@camstack/addon-provider-wyze 0.2.19 → 0.2.23

package/dist/addon.js

@@ -30,7 +30,8 @@ let events = require("events");
 let net = require("net");
 net = __toESM(net, 1);
 let node_child_process = require("node:child_process");
-//#region ../types/dist/event-category-Bxo5yJjt.mjs
+let node_tls = require("node:tls");
+//#region ../types/dist/event-category-C0lyLd5U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -47,9 +48,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
 	* A newer addon or server-root package version was found by the
-	* authoritative registry check. Emitted once per
-	* `(target, packageName, currentVersion, latestVersion)` transition; repeated
-	* polling of the same result is deduplicated by the checker.
+	* authoritative registry check. Emitted once when any observed
+	* `latestVersion` changes (or a package/node first appears behind);
+	* the payload carries the full currently-available list. Repeated
+	* polling of the same latests is silent.
 	*/
 	EventCategory["UpdateAvailable"] = "update.available";
 	/**
@@ -7579,6 +7581,10 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
+({
+	preBufferSec: 10,
+	postBufferSec: 30
+}).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -14595,6 +14601,9 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"addon-updated",
+	"server-updated",
+	"export-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -16488,13 +16497,19 @@ var RetrainStatusSchema = _enum([
 * "never marked" from "already trained" must read `retrainStatus`.
 *
 * `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
 */
 var TrackFlagFields = {
 	/** Operator marked this track as training material — i.e. `retrainStatus` is
 	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
-	debug: boolean().optional()
+	debug: boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: boolean().optional()
 };
 /**
 * The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
@@ -16519,6 +16534,7 @@ var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
 	debug: boolean(),
+	favourited: boolean(),
 	/** The lifecycle state the boolean was derived from. Required here (unlike on
 	*  a track row) because this shape is only ever produced by the write body,
 	*  which always knows it — and a surface that has just written needs to render
@@ -20315,8 +20331,28 @@ var ClipSchema = object({
 		startMs: number(),
 		endMs: number()
 	}),
-	/** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-	thumbnail: string().optional()
+	/**
+	* Lazy thumbnail URL, never inlined.
+	*
+	* Recording-derived clips (events-mode keep-window, and the prepared
+	* continuous event+fragment visit) MUST use the snapshot of the **main
+	* event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+	* of the event that owns `kind` (object > motion > audio). Do not extract
+	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
+	* mint their own stills.
+	*/
+	thumbnail: string().optional(),
+	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
+	*  The default provider's visit grain puts many motion heartbeats on one clip
+	*  instead of minting one clip per marker. */
+	eventIds: array(string()).optional(),
+	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+	*  bar keeps showing them via `recording.getAvailability`. */
+	holes: array(object({
+		startMs: number(),
+		endMs: number()
+	})).optional()
 });
 var ClipPlaybackSchema = object({
 	/** HLS master URL through the hub data-plane (Range + token in path). */
@@ -21891,10 +21927,18 @@ settings: record(string(), unknown()) });
 * descriptive — it never changes routing.
 */
 var ConnectionTestDescriptorSchema = object({ label: string() });
-method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
+var connectionTestCapability = {
+	name: "connection-test",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		testSettings: method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		describeTest: method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" })
+	}
+};
 /**
 * Upstream-system connectivity sensor — distinct from `device-status`,
 * which is the kernel-managed online/offline flag for the device's
@@ -26602,7 +26646,9 @@ var ExportOptionsSchema = object({
 	includeAudio: boolean(),
 	maxLifeMs: number().int().positive(),
 	deleteAfterDownload: boolean(),
-	title: string().max(200).optional()
+	title: string().max(200).optional(),
+	/** Notification-output target ids to ping when this export becomes ready. */
+	notifyTargetIds: array(string().min(1)).max(20).optional()
 }).superRefine((v, ctx) => {
 	if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
 		code: ZodIssueCode.custom,
@@ -26661,10 +26707,18 @@ var ExportBytesSchema = object({
 });
 method(object({
 	deviceId: number(),
-	profile: string(),
+	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+	profile: string().optional(),
+	profiles: array(string()).min(1).optional(),
 	fromMs: number(),
 	toMs: number(),
 	options: ExportOptionsSchema
+}).superRefine((v, ctx) => {
+	if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "pass profiles[] (min 1) or legacy profile",
+		path: ["profiles"]
+	});
 }), ExportRecordSchema, {
 	kind: "mutation",
 	auth: "protected"
@@ -29606,15 +29660,6 @@ var BaseDeviceProvider = class extends BaseAddon {
 			labels: ["probe not implemented"]
 		};
 	}
-	/**
-	* Top-level devices restored at once in {@link onRestoreDevices}.
-	*
-	* Four covers the fleets this ships to without turning a boot into a burst a
-	* camera NVR answers with a refusal. A provider whose upstream is a single
-	* session with a serial command channel (a Baichuan hub, an NVR that
-	* serialises ISAPI) should lower it; nothing needs to raise it.
-	*/
-	restoreConcurrency = 4;
 	async restoreDevices(savedDevices) {
 		await this.onRestoreDevices(savedDevices);
 		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -29669,14 +29714,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 				});
 			}
 		};
-		let nextTopLevel = 0;
-		await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
-			for (;;) {
-				const saved = topLevel[nextTopLevel++];
-				if (saved === void 0) return;
-				await restoreOne(saved);
-			}
-		}));
+		await Promise.all(topLevel.map((saved) => restoreOne(saved)));
 		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
 		for (const saved of childRows) {
 			const Class = this.deviceClasses[saved.type];
@@ -40631,7 +40669,8 @@ var WyzeClientRegistry = class {
 			credentials,
 			cameraListCache: [],
 			cameraListFetchedAt: 0,
-			cameraListInFlight: null
+			cameraListInFlight: null,
+			lastFetchError: null
 		});
 	}
 	/** Drop the client for an integration that no longer exists / was disabled. */
@@ -40659,6 +40698,14 @@ var WyzeClientRegistry = class {
 		this.#entries.clear();
 	}
 	/**
+	* The last classified error from a `getCameraList` fetch failure for an
+	* integration, or null when the last fetch succeeded (or no fetch has run
+	* yet). Used by `getStatus` to surface the reason for an empty adoption list.
+	*/
+	getLastFetchError(integrationId) {
+		return this.#entries.get(integrationId)?.lastFetchError ?? null;
+	}
+	/**
 	* Cloud camera list for ONE integration, cached + debounced + single-flight
 	* to avoid auth rate-limits. Returns the last cache (possibly empty) when the
 	* integration is unknown or the fetch fails.
@@ -40672,9 +40719,11 @@ var WyzeClientRegistry = class {
 		const run = entry.client.getCameraList().then((cams) => {
 			entry.cameraListCache = cams;
 			entry.cameraListFetchedAt = Date.now();
+			entry.lastFetchError = null;
 			return cams;
 		}).catch((err) => {
 			const classified = classifyCloudError(err);
+			entry.lastFetchError = classified;
 			this.#deps.logger.error("Wyze getCameraList failed", { meta: {
 				integrationId,
 				kind: classified.kind,
@@ -41170,11 +41219,16 @@ function buildWyzeAdoptionProvider(deps) {
 				let candidateCount = 0;
 				for (const integrationId of listIntegrations()) candidateCount += (await candidatesForIntegration(integrationId)).length;
 				const adoptedCount = (await listAdopted()).length;
+				const fetchErrors = [];
+				if (deps.getLastFetchError) for (const integrationId of listIntegrations()) {
+					const err = deps.getLastFetchError(integrationId);
+					if (err) fetchErrors.push(`[${integrationId}] ${err.message}`);
+				}
 				return {
 					lastDiscoveryAt: Date.now(),
 					candidateCount,
 					adoptedCount,
-					lastError: null
+					lastError: fetchErrors.length > 0 ? fetchErrors.join("; ") : null
 				};
 			} catch (err) {
 				logger.warn("wyze adoption: getStatus failed", { meta: { error: errMsg(err) } });
@@ -41189,11 +41243,12 @@ function buildWyzeAdoptionProvider(deps) {
 		refresh: async ({ integrationId }) => {
 			const candidateCount = (await candidatesForIntegration(integrationId, true)).length;
 			const adoptedCount = adoptedMapForIntegration(integrationId, await listAdopted()).size;
+			const fetchErr = deps.getLastFetchError?.(integrationId);
 			return {
 				lastDiscoveryAt: Date.now(),
 				candidateCount,
 				adoptedCount,
-				lastError: null
+				lastError: fetchErr ? fetchErr.message : null
 			};
 		},
 		adopt: async ({ integrationId, childNativeIds, perCandidate }) => {
@@ -41925,6 +41980,139 @@ var WyzeCamera = class extends BaseDevice {
 	static fromCloud = cameraConfigFromCloud;
 };
 //#endregion
+//#region src/wyze-connection-test.ts
+/**
+* Production default: creates a `WyzeCloud` with no-op session hooks so
+* `testSettings` never writes or reads `wyze-session.json`.
+*/
+function defaultWyzeCloudFacadeFactory(credentials) {
+	const cloud = new WyzeCloud({
+		apiKey: credentials.apiKey,
+		apiId: credentials.apiId,
+		loadSession: () => null,
+		saveSession: () => void 0,
+		clearSession: () => void 0
+	});
+	return {
+		ensureSession: (email, password) => cloud.ensureSession(email, password),
+		getCameraList: () => cloud.getCameraList()
+	};
+}
+var wyzeCredentialsSchema = object({
+	email: string().min(1).describe("Wyze account email"),
+	password: string().min(1).describe("Wyze account password"),
+	apiKey: string().min(1).describe("Wyze developer API key"),
+	apiId: string().min(1).describe("Wyze developer Key ID")
+});
+var TEST_LABEL = "Signs in to the Wyze cloud with these account credentials";
+function buildWyzeConnectionTestProvider(deps) {
+	const { makeCloud, logger } = deps;
+	return {
+		describeTest: async () => ({ label: TEST_LABEL }),
+		testSettings: async ({ settings }) => {
+			const parsed = wyzeCredentialsSchema.safeParse(settings);
+			if (!parsed.success) {
+				const missing = parsed.error.issues.map((i) => i.path.join(".") || "(root)").join(", ");
+				logger.warn("Wyze connection test: settings incomplete", { meta: { missing } });
+				return {
+					outcome: "rejected",
+					error: `Wyze account settings are incomplete or invalid: ${missing}`
+				};
+			}
+			const { email, password, apiKey, apiId } = parsed.data;
+			const startedAt = Date.now();
+			const cloud = makeCloud({
+				email,
+				password,
+				apiKey,
+				apiId
+			});
+			try {
+				await cloud.ensureSession(email, password);
+				let cameraCount = null;
+				try {
+					cameraCount = (await cloud.getCameraList()).length;
+				} catch {}
+				return {
+					outcome: "validated",
+					latencyMs: Date.now() - startedAt,
+					...cameraCount !== null ? { detail: `Found ${cameraCount} camera${cameraCount === 1 ? "" : "s"} on this account` } : {}
+				};
+			} catch (err) {
+				const classified = classifyCloudError(err);
+				if (classified.kind === "mfa") {
+					logger.warn("Wyze connection test: MFA required", { meta: { email } });
+					return {
+						outcome: "rejected",
+						error: classified.message
+					};
+				}
+				if (classified.kind === "credentials") {
+					logger.warn("Wyze connection test: credentials refused", { meta: { email } });
+					return {
+						outcome: "rejected",
+						error: "Wyze refused these credentials — check the email, password, API Key and Key ID. " + classified.message
+					};
+				}
+				logger.warn("Wyze connection test: could not complete", { meta: {
+					email,
+					kind: classified.kind,
+					error: errMsg(err)
+				} });
+				return {
+					outcome: "inconclusive",
+					error: classified.kind === "rate-limited" ? `Could not verify credentials — rate-limited by the Wyze cloud. Retry in ~30 s. ${classified.message}` : `Could not reach the Wyze cloud to verify these credentials: ${errMsg(err)}`
+				};
+			}
+		}
+	};
+}
+//#endregion
+//#region src/wyze-tls-trust.ts
+/**
+* Ubuntu 24.04's `ca-certificates` (2026-06) dropped DigiCert Global Root CA
+* (the 2006 SHA-1-era root, still valid until 2031). Wyze's `*.wyzecam.com`
+* leaf is issued by "DigiCert TLS RSA SHA256 2020 CA1", which chains to that
+* root. Node fetch then fails with `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` and
+* the adoption panel shows an empty camera list.
+*
+* macOS still trusts this root in the system keychain, which is why the same
+* URL verifies on the developer Mac and fails inside the hub container.
+*
+* The PEM is DigiCert's public root (https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem).
+* Applied once per addon process via `tls.setDefaultCACertificates` — does
+* NOT disable verification, it only restores the missing root.
+*/
+var DIGICERT_GLOBAL_ROOT_CA_PEM = `-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
+CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
+nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
+43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
+T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
+gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
+TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
+DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
+hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
+06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
+PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
+YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----
+`;
+var applied = false;
+function applyWyzeCloudTlsTrust() {
+	if (applied) return;
+	applied = true;
+	(0, node_tls.setDefaultCACertificates)([...(0, node_tls.getCACertificates)(), DIGICERT_GLOBAL_ROOT_CA_PEM]);
+}
+//#endregion
 //#region src/addon.ts
 function getString(obj, key) {
 	const v = obj[key];
@@ -41971,6 +42159,7 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		super({});
 	}
 	async onInitialize() {
+		applyWyzeCloudTlsTrust();
 		const regs = await super.onInitialize();
 		this.clients = new WyzeClientRegistry({
 			dataDir: this.ctx.dataDir,
@@ -41992,10 +42181,17 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		});
 		await this.reconcileIntegrations();
 		this.subscribeIntegrationLifecycle();
-		return [...regs, {
-			capability: deviceAdoptionCapability,
-			provider: this.buildAdoptionProvider()
-		}];
+		return [
+			...regs,
+			{
+				capability: deviceAdoptionCapability,
+				provider: this.buildAdoptionProvider()
+			},
+			{
+				capability: connectionTestCapability,
+				provider: this.buildConnectionTestProvider()
+			}
+		];
 	}
 	async onShutdown() {
 		this.clients?.clear();
@@ -42058,10 +42254,22 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		this.wireCameraDeps(dev);
 		await dev.materializeStreamSocket(camStreamId);
 	}
+	/**
+	* Pre-creation credential check. Registered unconditionally — it must answer
+	* BEFORE any integration for this addon exists, so it depends on nothing in
+	* {@link WyzeClientRegistry} and opens its own throwaway session (no disk I/O).
+	*/
+	buildConnectionTestProvider() {
+		return buildWyzeConnectionTestProvider({
+			makeCloud: defaultWyzeCloudFacadeFactory,
+			logger: this.ctx.logger
+		});
+	}
 	buildAdoptionProvider() {
 		return buildWyzeAdoptionProvider({
 			logger: this.ctx.logger,
 			getCameraList: (integrationId, force) => this.requireClients().getCameraList(integrationId, force),
+			getLastFetchError: (integrationId) => this.requireClients().getLastFetchError(integrationId),
 			hasIntegration: (integrationId) => this.requireClients().has(integrationId),
 			listIntegrations: () => this.requireClients().list(),
 			listAdopted: async () => {

package/dist/addon.mjs

@@ -6,10 +6,11 @@ import * as dgram from "dgram";
 import { EventEmitter } from "events";
 import * as net from "net";
 import { spawn } from "node:child_process";
+import { getCACertificates, setDefaultCACertificates } from "node:tls";
 //#region \0rolldown/runtime.js
 var __require$1 = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
-//#region ../types/dist/event-category-Bxo5yJjt.mjs
+//#region ../types/dist/event-category-C0lyLd5U.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -26,9 +27,10 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemRestartCompleted"] = "system.restart-completed";
 	/**
 	* A newer addon or server-root package version was found by the
-	* authoritative registry check. Emitted once per
-	* `(target, packageName, currentVersion, latestVersion)` transition; repeated
-	* polling of the same result is deduplicated by the checker.
+	* authoritative registry check. Emitted once when any observed
+	* `latestVersion` changes (or a package/node first appears behind);
+	* the payload carries the full currently-available list. Repeated
+	* polling of the same latests is silent.
 	*/
 	EventCategory["UpdateAvailable"] = "update.available";
 	/**
@@ -7558,6 +7560,10 @@ var RecordingBandSchema = object({
 	preBufferSec: number().min(0).optional(),
 	postBufferSec: number().min(0).optional()
 });
+({
+	preBufferSec: 10,
+	postBufferSec: 30
+}).postBufferSec * 1e3;
 /**
 * Per-device retention overrides. Every field is optional; an unset or `0`
 * value inherits the node-wide recorder default. Only footage-lifetime limits
@@ -14574,6 +14580,9 @@ var NcSystemEventKindSchema = _enum([
 	"alarm-disarmed",
 	"alarm-arming",
 	"alarm-arm-refused",
+	"addon-updated",
+	"server-updated",
+	"export-completed",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -16467,13 +16476,19 @@ var RetrainStatusSchema = _enum([
 * "never marked" from "already trained" must read `retrainStatus`.
 *
 * `debug` does NOT pin; it is attention, not durability.
+*
+* `favourited` IS a BOOLEAN pin (durability bit), not a retrain lifecycle.
+* A favourited track is skipped by retention the same way `staging` is, but
+* it does not enter `none|staging|trained` and has no staging budget.
 */
 var TrackFlagFields = {
 	/** Operator marked this track as training material — i.e. `retrainStatus` is
 	*  `'staging'`. */
 	markForTrain: boolean().optional(),
 	/** Operator marked this track for diagnostic attention. */
-	debug: boolean().optional()
+	debug: boolean().optional(),
+	/** Operator favourited this track. Pins it against pruning. */
+	favourited: boolean().optional()
 };
 /**
 * The lifecycle field itself, on the READ surfaces only (`Track`, `KeyEvent`).
@@ -16498,6 +16513,7 @@ var TrackFlagsSchema = object({
 	trackId: string(),
 	markForTrain: boolean(),
 	debug: boolean(),
+	favourited: boolean(),
 	/** The lifecycle state the boolean was derived from. Required here (unlike on
 	*  a track row) because this shape is only ever produced by the write body,
 	*  which always knows it — and a surface that has just written needs to render
@@ -20294,8 +20310,28 @@ var ClipSchema = object({
 		startMs: number(),
 		endMs: number()
 	}),
-	/** Thumbnail URL (lazy; e.g. analytics `getEventMedia`). Never inlined. */
-	thumbnail: string().optional()
+	/**
+	* Lazy thumbnail URL, never inlined.
+	*
+	* Recording-derived clips (events-mode keep-window, and the prepared
+	* continuous event+fragment visit) MUST use the snapshot of the **main
+	* event of the interval** — `getEventMedia({ eventId, kind: 'snapshot' })`
+	* of the event that owns `kind` (object > motion > audio). Do not extract
+	* a keyframe from the recorded segments. Other providers (onboard, HKSV)
+	* mint their own stills.
+	*/
+	thumbnail: string().optional(),
+	/** Analytics event ids that overlap this visit. Empty on footage-only clips.
+	*  The default provider's visit grain puts many motion heartbeats on one clip
+	*  instead of minting one clip per marker. */
+	eventIds: array(string()).optional(),
+	/** Intra-visit footage holes (GOP rolls, discarded segments) still shorter
+	*  than `VISIT_MERGE_GAP_MS`. Playback concatenates around them; the timeline
+	*  bar keeps showing them via `recording.getAvailability`. */
+	holes: array(object({
+		startMs: number(),
+		endMs: number()
+	})).optional()
 });
 var ClipPlaybackSchema = object({
 	/** HLS master URL through the hub data-plane (Range + token in path). */
@@ -21870,10 +21906,18 @@ settings: record(string(), unknown()) });
 * descriptive — it never changes routing.
 */
 var ConnectionTestDescriptorSchema = object({ label: string() });
-method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
+var connectionTestCapability = {
+	name: "connection-test",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		testSettings: method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		describeTest: method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" })
+	}
+};
 /**
 * Upstream-system connectivity sensor — distinct from `device-status`,
 * which is the kernel-managed online/offline flag for the device's
@@ -26581,7 +26625,9 @@ var ExportOptionsSchema = object({
 	includeAudio: boolean(),
 	maxLifeMs: number().int().positive(),
 	deleteAfterDownload: boolean(),
-	title: string().max(200).optional()
+	title: string().max(200).optional(),
+	/** Notification-output target ids to ping when this export becomes ready. */
+	notifyTargetIds: array(string().min(1)).max(20).optional()
 }).superRefine((v, ctx) => {
 	if (v.speed !== void 0 && v.timelapse !== void 0) ctx.addIssue({
 		code: ZodIssueCode.custom,
@@ -26640,10 +26686,18 @@ var ExportBytesSchema = object({
 });
 method(object({
 	deviceId: number(),
-	profile: string(),
+	/** @deprecated Prefer `profiles`. Kept so timelapse/notifiers keep working. */
+	profile: string().optional(),
+	profiles: array(string()).min(1).optional(),
 	fromMs: number(),
 	toMs: number(),
 	options: ExportOptionsSchema
+}).superRefine((v, ctx) => {
+	if ((v.profiles !== void 0 && v.profiles.length > 0 ? v.profiles : v.profile !== void 0 ? [v.profile] : []).length < 1) ctx.addIssue({
+		code: ZodIssueCode.custom,
+		message: "pass profiles[] (min 1) or legacy profile",
+		path: ["profiles"]
+	});
 }), ExportRecordSchema, {
 	kind: "mutation",
 	auth: "protected"
@@ -29585,15 +29639,6 @@ var BaseDeviceProvider = class extends BaseAddon {
 			labels: ["probe not implemented"]
 		};
 	}
-	/**
-	* Top-level devices restored at once in {@link onRestoreDevices}.
-	*
-	* Four covers the fleets this ships to without turning a boot into a burst a
-	* camera NVR answers with a refusal. A provider whose upstream is a single
-	* session with a serial command channel (a Baichuan hub, an NVR that
-	* serialises ISAPI) should lower it; nothing needs to raise it.
-	*/
-	restoreConcurrency = 4;
 	async restoreDevices(savedDevices) {
 		await this.onRestoreDevices(savedDevices);
 		if (savedDevices.length > 0) this.ctx.logger.info(`Restored ${savedDevices.length} ${this.providerName} device(s)`);
@@ -29648,14 +29693,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 				});
 			}
 		};
-		let nextTopLevel = 0;
-		await Promise.all(Array.from({ length: Math.min(Math.max(1, this.restoreConcurrency), topLevel.length) }, async () => {
-			for (;;) {
-				const saved = topLevel[nextTopLevel++];
-				if (saved === void 0) return;
-				await restoreOne(saved);
-			}
-		}));
+		await Promise.all(topLevel.map((saved) => restoreOne(saved)));
 		const childRows = savedDevices.filter((s) => s.parentDeviceId !== null);
 		for (const saved of childRows) {
 			const Class = this.deviceClasses[saved.type];
@@ -40610,7 +40648,8 @@ var WyzeClientRegistry = class {
 			credentials,
 			cameraListCache: [],
 			cameraListFetchedAt: 0,
-			cameraListInFlight: null
+			cameraListInFlight: null,
+			lastFetchError: null
 		});
 	}
 	/** Drop the client for an integration that no longer exists / was disabled. */
@@ -40638,6 +40677,14 @@ var WyzeClientRegistry = class {
 		this.#entries.clear();
 	}
 	/**
+	* The last classified error from a `getCameraList` fetch failure for an
+	* integration, or null when the last fetch succeeded (or no fetch has run
+	* yet). Used by `getStatus` to surface the reason for an empty adoption list.
+	*/
+	getLastFetchError(integrationId) {
+		return this.#entries.get(integrationId)?.lastFetchError ?? null;
+	}
+	/**
 	* Cloud camera list for ONE integration, cached + debounced + single-flight
 	* to avoid auth rate-limits. Returns the last cache (possibly empty) when the
 	* integration is unknown or the fetch fails.
@@ -40651,9 +40698,11 @@ var WyzeClientRegistry = class {
 		const run = entry.client.getCameraList().then((cams) => {
 			entry.cameraListCache = cams;
 			entry.cameraListFetchedAt = Date.now();
+			entry.lastFetchError = null;
 			return cams;
 		}).catch((err) => {
 			const classified = classifyCloudError(err);
+			entry.lastFetchError = classified;
 			this.#deps.logger.error("Wyze getCameraList failed", { meta: {
 				integrationId,
 				kind: classified.kind,
@@ -41149,11 +41198,16 @@ function buildWyzeAdoptionProvider(deps) {
 				let candidateCount = 0;
 				for (const integrationId of listIntegrations()) candidateCount += (await candidatesForIntegration(integrationId)).length;
 				const adoptedCount = (await listAdopted()).length;
+				const fetchErrors = [];
+				if (deps.getLastFetchError) for (const integrationId of listIntegrations()) {
+					const err = deps.getLastFetchError(integrationId);
+					if (err) fetchErrors.push(`[${integrationId}] ${err.message}`);
+				}
 				return {
 					lastDiscoveryAt: Date.now(),
 					candidateCount,
 					adoptedCount,
-					lastError: null
+					lastError: fetchErrors.length > 0 ? fetchErrors.join("; ") : null
 				};
 			} catch (err) {
 				logger.warn("wyze adoption: getStatus failed", { meta: { error: errMsg(err) } });
@@ -41168,11 +41222,12 @@ function buildWyzeAdoptionProvider(deps) {
 		refresh: async ({ integrationId }) => {
 			const candidateCount = (await candidatesForIntegration(integrationId, true)).length;
 			const adoptedCount = adoptedMapForIntegration(integrationId, await listAdopted()).size;
+			const fetchErr = deps.getLastFetchError?.(integrationId);
 			return {
 				lastDiscoveryAt: Date.now(),
 				candidateCount,
 				adoptedCount,
-				lastError: null
+				lastError: fetchErr ? fetchErr.message : null
 			};
 		},
 		adopt: async ({ integrationId, childNativeIds, perCandidate }) => {
@@ -41904,6 +41959,139 @@ var WyzeCamera = class extends BaseDevice {
 	static fromCloud = cameraConfigFromCloud;
 };
 //#endregion
+//#region src/wyze-connection-test.ts
+/**
+* Production default: creates a `WyzeCloud` with no-op session hooks so
+* `testSettings` never writes or reads `wyze-session.json`.
+*/
+function defaultWyzeCloudFacadeFactory(credentials) {
+	const cloud = new WyzeCloud({
+		apiKey: credentials.apiKey,
+		apiId: credentials.apiId,
+		loadSession: () => null,
+		saveSession: () => void 0,
+		clearSession: () => void 0
+	});
+	return {
+		ensureSession: (email, password) => cloud.ensureSession(email, password),
+		getCameraList: () => cloud.getCameraList()
+	};
+}
+var wyzeCredentialsSchema = object({
+	email: string().min(1).describe("Wyze account email"),
+	password: string().min(1).describe("Wyze account password"),
+	apiKey: string().min(1).describe("Wyze developer API key"),
+	apiId: string().min(1).describe("Wyze developer Key ID")
+});
+var TEST_LABEL = "Signs in to the Wyze cloud with these account credentials";
+function buildWyzeConnectionTestProvider(deps) {
+	const { makeCloud, logger } = deps;
+	return {
+		describeTest: async () => ({ label: TEST_LABEL }),
+		testSettings: async ({ settings }) => {
+			const parsed = wyzeCredentialsSchema.safeParse(settings);
+			if (!parsed.success) {
+				const missing = parsed.error.issues.map((i) => i.path.join(".") || "(root)").join(", ");
+				logger.warn("Wyze connection test: settings incomplete", { meta: { missing } });
+				return {
+					outcome: "rejected",
+					error: `Wyze account settings are incomplete or invalid: ${missing}`
+				};
+			}
+			const { email, password, apiKey, apiId } = parsed.data;
+			const startedAt = Date.now();
+			const cloud = makeCloud({
+				email,
+				password,
+				apiKey,
+				apiId
+			});
+			try {
+				await cloud.ensureSession(email, password);
+				let cameraCount = null;
+				try {
+					cameraCount = (await cloud.getCameraList()).length;
+				} catch {}
+				return {
+					outcome: "validated",
+					latencyMs: Date.now() - startedAt,
+					...cameraCount !== null ? { detail: `Found ${cameraCount} camera${cameraCount === 1 ? "" : "s"} on this account` } : {}
+				};
+			} catch (err) {
+				const classified = classifyCloudError(err);
+				if (classified.kind === "mfa") {
+					logger.warn("Wyze connection test: MFA required", { meta: { email } });
+					return {
+						outcome: "rejected",
+						error: classified.message
+					};
+				}
+				if (classified.kind === "credentials") {
+					logger.warn("Wyze connection test: credentials refused", { meta: { email } });
+					return {
+						outcome: "rejected",
+						error: "Wyze refused these credentials — check the email, password, API Key and Key ID. " + classified.message
+					};
+				}
+				logger.warn("Wyze connection test: could not complete", { meta: {
+					email,
+					kind: classified.kind,
+					error: errMsg(err)
+				} });
+				return {
+					outcome: "inconclusive",
+					error: classified.kind === "rate-limited" ? `Could not verify credentials — rate-limited by the Wyze cloud. Retry in ~30 s. ${classified.message}` : `Could not reach the Wyze cloud to verify these credentials: ${errMsg(err)}`
+				};
+			}
+		}
+	};
+}
+//#endregion
+//#region src/wyze-tls-trust.ts
+/**
+* Ubuntu 24.04's `ca-certificates` (2026-06) dropped DigiCert Global Root CA
+* (the 2006 SHA-1-era root, still valid until 2031). Wyze's `*.wyzecam.com`
+* leaf is issued by "DigiCert TLS RSA SHA256 2020 CA1", which chains to that
+* root. Node fetch then fails with `UNABLE_TO_GET_ISSUER_CERT_LOCALLY` and
+* the adoption panel shows an empty camera list.
+*
+* macOS still trusts this root in the system keychain, which is why the same
+* URL verifies on the developer Mac and fails inside the hub container.
+*
+* The PEM is DigiCert's public root (https://cacerts.digicert.com/DigiCertGlobalRootCA.crt.pem).
+* Applied once per addon process via `tls.setDefaultCACertificates` — does
+* NOT disable verification, it only restores the missing root.
+*/
+var DIGICERT_GLOBAL_ROOT_CA_PEM = `-----BEGIN CERTIFICATE-----
+MIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBh
+MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3
+d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBD
+QTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVT
+MRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5j
+b20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsB
+CSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97
+nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt
+43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7P
+T19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4
+gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAO
+BgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbR
+TLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUw
+DQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/Esr
+hMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg
+06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJF
+PnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0ls
+YSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQk
+CAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4=
+-----END CERTIFICATE-----
+`;
+var applied = false;
+function applyWyzeCloudTlsTrust() {
+	if (applied) return;
+	applied = true;
+	setDefaultCACertificates([...getCACertificates(), DIGICERT_GLOBAL_ROOT_CA_PEM]);
+}
+//#endregion
 //#region src/addon.ts
 function getString(obj, key) {
 	const v = obj[key];
@@ -41950,6 +42138,7 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		super({});
 	}
 	async onInitialize() {
+		applyWyzeCloudTlsTrust();
 		const regs = await super.onInitialize();
 		this.clients = new WyzeClientRegistry({
 			dataDir: this.ctx.dataDir,
@@ -41971,10 +42160,17 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		});
 		await this.reconcileIntegrations();
 		this.subscribeIntegrationLifecycle();
-		return [...regs, {
-			capability: deviceAdoptionCapability,
-			provider: this.buildAdoptionProvider()
-		}];
+		return [
+			...regs,
+			{
+				capability: deviceAdoptionCapability,
+				provider: this.buildAdoptionProvider()
+			},
+			{
+				capability: connectionTestCapability,
+				provider: this.buildConnectionTestProvider()
+			}
+		];
 	}
 	async onShutdown() {
 		this.clients?.clear();
@@ -42037,10 +42233,22 @@ var WyzeProviderAddon = class extends BaseDeviceProvider {
 		this.wireCameraDeps(dev);
 		await dev.materializeStreamSocket(camStreamId);
 	}
+	/**
+	* Pre-creation credential check. Registered unconditionally — it must answer
+	* BEFORE any integration for this addon exists, so it depends on nothing in
+	* {@link WyzeClientRegistry} and opens its own throwaway session (no disk I/O).
+	*/
+	buildConnectionTestProvider() {
+		return buildWyzeConnectionTestProvider({
+			makeCloud: defaultWyzeCloudFacadeFactory,
+			logger: this.ctx.logger
+		});
+	}
 	buildAdoptionProvider() {
 		return buildWyzeAdoptionProvider({
 			logger: this.ctx.logger,
 			getCameraList: (integrationId, force) => this.requireClients().getCameraList(integrationId, force),
+			getLastFetchError: (integrationId) => this.requireClients().getLastFetchError(integrationId),
 			hasIntegration: (integrationId) => this.requireClients().has(integrationId),
 			listIntegrations: () => this.requireClients().list(),
 			listAdopted: async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-wyze",
-  "version": "0.2.19",
+  "version": "0.2.23",
   "description": "Wyze camera device-provider addon for CamStack — wraps the @apocaliss92/wyze-bridge-js P2P/DTLS client, feeding the stream-broker via the pull-rfc4571 lazy-publish path (a structural twin of addon-provider-reolink)",
   "keywords": [
     "camstack",
@@ -54,6 +54,9 @@
           },
           {
             "name": "stream-params"
+          },
+          {
+            "name": "connection-test"
           }
         ]
       }