een-api-toolkit 0.3.82 → 0.3.91

package/CHANGELOG.md

@@ -2,105 +2,101 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.3.82] - 2026-02-14
+## [0.3.91] - 2026-02-21
 
 ### Release Summary
 
-#### PR #110: fix: Security hardening - hostname validation and CI/CD pipeline
+#### PR #118: Release v0.3.85 - API coverage docs and workflow security fix
 ## Summary
 
-Release v0.3.79 - Security hardening fixes for three vulnerabilities identified in code review:
-
-- **Hostname validation bypass**: Added DNS hostname character regex (`/^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$/`) before `endsWith()` check in `isAllowedEenHostname()` to prevent bypass attacks like `evil.com/.eagleeyenetworks.com`
-- **CI/CD branch restriction**: Added `head_branch == 'production'` check to npm-publish workflow to prevent publishing from non-production branches
-- **Script injection prevention**: Moved `${{ }}` interpolation from shell `run:` blocks to `env:` blocks in test-release workflow at 3 locations
+- Add EEN API v3.0 coverage documentation (4 documents comparing 211 API endpoints against 51 implemented, 24.2% coverage)
+- Add `api-coverage-agent` for on-demand regeneration of coverage docs
+- Update README with agent list and coverage section
+- Fix workflow_dispatch restriction to production branch (security)
 
 ## Commits
 
-- `d4e8a06` fix: harden hostname validation and CI/CD security
-- `c870348` Update src/utils/hostname.ts
-- `5a76991` Merge pull request #109
+- `baa7e1b` feat: add EEN API coverage documentation and agent
+- `eea17e8` docs: add missing agents to README agent list
+- `bb47cc2` docs: rename een-api-coverage-agent to api-coverage-agent
+- `c794fba` fix: restrict workflow_dispatch to production branch to prevent supply chain attack
+- `6e782e2` fix: restrict npm-publish workflow_dispatch to production branch
 
-## Test Results
+## Test Results (from PR #117)
 
-- **Lint**: 0 errors (1 pre-existing warning)
+- **Lint**: Passed
 - **Unit tests**: 644 passed
-- **Build**: Success
-- **E2E tests**: 225 passed across all 11 example apps
-- **Security review**: No HIGH-confidence vulnerabilities found
-
-## Files Changed
-
-- `src/utils/hostname.ts` - Added hostname character validation regex
-- `src/__tests__/auth.store.test.ts` - Added 5 test cases for malicious hostname bypass
-- `.github/workflows/npm-publish.yml` - Added production branch restriction
-- `.github/workflows/test-release.yml` - Fixed script injection at 3 locations
+- **Build**: Succeeded
+- **E2E tests**: 236 passed across all 11 example apps
+- **Security review**: No vulnerabilities
+- **Code review**: Approved by Claude Sonnet 4.5
 
 ## Version
 
-`0.3.79`
+v0.3.85
 
 🤖 Generated with [Claude Code](https://claude.com/claude-code)
 
-#### PR #112: fix: revert broken head_branch check and update agents/skill
+#### PR #128: Release v0.3.89: PTZ camera control API and vue-ptz example
 ## Summary
 
-Release v0.3.80 with two key changes:
+This release adds PTZ (Pan/Tilt/Zoom) camera control support to the toolkit:
 
-1. **Fix broken publish workflow** — The `head_branch == 'production'` check added in v0.3.79 caused all automated npm publish runs to be skipped. GitHub's `workflow_run.head_branch` refers to the PR source branch (e.g. `develop`), not the target. The upstream `test-release.yml` already restricts to PRs merged to production.
+- **PTZ API functions**: `getPtzPosition()`, `movePtz()`, `getPtzSettings()`, `updatePtzSettings()` with full TypeScript types
+- **PTZ types**: `PtzPosition`, `PtzMove` (discriminated union: position/direction/centerOn), `PtzSettings`, `PtzPreset`, `PtzSettingsUpdate`
+- **vue-ptz example app**: Complete PTZ control application with live video, direction pad, click-to-center, position display, preset management, and API call logging
+- **Camera capabilities**: Added `capabilities` field to `Camera` type for PTZ detection via `include: ['capabilities']`
+- **Documentation**: AI-PTZ.md reference doc, een-ptz-agent, updated AI-CONTEXT.md and CLAUDE.md
+- **E2E tests**: Conditional PTZ API tests that exercise position read, direction move, and preset loading when a PTZ camera is available
 
-2. **Add confidential data scan to PR-and-check skill** — New step that scans changed `.md` files for secrets, credentials, or confidential data before PR creation. Critical safeguard for a public npm package.
-
-3. **Agent documentation improvements** — Updated Playwright selectors (getByPlaceholder), SSE API patterns (nested deliveryConfig/filters), LivePlayer camera switching (:key trick), and setup agent scope (delegation to specialized agents).
+### Additional changes
+- Dependabot: CodeQL action bump to 4.32.3
+- CI: Use floating v1 tag for claude-code-action instead of SHA pin
 
 ## Commits
 
-- `1bb7297` fix: revert broken head_branch check in npm-publish workflow
-- `6afd34a` chore: add confidential data scan to PR-and-check skill and update agents
-- `c5ff7eb` Merge pull request #111
+- `c552fd0` feat: add PTZ camera control API and vue-ptz example app
+- `6a12649` fix: use single getCameras call with include and pagination for PTZ discovery
+- `2b04b26` fix: address review findings in vue-ptz example app
+- `92a18e4` fix: address remaining review findings
+- `4d01c2c` fix: use floating v1 tag for claude-code-action instead of SHA pin
+- `3f197ba` chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3
 
 ## Test Results
 
-- **Lint**: 0 errors (1 pre-existing warning)
-- **Unit tests**: 644 passed
-- **Build**: Success
-- **E2E tests**: 3/11 passed before flaky auth timeout in vue-cameras (camera-settings.spec.ts:328, unrelated to changes)
-- **Security review**: No vulnerabilities found
-- **Confidential data scan**: No secrets in 224 .md files
-
-## Version
+| Check | Result |
+|-------|--------|
+| Lint | Pass (0 errors) |
+| Unit tests | 681 passed (24 suites) |
+| Build | Pass |
+| E2E (12 apps) | All passed |
+| Security review | No vulnerabilities found |
+| Confidential data scan | Clean |
 
-`0.3.80`
-
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
-
-#### PR #113: fix: address three security review findings
-## Summary
-- **HIGH**: Validate hostname before persisting OAuth token — `setBaseUrl()` now returns boolean; `handleAuthCallback()` checks it before calling `setToken()`, preventing token persistence when hostname is rejected
-- **MEDIUM**: Pin external proxy repo clone in CI workflows (`validate-pr`, `test-release`) to commit SHA `4e8f45f` to prevent supply chain attacks
-- **LOW**: Remove unnecessary `id-token: write` permission from `claude-code-review` workflow
-
-## Test plan
-- [x] 644/644 unit tests pass
-- [x] 225/225 E2E tests pass across all 11 example apps
-- [x] Lint clean, build succeeds
-- [ ] Validate-PR workflow passes on this PR
+**Version**: 0.3.89
 
 🤖 Generated with [Claude Code](https://claude.com/claude-code)
 
 
 ### Detailed Changes
 
+#### Features
+- feat: add PTZ camera control API and vue-ptz example app
+
 #### Bug Fixes
-- fix: restore id-token:write permission required by claude-code-action
-- fix: address three security review findings
+- fix: address remaining PR #128 review findings
+- fix: address PR #128 review findings
+- fix: address remaining review findings
+- fix: address review findings in vue-ptz example app
+- fix: use single getCameras call with include and pagination for PTZ discovery
+- fix: use floating v1 tag for claude-code-action instead of SHA pin
 
 #### Other Changes
-- chore: document pinned OAuth proxy commit SHA in CI workflows
+- chore(deps): bump github/codeql-action from 4.32.2 to 4.32.3
 
 ### Links
 - [npm package](https://www.npmjs.com/package/een-api-toolkit)
-- [Full Changelog](https://github.com/klaushofrichter/een-api-toolkit/compare/v0.3.81...v0.3.82)
+- [Full Changelog](https://github.com/klaushofrichter/een-api-toolkit/compare/v0.3.85...v0.3.91)
 
 ---
-*Released: 2026-02-14 19:46:06 CST*
+*Released: 2026-02-21 17:41:30 CST*

package/README.md

@@ -182,7 +182,7 @@ The toolkit includes specialized [Claude Code](https://docs.anthropic.com/en/doc
 
 > **Note:** These agents use Claude Code's specific format. To use with other AI assistants (Gemini CLI, Copilot, etc.), the agent specs would need conversion.
 
-**Available agents:**
+**Available agents (installed via `npx een-setup-agents`):**
 - `een-setup-agent` - Project scaffolding, Pinia setup, Vite configuration
 - `een-auth-agent` - OAuth flows, route guards, token management
 - `een-users-agent` - User listing and profile APIs
@@ -190,6 +190,10 @@ The toolkit includes specialized [Claude Code](https://docs.anthropic.com/en/doc
 - `een-media-agent` - Live video, previews, HLS playback
 - `een-events-agent` - Events, alerts, metrics, SSE subscriptions
 - `een-grouping-agent` - Layouts CRUD operations, camera pane management
+- `een-automations-agent` - Alert rules, action rules, event conditions
+- `een-jobs-agent` - Jobs, exports, files, downloads
+
+The `setup-agents` script (`scripts/setup-agents.ts`) installs only agents matching the `een-*-agent.md` pattern. Other agents in `.claude/agents/` (such as `api-coverage-agent`, `docs-accuracy-reviewer`, `test-runner`) are for this repository only and are not distributed to consuming projects.
 
 **Installation:**
 ```bash
@@ -311,6 +315,25 @@ The `sync-secrets.sh` script manages secrets from a single source (root `.env` f
 
 > **Note:** Example `.env` files are gitignored. Run `sync-secrets.sh` after cloning to set up local development.
 
+## EEN API Coverage
+
+This toolkit implements a subset of the [Eagle Eye Networks REST API v3.0](https://developer.eagleeyenetworks.com/reference/using-the-api). Coverage documentation is maintained in `docs/`:
+
+| Document | Description |
+|----------|-------------|
+| **[All EEN API Endpoints](./docs/een-api-all-endpoints.md)** | Complete reference of all 211 EEN API v3.0 endpoints |
+| **[Implemented Endpoints](./docs/een-api-implemented.md)** | Endpoints implemented by the toolkit with function names and source files |
+| **[Missing Endpoints](./docs/een-api-missing.md)** | Endpoints not yet implemented, with per-category coverage percentages |
+| **[Coverage Table (HTML)](./docs/een-api-coverage.html)** | Interactive table with filtering, sorting, and summary statistics |
+
+**Fully implemented sections:** Layouts, Feeds, Jobs, Event Types, Event Metrics, Alerts
+
+**Partially implemented:** Users, Cameras, Bridges, Media, Events, Event Subscriptions, Automations, Exports, Files, Downloads
+
+**Not yet implemented:** PTZ, Speakers, Switches, Multi Cameras, Locations, Floors, Video Search, LPR, Roles, Accounts, and others
+
+To regenerate these documents after adding new API endpoints, use the `api-coverage-agent`.
+
 ## External Resources
 
 - [EEN Developer Portal](https://developer.eagleeyenetworks.com/)