feat: add bounded large-deployment discovery

test/runtime-contract.test.js

@@ -78,7 +78,20 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
     openExternal: async () => {},
   });
 
-  assert.deepEqual(await runtime.getDevices(), { success: true, devices: [{ guid: '550e8400-e29b-41d4-a716-446655440000' }] });
+  assert.deepEqual(await runtime.getDevices(), {
+    success: true,
+    devices: [{
+      id: '550e8400-e29b-41d4-a716-446655440000',
+      name: null,
+      type: null,
+      model: null,
+      address: null,
+      siteId: null,
+      deviceGroupId: null,
+      displayStatus: null,
+      localStorage: null,
+    }],
+  });
   const launched = await runtime.launchProxy(
     '550e8400-e29b-41d4-a716-446655440000',
     'proxy.operator@example.com'
@@ -102,6 +115,57 @@ test('runtime keeps Alta credentials in main-owned modules and exposes only non-
   assert.equal((await runtime.stopProxy(999)).success, false);
 });
 
+test('runtime discovers and projects hierarchy while metadata failures preserve cameras', async () => {
+  const deviceId = '550e8400-e29b-41d4-a716-446655440000';
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => [{
+        guid: deviceId,
+        name: 'Camera',
+        server_group_id: 'site-1',
+        secret: 'drop-me',
+      }],
+      getDeviceSites: async () => { throw Object.assign(new Error('tenant secret'), { code: 'ALTA_HTTP_ERROR' }); },
+      getDeviceGroups: async () => [{ id: 'group-1', name: 'Lobby', parent_id: null }],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+  });
+
+  const result = await runtime.getDeviceHierarchy();
+  assert.equal(result.success, true);
+  assert.deepEqual(result.hierarchy.devices.map(({ id }) => id), [deviceId]);
+  assert.deepEqual(result.hierarchy.sites, []);
+  assert.deepEqual(result.hierarchy.groups, [{
+    id: 'group-1', name: 'Lobby', parentId: null, pendingDeletionStart: null,
+  }]);
+  assert.equal(result.hierarchy.diagnostics.sites.error, 'Device sites unavailable');
+  assert.doesNotMatch(JSON.stringify(result), /drop-me|tenant secret/);
+});
+
+test('runtime enforces a bounded whole-discovery deadline', async () => {
+  const runtime = new AppRuntime({
+    sessionStore: createSessionStore(),
+    altaClient: {
+      getDevices: async () => new Promise(() => {}),
+      getDeviceSites: async () => [],
+      getDeviceGroups: async () => [],
+    },
+    proxyManager: { listTrackedProxies: () => [] },
+    discoveryTimeoutMs: 25,
+  });
+  const result = await runtime.getDeviceHierarchy();
+  assert.deepEqual(result, {
+    success: false,
+    hierarchy: { devices: [], sites: [], groups: [] },
+    message: 'Alta device discovery timed out',
+  });
+});
+
+test('runtime rejects discovery deadlines above 60 seconds', () => {
+  assert.throws(() => new AppRuntime({ discoveryTimeoutMs: 60_001 }), /discovery timeout/i);
+});
+
 test('runtime rejects invalid usernames before calling the proxy manager', async () => {
   const sessionStore = createSessionStore();
   sessionStore.establish('https://customer.avasecurity.com', 'top-secret-cookie');
@@ -364,7 +428,8 @@ test('preload and renderer expose only narrow, credential-free contracts', () =>
   const renderer = read('renderer.js');
   const html = read('index.html');
   const expectedMethods = [
-    'getDevices', 'getDeviceSites', 'getAuthInfo', 'launchProxy', 'stopProxy', 'disconnect',
+    'getDevices', 'getDeviceSites', 'getDeviceGroups', 'getDeviceHierarchy', 'getAuthInfo',
+    'launchProxy', 'stopProxy', 'disconnect',
     'getConnectionState', 'checkForUpdates', 'openFixedReleasesPage', 'rotatePairing',
     'revokePairing', 'getPairingStatus', 'onConnectionStateChanged',
   ];