@trillboards/edge-sdk 0.2.4 → 0.2.7

package/deploy/windows/build-windows.ps1

@@ -0,0 +1,225 @@
+<#
+.SYNOPSIS
+  build-windows.ps1 — build a self-contained Windows installer (.exe) for the
+  Trillboards on-device (local-sense) CCTV connector.
+
+.DESCRIPTION
+  Windows analogue of deploy/macos/build-macos-pkg.sh. Lays down a fully
+  self-contained tree the operator can run with NO system Node, ffmpeg, Docker,
+  or terminal:
+
+    <install>\Trillboards\edge\
+      bin\node.exe          official Node x64 runtime (pinned)
+      bin\ffmpeg.exe        pinned static ffmpeg (eugeneware/ffmpeg-static b6.0,
+                            the SAME upstream the macOS build uses; SHA-256 verified)
+      bin\trillboards-edge.cmd   launcher: PATH=bin first; node lib\...\cli.js
+      bin\trillboards-pair.cmd   first-run claim-code pairing helper
+      lib\edge-sdk\dist\cli.js   the connector CLI
+      lib\node_modules\...       runtime subset (edge-core + edge-platform-rtsp +
+                                 edge-sdk + transitive deps), WITHOUT the heavy
+                                 local ONNX/sharp/sqlite inference stack.
+
+  The connector is loaded WITHOUT the heavy ONNX/sharp/sqlite stack (cli.ts
+  lazy-requires EdgeAgent), so the bundle omits onnxruntime-node/sharp/
+  better-sqlite3 — keeping the inner .exe small. The release workflow signs this
+  connector installer, then bundle-windows-installer.ps1 wraps it with the
+  pinned Gemma model in one customer-facing executable. The inner installer
+  requires that model and verifies local AI before camera pairing.
+  RTSP capture is via the bundled ffmpeg (cross-platform), so a single x64 build
+  serves every Win10/11.
+
+  This script produces the unsigned build artifact. The production release
+  workflow applies Azure Trusted Signing Authenticode and verifies the signature
+  before publishing the installer to the CDN.
+
+.PARAMETER NodeVersion   Pinned Node runtime (default v22.22.0, matches macOS).
+.PARAMETER Offline       Skip downloads; copy the host node/ffmpeg (air-gapped CI).
+.PARAMETER SkipNsis      Stage only; do not compile the NSIS .exe (for unit checks).
+
+.OUTPUTS
+  Prints the inner installer path on the last line:
+    <pkgroot>\deploy\windows\dist-installer\inner\TrillboardsEdgeSetup-core-<ver>-x64.exe
+#>
+[CmdletBinding()]
+param(
+  [string]$NodeVersion = "v22.22.0",
+  [switch]$Offline,
+  [switch]$SkipNsis
+)
+
+$ErrorActionPreference = "Stop"
+Set-StrictMode -Version Latest
+
+# ─── Pinned static ffmpeg (win32-x64) — eugeneware/ffmpeg-static b6.0 ──────────
+# Same upstream + release the macOS build pins, so behavior matches. SHA-256
+# verified after download; refuse to bundle an unverified binary.
+$FfmpegStaticTag = if ($env:FFMPEG_STATIC_TAG) { $env:FFMPEG_STATIC_TAG } else { "b6.0" }
+$FfmpegSha256Win = if ($env:FFMPEG_SHA256_WIN) { $env:FFMPEG_SHA256_WIN } else { "e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1" }
+
+# ─── Locate ourselves + the edge-sdk package root ─────────────────────────────
+$Here = Split-Path -Parent $MyInvocation.MyCommand.Path          # deploy\windows
+$PkgRoot = (Resolve-Path "$Here\..\..").Path                      # …\packages\edge-sdk
+$WorkspaceRoot = (Resolve-Path "$PkgRoot\..\..").Path             # …\trillboards-edge-sdk
+
+$InstallSubdir = "Trillboards\edge"
+$DistDir = Join-Path $PkgRoot "deploy\windows\dist-installer"
+$Stage = Join-Path $DistDir "stage-x64"
+$Payload = Join-Path $Stage $InstallSubdir
+$Scratch = Join-Path $DistDir "scratch-x64"
+
+function Log  ($m) { Write-Host "[build] $m" -ForegroundColor Blue }
+function Warn ($m) { Write-Host "[warn] $m" -ForegroundColor Yellow }
+function Die  ($m) { Write-Host "[err] $m" -ForegroundColor Red; exit 1 }
+
+$Version = (node -e "process.stdout.write(require('$($PkgRoot -replace '\\','/')/package.json').version)")
+Log "edge-sdk v$Version  arch=x64  node=$NodeVersion"
+
+# ─── Clean + recreate the staging tree (idempotent) ───────────────────────────
+if (Test-Path $Stage)   { Remove-Item -Recurse -Force $Stage }
+if (Test-Path $Scratch) { Remove-Item -Recurse -Force $Scratch }
+New-Item -ItemType Directory -Force -Path "$Payload\bin","$Payload\lib","$Scratch" | Out-Null
+
+# ─── 1. Build ALL edge workspaces (tsc, dependency order) ──────────────────────
+# edge-sdk's tsc imports edge-core, edge-platform-rtsp/linux/windows, edge-sensing,
+# edge-ads, edge-federated AND edge-cloud — every workspace's dist must exist before
+# edge-sdk compiles. Building only edge-core + edge-platform-rtsp first (and the rest
+# AFTER edge-sdk) made edge-sdk's tsc fail on missing dep types in a clean CI checkout.
+# The root `build` = `npm run build --workspaces` compiles every workspace in
+# dependency order. (No `*> $null`: a future build error must surface in the CI log.)
+Log "Building all edge workspaces (tsc, dependency order)…"
+Push-Location $WorkspaceRoot; npm run build; if ($LASTEXITCODE -ne 0) { Die "edge workspace build failed (tsc)" }; Pop-Location
+
+# ─── 2. Lay down the edge-sdk dist ─────────────────────────────────────────────
+Log "Staging edge-sdk dist…"
+New-Item -ItemType Directory -Force -Path "$Payload\lib\edge-sdk" | Out-Null
+Copy-Item -Recurse -Force "$PkgRoot\dist" "$Payload\lib\edge-sdk\dist"
+Copy-Item -Force "$PkgRoot\package.json" "$Payload\lib\edge-sdk\package.json"
+
+# ─── 3. Runtime node_modules subset (NO heavy native stack) ────────────────────
+# robocopy /E mirrors the tree; /XD prunes the heavy/native/dev packages cloud-
+# sense + pair never require (EdgeAgent → onnxruntime-node is lazy). Keeps the
+# installer small. robocopy exit codes 0-7 are success; >=8 is a real error.
+#
+# /XJ is REQUIRED, not an optimisation: this is an npm-workspaces install, so
+# node_modules\@trillboards\* are directory JUNCTIONS back into ..\packages\*
+# (re-materialised from their built dist in step 3b just below). Without /XJ,
+# robocopy /E FOLLOWS those junctions into the package trees — which contain
+# their own nested workspace junctions — recursing through a huge/cyclic graph
+# that never terminates. That hung this step for >88 min on windows-latest and
+# the job was killed at its timeout on EVERY release run, so the .exe never
+# published. /MT parallelises the small-file copy; /R:1 /W:1 bound retries so a
+# single transiently-locked file can't trigger robocopy's default 1e6×30s hang.
+Log "Staging runtime node_modules (excluding ONNX/sharp/sqlite/dev)…"
+New-Item -ItemType Directory -Force -Path "$Payload\lib\node_modules" | Out-Null
+$xd = @("onnxruntime-node","sharp","@img","better-sqlite3","ffmpeg-static",".cache",".bin","typescript","jest","jest-cli","@jest","ts-jest","@types")
+$rcArgs = @("$WorkspaceRoot\node_modules", "$Payload\lib\node_modules", "/E", "/XJ", "/MT:16", "/R:1", "/W:1", "/NFL","/NDL","/NJH","/NJS","/NP")
+foreach ($d in $xd) { $rcArgs += @("/XD", $d) }
+robocopy @rcArgs | Out-Null
+if ($LASTEXITCODE -ge 8) { Die "robocopy node_modules failed (code $LASTEXITCODE)" }
+$global:LASTEXITCODE = 0
+
+# Overlay the @trillboards workspace packages with their REAL built dist (in the
+# workspace they are symlinks → copy materialized dist + package.json instead).
+foreach ($p in @("edge-core","edge-sensing","edge-ads","edge-federated","edge-cloud","edge-platform-rtsp","edge-platform-linux","edge-platform-windows","edge-csi","edge-sdk")) {
+  $src = "$WorkspaceRoot\packages\$p"
+  if (-not (Test-Path $src)) { continue }
+  $dest = "$Payload\lib\node_modules\@trillboards\$p"
+  if (Test-Path $dest) { Remove-Item -Recurse -Force $dest }
+  New-Item -ItemType Directory -Force -Path $dest | Out-Null
+  if (Test-Path "$src\dist") { Copy-Item -Recurse -Force "$src\dist" "$dest\dist" }
+  Copy-Item -Force "$src\package.json" "$dest\package.json"
+}
+
+# ─── 4. Bundle the Node runtime (official Windows x64) ─────────────────────────
+$NodeBin = "$Payload\bin\node.exe"
+if ($Offline) {
+  Log "Offline mode: copying host node…"
+  Copy-Item -Force (Get-Command node).Source $NodeBin
+} else {
+  $zip = "node-$NodeVersion-win-x64.zip"
+  $url = "https://nodejs.org/dist/$NodeVersion/$zip"
+  Log "Downloading official Node runtime: $url"
+  Invoke-WebRequest -Uri $url -OutFile "$Scratch\$zip" -UseBasicParsing
+  Expand-Archive -Path "$Scratch\$zip" -DestinationPath $Scratch -Force
+  Copy-Item -Force "$Scratch\node-$NodeVersion-win-x64\node.exe" $NodeBin
+}
+& $NodeBin --version *> $null; if ($LASTEXITCODE -ne 0) { Die "bundled node failed --version" }
+Log "Bundled node: $(& $NodeBin --version)"
+
+# ─── 5. Bundle ffmpeg (pinned static win32-x64 — SHA-256 verified) ─────────────
+$FfmpegBin = "$Payload\bin\ffmpeg.exe"
+if ($Offline) {
+  $hostFf = (Get-Command ffmpeg -ErrorAction SilentlyContinue).Source
+  if (-not $hostFf) { Die "offline mode: no host ffmpeg on PATH to copy." }
+  Copy-Item -Force $hostFf $FfmpegBin
+} else {
+  $url = "https://github.com/eugeneware/ffmpeg-static/releases/download/$FfmpegStaticTag/ffmpeg-win32-x64"
+  Log "Downloading pinned static ffmpeg: $url"
+  Invoke-WebRequest -Uri $url -OutFile "$Scratch\ffmpeg.exe" -UseBasicParsing
+  $actual = (Get-FileHash -Algorithm SHA256 "$Scratch\ffmpeg.exe").Hash.ToLower()
+  if ($actual -ne $FfmpegSha256Win.ToLower()) {
+    Die "ffmpeg SHA-256 mismatch (expected $FfmpegSha256Win, got $actual). Refusing to bundle an unverified binary."
+  }
+  Log "Verified ffmpeg SHA-256 ($FfmpegSha256Win)"
+  Copy-Item -Force "$Scratch\ffmpeg.exe" $FfmpegBin
+}
+& $FfmpegBin -version *> $null; if ($LASTEXITCODE -ne 0) { Die "bundled ffmpeg failed -version" }
+Log "Bundled ffmpeg OK"
+
+# ─── 6. Launcher + pair helper (bundled runtime — no system deps) ──────────────
+# PATH=bin first so the connector's default ffmpeg='ffmpeg' resolves to OURS.
+Copy-Item -Force "$Here\trillboards-edge.cmd" "$Payload\bin\trillboards-edge.cmd"
+Copy-Item -Force "$Here\trillboards-pair.cmd" "$Payload\bin\trillboards-pair.cmd"
+Copy-Item -Force "$Here\trillboards-setup.ps1" "$Payload\bin\trillboards-setup.ps1"
+Copy-Item -Force "$Here\trillboards-setup.vbs" "$Payload\bin\trillboards-setup.vbs"
+Copy-Item -Force "$Here\trillboards-edge-task.vbs" "$Payload\bin\trillboards-edge-task.vbs"
+Copy-Item -Force "$Here\run-connector.ps1"      "$Payload\bin\run-connector.ps1"
+Copy-Item -Force "$Here\register-task.ps1"    "$Payload\bin\register-task.ps1"
+Copy-Item -Force "$Here\stop-existing.ps1"    "$Payload\bin\stop-existing.ps1"
+Copy-Item -Force "$Here\install-update.ps1"    "$Payload\bin\install-update.ps1"
+
+# Construct the real customer window with Windows PowerShell before packaging.
+# -SmokeTest creates and validates every control but never displays the form or
+# starts pairing, so this runs safely on CI and catches runtime-only Forms bugs.
+$WindowsPowerShell = Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
+& $WindowsPowerShell -NoProfile -ExecutionPolicy Bypass -File "$Here\trillboards-setup.ps1" -SmokeTest
+if ($LASTEXITCODE -ne 0) { Die "customer setup window smoke test failed" }
+Log "Customer setup window smoke test passed"
+
+# On-device LiteRT-LM / Gemma provisioning. The inner installer receives the
+# model path from the customer SFX and verifies local AI before pairing; the
+# serve task keeps `litert-lm serve :9379` alive for local-sense.
+Copy-Item -Force "$Here\setup-litertlm.ps1"         "$Payload\bin\setup-litertlm.ps1"
+Copy-Item -Force "$Here\register-litertlm-task.ps1" "$Payload\bin\register-litertlm-task.ps1"
+Copy-Item -Force "$Here\check-feeds.js"       "$Payload\bin\check-feeds.js"
+
+# ─── 7. Smoke-test the staged bundle BEFORE packaging ──────────────────────────
+Log "Smoke-testing the staged launcher (version)…"
+$env:PATH = "$Payload\bin;$env:PATH"
+$env:NODE_PATH = "$Payload\lib\node_modules"
+$ver = & $NodeBin "$Payload\lib\edge-sdk\dist\cli.js" version 2>&1 | Out-String
+if ($ver -notmatch "edge-sdk v") { Die "staged launcher failed: $ver" }
+Log "Staged launcher OK: $($ver.Trim())"
+
+# ─── 8. Compile the NSIS installer (.exe) ──────────────────────────────────────
+if ($SkipNsis) { Log "SkipNsis set — staged tree only at $Stage"; Write-Output $Stage; exit 0 }
+
+$makensis = (Get-Command makensis -ErrorAction SilentlyContinue).Source
+if (-not $makensis) { Die "makensis not found on PATH (install NSIS: choco install nsis -y)" }
+$InnerDir = Join-Path $DistDir "inner"
+New-Item -ItemType Directory -Force -Path $InnerDir | Out-Null
+$out = Join-Path $InnerDir "TrillboardsEdgeSetup-core-$Version-x64.exe"
+Log "Compiling inner NSIS connector installer…"
+& $makensis "/DPAYLOAD_DIR=$Payload" "/DAPP_VERSION=$Version" "/DOUT_FILE=$out" "$Here\installer.nsi"
+if ($LASTEXITCODE -ne 0) { Die "makensis failed (code $LASTEXITCODE)" }
+if (-not (Test-Path $out)) { Die "installer .exe not produced at $out" }
+$sizeMb = [math]::Round((Get-Item $out).Length / 1MB, 1)
+Log "Built: $out ($sizeMb MB)"
+# Emit the installer path on a RELIABLE channel for CI. The historical caller
+# (`$out = ./build-windows.ps1 | Select-Object -Last 1`) was fragile: makensis,
+# npm and Invoke-WebRequest leak objects onto the success stream, and a `Die`
+# aborts before any path is written — so the caller silently captured $null and
+# failed downstream on `Test-Path $null` with a misleading error. GITHUB_OUTPUT
+# is unambiguous and survives stream pollution.
+if ($env:GITHUB_OUTPUT) { "exe=$out" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append }
+Write-Output $out

package/deploy/windows/bundle-windows-installer.ps1

@@ -0,0 +1,153 @@
+<#
+.SYNOPSIS
+  Wrap the signed NSIS connector installer and pinned Gemma model in one
+  customer-facing self-extracting executable.
+
+.DESCRIPTION
+  NSIS cannot emit an installer larger than roughly 2 GB, while the local AI
+  model is about 2.4 GB. This script uses the official 7-Zip installer SFX
+  module to produce one executable that extracts both files and launches the
+  inner installer with /MODEL_SOURCE. The release workflow signs the inner
+  installer before this step and signs the final SFX afterward.
+#>
+[CmdletBinding()]
+param(
+  [Parameter(Mandatory = $true)][string]$InnerInstaller,
+  [string]$OutputPath = "",
+  [string]$ModelPath = "",
+  [string]$ModelUrl = "https://huggingface.co/litert-community/gemma-4-E2B-it-litert-lm/resolve/main/gemma-4-E2B-it.litertlm",
+  [string]$ModelSha256 = "181938105e0eefd105961417e8da75903eacda102c4fce9ce90f50b97139a63c",
+  [string]$SevenZipSdkUrl = "https://www.7-zip.org/a/lzma2301.7z",
+  [string]$SevenZipSdkSha256 = "317dd834d6bbfd95433488b832e823cd3d4d420101436422c03af88507dd1370"
+)
+
+$ErrorActionPreference = "Stop"
+$Here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$DistDir = Join-Path $Here "dist-installer"
+$Scratch = Join-Path $DistDir "bundle-scratch"
+$Stage = Join-Path $Scratch "payload"
+$ModelId = "gemma-4-E2B-it.litertlm"
+
+function Log([string]$Message) { Write-Host "[bundle] $Message" -ForegroundColor Blue }
+function Fail([string]$Message) { throw "[bundle] $Message" }
+
+$InnerInstaller = (Resolve-Path -LiteralPath $InnerInstaller).Path
+if (-not (Test-Path -LiteralPath $InnerInstaller -PathType Leaf)) {
+  Fail "inner installer not found: $InnerInstaller"
+}
+
+if ([string]::IsNullOrWhiteSpace($OutputPath)) {
+  $version = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($InnerInstaller).ProductVersion
+  if ([string]::IsNullOrWhiteSpace($version)) { $version = "unknown" }
+  $OutputPath = Join-Path (Join-Path $DistDir "customer") "TrillboardsEdgeSetup-$version-x64.exe"
+}
+$OutputPath = [System.IO.Path]::GetFullPath($OutputPath)
+
+if (Test-Path -LiteralPath $Scratch) { Remove-Item -LiteralPath $Scratch -Recurse -Force }
+New-Item -ItemType Directory -Force -Path $Stage, (Split-Path -Parent $OutputPath) | Out-Null
+
+$sevenZip = Get-Command 7z.exe -ErrorAction SilentlyContinue
+if (-not $sevenZip) { $sevenZip = Get-Command 7z -ErrorAction SilentlyContinue }
+if (-not $sevenZip) { Fail "7z.exe is required to build the customer installer" }
+
+$stagedModelPath = Join-Path $Stage $ModelId
+if ([string]::IsNullOrWhiteSpace($ModelPath)) {
+  Log "downloading pinned local AI model"
+  & curl.exe -fL --retry 3 --output $stagedModelPath $ModelUrl
+  if ($LASTEXITCODE -ne 0) { Fail "model download failed (exit $LASTEXITCODE)" }
+} else {
+  $ModelPath = (Resolve-Path -LiteralPath $ModelPath).Path
+  Copy-Item -LiteralPath $ModelPath -Destination $stagedModelPath -Force
+}
+$actualModelSha256 = (Get-FileHash -LiteralPath $stagedModelPath -Algorithm SHA256).Hash.ToLowerInvariant()
+if ($actualModelSha256 -ne $ModelSha256.ToLowerInvariant()) {
+  Fail "model SHA-256 mismatch (expected $ModelSha256, got $actualModelSha256)"
+}
+Log "verified local AI model SHA-256"
+
+$sdkArchive = Join-Path $Scratch "lzma-sdk.7z"
+Log "downloading pinned official 7-Zip installer module"
+& curl.exe -fL --retry 3 --output $sdkArchive $SevenZipSdkUrl
+if ($LASTEXITCODE -ne 0) { Fail "LZMA SDK download failed (exit $LASTEXITCODE)" }
+$actualSdkSha256 = (Get-FileHash -LiteralPath $sdkArchive -Algorithm SHA256).Hash.ToLowerInvariant()
+if ($actualSdkSha256 -ne $SevenZipSdkSha256.ToLowerInvariant()) {
+  Fail "LZMA SDK SHA-256 mismatch (expected $SevenZipSdkSha256, got $actualSdkSha256)"
+}
+
+$sfxTools = Join-Path $Scratch "lzma-sdk"
+New-Item -ItemType Directory -Force -Path $sfxTools | Out-Null
+& $sevenZip.Source x $sdkArchive "-o$sfxTools" -y | Out-Null
+if ($LASTEXITCODE -ne 0) { Fail "could not extract the LZMA SDK" }
+$sfxModule = Get-ChildItem -LiteralPath $sfxTools -Recurse -File -Filter "7zSD.sfx" | Select-Object -First 1
+if (-not $sfxModule) { Fail "official 7zSD.sfx installer module was not found" }
+
+$innerName = "TrillboardsEdgeSetup-core.exe"
+Copy-Item -LiteralPath $InnerInstaller -Destination (Join-Path $Stage $innerName) -Force
+$sevenZipNotice = @'
+This installer uses the 7-Zip SFX installer module from the LZMA SDK.
+7-Zip is licensed under the GNU LGPL and other included licenses.
+Source and license information: https://www.7-zip.org/
+'@
+[System.IO.File]::WriteAllText((Join-Path $Stage "7zip-NOTICE.txt"), $sevenZipNotice, [System.Text.UTF8Encoding]::new($false))
+
+$launcher = @'
+Option Explicit
+Dim shell, fso, base, installer, model, command, result
+Set shell = CreateObject("WScript.Shell")
+Set fso = CreateObject("Scripting.FileSystemObject")
+base = fso.GetParentFolderName(WScript.ScriptFullName)
+installer = fso.BuildPath(base, "TrillboardsEdgeSetup-core.exe")
+model = fso.BuildPath(base, "gemma-4-E2B-it.litertlm")
+shell.Environment("Process")("TRILLBOARDS_BUNDLED_MODEL_PATH") = model
+command = Chr(34) & installer & Chr(34) & " /MODEL_SOURCE=" & Chr(34) & model & Chr(34)
+result = shell.Run(command, 1, True)
+WScript.Quit result
+'@
+[System.IO.File]::WriteAllText((Join-Path $Stage "install-bundled-ai.vbs"), $launcher, [System.Text.UTF8Encoding]::new($false))
+
+$archive = Join-Path $Scratch "trillboards-cctv.7z"
+Push-Location $Stage
+try {
+  # Store the already-compressed model. This keeps the release deterministic and
+  # avoids spending CI time for negligible additional compression.
+  & $sevenZip.Source a -t7z -mx=0 -ms=off $archive "*" | Out-Host
+  if ($LASTEXITCODE -ne 0) { Fail "payload archive creation failed" }
+} finally {
+  Pop-Location
+}
+& $sevenZip.Source t $archive | Out-Host
+if ($LASTEXITCODE -ne 0) { Fail "payload archive integrity test failed" }
+
+$config = @'
+;!@Install@!UTF-8!
+Title="Trillboards CCTV Setup"
+Progress="yes"
+GUIMode="1"
+RunProgram="wscript.exe install-bundled-ai.vbs"
+;!@InstallEnd@!
+'@
+$configPath = Join-Path $Scratch "sfx-config.txt"
+[System.IO.File]::WriteAllText($configPath, $config, [System.Text.UTF8Encoding]::new($false))
+
+if (Test-Path -LiteralPath $OutputPath) { Remove-Item -LiteralPath $OutputPath -Force }
+$output = [System.IO.File]::Open($OutputPath, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write)
+try {
+  foreach ($part in @($sfxModule.FullName, $configPath, $archive)) {
+    $input = [System.IO.File]::OpenRead($part)
+    try { $input.CopyTo($output) } finally { $input.Dispose() }
+  }
+} finally {
+  $output.Dispose()
+}
+
+$modelBytes = (Get-Item -LiteralPath $stagedModelPath).Length
+$outputBytes = (Get-Item -LiteralPath $OutputPath).Length
+if ($outputBytes -le $modelBytes) { Fail "customer installer is unexpectedly smaller than its required model" }
+Log "built one-file customer installer: $OutputPath ($([Math]::Round($outputBytes / 1GB, 2)) GB)"
+
+# The customer executable is self-contained. Reclaim the staged model and raw
+# archive now so signing and publish do not carry an extra ~4.8 GB on the runner.
+Remove-Item -LiteralPath $Scratch -Recurse -Force -ErrorAction SilentlyContinue
+
+if ($env:GITHUB_OUTPUT) { "exe=$OutputPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append }
+Write-Output $OutputPath

package/deploy/windows/check-feeds.js

@@ -0,0 +1,26 @@
+'use strict';
+//
+// check-feeds.js — RTSP-readiness gate for the Windows pairing helper.
+//
+// Exit 0  = every paired feed has an rtspUrl (ready to stream → start the task).
+// Exit 1  = at least one paired feed is still missing its rtspUrl.
+//
+// Mirrors the macOS pair.command `count_feeds_missing_rtsp` guard: in the
+// creds-stay-on-prem pairing path the server returns cameras WITHOUT an rtspUrl
+// (written into the config as empty placeholders) and `runPair` still exits 0 with
+// only a warning. cloud-sense then skips the URL-less feeds and exits with nothing
+// to run — so the helper must NOT start the background task or claim "connected"
+// until the operator pastes the rtsp:// URL(s) into the config.
+//
+// Usage: node check-feeds.js <path-to-trillboards.config.json>
+// Unparseable / missing config → exit 0 (fail open, matching the macOS guard) so a
+// transient read error never blocks an otherwise-valid start.
+try {
+  const cfg = JSON.parse(require('fs').readFileSync(process.argv[2], 'utf8'));
+  const feeds = Array.isArray(cfg.cameras)
+    ? cfg.cameras
+    : (cfg.camera && (cfg.camera.rtspUrl || cfg.deviceToken) ? [cfg.camera] : []);
+  process.exit(feeds.some((f) => !f || !f.rtspUrl) ? 1 : 0);
+} catch (e) {
+  process.exit(0);
+}

package/deploy/windows/e2e/test-local-sense.ps1

@@ -0,0 +1,185 @@
+<#
+.SYNOPSIS
+  test-local-sense.ps1 — Windows on-device-Gemma (LOCAL-sense) E2E for the
+  BYO-CCTV connector. PowerShell port of the proven macOS harness
+  (deploy/macos/test-install-pair.sh), focused on the local-inference path that
+  ONLY windows-latest can prove (Docker can't run Windows containers; Mac CI is
+  ARM and Gemma's Windows LiteRT-LM runtime is x86_64).
+
+.DESCRIPTION
+  Two modes — pick with -Mode:
+
+  wiring (DEFAULT, runs on EVERY CI event incl. PRs):
+    Builds the connector, then runs the cross-platform Node wiring runner
+    (scripts/run-local-sense-wiring-e2e.mjs) which drives the REAL built
+    `cli.js local-sense` against a STUB :9379 VLM (returns a fixed valid Gemma
+    JSON, person_count>=1) + a STUB ingest API, feeding the committed person
+    fixture through the connector's real RTSP/ffmpeg path. Proves the
+    connector → serve → preAnalyzed → assert plumbing WITHOUT the ~2.4 GB model.
+    This is a STUB-VLM proof — NOT a real-model proof.
+
+  real (workflow_dispatch / scheduled only):
+    Provisions litert-lm + imports Gemma 4 E2B (setup-litertlm.ps1, model cached),
+    waits for the real `litert-lm serve` :9379 to be healthy, then runs the REAL
+    on-device inference (scripts/verify-gemma4-vlm.mjs --require-person) on the
+    committed person fixture and asserts the model reports a person. This proves
+    ACTUAL Gemma inference on windows-latest.
+
+.PARAMETER Mode      'wiring' (default) or 'real'.
+.PARAMETER Frame     Person JPEG fixture. Default: e2e/fixtures/person.jpg.
+.PARAMETER Port      litert-lm serve port (real mode). Default 9379.
+.PARAMETER FfmpegPath  ffmpeg for the connector's RTSP capture (wiring mode).
+                       Default: the bundled bin\ffmpeg.exe if staged, else 'ffmpeg'.
+
+.OUTPUTS  exit 0 = E2E passed; exit 1 = failed.
+#>
+[CmdletBinding()]
+param(
+  [ValidateSet('wiring', 'real')][string]$Mode = 'wiring',
+  [string]$Frame,
+  [string]$Port = '9379',
+  [string]$FfmpegPath
+)
+$ErrorActionPreference = 'Stop'
+Set-StrictMode -Version Latest
+
+$Here    = Split-Path -Parent $MyInvocation.MyCommand.Path        # deploy\windows\e2e
+$PkgRoot = (Resolve-Path "$Here\..\..\..").Path                   # ...\edge-sdk
+$WorkspaceRoot = (Resolve-Path "$PkgRoot\..\..").Path             # ...\trillboards-edge-sdk
+if (-not $Frame) { $Frame = Join-Path $Here 'fixtures\person.jpg' }
+
+function Log  ($m) { Write-Host "[local-sense-e2e] $m" -ForegroundColor Blue }
+function Pass ($m) { Write-Host "PASS - $m" -ForegroundColor Green }
+function Die  ($m) { Write-Host "FAIL - $m" -ForegroundColor Red; exit 1 }
+
+Log "mode=$Mode  pkgRoot=$PkgRoot"
+if (-not (Test-Path $Frame)) { Die "person fixture not found: $Frame" }
+Log "person fixture: $Frame ($((Get-Item $Frame).Length) bytes)"
+
+# ─── Build the connector (both modes need dist/cli.js + the dist harness) ──────
+# Plain tsc (npm run build) — fast + reliable, NOT the full NSIS staging (whose
+# node_modules robocopy is the slow step that timed out the release build at 45
+# min; the wiring gate must stay well under its 20-min cap). dist/cli.js is the
+# SAME shipped entrypoint either way; ffmpeg is resolved separately below.
+Log "Building the connector (tsc, all workspaces in dependency order)…"
+Push-Location $WorkspaceRoot
+npm run build
+if ($LASTEXITCODE -ne 0) { Pop-Location; Die "npm run build (tsc) failed" }
+Pop-Location
+
+$Cli = Join-Path $PkgRoot 'dist\cli.js'
+if (-not (Test-Path $Cli)) { Die "dist\cli.js not built at $Cli" }
+Log "connector built: $Cli"
+
+# ─── Resolve ffmpeg for the connector's RTSP/file capture ──────────────────────
+# Order: explicit -FfmpegPath → a staged bundle ffmpeg (if a prior full build ran)
+# → host ffmpeg on PATH → download the SAME pinned static ffmpeg the shipped
+# connector uses (small, no robocopy). The connector needs SOME ffmpeg to turn
+# the file: fixture into a JPEG; which one doesn't change what the test proves.
+function Resolve-Ffmpeg {
+  if ($FfmpegPath -and (Get-Command $FfmpegPath -ErrorAction SilentlyContinue)) { return $FfmpegPath }
+  $staged = Join-Path $PkgRoot 'deploy\windows\dist-installer\stage-x64\Trillboards\edge\bin\ffmpeg.exe'
+  if (Test-Path $staged) { return $staged }
+  if (Get-Command ffmpeg -ErrorAction SilentlyContinue) { return 'ffmpeg' }
+  # Download the pinned static win32-x64 ffmpeg (same tag/sha the build pins).
+  $tag = if ($env:FFMPEG_STATIC_TAG) { $env:FFMPEG_STATIC_TAG } else { 'b6.0' }
+  $sha = if ($env:FFMPEG_SHA256_WIN) { $env:FFMPEG_SHA256_WIN } else { 'e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1' }
+  $dest = Join-Path ([System.IO.Path]::GetTempPath()) 'tb-e2e-ffmpeg.exe'
+  if (-not (Test-Path $dest)) {
+    $url = "https://github.com/eugeneware/ffmpeg-static/releases/download/$tag/ffmpeg-win32-x64"
+    Log "no ffmpeg found — downloading pinned static ffmpeg ($tag)"
+    Invoke-WebRequest -Uri $url -OutFile $dest -UseBasicParsing
+    $actual = (Get-FileHash -Algorithm SHA256 $dest).Hash.ToLower()
+    if ($actual -ne $sha.ToLower()) { Remove-Item $dest -Force; Die "ffmpeg SHA-256 mismatch (expected $sha, got $actual)" }
+  }
+  return $dest
+}
+$FfmpegPath = Resolve-Ffmpeg
+Log "ffmpeg for capture: $FfmpegPath"
+
+# ─── Mode: wiring (stub VLM, deterministic, every run) ─────────────────────────
+if ($Mode -eq 'wiring') {
+  Log "WIRING E2E — STUB :9379 VLM + STUB ingest; real connector cli.js local-sense"
+  Log "(this proves plumbing, NOT real Gemma inference)"
+  $runner = Join-Path $PkgRoot 'scripts\run-local-sense-wiring-e2e.mjs'
+  if (-not (Test-Path $runner)) { Die "wiring runner missing: $runner" }
+  node $runner --frame $Frame --ffmpeg $FfmpegPath
+  if ($LASTEXITCODE -ne 0) { Die "wiring E2E runner exited $LASTEXITCODE" }
+  Pass "Windows LOCAL-sense WIRING proven (stub VLM): connector→serve→preAnalyzed→person."
+  exit 0
+}
+
+# ─── Mode: real (actual Gemma 4 E2B via litert-lm serve) ───────────────────────
+Log "REAL-MODEL SMOKE — provisioning litert-lm + Gemma 4 E2B, then real inference"
+
+# 1. Provision litert-lm + import the model (idempotent; model may be cached by
+#    the workflow's actions/cache step before this runs).
+$setup = Join-Path $PkgRoot 'deploy\windows\setup-litertlm.ps1'
+if (-not (Test-Path $setup)) { Die "setup-litertlm.ps1 missing: $setup" }
+Log "running setup-litertlm.ps1 (uv tool install litert-lm + import Gemma 4 E2B + serve task)…"
+& powershell -NoProfile -ExecutionPolicy Bypass -File $setup -Port $Port -AllowModelDownload
+Log "setup-litertlm.ps1 finished (exit $LASTEXITCODE — non-fatal by design)"
+
+# 2. Locate litert-lm + ensure a serve is up. setup registers a Scheduled Task,
+#    but in CI (no interactive logon) the AtLogOn task won't fire — so start
+#    `litert-lm serve` directly as a background process and wait for health.
+$LocalBin = Join-Path $env:USERPROFILE '.local\bin'
+$env:Path = "$LocalBin;$env:Path"
+$litertlmCmd = Get-Command litert-lm -ErrorAction SilentlyContinue
+$litertlm = if ($litertlmCmd) { $litertlmCmd.Source } else { Join-Path $LocalBin 'litert-lm.exe' }
+if (-not (Test-Path $litertlm)) { Die "litert-lm not installed (uv tool install failed) — cannot run real-model smoke" }
+Log "litert-lm: $litertlm"
+
+function Test-ServeHealthy {
+  try {
+    $r = Invoke-WebRequest -Uri "http://127.0.0.1:$Port/v1/models" -UseBasicParsing -TimeoutSec 3
+    return ($r.StatusCode -eq 200)
+  } catch { return $false }
+}
+
+$LogBase = if ([string]::IsNullOrWhiteSpace($env:RUNNER_TEMP)) { $env:TEMP } else { $env:RUNNER_TEMP }
+$ServeLog = Join-Path $LogBase 'litertlm-serve.log'
+$serveProc = $null
+if (Test-ServeHealthy) {
+  Log "litert-lm serve already healthy on :$Port"
+} else {
+  Log "starting litert-lm serve on 127.0.0.1:$Port (log: $ServeLog)"
+  $serveProc = Start-Process -FilePath $litertlm `
+    -ArgumentList @('serve', '--host', '127.0.0.1', '--port', $Port) `
+    -RedirectStandardOutput $ServeLog -RedirectStandardError "$ServeLog.err" `
+    -PassThru -NoNewWindow
+}
+
+# 3. Wait for health (model load on first run can take a while; serve must answer
+#    /v1/models). Bounded to keep the job well under the 60-min cap.
+$healthy = $false
+for ($i = 0; $i -lt 120; $i++) {
+  if (Test-ServeHealthy) { $healthy = $true; break }
+  if ($serveProc -and $serveProc.HasExited) {
+    Log "litert-lm serve exited early (code $($serveProc.ExitCode))"
+    break
+  }
+  Start-Sleep -Seconds 5
+}
+if (-not $healthy) {
+  Log "--- serve log tail ---"
+  Get-Content $ServeLog -Tail 40 -ErrorAction SilentlyContinue
+  Get-Content "$ServeLog.err" -Tail 40 -ErrorAction SilentlyContinue
+  if ($serveProc) { try { $serveProc.Kill() } catch {} }
+  Die "litert-lm serve did not become healthy on :$Port within timeout"
+}
+Log "litert-lm serve healthy on :$Port"
+
+# 4. REAL on-device inference on the person fixture + assert a person was seen.
+$verifyExit = 1
+try {
+  $verify = Join-Path $PkgRoot 'scripts\verify-gemma4-vlm.mjs'
+  Log "running real Gemma inference (verify-gemma4-vlm.mjs --require-person)…"
+  node $verify $Frame --litert "http://127.0.0.1:$Port" --require-person
+  $verifyExit = $LASTEXITCODE
+} finally {
+  if ($serveProc) { try { $serveProc.Kill() } catch {} }
+}
+if ($verifyExit -ne 0) { Die "real-model smoke FAILED (verify-gemma4-vlm.mjs exit $verifyExit)" }
+Pass "Windows on-device Gemma 4 E2B detected a person on the fixture (REAL inference)."
+exit 0

package/deploy/windows/install-service.ps1

@@ -45,7 +45,12 @@ Pop-Location
 # Download models
 Write-Host "Downloading ONNX models..."
 Push-Location $InstallDir
-npx trillboards-edge download-models --dir $ModelsDir
+# No model download: Trillboards does not distribute blazeface.onnx/yamnet.onnx,
+# and this bundle excludes onnxruntime-node anyway (see build-windows.ps1), so the
+# ONNX sensing path does not run here — it uses LiteRT-LM/Gemma. The previously
+# hardcoded models.trillboards.com was never provisioned and answered every path
+# with the marketing SPA's index.html (HTTP 200, 2490 bytes of HTML).
+New-Item -ItemType Directory -Force -Path $ModelsDir | Out-Null
 Pop-Location
 
 # Install config template