@camstack/addon-export-alexa 1.2.106 → 1.2.108

package/dist/export-alexa.addon.mjs

@@ -5346,7 +5346,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-CnLyvg3w.mjs
+//#region ../types/dist/sleep-DBKu2-U5.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7488,7 +7488,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7563,7 +7579,11 @@ var BASE_LIVE_EGRESS_PROFILE = {
 */
 var ALEXA_EGRESS_PROFILE = {
 	...BASE_LIVE_EGRESS_PROFILE,
-	audio: { codec: "opus" }
+	audio: { codec: "opus" },
+	video: {
+		...BASE_LIVE_EGRESS_PROFILE.video,
+		singleSlicePerFrame: true
+	}
 };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -16451,7 +16471,7 @@ var AlarmArmModeSchema = _enum([
 	"vacation",
 	"custom_bypass"
 ]);
-object({
+var AlarmPanelStatusSchema = object({
 	/** Current lifecycle state. */
 	state: AlarmStateSchema,
 	/** Subset of arm modes the panel accepts. UI renders one button per
@@ -20044,13 +20064,109 @@ var SummariesQueryInput = object({
 	deviceIds: array(number()).min(1),
 	since: number().optional(),
 	until: number().optional(),
-	limit: number().int().min(1).max(200).default(50)
+	limit: number().int().min(1).max(200).default(50),
+	/** The same member-wise filter {@link listRecentSummaries} takes — one
+	*  meaning of "dog" on every summary surface. */
+	classes: array(string().min(1).max(60)).max(40).optional()
 });
-var SummariesPageSchema = object({ summaries: array(SummarySchema).readonly() });
 var SummaryDetailSchema = object({
 	summary: SummarySchema,
-	/** Member track ids, in absorption order. */
-	trackIds: array(string()).readonly()
+	/** Members in absorption order, oldest join first. */
+	members: array(object({
+		trackId: string(),
+		/**
+		* The track's class at the time it JOINED, or `null` when it was unresolved
+		* and the track no longer exists to fill it.
+		*
+		* The join, not the latest opinion: class voting can re-decide a track's
+		* class afterwards, and a group's composition is the history of who came
+		* together. A consumer counts these to badge a thumbnail — "two people and a
+		* dog" — rather than being handed a second, denormalised tally that would
+		* drift from the members it claims to describe.
+		*/
+		className: string().nullable(),
+		/** `primary` is the one member that carries the group's identity. */
+		role: _enum([
+			"primary",
+			"sibling",
+			"child"
+		]).nullable(),
+		joinedAt: number(),
+		/** Tier 1 — the sub-class (`dog`, `van`), resolved from the member's track
+		*  at read time. Absent when nothing resolved, never an empty string. */
+		label: string().optional(),
+		/** Tier 2 — the instance: a person's name, a plate. Absent when the pipeline
+		*  recognised nobody, and absent for a member whose track has been pruned —
+		*  a thumbnail that names the wrong person is worse than one naming nobody. */
+		subLabel: string().optional()
+	})).readonly()
+});
+/**
+* What a LIST of groups carries: the envelope plus what it is MADE OF.
+*
+* Coarse on purpose — the operator's rule is "only the rough data on the list,
+* we extend when we notice we need more". Enough to draw the card ("two people
+* and a dog") and no more. The MEMBERS, their names and the per-member links
+* are on {@link getSummary}: shipping every member of every group so a client
+* can count them turns a page of two hundred groups into a thousand records to
+* draw two hundred badges.
+*/
+var SummaryListItemSchema = object({
+	summary: SummarySchema,
+	/** Class counts, most numerous first; `className: null` is a member whose
+	*  class never resolved, counted so the counts add up to `memberCount`. */
+	classes: array(object({
+		className: string().nullable(),
+		count: number().int().positive()
+	})).readonly()
+});
+var SummariesPageSchema = object({ summaries: array(SummaryListItemSchema).readonly() });
+/**
+* The paged feed, deliberately the SAME shape as {@link RecentTracksQueryInput}.
+*
+* The reel on the cameras page and the Events gallery both ride a cursor, so a
+* summaries feed that could only answer "the last N for these cameras"
+* (`listSummaries`) would make groups available in the timeline and nowhere
+* else. Two feeds with different ordering contracts would be two ideas of what
+* "newest" means, on one screen.
+*/
+var RecentSummariesQueryInput = object({
+	/** Devices to merge. An empty array yields an empty page. */
+	deviceIds: array(number()),
+	/** Window lower bound on `lastActiveAt` (inclusive). */
+	since: number().optional(),
+	/** Window upper bound on `lastActiveAt` (inclusive). */
+	until: number().optional(),
+	limit: number().int().min(1).max(500).default(100),
+	/** Opaque continuation cursor from a previous page's `nextCursor`. */
+	cursor: string().optional(),
+	/**
+	* Restrict to these classes — THE SAME FIELD `listRecentTracks` takes, and
+	* deliberately the same name: the events filter tree emits one list of ticked
+	* taxonomy nodes, and a summaries feed that called it something else would
+	* make the operator's one filter component produce two shapes.
+	*
+	* A question about the MEMBERS: a group matches when ANY of them does. "Show
+	* me the arrivals with a dog" has to return the group of four people who had
+	* one with them; a filter on the group's own fields could only ever answer
+	* about its primary.
+	*
+	* Matched against all THREE tiers of a member — the class (`animal`), the
+	* sub-class (`dog`) and the instance (a name, a plate) — because which tier a
+	* ticked node lives on is the taxonomy's business, not the caller's. `dog` is
+	* an event kind in the tree and a tier-1 label on an `animal` track; a filter
+	* that read only the class would answer "animal" and never "dog".
+	*
+	* ABSENT or EMPTY means no filter — absent is not a selection of none.
+	*/
+	classes: array(string().min(1).max(60)).max(40).optional()
+});
+var RecentSummariesPageSchema = object({
+	/** Ordered by (`lastActiveAt` DESC, id DESC). Same light item as
+	*  {@link listSummaries} — one list shape, so a card renders the same
+	*  whichever feed drew it. */
+	summaries: array(SummaryListItemSchema).readonly(),
+	nextCursor: string().nullable()
 });
 var RecentTracksPageSchema = object({
 	/** Merged page, ordered by (`lastSeen` DESC, `trackId` DESC). */
@@ -20464,7 +20580,7 @@ DeviceType.Camera, method(object({ deviceId: number() }), array(TrackSchema).rea
 	classes: array(string()).optional(),
 	/** See {@link ExcludeSourcesDoc}. */
 	excludeSources: array(TrackSourceSchema).optional()
-}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
+}), array(TrackSchema).readonly()), method(RecentTracksQueryInput, RecentTracksPageSchema), method(SummariesQueryInput, SummariesPageSchema), method(RecentSummariesQueryInput, RecentSummariesPageSchema), method(object({ id: string() }), SummaryDetailSchema.nullable()), method(object({ deviceId: number() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
 }), method(DeviceEventQueryInput, array(MotionEventSchema).readonly()), method(ObjectEventQueryInput, array(ObjectEventSchema).readonly()), method(DeviceEventQueryInput, array(AudioEventSchema).readonly()), method(object({ deviceId: number() }), array(EventKindDescriptorSchema).readonly()), method(object({ deviceIds: array(number()).min(1).max(200) }), array(EventKindsForDeviceSchema).readonly()), method(object({
@@ -30070,7 +30186,29 @@ var LoggingSettingsPatchSchema = object({
 	* disarmed the channels it did not mention would make the Levels page and
 	* the Diagnostics page fight over the same value.
 	*/
-	channels: array(LogChannelWindowPatchSchema).readonly().optional()
+	channels: array(LogChannelWindowPatchSchema).readonly().optional(),
+	/**
+	* How many days the analytics OPS LOG is kept — the audit trail of what
+	* retention actually deleted.
+	*
+	* It lives HERE, on the logging document, and not on the analytics addon's
+	* settings form, on the operator's instruction: every other log-ish window in
+	* this system is configured through this one document, and a retention audit
+	* configured somewhere else is a second place to look when the question is
+	* "what happened to my data".
+	*
+	* That placement has a cost worth stating: this document ships in the
+	* framework closure, so this knob needs a published `@camstack/server` while
+	* the four windows beside it (D485) reach a node on `camstack deploy`.
+	*
+	* `retention-model.ts` argued this one must NOT follow a device window,
+	* because the audit trail is the history of the SWEEP and not of the camera.
+	* That argument stands and is untouched — what changes is that 30 days stops
+	* being a constant nobody can reach. `0` keeps it forever. The floor is 1 day
+	* rather than 0-as-delete: an audit log truncated to nothing is precisely the
+	* state in which the next 9.5 GiB leak cannot be explained.
+	*/
+	opsLogRetentionDays: number().int().min(0).max(3650).optional()
 });
 /**
 * Which LAYER of the hierarchy is addressed. Absent = the cluster layer.
@@ -30143,6 +30281,14 @@ var LoggingSettingsStateSchema = object({
 	channels: array(LogChannelDescriptorSchema).readonly(),
 	/** The channels ARMED right now, each with its deadline. */
 	activeChannels: array(LogChannelWindowStateSchema).readonly(),
+	/**
+	* The ops-log window in days, as it is in force. `0` = kept forever.
+	*
+	* Reported rather than left to the caller's memory of what it wrote: this is
+	* the value the analytics sweep will actually use, and an operator asking how
+	* long their audit trail lives should not have to infer it from a default.
+	*/
+	opsLogRetentionDays: number().int().min(0),
 	persisted: boolean()
 });
 method(_void(), FeatureManifestSchema), method(_void(), HealthStatusSchema), method(_void(), FeatureManifestSchema), method(_void(), array(NetworkAddressSchema).readonly()), method(_void(), unknown().nullable(), { auth: "admin" }), method(record(string(), unknown()), _null(), {
@@ -34302,6 +34448,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"pipelineAnalytics.listRecentSummaries": {
+		capName: "pipeline-analytics",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"pipelineAnalytics.listRecentTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -38129,6 +38281,11 @@ Object.freeze({
 		form: "single",
 		optional: true
 	}],
+	"pipelineAnalytics.listRecentSummaries": [{
+		name: "deviceIds",
+		form: "array",
+		optional: false
+	}],
 	"pipelineAnalytics.listRecentTracks": [{
 		name: "deviceIds",
 		form: "array",
@@ -39602,66 +39759,65 @@ async function releaseAlexaEgress(input) {
 	}
 }
 //#endregion
-//#region src/handlers/types.ts
+//#region src/handlers/security-panel-arm-state.ts
 /**
-* Zod schemas for the subset of the Alexa Smart Home directive surface
-* that we actually parse hub-side. The Smart Home Skill API ships
-* thousands of optional fields per namespace — we only validate what
-* we read; everything else passes through as `unknown`.
+* The panel modes behind each Alexa arm state, PRIMARY first — the mirror of
+* `MODES_BY_TARGET` in the HomeKit exporter, and for the same reason: one
+* Alexa state stands for two panel modes, so a panel offering only the
+* secondary would otherwise be sent a mode it refuses.
+*/
+var MODES_BY_ARM_STATE = {
+	ARMED_STAY: ["home", "custom_bypass"],
+	ARMED_AWAY: ["away", "vacation"],
+	ARMED_NIGHT: ["night"]
+};
+var ARM_STATES = [
+	"ARMED_STAY",
+	"ARMED_AWAY",
+	"ARMED_NIGHT"
+];
+/** The panel's state as Alexa's `armState` property. */
+function alexaArmStateFor(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return "ARMED_STAY";
+		case "armed_night": return "ARMED_NIGHT";
+		case "armed_away":
+		case "armed_vacation":
+		case "pending":
+		case "triggered": return "ARMED_AWAY";
+		default: return "DISARMED";
+	}
+}
+/** `burglaryAlarm`, the only alarm property this cap can honestly fill. */
+function burglaryAlarmFor(state) {
+	return { value: state === "triggered" ? "ALARM" : "OK" };
+}
+/**
+* The `supportedArmStates` for discovery.
 *
-* Reference: https://developer.amazon.com/en-US/docs/alexa/smarthome/smart-home-skill-api-message-reference.html
+* `DISARMED` is always present: disarming is not one of the panel's arm modes.
+* An EMPTY `availableModes` is unknown, not "none" — a provider that never
+* populated the list looks identical to one that accepts nothing, and
+* publishing a panel that can only be disarmed on that guess takes the
+* controls off a working alarm. The caller logs it.
 */
-/** A directive header carries namespace + name + token + correlation id. */
-var DirectiveHeaderSchema = object({
-	namespace: string(),
-	name: string(),
-	payloadVersion: string(),
-	messageId: string(),
-	correlationToken: string().optional()
-});
-/** Scope carries the bearer token Alexa minted via our OAuth provider. */
-var BearerScopeSchema = object({
-	type: literal("BearerToken"),
-	token: string()
-});
-/** Endpoint reference inside a directive payload. */
-var EndpointRefSchema = object({
-	endpointId: string(),
-	scope: BearerScopeSchema.optional(),
-	cookie: record(string(), string()).optional()
-});
-var DiscoveryDirectiveSchema = object({
-	header: DirectiveHeaderSchema.extend({
-		namespace: literal("Alexa.Discovery"),
-		name: literal("Discover")
-	}),
-	payload: object({ scope: BearerScopeSchema })
-});
-/** Envelope wrapping a directive on the Alexa→skill wire. */
-var DirectiveRequestSchema = object({ directive: object({
-	header: DirectiveHeaderSchema,
-	endpoint: EndpointRefSchema.optional(),
-	payload: unknown().optional()
-}) });
-var InitializeCameraStreamsPayloadSchema = object({ cameraStreams: array(object({
-	protocol: string(),
-	resolution: object({
-		width: number(),
-		height: number()
-	}).optional(),
-	authorizationType: string().optional(),
-	videoCodec: string().optional(),
-	audioCodec: string().optional()
-})).optional() });
-var InitiateSessionWithOfferPayloadSchema = object({
-	sessionId: string(),
-	offer: object({
-		format: string().optional(),
-		value: string()
-	})
-});
-var SessionDisconnectedPayloadSchema = object({ sessionId: string() });
-var SetModePayloadSchema = object({ mode: string() });
+function supportedArmStatesFor(availableModes) {
+	return [...availableModes.length === 0 ? ARM_STATES : ARM_STATES.filter((armState) => MODES_BY_ARM_STATE[armState].some((mode) => availableModes.includes(mode))), "DISARMED"];
+}
+/**
+* The arm mode to send for an Alexa arm state, or `null` when there is none.
+*
+* `null` is not a shrug: `DISARMED` is the Disarm DIRECTIVE, a different call,
+* and an arm state the panel accepts no mode for is a directive the handler
+* refuses with `NOT_READY_FOR_ARM` rather than translating into a guess.
+*/
+function alarmArmModeForAlexa(armState, availableModes) {
+	if (armState === "DISARMED") return null;
+	const candidates = MODES_BY_ARM_STATE[armState];
+	if (availableModes.length === 0) return candidates[0] ?? null;
+	return candidates.find((mode) => availableModes.includes(mode)) ?? null;
+}
 //#endregion
 //#region src/endpoints/builder.ts
 var DEFAULT_RESOLUTIONS = [{
@@ -39985,6 +40141,53 @@ function buildPrivacyEndpoint(input) {
 		}
 	};
 }
+/**
+* An `alarm-panel` device as an `Alexa.SecurityPanelController` endpoint.
+*
+* It is its OWN endpoint, not a child of a camera: a panel is a standalone
+* device and has no stream, no doorbell and no PTZ. The `__alarm` suffix on
+* the endpoint id is a routing tag (see `handlers/endpoint-id.ts`).
+*
+* ## What is declared, and what is deliberately not
+*
+*  - `armState` and `burglaryAlarm` are the two properties this cap can fill
+*    honestly. `fireAlarm` / `carbonMonoxideAlarm` / `waterAlarm` are NOT
+*    declared: `alarm-panel` has no field saying WHICH alarm is sounding, and
+*    declaring a property we would always answer `OK` on is a claim with no
+*    basis behind it. The reasoning is in `security-panel-arm-state.ts`.
+*  - `proactivelyReported: false`. This addon's Event Gateway pushes
+*    ChangeReports for camera motion only; a panel state change is not wired
+*    to it, and promising a report nothing sends is how an endpoint ends up
+*    looking broken. `retrievable: true` — `Alexa/ReportState` answers.
+*  - `supportedAuthorizationTypes` appears only for a panel that requires a
+*    code. Alexa's Disarm directive can carry a PIN; its **Arm directive
+*    cannot**, which is why a PIN-gated arm is refused by the handler with
+*    `AUTHORIZATION_REQUIRED` rather than attempted.
+*/
+function buildAlarmPanelEndpoint(input) {
+	const configuration = { supportedArmStates: supportedArmStatesFor(input.availableModes).map((value) => ({ value })) };
+	if (input.requiresCode) configuration.supportedAuthorizationTypes = [{ type: "FOUR_DIGIT_PIN" }];
+	const securityPanelController = {
+		type: "AlexaInterface",
+		interface: "Alexa.SecurityPanelController",
+		version: "3",
+		properties: {
+			supported: [{ name: "armState" }, { name: "burglaryAlarm" }],
+			proactivelyReported: false,
+			retrievable: true
+		},
+		configuration
+	};
+	return {
+		endpointId: `${input.deviceId}__alarm`,
+		manufacturerName: "camstack",
+		description: "CamStack alarm panel",
+		friendlyName: input.friendlyName.trim().length > 0 ? input.friendlyName.trim() : `Alarm ${input.deviceId}`,
+		displayCategories: ["SECURITY_PANEL"],
+		capabilities: [ALEXA_BASE_CAPABILITY, securityPanelController],
+		cookie: { stableId: input.stableId }
+	};
+}
 //#endregion
 //#region src/handlers/error-envelope.ts
 /**
@@ -40020,20 +40223,68 @@ function errorEnvelope(header, type, message) {
 	} };
 }
 //#endregion
-//#region src/handlers/discovery.ts
+//#region src/handlers/types.ts
 /**
-* `Alexa.Discovery/Discover` handler — fires when the Alexa app pulls
-* the user's device list. We respond with the operator-curated
-* `exposed-devices.json` list, resolved against the live device
-* registry (so we don't return zombie endpoints for deleted devices).
+* Zod schemas for the subset of the Alexa Smart Home directive surface
+* that we actually parse hub-side. The Smart Home Skill API ships
+* thousands of optional fields per namespace — we only validate what
+* we read; everything else passes through as `unknown`.
 *
-* Feature detection is PASSIVE: per exposed device we inspect the
-* `DeviceInfo.features` + bound caps (from `device-manager.getBindings`)
-* and emit only the Alexa capabilities backed by something on our side.
-* Child accessories (siren/floodlight/PIR/…) become SEPARATE endpoints
-* with `endpointId = ${parent}__${child}` so directive handlers can
-* route to the right cap on the right device.
+* Reference: https://developer.amazon.com/en-US/docs/alexa/smarthome/smart-home-skill-api-message-reference.html
 */
+/** A directive header carries namespace + name + token + correlation id. */
+var DirectiveHeaderSchema = object({
+	namespace: string(),
+	name: string(),
+	payloadVersion: string(),
+	messageId: string(),
+	correlationToken: string().optional()
+});
+/** Scope carries the bearer token Alexa minted via our OAuth provider. */
+var BearerScopeSchema = object({
+	type: literal("BearerToken"),
+	token: string()
+});
+/** Endpoint reference inside a directive payload. */
+var EndpointRefSchema = object({
+	endpointId: string(),
+	scope: BearerScopeSchema.optional(),
+	cookie: record(string(), string()).optional()
+});
+var DiscoveryDirectiveSchema = object({
+	header: DirectiveHeaderSchema.extend({
+		namespace: literal("Alexa.Discovery"),
+		name: literal("Discover")
+	}),
+	payload: object({ scope: BearerScopeSchema })
+});
+/** Envelope wrapping a directive on the Alexa→skill wire. */
+var DirectiveRequestSchema = object({ directive: object({
+	header: DirectiveHeaderSchema,
+	endpoint: EndpointRefSchema.optional(),
+	payload: unknown().optional()
+}) });
+var InitializeCameraStreamsPayloadSchema = object({ cameraStreams: array(object({
+	protocol: string(),
+	resolution: object({
+		width: number(),
+		height: number()
+	}).optional(),
+	authorizationType: string().optional(),
+	videoCodec: string().optional(),
+	audioCodec: string().optional()
+})).optional() });
+var InitiateSessionWithOfferPayloadSchema = object({
+	sessionId: string(),
+	offer: object({
+		format: string().optional(),
+		value: string()
+	})
+});
+var SessionDisconnectedPayloadSchema = object({ sessionId: string() });
+var SetModePayloadSchema = object({ mode: string() });
+//#endregion
+//#region src/handlers/discovery.ts
 var discoveryPayloadSchema = DiscoveryDirectiveSchema.shape.payload;
 /** Devices built at once in `handleDiscovery` — latency-bound tRPC reads, so
 *  six lanes hide the round-trips without stampeding a booting hub. */
@@ -40047,6 +40298,7 @@ var CAP_SWITCH = "switch";
 var CAP_BRIGHTNESS = "brightness";
 var CAP_BATTERY = "battery";
 var CAP_PRIVACY_MASK = "privacy-mask";
+var CAP_ALARM_PANEL = "alarm-panel";
 async function handleDiscovery(header, payloadRaw, deps, callerIdentity) {
 	if (!discoveryPayloadSchema.safeParse(payloadRaw).success) return errorEnvelope(header, "INVALID_DIRECTIVE", "Discovery payload shape unexpected");
 	const exposed = await deps.listExposed();
@@ -40086,6 +40338,7 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		return [];
 	}
 	const parentInfo = await loadBoundDeviceInfo(device, api);
+	if (parentInfo.capNames.includes(CAP_ALARM_PANEL)) return [await buildAlarmPanelEndpointFor(parentInfo, api, deps)];
 	const children = await api.deviceManager.getChildren.query({ parentDeviceId: deviceId }).catch((err) => {
 		deps.logger.warn("alexa discovery: getChildren failed", {
 			tags: { deviceId },
@@ -40165,6 +40418,47 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 	}
 	return out;
 }
+/**
+* The panel endpoint, with what the panel says it accepts.
+*
+* A `getStatus` that fails leaves `availableModes` empty and `requiresCode`
+* false, and those are the UNKNOWN readings, not assertions: an empty mode
+* list makes discovery declare all three arm states (`supportedArmStatesFor`)
+* rather than publishing a panel that can only be disarmed, and the directive
+* handler re-reads the panel before it commands anything, so a PIN discovered
+* later is still honoured. The blind read is logged against the device id.
+*/
+async function buildAlarmPanelEndpointFor(info, api, deps) {
+	const status = await api.alarmPanel.getStatus.query({ deviceId: info.id }).catch((err) => {
+		deps.logger.warn("alexa discovery: alarmPanel.getStatus failed — declaring every arm state", {
+			tags: { deviceId: info.id },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return null;
+	});
+	const parsed = AlarmPanelStatusSchema.pick({
+		availableModes: true,
+		requiresCode: true
+	}).safeParse(status);
+	if (!parsed.success && status !== null) deps.logger.warn("alexa discovery: panel status did not match the cap schema", { tags: { deviceId: info.id } });
+	const availableModes = parsed.success ? parsed.data.availableModes : [];
+	const requiresCode = parsed.success ? parsed.data.requiresCode : false;
+	deps.logger.info("alexa discovery: built alarm panel endpoint", {
+		tags: { deviceId: info.id },
+		meta: {
+			name: info.name,
+			availableModes: [...availableModes],
+			requiresCode
+		}
+	});
+	return buildAlarmPanelEndpoint({
+		deviceId: info.id,
+		stableId: info.stableId,
+		friendlyName: info.name,
+		availableModes,
+		requiresCode
+	});
+}
 async function loadBoundDeviceInfo(device, api) {
 	const capNames = (await api.deviceManager.getBindings.query({ deviceId: device.id })).entries.map((e) => e.capName);
 	return {
@@ -40230,10 +40524,14 @@ function parseCameraEndpointId(raw) {
 		kind: "privacy",
 		parentDeviceId: parent
 	};
+	if (tail === "alarm") return {
+		kind: "alarm-panel",
+		deviceId: parent
+	};
 	const child = parseNonNegativeInt(tail);
 	if (child === null) return {
 		kind: "invalid",
-		reason: `child segment not numeric and not 'autotrack'/'privacy': ${raw}`
+		reason: `child segment not numeric and not 'autotrack'/'privacy'/'alarm': ${raw}`
 	};
 	return {
 		kind: "child",
@@ -40248,6 +40546,68 @@ function parseNonNegativeInt(s) {
 	return n;
 }
 //#endregion
+//#region src/handlers/brightness-controller.ts
+var SetBrightnessDirectiveSchema = object({
+	header: object({
+		namespace: literal("Alexa.BrightnessController"),
+		name: literal("SetBrightness")
+	}),
+	endpoint: EndpointRefSchema,
+	payload: object({ brightness: number().min(0).max(100) })
+});
+async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SetBrightnessDirectiveSchema.safeParse({
+		header: {
+			namespace: header.namespace,
+			name: header.name
+		},
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpointId = parsed.data.endpoint.endpointId;
+	const parsedId = parseCameraEndpointId(endpointId);
+	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy" || parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
+	if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "BrightnessController is not exposed on camera endpoints — direct the directive at the dimmable child accessory");
+	if (parsedId.kind === "invalid") return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
+	const percentage = parsed.data.payload.brightness;
+	const api = deps.ctx.api;
+	try {
+		await api.brightness.setBrightness.mutate({
+			deviceId: parsedId.childDeviceId,
+			percentage
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn("alexa brightness-controller: setBrightness failed", { meta: {
+			deviceId: parsedId.childDeviceId,
+			percentage,
+			error: message
+		} });
+		return errorEnvelope(header, "INTERNAL_ERROR", `brightness.setBrightness failed: ${message}`);
+	}
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId },
+			payload: {}
+		},
+		context: { properties: [{
+			namespace: "Alexa.BrightnessController",
+			name: "brightness",
+			value: percentage,
+			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
+			uncertaintyInMilliseconds: 500
+		}] }
+	};
+}
+//#endregion
 //#region src/handlers/camera-stream.ts
 /**
 * `Alexa.CameraStreamController/InitializeCameraStreams` handler.
@@ -40330,347 +40690,42 @@ async function handleInitializeCameraStreams(header, endpointRaw, payloadRaw, de
 	} };
 }
 //#endregion
-//#region src/handlers/rtc-session.ts
-var InitiateSessionWithOfferDirectiveSchema = object({
-	endpoint: EndpointRefSchema,
-	payload: InitiateSessionWithOfferPayloadSchema
-});
-var SessionDisconnectedDirectiveSchema = object({
-	endpoint: EndpointRefSchema,
-	payload: SessionDisconnectedPayloadSchema
-});
-/**
-* Live egress handles, keyed by `<deviceId>/<sessionId>`.
-*
-* The primitive's refcount has no lease TTL: a holder that vanishes without
-* releasing leaks a child until the broker restarts (D67). This handler is a
-* holder, so it keeps the one piece of state that lets it not be that holder —
-* the `pipelineKey` its `SessionDisconnected` has to release.
-*
-* A module-level map is right here because the directive handlers are free
-* functions called per directive; the entry is written on a successful acquire
-* and deleted on the release path, both of which are the same tick as the
-* directive that owns it.
-*/
-var EGRESS_HANDLES = /* @__PURE__ */ new Map();
-function egressHandleKey(deviceId, sessionId) {
-	return `${deviceId}/${sessionId}`;
-}
-var WEBRTC_PROFILE_NAMES = [
-	"high",
-	"mid",
-	"low"
-];
-function resolveWebrtcTarget(pref) {
-	if (pref === "auto") return void 0;
-	if (WEBRTC_PROFILE_NAMES.includes(pref)) return {
-		kind: "profile",
-		profile: pref
-	};
-	return {
-		kind: "cam-stream",
-		camStreamId: pref
-	};
-}
-async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = InitiateSessionWithOfferDirectiveSchema.safeParse({
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpoint = parsed.data.endpoint;
-	const payload = parsed.data.payload;
-	const parsedId = parseCameraEndpointId(endpoint.endpointId);
-	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `endpointId ${endpoint.endpointId} is not a camera`);
-	const deviceId = parsedId.deviceId;
-	const sessionId = payload.sessionId;
-	const log = deps.logger.withTags({
-		deviceId,
-		sessionId
-	});
-	const sdpOffer = payload.offer.value;
-	if (sdpOffer.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "offer.value is empty");
-	const api = deps.ctx.api;
-	const exposedEntry = deps.listExposed().find((e) => e.deviceId === deviceId);
-	const explicitSourceProfile = exposedEntry?.settings?.sourceProfile;
-	const mappedFromPreference = (() => {
-		const pref = exposedEntry?.settings?.streamPreference;
-		if (pref === "low" || pref === "mid" || pref === "high") return pref;
-	})();
-	const sourceProfile = explicitSourceProfile ?? mappedFromPreference ?? "high";
-	let derivedTarget;
-	/**
-	* The primitive's release handle, when this session acquired one. Recorded so
-	* `SessionDisconnected` can release it: a refcount whose holder disappears is
-	* the one gap D67 leaves open, and the least this handler can do is not BE
-	* that holder.
-	*/
-	let egressPipelineKey = null;
-	const picked = await api.cameraStreams.pickStream.query({
-		deviceId,
-		requirements: {
-			acceptCodecs: ["h264"],
-			minHeight: 480,
-			excludeDerived: true,
-			requireSiblingCodec: ["h265", "hevc"]
-		}
-	}).catch((err) => {
-		log.warn("alexa rtc-session: cameraStreams.pickStream threw — falling back to transcode", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		return null;
-	});
-	if (picked) {
-		log.info("alexa rtc-session: bypassing transcode via cameraStreams.pickStream", { meta: {
-			sourceProfile,
-			selectedCamStreamId: picked.camStreamId,
-			reason: picked.reason
-		} });
-		derivedTarget = {
-			kind: "cam-stream",
-			camStreamId: picked.camStreamId
-		};
-	} else try {
-		const acquired = await acquireAlexaEgress({
-			api,
-			deviceId,
-			sourceProfile,
-			sessionId,
-			logger: log
-		});
-		egressPipelineKey = acquired.pipelineKey;
-		EGRESS_HANDLES.set(egressHandleKey(deviceId, sessionId), acquired.pipelineKey);
-		derivedTarget = {
-			kind: "cam-stream",
-			camStreamId: acquired.camStreamId
-		};
-	} catch (err) {
-		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
-	}
-	try {
-		const result = await api.webrtcSession.handleOffer.mutate({
-			deviceId,
-			sdpOffer,
-			sessionId,
-			target: derivedTarget,
-			relayOnly: false,
-			nonTrickle: true,
-			disableTurn: true,
-			disableIpv6: true,
-			consumerAttribution: {
-				kind: "alexa",
-				sessionId
-			}
-		});
-		log.info("alexa rtc-session: AnswerGenerated", { meta: {
-			returnedSessionId: result.sessionId,
-			sdpAnswerLen: result.sdpAnswer.length
-		} });
-		return { event: {
-			header: {
-				namespace: "Alexa.RTCSessionController",
-				name: "AnswerGeneratedForSession",
-				messageId: header.messageId,
-				correlationToken: header.correlationToken,
-				payloadVersion: "3"
-			},
-			endpoint: { endpointId: endpoint.endpointId },
-			payload: { answer: {
-				format: payload.offer.format ?? "SDP",
-				value: result.sdpAnswer
-			} }
-		} };
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		const mSectionSummary = (() => {
-			const lines = sdpOffer.split(/\r?\n/);
-			const sections = [];
-			let current = null;
-			for (const raw of lines) {
-				const line = raw.trim();
-				if (line.startsWith("m=")) {
-					if (current) sections.push(current);
-					current = {
-						mid: null,
-						kind: line.split(" ")[0]?.slice(2) ?? "unknown",
-						direction: null,
-						codecs: []
-					};
-				} else if (current) {
-					if (line.startsWith("a=mid:")) current.mid = line.slice(6);
-					else if (/^a=(sendonly|recvonly|sendrecv|inactive)$/.test(line)) current.direction = line.slice(2);
-					else if (line.startsWith("a=rtpmap:")) current.codecs.push(line.slice(9));
-				}
-			}
-			if (current) sections.push(current);
-			return sections;
-		})();
-		log.warn("alexa rtc-session: handleOffer failed", { meta: {
-			error: message,
-			offerLen: sdpOffer.length,
-			mSections: mSectionSummary,
-			offerSdp: sdpOffer
-		} });
-		if (egressPipelineKey !== null) {
-			EGRESS_HANDLES.delete(egressHandleKey(deviceId, sessionId));
-			await releaseAlexaEgress({
-				api,
-				deviceId,
-				pipelineKey: egressPipelineKey,
-				logger: log
-			});
-		}
-		return errorEnvelope(header, "INTERNAL_ERROR", `webrtc-session.handleOffer failed: ${message}`);
-	}
-}
-async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SessionDisconnectedDirectiveSchema.safeParse({
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpoint = parsed.data.endpoint;
-	const parsedId = parseCameraEndpointId(endpoint.endpointId);
-	if (parsedId.kind === "camera") {
-		const handleKey = egressHandleKey(parsedId.deviceId, parsed.data.payload.sessionId);
-		const pipelineKey = EGRESS_HANDLES.get(handleKey);
-		if (pipelineKey !== void 0) {
-			EGRESS_HANDLES.delete(handleKey);
-			await releaseAlexaEgress({
-				api: deps.ctx.api,
-				deviceId: parsedId.deviceId,
-				pipelineKey,
-				logger: deps.logger
-			});
-		}
-		try {
-			await deps.ctx.api.webrtcSession.closeSession.mutate({
-				deviceId: parsedId.deviceId,
-				sessionId: parsed.data.payload.sessionId
-			});
-		} catch (err) {
-			deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
-				tags: {
-					deviceId: parsedId.deviceId,
-					sessionId: parsed.data.payload.sessionId
-				},
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-	}
-	const disconnectedDeviceId = parsedId.kind === "camera" ? parsedId.deviceId : void 0;
-	deps.logger.info("alexa rtc-session: SessionDisconnected", {
-		tags: {
-			sessionId: parsed.data.payload.sessionId,
-			...disconnectedDeviceId !== void 0 ? { deviceId: disconnectedDeviceId } : {}
-		},
-		meta: { endpointId: endpoint.endpointId }
-	});
-	return { event: {
-		header: {
-			namespace: "Alexa",
-			name: "Response",
-			messageId: header.messageId,
-			correlationToken: header.correlationToken,
-			payloadVersion: "3"
-		},
-		endpoint: { endpointId: endpoint.endpointId },
-		payload: {}
-	} };
-}
-//#endregion
-//#region src/handlers/ptz-preset.ts
-/**
-* `Alexa.ModeController/SetMode` handler — dispatches three PTZ instances:
-*
-*   `ptz.preset` — preset-recall. Decodes the preset name from the mode
-*     value and calls `ptz.goToPreset({deviceId, presetId})`.
-*
-*   `ptz.pan`  — momentary pan. `ptz.pan.left|right|center` issues a
-*     continuousMove pulse stopped on a timer; the dropdown reverts to
-*     `center` server-side so subsequent picks re-trigger the move.
-*
-*   `ptz.tilt` — momentary tilt. Mirrors ptz.pan with up|down|center.
-*/
-var SetModeDirectiveSchema = object({
+//#region src/handlers/power-controller.ts
+var PowerDirectiveSchema = object({
 	header: object({
-		namespace: literal("Alexa.ModeController"),
-		name: literal("SetMode"),
-		instance: string().optional()
+		namespace: literal("Alexa.PowerController"),
+		name: _enum(["TurnOn", "TurnOff"])
 	}),
-	endpoint: EndpointRefSchema,
-	payload: SetModePayloadSchema
+	endpoint: EndpointRefSchema
 });
-var PTZ_PRESET_MODE_PREFIX = "ptz.preset.";
-var PTZ_DIRECTION_PULSE_MS = 1e3;
-var PTZ_PAN_MOVES = {
-	"ptz.pan.left": { pan: -1 },
-	"ptz.pan.right": { pan: 1 },
-	"ptz.pan.center": {}
-};
-var PTZ_TILT_MOVES = {
-	"ptz.tilt.up": { tilt: 1 },
-	"ptz.tilt.down": { tilt: -1 },
-	"ptz.tilt.center": {}
-};
-async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SetModeDirectiveSchema.safeParse({
+async function handlePower(header, endpointRaw, deps, _callerIdentity) {
+	const parsed = PowerDirectiveSchema.safeParse({
 		header: {
 			namespace: header.namespace,
-			name: header.name,
-			instance: header.instance
+			name: header.name
 		},
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
+		endpoint: endpointRaw
 	});
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const instance = parsed.data.header.instance;
-	if (instance !== "ptz.preset" && instance !== "ptz.pan" && instance !== "ptz.tilt") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController instance not supported: ${instance ?? "(missing)"}`);
 	const endpointId = parsed.data.endpoint.endpointId;
 	const parsedId = parseCameraEndpointId(endpointId);
-	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController only supported on camera endpoints — got ${endpointId}`);
-	const mode = parsed.data.payload.mode;
+	const on = parsed.data.header.name === "TurnOn";
 	const api = deps.ctx.api;
-	if (instance === "ptz.pan" || instance === "ptz.tilt") {
-		const move = (instance === "ptz.pan" ? PTZ_PAN_MOVES : PTZ_TILT_MOVES)[mode];
-		if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a valid ${instance} mode`);
-		if (Object.keys(move).length === 0) await api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-			deps.logger.debug("alexa ptz-mode: stop (center) failed (non-fatal)", { meta: {
-				deviceId: parsedId.deviceId,
-				instance,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		});
-		else try {
-			await api.ptz.continuousMove.mutate({
-				deviceId: parsedId.deviceId,
-				...move
-			});
-			setTimeout(() => {
-				api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-					deps.logger.debug("alexa ptz-mode: stop after pulse failed (non-fatal)", { meta: {
-						deviceId: parsedId.deviceId,
-						instance,
-						error: err instanceof Error ? err.message : String(err)
-					} });
-				});
-			}, PTZ_DIRECTION_PULSE_MS);
-		} catch (err) {
-			return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		return modeSuccessResponse(header, endpointId, instance, instance === "ptz.pan" ? "ptz.pan.center" : "ptz.tilt.center");
-	}
-	if (!mode.startsWith(PTZ_PRESET_MODE_PREFIX)) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a ptz.preset mode`);
-	const presetName = mode.slice(11);
-	if (presetName.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "preset name missing after prefix");
-	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName);
-	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' not found on device ${parsedId.deviceId}`);
-	await api.ptz.goToPreset.mutate({
-		deviceId: parsedId.deviceId,
-		presetId: preset.id
+	if (parsedId.kind === "autotrack") await api.ptzAutotrack.setEnabled.mutate({
+		deviceId: parsedId.parentDeviceId,
+		enabled: on
 	});
-	return modeSuccessResponse(header, endpointId, "ptz.preset", mode);
-}
-function modeSuccessResponse(header, endpointId, instance, mode) {
+	else if (parsedId.kind === "privacy") await api.privacyMask.setMask.mutate({
+		deviceId: parsedId.parentDeviceId,
+		patch: { enabled: on }
+	});
+	else if (parsedId.kind === "child") await api.switch.setState.mutate({
+		deviceId: parsedId.childDeviceId,
+		on
+	});
+	else if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on camera endpoints — direct the directive at the child accessory");
+	else if (parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on alarm-panel endpoints — use Alexa.SecurityPanelController");
+	else return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
 	return {
 		event: {
 			header: {
@@ -40684,10 +40739,9 @@ function modeSuccessResponse(header, endpointId, instance, mode) {
 			payload: {}
 		},
 		context: { properties: [{
-			namespace: "Alexa.ModeController",
-			instance,
-			name: "mode",
-			value: mode,
+			namespace: "Alexa.PowerController",
+			name: "powerState",
+			value: on ? "ON" : "OFF",
 			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
 			uncertaintyInMilliseconds: 500
 		}] }
@@ -40787,133 +40841,99 @@ function successResponse(header, endpointId, toggleState, instance) {
 	};
 }
 //#endregion
-//#region src/handlers/power-controller.ts
-/**
-* `Alexa.PowerController/{TurnOn,TurnOff}` handler.
-*
-* Routing decodes the endpoint id:
-*   - `${parent}__${child}` → call `switch.setState({deviceId: child, on})`
-*   - `${parent}__autotrack` → call `ptzAutotrack.setEnabled({deviceId: parent, enabled})`
-*   - `${parent}__privacy` → call `privacyMask.setMask({deviceId: parent, patch: { enabled } })`
-*   - `${deviceId}` (bare parent camera) → reject with INVALID_DIRECTIVE
-*     (we never expose PowerController on the camera itself).
-*
-* Auth: verify the directive's scope token (same as every other
-* controller).
-*/
-var PowerDirectiveSchema = object({
-	header: object({
-		namespace: literal("Alexa.PowerController"),
-		name: _enum(["TurnOn", "TurnOff"])
-	}),
-	endpoint: EndpointRefSchema
-});
-async function handlePower(header, endpointRaw, deps, _callerIdentity) {
-	const parsed = PowerDirectiveSchema.safeParse({
-		header: {
-			namespace: header.namespace,
-			name: header.name
-		},
-		endpoint: endpointRaw
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpointId = parsed.data.endpoint.endpointId;
-	const parsedId = parseCameraEndpointId(endpointId);
-	const on = parsed.data.header.name === "TurnOn";
-	const api = deps.ctx.api;
-	if (parsedId.kind === "autotrack") await api.ptzAutotrack.setEnabled.mutate({
-		deviceId: parsedId.parentDeviceId,
-		enabled: on
-	});
-	else if (parsedId.kind === "privacy") await api.privacyMask.setMask.mutate({
-		deviceId: parsedId.parentDeviceId,
-		patch: { enabled: on }
-	});
-	else if (parsedId.kind === "child") await api.switch.setState.mutate({
-		deviceId: parsedId.childDeviceId,
-		on
-	});
-	else if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on camera endpoints — direct the directive at the child accessory");
-	else return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
-	return {
-		event: {
-			header: {
-				namespace: "Alexa",
-				name: "Response",
-				messageId: header.messageId,
-				correlationToken: header.correlationToken,
-				payloadVersion: "3"
-			},
-			endpoint: { endpointId },
-			payload: {}
-		},
-		context: { properties: [{
-			namespace: "Alexa.PowerController",
-			name: "powerState",
-			value: on ? "ON" : "OFF",
-			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
-			uncertaintyInMilliseconds: 500
-		}] }
-	};
-}
-//#endregion
-//#region src/handlers/brightness-controller.ts
+//#region src/handlers/ptz-preset.ts
 /**
-* `Alexa.BrightnessController/SetBrightness` handler.
+* `Alexa.ModeController/SetMode` handler — dispatches three PTZ instances:
 *
-* The Discovery handler declares `Alexa.BrightnessController` only on
-* child accessory endpoints that bind the `brightness` cap (today:
-* Reolink floodlights, Hikvision supplemental lights). Brightness is
-* NEVER exposed on the parent camera endpoint or on the synthetic
-* autotrack endpoint — both reject INVALID_DIRECTIVE here.
+*   `ptz.preset` — preset-recall. Decodes the preset name from the mode
+*     value and calls `ptz.goToPreset({deviceId, presetId})`.
 *
-* Routing:
-*   - `${parent}__${child}` → `brightness.setBrightness({deviceId: child, percentage})`
+*   `ptz.pan`  — momentary pan. `ptz.pan.left|right|center` issues a
+*     continuousMove pulse stopped on a timer; the dropdown reverts to
+*     `center` server-side so subsequent picks re-trigger the move.
 *
-* Auth: same scope-token verification path as the other controllers.
-* The response carries the `Alexa.BrightnessController.brightness`
-* property echoing the new level so the Echo updates its UI without an
-* extra ReportState round-trip.
+*   `ptz.tilt` — momentary tilt. Mirrors ptz.pan with up|down|center.
 */
-var SetBrightnessDirectiveSchema = object({
+var SetModeDirectiveSchema = object({
 	header: object({
-		namespace: literal("Alexa.BrightnessController"),
-		name: literal("SetBrightness")
+		namespace: literal("Alexa.ModeController"),
+		name: literal("SetMode"),
+		instance: string().optional()
 	}),
 	endpoint: EndpointRefSchema,
-	payload: object({ brightness: number().min(0).max(100) })
+	payload: SetModePayloadSchema
 });
-async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SetBrightnessDirectiveSchema.safeParse({
+var PTZ_PRESET_MODE_PREFIX = "ptz.preset.";
+var PTZ_DIRECTION_PULSE_MS = 1e3;
+var PTZ_PAN_MOVES = {
+	"ptz.pan.left": { pan: -1 },
+	"ptz.pan.right": { pan: 1 },
+	"ptz.pan.center": {}
+};
+var PTZ_TILT_MOVES = {
+	"ptz.tilt.up": { tilt: 1 },
+	"ptz.tilt.down": { tilt: -1 },
+	"ptz.tilt.center": {}
+};
+async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SetModeDirectiveSchema.safeParse({
 		header: {
 			namespace: header.namespace,
-			name: header.name
+			name: header.name,
+			instance: header.instance
 		},
 		endpoint: endpointRaw,
 		payload: payloadRaw ?? {}
 	});
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const instance = parsed.data.header.instance;
+	if (instance !== "ptz.preset" && instance !== "ptz.pan" && instance !== "ptz.tilt") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController instance not supported: ${instance ?? "(missing)"}`);
 	const endpointId = parsed.data.endpoint.endpointId;
 	const parsedId = parseCameraEndpointId(endpointId);
-	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
-	if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "BrightnessController is not exposed on camera endpoints — direct the directive at the dimmable child accessory");
-	if (parsedId.kind === "invalid") return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
-	const percentage = parsed.data.payload.brightness;
+	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController only supported on camera endpoints — got ${endpointId}`);
+	const mode = parsed.data.payload.mode;
 	const api = deps.ctx.api;
-	try {
-		await api.brightness.setBrightness.mutate({
-			deviceId: parsedId.childDeviceId,
-			percentage
+	if (instance === "ptz.pan" || instance === "ptz.tilt") {
+		const move = (instance === "ptz.pan" ? PTZ_PAN_MOVES : PTZ_TILT_MOVES)[mode];
+		if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a valid ${instance} mode`);
+		if (Object.keys(move).length === 0) await api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
+			deps.logger.debug("alexa ptz-mode: stop (center) failed (non-fatal)", { meta: {
+				deviceId: parsedId.deviceId,
+				instance,
+				error: err instanceof Error ? err.message : String(err)
+			} });
 		});
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		deps.logger.warn("alexa brightness-controller: setBrightness failed", { meta: {
-			deviceId: parsedId.childDeviceId,
-			percentage,
-			error: message
-		} });
-		return errorEnvelope(header, "INTERNAL_ERROR", `brightness.setBrightness failed: ${message}`);
+		else try {
+			await api.ptz.continuousMove.mutate({
+				deviceId: parsedId.deviceId,
+				...move
+			});
+			setTimeout(() => {
+				api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
+					deps.logger.debug("alexa ptz-mode: stop after pulse failed (non-fatal)", { meta: {
+						deviceId: parsedId.deviceId,
+						instance,
+						error: err instanceof Error ? err.message : String(err)
+					} });
+				});
+			}, PTZ_DIRECTION_PULSE_MS);
+		} catch (err) {
+			return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return modeSuccessResponse(header, endpointId, instance, instance === "ptz.pan" ? "ptz.pan.center" : "ptz.tilt.center");
 	}
+	if (!mode.startsWith(PTZ_PRESET_MODE_PREFIX)) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a ptz.preset mode`);
+	const presetName = mode.slice(11);
+	if (presetName.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "preset name missing after prefix");
+	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName);
+	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' not found on device ${parsedId.deviceId}`);
+	await api.ptz.goToPreset.mutate({
+		deviceId: parsedId.deviceId,
+		presetId: preset.id
+	});
+	return modeSuccessResponse(header, endpointId, "ptz.preset", mode);
+}
+function modeSuccessResponse(header, endpointId, instance, mode) {
 	return {
 		event: {
 			header: {
@@ -40927,9 +40947,10 @@ async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _calle
 			payload: {}
 		},
 		context: { properties: [{
-			namespace: "Alexa.BrightnessController",
-			name: "brightness",
-			value: percentage,
+			namespace: "Alexa.ModeController",
+			instance,
+			name: "mode",
+			value: mode,
 			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
 			uncertaintyInMilliseconds: 500
 		}] }
@@ -40950,6 +40971,7 @@ async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
 		else if (parsed.kind === "privacy") await collectPrivacyProperties(api, parsed.parentDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "autotrack") await collectAutotrackProperties(api, parsed.parentDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "child") await collectChildProperties(api, parsed.childDeviceId, properties, nowIso, deps.logger);
+		else if (parsed.kind === "alarm-panel") await collectAlarmPanelProperties(api, parsed.deviceId, properties, nowIso, deps.logger);
 	} catch (err) {
 		deps.logger.warn("alexa report-state: collection failed", { meta: {
 			endpointId,
@@ -41011,6 +41033,42 @@ async function collectCameraProperties(api, deviceId, properties, timeOfSample,
 		uncertaintyInMilliseconds: 0
 	});
 }
+/**
+* The panel's two declared properties.
+*
+* Both are omitted when the panel cannot be read — an `armState` we guessed
+* would be a claim about whether a house is locked, and Alexa rendering the
+* endpoint as unavailable is the truthful outcome of a panel nobody reached.
+* The failure is logged with the device id, never swallowed.
+*/
+async function collectAlarmPanelProperties(api, deviceId, properties, timeOfSample, logger) {
+	const status = await api.alarmPanel.getStatus.query({ deviceId }).catch((err) => {
+		logger.warn("alexa report-state: alarmPanel.getStatus FAILED — Alexa will show the panel as unavailable", {
+			tags: { deviceId },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return null;
+	});
+	const parsed = AlarmPanelStatusSchema.pick({ state: true }).safeParse(status);
+	if (!parsed.success) {
+		if (status !== null) logger.warn("alexa report-state: panel status did not match the cap schema — omitting", { tags: { deviceId } });
+		return;
+	}
+	properties.push({
+		namespace: "Alexa.SecurityPanelController",
+		name: "armState",
+		value: alexaArmStateFor(parsed.data.state),
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	});
+	properties.push({
+		namespace: "Alexa.SecurityPanelController",
+		name: "burglaryAlarm",
+		value: burglaryAlarmFor(parsed.data.state),
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	});
+}
 async function collectPrivacyProperties(api, parentDeviceId, properties, timeOfSample, _logger) {
 	const status = await api.privacyMask.getStatus.query({ deviceId: parentDeviceId }).catch(() => null);
 	const enabled = Boolean(status?.enabled);
@@ -41064,6 +41122,478 @@ async function collectChildProperties(api, childDeviceId, properties, timeOfSamp
 	});
 }
 //#endregion
+//#region src/handlers/rtc-session.ts
+var InitiateSessionWithOfferDirectiveSchema = object({
+	endpoint: EndpointRefSchema,
+	payload: InitiateSessionWithOfferPayloadSchema
+});
+var SessionDisconnectedDirectiveSchema = object({
+	endpoint: EndpointRefSchema,
+	payload: SessionDisconnectedPayloadSchema
+});
+/**
+* Live egress handles, keyed by `<deviceId>/<sessionId>`.
+*
+* The primitive's refcount has no lease TTL: a holder that vanishes without
+* releasing leaks a child until the broker restarts (D67). This handler is a
+* holder, so it keeps the one piece of state that lets it not be that holder —
+* the `pipelineKey` its `SessionDisconnected` has to release.
+*
+* A module-level map is right here because the directive handlers are free
+* functions called per directive; the entry is written on a successful acquire
+* and deleted on the release path, both of which are the same tick as the
+* directive that owns it.
+*/
+var EGRESS_HANDLES = /* @__PURE__ */ new Map();
+function egressHandleKey(deviceId, sessionId) {
+	return `${deviceId}/${sessionId}`;
+}
+var WEBRTC_PROFILE_NAMES = [
+	"high",
+	"mid",
+	"low"
+];
+function resolveWebrtcTarget(pref) {
+	if (pref === "auto") return void 0;
+	if (WEBRTC_PROFILE_NAMES.includes(pref)) return {
+		kind: "profile",
+		profile: pref
+	};
+	return {
+		kind: "cam-stream",
+		camStreamId: pref
+	};
+}
+async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = InitiateSessionWithOfferDirectiveSchema.safeParse({
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpoint = parsed.data.endpoint;
+	const payload = parsed.data.payload;
+	const parsedId = parseCameraEndpointId(endpoint.endpointId);
+	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `endpointId ${endpoint.endpointId} is not a camera`);
+	const deviceId = parsedId.deviceId;
+	const sessionId = payload.sessionId;
+	const log = deps.logger.withTags({
+		deviceId,
+		sessionId
+	});
+	const sdpOffer = payload.offer.value;
+	if (sdpOffer.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "offer.value is empty");
+	const api = deps.ctx.api;
+	const exposedEntry = deps.listExposed().find((e) => e.deviceId === deviceId);
+	const explicitSourceProfile = exposedEntry?.settings?.sourceProfile;
+	const mappedFromPreference = (() => {
+		const pref = exposedEntry?.settings?.streamPreference;
+		if (pref === "low" || pref === "mid" || pref === "high") return pref;
+	})();
+	const sourceProfile = explicitSourceProfile ?? mappedFromPreference ?? "high";
+	let derivedTarget;
+	/**
+	* The primitive's release handle, when this session acquired one. Recorded so
+	* `SessionDisconnected` can release it: a refcount whose holder disappears is
+	* the one gap D67 leaves open, and the least this handler can do is not BE
+	* that holder.
+	*/
+	let egressPipelineKey = null;
+	const picked = await api.cameraStreams.pickStream.query({
+		deviceId,
+		requirements: {
+			acceptCodecs: ["h264"],
+			minHeight: 480,
+			excludeDerived: true,
+			requireSiblingCodec: ["h265", "hevc"]
+		}
+	}).catch((err) => {
+		log.warn("alexa rtc-session: cameraStreams.pickStream threw — falling back to transcode", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	});
+	if (picked) {
+		log.info("alexa rtc-session: bypassing transcode via cameraStreams.pickStream", { meta: {
+			sourceProfile,
+			selectedCamStreamId: picked.camStreamId,
+			reason: picked.reason
+		} });
+		derivedTarget = {
+			kind: "cam-stream",
+			camStreamId: picked.camStreamId
+		};
+	} else try {
+		const acquired = await acquireAlexaEgress({
+			api,
+			deviceId,
+			sourceProfile,
+			sessionId,
+			logger: log
+		});
+		egressPipelineKey = acquired.pipelineKey;
+		EGRESS_HANDLES.set(egressHandleKey(deviceId, sessionId), acquired.pipelineKey);
+		derivedTarget = {
+			kind: "cam-stream",
+			camStreamId: acquired.camStreamId
+		};
+	} catch (err) {
+		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
+	}
+	try {
+		const result = await api.webrtcSession.handleOffer.mutate({
+			deviceId,
+			sdpOffer,
+			sessionId,
+			target: derivedTarget,
+			relayOnly: false,
+			nonTrickle: true,
+			disableTurn: true,
+			disableIpv6: true,
+			consumerAttribution: {
+				kind: "alexa",
+				sessionId
+			}
+		});
+		log.info("alexa rtc-session: AnswerGenerated", { meta: {
+			returnedSessionId: result.sessionId,
+			sdpAnswerLen: result.sdpAnswer.length
+		} });
+		return { event: {
+			header: {
+				namespace: "Alexa.RTCSessionController",
+				name: "AnswerGeneratedForSession",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: endpoint.endpointId },
+			payload: { answer: {
+				format: payload.offer.format ?? "SDP",
+				value: result.sdpAnswer
+			} }
+		} };
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		const mSectionSummary = (() => {
+			const lines = sdpOffer.split(/\r?\n/);
+			const sections = [];
+			let current = null;
+			for (const raw of lines) {
+				const line = raw.trim();
+				if (line.startsWith("m=")) {
+					if (current) sections.push(current);
+					current = {
+						mid: null,
+						kind: line.split(" ")[0]?.slice(2) ?? "unknown",
+						direction: null,
+						codecs: []
+					};
+				} else if (current) {
+					if (line.startsWith("a=mid:")) current.mid = line.slice(6);
+					else if (/^a=(sendonly|recvonly|sendrecv|inactive)$/.test(line)) current.direction = line.slice(2);
+					else if (line.startsWith("a=rtpmap:")) current.codecs.push(line.slice(9));
+				}
+			}
+			if (current) sections.push(current);
+			return sections;
+		})();
+		log.warn("alexa rtc-session: handleOffer failed", { meta: {
+			error: message,
+			offerLen: sdpOffer.length,
+			mSections: mSectionSummary,
+			offerSdp: sdpOffer
+		} });
+		if (egressPipelineKey !== null) {
+			EGRESS_HANDLES.delete(egressHandleKey(deviceId, sessionId));
+			await releaseAlexaEgress({
+				api,
+				deviceId,
+				pipelineKey: egressPipelineKey,
+				logger: log
+			});
+		}
+		return errorEnvelope(header, "INTERNAL_ERROR", `webrtc-session.handleOffer failed: ${message}`);
+	}
+}
+async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SessionDisconnectedDirectiveSchema.safeParse({
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpoint = parsed.data.endpoint;
+	const parsedId = parseCameraEndpointId(endpoint.endpointId);
+	if (parsedId.kind === "camera") {
+		const handleKey = egressHandleKey(parsedId.deviceId, parsed.data.payload.sessionId);
+		const pipelineKey = EGRESS_HANDLES.get(handleKey);
+		if (pipelineKey !== void 0) {
+			EGRESS_HANDLES.delete(handleKey);
+			await releaseAlexaEgress({
+				api: deps.ctx.api,
+				deviceId: parsedId.deviceId,
+				pipelineKey,
+				logger: deps.logger
+			});
+		}
+		try {
+			await deps.ctx.api.webrtcSession.closeSession.mutate({
+				deviceId: parsedId.deviceId,
+				sessionId: parsed.data.payload.sessionId
+			});
+		} catch (err) {
+			deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
+				tags: {
+					deviceId: parsedId.deviceId,
+					sessionId: parsed.data.payload.sessionId
+				},
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
+	const disconnectedDeviceId = parsedId.kind === "camera" ? parsedId.deviceId : void 0;
+	deps.logger.info("alexa rtc-session: SessionDisconnected", {
+		tags: {
+			sessionId: parsed.data.payload.sessionId,
+			...disconnectedDeviceId !== void 0 ? { deviceId: disconnectedDeviceId } : {}
+		},
+		meta: { endpointId: endpoint.endpointId }
+	});
+	return { event: {
+		header: {
+			namespace: "Alexa",
+			name: "Response",
+			messageId: header.messageId,
+			correlationToken: header.correlationToken,
+			payloadVersion: "3"
+		},
+		endpoint: { endpointId: endpoint.endpointId },
+		payload: {}
+	} };
+}
+//#endregion
+//#region src/handlers/security-panel.ts
+var ArmPayloadSchema = object({ armState: _enum([
+	"ARMED_STAY",
+	"ARMED_AWAY",
+	"ARMED_NIGHT"
+]) });
+var DisarmPayloadSchema = object({ authorization: object({
+	type: literal("FOUR_DIGIT_PIN"),
+	value: string().min(1)
+}).optional() });
+/** The subset of the panel status the directives read. */
+var PanelReadSchema = AlarmPanelStatusSchema.pick({
+	state: true,
+	availableModes: true,
+	requiresCode: true
+});
+/**
+* `Alexa.SecurityPanelController.ErrorResponse`.
+*
+* A namespace of its own, because the four types that matter here
+* (`AUTHORIZATION_REQUIRED`, `UNAUTHORIZED`, `NOT_READY_FOR_ARM`,
+* `BYPASS_NEEDED`) are only understood under it — the generic `Alexa`
+* `ErrorResponse` from `error-envelope.ts` carries none of them, and a PIN
+* problem reported there is a message the Alexa app cannot act on.
+*/
+function securityPanelError(header, type, message) {
+	return { event: {
+		header: {
+			namespace: "Alexa.SecurityPanelController",
+			name: "ErrorResponse",
+			messageId: header.messageId,
+			correlationToken: header.correlationToken,
+			payloadVersion: "3"
+		},
+		payload: {
+			type,
+			message
+		}
+	} };
+}
+/** Resolve the alarm panel this directive targets, or the refusal to send. */
+function resolveDeviceId(endpointRaw) {
+	const parsedEndpoint = EndpointRefSchema.safeParse(endpointRaw);
+	if (!parsedEndpoint.success) return { reason: "missing or malformed endpoint" };
+	const parsedId = parseCameraEndpointId(parsedEndpoint.data.endpointId);
+	if (parsedId.kind === "alarm-panel") return { deviceId: parsedId.deviceId };
+	return { reason: `SecurityPanelController is only exposed on alarm-panel endpoints — got '${parsedEndpoint.data.endpointId}'` };
+}
+/**
+* What the panel currently accepts, or `null` when it could not be read.
+*
+* `null` is the honest answer and the callers treat it as unknown; nothing
+* here substitutes a default that would read as "accepts nothing, needs no
+* PIN".
+*/
+async function readPanel(api, deviceId, logger, phase) {
+	const raw = await api.alarmPanel.getStatus.query({ deviceId }).catch((err) => {
+		logger.warn("alexa security-panel: alarmPanel.getStatus failed — proceeding without it", {
+			tags: { deviceId },
+			meta: {
+				phase,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	});
+	const parsed = PanelReadSchema.safeParse(raw);
+	if (!parsed.success) {
+		if (raw !== null) logger.warn("alexa security-panel: panel status did not match the cap schema", {
+			tags: { deviceId },
+			meta: { phase }
+		});
+		return null;
+	}
+	return parsed.data;
+}
+/** The `context.properties` block for a panel whose state we re-read. */
+function panelProperties(facts, fallback) {
+	const timeOfSample = (/* @__PURE__ */ new Date()).toISOString();
+	const parsedState = facts === null ? null : AlarmPanelStatusSchema.shape.state.parse(facts.state);
+	const armState = parsedState === null ? fallback : alexaArmStateFor(parsedState);
+	const burglary = parsedState === null ? { value: "OK" } : burglaryAlarmFor(parsedState);
+	return [{
+		namespace: "Alexa.SecurityPanelController",
+		name: "armState",
+		value: armState,
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	}, {
+		namespace: "Alexa.SecurityPanelController",
+		name: "burglaryAlarm",
+		value: burglary,
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	}];
+}
+async function handleArm(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const target = resolveDeviceId(endpointRaw);
+	if (!("deviceId" in target)) return errorEnvelope(header, "INVALID_DIRECTIVE", target.reason);
+	const { deviceId } = target;
+	const payload = ArmPayloadSchema.safeParse(payloadRaw);
+	if (!payload.success) {
+		deps.logger.warn("alexa security-panel: Arm payload is not an arm state Alexa defines", {
+			tags: { deviceId },
+			meta: { error: payload.error.message }
+		});
+		return errorEnvelope(header, "INVALID_DIRECTIVE", `Arm payload unexpected: ${payload.error.message}`);
+	}
+	const requested = payload.data.armState;
+	const api = deps.ctx.api;
+	const facts = await readPanel(api, deviceId, deps.logger, "arm");
+	if (facts?.requiresCode === true) {
+		deps.logger.warn("alexa security-panel: panel requires a PIN and the Arm directive carries none — REFUSED", {
+			tags: { deviceId },
+			meta: { requested }
+		});
+		return securityPanelError(header, "AUTHORIZATION_REQUIRED", "this panel requires a PIN to arm, and Alexa cannot supply one on an Arm directive");
+	}
+	const mode = alarmArmModeForAlexa(requested, facts?.availableModes ?? []);
+	if (mode === null) {
+		deps.logger.warn("alexa security-panel: panel accepts no mode for this arm state — REFUSED", {
+			tags: { deviceId },
+			meta: {
+				requested,
+				availableModes: facts?.availableModes ?? null
+			}
+		});
+		return securityPanelError(header, "NOT_READY_FOR_ARM", `panel does not accept ${requested}`);
+	}
+	try {
+		await api.alarmPanel.arm.mutate({
+			deviceId,
+			mode
+		});
+	} catch (err) {
+		deps.logger.warn("alexa security-panel: arm command failed", {
+			tags: { deviceId },
+			meta: {
+				requested,
+				mode,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return securityPanelError(header, "NOT_READY_FOR_ARM", err instanceof Error ? err.message : String(err));
+	}
+	deps.logger.info("alexa security-panel: armed", {
+		tags: { deviceId },
+		meta: {
+			requested,
+			mode
+		}
+	});
+	const after = await readPanel(api, deviceId, deps.logger, "arm-confirm");
+	if (after?.state === "arming") deps.logger.info("alexa security-panel: panel is in its exit delay — reporting DISARMED until it is set", {
+		tags: { deviceId },
+		meta: {
+			requested,
+			mode
+		}
+	});
+	return {
+		event: {
+			header: {
+				namespace: "Alexa.SecurityPanelController",
+				name: "Arm.Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: `${deviceId}__alarm` },
+			payload: {}
+		},
+		context: { properties: panelProperties(after, requested) }
+	};
+}
+async function handleDisarm(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const target = resolveDeviceId(endpointRaw);
+	if (!("deviceId" in target)) return errorEnvelope(header, "INVALID_DIRECTIVE", target.reason);
+	const { deviceId } = target;
+	const payload = DisarmPayloadSchema.safeParse(payloadRaw ?? {});
+	if (!payload.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `Disarm payload unexpected: ${payload.error.message}`);
+	const code = payload.data.authorization?.value;
+	const api = deps.ctx.api;
+	if ((await readPanel(api, deviceId, deps.logger, "disarm"))?.requiresCode === true && code === void 0) {
+		deps.logger.warn("alexa security-panel: panel requires a PIN and the Disarm directive carried none — REFUSED", { tags: { deviceId } });
+		return securityPanelError(header, "AUTHORIZATION_REQUIRED", "this panel requires a PIN to disarm");
+	}
+	try {
+		await api.alarmPanel.disarm.mutate(code === void 0 ? { deviceId } : {
+			deviceId,
+			code
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn("alexa security-panel: disarm command failed", {
+			tags: { deviceId },
+			meta: {
+				codeSupplied: code !== void 0,
+				error: message
+			}
+		});
+		return code === void 0 ? errorEnvelope(header, "INTERNAL_ERROR", message) : securityPanelError(header, "UNAUTHORIZED", message);
+	}
+	deps.logger.info("alexa security-panel: disarmed", {
+		tags: { deviceId },
+		meta: { codeSupplied: code !== void 0 }
+	});
+	const after = await readPanel(api, deviceId, deps.logger, "disarm-confirm");
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: `${deviceId}__alarm` },
+			payload: {}
+		},
+		context: { properties: panelProperties(after, "DISARMED") }
+	};
+}
+//#endregion
 //#region src/handlers/stubs.ts
 /**
 * Stub responder for namespaces not yet implemented (CameraStream /
@@ -41143,7 +41673,9 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 		"Alexa.ModeController/SetMode": "create",
 		"Alexa.ToggleController/TurnOn": "create",
 		"Alexa.ToggleController/TurnOff": "create",
-		"Alexa/ReportState": "view"
+		"Alexa/ReportState": "view",
+		"Alexa.SecurityPanelController/Arm": "create",
+		"Alexa.SecurityPanelController/Disarm": "create"
 	};
 	try {
 		const key = `${header.namespace}/${header.name}`;
@@ -41188,6 +41720,14 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 			status: 200,
 			body: await handlePtzDirection(header, endpoint, deps.ptzDirection, callerIdentity)
 		};
+		if (key === "Alexa.SecurityPanelController/Arm") return {
+			status: 200,
+			body: await handleArm(header, endpoint, payload, deps.securityPanel, callerIdentity)
+		};
+		if (key === "Alexa.SecurityPanelController/Disarm") return {
+			status: 200,
+			body: await handleDisarm(header, endpoint, payload, deps.securityPanel, callerIdentity)
+		};
 		if (key === "Alexa/ReportState") return {
 			status: 200,
 			body: await handleReportState(header, endpoint, deps.reportState, callerIdentity)
@@ -42744,7 +43284,13 @@ var DEFAULT_CONFIG = {
 	enforceIngressToken: false,
 	staleEndpointPurgeInput: ""
 };
-var SUPPORTED_KINDS = ["camera", "doorbell"];
+/** UI filter for the Export picker. `alarm-panel` publishes an
+*  `Alexa.SecurityPanelController` endpoint (`endpoints/builder.ts`). */
+var SUPPORTED_KINDS = [
+	"camera",
+	"doorbell",
+	DeviceType.AlarmPanel
+];
 var ExportAlexaAddon = class extends BaseAddon {
 	lwaGateway = null;
 	syncEngine = null;
@@ -42813,6 +43359,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 				reportState: {
 					ctx: this.ctx,
 					logger: this.ctx.logger
+				},
+				securityPanel: {
+					ctx: this.ctx,
+					logger: this.ctx.logger
 				}
 			},
 			lwaTokensCallbackDeps: {