@trillboards/edge-sdk 0.2.3 → 0.2.6

package/dist/localSensing.js

@@ -0,0 +1,492 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalSensingClient = void 0;
+exports.fieldSetForProfileType = fieldSetForProfileType;
+exports.isAlertWorthy = isAlertWorthy;
+exports.alertSignature = alertSignature;
+exports.isCloudEscalationEnabled = isCloudEscalationEnabled;
+exports.buildLocalSensingLoops = buildLocalSensingLoops;
+const AudienceAnalyzeClient_1 = require("./AudienceAnalyzeClient");
+const LiteRtVlmProvider_1 = require("./LiteRtVlmProvider");
+const SensingProfileClient_1 = require("./SensingProfileClient");
+const CloudSensingManager_1 = require("./CloudSensingManager");
+const localInferenceSchema_1 = require("./localInferenceSchema");
+const CloudEscalationPolicy_1 = require("./CloudEscalationPolicy");
+const legacyRecorderProfile_1 = require("./legacyRecorderProfile");
+/** How long a fetched profile is cached before the connector re-checks for a new alert. */
+const DEFAULT_PROFILE_TTL_MS = 5 * 60 * 1000;
+/**
+ * The server's own name for a Sense-Anything profile — one an operator authored
+ * from their venue intent, as opposed to a seeded DOOH audience preset.
+ * `sensingProfileService.createProfile` defaults `profile_type` to this and
+ * derives `profile_origin='custom_intent'` from it; 147 of the 157 active
+ * profiles carried it on 2026-08-11.
+ */
+const CUSTOM_INTENT_PROFILE_TYPE = 'custom_intent';
+/**
+ * Map a deployed profile's SELF-DESCRIBING type to the on-device field set.
+ *
+ * A Sense-Anything (`custom_intent`) profile asked a specific operational
+ * question about the operator's own venue, so the on-device model is asked for
+ * that profile's fields plus the presence primitives — NOT the 12 DOOH audience
+ * fields, which answer nothing the operator asked and cost 1.09-1.53x the
+ * per-frame latency depending on delegate (measured; see localInferenceSchema's
+ * header). Every other type — a seeded builtin preset, or NO deployed profile at
+ * all — is a screen/audience measurement deployment and keeps the full audience
+ * contract.
+ *
+ * This reads the kind the SERVER already reports rather than an allowlist of
+ * profile names maintained on the device.
+ */
+function fieldSetForProfileType(profileType) {
+    return profileType === CUSTOM_INTENT_PROFILE_TYPE ? 'operator' : 'audience';
+}
+/**
+ * Sentinel values the schema uses for an EMPTY scene (see localInferenceSchema):
+ * audience_* enums collapse to 'none'/'unclear', crowd_density to 'empty',
+ * narratives to '' when no people are present. A custom enum's "nothing here"
+ * value typically reads the same ('empty'/'unknown'). Treated as "no signal" so
+ * a blank room doesn't ship a frame.
+ */
+const EMPTY_SCENE_SENTINELS = new Set(['', 'none', 'unclear', 'empty', 'unknown']);
+/**
+ * Keys ignored by the gate — they don't DISCRIMINATE an empty scene from a busy
+ * one, so gating on them would attach a frame to every observation (defeating
+ * the privacy filter):
+ *   - source / captured_at: connector-stamped provenance + time (never a signal);
+ *   - confidence: a meta score the model emits ~always > 0 even for a blank room;
+ *   - scene_description: free text that is non-empty even when the scene is empty
+ *     ("an empty room") — not a meaningful route equality target.
+ * Discriminative scene fields (person_count, people_present, crowd_density,
+ * ad_receptivity_score, the audience_* enums, the narrative) are NOT ignored:
+ * each reads its empty-sentinel/0/false for a blank scene, so they correctly
+ * contribute no signal when empty but DO when people are present.
+ */
+const NON_DISCRIMINATIVE_KEYS = new Set(['source', 'captured_at', 'confidence', 'scene_description']);
+/**
+ * Decide whether an on-device result is potentially ALERT-WORTHY — the gate that
+ * keeps the evidence frame OFF the wire for an EMPTY/uninteresting scene (privacy
+ * + bandwidth) while still attaching it for any observation an operator route
+ * could fire on. Sense-Anything routes evaluate gt/gte/lt/lte/eq/neq over
+ * numbers (counts AND gauges), booleans, and strings/enums (routeEvaluatorService
+ * `compare()`), so the gate cannot be limited to "true boolean / positive count"
+ * — a gauge route (`avg_wait_minutes gt 5`) or an enum route
+ * (`shelf_state eq "empty"`) would otherwise fire WITHOUT a snapshot.
+ *
+ * A frame is attached when the result carries ANY meaningful signal:
+ *   - any boolean field that is `true` (safety_concern, people_present, a custom
+ *     shelf_empty, …);
+ *   - any positive finite number — a count (person_count / *_count) OR a gauge
+ *     (avg_wait_minutes, ad_receptivity_score, …);
+ *   - any non-empty array (a populated `list` custom field), or non-empty object
+ *     (a `distribution` field);
+ *   - any string/enum whose value is NOT an empty-scene sentinel
+ *     (''/none/unclear/empty/unknown) — e.g. shelf_state='low'.
+ * Non-discriminative keys (source, captured_at, confidence, scene_description)
+ * are ignored — see NON_DISCRIMINATIVE_KEYS for why.
+ *
+ * KNOWN BOUNDARY (deliberate privacy tradeoff): a route that alerts on ABSENCE
+ * — `person_count lte 0`, `people_present eq false`, `shelf_state eq "empty"` —
+ * fires on a genuinely empty scene, which this gate suppresses by design (a
+ * blank-room frame is exactly the privacy harm the gate exists to prevent). The
+ * server owns the route predicates and can request a frame for those routes;
+ * operators who want every frame can disable the gate (attachEvidenceFrame).
+ */
+function isAlertWorthy(result) {
+    if (!result || typeof result !== 'object')
+        return false;
+    for (const [key, value] of Object.entries(result)) {
+        if (NON_DISCRIMINATIVE_KEYS.has(key))
+            continue;
+        if (value === true)
+            return true;
+        if (typeof value === 'number') {
+            if (Number.isFinite(value) && value > 0)
+                return true;
+            continue;
+        }
+        if (typeof value === 'string') {
+            const v = value.trim().toLowerCase();
+            if (v.length > 0 && !EMPTY_SCENE_SENTINELS.has(v))
+                return true;
+            continue;
+        }
+        if (Array.isArray(value)) {
+            if (value.length > 0)
+                return true;
+            continue;
+        }
+        if (value && typeof value === 'object') {
+            if (Object.keys(value).length > 0)
+                return true;
+            continue;
+        }
+    }
+    return false;
+}
+/**
+ * A stable fingerprint of the ALERT-BEARING state of one result — "has the
+ * operator-visible situation changed?" in one comparable string.
+ *
+ * Built from EXACTLY the keys `isAlertWorthy` judges (NON_DISCRIMINATIVE_KEYS
+ * excluded), so the two can never drift: the same fields that decide whether a
+ * frame carries signal decide whether that signal is NEW. Keys are sorted so
+ * the model's property order cannot manufacture a change, and values are
+ * compared as emitted — a `queue_length` of 3 and of 4 are genuinely different
+ * facts and an operator route may key on exactly that boundary, so this
+ * deliberately does NOT bucket numbers into invented bands.
+ *
+ * Used by CloudEscalationPolicy's novelty bound: an unchanged signature means a
+ * verdict the cloud has already adjudicated, so the frame stays on-premises.
+ */
+function alertSignature(result) {
+    if (!result || typeof result !== 'object')
+        return '';
+    const parts = [];
+    for (const key of Object.keys(result).sort()) {
+        if (NON_DISCRIMINATIVE_KEYS.has(key))
+            continue;
+        const value = result[key];
+        // Arrays/objects (a `list` / `distribution` custom field) serialize
+        // structurally; scalars stringify. Undefined is elided so an absent key and
+        // an explicitly-undefined key read the same.
+        if (value === undefined)
+            continue;
+        parts.push(`${key}=${typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value)}`);
+    }
+    return parts.join('|');
+}
+/**
+ * Is cloud escalation actually ON for this local-sensing configuration?
+ *
+ * TWO settings decide it, and this is the ONLY place that combines them:
+ * `cloudEscalation.enabled` opts in, and `attachEvidenceFrame: false` — the
+ * operator's "no frame ever leaves this machine" switch — outranks it, because
+ * escalation sends a frame. `LocalSensingClient` enforces the rule and the
+ * startup banner reports it; they must read the same expression or the banner
+ * will one day claim an egress posture the client is not running.
+ */
+function isCloudEscalationEnabled(options) {
+    if (!options)
+        return false;
+    return options.cloudEscalation?.enabled === true && options.attachEvidenceFrame !== false;
+}
+/**
+ * LocalSensingClient — the SensingClient the cadence loop uses in LOCAL mode.
+ * It runs the VLM ON-DEVICE (LiteRtVlmProvider — Gemma 4 on LiteRT-LM via
+ * plain-completion + client-side schema validation, the real CCTV runtime) and
+ * POSTs the STRUCTURED result as `preAnalyzed` (uploadClient.analyzePreAnalyzed),
+ * skipping the cloud VLM. Implements the same `analyze({jpeg,captureMode})`
+ * shape AudienceAnalyzeClient exposes, so CloudSensingManager runs it UNCHANGED.
+ *
+ * PROFILE-DRIVEN: before analyzing, it fetches (and caches) the screen's active
+ * Sense-Anything profile via SensingProfileClient and rebuilds the constrained
+ * schema + prompt to include the operator's CUSTOM fields — the on-device
+ * equivalent of the cloud `buildProfileDrivenJsonSchema`. So a deployed alert
+ * like "queue_length >= 3" makes Gemma emit `queue_length`, which flows through
+ * preAnalyzed → OFV → the route → the webhook, exactly like the cloud VLM. The
+ * fetch is best-effort: on any failure the last-good (or default) schema is kept,
+ * so on-device sensing NEVER goes silent.
+ *
+ * The connector OVERRIDES `source='vlm_edge'` and `captured_at` (the actual
+ * capture time) — never trusting the model for provenance/time. The SERVER
+ * additionally forces provenance `local_connector` on the preAnalyzed ingest,
+ * gating local-inferred data out of the sold bidstream while still firing the
+ * operator's Sense-Anything routes.
+ *
+ * ── CLOUD ESCALATION (opt-in, Phase 6d) ─────────────────────────────────────
+ * Local Gemma is the always-on gate; the CLOUD is the judge for the frames it
+ * flags. When `cloudEscalation.enabled` and the policy admits this frame, the
+ * SAME JPEG is POSTed through the SAME upload client's `analyze()` — the cloud
+ * path the connector already owns — and the cloud VLM's verdict becomes the
+ * observation. Three properties are load-bearing:
+ *
+ *   1. ONE FRAME, ONE OBSERVATION. An escalated frame does NOT also post its
+ *      local `preAnalyzed` result. Posting both would double-count the same
+ *      physical frame and put two verdicts for one moment in the stream —
+ *      exactly the dual write the codebase forbids. The cloud verdict
+ *      supersedes; the local one was a sampling decision, not a datum.
+ *   2. NO PROVENANCE LAUNDERING. What lands is what the CLOUD inferred from a
+ *      real frame, so the server's normal cloud provenance is the truthful
+ *      stamp — identical to `cloud-sense` and to the existing
+ *      `cloudFallbackOnError` frame. Nothing the local model produced enters
+ *      that record, so `ingest_source='local_connector'` (which exists to keep
+ *      operator-forgeable structured input out of the sold bidstream) does not
+ *      apply and is not evaded: there IS no local structured input on this path.
+ *   3. THE PRIVACY GATE IS UNCHANGED. Escalation reuses `isAlertWorthy`, so the
+ *      set of frames that can leave the premises is exactly the set that
+ *      already leaves as evidence photos — and `attachEvidenceFrame: false`
+ *      (the operator's "no frame ever leaves" switch) disables escalation
+ *      outright. An empty scene never escalates.
+ *
+ * A failed cloud call falls back to posting the local result, so an escalation
+ * can degrade the ACCURACY of one frame but can never LOSE it.
+ */
+class LocalSensingClient {
+    constructor(localProvider, uploadClient, options = {}) {
+        this.localProvider = localProvider;
+        this.uploadClient = uploadClient;
+        this.lastProfileFetchMs = 0;
+        /** The active profile name (for logging / observability). */
+        this.activeProfileName = null;
+        /**
+         * Which field set the active profile resolved to (for logging / observability):
+         * 'operator' for a Sense-Anything profile, 'audience' for a DOOH preset or no
+         * profile. See fieldSetForProfileType.
+         */
+        this.activeFieldSet = 'audience';
+        this.profileClient = options.profileClient;
+        this.profileTtlMs = options.profileTtlMs ?? DEFAULT_PROFILE_TTL_MS;
+        this.baseSchema = options.schema ?? (0, localInferenceSchema_1.buildLocalSensingSchema)();
+        this.basePrompt = options.prompt ?? (0, localInferenceSchema_1.buildLocalSensingPrompt)();
+        this.cachedSchema = this.baseSchema;
+        this.cachedPrompt = this.basePrompt;
+        this.attachEvidenceFrame = options.attachEvidenceFrame !== false;
+        this.cloudFallbackOnError = options.cloudFallbackOnError === true;
+        this.feedName = options.feedName || 'local-sense';
+        // `attachEvidenceFrame: false` is the operator saying NO frame may ever
+        // leave this machine, and escalation sends a frame — isCloudEscalationEnabled
+        // is the one expression that resolves the pair (the startup banner reads the
+        // same one, so the two can never disagree).
+        this.escalationPolicy = new CloudEscalationPolicy_1.CloudEscalationPolicy({
+            ...(options.cloudEscalation || {}),
+            enabled: isCloudEscalationEnabled({
+                attachEvidenceFrame: this.attachEvidenceFrame,
+                cloudEscalation: options.cloudEscalation,
+            }),
+        });
+    }
+    getEndpoint() {
+        return this.uploadClient.getEndpoint();
+    }
+    reportCameraHealth(cameraHealth) {
+        return this.uploadClient.reportCameraHealth(cameraHealth);
+    }
+    /**
+     * Re-fetch the active profile if the cache is stale and rebuild the schema +
+     * prompt from its custom fields AND its KIND. Best-effort: a fetch failure
+     * keeps the existing schema (never disrupts an in-flight profile).
+     *
+     * The field set follows the profile's own reported type (fieldSetForProfileType):
+     * a Sense-Anything profile gets its declared fields plus the presence
+     * primitives; a seeded DOOH preset — or a profile that declares nothing —
+     * keeps the full audience contract.
+     */
+    async refreshProfileIfStale() {
+        if (!this.profileClient)
+            return;
+        const now = Date.now();
+        if (now - this.lastProfileFetchMs < this.profileTtlMs)
+            return;
+        this.lastProfileFetchMs = now;
+        const profile = await this.profileClient.fetchProfile();
+        if (profile === null)
+            return; // transient error — keep last-good schema
+        this.activeProfileName = profile.profileName;
+        const fieldSet = fieldSetForProfileType(profile.profileType);
+        this.activeFieldSet = fieldSet;
+        if (fieldSet === 'operator' || profile.fields.length > 0) {
+            this.cachedSchema = (0, localInferenceSchema_1.buildLocalSensingSchema)({ fieldSet, extraFields: profile.fields });
+            this.cachedPrompt = (0, localInferenceSchema_1.buildLocalSensingPrompt)({ fieldSet, extraFields: profile.fields });
+        }
+        else {
+            // A DOOH/seeded profile with no custom fields (or no active profile at
+            // all) → the default audience schema, byte-for-byte unchanged.
+            this.cachedSchema = this.baseSchema;
+            this.cachedPrompt = this.basePrompt;
+        }
+    }
+    /**
+     * What the on-device runtime resolved about this host's accelerator (which
+     * litert-lm delegate it selected, and why it is not on the GPU when it is not).
+     * Surfaced so an operator/support can see a silent CPU fallback without
+     * log-diving. See LiteRtVlmProvider.getAcceleratorHealth.
+     */
+    getAcceleratorHealth() {
+        return this.localProvider.getAcceleratorHealth();
+    }
+    /**
+     * Cloud-escalation counters for this feed — how many candidate frames were
+     * adjudicated by the cloud VLM, and why the rest were not. Read by
+     * `CloudSensingManager.getSensingHealth()` so escalation shows up on the
+     * operator's periodic capacity line: sending frames off-premises must be
+     * VISIBLE, not merely documented.
+     */
+    getEscalationStats() {
+        return this.escalationPolicy.getStats();
+    }
+    async analyze(request) {
+        await this.refreshProfileIfStale();
+        let structured;
+        try {
+            structured = await this.localProvider.analyze({
+                jpeg: request.jpeg,
+                schema: this.cachedSchema,
+                prompt: this.cachedPrompt,
+            });
+        }
+        catch (err) {
+            if (!this.cloudFallbackOnError)
+                throw err;
+            // Per-frame degrade: on-device inference threw for THIS frame, so ship it
+            // to the cloud VLM instead of dropping it. Reuses the SAME upload client —
+            // the cloud path the connector already has — so no new provider/logic. The
+            // server provenance-gates a cloud-served frame exactly like cloud-sense.
+            // eslint-disable-next-line no-console
+            console.warn(`[local-sense] on-device inference failed for a frame (${err.message}) — ` +
+                'falling back to the cloud VLM for this frame');
+            return this.uploadClient.analyze({
+                jpeg: request.jpeg,
+                capturedAt: Date.now(),
+                captureMode: request.captureMode,
+            });
+        }
+        // Connector-controlled provenance + time (don't trust the model for these).
+        const capturedAtMs = Date.now();
+        // PRIVACY-CONSCIOUS evidence frame: attach the SAME JPEG the VLM analyzed
+        // (no re-capture) only when enabled AND the observation is potentially
+        // alert-worthy. Empty/uninteresting scenes send results only — no frame.
+        // Evaluate over the raw model output (not the provenance-stamped `result`,
+        // though both yield the same gate since source/captured_at are strings).
+        const hasSignal = isAlertWorthy(structured);
+        // ESCALATION: a candidate the local model flagged is adjudicated by the
+        // cloud VLM BEFORE it can fire an alert. Same gate as the evidence frame,
+        // so no frame leaves that would not already have left; the policy adds the
+        // novelty/pacing/budget bounds. On success this frame's observation is the
+        // CLOUD's — the local result is deliberately not also posted (one frame,
+        // one observation).
+        const canEscalate = this.escalationPolicy.isEnabled() && hasSignal;
+        if (this.escalationPolicy.tryEscalate({
+            hasSignal,
+            // Only computed when the frame could actually escalate. This runs on
+            // every frame of every camera and the common case — escalation off, or
+            // an empty scene — needs no signature at all (tryEscalate rejects on
+            // `disabled`/`no_signal` before it reads one).
+            signature: canEscalate ? alertSignature(structured) : '',
+        }).escalate) {
+            try {
+                const escalated = await this.uploadClient.analyze({
+                    jpeg: request.jpeg,
+                    capturedAt: capturedAtMs,
+                    captureMode: request.captureMode,
+                });
+                // Rare by construction (bounded per feed per hour), so log every one:
+                // an operator must be able to see each frame that left the premises.
+                // eslint-disable-next-line no-console
+                console.log(`[${this.feedName}] local candidate escalated to the cloud VLM for confirmation ` +
+                    `→ HTTP ${escalated.statusCode}${escalated.ok ? '' : ' (NOT OK)'}`);
+                if (escalated.ok)
+                    return escalated;
+                // A non-2xx cloud verdict is no verdict at all — fall through and ship
+                // the local result rather than losing the observation.
+                // eslint-disable-next-line no-console
+                console.warn(`[${this.feedName}] cloud escalation returned HTTP ${escalated.statusCode} — ` +
+                    'keeping the on-device verdict for this frame');
+            }
+            catch (err) {
+                // eslint-disable-next-line no-console
+                console.warn(`[${this.feedName}] cloud escalation failed (${err.message}) — ` +
+                    'keeping the on-device verdict for this frame');
+            }
+        }
+        const result = {
+            ...structured,
+            source: 'vlm_edge',
+            captured_at: new Date(capturedAtMs).toISOString(),
+        };
+        const includeFrame = this.attachEvidenceFrame && hasSignal;
+        return this.uploadClient.analyzePreAnalyzed(result, {
+            capturedAt: capturedAtMs,
+            captureMode: request.captureMode,
+            ...(includeFrame ? { jpeg: request.jpeg } : {}),
+        });
+    }
+}
+exports.LocalSensingClient = LocalSensingClient;
+/**
+ * Build per-feed capture loops for LOCAL sensing — one RTSP provider + one
+ * LocalSensingClient (local VLM + preAnalyzed upload) per feed, each under its
+ * OWN device token. Each client fetches its screen's active Sense-Anything
+ * profile so the on-device VLM emits that screen's custom fields. Mirrors
+ * buildSensingLoops but swaps the cloud client for the local one.
+ */
+function buildLocalSensingLoops(config, deps) {
+    const feeds = (0, CloudSensingManager_1.resolveFeeds)(config);
+    if (feeds.length === 0) {
+        throw new Error('buildLocalSensingLoops: no camera feeds configured (set `cameras: [...]` or `camera.rtspUrl`)');
+    }
+    const litertLmBaseUrl = config.localSensing?.litertLmBaseUrl;
+    const model = config.localSensing?.model;
+    // Which litert-lm delegate to run. Default 'auto' (resolve the `,gpu` variant
+    // from the live model list and prefer it) — see LiteRtVlmProvider.
+    const accelerator = config.localSensing?.accelerator;
+    // Evidence frame defaults ON; resolveConfig normalizes it, but treat a bare
+    // (un-normalized) config or absent localSensing the same way (explicit false
+    // is the only opt-out).
+    const attachEvidenceFrame = config.localSensing?.attachEvidenceFrame !== false;
+    // Per-frame cloud fallback defaults OFF (opt-in) so the plain local-sense path
+    // is unchanged. When true, a frame whose on-device inference throws is POSTed
+    // to the cloud VLM (same upload client) rather than dropped.
+    const cloudFallbackOnError = config.localSensing?.cloudFallbackOnError === true;
+    // Cloud escalation defaults OFF. Each feed gets its OWN policy instance so the
+    // per-camera budget is per camera (a shared one would let a busy feed spend a
+    // quiet feed's confirmations).
+    const cloudEscalation = config.localSensing?.cloudEscalation;
+    const rtspFactory = deps?.rtspProviderFactory ??
+        ((feed) => {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const { RTSPCameraProvider } = require('@trillboards/edge-platform-rtsp');
+            return new RTSPCameraProvider({
+                rtspUrl: feed.rtspUrl,
+                width: feed.width,
+                height: feed.height,
+                fps: feed.fps,
+                transport: feed.transport,
+                ffmpegPath: feed.ffmpegPath,
+                // Honor a mosaic tile's crop in the per-tile-pull fallback path (shared
+                // grouping handles the single-pull case). Without this, a mosaic config
+                // in local-sense would send the whole composite for each tile.
+                crop: feed.crop,
+                outputFormat: feed.outputFormat ?? 'jpeg',
+                jpegQuality: feed.jpegQuality,
+                ...(deps?.streamUrlResolver
+                    ? {
+                        streamUrlResolver: (currentUrl, error) => deps.streamUrlResolver(feed, currentUrl, error),
+                    }
+                    : {}),
+                ...(0, legacyRecorderProfile_1.legacyRecorderRtspOptions)(feed.sourceType),
+            });
+        });
+    const localProviderFactory = deps?.localProviderFactory ??
+        (() => new LiteRtVlmProvider_1.LiteRtVlmProvider({ litertLmBaseUrl, model, accelerator }));
+    const uploadClientFactory = deps?.uploadClientFactory ??
+        ((feed) => new AudienceAnalyzeClient_1.AudienceAnalyzeClient({
+            apiBaseUrl: config.apiBaseUrl,
+            deviceToken: feed.deviceToken,
+            screenId: feed.screenId,
+            imageWidth: feed.width,
+            imageHeight: feed.height,
+        }, deps?.httpPoster));
+    // Each feed fetches its OWN screen's active profile (device token binds to one
+    // screen). Falls back to the default schema if the profile fetch ever fails.
+    const profileClientFactory = deps?.profileClientFactory ??
+        ((feed) => new SensingProfileClient_1.SensingProfileClient({ apiBaseUrl: config.apiBaseUrl, deviceToken: feed.deviceToken }, deps?.httpPoster));
+    // Mosaic-aware (shared with cloud sensing): collapses tiles of one source onto
+    // a single shared pull + crops each tile, so local-sense honors mosaic configs
+    // identically to cloud-sense. `sharedSources` lets the VLM attach to the SAME
+    // pull the on-device zoo uses (combined-sense), so one RTSP pull feeds both.
+    return (0, CloudSensingManager_1.buildTiledCameras)(feeds, rtspFactory, {
+        sharedSources: deps?.sharedSources,
+    }).map(({ feed, camera }) => ({
+        name: feed.name,
+        camera,
+        client: new LocalSensingClient(localProviderFactory(feed), uploadClientFactory(feed), {
+            profileClient: profileClientFactory(feed),
+            attachEvidenceFrame,
+            cloudFallbackOnError,
+            feedName: feed.name,
+            ...(cloudEscalation ? { cloudEscalation } : {}),
+        }),
+    }));
+}
+//# sourceMappingURL=localSensing.js.map

package/dist/localSensing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localSensing.js","sourceRoot":"","sources":["../src/localSensing.ts"],"names":[],"mappings":";;;AAyDA,wDAEC;AAqGD,sCAwBC;AAiBD,wCAaC;AAYD,4DAMC;AAiSD,wDAsGC;AA9mBD,mEAKiC;AACjC,2DAAsF;AACtF,iEAA8D;AAC9D,+DAM+B;AAE/B,iEAIgC;AAChC,mEAIiC;AAEjC,mEAAoE;AAEpE,2FAA2F;AAC3F,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,0BAA0B,GAAG,eAAe,CAAC;AAEnD;;;;;;;;;;;;;;GAcG;AACH,SAAgB,sBAAsB,CAAC,WAAsC;IAC3E,OAAO,WAAW,KAAK,0BAA0B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC9E,CAAC;AAgDD;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEtG;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,aAAa,CAAC,MAA+B;IAC3D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/C,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACrD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/D,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,cAAc,CAAC,MAA+B;IAC5D,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,oEAAoE;QACpE,4EAA4E;QAC5E,6CAA6C;QAC7C,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9G,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,wBAAwB,CAAC,OAGrB;IAClB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,eAAe,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;AAC5F,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,MAAa,kBAAkB;IA6B7B,YACmB,aAAgC,EAChC,YAAmC,EACpD,UAAqC,EAAE;QAFtB,kBAAa,GAAb,aAAa,CAAmB;QAChC,iBAAY,GAAZ,YAAY,CAAuB;QAxB9C,uBAAkB,GAAG,CAAC,CAAC;QAa/B,6DAA6D;QAC7D,sBAAiB,GAAkB,IAAI,CAAC;QACxC;;;;WAIG;QACH,mBAAc,GAAwB,UAAU,CAAC;QAO/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;QACnE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,8CAAuB,GAAE,CAAC;QAC9D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,IAAI,IAAA,8CAAuB,GAAE,CAAC;QAC9D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,KAAK,KAAK,CAAC;QACjE,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC;QAClE,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,CAAC;QAClD,wEAAwE;QACxE,8EAA8E;QAC9E,6EAA6E;QAC7E,4CAA4C;QAC5C,IAAI,CAAC,gBAAgB,GAAG,IAAI,6CAAqB,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;YAClC,OAAO,EAAE,wBAAwB,CAAC;gBAChC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,eAAe,EAAE,OAAO,CAAC,eAAe;aACzC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAED,kBAAkB,CAAC,YAAgC;QACjD,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACK,KAAK,CAAC,qBAAqB;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9D,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,EAAE,CAAC;QACxD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,CAAC,0CAA0C;QACxE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;QAC7C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAC/B,IAAI,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,YAAY,GAAG,IAAA,8CAAuB,EAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,YAAY,GAAG,IAAA,8CAAuB,EAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACtC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,oBAAoB;QAClB,OAAO,IAAI,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC;IACnD,CAAC;IAED;;;;;;OAMG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA+C;QAC3D,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnC,IAAI,UAAmC,CAAC;QACxC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;gBAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YAC1C,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,yDAA0D,GAAa,CAAC,OAAO,MAAM;gBACnF,8CAA8C,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;gBAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;gBACtB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,0EAA0E;QAC1E,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,yEAAyE;QACzE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QAE5C,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,oBAAoB;QACpB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,SAAS,CAAC;QACnE,IACE,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC;YAChC,SAAS;YACT,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,+CAA+C;YAC/C,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;SACzD,CAAC,CAAC,QAAQ,EACX,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;oBAChD,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,UAAU,EAAE,YAAY;oBACxB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC,CAAC,CAAC;gBACH,sEAAsE;gBACtE,qEAAqE;gBACrE,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CACT,IAAI,IAAI,CAAC,QAAQ,gEAAgE;oBAC/E,UAAU,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CACrE,CAAC;gBACF,IAAI,SAAS,CAAC,EAAE;oBAAE,OAAO,SAAS,CAAC;gBACnC,uEAAuE;gBACvE,uDAAuD;gBACvD,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CACV,IAAI,IAAI,CAAC,QAAQ,oCAAoC,SAAS,CAAC,UAAU,KAAK;oBAC5E,8CAA8C,CACjD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CACV,IAAI,IAAI,CAAC,QAAQ,8BAA+B,GAAa,CAAC,OAAO,MAAM;oBACzE,8CAA8C,CACjD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAA4B;YACtC,GAAG,UAAU;YACb,MAAM,EAAE,UAAU;YAClB,WAAW,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE;SAClD,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,IAAI,SAAS,CAAC;QAC3D,OAAO,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,EAAE;YAClD,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;CACF;AAlND,gDAkNC;AAmBD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,MAAuB,EACvB,IAA4B;IAE5B,MAAM,KAAK,GAAG,IAAA,kCAAY,EAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;IACzC,8EAA8E;IAC9E,mEAAmE;IACnE,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,mBAAmB,GAAG,MAAM,CAAC,YAAY,EAAE,mBAAmB,KAAK,KAAK,CAAC;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAChF,+EAA+E;IAC/E,8EAA8E;IAC9E,+BAA+B;IAC/B,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;IAE7D,MAAM,WAAW,GACf,IAAI,EAAE,mBAAmB;QACzB,CAAC,CAAC,IAAkB,EAAE,EAAE;YACtB,8DAA8D;YAC9D,MAAM,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAAC;YAC1E,OAAO,IAAI,kBAAkB,CAAC;gBAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,wEAAwE;gBACxE,wEAAwE;gBACxE,+DAA+D;gBAC/D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,MAAM;gBACzC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,EAAE,iBAAiB;oBACzB,CAAC,CAAC;wBACE,iBAAiB,EAAE,CAAC,UAAkB,EAAE,KAAY,EAAE,EAAE,CACtD,IAAI,CAAC,iBAAkB,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC;qBACnD;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,IAAA,iDAAyB,EAAC,IAAI,CAAC,UAAU,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IAEL,MAAM,oBAAoB,GACxB,IAAI,EAAE,oBAAoB;QAC1B,CAAC,GAAG,EAAE,CAAC,IAAI,qCAAiB,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAEzE,MAAM,mBAAmB,GACvB,IAAI,EAAE,mBAAmB;QACzB,CAAC,CAAC,IAAkB,EAAE,EAAE,CACtB,IAAI,6CAAqB,CACvB;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,WAAW,EAAE,IAAI,CAAC,MAAM;SACzB,EACD,IAAI,EAAE,UAAU,CACjB,CAAC,CAAC;IAEP,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,oBAAoB,GACxB,IAAI,EAAE,oBAAoB;QAC1B,CAAC,CAAC,IAAkB,EAAE,EAAE,CACtB,IAAI,2CAAoB,CACtB,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAChE,IAAI,EAAE,UAAU,CACjB,CAAC,CAAC;IAEP,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,OAAO,IAAA,uCAAiB,EAAC,KAAK,EAAE,WAAW,EAAE;QAC3C,aAAa,EAAE,IAAI,EAAE,aAAa;KACnC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM;QACN,MAAM,EAAE,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC,IAAI,CAAC,EAAE;YACpF,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC;YACzC,mBAAmB;YACnB,oBAAoB;YACpB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC;KACH,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/modelIntegrity.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Is this file actually an ONNX model?
+ *
+ * THE FAILURE THIS PREVENTS
+ * -------------------------------------------------------------------------
+ * `models.trillboards.com` was never provisioned. The `trillboards.com` zone
+ * has no `models` record, so the name is caught by the `*.trillboards.com`
+ * wildcard A-alias and answered by the application ALB, which returns the
+ * marketing SPA's `index.html` — HTTP **200**, `content-type: text/html`,
+ * 2490 bytes — for every path under it.
+ *
+ * Every consumer of that URL treated 200 as success and, at most, checked a
+ * SIZE FLOOR:
+ *
+ *   deploy/docker/Dockerfile.{cpu,cuda,openvino}  `if (size < 1000) reject`
+ *   scripts/download-models.sh                    `curl -f` (does not fail on 200)
+ *   src/cli.ts / src/init.ts                      statusCode !== 200 only
+ *   src/diagnose.ts                               `size === 0` only
+ *
+ * 2490 > 1000, so every one of them accepted a web page as a model, wrote it
+ * to `blazeface.onnx`, and reported success — `download-models` printed
+ * `[OK] blazeface.onnx (0.0 MB)` and `diagnose` reported `ONNX Models: pass`.
+ * At runtime onnxruntime then throws `Protobuf parsing failed`, the camera
+ * subsystem reports ERROR, and the operator has been told everything is fine.
+ *
+ * A size floor cannot distinguish a model from a web page and never will. The
+ * check has to be on the CONTENT.
+ *
+ * WHAT IS CHECKED
+ * -------------------------------------------------------------------------
+ * An ONNX file is a serialized `ModelProto`. Protobuf encodes field 1
+ * (`ir_version`, a varint) as tag byte `0x08`, so every real ONNX model begins
+ * with `0x08`. HTML begins with `<` (0x3C). The two are decisive and cheap.
+ *
+ * Deliberately reports WHAT it found rather than a bare "invalid": an operator
+ * who is told "this is an HTML page, the model host is serving a web page" can
+ * act, where "invalid model" sends them looking at their disk.
+ */
+export interface ModelIntegrityResult {
+    valid: boolean;
+    /** Human-readable reason, present only when `valid` is false. */
+    reason?: string;
+    /** What the bytes actually look like, when we can tell. */
+    detected?: 'html' | 'empty' | 'truncated' | 'not-onnx';
+    bytes?: number;
+}
+/** Classify a model file's leading bytes. Pure — takes the buffer, touches no disk. */
+export declare function classifyModelBytes(buf: Buffer, totalBytes: number): ModelIntegrityResult;
+/** Classify a model file on disk. Returns `{valid:false}` rather than throwing for a missing file. */
+export declare function inspectModelFile(filePath: string): ModelIntegrityResult;
+/**
+ * Throw unless `filePath` is a real ONNX model, DELETING it if it is not.
+ *
+ * Deleting is the point. A rejected download that stays on disk is worse than
+ * no download at all: the next `download-models` run sees the file, prints
+ * `[SKIP] (already exists)`, and the bad bytes become permanent.
+ */
+export declare function assertOnnxModel(filePath: string, label?: string): void;
+//# sourceMappingURL=modelIntegrity.d.ts.map

package/dist/modelIntegrity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modelIntegrity.d.ts","sourceRoot":"","sources":["../src/modelIntegrity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAaH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,CAAC;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,oBAAoB,CAyCxF;AAED,sGAAsG;AACtG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB,CAkBvE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,SAAW,GAAG,IAAI,CASxE"}