@camstack/addon-model-studio 1.1.217 → 1.1.218

package/dist/model-studio.addon.mjs

@@ -5738,7 +5738,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BNeXenvr.mjs
+//#region ../types/dist/sleep-B0JG7-_F.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15396,6 +15396,10 @@ var DeviceInfoSchema = object({
 	isCamera: boolean(),
 	/** Current config values — serializable snapshot */
 	config: record(string(), unknown()),
+	/** Paths inside `config` the device's schema declares secret (D783) —
+	*  what the non-admin redaction withholds. Paths, never values. Absent
+	*  when the owning runner has not reported them. */
+	secretConfigPaths: array(string()).optional(),
 	/** Hardware + identity blob (manufacturer / model / firmware / sn /
 	*  uid / mac / …). Populated by drivers; editable via setMetadata. */
 	metadata: record(string(), unknown()).nullable().optional(),
@@ -15601,7 +15605,13 @@ var DeviceRegisterPayloadSchema = object({
 	*  call (workers re-register on init), so probe-driven updates
 	*  (e.g. PTZ flag flipping after the abilities probe) propagate. */
 	features: array(string()).optional(),
-	config: record(string(), unknown())
+	config: record(string(), unknown()),
+	/** Config paths the device's own schema DECLARES secret
+	*  (`.meta({ secret: true })` — dotted, `[]` for array items, e.g.
+	*  `connection.password`). Re-published on every register; the non-admin
+	*  redaction withholds them at any depth (D783). Optional: an older runner
+	*  omits it and the keyword backstop applies. */
+	secretConfigPaths: array(string()).optional()
 });
 var DeviceRemovePayloadSchema = object({ deviceId: number() });
 var DevicePersistConfigPayloadSchema = object({
@@ -17260,7 +17270,14 @@ var LoginMethodContributionSchema = discriminatedUnion("kind", [
 		icon: string().optional(),
 		/** Addon-owned HTTP route the button navigates to (GET). */
 		startUrl: string(),
-		stage: LoginStageEnum
+		stage: LoginStageEnum,
+		/**
+		* The provider names an external identity a signed-in user can link to
+		* their own account (D782): `auth.listLinkableProviders` /
+		* `beginExternalLink` offer exactly the redirect methods that set this,
+		* whatever their id. Absent / false — a login button only (magic-link).
+		*/
+		linkable: boolean().optional()
 	}),
 	object({
 		kind: literal("widget"),
@@ -22663,7 +22680,13 @@ var RetrainFrameSchema = object({
 	sizeBytes: number().int(),
 	width: number().int(),
 	height: number().int(),
-	copiedAt: number()
+	copiedAt: number(),
+	/** When the CAMERA captured the frame. Absent on a copy taken before D785. */
+	capturedAt: number().optional(),
+	/** The operator's "every subject in this frame is boxed". Detector
+	*  evaluation keeps only complete frames: an unboxed subject would count as
+	*  a false positive. */
+	complete: boolean()
 });
 /** Why a copy-on-select could not be honoured — named, never a silent skip. */
 var RetrainCopyRefusalSchema = _enum([
@@ -22684,6 +22707,51 @@ var RetrainFrameListSchema = object({
 	/** What the page pre-selects — the native key frame when one survives. */
 	autoPickMediaId: number().int().optional()
 });
+/**
+* Which frames an annotated export carries. Every field narrows; an empty
+* filter is every annotated copy. A dataset VERSION is a frozen `frameIds`
+* list owned by whoever trains (the training orchestrator), so `frameIds` is
+* the primitive a version export uses; `batchId` re-selects what an earlier
+* export carried (`exportedInBatch`).
+*/
+var RetrainExportFilterSchema = object({
+	deviceIds: array(number()).optional(),
+	frameIds: array(string()).max(2e4).optional(),
+	batchId: string().optional(),
+	/** Only frames the operator marked complete (all subjects boxed). */
+	completeOnly: boolean().optional()
+});
+/**
+* `frames`: the full frame copies, boxes in `annotations.json`.
+* `crops`: additionally one JPEG per subject, cut with the runtime detail-crop
+* convention — the classifier layout.
+*/
+var RetrainExportLayoutSchema = _enum(["frames", "crops"]);
+/**
+* Where `writeRetrainArchive` streams the tar: one HTTP request whose body is
+* the archive, sent chunk by chunk. Covers a presigned PUT and a provider
+* addon's data-plane upload route alike. Headers are sent verbatim and never
+* logged.
+*/
+var RetrainArchiveTargetSchema = object({
+	kind: literal("http"),
+	method: _enum(["PUT", "POST"]),
+	url: string().url(),
+	headers: record(string(), string()).optional()
+});
+var RetrainArchiveResultSchema = object({
+	batchId: string(),
+	frames: number().int(),
+	crops: number().int(),
+	annotations: number().int(),
+	/** Frames planned but not shipped (unreadable copy, path too long). */
+	missing: number().int(),
+	bytes: number().int(),
+	/** sha256 of the exact bytes sent. */
+	sha256: string(),
+	/** The target's HTTP status. */
+	status: number().int()
+});
 /** What the operator asked the assist to look for. */
 var RetrainAssistSubjectSchema = discriminatedUnion("kind", [object({
 	kind: literal("package"),
@@ -23478,9 +23546,25 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 }), RetrainTransitionResultSchema, {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceIds: array(number()).optional() }), object({ url: string() }), {
+}), method(RetrainExportFilterSchema.extend({ layout: RetrainExportLayoutSchema.optional() }), object({ url: string() }), {
 	kind: "query",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	trackId: string(),
+	frameId: string(),
+	complete: boolean()
+}), RetrainFrameSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	filter: RetrainExportFilterSchema,
+	layout: RetrainExportLayoutSchema,
+	target: RetrainArchiveTargetSchema
+}), RetrainArchiveResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 60 * 6e4
 }), method(object({
 	/** Which of the three event tables owns the row. */
 	ownerType: EventOwnerTypeSchema,
@@ -26770,7 +26854,19 @@ var SsoBridgeClaimsSchema = object({
 	* editing a descriptor must not retroactively extend or shorten a link the
 	* operator already consented to.
 	*/
-	refreshTtl: union([number().int().positive(), literal("never")]).optional()
+	refreshTtl: union([number().int().positive(), literal("never")]).optional(),
+	/**
+	* Opaque handle of a hub-side LINK intent (D782). Set by an OIDC callback
+	* that was started from a signed-in user's "Link" button: the finish then
+	* links this identity to the intent's user instead of signing anyone in.
+	* The handle carries no user id — the hub resolves it, single-use.
+	*/
+	linkIntent: string().optional(),
+	/**
+	* Verified `iss` of the id_token behind an OIDC login bridge (D782). A
+	* subject is unique only per issuer, so a link is bound to it.
+	*/
+	issuer: string().optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
@@ -28676,7 +28772,22 @@ DeviceType.Camera, method(object({ deviceId: number().int().nonnegative() }), ar
 	* field their hints were silently stripped by the schema and the
 	* adaptive ladder started blind on the client's display size.
 	*/
-	hints: webrtcClientHintsSchema.optional()
+	hints: webrtcClientHintsSchema.optional(),
+	/**
+	* Talk-back (D771): relay the PEER's audio to the device's speaker
+	* through the `intercom` cap's push-talk triple. When `true` and the
+	* offer lets the peer send audio, the answer's audio is `sendrecv`
+	* and every inbound frame goes to `intercom.pushTalkAudio` for this
+	* `deviceId`; absent/false answers `sendonly`, as for every viewer.
+	*
+	* TRUSTED-CALLER ONLY. Set by the Alexa export for an Echo on a camera
+	* with `intercom`, when the linked user may control that camera. The
+	* hub STRIPS it from every request-bound call (a browser), exactly as
+	* it overwrites `relayOnly` — a viewer's talk permission is the
+	* intercom cap's own surface (share tokens gate it there), and this
+	* flag must not become a second door to the camera's speaker.
+	*/
+	talkback: boolean().optional()
 }), object({
 	sessionId: string(),
 	sdpAnswer: string()
@@ -36720,6 +36831,32 @@ var TotpStatusSchema = object({
 	/** Null when no row exists OR the row is still pending confirmation. */
 	confirmedAt: number().nullable()
 });
+/**
+* user-management — singleton capability for user accounts, API keys,
+* and scoped tokens.
+*
+* v2 model: every method gated by `auth: 'admin'`. Admin-only delegation
+* — the subset check on `setUserScopes` / `createScopedToken` is moot
+* because non-admins never reach these. If/when we open non-admin
+* delegation, structural caller-scope subset check goes inside the
+* provider.
+*/
+var ExternalIdentitySchema = object({
+	/** Login-method id of the provider instance, e.g. `auth-oidc/authentik`. */
+	provider: string(),
+	/** The IdP's stable subject (`sub`) for this account. */
+	subject: string(),
+	/** The verified `iss` of the IdP the identity was linked under — `sub` is unique only per issuer. */
+	issuer: string(),
+	userId: string(),
+	/** What the IdP called the account at link time (username / email) — display only. */
+	label: string().optional(),
+	linkedAt: number()
+});
+var ExternalIdentityKeySchema = object({
+	provider: string().min(1),
+	subject: string().min(1)
+});
 method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserInputSchema, UserSummarySchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -36833,7 +36970,22 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	userId: string(),
 	username: string(),
 	scopes: array(TokenScopeSchema)
-}).nullable(), { access: "view" }), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
+}).nullable(), { access: "view" }), method(object({ userId: string() }), array(ExternalIdentitySchema), { auth: "admin" }), method(ExternalIdentityKeySchema, object({
+	userId: string(),
+	issuer: string()
+}).nullable(), { auth: "admin" }), method(ExternalIdentityKeySchema.extend({
+	userId: string(),
+	issuer: string().min(1),
+	label: string().optional()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "create"
+}), method(ExternalIdentityKeySchema.extend({ userId: string() }), object({ success: boolean() }), {
+	kind: "mutation",
+	auth: "admin",
+	access: "delete"
+}), method(_void(), array(OauthSessionSummarySchema), { auth: "admin" }), method(object({ id: string() }), object({ success: boolean() }), {
 	kind: "mutation",
 	auth: "admin",
 	access: "delete"
@@ -41737,6 +41889,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.setRetrainFrameComplete": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.setTrackFlags": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -41773,6 +41931,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.writeRetrainArchive": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineExecutor.cacheFrameInPool": {
 		capName: "pipeline-executor",
 		capScope: "system",
@@ -44125,18 +44289,36 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"userManagement.findUserByExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.getTotpStatus": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.linkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"userManagement.listApiKeys": {
 		capName: "user-management",
 		capScope: "system",
 		addonId: null,
 		access: "view"
 	},
+	"userManagement.listExternalIdentities": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"userManagement.listOauthSessions": {
 		capName: "user-management",
 		capScope: "system",
@@ -44215,6 +44397,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"userManagement.unlinkExternalIdentity": {
+		capName: "user-management",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
 	"userManagement.updateUser": {
 		capName: "user-management",
 		capScope: "system",
@@ -47554,6 +47742,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineAnalytics.setRetrainFrameComplete": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineAnalytics.setTrackFlags": [{
 		name: "deviceId",
 		form: "single",

package/dist/{player-overlays-BU4aAx02.mjs → player-overlays-CYNFSDYV.mjs}

@@ -1,5 +1,5 @@
 import { b as e, g as t, l as n, u as r } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare__react__loadShare__.js-CHL8loOl.mjs";
-import { b as i, y as a } from "./responsive-CU7BiLwa.mjs";
+import { b as i, y as a } from "./responsive-oZzHP3lx.mjs";
 import { n as o, r as s, t as c } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-ds_Ehzaa.mjs";
 var l = i("chevron-down", [["path", {
 	d: "m6 9 6 6 6-6",

package/dist/remoteEntry.js

@@ -1,2 +1,2 @@
-import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-XvoS0Enz.mjs";
+import { n as e, t } from "./virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-BA6FOYZy.mjs";
 export { t as get, e as init };

package/dist/{responsive-CU7BiLwa.mjs → responsive-oZzHP3lx.mjs}

@@ -1,6 +1,6 @@
 import { _ as e, b as t, c as n, g as r, l as i, m as a, n as o, r as s, t as c, u as l } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare__react__loadShare__.js-CHL8loOl.mjs";
 import "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare__react_mf_1_jsx_mf_2_runtime__loadShare__.js-ds_Ehzaa.mjs";
-import { f as u } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-DgQsf8Wc.mjs";
+import { f as u } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare___mf_0_camstack_mf_1_types__loadShare__.js-CE6l15x5.mjs";
 //#region ../../node_modules/lucide-react/dist/esm/shared/src/utils/mergeClasses.js
 t();
 var d = (...e) => e.filter((e, t, n) => !!e && e.trim() !== "" && n.indexOf(e) === t).join(" ").trim(), f = (e) => e.replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase(), p = (e) => e.replace(/^([A-Z])|[\s-_]+(\w)/g, (e, t, n) => n ? n.toUpperCase() : t.toLowerCase()), m = (e) => {

package/dist/{scene-monitor-copy-BX9UvcxQ.mjs → scene-monitor-copy-C2YKn7wo.mjs}

@@ -1,5 +1,5 @@
 import { b as e, c as t, g as n, m as r } from "./_virtual_mf___mfe_internal__addon_model_studio_page__loadShare__react__loadShare__.js-CHL8loOl.mjs";
-import { b as i } from "./responsive-CU7BiLwa.mjs";
+import { b as i } from "./responsive-oZzHP3lx.mjs";
 var a = i("camera", [["path", {
 	d: "M13.997 4a2 2 0 0 1 1.76 1.05l.486.9A2 2 0 0 0 18.003 7H20a2 2 0 0 1 2 2v9a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V9a2 2 0 0 1 2-2h1.997a2 2 0 0 0 1.759-1.048l.489-.904A2 2 0 0 1 10.004 4z",
 	key: "18u6gg"

package/dist/{square-DhCedQoj.mjs → square-DUBjO0Wq.mjs}

@@ -1,4 +1,4 @@
-import { b as e } from "./responsive-CU7BiLwa.mjs";
+import { b as e } from "./responsive-oZzHP3lx.mjs";
 var t = e("eye-off", [
 	["path", {
 		d: "M10.733 5.076a10.744 10.744 0 0 1 11.205 6.575 1 1 0 0 1 0 .696 10.747 10.747 0 0 1-1.444 2.49",

package/dist/{trash-2-BCjCExeI.mjs → trash-2-DpaexsRt.mjs}

@@ -1,4 +1,4 @@
-import { b as e } from "./responsive-CU7BiLwa.mjs";
+import { b as e } from "./responsive-oZzHP3lx.mjs";
 var t = e("trash-2", [
 	["path", {
 		d: "M10 11v6",

package/dist/{virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-XvoS0Enz.mjs → virtual_mf-REMOTE_ENTRY_ID___mfe_internal__addon_model_studio_page__remoteEntry_js-BA6FOYZy.mjs}

@@ -2753,7 +2753,7 @@ async function rr(e) {
 	}
 }
 async function ir() {
-	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_model_studio_page-BPVoz67A.mjs")).catch((e) => {
+	return tr ||= rr(() => import("./_virtual_mf-localSharedImportMap___mfe_internal__addon_model_studio_page-WTUyarUL.mjs")).catch((e) => {
 		throw tr = void 0, e;
 	}), tr;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-model-studio",
-  "version": "1.1.217",
+  "version": "1.1.218",
   "description": "Custom detection model registry, conversion & distribution for CamStack",
   "keywords": [
     "camstack",

package/python/__tests__/test_calibration.py

@@ -0,0 +1,56 @@
+"""INT8 calibration inputs (cloud-training P6): which images, and how they are
+fed. Calibration must see frames the way the runtime feeds the model — the
+inference pool's letterbox is CENTRED (pad = (size - new) // 2, grey 114) —
+and must be able to use the operator's own frames, i.e. the hub's annotated
+export, whose frames sit in nested folders next to `annotations.json`."""
+import numpy as np
+import pytest
+
+cv2 = pytest.importorskip("cv2")
+
+from convert_lib import calibration_images, letterbox_for_calibration  # noqa: E402
+
+
+def _touch(path, data=b"x"):
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_bytes(data)
+
+
+def test_a_flat_folder_is_read_in_file_name_order(tmp_path):
+    for name in ("b.jpg", "a.jpg", "c.png", "notes.txt"):
+        _touch(tmp_path / name)
+    assert [p.name for p in calibration_images(str(tmp_path), 10)] == ["a.jpg", "b.jpg", "c.png"]
+
+
+def test_the_sample_count_is_a_cap(tmp_path):
+    for i in range(5):
+        _touch(tmp_path / f"{i}.jpg")
+    assert len(calibration_images(str(tmp_path), 3)) == 3
+
+
+def test_an_export_directory_calibrates_on_its_frames_only(tmp_path):
+    _touch(tmp_path / "annotations.json", b"{}")
+    _touch(tmp_path / "frames" / "615" / "t1" / "a.jpg")
+    _touch(tmp_path / "frames" / "617" / "t2" / "b.jpg")
+    _touch(tmp_path / "crops" / "person" / "x.jpg")
+    names = [p.relative_to(tmp_path).as_posix() for p in calibration_images(str(tmp_path), 10)]
+    assert names == ["frames/615/t1/a.jpg", "frames/617/t2/b.jpg"]
+
+
+def test_an_empty_folder_is_refused(tmp_path):
+    with pytest.raises(ValueError):
+        calibration_images(str(tmp_path), 10)
+
+
+def test_the_letterbox_is_centred_like_the_runtime():
+    rgb = np.full((100, 200, 3), 255, dtype=np.uint8)  # 2:1 white frame
+    out = letterbox_for_calibration(rgb, 64)
+    assert out.shape == (1, 3, 64, 64)
+    assert out.dtype == np.float32
+    # Content 64x32, centred: grey rows 0..15 and 48..63, white in between.
+    column = out[0, 0, :, 32]
+    assert column[0] == pytest.approx(114 / 255)
+    assert column[63] == pytest.approx(114 / 255)
+    assert column[32] == pytest.approx(1.0)
+    assert column[15] == pytest.approx(114 / 255)
+    assert column[16] == pytest.approx(1.0)

package/python/convert_lib.py

@@ -64,32 +64,61 @@ def validate_openvino_ir(xml_path: str) -> None:
             raise ValueError(f"IR {xml_path} has an empty-named tensor")
 
 
+CALIBRATION_SUFFIXES = {".jpg", ".jpeg", ".png"}
+
+
+def calibration_images(calib_dir: str, max_samples: int) -> "list[Path]":
+    """The first ``max_samples`` calibration images of ``calib_dir``, in path order.
+
+    A flat folder (COCO val2017) is read exactly as before: file-name order. A
+    folder is walked recursively, so the operator's own frames work as they
+    come. The hub's annotated export (a folder holding ``annotations.json``)
+    calibrates on its ``frames/`` only: its ``crops/`` are classifier inputs,
+    not what a root detector is fed.
+    """
+    root = Path(calib_dir)
+    if not root.is_dir():
+        raise ValueError(f"calibration folder {calib_dir} does not exist")
+    base = root / "frames" if (root / "annotations.json").is_file() else root
+    images = sorted(
+        (p for p in base.rglob("*") if p.is_file() and p.suffix.lower() in CALIBRATION_SUFFIXES),
+        key=lambda p: p.relative_to(base).as_posix(),
+    )[:max_samples]
+    if not images:
+        raise ValueError(f"no calibration images in {calib_dir}")
+    return images
+
+
+def letterbox_for_calibration(rgb, imgsz: int):
+    """``rgb`` (HxWx3 uint8) → ``[1,3,imgsz,imgsz]`` float32 in [0,1], letterboxed
+    as the inference pool does (``inference_pool.letterbox_image``): scale by the
+    long side, truncate, CENTRE with grey 114 padding."""
+    import cv2
+    import numpy as np
+
+    h, w = rgb.shape[:2]
+    scale = imgsz / max(h, w)
+    nw, nh = int(w * scale), int(h * scale)
+    pad_x, pad_y = (imgsz - nw) // 2, (imgsz - nh) // 2
+    resized = rgb if (nw, nh) == (w, h) else cv2.resize(rgb, (nw, nh), interpolation=cv2.INTER_LINEAR)
+    canvas = np.full((imgsz, imgsz, 3), 114, dtype=np.uint8)
+    canvas[pad_y : pad_y + nh, pad_x : pad_x + nw] = resized
+    chw = canvas.transpose(2, 0, 1).astype(np.float32) / 255.0
+    return chw[np.newaxis, ...]
+
+
 def quantize_openvino_int8(
     onnx_path: str, out_xml: str, calib_dir: str, imgsz: int, max_samples: int = 300
 ) -> None:
     import cv2
-    import numpy as np
     import openvino as ov
     import nncf
 
-    calib = Path(calib_dir)
-    images = sorted(
-        p for p in calib.iterdir() if p.suffix.lower() in {".jpg", ".jpeg", ".png"}
-    )[:max_samples]
-    if not images:
-        raise ValueError(f"no calibration images in {calib_dir}")
+    images = calibration_images(calib_dir, max_samples)
 
     def preprocess(path: Path):
         img = cv2.imread(str(path))
-        img = cv2.cvtColor(img, cv2.COLOR_BGR2RGB)
-        h, w = img.shape[:2]
-        scale = imgsz / max(h, w)
-        nh, nw = int(round(h * scale)), int(round(w * scale))
-        resized = cv2.resize(img, (nw, nh))
-        canvas = np.full((imgsz, imgsz, 3), 114, dtype=np.uint8)
-        canvas[:nh, :nw] = resized
-        chw = canvas.transpose(2, 0, 1).astype(np.float32) / 255.0
-        return chw[np.newaxis, ...]
+        return letterbox_for_calibration(cv2.cvtColor(img, cv2.COLOR_BGR2RGB), imgsz)
 
     dataset = nncf.Dataset(images, lambda p: preprocess(p))
     ov_model = ov.convert_model(onnx_path)