@trillboards/edge-sdk 0.2.4 → 0.2.6

package/dist/setupMode.js

@@ -0,0 +1,828 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupHostFingerprint = setupHostFingerprint;
+exports.buildSetupPortalUrl = buildSetupPortalUrl;
+exports.openSetupPortal = openSetupPortal;
+exports.normalizeDirectStreamUrl = normalizeDirectStreamUrl;
+exports.mergeDiscoveredHosts = mergeDiscoveredHosts;
+exports.mergeConfigFile = mergeConfigFile;
+exports.runSetupMode = runSetupMode;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const SetupSessionClient_1 = require("./SetupSessionClient");
+const ChannelProber_1 = require("./ChannelProber");
+const discovery_1 = require("./discovery");
+const connectorCadence_1 = require("./connectorCadence");
+const legacyRecorderProfile_1 = require("./legacyRecorderProfile");
+const RecorderAddressRecovery_1 = require("./RecorderAddressRecovery");
+/** Stable, non-PII connector fingerprint (same derivation as cli.ts pairing). */
+function setupHostFingerprint() {
+    const raw = `${os.hostname()}|${process.platform}|${os.arch()}`;
+    return 'conn_' + (0, crypto_1.createHash)('sha256').update(raw).digest('hex').slice(0, 24);
+}
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const DEFAULT_PORTAL_BASE_URL = 'https://trillboards.com';
+const SETUP_CODE_HASH_PARAM = 'cctvSetupCode';
+/**
+ * Build the one-time browser handoff without sending the setup code to the web
+ * server. URL fragments stay client-side; the portal consumes and removes it.
+ */
+function buildSetupPortalUrl(displayCode, portalBaseUrl = DEFAULT_PORTAL_BASE_URL) {
+    const normalized = String(displayCode || '').replace(/[^a-zA-Z0-9]/g, '').toUpperCase();
+    if (normalized.length !== 8)
+        throw new Error('setup code must contain 8 characters');
+    const base = new URL(portalBaseUrl);
+    if (base.protocol !== 'https:' && base.protocol !== 'http:') {
+        throw new Error('portal base URL must use http or https');
+    }
+    const formatted = `${normalized.slice(0, 4)}-${normalized.slice(4)}`;
+    const target = new URL('/earner/screens', base);
+    target.searchParams.set('addCamera', '1');
+    target.hash = new URLSearchParams({ [SETUP_CODE_HASH_PARAM]: formatted }).toString();
+    return target.toString();
+}
+/** Open the setup handoff in the owner's default browser. Never uses a shell. */
+function openSetupPortal(url, platform = process.platform) {
+    const command = platform === 'darwin'
+        ? { executable: 'open', args: [url] }
+        : platform === 'win32'
+            ? { executable: 'explorer.exe', args: [url] }
+            : platform === 'linux'
+                ? { executable: 'xdg-open', args: [url] }
+                : null;
+    if (!command)
+        return Promise.resolve(false);
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (opened) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(opened);
+        };
+        try {
+            const child = (0, child_process_1.spawn)(command.executable, command.args, {
+                detached: true,
+                stdio: 'ignore',
+                windowsHide: true,
+            });
+            child.once('spawn', () => {
+                child.unref();
+                finish(true);
+            });
+            child.once('error', () => finish(false));
+        }
+        catch {
+            finish(false);
+        }
+    });
+}
+function normalizeDirectStreamUrl(input) {
+    const streamUrl = String(input || '').trim();
+    if (!streamUrl || streamUrl.length > 2048) {
+        throw new Error('Enter an rtsp:// or rtsps:// camera stream link.');
+    }
+    let parsed;
+    try {
+        parsed = new URL(streamUrl);
+    }
+    catch {
+        throw new Error('Enter a valid rtsp:// or rtsps:// camera stream link.');
+    }
+    if (parsed.protocol !== 'rtsp:' && parsed.protocol !== 'rtsps:') {
+        throw new Error('Only rtsp:// and rtsps:// stream links are supported.');
+    }
+    if (!parsed.hostname) {
+        throw new Error('The stream link is missing a host.');
+    }
+    if (parsed.hash) {
+        parsed.hash = '';
+        return parsed.toString();
+    }
+    return streamUrl;
+}
+function directStreamInfo(streamUrl, preferredName) {
+    const u = new URL(streamUrl);
+    const host = u.hostname;
+    const port = Number(u.port) || 554;
+    const looksUbiquiti = u.port === '7441' || /enableSrtp/i.test(u.search);
+    return {
+        host,
+        port,
+        name: preferredName || (looksUbiquiti ? 'UniFi camera' : `Camera at ${host}`),
+        brand: looksUbiquiti ? 'ubiquiti' : 'direct-link',
+    };
+}
+function mergeDiscoveredHosts(onvifHosts, sweptHosts) {
+    const sweptByHost = new Map(sweptHosts
+        .filter((host) => typeof host?.host === 'string' && host.host)
+        .map((host) => [String(host.host), host]));
+    const seen = new Set();
+    const merged = onvifHosts.map((host) => {
+        const key = typeof host?.host === 'string' ? host.host : '';
+        if (!key)
+            return host;
+        seen.add(key);
+        const swept = sweptByHost.get(key);
+        if (!swept)
+            return host;
+        return {
+            ...host,
+            ...(Array.isArray(swept.openPorts) ? { openPorts: swept.openPorts } : {}),
+            ...(typeof swept.brandHint === 'string' ? { brandHint: swept.brandHint } : {}),
+        };
+    });
+    for (const swept of sweptByHost.values()) {
+        if (!seen.has(String(swept.host)))
+            merged.push(swept);
+    }
+    return merged;
+}
+function recorderIdentityFor(camera, credsByHost, probedByChannelKey, macByHost) {
+    const probed = probedByChannelKey.get(camera.channelKey);
+    const serial = String(probed?.serial || '').trim();
+    const mac = camera.host ? macByHost.get(camera.host) : undefined;
+    if (serial) {
+        return {
+            id: `onvif:${(0, crypto_1.createHash)('sha256').update(serial).digest('hex').slice(0, 24)}`,
+            serial,
+            ...(mac ? { mac } : {}),
+        };
+    }
+    if (!camera.host)
+        return undefined;
+    if (mac) {
+        return {
+            id: `mac:${(0, crypto_1.createHash)('sha256').update(mac).digest('hex').slice(0, 24)}`,
+            mac,
+        };
+    }
+    const username = credsByHost.get(camera.host)?.username || '';
+    const seed = `${camera.host}:${camera.port ?? 554}:${username}`;
+    return { id: `local:${(0, crypto_1.createHash)('sha256').update(seed).digest('hex').slice(0, 24)}` };
+}
+function cameraHost(camera) {
+    try {
+        const url = new URL(String(camera.rtspUrl || ''));
+        return url.hostname || null;
+    }
+    catch {
+        return null;
+    }
+}
+function recorderGroupKey(camera) {
+    if (camera.sourceType !== 'recorder')
+        return null;
+    const recorder = camera.recorder;
+    if (recorder && typeof recorder === 'object' && typeof recorder.id === 'string') {
+        return `id:${recorder.id}`;
+    }
+    const host = cameraHost(camera);
+    return host ? `host:${host}` : null;
+}
+/**
+ * Merge a finalized setup into the local config.
+ *
+ * The finalized channel set is authoritative for each recorder touched by this
+ * setup. That prevents deleted/replaced portal cameras from remaining as hidden
+ * local sensing loops, while feeds from other recorders and direct RTSPS links
+ * remain intact.
+ */
+function mergeConfigFile(existingRaw, incoming, credsByHost, directUrlsByChannelKey = new Map(), probedByChannelKey = new Map(), macByHost = new Map()) {
+    let existing = {};
+    if (existingRaw) {
+        try {
+            existing = JSON.parse(existingRaw);
+        }
+        catch {
+            existing = {};
+        }
+    }
+    const current = Array.isArray(existing.cameras)
+        ? existing.cameras
+        : [];
+    const incomingRecorderIdentities = new Map();
+    const incomingRecorderHosts = new Set();
+    for (const cam of incoming.cameras) {
+        if (cam.sourceType !== 'recorder')
+            continue;
+        const identity = recorderIdentityFor(cam, credsByHost, probedByChannelKey, macByHost);
+        if (identity)
+            incomingRecorderIdentities.set(cam.channelKey, identity);
+        if (cam.host)
+            incomingRecorderHosts.add(cam.host);
+    }
+    const incomingRecorderIds = new Set([...incomingRecorderIdentities.values()].map((identity) => identity.id));
+    const incomingRecorderGroups = new Set([
+        ...[...incomingRecorderIds].map((id) => `id:${id}`),
+        ...[...incomingRecorderHosts].map((host) => `host:${host}`),
+    ]);
+    const preserved = current.filter((camera) => {
+        const group = recorderGroupKey(camera);
+        if (!group)
+            return true;
+        if (incomingRecorderGroups.has(group))
+            return false;
+        const host = cameraHost(camera);
+        if (host && incomingRecorderHosts.has(host))
+            return false;
+        // Finalize contains only this setup's selection. An unmatched group may be
+        // another recorder already attached to the same connector, so retain it.
+        return true;
+    });
+    const byScreen = new Map(preserved.map((c) => [String(c.screenId || ''), c]));
+    const hasRecorder = incoming.cameras.some((cam) => cam.sourceType === 'recorder');
+    const existingCloudSensing = existing.cloudSensing && typeof existing.cloudSensing === 'object'
+        ? existing.cloudSensing
+        : {};
+    const existingLocalSensing = existing.localSensing && typeof existing.localSensing === 'object'
+        ? existing.localSensing
+        : {};
+    for (const cam of incoming.cameras) {
+        // Reassemble the full rtsp:// URL from LOCAL creds + the server's
+        // credential-free recipe. Percent-encoding handled by buildRtspUrl (the
+        // `pass@123` class). A camera whose host has no local creds keeps an empty
+        // rtspUrl (creds-stay-on-prem manual fill, same as legacy pairing).
+        const creds = cam.host ? credsByHost.get(cam.host) : undefined;
+        const directUrl = directUrlsByChannelKey.get(cam.channelKey);
+        const recorder = incomingRecorderIdentities.get(cam.channelKey);
+        const rtspUrl = directUrl ||
+            (cam.host && cam.pathTemplate && creds
+                ? (0, ChannelProber_1.buildRtspUrl)(cam.host, cam.port ?? 554, (0, ChannelProber_1.materializeCredentialPathTemplate)(cam.pathTemplate, creds.username, creds.password), creds.username, creds.password)
+                : (byScreen.get(cam.screenId)?.rtspUrl || ''));
+        byScreen.set(cam.screenId, {
+            ...(byScreen.get(cam.screenId) || {}),
+            name: cam.name,
+            screenId: cam.screenId,
+            deviceToken: cam.deviceToken,
+            rtspUrl,
+            channelKey: cam.channelKey,
+            ...(cam.sourceType ? { sourceType: cam.sourceType } : {}),
+            ...(cam.transport ? { transport: cam.transport } : {}),
+            ...(recorder ? { recorder } : {}),
+        });
+    }
+    const mergedCameras = [...byScreen.values()];
+    return {
+        ...existing,
+        apiBaseUrl: incoming.apiBaseUrl || existing.apiBaseUrl || 'https://api.trillboards.com',
+        cloudSensing: {
+            ...existingCloudSensing,
+            enabled: false,
+            // Still-scene cadence, sized to the feed count AFTER this merge.
+            //
+            // It has to be computed here, on the post-merge list, because a finalize
+            // batch is not the connector: adding one camera to a box that already
+            // runs 20 would otherwise size for 1 feed and leave 21 feeds demanding
+            // ~2,520 still-scene analyses/hour against a budget of 493. Only this
+            // side ever sees the total. See connectorCadence.ts for the measurement.
+            //
+            // Precedence: an operator's explicit local value wins, then anything the
+            // server explicitly sent, then the derived default.
+            ...(typeof existingCloudSensing.periodicIntervalMs === 'number'
+                ? {}
+                : {
+                    periodicIntervalMs: typeof incoming.cloudSensing.periodicIntervalMs === 'number'
+                        ? incoming.cloudSensing.periodicIntervalMs
+                        : (0, connectorCadence_1.periodicIntervalMsForFeedCount)(mergedCameras.length),
+                }),
+            ...(hasRecorder && typeof existingCloudSensing.feedStaggerMs !== 'number'
+                ? { feedStaggerMs: legacyRecorderProfile_1.LEGACY_RECORDER_RUNTIME_PROFILE.feedStaggerMs }
+                : {}),
+            ...(hasRecorder && typeof existingCloudSensing.maxFeedStaggerMs !== 'number'
+                ? { maxFeedStaggerMs: legacyRecorderProfile_1.LEGACY_RECORDER_RUNTIME_PROFILE.maxFeedStaggerMs }
+                : {}),
+            ...(hasRecorder && typeof existingCloudSensing.cameraHealthFailureGraceCount !== 'number'
+                ? {
+                    cameraHealthFailureGraceCount: legacyRecorderProfile_1.LEGACY_RECORDER_RUNTIME_PROFILE.cameraHealthFailureGraceCount,
+                }
+                : {}),
+        },
+        localSensing: {
+            ...existingLocalSensing,
+            enabled: true,
+            // Preserve an operator's explicit opt-in, but never introduce cloud
+            // inference during ordinary setup. Fresh installs remain local-only.
+            allowCloudFallback: existingLocalSensing.allowCloudFallback === true,
+        },
+        cameras: mergedCameras,
+    };
+}
+/**
+ * Run the interactive setup session. Returns 0 on config-written, 2 on
+ * session-expired (restart for a fresh code), 1 on hard errors.
+ */
+async function runSetupMode(opts) {
+    const log = opts.log ?? ((l) => console.log(l));
+    const progress = (state) => {
+        try {
+            opts.progress?.(state);
+        }
+        catch {
+            // A UI update is advisory. Camera setup must remain functional if the
+            // native window closes or its state file becomes unavailable.
+        }
+    };
+    const sleep = opts.sleep ?? defaultSleep;
+    const fingerprint = setupHostFingerprint();
+    const client = opts.client ?? new SetupSessionClient_1.SetupSessionClient({ apiBaseUrl: opts.apiBaseUrl, connectorFingerprint: fingerprint });
+    const discover = opts.discover ?? discovery_1.discoverOnvifHosts;
+    const sweep = opts.sweep ?? discovery_1.sweepLanForRecorders;
+    const probe = opts.probe ?? ChannelProber_1.probeHost;
+    progress({
+        stage: 'starting',
+        title: 'Starting camera setup',
+        message: 'Connecting securely to Trillboards.',
+    });
+    let started;
+    try {
+        started = await client.start({ connectorVersion: opts.connectorVersion, platform: process.platform });
+    }
+    catch (err) {
+        const msg = err.message || '';
+        if (/HTTP 404/.test(msg)) {
+            // Server predates the setup-session API (deploy sequencing) — tell the
+            // wrapper to fall back to the classic portal-code flow (exit 3).
+            log('This Trillboards server does not support the new setup flow yet.');
+            log('Use the classic option: generate a code in the portal and paste it here.');
+            progress({
+                stage: 'error',
+                title: 'Setup needs an update',
+                message: 'The camera setup service is not available yet. Try again shortly.',
+                recoverable: true,
+            });
+            return 3;
+        }
+        log(`Could not reach Trillboards to begin setup: ${msg}`);
+        log('Check this computer\'s internet connection and run setup again.');
+        progress({
+            stage: 'error',
+            title: 'Could not start setup',
+            message: 'Check this computer\'s internet connection, then try again.',
+            recoverable: true,
+        });
+        return 1;
+    }
+    let codeExpiresAtMs = Date.parse(started.codeExpiresAt) || Date.now() + 15 * 60 * 1000;
+    let displayCodeFormatted = started.displayCodeFormatted;
+    log('');
+    log('==================================================');
+    log('   Your Trillboards setup code:');
+    log('');
+    log(`       ${started.displayCodeFormatted}`);
+    log('');
+    log('   In the Trillboards portal, open  Screens →');
+    log('   Add cameras  and type this code. This window');
+    log('   finishes the rest automatically.');
+    log('==================================================');
+    log('');
+    // Default path: take the owner straight back to the signed-in portal and let
+    // it claim this one-time code from the URL fragment. If the OS/browser blocks
+    // the launch, the displayed code above remains the complete fallback.
+    let portalUrl;
+    try {
+        portalUrl = buildSetupPortalUrl(started.displayCodeFormatted, opts.portalBaseUrl || DEFAULT_PORTAL_BASE_URL);
+        const opened = await (opts.openPortal ?? openSetupPortal)(portalUrl);
+        log(opened
+            ? 'Opened Trillboards in your browser — sign in if asked. Connecting automatically…'
+            : 'Open Trillboards → Screens → Add cameras, then type the code shown above.');
+    }
+    catch {
+        log('Open Trillboards → Screens → Add cameras, then type the code shown above.');
+    }
+    log('');
+    progress({
+        stage: 'waiting_for_account',
+        title: 'Connect your Trillboards account',
+        message: portalUrl
+            ? 'Continue in the Trillboards portal. This app will finish setup automatically.'
+            : 'In Trillboards, open Screens, add CCTV cameras, and enter this setup code.',
+        displayCode: started.displayCodeFormatted,
+        ...(portalUrl ? { portalUrl } : {}),
+    });
+    const pollIntervalMs = Math.max(1500, Math.min(5000, started.pollIntervalMs || 2500));
+    const deadline = Date.now() + (opts.maxWaitMs ?? 2 * 60 * 60 * 1000);
+    const credsByHost = new Map();
+    const directUrlsByChannelKey = new Map();
+    const probedByChannelKey = new Map();
+    const macByHost = new Map();
+    let claimedAnnounced = false;
+    let lastClaimIssueAtMs = 0;
+    let discoveryReported = false;
+    const validatedChannelKeys = new Set();
+    const rejectedChannelKeys = new Set();
+    const reportValidationProgress = () => {
+        progress({
+            stage: 'validating',
+            title: 'Validating camera feeds',
+            message: validatedChannelKeys.size > 0
+                ? `${validatedChannelKeys.size} visible camera feed(s) are ready.`
+                : 'Checking each channel for a visible image.',
+            validatedFeeds: validatedChannelKeys.size,
+            rejectedFeeds: rejectedChannelKeys.size,
+        });
+    };
+    const runDiscovery = async () => {
+        log('Scanning your network for cameras and recorders…');
+        progress({
+            stage: 'discovering',
+            title: 'Finding cameras and recorders',
+            message: 'Scanning this local network. This usually takes less than a minute.',
+        });
+        let onvifHosts = [];
+        try {
+            onvifHosts = await discover({ timeoutMs: 4000 });
+        }
+        catch {
+            onvifHosts = [];
+        }
+        let swept = [];
+        try {
+            swept = await sweep({});
+        }
+        catch {
+            swept = [];
+        }
+        // Merge: ONVIF hits are richer; sweep adds no-ONVIF recorders (as bare
+        // host entries the portal renders as "Recorder at <ip> — tap to connect").
+        const discoveredHosts = mergeDiscoveredHosts(onvifHosts, swept);
+        try {
+            await client.reportDiscovered({ onvifHosts: discoveredHosts, cameras: [] });
+            log(`Found ${discoveredHosts.length} device(s) — pick yours in the portal.`);
+            const devicesFound = discoveredHosts.length;
+            progress({
+                stage: 'devices_found',
+                title: devicesFound === 1 ? 'Recorder found' : `${devicesFound} devices found`,
+                message: devicesFound > 0
+                    ? 'Choose your recorder in the Trillboards portal.'
+                    : 'No recorder was found automatically. You can enter its address in the portal.',
+                devicesFound,
+            });
+        }
+        catch (err) {
+            if (err instanceof SetupSessionClient_1.SetupSessionExpiredError)
+                throw err;
+            log(`(Could not report the scan: ${err.message})`);
+        }
+    };
+    const executeCommand = async (command) => {
+        if (command.type === 'discover') {
+            await client.heartbeat('discovering');
+            await runDiscovery();
+            await client.ack(command.commandId);
+            return;
+        }
+        if (command.type === 'probe' && command.host && command.credentials) {
+            credsByHost.set(command.host, command.credentials);
+            await client.heartbeat('probing', command.host);
+            log(`Checking cameras on ${command.host}…`);
+            reportValidationProgress();
+            let sentAny = false;
+            const results = await probe({
+                host: command.host,
+                port: command.port,
+                username: command.credentials.username,
+                password: command.credentials.password,
+                brandHint: command.brandHint,
+                channelHint: command.channelHint,
+            }, {
+                ffmpegPath: opts.ffmpegPath,
+                onResult: async (r) => {
+                    sentAny = true;
+                    probedByChannelKey.set(r.channelKey, r);
+                    try {
+                        await client.reportResults([r]);
+                    }
+                    catch (err) {
+                        if (err instanceof SetupSessionClient_1.SetupSessionExpiredError)
+                            throw err;
+                        /* transient report failure: the final batch below retries */
+                    }
+                    log(r.status === 'validated'
+                        ? `  ✓ channel ${r.channel ?? '?'} — working`
+                        : `  ✗ channel ${r.channel ?? '?'} — ${r.failureClass || r.status}`);
+                    if (r.status === 'validated') {
+                        validatedChannelKeys.add(r.channelKey);
+                        rejectedChannelKeys.delete(r.channelKey);
+                    }
+                    else {
+                        rejectedChannelKeys.add(r.channelKey);
+                        validatedChannelKeys.delete(r.channelKey);
+                    }
+                    reportValidationProgress();
+                },
+            });
+            try {
+                const mac = await (opts.lookupMac ?? RecorderAddressRecovery_1.lookupMacAddress)(command.host);
+                if (mac)
+                    macByHost.set(command.host, mac);
+            }
+            catch {
+                // ONVIF serial remains preferred; a missing neighbor-table entry only
+                // disables automatic DHCP recovery for this legacy recorder.
+            }
+            // Final (possibly duplicate — server merges by channelKey) batch + ack.
+            try {
+                if (results.length > 0)
+                    await client.reportResults(results, command.commandId);
+                else
+                    await client.ack(command.commandId);
+            }
+            catch (err) {
+                if (err instanceof SetupSessionClient_1.SetupSessionExpiredError)
+                    throw err;
+                if (!sentAny)
+                    log(`(Could not report results: ${err.message})`);
+                await client.ack(command.commandId).catch(() => { });
+            }
+            // Incremental channel results are progress, not completion. Keep a
+            // separate terminal marker so the portal cannot enable Finalize while a
+            // later recorder channel is still being validated.
+            await client.heartbeat('probe_complete', command.commandId).catch(() => { });
+            return;
+        }
+        if (command.type === 'probe_url' && command.streamUrl) {
+            const streamUrl = normalizeDirectStreamUrl(command.streamUrl);
+            const key = (0, ChannelProber_1.directStreamChannelKey)(streamUrl);
+            const info = directStreamInfo(streamUrl, command.name);
+            directUrlsByChannelKey.set(key, streamUrl);
+            await client.heartbeat('probing', 'direct stream link');
+            log(`Checking direct camera stream at ${(0, ChannelProber_1.sanitizeRtspUrlForLog)(streamUrl)}…`);
+            reportValidationProgress();
+            const grab = await (0, ChannelProber_1.grabOneFrameAnyTransport)(streamUrl, {
+                ffmpegPath: opts.ffmpegPath,
+                timeoutMs: 8000,
+            });
+            const result = grab.ok
+                ? {
+                    channelKey: key,
+                    status: 'validated',
+                    sourceType: 'direct_url',
+                    name: info.name,
+                    brand: info.brand,
+                    host: info.host,
+                    port: info.port,
+                    transport: grab.transport,
+                    thumbnailBase64: grab.jpegBase64,
+                }
+                : {
+                    channelKey: key,
+                    status: 'failed',
+                    sourceType: 'direct_url',
+                    failureClass: grab.failureClass || 'no_frames',
+                    message: grab.message ? (0, ChannelProber_1.sanitizeRtspUrlForLog)(grab.message) : 'The stream did not return a frame.',
+                    name: info.name,
+                    brand: info.brand,
+                    host: info.host,
+                    port: info.port,
+                };
+            try {
+                await client.reportResults([result], command.commandId);
+            }
+            catch (err) {
+                if (err instanceof SetupSessionClient_1.SetupSessionExpiredError)
+                    throw err;
+                log(`(Could not report direct stream result: ${err.message})`);
+                await client.ack(command.commandId).catch(() => { });
+            }
+            await client.heartbeat('probe_complete', command.commandId).catch(() => { });
+            log(result.status === 'validated'
+                ? '  ✓ direct camera stream — working'
+                : `  ✗ direct camera stream — ${result.failureClass || result.status}`);
+            if (result.status === 'validated') {
+                validatedChannelKeys.add(result.channelKey);
+                rejectedChannelKeys.delete(result.channelKey);
+            }
+            else {
+                rejectedChannelKeys.add(result.channelKey);
+                validatedChannelKeys.delete(result.channelKey);
+            }
+            reportValidationProgress();
+            return;
+        }
+        // Unknown/malformed command — ack it away so the queue can't wedge.
+        await client.ack(command.commandId).catch(() => { });
+    };
+    while (Date.now() < deadline) {
+        let polled;
+        try {
+            polled = await client.poll();
+        }
+        catch (err) {
+            if (err instanceof SetupSessionClient_1.SetupSessionExpiredError) {
+                log('This setup session expired. Run setup again for a fresh code.');
+                progress({
+                    stage: 'error',
+                    title: 'Setup session expired',
+                    message: 'Start setup again for a fresh code. No cameras were created.',
+                    recoverable: true,
+                });
+                return 2;
+            }
+            await sleep(pollIntervalMs * 2); // transient network blip — back off once
+            continue;
+        }
+        if (!polled.claimed) {
+            // Refresh the display code shortly before it expires so the owner never
+            // reads a dead code off this window.
+            if (Date.now() > codeExpiresAtMs - 60000) {
+                try {
+                    const fresh = await client.regenerateCode();
+                    codeExpiresAtMs = Date.parse(fresh.codeExpiresAt) || Date.now() + 15 * 60 * 1000;
+                    displayCodeFormatted = fresh.displayCodeFormatted;
+                    log(`Code refreshed — new code: ${fresh.displayCodeFormatted}`);
+                    portalUrl = buildSetupPortalUrl(fresh.displayCodeFormatted, opts.portalBaseUrl || DEFAULT_PORTAL_BASE_URL);
+                    progress({
+                        stage: polled.claimIssue ? 'account_attention' : 'waiting_for_account',
+                        title: polled.claimIssue
+                            ? 'Use an account that can add cameras'
+                            : 'Connect your Trillboards account',
+                        message: polled.claimIssue
+                            ? polled.claimIssue.message
+                            : 'The setup code was refreshed. Continue in the Trillboards portal.',
+                        displayCode: fresh.displayCodeFormatted,
+                        portalUrl,
+                        ...(polled.claimIssue ? { recoverable: true } : {}),
+                    });
+                }
+                catch (err) {
+                    if (err instanceof SetupSessionClient_1.SetupSessionExpiredError) {
+                        log('This setup session expired. Run setup again for a fresh code.');
+                        progress({
+                            stage: 'error',
+                            title: 'Setup session expired',
+                            message: 'Start setup again for a fresh code. No cameras were created.',
+                            recoverable: true,
+                        });
+                        return 2;
+                    }
+                }
+            }
+            if (polled.claimIssue && polled.claimIssue.atMs > lastClaimIssueAtMs) {
+                lastClaimIssueAtMs = polled.claimIssue.atMs;
+                log('The signed-in account cannot add cameras. Switch to an account owner or screen editor.');
+                progress({
+                    stage: 'account_attention',
+                    title: 'Use an account that can add cameras',
+                    message: polled.claimIssue.message,
+                    displayCode: displayCodeFormatted,
+                    ...(portalUrl ? { portalUrl } : {}),
+                    recoverable: true,
+                });
+            }
+            await sleep(pollIntervalMs);
+            continue;
+        }
+        if (!claimedAnnounced) {
+            claimedAnnounced = true;
+            log('Connected to your Trillboards account ✓');
+            progress({
+                stage: 'account_connected',
+                title: 'Account connected',
+                message: 'This computer is securely paired with your Trillboards account.',
+            });
+            await client.heartbeat('service_verified').catch(() => { });
+        }
+        if (!discoveryReported) {
+            discoveryReported = true;
+            try {
+                await runDiscovery();
+            }
+            catch (err) {
+                if (err instanceof SetupSessionClient_1.SetupSessionExpiredError) {
+                    log('This setup session expired. Run setup again for a fresh code.');
+                    progress({
+                        stage: 'error',
+                        title: 'Setup session expired',
+                        message: 'Start setup again for a fresh code. No cameras were created.',
+                        recoverable: true,
+                    });
+                    return 2;
+                }
+            }
+        }
+        if (polled.config && polled.config.cameras && polled.config.cameras.length > 0) {
+            // Finalized: write the merged config with locally-reassembled RTSP URLs.
+            progress({
+                stage: 'cameras_created',
+                title: 'Creating camera screens',
+                message: 'Saving the validated camera configuration on this computer.',
+                cameraCount: polled.config.cameras.length,
+                validatedFeeds: validatedChannelKeys.size || polled.config.cameras.length,
+                rejectedFeeds: rejectedChannelKeys.size,
+            });
+            const resolved = path.resolve(opts.configPath);
+            let existingRaw = null;
+            try {
+                existingRaw = fs.readFileSync(resolved, 'utf8');
+            }
+            catch {
+                existingRaw = null;
+            }
+            const merged = mergeConfigFile(existingRaw, polled.config, credsByHost, directUrlsByChannelKey, probedByChannelKey, macByHost);
+            try {
+                fs.writeFileSync(resolved, JSON.stringify(merged, null, 2) + '\n', { mode: 0o600 });
+                // mode: only applies when CREATING the file — an existing 0644 config
+                // (trillboards-edge init / hand-made) must be tightened too: it now
+                // holds camera credentials.
+                try {
+                    fs.chmodSync(resolved, 0o600);
+                }
+                catch {
+                    /* best-effort (Windows ACLs) — the write above succeeded */
+                }
+            }
+            catch (err) {
+                log(`Could not save the camera configuration: ${err.message}`);
+                log(`Fix the file permissions on ${resolved} and run setup again — your cameras are already created.`);
+                progress({
+                    stage: 'error',
+                    title: 'Could not save camera settings',
+                    message: 'Your camera screens were created, but this computer could not save their settings. Contact Trillboards support.',
+                    cameraCount: polled.config.cameras.length,
+                    recoverable: true,
+                });
+                return 1;
+            }
+            await client.heartbeat('config_applied').catch(() => { });
+            log('');
+            log(`✓ ${polled.config.cameras.length} camera(s) configured — starting sensing.`);
+            log('You can close this window. The portal shows each camera as it comes online.');
+            progress({
+                stage: 'cameras_created',
+                title: `${polled.config.cameras.length} camera${polled.config.cameras.length === 1 ? '' : 's'} connected`,
+                message: 'The camera screens are created. Starting the private local AI installed with Trillboards.',
+                cameraCount: polled.config.cameras.length,
+                validatedFeeds: validatedChannelKeys.size || polled.config.cameras.length,
+                rejectedFeeds: rejectedChannelKeys.size,
+            });
+            return 0;
+        }
+        if (polled.command) {
+            try {
+                await executeCommand(polled.command);
+            }
+            catch (err) {
+                if (err instanceof SetupSessionClient_1.SetupSessionExpiredError) {
+                    log('This setup session expired. Run setup again for a fresh code.');
+                    progress({
+                        stage: 'error',
+                        title: 'Setup session expired',
+                        message: 'Start setup again for a fresh code. No cameras were created.',
+                        recoverable: true,
+                    });
+                    return 2;
+                }
+                log(`Command failed: ${err.message}`);
+                await client.ack(polled.command.commandId).catch(() => { });
+            }
+            continue; // poll immediately — more commands may be queued
+        }
+        await sleep(pollIntervalMs);
+    }
+    log('Setup timed out waiting for the portal. Run setup again when you are ready.');
+    progress({
+        stage: 'error',
+        title: 'Setup timed out',
+        message: 'Start setup again when you are ready. No cameras were created.',
+        recoverable: true,
+    });
+    return 2;
+}
+//# sourceMappingURL=setupMode.js.map