@trillboards/edge-sdk 0.2.21 → 0.2.24

package/dist/localNetworkAccess.js

@@ -0,0 +1,490 @@
+"use strict";
+/**
+ * macOS **Local Network** (TCC) access detection.
+ *
+ * ## Why this file exists
+ *
+ * On macOS 15+ every process that talks to a private-IP LAN host is gated by
+ * the *Local Network* privacy grant. The connector's whole camera surface is
+ * LAN traffic — ONVIF WS-Discovery multicast, the subnet TCP sweep, and RTSP
+ * frame capture — so a missing grant takes every camera offline at once.
+ *
+ * The failure it produces is not silence, it is **misattribution**: ffmpeg
+ * reports "no route to host", `classifyRtspFailureClass` maps that to
+ * `rtsp_unreachable`, and the portal tells the operator to check that their
+ * camera and connector are on the same network. They are. The fix is a
+ * checkbox in System Settings that nobody was told to tick.
+ *
+ * ## What macOS actually exposes — measured, not assumed
+ *
+ * Measured on macOS 26.5.2 (arm64) on 2026-08-14:
+ *
+ * - The grant is **not readable**. `kTCCServiceLocalNetwork` does not exist in
+ *   `tccd`'s service table (positive control: `kTCCServiceCamera` is present),
+ *   there is no row in either TCC.db, and `tccutil` cannot address it. The
+ *   decision is owned by `nehelper` (`com.apple.network.localnetworkdecision`)
+ *   and is not exposed to a client process by any public or file-level means.
+ *   **So the state must be inferred from behaviour.**
+ *
+ * - Denial has a sharp, specific signature. The *same* binary, same machine,
+ *   same network, same minute, differing only in who launched it:
+ *
+ *   | operation                        | LAN allowed          | LAN denied           |
+ *   |----------------------------------|----------------------|----------------------|
+ *   | `sendto` 239.255.255.250:3702    | sent                 | **EHOSTUNREACH, 0 ms** |
+ *   | `connect` gateway:80 (host up)   | connected, 4 ms      | **EHOSTUNREACH, 1 ms** |
+ *   | `connect` gateway:9 (port shut)  | ECONNREFUSED, 1005 ms| **EHOSTUNREACH, 0 ms** |
+ *   | `connect` 192.168.0.222 (no host)| timeout, 3004 ms     | timeout, 3193 ms     |
+ *   | `connect` 127.0.0.1 (loopback)   | connected            | connected            |
+ *
+ * Two things in that table are the entire design:
+ *
+ * 1. **The absent host times out in BOTH states.** A probe that only tries the
+ *    camera can never tell "denied" from "the NVR is off", because they look
+ *    identical. That is precisely the bug, so a probe that reproduces it is
+ *    worthless.
+ *
+ * 2. **Multicast `sendto` is the clean discriminator.** An empty network
+ *    segment still *accepts* a multicast send — nothing answers, but the send
+ *    succeeds. Only the TCC gate makes `sendto` itself fail. And an immediate
+ *    `EHOSTUNREACH` toward an address on the machine's own directly-connected
+ *    subnet cannot come from routing: the kernel has a connected route there by
+ *    construction, and a missing host shows up as an ARP timeout instead.
+ *
+ * Loopback is deliberately only a control, never evidence: it is never gated,
+ * so it succeeds in both states and separates nothing.
+ *
+ * ## Why NOT the default gateway
+ *
+ * The obvious probe — `route -n get default` — is wrong, and measurably so.
+ * On the test machine the default route is a Tailscale `utun` interface, and
+ * under a denied grant that endpoint answered `ECONNREFUSED` in the same run
+ * where the real LAN returned `EHOSTUNREACH`. A VPN default route is not a LAN
+ * host and is not gated, so probing it reports "the LAN is fine" every time and
+ * sends the operator straight back to debugging the recorder. Probe targets are
+ * therefore derived from the machine's **own directly-connected IPv4 subnets**
+ * via `os.networkInterfaces()`, never from the default route.
+ *
+ * ## Failing safe
+ *
+ * Every ambiguous outcome resolves to `unknown`, never to `denied`. Positive
+ * evidence that the LAN is reachable (a completed connect, or an RST) vetoes a
+ * denial verdict outright. Claiming a permission problem that isn't there sends
+ * the operator to the wrong place just as surely as the bug this replaces.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOCAL_NETWORK_DENIED_SUMMARY = exports.LOCAL_NETWORK_DENIED_SUGGESTION = void 0;
+exports.probeLocalNetworkAccess = probeLocalNetworkAccess;
+exports.decideLocalNetworkVerdict = decideLocalNetworkVerdict;
+const dgram = __importStar(require("dgram"));
+const net = __importStar(require("net"));
+const os = __importStar(require("os"));
+/** WS-Discovery group — the exact target `discovery.ts` probes. */
+const WSD_MULTICAST_ADDR = '239.255.255.250';
+const WSD_MULTICAST_PORT = 3702;
+/**
+ * A connect that fails this fast never left the host. Real LAN round trips —
+ * even an RST from a directly-attached router — were measured at ~1 s; the
+ * blocked path returned in 0-1 ms. 250 ms is two orders of magnitude of margin
+ * on the blocked side and well under the observed floor on the allowed side.
+ */
+const IMMEDIATE_FAILURE_MS = 250;
+/** Per-target TCP budget. Absent hosts hit this; blocked ones never get near it. */
+const DEFAULT_TCP_TIMEOUT_MS = 1200;
+/** errno names macOS returns for a gated local-network operation. */
+const BLOCKED_ERROR_CODES = new Set(['EHOSTUNREACH', 'ENETUNREACH', 'EPERM', 'EACCES']);
+/** Ports worth trying on a LAN neighbour: a closed one is as good as an open one. */
+const PROBE_PORTS = [80, 443];
+/** IPv4 dotted-quad → uint32. */
+function ipv4ToInt(ip) {
+    const parts = ip.split('.');
+    if (parts.length !== 4)
+        return null;
+    let out = 0;
+    for (const part of parts) {
+        const n = Number(part);
+        if (!Number.isInteger(n) || n < 0 || n > 255)
+            return null;
+        out = (out << 8) | n;
+    }
+    return out >>> 0;
+}
+function intToIpv4(value) {
+    return [(value >>> 24) & 255, (value >>> 16) & 255, (value >>> 8) & 255, value & 255].join('.');
+}
+/**
+ * Directly-connected IPv4 subnets. These are the only place an immediate
+ * `EHOSTUNREACH` is diagnostic: the kernel has a route to them by construction,
+ * so an instant refusal there came from something above routing.
+ */
+function connectedSubnets(ifaces) {
+    const out = [];
+    for (const infos of Object.values(ifaces)) {
+        if (!infos)
+            continue;
+        for (const info of infos) {
+            // Node <18 reports `family` as 'IPv4'; newer builds may use 4.
+            const isV4 = info.family === 'IPv4' || info.family === 4;
+            if (!isV4 || info.internal)
+                continue;
+            const addr = ipv4ToInt(info.address);
+            const mask = info.netmask ? ipv4ToInt(info.netmask) : null;
+            if (addr === null || mask === null || mask === 0)
+                continue;
+            // A /32 (point-to-point tunnel: VPN, utun) has no local segment to probe.
+            if (mask === 0xffffffff)
+                continue;
+            out.push({
+                address: info.address,
+                netmask: info.netmask,
+                network: (addr & mask) >>> 0,
+                mask,
+            });
+        }
+    }
+    return out;
+}
+/**
+ * Every IPv4 address this host owns — loopback and point-to-point tunnels
+ * included, which is why this does NOT reuse `connectedSubnets`' filters.
+ *
+ * A connection to one of our own addresses never leaves the box, so it is
+ * never subject to the Local Network gate: it answers (or RSTs) identically
+ * whether the grant is allowed or denied. Probing one would therefore produce
+ * a `reachableTarget` that is not evidence of anything, and `decideVerdict`
+ * treats a reachable target as a VETO over a blocked multicast send — so a
+ * self-probe does not merely add noise, it converts a real `denied` into
+ * `granted` and puts us straight back to reporting `rtsp_unreachable` while
+ * macOS blocks every camera.
+ *
+ * This is not hypothetical: the `.1` convention in `buildTargets` picks the
+ * host's OWN address on any subnet where this Mac is the router — Internet
+ * Sharing (192.168.2.1), and the host-only bridges VMware/Parallels/VirtualBox
+ * install (172.16.x.1, 10.211.55.1, 192.168.56.1). Those interfaces are
+ * non-internal and carry a real netmask, so they survive every other filter.
+ */
+function ownAddresses(ifaces) {
+    const own = new Set();
+    for (const infos of Object.values(ifaces)) {
+        if (!infos)
+            continue;
+        for (const info of infos) {
+            const isV4 = info.family === 'IPv4' || info.family === 4;
+            if (isV4 && info.address)
+                own.add(info.address);
+        }
+    }
+    return own;
+}
+function isOnConnectedSubnet(host, subnets) {
+    const addr = ipv4ToInt(host);
+    if (addr === null)
+        return false;
+    return subnets.some((s) => ((addr & s.mask) >>> 0) === s.network);
+}
+/**
+ * Probe targets, best first.
+ *
+ * Configured camera hosts lead because they are known-real LAN devices. The
+ * conventional `.1` follows: on a /24 it is the router in the overwhelming
+ * majority of deployments, and — critically — a *closed port* on it is just as
+ * useful as an open one, because an RST proves the packet made the round trip.
+ *
+ * `own` removes this host's own addresses from both sources. Only an
+ * off-box destination can carry information about a gate that exists to
+ * mediate off-box destinations; see `ownAddresses`.
+ */
+function buildTargets(subnets, extraHosts, own) {
+    const targets = [];
+    const seen = new Set();
+    const push = (host) => {
+        if (!host || seen.has(host) || own.has(host))
+            return;
+        seen.add(host);
+        targets.push(host);
+    };
+    for (const host of extraHosts) {
+        if (isOnConnectedSubnet(host, subnets))
+            push(host);
+    }
+    for (const subnet of subnets) {
+        push(intToIpv4((subnet.network | 1) >>> 0));
+    }
+    return targets;
+}
+function tcpProbe(host, port, timeoutMs) {
+    return new Promise((resolve) => {
+        const startedAt = Date.now();
+        const socket = new net.Socket();
+        let settled = false;
+        const finish = (outcome, code) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.destroy();
+            }
+            catch {
+                /* already gone */
+            }
+            resolve({ target: `${host}:${port}`, outcome, code, elapsedMs: Date.now() - startedAt });
+        };
+        socket.setTimeout(timeoutMs, () => finish('silent'));
+        socket.once('connect', () => finish('reachable'));
+        socket.once('error', (err) => {
+            const code = err.code ?? 'UNKNOWN';
+            const elapsed = Date.now() - startedAt;
+            // An RST is positive proof the LAN carried our packet and brought an
+            // answer back — it means the host is there and declining, not blocked.
+            if (code === 'ECONNREFUSED' || code === 'ECONNRESET')
+                return finish('reachable', code);
+            // Blocked errnos only count when they arrive impossibly fast. The same
+            // errno after a real timeout is an ordinary unreachable host.
+            if (BLOCKED_ERROR_CODES.has(code) && elapsed <= IMMEDIATE_FAILURE_MS) {
+                return finish('blocked', code);
+            }
+            finish('silent', code);
+        });
+        try {
+            socket.connect(port, host);
+        }
+        catch (err) {
+            finish('silent', err?.code);
+        }
+    });
+}
+/**
+ * The WS-Discovery multicast send — the single strongest signal available.
+ *
+ * An empty LAN still accepts this datagram; only the TCC gate rejects the
+ * `sendto` itself. Nothing is expected to answer, so no listener is set up.
+ */
+function multicastProbe(interfaceAddress) {
+    return new Promise((resolve) => {
+        let socket;
+        try {
+            socket = dgram.createSocket({ type: 'udp4', reuseAddr: true });
+        }
+        catch (err) {
+            return resolve({ result: 'error', code: err?.code });
+        }
+        let settled = false;
+        const finish = (result, code) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                socket.close();
+            }
+            catch {
+                /* already closed */
+            }
+            resolve({ result, code });
+        };
+        const classify = (code) => code && BLOCKED_ERROR_CODES.has(code) ? finish('blocked', code) : finish('error', code);
+        socket.once('error', (err) => classify(err.code));
+        // Guard against a socket that never settles for any reason.
+        const guard = setTimeout(() => finish('error', 'ETIMEDOUT'), 2000);
+        if (typeof guard.unref === 'function')
+            guard.unref();
+        try {
+            socket.bind(0, () => {
+                try {
+                    socket.setMulticastTTL(1);
+                    // Pin the egress to the LAN interface. Without this the kernel picks
+                    // one from the route table, and on a host with Tailscale/ZeroTier/a
+                    // corporate VPN that route is the tunnel — `route to 239.255.255.250
+                    // -> utun4` was measured on the very machine this was developed on,
+                    // while the cameras sat on en0. A probe that leaves down the tunnel
+                    // is not testing the path the cameras are on.
+                    if (interfaceAddress)
+                        socket.setMulticastInterface(interfaceAddress);
+                }
+                catch {
+                    /* not fatal — the send is what we are measuring */
+                }
+                const payload = Buffer.from('<trillboards:probe/>');
+                socket.send(payload, 0, payload.length, WSD_MULTICAST_PORT, WSD_MULTICAST_ADDR, (err) => {
+                    clearTimeout(guard);
+                    if (err)
+                        return classify(err.code);
+                    finish('sent');
+                });
+            });
+        }
+        catch (err) {
+            clearTimeout(guard);
+            classify(err?.code);
+        }
+    });
+}
+/**
+ * Decide whether this process can reach the local network.
+ *
+ * Never throws, never rejects. Ambiguity always resolves toward `unknown`.
+ */
+async function probeLocalNetworkAccess(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const emptyEvidence = {
+        multicastSend: 'skipped',
+        silentTargets: [],
+        loopbackUsable: false,
+        subnets: [],
+    };
+    // Only macOS gates local-network traffic. Reporting anything else on Linux or
+    // Windows would invent a permission problem that cannot exist there.
+    if (platform !== 'darwin') {
+        return {
+            verdict: 'not_applicable',
+            reason: `${platform} has no Local Network permission gate`,
+            evidence: emptyEvidence,
+        };
+    }
+    const ifaces = (options.networkInterfaces ?? os.networkInterfaces)();
+    const subnets = connectedSubnets(ifaces);
+    const evidence = {
+        ...emptyEvidence,
+        subnets: subnets.map((s) => `${s.address}/${s.netmask}`),
+    };
+    if (subnets.length === 0) {
+        return {
+            verdict: 'unknown',
+            reason: 'no directly-connected IPv4 network — cannot assess Local Network access',
+            evidence,
+        };
+    }
+    const timeoutMs = options.tcpTimeoutMs ?? DEFAULT_TCP_TIMEOUT_MS;
+    const runTcp = options.tcpProbeImpl ?? tcpProbe;
+    const runMulticast = options.multicastProbeImpl ?? multicastProbe;
+    // Control: prove this process can open sockets at all. Loopback is never
+    // gated, so a failure here means something other than a Local Network denial.
+    // ECONNREFUSED on a closed port is the expected, healthy answer.
+    const loopback = await runTcp('127.0.0.1', 9, Math.min(timeoutMs, 500));
+    evidence.loopbackUsable = loopback.outcome === 'reachable' || loopback.outcome === 'silent';
+    const multicast = await runMulticast(subnets[0].address);
+    evidence.multicastSend = multicast.result;
+    if (multicast.code)
+        evidence.multicastErrorCode = multicast.code;
+    const targets = buildTargets(subnets, options.extraHosts ?? [], ownAddresses(ifaces));
+    for (const host of targets) {
+        for (const port of PROBE_PORTS) {
+            const outcome = await runTcp(host, port, timeoutMs);
+            if (outcome.outcome === 'reachable') {
+                evidence.reachableTarget = outcome.target;
+                break;
+            }
+            if (outcome.outcome === 'blocked') {
+                evidence.blockedTarget = outcome.target;
+                break;
+            }
+            evidence.silentTargets.push(outcome.target);
+        }
+        // Positive reachability is decisive; stop as soon as we have it.
+        if (evidence.reachableTarget)
+            break;
+    }
+    const decision = decideLocalNetworkVerdict(evidence);
+    return { ...decision, evidence };
+}
+/**
+ * The verdict rule, isolated from all I/O.
+ *
+ * Split out so it can be driven from the socket outcomes *recorded on a Mac
+ * that was actually blocked*. The OS-level denial could not be re-induced on
+ * demand after it cleared, so replaying the measured evidence through this
+ * exact function is the only way the `denied` branch gets tested against real
+ * data rather than against an invented signature.
+ */
+function decideLocalNetworkVerdict(evidence) {
+    // Anything on the local segment answered us — the grant cannot be missing.
+    // This veto runs first on purpose: it is the only unambiguous evidence here.
+    if (evidence.reachableTarget) {
+        return {
+            verdict: 'granted',
+            reason: `local network reachable (${evidence.reachableTarget} answered)`,
+        };
+    }
+    if (!evidence.loopbackUsable) {
+        return {
+            verdict: 'unknown',
+            reason: 'loopback socket unusable — this process cannot open sockets at all',
+        };
+    }
+    // The multicast send is the discriminator. An empty segment still ACCEPTS the
+    // datagram — nothing answers, but `sendto` succeeds — so a refusal here is not
+    // something an absent camera, an absent recorder, or an empty VLAN can produce.
+    if (evidence.multicastSend === 'blocked') {
+        const corroborated = Boolean(evidence.blockedTarget);
+        return {
+            verdict: 'denied',
+            reason: corroborated
+                ? `Local Network permission denied: multicast send refused (${evidence.multicastErrorCode}) ` +
+                    `and ${evidence.blockedTarget} refused instantly on a directly-connected subnet`
+                : `Local Network permission denied: multicast send to ${WSD_MULTICAST_ADDR} refused ` +
+                    `(${evidence.multicastErrorCode}) while loopback works`,
+        };
+    }
+    // An instant blocked errno toward our own subnet, without the multicast
+    // corroboration, is suggestive but not conclusive — say so rather than guess.
+    // A reject route produces exactly this shape, and it is NOT a TCC denial.
+    if (evidence.blockedTarget) {
+        return {
+            verdict: 'unknown',
+            reason: `${evidence.blockedTarget} refused instantly on a directly-connected subnet, ` +
+                'but the multicast probe was not refused — inconclusive',
+        };
+    }
+    return {
+        verdict: 'unknown',
+        reason: evidence.silentTargets.length > 0
+            ? `no answer from ${evidence.silentTargets.length} local target(s) — ` +
+                'the segment may simply be empty'
+            : 'no probeable local targets found',
+    };
+}
+/**
+ * The operator-facing instruction for a denied grant.
+ *
+ * Names the pane and says plainly that a human has to be at the machine, because
+ * the one thing that cannot be automated here is the only thing that fixes it.
+ */
+exports.LOCAL_NETWORK_DENIED_SUGGESTION = 'Open System Settings › Privacy & Security › Local Network and turn on access for ' +
+    'Trillboards. Someone has to do this at the Mac itself — the grant cannot be enabled remotely, ' +
+    'and macOS only offers it to an app a person is signed in to.';
+/** Same message, one line, for a log or a health beacon. */
+exports.LOCAL_NETWORK_DENIED_SUMMARY = 'macOS is blocking this connector from reaching the local network ' +
+    '(System Settings › Privacy & Security › Local Network)';
+//# sourceMappingURL=localNetworkAccess.js.map

package/dist/localNetworkAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localNetworkAccess.js","sourceRoot":"","sources":["../src/localNetworkAccess.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmVH,0DAsEC;AAWD,8DAsDC;AAxdD,6CAA+B;AAC/B,yCAA2B;AAC3B,uCAAyB;AAEzB,mEAAmE;AACnE,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAC7C,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAEjC,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,qEAAqE;AACrE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExF,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAAC,EAAE,EAAE,GAAG,CAAU,CAAC;AAuEvC,iCAAiC;AACjC,SAAS,SAAS,CAAC,EAAU;IAC3B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,OAAO,IAAI,CAAC;QAC1D,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AASD;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,MAA8C;IAE9C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,+DAA+D;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAK,IAAI,CAAC,MAA4B,KAAK,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC;gBAAE,SAAS;YAC3D,0EAA0E;YAC1E,IAAI,IAAI,KAAK,UAAU;gBAAE,SAAS;YAClC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC;gBAC5B,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,YAAY,CAAC,MAA8C;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAK,IAAI,CAAC,MAA4B,KAAK,CAAC,CAAC;YAChF,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,OAA0B;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CACnB,OAA0B,EAC1B,UAAoB,EACpB,GAAwB;IAExB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,OAAmC,EAAE,IAAa,EAAE,EAAE;YACpE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAC3F,CAAC,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACvC,qEAAqE;YACrE,uEAAuE;YACvE,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,YAAY;gBAAE,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACvF,uEAAuE;YACvE,8DAA8D;YAC9D,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,oBAAoB,EAAE,CAAC;gBACrE,OAAO,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,QAAQ,EAAG,GAA6B,EAAE,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,gBAAyB;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAG,GAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAoC,EAAE,IAAa,EAAE,EAAE;YACrE,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAE,EAAE,CAC5C,IAAI,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAE1F,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,4DAA4D;QAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAErD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE;gBAClB,IAAI,CAAC;oBACH,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;oBAC1B,qEAAqE;oBACrE,oEAAoE;oBACpE,qEAAqE;oBACrE,oEAAoE;oBACpE,oEAAoE;oBACpE,8CAA8C;oBAC9C,IAAI,gBAAgB;wBAAE,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;gBACvE,CAAC;gBAAC,MAAM,CAAC;oBACP,mDAAmD;gBACrD,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;gBACpD,MAAM,CAAC,IAAI,CACT,OAAO,EACP,CAAC,EACD,OAAO,CAAC,MAAM,EACd,kBAAkB,EAClB,kBAAkB,EAClB,CAAC,GAAiC,EAAE,EAAE;oBACpC,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,GAAG;wBAAE,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACnC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjB,CAAC,CACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,QAAQ,CAAE,GAA6B,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,uBAAuB,CAC3C,UAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,MAAM,aAAa,GAA8B;QAC/C,aAAa,EAAE,SAAS;QACxB,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,KAAK;QACrB,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,GAAG,QAAQ,uCAAuC;YAC1D,QAAQ,EAAE,aAAa;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAA8B;QAC1C,GAAG,aAAa;QAChB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;KACzD,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,yEAAyE;YACjF,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,IAAI,QAAQ,CAAC;IAChD,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,IAAI,cAAc,CAAC;IAElE,yEAAyE;IACzE,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IACxE,QAAQ,CAAC,cAAc,GAAG,QAAQ,CAAC,OAAO,KAAK,WAAW,IAAI,QAAQ,CAAC,OAAO,KAAK,QAAQ,CAAC;IAE5F,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC;IAC1C,IAAI,SAAS,CAAC,IAAI;QAAE,QAAQ,CAAC,kBAAkB,GAAG,SAAS,CAAC,IAAI,CAAC;IAEjE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;gBACpC,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;gBAC1C,MAAM;YACR,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAClC,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;gBACxC,MAAM;YACR,CAAC;YACD,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;QACD,iEAAiE;QACjE,IAAI,QAAQ,CAAC,eAAe;YAAE,MAAM;IACtC,CAAC;IAED,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CACvC,QAAmC;IAEnC,2EAA2E;IAC3E,6EAA6E;IAC7E,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,4BAA4B,QAAQ,CAAC,eAAe,YAAY;SACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACrD,OAAO;YACL,OAAO,EAAE,QAAQ;YACjB,MAAM,EAAE,YAAY;gBAClB,CAAC,CAAC,4DAA4D,QAAQ,CAAC,kBAAkB,IAAI;oBAC3F,OAAO,QAAQ,CAAC,aAAa,mDAAmD;gBAClF,CAAC,CAAC,sDAAsD,kBAAkB,WAAW;oBACnF,IAAI,QAAQ,CAAC,kBAAkB,wBAAwB;SAC5D,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,SAAS;YAClB,MAAM,EACJ,GAAG,QAAQ,CAAC,aAAa,qDAAqD;gBAC9E,wDAAwD;SAC3D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,SAAS;QAClB,MAAM,EACJ,QAAQ,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,kBAAkB,QAAQ,CAAC,aAAa,CAAC,MAAM,qBAAqB;gBACpE,iCAAiC;YACnC,CAAC,CAAC,kCAAkC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACU,QAAA,+BAA+B,GAC1C,mFAAmF;IACnF,gGAAgG;IAChG,8DAA8D,CAAC;AAEjE,4DAA4D;AAC/C,QAAA,4BAA4B,GACvC,mEAAmE;IACnE,wDAAwD,CAAC"}

package/dist/sensingRunMode.d.ts

@@ -73,6 +73,17 @@ export declare const NO_FEEDS_MESSAGE: string;
  * 24/7 log, short enough that an operator watching an install sees it.
  */
 export declare const SENSING_HEALTH_LOG_INTERVAL_MS: number;
+/**
+ * How often a CONTINUING transport failure is restated after its first report.
+ *
+ * A TLS-inspecting proxy fails every upload on every feed, so an unthrottled
+ * report is 32 cameras x every cadence tick — which buries the one thing an
+ * operator needs to read under the noise it generates, and burns the 20 MB log
+ * budget doing it. The first occurrence and every CHANGE of cause are always
+ * reported in full; a continuing one restates itself on this interval with a
+ * count, so an operator who opens the log an hour later still sees it.
+ */
+export declare const TRANSPORT_FAILURE_RESTATE_INTERVAL_MS: number;
 /**
  * The operator-facing degradation line. A machine that cannot analyze 16
  * cameras every 30 s is not a bug to hide — it is a capacity fact to state, in
@@ -80,6 +91,31 @@ export declare const SENSING_HEALTH_LOG_INTERVAL_MS: number;
  * at, how many analyses/minute this machine sustains, and where the rest went.
  */
 export declare function formatSensingHealth(health: ReturnType<CloudSensingManager['getSensingHealth']>): string;
+/**
+ * Wire the manager's lifecycle events to the IO sink — identical for both modes
+ * except the per-frame "analyzed" line (cloud says `analyze →`, local says
+ * `local→preAnalyzed →`).
+ *
+ * The cascade's per-frame outcomes (`motionSkipped`, `admissionDenied`) are
+ * deliberately NOT logged per event: on a saturated 16-camera connector they
+ * would be tens of thousands of lines a day and would bury the events that
+ * need a human. They stay on the EventEmitter for embedders, and reach the
+ * operator as counts on the periodic capacity line below.
+ */
+/**
+ * The operator-facing reporter for "I cannot reach the API, and here is why".
+ *
+ * Returns `true` from `report()` when it handled the error, so the caller can
+ * fall through to its ordinary per-feed line for everything else.
+ *
+ * Exported for tests: the properties worth pinning are that the FIRST failure
+ * is stated in full, that a CHANGE of cause is stated in full (otherwise a
+ * fixed trust problem followed by a proxy problem would be silent), and that a
+ * continuing one is throttled rather than repeated per feed per tick.
+ */
+export declare function createTransportFailureReporter(io: SensingIo, now?: () => number): {
+    report(name: string, error: Error): boolean;
+};
 /**
  * Build (but do NOT start) the thin cloud-sensing manager: RTSP frame → POST
  * /v2/earner/audience-analyze (cloud VLM does the inference). Returns `null`

package/dist/sensingRunMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sensingRunMode.d.ts","sourceRoot":"","sources":["../src/sensingRunMode.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAInB,KAAK,YAAY,EAElB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAMhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,YAAY,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7B;AA2CD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,IAAI;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KACxC,CAAC;CACH;AAED,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,SAIvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAEgD,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAuN5D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,GAC1D,MAAM,CA6CR;AAwED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,EAAE,GAAE,SAAqB,EACzB,IAAI,CAAC,EAAE,kBAAkB,GACxB,mBAAmB,GAAG,IAAI,CAiE5B;AAqCD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,EAAE,GAAE,SAAqB,EACzB,IAAI,CAAC,EAAE,kBAAkB,GACxB,mBAAmB,GAAG,IAAI,CAyF5B"}
+{"version":3,"file":"sensingRunMode.d.ts","sourceRoot":"","sources":["../src/sensingRunMode.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EAInB,KAAK,YAAY,EAElB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAExD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAOhD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,CAClB,IAAI,EAAE,YAAY,EAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,KAAK,KACT,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC7B;AA2CD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,IAAI;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;KACxC,CAAC;CACH;AAED,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3B,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B;AAED,qEAAqE;AACrE,eAAO,MAAM,SAAS,EAAE,SAIvB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAEgD,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,QAAgB,CAAC;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,qCAAqC,QAAiB,CAAC;AAuNpE;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,UAAU,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC,GAC1D,MAAM,CA6CR;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,SAAS,EACb,GAAG,GAAE,MAAM,MAAiB,GAC3B;IAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAA;CAAE,CA+BjD;AAoED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,EAAE,GAAE,SAAqB,EACzB,IAAI,CAAC,EAAE,kBAAkB,GACxB,mBAAmB,GAAG,IAAI,CAiE5B;AAqCD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,eAAe,EACvB,EAAE,GAAE,SAAqB,EACzB,IAAI,CAAC,EAAE,kBAAkB,GACxB,mBAAmB,GAAG,IAAI,CAyF5B"}

package/dist/sensingRunMode.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSING_HEALTH_LOG_INTERVAL_MS = exports.NO_FEEDS_MESSAGE = exports.consoleIo = void 0;
+exports.TRANSPORT_FAILURE_RESTATE_INTERVAL_MS = exports.SENSING_HEALTH_LOG_INTERVAL_MS = exports.NO_FEEDS_MESSAGE = exports.consoleIo = void 0;
 exports.formatSensingHealth = formatSensingHealth;
+exports.createTransportFailureReporter = createTransportFailureReporter;
 exports.buildCloudSensingManager = buildCloudSensingManager;
 exports.buildLocalSensingManager = buildLocalSensingManager;
 const CloudSensingManager_1 = require("./CloudSensingManager");
@@ -9,6 +10,7 @@ const localSensing_1 = require("./localSensing");
 const SensingProfileClient_1 = require("./SensingProfileClient");
 const deployedCadenceSource_1 = require("./deployedCadenceSource");
 const RecorderAddressRecovery_1 = require("./RecorderAddressRecovery");
+const transportFailure_1 = require("./transportFailure");
 /**
  * Shared construction of the cloud- and local-sensing managers.
  *
@@ -62,6 +64,17 @@ exports.NO_FEEDS_MESSAGE = 'No camera feeds configured. Set `cameras: [{ name, s
  * 24/7 log, short enough that an operator watching an install sees it.
  */
 exports.SENSING_HEALTH_LOG_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * How often a CONTINUING transport failure is restated after its first report.
+ *
+ * A TLS-inspecting proxy fails every upload on every feed, so an unthrottled
+ * report is 32 cameras x every cadence tick — which buries the one thing an
+ * operator needs to read under the noise it generates, and burns the 20 MB log
+ * budget doing it. The first occurrence and every CHANGE of cause are always
+ * reported in full; a continuing one restates itself on this interval with a
+ * count, so an operator who opens the log an hour later still sees it.
+ */
+exports.TRANSPORT_FAILURE_RESTATE_INTERVAL_MS = 10 * 60 * 1000;
 const CADENCE_CLAMP_WORDING = {
     no_request: '',
     operator_request: '',
@@ -319,6 +332,47 @@ function formatSensingHealth(health) {
  * need a human. They stay on the EventEmitter for embedders, and reach the
  * operator as counts on the periodic capacity line below.
  */
+/**
+ * The operator-facing reporter for "I cannot reach the API, and here is why".
+ *
+ * Returns `true` from `report()` when it handled the error, so the caller can
+ * fall through to its ordinary per-feed line for everything else.
+ *
+ * Exported for tests: the properties worth pinning are that the FIRST failure
+ * is stated in full, that a CHANGE of cause is stated in full (otherwise a
+ * fixed trust problem followed by a proxy problem would be silent), and that a
+ * continuing one is throttled rather than repeated per feed per tick.
+ */
+function createTransportFailureReporter(io, now = Date.now) {
+    let lastClass = null;
+    let lastFullReportAtMs = 0;
+    let sinceLastReport = 0;
+    const feeds = new Set();
+    return {
+        report(name, error) {
+            if (!(error instanceof transportFailure_1.TransportFailure))
+                return false;
+            feeds.add(name);
+            sinceLastReport++;
+            const at = now();
+            const isNewCause = error.failureClass !== lastClass;
+            const isDue = at - lastFullReportAtMs >= exports.TRANSPORT_FAILURE_RESTATE_INTERVAL_MS;
+            if (!isNewCause && !isDue)
+                return true;
+            const suppressed = sinceLastReport - 1;
+            for (const line of (0, transportFailure_1.formatTransportFailure)(error))
+                io.error(line);
+            io.error(`  Affected feeds: ${[...feeds].join(', ')}` +
+                (suppressed > 0 ? ` (${suppressed} further attempt(s) since the last report)` : ''));
+            lastClass = error.failureClass;
+            lastFullReportAtMs = at;
+            sinceLastReport = 0;
+            feeds.clear();
+            feeds.add(name);
+            return true;
+        },
+    };
+}
 function wireSensingLogs(manager, io, analyzedLine) {
     manager.on('analyzed', ({ name, response }) => {
         io.log(analyzedLine(name, response));
@@ -344,7 +398,15 @@ function wireSensingLogs(manager, io, analyzedLine) {
     manager.on('reconnected', ({ name }) => {
         io.log(`[${name}] RTSP reconnected — sensing resumed`);
     });
+    const transportReporter = createTransportFailureReporter(io);
     manager.on('error', ({ name, error }) => {
+        // A TRANSPORT failure is not a feed error and must not be filed as one:
+        // nothing reached the server, so there is no status code, the health beacon
+        // cannot get through either, and the fix is on the customer's network. It
+        // gets its own block naming the cause and the action. A REJECTION — the
+        // server answering non-2xx — stays on `analyzeRejected` with its status.
+        if (transportReporter.report(name, error))
+            return;
         io.error(`[${name}] error: ${error.message}`);
     });
     // Periodic capacity line. `unref()` so it can never hold the process open.