onvif-dashboard 0.1.0

package/.next/static/chunks/turbopack-1gvya9vclt5yj.js

@@ -0,0 +1 @@
+(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,{otherChunks:["static/chunks/310vm2bl3xxpt.js","static/chunks/2mmpezlrfmbu5.js","static/chunks/27t_qfc-3_lzs.js","static/chunks/04l2v6p7fakl9.js","static/chunks/11be91k_gj8bl.js"],runtimeModuleIds:[94553]}]),(()=>{let e;if(!Array.isArray(globalThis.TURBOPACK))return;var t,r=function(){if(null!=self.TURBOPACK_ASSET_SUFFIX)return self.TURBOPACK_ASSET_SUFFIX;let e=document?.currentScript?.getAttribute?.("src")??"",t=e.indexOf("?");return t>=0?e.slice(t):""}(),n=((t=n||{})[t.Runtime=0]="Runtime",t[t.Parent=1]="Parent",t[t.Update=2]="Update",t);let o=new WeakMap;function l(e,t){this.m=e,this.e=t}let i=l.prototype,u=Object.prototype.hasOwnProperty,s="u">typeof Symbol&&Symbol.toStringTag;function c(e,t,r){u.call(e,t)||Object.defineProperty(e,t,r)}function a(e,t){let r=e[t];return r||(r=f(t),e[t]=r),r}function f(e){return{exports:{},error:void 0,id:e,namespaceObject:void 0}}function p(e,t,r){c(e,"__esModule",{value:!0}),s&&c(e,s,{value:"Module"});let n=0;for(;n<t.length;){let r=t[n++],o=t[n++];if("number"==typeof o)if(0===o)c(e,r,{value:t[n++],enumerable:!0,writable:!1});else throw Error(`unexpected tag: ${o}`);else"function"==typeof t[n]?c(e,r,{get:o,set:t[n++],enumerable:!0}):c(e,r,{get:o,enumerable:!0})}r||Object.seal(e)}function h(e,t){(null!=t?a(this.c,t):this.m).exports=e}i.s=function(e,t,r){let n,o;null!=t?o=(n=a(this.c,t)).exports:(n=this.m,o=this.e),n.namespaceObject=o,p(o,e,r)},i.j=function(e,t){let r,n;null!=t?n=(r=a(this.c,t)).exports:(r=this.m,n=this.e);let l=function(e,t){let r=o.get(e);if(!r){o.set(e,r=[]);let n=e=>{if("default"!==e){for(let t of r)if(u.call(t,e))return t}};e.exports=e.namespaceObject=new Proxy(t,{get(e,t){if(u.call(e,t)||"default"===t||"__esModule"===t)return Reflect.get(e,t);let r=n(t);return r&&Reflect.get(r,t)},set:()=>!1,defineProperty:()=>!1,deleteProperty:()=>!1,has:(e,t)=>!!Reflect.has(e,t)||"default"!==t&&"__esModule"!==t&&void 0!==n(t),ownKeys(e){let t=Reflect.ownKeys(e);for(let e of r)for(let r of Reflect.ownKeys(e))"default"===r||t.includes(r)||t.push(r);return t},getOwnPropertyDescriptor(e,t){let r=Reflect.getOwnPropertyDescriptor(e,t);if(r||"default"===t||"__esModule"===t)return r;let o=n(t);if(o)return{enumerable:!0,configurable:!0,get:()=>Reflect.get(o,t)}}})}return r}(r,n);"object"==typeof e&&null!==e&&l.push(e)},i.v=h,i.n=function(e,t){let r;(r=null!=t?a(this.c,t):this.m).exports=r.namespaceObject=e};let d=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,m=[null,d({}),d([]),d(d)];function y(e,t,r){let n=[],o=-1;for(let t=e;("object"==typeof t||"function"==typeof t)&&!m.includes(t);t=d(t))for(let r of Object.getOwnPropertyNames(t))n.push(r,function(e,t){return()=>e[t]}(e,r)),-1===o&&"default"===r&&(o=n.length-1);return r&&o>=0||(o>=0?n.splice(o,1,0,e):n.push("default",0,e)),p(t,n),t}function g(e){let t=K(e,this.m);if(t.namespaceObject)return t.namespaceObject;let r=t.exports;return t.namespaceObject=y(r,"function"==typeof r?function(...e){return r.apply(this,e)}:Object.create(null),r&&r.__esModule)}function b(e){let t=e.indexOf("#");-1!==t&&(e=e.substring(0,t));let r=e.indexOf("?");return -1!==r&&(e=e.substring(0,r)),e}i.i=g,i.A=function(e){return this.r(e)(g.bind(this))},i.t="function"==typeof require?require:function(){throw Error("Unexpected use of runtime require")},i.r=function(e){return K(e,this.m).exports},i.f=function(e){function t(t){if(t=b(t),u.call(e,t))return e[t].module();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r}return t.keys=()=>Object.keys(e),t.resolve=t=>{if(t=b(t),u.call(e,t))return e[t].id();let r=Error(`Cannot find module '${t}'`);throw r.code="MODULE_NOT_FOUND",r},t.import=async e=>await t(e),t};let O=function(e){let t=new URL(e,"x:/"),r={};for(let e in t)r[e]=t[e];for(let t in r.href=e,r.pathname=e.replace(/[?#].*/,""),r.origin=r.protocol="",r.toString=r.toJSON=(...t)=>e,r)Object.defineProperty(this,t,{enumerable:!0,configurable:!0,value:r[t]})};function w(e,t){throw Error(`Invariant: ${t(e)}`)}O.prototype=URL.prototype,i.U=O,i.z=function(e){throw Error("dynamic usage of require is not supported")},i.g=globalThis;let k=l.prototype,R="string"==typeof TURBOPACK_CHUNK_BASE_PATH?TURBOPACK_CHUNK_BASE_PATH:"/_next/",_=new Map;i.M=_;let U=new Map,v=new Map,P=new Map;async function j(e,t,r){let n;if("string"==typeof r)return function(e,t,r){return A(e,t,r)}(e,t,E(r));let o=r.included||[],l=o.map(e=>!!_.has(e)||U.get(e));if(l.length>0&&l.every(e=>e))return void await Promise.all(l);for(let l of(n=A(e,t,E(r.path)),o))U.has(l)||U.set(l,n);await n}k.l=function(e){return j(n.Parent,this.m.id,e)};let C=Promise.resolve(void 0),$=new WeakMap;function A(t,r,o){let l=e.loadChunkCached(t,o),i=$.get(l);if(void 0===i){let e=$.set.bind($,l,C);i=l.then(e).catch(e=>{let l;switch(t){case n.Runtime:l=`as a runtime dependency of chunk ${r}`;break;case n.Parent:l=`from module ${r}`;break;case n.Update:l="from an HMR update";break;default:w(t,e=>`Unknown source type: ${e}`)}let i=Error(`Failed to load chunk ${o} ${l}${e?`: ${e}`:""}`,e?{cause:e}:void 0);throw i.name="ChunkLoadError",i}),$.set(l,i)}return i}k.L=function(e){var t,r;return t=n.Parent,r=this.m.id,A(t,r,e)};k.R=function(e){let t=this.r(e);return t?.default??t},k.P=function(e){return`/ROOT/${e??""}`},k.F=function(e){return e?`file:///ROOT/${e.split("/").map(encodeURIComponent).join("/")}`:"file:///ROOT/"},k.q=function(e,t){h.call(this,`${e}${r}`,t)};let T=/[^A-Za-z0-9\-_.!~*'()/]/;function E(e,t=R){let n=T.test(e)?e.split("/").map(encodeURIComponent).join("/"):e;return`${t}${n}${r}`}function S(e,t){let r,n=e.indexOf("?");if(-1!==n)r=n;else{let t=e.indexOf("#");r=-1!==t?t:e.length}return r>=t.length&&e.startsWith(t,r-t.length)}k.b=R,k.X=r,k.h=E;function x(e){return S(e,".css")}let M={};i.c=M;let K=(e,t)=>{let r=M[e];if(r){if(r.error)throw r.error;return r}return N(e,n.Parent,t.id)};function N(e,t,r){let n=_.get(e);if("function"!=typeof n)throw Error(function(e,t,r){let n;switch(t){case 0:n=`as a runtime entry of chunk ${r}`;break;case 1:n=`because it was required from module ${r}`;break;case 2:n="because of an HMR update";break;default:w(t,e=>`Unknown source type: ${e}`)}return`Module ${e} was instantiated ${n}, but the module factory is not available.`}(e,t,r));let o=f(e),i=o.exports;M[e]=o;let u=new l(o,i);try{n(u,o,i)}catch(e){throw o.error=e,e}return o.namespaceObject&&o.exports!==o.namespaceObject&&y(o.exports,o.namespaceObject),o}function B(t){let r;if(!Array.isArray(t))return e.registerChunk(void 0,t);let n=function(e){if("string"==typeof e)return e;if(e)return{src:e.getAttribute("src")};if("u">typeof TURBOPACK_NEXT_CHUNK_URLS)return{src:TURBOPACK_NEXT_CHUNK_URLS.pop()};throw Error("chunk path empty but not in a worker")}(t[0]);return 2===t.length?r=t[1]:(r=void 0,!function(e,t){let r=1;for(;r<e.length;){let n,o=r+1;for(;o<e.length&&"function"!=typeof e[o];)o++;if(o===e.length)throw Error("malformed chunk format, expected a factory function");let l=e[o];for(let l=r;l<o;l++){let r=e[l],o=t.get(r);if(o){n=o;break}}let i=n??l,u=!1;for(let n=r;n<o;n++){let r=e[n];t.has(r)||(u||(i===l&&Object.defineProperty(l,"name",{value:"module evaluation"}),u=!0),t.set(r,i))}r=o+1}}(t,_)),e.registerChunk(n,r)}let L=new Map;function I(e){let t=L.get(e);if(!t){let r,n;t={resolved:!1,loadingStarted:!1,retryAttempts:0,promise:new Promise((e,t)=>{r=e,n=t}),resolve:()=>{t.resolved=!0,r()},reject:n},L.set(e,t)}return t}function q(e,t,r,n,o){!(null==n||n instanceof DOMException&&"NetworkError"===n.name)||r.retryAttempts>=1||L.get(t)!==r?(L.get(t)===r&&L.delete(t),r.reject(n)):(r.retryAttempts++,setTimeout(()=>{r.resolved||L.get(t)!==r||(o?o():(r.loadingStarted=!1,H(e,t)))},200+Math.floor(401*Math.random())))}function H(e,t){let r=I(t);if(r.loadingStarted)return r.promise;if(e===n.Runtime)return r.loadingStarted=!0,x(t)&&r.resolve(),r.promise;if("function"==typeof importScripts)if(x(t));else if(S(t,".js")){self.TURBOPACK_NEXT_CHUNK_URLS.push(t);try{importScripts(t)}catch(n){q(e,t,r,n)}}else throw Error(`can't infer type of chunk from URL ${t} in worker`);else{let n=decodeURI(t);if(x(t))if(document.querySelectorAll(`link[rel=stylesheet][href="${t}"],link[rel=stylesheet][href^="${t}?"],link[rel=stylesheet][href="${n}"],link[rel=stylesheet][href^="${n}?"]`).length>0)r.resolve();else{let n=()=>{let o=document.createElement("link");return o.rel="stylesheet",o.crossOrigin=null,o.href=t,o.onerror=()=>{let l=document.createComment("");o.replaceWith(l),q(e,t,r,void 0,()=>l.replaceWith(n()))},o.onload=()=>{r.resolve()},o};document.head.appendChild(n())}else if(S(t,".js")){let o=document.querySelectorAll(`script[src="${t}"],script[src^="${t}?"],script[src="${n}"],script[src^="${n}?"]`);if(o.length>0)for(let n of Array.from(o))n.addEventListener("error",()=>{n.remove(),q(e,t,r)},{once:!0});else{let n=document.createElement("script");n.crossOrigin=null,n.src=t,n.onerror=()=>{n.remove(),q(e,t,r)},document.head.appendChild(n)}}else throw Error(`can't infer type of chunk from URL ${t}`)}return r.loadingStarted=!0,r.promise}e={async registerChunk(e,t){let r;if(null!=e&&(r=function(e){if("string"==typeof e)return e;let t=decodeURIComponent(e.src.replace(/[?#].*$/,""));return t.startsWith(R)?t.slice(R.length):t}(e),I("string"==typeof e?E(e):e.src).resolve()),null!=t){for(let e of t.otherChunks)I(E("string"==typeof e?e:e.path));if(await Promise.all(t.otherChunks.map(e=>{var t;return t=r,j(n.Runtime,t,e)})),t.runtimeModuleIds.length>0)for(let e of t.runtimeModuleIds)!function(e,t){let r=M[t];if(r){if(r.error)throw r.error;return}N(t,n.Runtime,e)}(r,e)}},loadChunkCached:(e,t)=>H(e,t)};var F=globalThis.TURBOPACK;globalThis.TURBOPACK={push:B},F.forEach(B)})();

package/.next/static/whCVdskjCUfluHW0q3o9p/_buildManifest.js

@@ -0,0 +1,11 @@
+self.__BUILD_MANIFEST = {
+  "__rewrites": {
+    "afterFiles": [],
+    "beforeFiles": [],
+    "fallback": []
+  },
+  "sortedPages": [
+    "/_app",
+    "/_error"
+  ]
+};self.__BUILD_MANIFEST_CB && self.__BUILD_MANIFEST_CB()

package/.next/static/whCVdskjCUfluHW0q3o9p/_clientMiddlewareManifest.js

@@ -0,0 +1,6 @@
+self.__MIDDLEWARE_MATCHERS = [
+  {
+    "regexp": "^(?:\\/(_next\\/data\\/[^/]{1,}))?(?:\\/((?!_next\\/static|_next\\/image|favicon.ico).*))(\\.json|\\.rsc|\\.segments\\/.+\\.segment\\.rsc)?[\\/#\\?]?$",
+    "originalSource": "/((?!_next/static|_next/image|favicon.ico).*)"
+  }
+];self.__MIDDLEWARE_MATCHERS_CB && self.__MIDDLEWARE_MATCHERS_CB()

package/.next/static/whCVdskjCUfluHW0q3o9p/_ssgManifest.js

@@ -0,0 +1 @@
+self.__SSG_MANIFEST=new Set([]);self.__SSG_MANIFEST_CB&&self.__SSG_MANIFEST_CB()

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Michael Mainguy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,173 @@
+# Cameras
+
+A web interface for discovering and managing Hikvision and Annke IP cameras on your local network.
+
+## Securing the web interface
+
+The dashboard and its API are protected by a single admin login. The login is stored in a
+file, **never** in plain text: the password is hashed with [scrypt](https://nodejs.org/api/crypto.html#cryptoscryptpassword-salt-keylen-options-callback)
+(random salt, N=65536, r=8, p=1), so it can't be recovered from the file.
+
+| Setting | Default |
+| --- | --- |
+| `ADMIN_AUTH_FILE` (environment variable, e.g. in `.env.local`) | `./.data/admin.json` |
+
+If the file doesn't exist, the app starts **unsecured**: anyone who can reach it can view your
+cameras and change their logins. To avoid ever running it that way, create the admin file
+before the first start (below).
+
+### Setting it up from the browser instead
+
+With no admin file, the server prints a **one-time setup code** in its console at startup:
+
+```
+====================================================================
+  No admin login is set up: the camera dashboard is NOT secured.
+
+  To secure it from a browser, open /setup and enter this one-time code:
+
+      XLZ7-Q4MB
+  ...
+```
+
+Opening the app sends you to `/setup`, which asks for that code plus the new admin username
+and password. Only someone who can see the server console can claim the login. After 5 wrong
+codes a new one is printed.
+
+You can also choose **Skip for now and run unsecured**. Every page then shows a red warning
+banner, the API stays open to anyone on the network, and the setup prompt returns the next
+time the browser is restarted.
+
+### Signing in
+
+Once an admin exists, every page and API call needs a session: pages redirect to `/login`,
+and the API answers `401`. A session lasts **12 hours from your last activity**. After 10
+wrong passwords from one address (or 100 from all addresses) within 15 minutes, logins are
+paused for up to 15 minutes. **Sign out** (top right) ends the session in that browser; to
+sign out everywhere, change the password.
+
+### Create the admin login (recommended)
+
+```bash
+npm run admin:create
+```
+
+It asks for a username and a password (at least 12 characters; typing is hidden, and you
+confirm it), then writes the file with owner-only permissions (`0600`). Options:
+
+```bash
+npm run admin:create -- --username admin      # only ask for the password
+npm run admin:create -- --force               # replace the existing admin (reset the password)
+printf '%s\n' "$PW" | npm run admin:create -- --username admin   # non-interactive, e.g. provisioning
+```
+
+### Without npm: a Node one-liner
+
+Any Node 24+ can produce the same file. The password is read from the terminal without
+echoing, so it never appears in your shell history or the process list:
+
+```bash
+(read -rs PW && export PW && umask 077 && mkdir -p .data && node -e '
+const c = require("node:crypto"), N = 65536, r = 8, p = 1, salt = c.randomBytes(16);
+const key = c.scryptSync(process.env.PW, salt, 64, { N, r, p, maxmem: 256 * N * r });
+const passwordHash = ["scrypt", N, r, p, salt.toString("base64"), key.toString("base64")].join("$");
+console.log(JSON.stringify({ version: 1, username: "admin", passwordHash }, null, 2));
+' > .data/admin.json)
+```
+
+The parentheses run it in a subshell, so the password variable and the stricter `umask` end
+with it.
+
+Change `username: "admin"` to taste. Usernames are 1–64 letters, digits, or `. _ @ -`.
+
+### File format
+
+```json
+{
+  "version": 1,
+  "username": "admin",
+  "passwordHash": "scrypt$65536$8$1$<salt, base64>$<64-byte key, base64>"
+}
+```
+
+A file that exists but is malformed stops the app from authenticating anyone rather than
+quietly turning security off; fix it or delete it.
+
+### Forgot the password?
+
+Run `npm run admin:create -- --force` (or delete the file and create it again). Changing the
+password signs out every existing session.
+
+## Live video (MediaMTX)
+
+Browsers can't play the cameras' RTSP streams, so live video goes through
+[MediaMTX](https://github.com/bluenviron/mediamtx), a single MIT-licensed binary that
+the app will run on this machine only (localhost). Install the pinned build with:
+
+```bash
+npm run video:install
+```
+
+This downloads the MediaMTX release pinned in `src/lib/mediamtx-install.ts` for your
+platform (macOS or Linux, Intel or ARM), checks its SHA-256 against the value committed
+there, and puts the binary in `./bin/` (not checked in). A download that doesn't match
+is refused and nothing is written. Re-running it does nothing if that build is already
+installed.
+
+To upgrade, change `version` in `MEDIAMTX_RELEASE` and replace every `sha256` with the
+values from that release's `checksums.sha256` on GitHub (cross-check them against the
+per-file digests on the release page), then run `npm run video:install` again.
+
+## Motion recording
+
+When a camera reports motion over ONVIF, the app records a clip and stops a few seconds
+after the motion ends. Clips are fragmented MP4 and play in the browser.
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `RECORDINGS_DIR` | `.data/recordings` | Where clips are written; point it at an external drive or NAS if you like. One folder per camera. |
+| `RECORD_STREAM` | `sub` | Which stream is recorded. `sub` is about 5 MB per minute of motion, `main` about 38 MB. |
+| `RECORD_KEEP_DAYS` | `7` | Clips older than this are deleted by an hourly sweep. |
+| `MOTION_RECORDING` | on | Set to `off` to record nothing. |
+
+There is no pre-roll: a clip starts when the camera reports motion, which is a second or
+two after movement begins. Recording pulls the camera only while motion lasts.
+
+---
+
+This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
+
+## Getting Started
+
+First, run the development server:
+
+```bash
+npm run dev
+# or
+yarn dev
+# or
+pnpm dev
+# or
+bun dev
+```
+
+Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
+
+You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+
+This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+
+## Learn More
+
+To learn more about Next.js, take a look at the following resources:
+
+- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
+- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+
+You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
+
+## Deploy on Vercel
+
+The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
+
+Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.

package/cli/onvif-dashboard.mjs

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+// The command people get from npm (vrek iss-kz5c88a). Node runs the TypeScript in src/lib
+// directly (type stripping, Node 24+), so there is nothing to build for the CLI itself.
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+import path from "node:path";
+import { applyEnvironment, firstRun, SECRETS_FILE } from "../src/lib/first-run.ts";
+import { installMediamtx } from "../src/lib/mediamtx-install.ts";
+import { adminFilePath, readAdminFile } from "../src/lib/admin-file.ts";
+
+const HELP = `onvif-dashboard — watch and manage ONVIF cameras on your own network
+
+Usage:
+  onvif-dashboard start           run the dashboard (PORT, HOSTNAME)
+  onvif-dashboard setup           choose where data lives and prepare this machine
+  onvif-dashboard admin           create or replace the admin login (--force to replace)
+  onvif-dashboard install-video   download MediaMTX, needed for live video and recording
+  onvif-dashboard help            this message
+
+Environment:
+  CAMERAS_DATA_DIR   where data lives (asked once, then remembered)
+  ADMIN_AUTH_FILE, CAMERA_REGISTRY_FILE, CAMERA_CREDENTIALS_FILE,
+  AUDIT_LOG_FILE, RECORDINGS_DIR, MEDIAMTX_BIN   override individual paths
+`;
+
+/** Asks a question when there's a terminal; returns undefined when there isn't. */
+function prompter() {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return undefined;
+  return async (question, fallback) => {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      return await rl.question(`${question} [${fallback}] `);
+    } finally {
+      rl.close();
+    }
+  };
+}
+
+async function setup() {
+  const ask = prompter();
+  const result = await firstRun({ ask });
+  console.log(`\nData folder: ${result.dataDir}`);
+  console.log(`Key for stored camera logins: ${path.join(result.dataDir, SECRETS_FILE)}`);
+
+  if (!result.videoReady) {
+    const install = ask ? await ask("Download MediaMTX now? Live video and recording need it. (y/n)", "y") : "n";
+    if (/^y/i.test(install || "y")) await installVideo();
+    else console.log("Skipped. Run onvif-dashboard install-video when you want live video.");
+  } else {
+    console.log("Live video: MediaMTX is installed.");
+  }
+
+  await applyEnvironment();
+  const admin = await readAdminFile(adminFilePath()).catch(() => null);
+  console.log(
+    admin
+      ? `\nAdmin login: already set up (${adminFilePath()}).`
+      : `\nNo admin login yet. Start the app and open it in a browser: it prints a one-time setup code` +
+          ` in this console, which you enter to create the login. You can skip that, but then anyone on` +
+          ` your network can use it.`,
+  );
+  console.log("\nReady. Start it with: onvif-dashboard start");
+}
+
+/** Runs the built server, with the remembered folder and stored key in its environment. */
+async function start() {
+  await applyEnvironment();
+  if (!process.env.CAMERA_CREDENTIALS_KEY) {
+    // Never started before: take the defaults quietly rather than refuse to run.
+    await firstRun();
+    await applyEnvironment();
+  }
+
+  const server = path.join(import.meta.dirname, "..", ".next", "standalone", "server.js");
+  if (!(await access(server).then(() => true, () => false))) {
+    console.error("The built server is missing. From a source checkout, run: npm run build");
+    process.exit(1);
+  }
+
+  const child = spawn(process.execPath, [server], {
+    cwd: path.dirname(server),
+    stdio: "inherit",
+    env: { ...process.env, PORT: process.env.PORT ?? "3000", HOSTNAME: process.env.HOSTNAME ?? "0.0.0.0" },
+  });
+  for (const signal of ["SIGINT", "SIGTERM"]) process.on(signal, () => child.kill(signal));
+  child.on("exit", (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
+}
+
+/** Creates the admin login, prompting for it; the script it runs has the interactive bits. */
+async function admin(args) {
+  await applyEnvironment();
+  const script = path.join(import.meta.dirname, "..", "scripts", "create-admin.mts");
+  const child = spawn(process.execPath, ["--disable-warning=MODULE_TYPELESS_PACKAGE_JSON", script, ...args], {
+    stdio: "inherit",
+    env: process.env,
+  });
+  child.on("exit", (code, signal) => process.exit(signal ? 1 : (code ?? 0)));
+}
+
+async function installVideo() {
+  const result = await installMediamtx();
+  console.log(
+    result.status === "installed"
+      ? `Installed MediaMTX ${result.version} at ${result.binary} (checksum verified).`
+      : `MediaMTX ${result.version} is already installed at ${result.binary}.`,
+  );
+}
+
+const { positionals } = parseArgs({ allowPositionals: true, strict: false });
+const command = positionals[0] ?? "help";
+
+try {
+  if (command === "start") await start();
+  else if (command === "setup") await setup();
+  else if (command === "admin") await admin(process.argv.slice(3));
+  else if (command === "install-video") await installVideo();
+  else if (command === "help" || command === "--help" || command === "-h") console.log(HELP);
+  else {
+    console.error(`Unknown command: ${command}\n`);
+    console.log(HELP);
+    process.exit(2);
+  }
+} catch (err) {
+  console.error(err instanceof Error ? err.message : err);
+  process.exit(1);
+}

package/cli/onvif-dashboard.test.ts

@@ -0,0 +1,73 @@
+import { execFile } from "node:child_process";
+import { mkdtemp, readFile, realpath, rm, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+/** Runs the published command as a real process, in a directory of its own. */
+const run = promisify(execFile);
+const CLI = path.join(import.meta.dirname, "onvif-dashboard.mjs");
+
+let dir: string;
+beforeEach(async () => {
+  // realpath because macOS temp folders are symlinks, and the CLI reports resolved paths.
+  dir = await realpath(await mkdtemp(path.join(os.tmpdir(), "cli-")));
+});
+afterEach(() => rm(dir, { recursive: true, force: true }));
+
+const cli = (args: string[]) =>
+  run(process.execPath, ["--disable-warning=MODULE_TYPELESS_PACKAGE_JSON", CLI, ...args], {
+    cwd: dir,
+    env: {
+      ...process.env,
+      XDG_CONFIG_HOME: path.join(dir, "config"),
+      CAMERAS_BIN_DIR: path.join(dir, "bin"),
+      CAMERAS_DATA_DIR: undefined,
+    },
+  }).catch((err: Error & { code?: number; stdout?: string; stderr?: string }) => ({
+    code: err.code,
+    stdout: err.stdout ?? "",
+    stderr: err.stderr ?? "",
+  }));
+
+describe("onvif-dashboard", () => {
+  it("explains itself, and says so when the command is unknown", async () => {
+    expect((await cli(["help"])).stdout).toContain("onvif-dashboard setup");
+    const bad = (await cli(["wat"])) as { code?: number; stderr: string };
+    expect(bad.code).toBe(2);
+    expect(bad.stderr).toContain("Unknown command: wat");
+  });
+
+  it("sets a machine up without a terminal: default folder, a key, and what to do next", async () => {
+    const { stdout } = await cli(["setup"]);
+    const data = path.join(dir, ".data");
+
+    expect(stdout).toContain("No terminal to ask");
+    expect(stdout).toContain(`Data folder: ${data}`);
+    expect(stdout).toContain("install-video");
+    expect(stdout).toContain("No admin login yet");
+    expect(stdout).toContain("onvif-dashboard start");
+
+    const secrets = path.join(data, "secrets.env");
+    expect((await stat(secrets)).mode & 0o777).toBe(0o600);
+    expect(await readFile(secrets, "utf8")).toMatch(/CAMERA_CREDENTIALS_KEY=[0-9a-f]{64}/);
+    expect(JSON.parse(await readFile(path.join(dir, "config/onvif-dashboard/config.json"), "utf8"))).toEqual({
+      dataDir: data,
+    });
+  });
+
+  it("offers the admin command the messages point people at", async () => {
+    const { stdout } = await cli(["admin", "--help"]);
+    expect(stdout).toContain("--force");
+  });
+
+  it("running it again changes nothing", async () => {
+    await cli(["setup"]);
+    const secrets = path.join(dir, ".data", "secrets.env");
+    const before = await readFile(secrets, "utf8");
+    const { stdout } = await cli(["setup"]);
+    expect(await readFile(secrets, "utf8")).toBe(before);
+    expect(stdout).not.toContain("Made a key");
+  });
+});

package/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "onvif-dashboard",
+  "version": "0.1.0",
+  "description": "Web dashboard for ONVIF cameras (Hikvision, Annke): discovery, live video over WebRTC, motion recording and settings, all on your own network.",
+  "keywords": [
+    "onvif",
+    "hikvision",
+    "annke",
+    "ip-camera",
+    "cctv",
+    "webrtc",
+    "nvr",
+    "surveillance",
+    "dashboard"
+  ],
+  "license": "MIT",
+  "author": "Michael Mainguy",
+  "repository": {
+    "type": "git",
+    "url": "git+https://git.dasfad.com/mmainguy/cameras.git"
+  },
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "files": [
+    ".next/standalone",
+    ".next/static",
+    "public",
+    "cli",
+    "src/lib/paths.ts",
+    "src/lib/first-run.ts",
+    "src/lib/mediamtx-install.ts",
+    "src/lib/admin-file.ts",
+    "scripts/create-admin.mts",
+    "scripts/install-mediamtx.mts",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "dev": "next dev",
+    "build": "next build && node scripts/bundle-standalone.mjs",
+    "start": "next start",
+    "lint": "eslint",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
+    "admin:create": "node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON scripts/create-admin.mts",
+    "video:install": "node --disable-warning=MODULE_TYPELESS_PACKAGE_JSON scripts/install-mediamtx.mts"
+  },
+  "dependencies": {
+    "@tanstack/react-query": "^5.103.1",
+    "lucide-react": "^1.47.0",
+    "next": "16.3.5",
+    "onvif": "github:mikemainguy/onvif#e8c340fdf97cf4a42da23ce810b4ecdd8c93dd4b",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "server-only": "^0.0.1",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@tailwindcss/postcss": "^4",
+    "@testing-library/dom": "^10.4.2",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "^24.13.6",
+    "@types/react": "^19",
+    "@types/react-dom": "^19",
+    "@vitejs/plugin-react": "^6.1.1",
+    "@vitest/coverage-v8": "^5.0.1",
+    "eslint": "^9",
+    "eslint-config-next": "16.3.5",
+    "jsdom": "^29.1.1",
+    "tailwindcss": "^4",
+    "typescript": "^5",
+    "vitest": "^5.0.1"
+  },
+  "bin": {
+    "onvif-dashboard": "cli/onvif-dashboard.mjs"
+  }
+}

package/public/file.svg

@@ -0,0 +1 @@
+<svg fill="none" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M14.5 13.5V5.41a1 1 0 0 0-.3-.7L9.8.29A1 1 0 0 0 9.08 0H1.5v13.5A2.5 2.5 0 0 0 4 16h8a2.5 2.5 0 0 0 2.5-2.5m-1.5 0v-7H8v-5H3v12a1 1 0 0 0 1 1h8a1 1 0 0 0 1-1M9.5 5V2.12L12.38 5zM5.13 5h-.62v1.25h2.12V5zm-.62 3h7.12v1.25H4.5zm.62 3h-.62v1.25h7.12V11z" clip-rule="evenodd" fill="#666" fill-rule="evenodd"/></svg>

package/public/globe.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><g clip-path="url(#a)"><path fill-rule="evenodd" clip-rule="evenodd" d="M10.27 14.1a6.5 6.5 0 0 0 3.67-3.45q-1.24.21-2.7.34-.31 1.83-.97 3.1M8 16A8 8 0 1 0 8 0a8 8 0 0 0 0 16m.48-1.52a7 7 0 0 1-.96 0H7.5a4 4 0 0 1-.84-1.32q-.38-.89-.63-2.08a40 40 0 0 0 3.92 0q-.25 1.2-.63 2.08a4 4 0 0 1-.84 1.31zm2.94-4.76q1.66-.15 2.95-.43a7 7 0 0 0 0-2.58q-1.3-.27-2.95-.43a18 18 0 0 1 0 3.44m-1.27-3.54a17 17 0 0 1 0 3.64 39 39 0 0 1-4.3 0 17 17 0 0 1 0-3.64 39 39 0 0 1 4.3 0m1.1-1.17q1.45.13 2.69.34a6.5 6.5 0 0 0-3.67-3.44q.65 1.26.98 3.1M8.48 1.5l.01.02q.41.37.84 1.31.38.89.63 2.08a40 40 0 0 0-3.92 0q.25-1.2.63-2.08a4 4 0 0 1 .85-1.32 7 7 0 0 1 .96 0m-2.75.4a6.5 6.5 0 0 0-3.67 3.44 29 29 0 0 1 2.7-.34q.31-1.83.97-3.1M4.58 6.28q-1.66.16-2.95.43a7 7 0 0 0 0 2.58q1.3.27 2.95.43a18 18 0 0 1 0-3.44m.17 4.71q-1.45-.12-2.69-.34a6.5 6.5 0 0 0 3.67 3.44q-.65-1.27-.98-3.1" fill="#666"/></g><defs><clipPath id="a"><path fill="#fff" d="M0 0h16v16H0z"/></clipPath></defs></svg>

package/public/next.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 394 80"><path fill="#000" d="M262 0h68.5v12.7h-27.2v66.6h-13.6V12.7H262V0ZM149 0v12.7H94v20.4h44.3v12.6H94v21h55v12.6H80.5V0h68.7zm34.3 0h-17.8l63.8 79.4h17.9l-32-39.7 32-39.6h-17.9l-23 28.6-23-28.6zm18.3 56.7-9-11-27.1 33.7h17.8l18.3-22.7z"/><path fill="#000" d="M81 79.3 17 0H0v79.3h13.6V17l50.2 62.3H81Zm252.6-.4c-1 0-1.8-.4-2.5-1s-1.1-1.6-1.1-2.6.3-1.8 1-2.5 1.6-1 2.6-1 1.8.3 2.5 1a3.4 3.4 0 0 1 .6 4.3 3.7 3.7 0 0 1-3 1.8zm23.2-33.5h6v23.3c0 2.1-.4 4-1.3 5.5a9.1 9.1 0 0 1-3.8 3.5c-1.6.8-3.5 1.3-5.7 1.3-2 0-3.7-.4-5.3-1s-2.8-1.8-3.7-3.2c-.9-1.3-1.4-3-1.4-5h6c.1.8.3 1.6.7 2.2s1 1.2 1.6 1.5c.7.4 1.5.5 2.4.5 1 0 1.8-.2 2.4-.6a4 4 0 0 0 1.6-1.8c.3-.8.5-1.8.5-3V45.5zm30.9 9.1a4.4 4.4 0 0 0-2-3.3 7.5 7.5 0 0 0-4.3-1.1c-1.3 0-2.4.2-3.3.5-.9.4-1.6 1-2 1.6a3.5 3.5 0 0 0-.3 4c.3.5.7.9 1.3 1.2l1.8 1 2 .5 3.2.8c1.3.3 2.5.7 3.7 1.2a13 13 0 0 1 3.2 1.8 8.1 8.1 0 0 1 3 6.5c0 2-.5 3.7-1.5 5.1a10 10 0 0 1-4.4 3.5c-1.8.8-4.1 1.2-6.8 1.2-2.6 0-4.9-.4-6.8-1.2-2-.8-3.4-2-4.5-3.5a10 10 0 0 1-1.7-5.6h6a5 5 0 0 0 3.5 4.6c1 .4 2.2.6 3.4.6 1.3 0 2.5-.2 3.5-.6 1-.4 1.8-1 2.4-1.7a4 4 0 0 0 .8-2.4c0-.9-.2-1.6-.7-2.2a11 11 0 0 0-2.1-1.4l-3.2-1-3.8-1c-2.8-.7-5-1.7-6.6-3.2a7.2 7.2 0 0 1-2.4-5.7 8 8 0 0 1 1.7-5 10 10 0 0 1 4.3-3.5c2-.8 4-1.2 6.4-1.2 2.3 0 4.4.4 6.2 1.2 1.8.8 3.2 2 4.3 3.4 1 1.4 1.5 3 1.5 5h-5.8z"/></svg>

package/public/vercel.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1155 1000"><path d="m577.3 0 577.4 1000H0z" fill="#fff"/></svg>

package/public/window.svg

@@ -0,0 +1 @@
+<svg fill="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16"><path fill-rule="evenodd" clip-rule="evenodd" d="M1.5 2.5h13v10a1 1 0 0 1-1 1h-11a1 1 0 0 1-1-1zM0 1h16v11.5a2.5 2.5 0 0 1-2.5 2.5h-11A2.5 2.5 0 0 1 0 12.5zm3.75 4.5a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5M7 4.75a.75.75 0 1 1-1.5 0 .75.75 0 0 1 1.5 0m1.75.75a.75.75 0 1 0 0-1.5.75.75 0 0 0 0 1.5" fill="#666"/></svg>