@trillboards/edge-sdk 0.2.4 → 0.2.7

package/dist/ChannelProber.js

@@ -0,0 +1,887 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.channelKeyFor = channelKeyFor;
+exports.normalizeRecorderBrandHint = normalizeRecorderBrandHint;
+exports.brandPathCandidates = brandPathCandidates;
+exports.credentialFreePathTemplate = credentialFreePathTemplate;
+exports.materializeCredentialPathTemplate = materializeCredentialPathTemplate;
+exports.buildRtspUrl = buildRtspUrl;
+exports.injectCreds = injectCreds;
+exports.pathTemplateOf = pathTemplateOf;
+exports.directStreamChannelKey = directStreamChannelKey;
+exports.sanitizeRtspUrlForLog = sanitizeRtspUrlForLog;
+exports.grabOneFrame = grabOneFrame;
+exports.grabOneFrameAnyTransport = grabOneFrameAnyTransport;
+exports.classifyFfmpegStderr = classifyFfmpegStderr;
+exports.probeHost = probeHost;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const OnvifClient_1 = require("./OnvifClient");
+const runtimePaths_1 = require("./runtimePaths");
+// Empty recorder inputs are black except for a small timestamp/channel OSD.
+const EMPTY_FRAME_MIN_DARK_PERCENT = 98;
+const EMPTY_FRAME_PIXEL_THRESHOLD = 32;
+/** Stable, name-free channel identity → the server-side cameraKey. */
+function channelKeyFor(parts) {
+    if (parts.serial) {
+        const src = parts.sourceToken || parts.profileToken || String(parts.channel ?? 0);
+        return `onvif:${parts.serial}:${src}`.slice(0, 128);
+    }
+    const seed = `${parts.host}:${parts.port}:${parts.channel ?? 0}`;
+    return `nvr:${(0, crypto_1.createHash)('sha1').update(seed).digest('hex').slice(0, 16)}`;
+}
+/**
+ * Brand RTSP path candidates, SUBSTREAM FIRST (cheaper session slot; good
+ * enough for validation), widened to the US SMB installed base per the
+ * product review (Hikvision/Dahua/Reolink alone missed Lorex/Swann/XMeye-class
+ * recorders — exactly what gas stations bought retail).
+ */
+function normalizeRecorderBrandHint(brand) {
+    const normalized = String(brand || '').trim().toLowerCase();
+    if (!normalized || normalized === 'auto')
+        return undefined;
+    if (normalized.includes('axis'))
+        return 'axis';
+    if (normalized.includes('hanwha') ||
+        normalized.includes('wisenet') ||
+        normalized.includes('samsung techwin'))
+        return 'hanwha';
+    if (normalized.includes('avigilon') || normalized.includes('motorola solutions'))
+        return 'avigilon';
+    if (normalized === 'unv' || normalized.includes('uniview'))
+        return 'uniview';
+    if (normalized.includes('bosch'))
+        return 'bosch';
+    if (normalized.includes('ubiquiti') || normalized.includes('unifi'))
+        return 'ubiquiti';
+    if (normalized.includes('mobotix'))
+        return 'mobotix';
+    // Honeywell Commercial Security (Honeywell Building Automation — NOT Resideo,
+    // which took only the residential line in the 2018 spinoff). Deliberately
+    // matched BEFORE the Hikvision/Dahua families so a Honeywell-branded unit
+    // never falls into one of them by substring: Honeywell is a Dahua OEM through
+    // April 2022 and a Vivotek OEM since, and the "Honeywell is a Hikvision OEM"
+    // lists that circulate carry no model map, firmware or UI evidence at all.
+    // `maxpro` covers the MAXPRO NVR/VMS appliances, which report their own name.
+    if (normalized.includes('honeywell') || normalized.includes('maxpro'))
+        return 'honeywell';
+    if (normalized.includes('hikvision'))
+        return 'hikvision';
+    if (normalized.includes('hilook'))
+        return 'hilook';
+    if (normalized.includes('annke'))
+        return 'annke';
+    if (normalized.includes('dahua'))
+        return 'dahua';
+    if (normalized.includes('lorex'))
+        return 'lorex';
+    if (normalized.includes('amcrest')) {
+        return /recorder|nvr|dvr/.test(normalized) ? 'amcrest-recorder' : 'amcrest';
+    }
+    if (normalized.includes('reolink'))
+        return 'reolink';
+    if (normalized.includes('invid'))
+        return 'invid';
+    if (normalized.includes('swann'))
+        return 'swann';
+    if (normalized === 'tvt' || normalized.includes('tvt digital'))
+        return 'tvt';
+    if (normalized === 'generic-dvr' ||
+        normalized.includes('xmeye') ||
+        normalized.includes('xiongmai') ||
+        normalized.includes('netsurveillance') ||
+        normalized.includes('net-surveillance') ||
+        normalized.includes('icsee')) {
+        return 'xmeye';
+    }
+    return normalized;
+}
+function isXmeyeBrand(brand) {
+    return normalizeRecorderBrandHint(brand) === 'xmeye';
+}
+function brandPathCandidates(brand, ch, credentials) {
+    const b = normalizeRecorderBrandHint(brand) || '';
+    const hik = [`/Streaming/Channels/${ch}02`, `/Streaming/Channels/${ch}01`];
+    const dahua = [
+        `/cam/realmonitor?channel=${ch}&subtype=1`,
+        `/cam/realmonitor?channel=${ch}&subtype=0`,
+    ];
+    const uniview = [`/unicast/c${ch}/s1/live`, `/unicast/c${ch}/s0/live`];
+    const xmeyeUser = encodeURIComponent(credentials?.username ?? 'admin');
+    const xmeyePassword = encodeURIComponent(credentials?.password ?? '');
+    const hanwha = [`/LiveChannel/${Math.max(0, ch - 1)}/media.smp`];
+    const xmeye = [
+        `/user=${xmeyeUser}&password=${xmeyePassword}&channel=${ch}&stream=1.sdp?real_stream`,
+        `/user=${xmeyeUser}&password=${xmeyePassword}&channel=${ch}&stream=0.sdp?real_stream`,
+    ];
+    const h264Preview = [
+        `/h264Preview_${String(ch).padStart(2, '0')}_sub`,
+        `/h264Preview_${String(ch).padStart(2, '0')}_main`,
+    ];
+    const reolinkCurrent = [
+        `/Preview_${String(ch).padStart(2, '0')}_sub`,
+        `/Preview_${String(ch).padStart(2, '0')}_main`,
+    ];
+    // Honeywell. EVERY string here is lifted from a Honeywell PDF with a worked
+    // example — nothing is inferred from a family resemblance, because a guessed
+    // path that answers 401 is indistinguishable from a wrong password and trips
+    // the auth breaker on the owner's own recorder.
+    //
+    //   /live1sN.sdp and /live/<Camera ID>/<Streaming ID>  — 35 + 60 Series
+    //     cameras, both forms printed with examples in 800-26904-F (2024-11-27):
+    //     "Mainstream: rtsp://192.168.0.108:554/live1s1.sdp", ".../live/1/1".
+    //     Stream ids: 1 main, 2 sub, 3 third.
+    //   /live.sdp, /live2.sdp — 30 Series (a.k.a. Performance Series) cameras.
+    //     Documented as `rtsp://<ip>:<rtsp port>/<access name for stream 1 to 3>`
+    //     with live.sdp as the factory access name.
+    //
+    // The Dahua family follows because the Performance Series HQA DVR IS a Dahua
+    // XVR: its own user guide (800-23287-A) defaults TCP to 37777, offers 37776
+    // as the alternate HTTP port, and lists CVI/AHD/CVBS channel types.
+    //
+    // What is deliberately ABSENT: a per-channel path for a Honeywell NVR. The 30
+    // Series NVR, 35 Series NVR, 35 Series Pro NVR and HQA DVR guides all confirm
+    // the box SERVES RTSP on 554 and none of them publishes the channel URL; every
+    // rtsp:// example in those manuals is the recorder acting as a CLIENT adding a
+    // third-party camera. The ONVIF conformance database agrees on the shape of
+    // the gap — of 638 Honeywell registrations, 525 are `device` and all 111
+    // recorder-prefixed models (HN*, HEN*, MAXPRO, HUS, HNCNV, PROWATCH) are
+    // `client`, category "Video Management System". Honeywell recorders CONSUME
+    // ONVIF; they do not answer GetProfiles. So beyond channel 1 the only
+    // evidence-backed candidates are the Dahua ones, and inventing a
+    // `/live/<ch>/…` recorder path to fill the hole would be exactly the guess
+    // this comment exists to refuse.
+    const honeywell = ch === 1
+        ? [
+            `/live/1/2`,
+            `/live1s2.sdp`,
+            `/live2.sdp`,
+            `/live/1/1`,
+            `/live1s1.sdp`,
+            `/live.sdp`,
+            ...dahua,
+        ]
+        : dahua;
+    const tvt = [
+        `/?chID=${ch}&streamType=sub1&linkType=tcp`,
+        `/?chID=${ch}&streamType=main&linkType=tcp`,
+        `/chID=${ch}&streamType=sub1&linkType=tcp`,
+        `/chID=${ch}&streamType=main&linkType=tcp`,
+        `/ch${String(ch).padStart(2, '0')}/1`,
+        `/ch${String(ch).padStart(2, '0')}/0`,
+    ];
+    switch (b) {
+        case 'hikvision':
+        case 'hilook':
+        case 'annke': // Hikvision OEM
+            return hik;
+        case 'dahua':
+        case 'lorex': // Dahua OEM
+        case 'amcrest': // Amcrest IP-camera firmware uses Dahua realmonitor paths
+            return dahua;
+        case 'amcrest-recorder':
+        case 'amcrest-nvr':
+        case 'amcrest-dvr':
+            // Keep recorder and IP-camera families explicit: unsupported Amcrest
+            // paths can answer 401, which is indistinguishable from bad credentials
+            // until a stream succeeds and must not bypass the auth circuit breaker.
+            return h264Preview;
+        case 'reolink':
+            // Preserve the installed-base h264Preview paths first, then cover the
+            // current Reolink NVR Preview_XX form without risking old deployments.
+            return [...h264Preview, ...reolinkCurrent];
+        case 'honeywell':
+            return honeywell;
+        case 'hanwha':
+            return hanwha;
+        case 'axis':
+            // Axis cameras expose this documented path; Axis recorder appliances
+            // otherwise remain ONVIF/direct-camera integrations rather than guessed
+            // per-channel proxies.
+            return ch === 1 ? ['/axis-media/media.amp'] : [];
+        case 'uniview':
+        case 'unv':
+            return uniview;
+        case 'avigilon':
+        case 'bosch':
+        case 'mobotix':
+        case 'ubiquiti':
+            // These enterprise/protect appliances do not share one verified
+            // recorder-level channel proxy. Use their ONVIF media profiles or a
+            // direct camera/Protect RTSP(S) link instead of inventing paths.
+            return [];
+        case 'xmeye':
+        case 'icsee':
+        case 'generic-dvr':
+            return xmeye;
+        case 'invid':
+        case 'tvt':
+        case 'swann': // mixed OEM: TVT-style first, then the two big families
+            return [...tvt, ...hik, ...dahua];
+        default:
+            // Unknown brand: walk common retail/OEM families (substreams first).
+            // TVT/INVID-class recorders can return a misleading 401 on Dahua-style
+            // paths even when the credentials are correct, so try TVT before Dahua.
+            return [...hik, ...tvt, ...dahua, ...uniview];
+    }
+}
+/** Remove XM query credentials before a probe result leaves the connector. */
+function credentialFreePathTemplate(pathValue, brand) {
+    if (!isXmeyeBrand(brand))
+        return pathValue;
+    return pathValue.replace(/^\/user=[^&]*&password=[^&]*(&channel=)/i, '/user={username}&password={password}$1');
+}
+/** Restore a credential-free path recipe while writing the local-only config. */
+function materializeCredentialPathTemplate(pathTemplate, username, password) {
+    return pathTemplate
+        .replace(/\{username\}/g, encodeURIComponent(username))
+        .replace(/\{password\}/g, encodeURIComponent(password));
+}
+/** Percent-encode credentials into an rtsp:// URL (the Hiten `pass@123` class). */
+function buildRtspUrl(host, port, path, username, password) {
+    const u = encodeURIComponent(username);
+    const p = encodeURIComponent(password);
+    const norm = path.startsWith('/') ? path : `/${path}`;
+    return `rtsp://${u}:${p}@${host}:${port}${norm}`;
+}
+/** Inject creds into an ONVIF-returned rtsp URI (they usually come credless). */
+function injectCreds(uri, username, password) {
+    try {
+        const u = new URL(uri);
+        u.username = encodeURIComponent(username);
+        u.password = encodeURIComponent(password);
+        return u.toString();
+    }
+    catch {
+        return uri;
+    }
+}
+/** Strip credentials+host → the storable path template. */
+function pathTemplateOf(uri) {
+    try {
+        const u = new URL(uri);
+        return `${u.pathname}${u.search || ''}`;
+    }
+    catch {
+        return uri.replace(/^rtsp:\/\/[^/]+/i, '');
+    }
+}
+function directStreamChannelKey(streamUrl) {
+    return `direct:${(0, crypto_1.createHash)('sha1').update(streamUrl).digest('hex').slice(0, 24)}`;
+}
+function sanitizeRtspUrlForLog(text) {
+    return String(text || '').replace(/\brtsps?:\/\/[^\s'"<>]+/gi, (raw) => {
+        try {
+            const u = new URL(raw);
+            const auth = u.username || u.password ? '***:***@' : '';
+            const pathPart = u.pathname && u.pathname !== '/' ? '/[redacted]' : '';
+            const queryPart = u.search ? '?[redacted]' : '';
+            return `${u.protocol}//${auth}${u.host}${pathPart}${queryPart}`;
+        }
+        catch {
+            return raw
+                .replace(/\/\/([^:]+):([^@]+)@/, '//***:***@')
+                .replace(/^(rtsps?:\/\/[^/?#\s]+).+$/i, '$1/[redacted]');
+        }
+    });
+}
+function escapeFfconcatValue(value) {
+    return value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+}
+function buildFrameInputArgs(rtspUrl, timeoutMs, transport) {
+    if (!/^rtsps?:\/\//i.test(rtspUrl)) {
+        return {
+            args: ['-rw_timeout', String(timeoutMs * 1000), '-i', rtspUrl],
+            cleanup: () => undefined,
+        };
+    }
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'trillboards-rtsp-'));
+    const file = path.join(dir, 'input.ffconcat');
+    fs.writeFileSync(file, [
+        'ffconcat version 1.0',
+        `file '${escapeFfconcatValue(rtspUrl)}'`,
+        `option rtsp_transport ${transport}`,
+        `option timeout ${timeoutMs * 1000}`,
+        '',
+    ].join('\n'), { mode: 0o600 });
+    try {
+        fs.chmodSync(file, 0o600);
+    }
+    catch {
+        /* best-effort on platforms with ACL semantics */
+    }
+    return {
+        args: [
+            '-protocol_whitelist', 'file,crypto,tcp,tls,rtp,rtsp,udp,http,https',
+            '-safe', '0',
+            '-f', 'concat',
+            '-i', file,
+        ],
+        cleanup: () => {
+            try {
+                fs.unlinkSync(file);
+            }
+            catch {
+                /* already gone */
+            }
+            try {
+                fs.rmdirSync(dir);
+            }
+            catch {
+                /* best-effort cleanup */
+            }
+        },
+    };
+}
+function blackFramePercent(stderr) {
+    const matches = [...stderr.matchAll(/\bpblack:(\d+(?:\.\d+)?)/gi)];
+    if (matches.length === 0)
+        return null;
+    return Math.max(...matches.map((match) => Number(match[1])).filter(Number.isFinite));
+}
+/**
+ * Grab ONE frame (downscaled JPEG) from an RTSP URL via the bundled ffmpeg.
+ * `-timeout` (µs) is the rtsp demuxer's socket timeout — NOT `-rw_timeout`
+ * (the #7946 regression). Classification reads ffmpeg's stderr.
+ */
+function grabOneFrame(rtspUrl, { ffmpegPath, timeoutMs = 6000, spawner = child_process_1.spawn, transport = 'tcp', } = {}) {
+    return new Promise((resolve) => {
+        const input = buildFrameInputArgs(rtspUrl, timeoutMs, transport);
+        const resolvedFfmpegPath = (0, runtimePaths_1.resolveFfmpegBinaryPath)(ffmpegPath);
+        const args = [
+            '-hide_banner',
+            '-loglevel', 'info',
+            ...input.args,
+            '-frames:v', '1',
+            '-vf',
+            `blackframe=amount=${EMPTY_FRAME_MIN_DARK_PERCENT}:threshold=${EMPTY_FRAME_PIXEL_THRESHOLD},scale=320:-2`,
+            '-q:v', '7',
+            '-f', 'image2',
+            'pipe:1',
+        ];
+        let child;
+        try {
+            child = spawner(resolvedFfmpegPath, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        }
+        catch (err) {
+            input.cleanup();
+            resolve({ ok: false, failureClass: 'rtsp_unreachable', message: `ffmpeg spawn failed: ${err.message}` });
+            return;
+        }
+        const out = [];
+        const errChunks = [];
+        let settled = false;
+        const settle = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            input.cleanup();
+            try {
+                child.kill('SIGKILL');
+            }
+            catch {
+                /* gone */
+            }
+            resolve(r);
+        };
+        // Hard wall-clock guard ABOVE the demuxer timeout (a hung decode must not
+        // wedge the probe queue).
+        const timer = setTimeout(() => settle({ ok: false, failureClass: 'rtsp_timeout', message: `no frame within ${timeoutMs}ms` }), timeoutMs + 2000);
+        child.stdout?.on('data', (c) => out.push(c));
+        child.stderr?.on('data', (c) => errChunks.push(c));
+        child.on('error', (err) => {
+            clearTimeout(timer);
+            settle({ ok: false, failureClass: 'rtsp_unreachable', message: err.message });
+        });
+        child.on('close', () => {
+            clearTimeout(timer);
+            const stderr = Buffer.concat(errChunks).toString('utf8');
+            const jpeg = Buffer.concat(out);
+            if (jpeg.length > 100) {
+                const darkPercent = blackFramePercent(stderr);
+                if (darkPercent != null && darkPercent >= EMPTY_FRAME_MIN_DARK_PERCENT) {
+                    settle({
+                        ok: false,
+                        failureClass: 'empty_channel',
+                        message: 'Stream is effectively black; no camera image was detected.',
+                    });
+                    return;
+                }
+                settle({ ok: true, jpegBase64: jpeg.toString('base64') });
+                return;
+            }
+            settle({ ok: false, ...classifyFfmpegStderr(stderr) });
+        });
+    });
+}
+function shouldTryNextTransport(failureClass) {
+    return (failureClass === 'rtsp_timeout' ||
+        failureClass === 'nvr_busy' ||
+        failureClass === 'no_frames' ||
+        failureClass === 'decode_error');
+}
+async function grabOneFrameAnyTransport(rtspUrl, opts) {
+    let strongestFailure = null;
+    for (const transport of ['tcp', 'udp']) {
+        const grab = await grabOneFrame(rtspUrl, { ...opts, transport });
+        if (grab.ok) {
+            return { ...grab, transport };
+        }
+        const failed = { ...grab, transport };
+        if (!strongestFailure ||
+            failureSignalRank(failed.failureClass) >= failureSignalRank(strongestFailure.failureClass)) {
+            strongestFailure = failed;
+        }
+        if (!shouldTryNextTransport(grab.failureClass)) {
+            break;
+        }
+    }
+    return strongestFailure || { ok: false, failureClass: 'no_frames', message: 'stream produced no frame' };
+}
+/** Map ffmpeg's stderr to a failure class the portal can act on. */
+function classifyFfmpegStderr(stderr) {
+    // Classify on CREDENTIAL-FREE text, and match status codes as whole tokens.
+    //
+    // ffmpeg echoes the RTSP URL it failed to open — credentials included — into
+    // its own error lines ("Impossible to open 'rtsp://admin:pass%40123@…'").
+    // `@` percent-encodes to `%40`, so the extremely common recorder password
+    // shape `pass@123` renders as `pass%40123`, which CONTAINS the substring
+    // `401`. Matching a bare `401` against that raw buffer classified a perfectly
+    // correct login as `rtsp_auth`, which trips the auth circuit breaker in
+    // probeHost() and ABORTS the entire host probe with "Recorder rejected the
+    // username/password" — so the owner re-types a password that was never wrong
+    // and the camera is never added. Same shape for `404` (`@4…` → `%404`) and
+    // for a channel path that legitimately contains the digits (channel 4's
+    // Hikvision candidate is `/Streaming/Channels/401`).
+    //
+    // Redacting first removes the credentials and the path from every rtsp URL in
+    // the buffer; the word boundaries stop any remaining digit run inside a
+    // longer token (e.g. an ffconcat temp-dir name) from reading as a status code.
+    const s = sanitizeRtspUrlForLog(stderr).toLowerCase();
+    const line = sanitizeRtspUrlForLog(stderr.trim().split('\n').pop() || '').slice(0, 200);
+    if (/\b401\b|unauthorized/.test(s))
+        return { failureClass: 'rtsp_auth', message: line };
+    if (/\b(?:453|455)\b|not enough bandwidth|session limit|too many/.test(s))
+        return { failureClass: 'nvr_busy', message: line };
+    if (/\b404\b|not found|describe.*(fail|error)|no such|stream not exist/.test(s))
+        return { failureClass: 'bad_path', message: line };
+    if (/refused|no route|unreachable|network is down/.test(s))
+        return { failureClass: 'rtsp_unreachable', message: line };
+    if (/timed? ?out|timeout/.test(s))
+        return { failureClass: 'rtsp_timeout', message: line };
+    if (/(missing pps|non-existing pps|missing sps|non-existing sps|decode_slice_header|illegal poc|invalid nal|corrupt(?:ed)?|error while decoding|concealing \d+|reference picture missing|mmco|cabac|sps_id|pps_id)/.test(s)) {
+        return { failureClass: 'decode_error', message: line };
+    }
+    if (/immediate exit|end of file|could not find codec|invalid data/.test(s))
+        return { failureClass: 'no_frames', message: line };
+    return { failureClass: 'no_frames', message: line || 'stream produced no frame' };
+}
+function failureSignalRank(failureClass) {
+    switch (failureClass) {
+        case 'bad_path':
+        case 'empty_channel':
+            return 0;
+        case 'no_frames':
+            return 1;
+        case 'decode_error':
+            return 2;
+        case 'rtsp_timeout':
+            return 3;
+        case 'rtsp_unreachable':
+            return 4;
+        case 'nvr_busy':
+            return 5;
+        case 'rtsp_forbidden':
+        case 'rtsp_auth':
+            return 6;
+        default:
+            return -1;
+    }
+}
+/** Tiny promise pool (per-host RTSP concurrency cap). */
+async function pooled(items, limit, fn) {
+    let next = 0;
+    const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+        while (next < items.length) {
+            const i = next++;
+            await fn(items[i], i);
+        }
+    });
+    await Promise.all(workers);
+}
+/**
+ * Probe one recorder. Streams results via opts.onResult as channels settle and
+ * returns the full list. NEVER throws for per-channel problems — only for
+ * programmer errors; credential rejection yields a single `rtsp_auth` result
+ * for the host (the circuit-breaker contract).
+ */
+async function probeHost(target, opts = {}) {
+    const host = target.host;
+    const rtspPort = target.port ?? 554;
+    const concurrency = opts.concurrency ?? 1;
+    const requestedBrand = normalizeRecorderBrandHint(target.brandHint);
+    const probeStartedAt = Date.now();
+    let grabTimeoutMs = opts.grabTimeoutMs ?? 6000;
+    let deadline = probeStartedAt + (opts.totalBudgetMs ?? 90000);
+    const applyResolvedBrandBudgets = (resolvedBrand) => {
+        if (resolvedBrand !== 'xmeye')
+            return;
+        if (opts.grabTimeoutMs == null)
+            grabTimeoutMs = 10000;
+        if (opts.totalBudgetMs == null)
+            deadline = probeStartedAt + 180000;
+    };
+    applyResolvedBrandBudgets(requestedBrand);
+    const results = [];
+    const emit = async (r) => {
+        const recorderResult = { ...r, sourceType: 'recorder' };
+        results.push(recorderResult);
+        if (opts.onResult)
+            await opts.onResult(recorderResult);
+    };
+    const budgetLeft = () => deadline - Date.now();
+    // ── Stage 1: prefer ONVIF enumeration, but do not assume ONVIF and RTSP
+    // share an auth realm. Older recorders often require a separately-enabled
+    // ONVIF account while accepting the owner's normal login for RTSP.
+    let serial = null;
+    let brand = requestedBrand;
+    let onvifProfiles = [];
+    let onvifAvailable = false;
+    let onvifAuthRejected = false;
+    const onvifPorts = target.onvifPort ? [target.onvifPort] : [80, 8899];
+    for (const onvifPort of onvifPorts) {
+        const client = new OnvifClient_1.OnvifClient({ host, port: onvifPort, username: target.username, password: target.password, timeoutMs: 5000 }, opts.poster);
+        try {
+            const info = await client.getDeviceInformation();
+            serial = info.serialNumber;
+            if (!brand && info.manufacturer)
+                brand = normalizeRecorderBrandHint(info.manufacturer);
+            applyResolvedBrandBudgets(brand);
+            onvifAvailable = true;
+            try {
+                onvifProfiles = await client.getProfiles();
+            }
+            catch (err) {
+                if (err.kind === 'auth')
+                    throw err;
+                onvifProfiles = []; // device service ok, media flaky → brand fallback
+            }
+            // Resolve real URIs per profile (still ONVIF-authed — no RTSP yet).
+            if (onvifProfiles.length > 0) {
+                const uris = new Map();
+                for (const p of onvifProfiles) {
+                    if (budgetLeft() < 10000)
+                        break;
+                    try {
+                        const uri = await client.getStreamUri(p.token);
+                        if (uri)
+                            uris.set(p.token, uri);
+                    }
+                    catch (err) {
+                        if (err.kind === 'auth')
+                            throw err;
+                    }
+                }
+                // ── Stage 2a: validate each REAL URI (substreams naturally dedupe by
+                // videoSourceToken: keep ONE profile per source — prefer the later,
+                // typically lower-res, profile for validation cheapness).
+                const bySource = new Map();
+                for (const p of onvifProfiles) {
+                    const uri = uris.get(p.token);
+                    if (!uri)
+                        continue;
+                    const src = p.videoSourceToken || p.token;
+                    bySource.set(src, { profile: p, uri }); // later profile wins (substream)
+                }
+                const entries = [...bySource.entries()];
+                let channelIdx = 0;
+                await pooled(entries, concurrency, async ([src, { profile, uri }]) => {
+                    if (budgetLeft() <= 0)
+                        return;
+                    const channel = ++channelIdx;
+                    const grab = await grabOneFrameAnyTransport(injectCreds(uri, target.username, target.password), {
+                        ffmpegPath: opts.ffmpegPath,
+                        timeoutMs: Math.min(grabTimeoutMs, Math.max(2000, budgetLeft())),
+                        spawner: opts.spawner,
+                    });
+                    const key = channelKeyFor({ serial, sourceToken: src, profileToken: profile.token, host, port: rtspPort, channel });
+                    if (grab.ok) {
+                        await emit({
+                            channelKey: key,
+                            status: 'validated',
+                            name: profile.name || undefined,
+                            brand,
+                            host,
+                            port: rtspPort,
+                            channel,
+                            serial: serial || undefined,
+                            profileToken: profile.token,
+                            pathTemplate: credentialFreePathTemplate(pathTemplateOf(uri), brand),
+                            transport: grab.transport,
+                            thumbnailBase64: grab.jpegBase64,
+                        });
+                    }
+                    else {
+                        // ONVIF creds were ACCEPTED — an RTSP 401 here is a PERMISSION
+                        // problem (account can't stream), not a password problem.
+                        const failureClass = grab.failureClass === 'rtsp_auth' ? 'rtsp_forbidden' : grab.failureClass;
+                        await emit({
+                            channelKey: key,
+                            status: failureClass === 'empty_channel' ? 'empty' : 'failed',
+                            failureClass,
+                            message: failureClass === 'empty_channel'
+                                ? 'No camera image detected on this channel.'
+                                : grab.message,
+                            name: profile.name || undefined,
+                            brand,
+                            host,
+                            port: rtspPort,
+                            channel,
+                            serial: serial || undefined,
+                            profileToken: profile.token,
+                            pathTemplate: credentialFreePathTemplate(pathTemplateOf(uri), brand),
+                        });
+                    }
+                });
+                return results;
+            }
+            break; // ONVIF authed but no profiles → brand fallback below (creds proven)
+        }
+        catch (err) {
+            const kind = err.kind;
+            if (kind === 'auth') {
+                // Stop touching ONVIF ports, then let one RTSP proof decide whether the
+                // recorder login is actually wrong. INVID/TVT-class DVRs commonly reject
+                // ONVIF until a separate ONVIF user is enabled while RTSP works normally.
+                onvifAuthRejected = true;
+                break;
+            }
+            // unreachable/not_onvif on this port → try next ONVIF port, else fall back.
+        }
+    }
+    // Prove the RTSP auth realm independently when ONVIF rejected the account or
+    // when discovery could not identify a brand. The root DESCRIBE/frame result
+    // is used only as an auth proof, never emitted as a camera (it is often a
+    // recorder grid view). A 401 stops immediately; only a frame or authenticated
+    // decode data proves the login and lets path-specific 401s be treated as
+    // wrong paths. A root 404 is not proof because that endpoint may be public.
+    let rtspCredentialsProven = false;
+    if (!onvifAvailable && (onvifAuthRejected || !brand)) {
+        const rootGrab = await grabOneFrameAnyTransport(buildRtspUrl(host, rtspPort, '/', target.username, target.password), {
+            ffmpegPath: opts.ffmpegPath,
+            timeoutMs: Math.min(grabTimeoutMs, Math.max(2000, budgetLeft())),
+            spawner: opts.spawner,
+        });
+        if (rootGrab.failureClass === 'rtsp_auth') {
+            await emit({
+                channelKey: channelKeyFor({ host, port: rtspPort, channel: 0 }),
+                status: 'failed',
+                failureClass: 'rtsp_auth',
+                message: 'Recorder rejected the username/password (stopped immediately so the account does not get locked).',
+                host,
+                port: rtspPort,
+                brand,
+            });
+            return results;
+        }
+        if (rootGrab.failureClass === 'nvr_busy') {
+            await emit({
+                channelKey: channelKeyFor({ host, port: rtspPort, channel: 0 }),
+                status: 'failed',
+                failureClass: 'nvr_busy',
+                message: rootGrab.message,
+                host,
+                port: rtspPort,
+                brand,
+            });
+            return results;
+        }
+        rtspCredentialsProven =
+            rootGrab.ok ||
+                rootGrab.failureClass === 'decode_error' ||
+                rootGrab.failureClass === 'empty_channel';
+    }
+    // ── Stage 2b: brand-candidate walk (no ONVIF enumeration available). The
+    // FIRST RTSP auth rejection trips the breaker (≤1 RTSP auth touch beyond the
+    // ONVIF attempt). Channels walk until maxConsecutiveDead in a row.
+    const maxDead = opts.maxConsecutiveDead ?? (brand === 'xmeye' ? 8 : 4);
+    const maxChannels = Math.min(opts.maxChannels ?? 32, 64);
+    const hinted = Number.isFinite(Number(target.channelHint)) ? Math.trunc(Number(target.channelHint)) : null;
+    const walkTo = hinted ? Math.min(hinted, maxChannels) : maxChannels;
+    const firstCandidates = brandPathCandidates(brand, 1, target);
+    if (firstCandidates.length === 0) {
+        await emit({
+            channelKey: channelKeyFor({ serial, host, port: rtspPort, channel: 0 }),
+            status: 'failed',
+            failureClass: 'bad_path',
+            message: brand === 'ubiquiti'
+                ? 'UniFi Protect did not expose ONVIF media profiles. Paste the local RTSPS stream link from Protect.'
+                : 'This device did not expose ONVIF media profiles or a verified recorder-level RTSP channel path. Enable ONVIF/Profile T or use a direct camera stream link.',
+            host,
+            port: rtspPort,
+            brand,
+        });
+        return results;
+    }
+    let consecutiveDead = 0;
+    for (let ch = 1; ch <= walkTo; ch++) {
+        if (budgetLeft() <= 0)
+            break;
+        if (!hinted && consecutiveDead >= maxDead)
+            break;
+        const key = channelKeyFor({ serial, host, port: rtspPort, channel: ch });
+        let channelResult = null;
+        const candidates = ch === 1 ? firstCandidates : brandPathCandidates(brand, ch, target);
+        if (candidates.length === 0)
+            break;
+        for (const path of candidates) {
+            if (budgetLeft() <= 0)
+                break;
+            const grab = await grabOneFrameAnyTransport(buildRtspUrl(host, rtspPort, path, target.username, target.password), {
+                ffmpegPath: opts.ffmpegPath,
+                timeoutMs: Math.min(grabTimeoutMs, Math.max(2000, budgetLeft())),
+                spawner: opts.spawner,
+            });
+            if (grab.ok ||
+                grab.failureClass === 'decode_error' ||
+                grab.failureClass === 'empty_channel') {
+                // Any authenticated RTSP payload proves the login for the rest of this
+                // host. Some DVRs return 401 for empty channels or unsupported vendor
+                // paths, so a later 401 must not erase an earlier stream success.
+                rtspCredentialsProven = true;
+            }
+            if (grab.ok) {
+                channelResult = {
+                    channelKey: key,
+                    status: 'validated',
+                    brand,
+                    host,
+                    port: rtspPort,
+                    channel: ch,
+                    serial: serial || undefined,
+                    pathTemplate: credentialFreePathTemplate(path, brand),
+                    transport: grab.transport,
+                    thumbnailBase64: grab.jpegBase64,
+                };
+                break;
+            }
+            if (grab.failureClass === 'rtsp_auth') {
+                if (rtspCredentialsProven) {
+                    // An earlier RTSP frame/decode already proved these credentials. Some
+                    // DVRs answer 401 for unsupported vendor paths, so keep walking
+                    // candidates instead of falsely blaming the password.
+                    const failedCandidate = {
+                        channelKey: key,
+                        status: 'failed',
+                        failureClass: 'bad_path',
+                        message: 'Recorder login worked, but this stream path was rejected.',
+                        brand,
+                        host,
+                        port: rtspPort,
+                        channel: ch,
+                        pathTemplate: credentialFreePathTemplate(path, brand),
+                    };
+                    if (!channelResult ||
+                        failureSignalRank(failedCandidate.failureClass) >=
+                            failureSignalRank(channelResult.failureClass)) {
+                        channelResult = failedCandidate;
+                    }
+                    continue;
+                }
+                // Without ONVIF proof this IS (probably) a bad password → breaker.
+                // With ONVIF-proven creds it's a permission problem instead.
+                await emit({
+                    channelKey: key,
+                    status: 'failed',
+                    failureClass: onvifAvailable ? 'rtsp_forbidden' : 'rtsp_auth',
+                    message: onvifAvailable
+                        ? 'Recorder accepted the password but refused streaming (account lacks live-view/RTSP permission).'
+                        : 'Recorder rejected the username/password (stopped immediately so the account does not get locked).',
+                    host,
+                    port: rtspPort,
+                    channel: ch,
+                    brand,
+                });
+                return results; // CIRCUIT BREAKER
+            }
+            const failedCandidate = {
+                channelKey: key,
+                status: 'failed',
+                failureClass: grab.failureClass,
+                message: grab.message,
+                brand,
+                host,
+                port: rtspPort,
+                channel: ch,
+                pathTemplate: credentialFreePathTemplate(path, brand),
+            };
+            if (!channelResult ||
+                failureSignalRank(grab.failureClass) >= failureSignalRank(channelResult.failureClass)) {
+                channelResult = failedCandidate;
+            }
+            // bad/no-frame/decode results can vary across substream/mainstream
+            // candidates, so keep walking and preserve the strongest signal.
+            // Connection-level failures stop the walk (same socket will fail again).
+            if (grab.failureClass !== 'bad_path' &&
+                grab.failureClass !== 'no_frames' &&
+                grab.failureClass !== 'decode_error' &&
+                grab.failureClass !== 'empty_channel')
+                break;
+        }
+        if (channelResult) {
+            if (channelResult.status === 'validated')
+                consecutiveDead = 0;
+            else
+                consecutiveDead++;
+            // A hinted walk marks trailing dead channels as EMPTY (neutral "no
+            // camera on this channel"), not scary red failures (product review #16).
+            if (channelResult.status === 'failed' &&
+                (channelResult.failureClass === 'empty_channel' ||
+                    (hinted &&
+                        (channelResult.failureClass === 'bad_path' ||
+                            channelResult.failureClass === 'no_frames' ||
+                            channelResult.failureClass === 'rtsp_timeout')))) {
+                channelResult = { ...channelResult, status: 'empty', failureClass: 'empty_channel', message: 'No camera detected on this channel.' };
+            }
+            await emit(channelResult);
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=ChannelProber.js.map