@camstack/addon-provider-wyze 0.2.132 → 0.2.133

package/dist/addon.js

@@ -5409,7 +5409,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-Cr5YOk3m.mjs
+//#region ../types/dist/sleep-DujUvOcb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -15002,6 +15002,14 @@ var KeychainAuditEntrySchema = object({
 	ref: string().nullable(),
 	detail: string().nullable()
 });
+var KEYCHAIN_RESET_CONFIRMATION = "RESET KEYCHAIN";
+/**
+* Secrets the HUB itself holds (owner `system`) that no settings form shows:
+* `jwt-signing-key` — the session signing key (D797). It is always "in use",
+* never an orphan; it is generated on a fresh hub and replaced only through
+* {@link keychainAdminCapability.methods.setSystemSecret}.
+*/
+var SystemHeldSecretNameSchema = _enum(["jwt-signing-key"]);
 method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}), array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }), method(object({ limit: number().int().min(1).max(500).optional() }), array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }), method(object({ ref: string().min(1) }), object({
 	value: string(),
 	version: number().int()
@@ -15009,6 +15017,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	name: SystemHeldSecretNameSchema,
+	value: string().min(16)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -15038,7 +15056,7 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({ confirm: literal("RESET KEYCHAIN") }), object({
+}), method(object({ confirm: literal(KEYCHAIN_RESET_CONFIRMATION) }), object({
 	archivedCollection: string().nullable(),
 	archived: number().int()
 }), {
@@ -23482,6 +23500,9 @@ var RetrainExportFilterSchema = object({
 	frameIds: array(string()).max(2e4).optional(),
 	/** Only frames in at least one of these named collections. */
 	collectionIds: array(string()).max(200).optional(),
+	/** Exactly the frames of this dataset version (and its completeOnly). An
+	*  unknown id selects nothing. */
+	datasetVersionId: string().optional(),
 	batchId: string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: boolean().optional()
@@ -23649,6 +23670,67 @@ var RetrainLlmAssistResultSchema = discriminatedUnion("kind", [object({
 	]),
 	detail: string().optional()
 })]);
+/** What a dataset version is cut from. Every field narrows. */
+var RetrainDatasetSelectionSchema = object({
+	deviceIds: array(number()).readonly().optional(),
+	collectionIds: array(string()).max(200).readonly().optional(),
+	frameIds: array(string()).max(2e4).readonly().optional()
+});
+/** The counts a dataset is judged by. */
+var RetrainDatasetStatsSchema = object({
+	frames: number().int(),
+	completeFrames: number().int(),
+	/** `completeFrames / frames`, 0..1. */
+	completeness: number(),
+	/** Boxes to learn (model errors excluded). */
+	subjects: number().int(),
+	modelErrors: number().int(),
+	/** Complete frames with no subject. */
+	hardNegatives: number().int(),
+	/** Subjects per class × camera × day/night. */
+	cells: array(object({
+		macroClass: string(),
+		deviceId: number(),
+		lighting: _enum([
+			"day",
+			"night",
+			"unknown"
+		]),
+		subjects: number().int(),
+		frames: number().int()
+	})).readonly(),
+	cameras: array(object({
+		deviceId: number(),
+		frames: number().int(),
+		completeFrames: number().int()
+	})).readonly()
+});
+/** An immutable dataset version, without its frame list. */
+var RetrainDatasetVersionSchema = object({
+	id: string(),
+	name: string(),
+	createdAt: number(),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: boolean(),
+	frameCount: number().int(),
+	/** sha256 of what the frames taught when the version was frozen. */
+	annotationHash: string(),
+	/** The export manifest schema the version was cut under. */
+	manifestSchema: string(),
+	stats: RetrainDatasetStatsSchema
+});
+var CreateRetrainDatasetVersionResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("created"),
+	version: RetrainDatasetVersionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"empty-name",
+		"duplicate-name",
+		"no-frames"
+	])
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
 	trackId: string(),
@@ -24438,6 +24520,36 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 60 * 6e4
+}), method(object({
+	selection: RetrainDatasetSelectionSchema,
+	completeOnly: boolean().optional()
+}), RetrainDatasetStatsSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	name: string().max(120),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: boolean()
+}), CreateRetrainDatasetVersionResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(object({}), array(RetrainDatasetVersionSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ id: string() }), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), object({
+	found: boolean(),
+	annotationHash: string(),
+	matches: boolean(),
+	missingFrames: number().int()
+}), {
+	kind: "query",
+	auth: "admin",
+	timeoutMs: 12e4
 }), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -45789,6 +45901,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.setSystemSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.status": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -47235,6 +47353,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.createRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47247,6 +47371,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47469,6 +47599,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainDatasetVersions": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47511,6 +47647,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.previewRetrainDataset": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47649,6 +47791,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.verifyRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -60347,6 +60495,20 @@ function getString(obj, key) {
 	const v = obj[key];
 	return typeof v === "string" ? v : "";
 }
+/**
+* Keys the account form declares. They belong to `integration.settings`; in
+* the addon's global store they are stale leftovers.
+*/
+var GLOBAL_CREDENTIAL_KEYS = [
+	"email",
+	"password",
+	"apiKey",
+	"apiId"
+];
+/** A stored value worth removing: a non-empty string or a keychain marker. */
+function isStoredValue(v) {
+	return typeof v === "string" && v.length > 0 || isSecretMarker(v);
+}
 /** Extract account credentials from an integration's settings, or null. */
 function credentialsFromSettings(settings) {
 	const email = getString(settings, "email").trim();
@@ -60411,6 +60573,9 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 				});
 			});
 		});
+		await this.purgeStaleGlobalCredentials().catch((err) => {
+			this.ctx.logger.warn("could not remove stale Wyze credentials from the global store", { meta: { error: errMsg(err) } });
+		});
 		await this.reconcileIntegrations();
 		this.subscribeIntegrationLifecycle();
 		return [
@@ -60546,8 +60711,25 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 			}
 		});
 	}
+	globalSettingsSchema() {
+		return buildSettingsSchema();
+	}
 	async getGlobalSettings() {
-		return hydrateSchema(buildSettingsSchema(), {});
+		return hydrateSchema(this.globalSettingsSchema(), {});
+	}
+	/**
+	* Remove account credentials left in the GLOBAL store. They are dead — the
+	* addon reads credentials only from `integration.settings` — and an older
+	* build left them there as plaintext. Idempotent: a clean store is not
+	* written. Secret keys are cleared through `clearSecrets`, which also drops
+	* any keychain value a marker points at.
+	*/
+	async purgeStaleGlobalCredentials() {
+		const stored = await this.resolveGlobalStore();
+		const present = GLOBAL_CREDENTIAL_KEYS.filter((key) => isStoredValue(stored[key]));
+		if (present.length === 0) return;
+		await this.clearSecrets(present);
+		this.ctx.logger.info("Removed stale Wyze credentials from the addon global store", { meta: { keys: present } });
 	}
 	async onGetCreationSchema(type) {
 		if (type !== DeviceType.Camera) return null;

package/dist/addon.mjs

@@ -5388,7 +5388,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-Cr5YOk3m.mjs
+//#region ../types/dist/sleep-DujUvOcb.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -14981,6 +14981,14 @@ var KeychainAuditEntrySchema = object({
 	ref: string().nullable(),
 	detail: string().nullable()
 });
+var KEYCHAIN_RESET_CONFIRMATION = "RESET KEYCHAIN";
+/**
+* Secrets the HUB itself holds (owner `system`) that no settings form shows:
+* `jwt-signing-key` — the session signing key (D797). It is always "in use",
+* never an orphan; it is generated on a fresh hub and replaced only through
+* {@link keychainAdminCapability.methods.setSystemSecret}.
+*/
+var SystemHeldSecretNameSchema = _enum(["jwt-signing-key"]);
 method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}), array(KeychainAdminSecretSchema).readonly(), { auth: "admin" }), method(object({ limit: number().int().min(1).max(500).optional() }), array(KeychainAuditEntrySchema).readonly(), { auth: "admin" }), method(object({ ref: string().min(1) }), object({
 	value: string(),
 	version: number().int()
@@ -14988,6 +14996,16 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
+}), method(object({
+	name: SystemHeldSecretNameSchema,
+	value: string().min(16)
+}), object({
+	ref: string(),
+	version: number().int()
+}), {
+	kind: "mutation",
+	auth: "admin",
+	caller: "required"
 }), method(object({ refs: array(string().min(1)).max(1e3) }), object({
 	deleted: array(string()).readonly(),
 	kept: array(object({
@@ -15017,7 +15035,7 @@ method(object({}), KeychainStatusSchema, { auth: "admin" }), method(object({}),
 	kind: "mutation",
 	auth: "admin",
 	caller: "required"
-}), method(object({ confirm: literal("RESET KEYCHAIN") }), object({
+}), method(object({ confirm: literal(KEYCHAIN_RESET_CONFIRMATION) }), object({
 	archivedCollection: string().nullable(),
 	archived: number().int()
 }), {
@@ -23461,6 +23479,9 @@ var RetrainExportFilterSchema = object({
 	frameIds: array(string()).max(2e4).optional(),
 	/** Only frames in at least one of these named collections. */
 	collectionIds: array(string()).max(200).optional(),
+	/** Exactly the frames of this dataset version (and its completeOnly). An
+	*  unknown id selects nothing. */
+	datasetVersionId: string().optional(),
 	batchId: string().optional(),
 	/** Only frames the operator marked complete (all subjects boxed). */
 	completeOnly: boolean().optional()
@@ -23628,6 +23649,67 @@ var RetrainLlmAssistResultSchema = discriminatedUnion("kind", [object({
 	]),
 	detail: string().optional()
 })]);
+/** What a dataset version is cut from. Every field narrows. */
+var RetrainDatasetSelectionSchema = object({
+	deviceIds: array(number()).readonly().optional(),
+	collectionIds: array(string()).max(200).readonly().optional(),
+	frameIds: array(string()).max(2e4).readonly().optional()
+});
+/** The counts a dataset is judged by. */
+var RetrainDatasetStatsSchema = object({
+	frames: number().int(),
+	completeFrames: number().int(),
+	/** `completeFrames / frames`, 0..1. */
+	completeness: number(),
+	/** Boxes to learn (model errors excluded). */
+	subjects: number().int(),
+	modelErrors: number().int(),
+	/** Complete frames with no subject. */
+	hardNegatives: number().int(),
+	/** Subjects per class × camera × day/night. */
+	cells: array(object({
+		macroClass: string(),
+		deviceId: number(),
+		lighting: _enum([
+			"day",
+			"night",
+			"unknown"
+		]),
+		subjects: number().int(),
+		frames: number().int()
+	})).readonly(),
+	cameras: array(object({
+		deviceId: number(),
+		frames: number().int(),
+		completeFrames: number().int()
+	})).readonly()
+});
+/** An immutable dataset version, without its frame list. */
+var RetrainDatasetVersionSchema = object({
+	id: string(),
+	name: string(),
+	createdAt: number(),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: boolean(),
+	frameCount: number().int(),
+	/** sha256 of what the frames taught when the version was frozen. */
+	annotationHash: string(),
+	/** The export manifest schema the version was cut under. */
+	manifestSchema: string(),
+	stats: RetrainDatasetStatsSchema
+});
+var CreateRetrainDatasetVersionResultSchema = discriminatedUnion("kind", [object({
+	kind: literal("created"),
+	version: RetrainDatasetVersionSchema
+}), object({
+	kind: literal("refused"),
+	reason: _enum([
+		"empty-name",
+		"duplicate-name",
+		"no-frames"
+	])
+})]);
 /** The outcome of a lifecycle move owned by the retrain page. */
 var RetrainTransitionResultSchema = object({
 	trackId: string(),
@@ -24417,6 +24499,36 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	kind: "mutation",
 	auth: "admin",
 	timeoutMs: 60 * 6e4
+}), method(object({
+	selection: RetrainDatasetSelectionSchema,
+	completeOnly: boolean().optional()
+}), RetrainDatasetStatsSchema, {
+	kind: "query",
+	auth: "admin"
+}), method(object({
+	name: string().max(120),
+	selection: RetrainDatasetSelectionSchema,
+	layout: RetrainExportLayoutSchema,
+	completeOnly: boolean()
+}), CreateRetrainDatasetVersionResultSchema, {
+	kind: "mutation",
+	auth: "admin",
+	timeoutMs: 12e4
+}), method(object({}), array(RetrainDatasetVersionSchema).readonly(), {
+	kind: "query",
+	auth: "admin"
+}), method(object({ id: string() }), object({ deleted: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string() }), object({
+	found: boolean(),
+	annotationHash: string(),
+	matches: boolean(),
+	missingFrames: number().int()
+}), {
+	kind: "query",
+	auth: "admin",
+	timeoutMs: 12e4
 }), method(object({}), array(RetrainAssistProfileSchema).readonly(), {
 	kind: "query",
 	auth: "admin"
@@ -45768,6 +45880,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"keychainAdmin.setSystemSecret": {
+		capName: "keychain-admin",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"keychainAdmin.status": {
 		capName: "keychain-admin",
 		capScope: "system",
@@ -47214,6 +47332,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.createRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.deleteDeviceEvents": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47226,6 +47350,12 @@ Object.freeze({
 		addonId: null,
 		access: "delete"
 	},
+	"pipelineAnalytics.deleteRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
 	"pipelineAnalytics.deleteTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47448,6 +47578,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRetrainDatasetVersions": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRetrainFrames": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47490,6 +47626,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.previewRetrainDataset": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.proposeRetrainAnnotations": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -47628,6 +47770,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineAnalytics.verifyRetrainDatasetVersion": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.wipeAllAnalytics": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -60326,6 +60474,20 @@ function getString(obj, key) {
 	const v = obj[key];
 	return typeof v === "string" ? v : "";
 }
+/**
+* Keys the account form declares. They belong to `integration.settings`; in
+* the addon's global store they are stale leftovers.
+*/
+var GLOBAL_CREDENTIAL_KEYS = [
+	"email",
+	"password",
+	"apiKey",
+	"apiId"
+];
+/** A stored value worth removing: a non-empty string or a keychain marker. */
+function isStoredValue(v) {
+	return typeof v === "string" && v.length > 0 || isSecretMarker(v);
+}
 /** Extract account credentials from an integration's settings, or null. */
 function credentialsFromSettings(settings) {
 	const email = getString(settings, "email").trim();
@@ -60390,6 +60552,9 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 				});
 			});
 		});
+		await this.purgeStaleGlobalCredentials().catch((err) => {
+			this.ctx.logger.warn("could not remove stale Wyze credentials from the global store", { meta: { error: errMsg(err) } });
+		});
 		await this.reconcileIntegrations();
 		this.subscribeIntegrationLifecycle();
 		return [
@@ -60525,8 +60690,25 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 			}
 		});
 	}
+	globalSettingsSchema() {
+		return buildSettingsSchema();
+	}
 	async getGlobalSettings() {
-		return hydrateSchema(buildSettingsSchema(), {});
+		return hydrateSchema(this.globalSettingsSchema(), {});
+	}
+	/**
+	* Remove account credentials left in the GLOBAL store. They are dead — the
+	* addon reads credentials only from `integration.settings` — and an older
+	* build left them there as plaintext. Idempotent: a clean store is not
+	* written. Secret keys are cleared through `clearSecrets`, which also drops
+	* any keychain value a marker points at.
+	*/
+	async purgeStaleGlobalCredentials() {
+		const stored = await this.resolveGlobalStore();
+		const present = GLOBAL_CREDENTIAL_KEYS.filter((key) => isStoredValue(stored[key]));
+		if (present.length === 0) return;
+		await this.clearSecrets(present);
+		this.ctx.logger.info("Removed stale Wyze credentials from the addon global store", { meta: { keys: present } });
 	}
 	async onGetCreationSchema(type) {
 		if (type !== DeviceType.Camera) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-wyze",
-  "version": "0.2.132",
+  "version": "0.2.133",
   "description": "Wyze camera device-provider addon for CamStack — wraps the @apocaliss92/wyze-bridge-js P2P/DTLS client, feeding the stream-broker via the pull-rfc4571 lazy-publish path (a structural twin of addon-provider-reolink)",
   "keywords": [
     "camstack",