@camstack/addon-export-alexa 1.2.107 → 1.2.108

package/dist/export-alexa.addon.mjs

@@ -7488,7 +7488,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -7564,31 +7580,10 @@ var BASE_LIVE_EGRESS_PROFILE = {
 var ALEXA_EGRESS_PROFILE = {
 	...BASE_LIVE_EGRESS_PROFILE,
 	audio: { codec: "opus" },
-	/**
-	* ONE slice per access unit.
-	*
-	* `-tune zerolatency` turns on x264's sliced threads, and every access unit
-	* came out of this encode as FIVE slices — measured on the hub 2026-09-13 on
-	* the exact argv this path spawns, and reduced to one by this single flag.
-	*
-	* Five slices share one RTP timestamp and carry one marker bit, so a
-	* libwebrtc depacketiser sees five frame-starts and one frame-end per frame.
-	* The Echo renders the first pictures and then freezes for good, while the
-	* audio — a separate plane — plays on. It is the only structural property
-	* that survived the elimination: the same freeze reproduced at 2304×1296
-	* HEVC with 217 KB keyframes AND at 640×360 H.264 with 67 KB keyframes and a
-	* fifth of the bitrate, so source, resolution, bitrate, keyframe burst,
-	* hardware decode, parameter sets, drift and bitstream conformance are all
-	* out — each ruled out by a measurement, not by elimination.
-	*
-	* The tune STAYS: it also drops the lookahead and the B-frames, which a live
-	* path wants. Only the slicing is unwanted, and this is the flag that says so.
-	*
-	* Scoped to Alexa deliberately. HomeKit and the browser transcode inherit
-	* {@link BASE_LIVE_EGRESS_PROFILE}; whether they want the same shape is a
-	* question for their own evidence, and the browser has not been measured.
-	*/
-	outputArgs: ["-x264-params", "sliced-threads=0"]
+	video: {
+		...BASE_LIVE_EGRESS_PROFILE.video,
+		singleSlicePerFrame: true
+	}
 };
 /**
 * Deep wiring healthcheck — snapshot of active reachability probes across
@@ -16476,7 +16471,7 @@ var AlarmArmModeSchema = _enum([
 	"vacation",
 	"custom_bypass"
 ]);
-object({
+var AlarmPanelStatusSchema = object({
 	/** Current lifecycle state. */
 	state: AlarmStateSchema,
 	/** Subset of arm modes the panel accepts. UI renders one button per
@@ -39764,66 +39759,65 @@ async function releaseAlexaEgress(input) {
 	}
 }
 //#endregion
-//#region src/handlers/types.ts
+//#region src/handlers/security-panel-arm-state.ts
 /**
-* Zod schemas for the subset of the Alexa Smart Home directive surface
-* that we actually parse hub-side. The Smart Home Skill API ships
-* thousands of optional fields per namespace — we only validate what
-* we read; everything else passes through as `unknown`.
+* The panel modes behind each Alexa arm state, PRIMARY first — the mirror of
+* `MODES_BY_TARGET` in the HomeKit exporter, and for the same reason: one
+* Alexa state stands for two panel modes, so a panel offering only the
+* secondary would otherwise be sent a mode it refuses.
+*/
+var MODES_BY_ARM_STATE = {
+	ARMED_STAY: ["home", "custom_bypass"],
+	ARMED_AWAY: ["away", "vacation"],
+	ARMED_NIGHT: ["night"]
+};
+var ARM_STATES = [
+	"ARMED_STAY",
+	"ARMED_AWAY",
+	"ARMED_NIGHT"
+];
+/** The panel's state as Alexa's `armState` property. */
+function alexaArmStateFor(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return "ARMED_STAY";
+		case "armed_night": return "ARMED_NIGHT";
+		case "armed_away":
+		case "armed_vacation":
+		case "pending":
+		case "triggered": return "ARMED_AWAY";
+		default: return "DISARMED";
+	}
+}
+/** `burglaryAlarm`, the only alarm property this cap can honestly fill. */
+function burglaryAlarmFor(state) {
+	return { value: state === "triggered" ? "ALARM" : "OK" };
+}
+/**
+* The `supportedArmStates` for discovery.
 *
-* Reference: https://developer.amazon.com/en-US/docs/alexa/smarthome/smart-home-skill-api-message-reference.html
+* `DISARMED` is always present: disarming is not one of the panel's arm modes.
+* An EMPTY `availableModes` is unknown, not "none" — a provider that never
+* populated the list looks identical to one that accepts nothing, and
+* publishing a panel that can only be disarmed on that guess takes the
+* controls off a working alarm. The caller logs it.
 */
-/** A directive header carries namespace + name + token + correlation id. */
-var DirectiveHeaderSchema = object({
-	namespace: string(),
-	name: string(),
-	payloadVersion: string(),
-	messageId: string(),
-	correlationToken: string().optional()
-});
-/** Scope carries the bearer token Alexa minted via our OAuth provider. */
-var BearerScopeSchema = object({
-	type: literal("BearerToken"),
-	token: string()
-});
-/** Endpoint reference inside a directive payload. */
-var EndpointRefSchema = object({
-	endpointId: string(),
-	scope: BearerScopeSchema.optional(),
-	cookie: record(string(), string()).optional()
-});
-var DiscoveryDirectiveSchema = object({
-	header: DirectiveHeaderSchema.extend({
-		namespace: literal("Alexa.Discovery"),
-		name: literal("Discover")
-	}),
-	payload: object({ scope: BearerScopeSchema })
-});
-/** Envelope wrapping a directive on the Alexa→skill wire. */
-var DirectiveRequestSchema = object({ directive: object({
-	header: DirectiveHeaderSchema,
-	endpoint: EndpointRefSchema.optional(),
-	payload: unknown().optional()
-}) });
-var InitializeCameraStreamsPayloadSchema = object({ cameraStreams: array(object({
-	protocol: string(),
-	resolution: object({
-		width: number(),
-		height: number()
-	}).optional(),
-	authorizationType: string().optional(),
-	videoCodec: string().optional(),
-	audioCodec: string().optional()
-})).optional() });
-var InitiateSessionWithOfferPayloadSchema = object({
-	sessionId: string(),
-	offer: object({
-		format: string().optional(),
-		value: string()
-	})
-});
-var SessionDisconnectedPayloadSchema = object({ sessionId: string() });
-var SetModePayloadSchema = object({ mode: string() });
+function supportedArmStatesFor(availableModes) {
+	return [...availableModes.length === 0 ? ARM_STATES : ARM_STATES.filter((armState) => MODES_BY_ARM_STATE[armState].some((mode) => availableModes.includes(mode))), "DISARMED"];
+}
+/**
+* The arm mode to send for an Alexa arm state, or `null` when there is none.
+*
+* `null` is not a shrug: `DISARMED` is the Disarm DIRECTIVE, a different call,
+* and an arm state the panel accepts no mode for is a directive the handler
+* refuses with `NOT_READY_FOR_ARM` rather than translating into a guess.
+*/
+function alarmArmModeForAlexa(armState, availableModes) {
+	if (armState === "DISARMED") return null;
+	const candidates = MODES_BY_ARM_STATE[armState];
+	if (availableModes.length === 0) return candidates[0] ?? null;
+	return candidates.find((mode) => availableModes.includes(mode)) ?? null;
+}
 //#endregion
 //#region src/endpoints/builder.ts
 var DEFAULT_RESOLUTIONS = [{
@@ -40147,6 +40141,53 @@ function buildPrivacyEndpoint(input) {
 		}
 	};
 }
+/**
+* An `alarm-panel` device as an `Alexa.SecurityPanelController` endpoint.
+*
+* It is its OWN endpoint, not a child of a camera: a panel is a standalone
+* device and has no stream, no doorbell and no PTZ. The `__alarm` suffix on
+* the endpoint id is a routing tag (see `handlers/endpoint-id.ts`).
+*
+* ## What is declared, and what is deliberately not
+*
+*  - `armState` and `burglaryAlarm` are the two properties this cap can fill
+*    honestly. `fireAlarm` / `carbonMonoxideAlarm` / `waterAlarm` are NOT
+*    declared: `alarm-panel` has no field saying WHICH alarm is sounding, and
+*    declaring a property we would always answer `OK` on is a claim with no
+*    basis behind it. The reasoning is in `security-panel-arm-state.ts`.
+*  - `proactivelyReported: false`. This addon's Event Gateway pushes
+*    ChangeReports for camera motion only; a panel state change is not wired
+*    to it, and promising a report nothing sends is how an endpoint ends up
+*    looking broken. `retrievable: true` — `Alexa/ReportState` answers.
+*  - `supportedAuthorizationTypes` appears only for a panel that requires a
+*    code. Alexa's Disarm directive can carry a PIN; its **Arm directive
+*    cannot**, which is why a PIN-gated arm is refused by the handler with
+*    `AUTHORIZATION_REQUIRED` rather than attempted.
+*/
+function buildAlarmPanelEndpoint(input) {
+	const configuration = { supportedArmStates: supportedArmStatesFor(input.availableModes).map((value) => ({ value })) };
+	if (input.requiresCode) configuration.supportedAuthorizationTypes = [{ type: "FOUR_DIGIT_PIN" }];
+	const securityPanelController = {
+		type: "AlexaInterface",
+		interface: "Alexa.SecurityPanelController",
+		version: "3",
+		properties: {
+			supported: [{ name: "armState" }, { name: "burglaryAlarm" }],
+			proactivelyReported: false,
+			retrievable: true
+		},
+		configuration
+	};
+	return {
+		endpointId: `${input.deviceId}__alarm`,
+		manufacturerName: "camstack",
+		description: "CamStack alarm panel",
+		friendlyName: input.friendlyName.trim().length > 0 ? input.friendlyName.trim() : `Alarm ${input.deviceId}`,
+		displayCategories: ["SECURITY_PANEL"],
+		capabilities: [ALEXA_BASE_CAPABILITY, securityPanelController],
+		cookie: { stableId: input.stableId }
+	};
+}
 //#endregion
 //#region src/handlers/error-envelope.ts
 /**
@@ -40182,20 +40223,68 @@ function errorEnvelope(header, type, message) {
 	} };
 }
 //#endregion
-//#region src/handlers/discovery.ts
+//#region src/handlers/types.ts
 /**
-* `Alexa.Discovery/Discover` handler — fires when the Alexa app pulls
-* the user's device list. We respond with the operator-curated
-* `exposed-devices.json` list, resolved against the live device
-* registry (so we don't return zombie endpoints for deleted devices).
+* Zod schemas for the subset of the Alexa Smart Home directive surface
+* that we actually parse hub-side. The Smart Home Skill API ships
+* thousands of optional fields per namespace — we only validate what
+* we read; everything else passes through as `unknown`.
 *
-* Feature detection is PASSIVE: per exposed device we inspect the
-* `DeviceInfo.features` + bound caps (from `device-manager.getBindings`)
-* and emit only the Alexa capabilities backed by something on our side.
-* Child accessories (siren/floodlight/PIR/…) become SEPARATE endpoints
-* with `endpointId = ${parent}__${child}` so directive handlers can
-* route to the right cap on the right device.
+* Reference: https://developer.amazon.com/en-US/docs/alexa/smarthome/smart-home-skill-api-message-reference.html
 */
+/** A directive header carries namespace + name + token + correlation id. */
+var DirectiveHeaderSchema = object({
+	namespace: string(),
+	name: string(),
+	payloadVersion: string(),
+	messageId: string(),
+	correlationToken: string().optional()
+});
+/** Scope carries the bearer token Alexa minted via our OAuth provider. */
+var BearerScopeSchema = object({
+	type: literal("BearerToken"),
+	token: string()
+});
+/** Endpoint reference inside a directive payload. */
+var EndpointRefSchema = object({
+	endpointId: string(),
+	scope: BearerScopeSchema.optional(),
+	cookie: record(string(), string()).optional()
+});
+var DiscoveryDirectiveSchema = object({
+	header: DirectiveHeaderSchema.extend({
+		namespace: literal("Alexa.Discovery"),
+		name: literal("Discover")
+	}),
+	payload: object({ scope: BearerScopeSchema })
+});
+/** Envelope wrapping a directive on the Alexa→skill wire. */
+var DirectiveRequestSchema = object({ directive: object({
+	header: DirectiveHeaderSchema,
+	endpoint: EndpointRefSchema.optional(),
+	payload: unknown().optional()
+}) });
+var InitializeCameraStreamsPayloadSchema = object({ cameraStreams: array(object({
+	protocol: string(),
+	resolution: object({
+		width: number(),
+		height: number()
+	}).optional(),
+	authorizationType: string().optional(),
+	videoCodec: string().optional(),
+	audioCodec: string().optional()
+})).optional() });
+var InitiateSessionWithOfferPayloadSchema = object({
+	sessionId: string(),
+	offer: object({
+		format: string().optional(),
+		value: string()
+	})
+});
+var SessionDisconnectedPayloadSchema = object({ sessionId: string() });
+var SetModePayloadSchema = object({ mode: string() });
+//#endregion
+//#region src/handlers/discovery.ts
 var discoveryPayloadSchema = DiscoveryDirectiveSchema.shape.payload;
 /** Devices built at once in `handleDiscovery` — latency-bound tRPC reads, so
 *  six lanes hide the round-trips without stampeding a booting hub. */
@@ -40209,6 +40298,7 @@ var CAP_SWITCH = "switch";
 var CAP_BRIGHTNESS = "brightness";
 var CAP_BATTERY = "battery";
 var CAP_PRIVACY_MASK = "privacy-mask";
+var CAP_ALARM_PANEL = "alarm-panel";
 async function handleDiscovery(header, payloadRaw, deps, callerIdentity) {
 	if (!discoveryPayloadSchema.safeParse(payloadRaw).success) return errorEnvelope(header, "INVALID_DIRECTIVE", "Discovery payload shape unexpected");
 	const exposed = await deps.listExposed();
@@ -40248,6 +40338,7 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 		return [];
 	}
 	const parentInfo = await loadBoundDeviceInfo(device, api);
+	if (parentInfo.capNames.includes(CAP_ALARM_PANEL)) return [await buildAlarmPanelEndpointFor(parentInfo, api, deps)];
 	const children = await api.deviceManager.getChildren.query({ parentDeviceId: deviceId }).catch((err) => {
 		deps.logger.warn("alexa discovery: getChildren failed", {
 			tags: { deviceId },
@@ -40327,6 +40418,47 @@ async function buildEndpointsForExposedDevice(deviceId, deps) {
 	}
 	return out;
 }
+/**
+* The panel endpoint, with what the panel says it accepts.
+*
+* A `getStatus` that fails leaves `availableModes` empty and `requiresCode`
+* false, and those are the UNKNOWN readings, not assertions: an empty mode
+* list makes discovery declare all three arm states (`supportedArmStatesFor`)
+* rather than publishing a panel that can only be disarmed, and the directive
+* handler re-reads the panel before it commands anything, so a PIN discovered
+* later is still honoured. The blind read is logged against the device id.
+*/
+async function buildAlarmPanelEndpointFor(info, api, deps) {
+	const status = await api.alarmPanel.getStatus.query({ deviceId: info.id }).catch((err) => {
+		deps.logger.warn("alexa discovery: alarmPanel.getStatus failed — declaring every arm state", {
+			tags: { deviceId: info.id },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return null;
+	});
+	const parsed = AlarmPanelStatusSchema.pick({
+		availableModes: true,
+		requiresCode: true
+	}).safeParse(status);
+	if (!parsed.success && status !== null) deps.logger.warn("alexa discovery: panel status did not match the cap schema", { tags: { deviceId: info.id } });
+	const availableModes = parsed.success ? parsed.data.availableModes : [];
+	const requiresCode = parsed.success ? parsed.data.requiresCode : false;
+	deps.logger.info("alexa discovery: built alarm panel endpoint", {
+		tags: { deviceId: info.id },
+		meta: {
+			name: info.name,
+			availableModes: [...availableModes],
+			requiresCode
+		}
+	});
+	return buildAlarmPanelEndpoint({
+		deviceId: info.id,
+		stableId: info.stableId,
+		friendlyName: info.name,
+		availableModes,
+		requiresCode
+	});
+}
 async function loadBoundDeviceInfo(device, api) {
 	const capNames = (await api.deviceManager.getBindings.query({ deviceId: device.id })).entries.map((e) => e.capName);
 	return {
@@ -40392,10 +40524,14 @@ function parseCameraEndpointId(raw) {
 		kind: "privacy",
 		parentDeviceId: parent
 	};
+	if (tail === "alarm") return {
+		kind: "alarm-panel",
+		deviceId: parent
+	};
 	const child = parseNonNegativeInt(tail);
 	if (child === null) return {
 		kind: "invalid",
-		reason: `child segment not numeric and not 'autotrack'/'privacy': ${raw}`
+		reason: `child segment not numeric and not 'autotrack'/'privacy'/'alarm': ${raw}`
 	};
 	return {
 		kind: "child",
@@ -40410,6 +40546,68 @@ function parseNonNegativeInt(s) {
 	return n;
 }
 //#endregion
+//#region src/handlers/brightness-controller.ts
+var SetBrightnessDirectiveSchema = object({
+	header: object({
+		namespace: literal("Alexa.BrightnessController"),
+		name: literal("SetBrightness")
+	}),
+	endpoint: EndpointRefSchema,
+	payload: object({ brightness: number().min(0).max(100) })
+});
+async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SetBrightnessDirectiveSchema.safeParse({
+		header: {
+			namespace: header.namespace,
+			name: header.name
+		},
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpointId = parsed.data.endpoint.endpointId;
+	const parsedId = parseCameraEndpointId(endpointId);
+	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy" || parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
+	if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "BrightnessController is not exposed on camera endpoints — direct the directive at the dimmable child accessory");
+	if (parsedId.kind === "invalid") return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
+	const percentage = parsed.data.payload.brightness;
+	const api = deps.ctx.api;
+	try {
+		await api.brightness.setBrightness.mutate({
+			deviceId: parsedId.childDeviceId,
+			percentage
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn("alexa brightness-controller: setBrightness failed", { meta: {
+			deviceId: parsedId.childDeviceId,
+			percentage,
+			error: message
+		} });
+		return errorEnvelope(header, "INTERNAL_ERROR", `brightness.setBrightness failed: ${message}`);
+	}
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId },
+			payload: {}
+		},
+		context: { properties: [{
+			namespace: "Alexa.BrightnessController",
+			name: "brightness",
+			value: percentage,
+			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
+			uncertaintyInMilliseconds: 500
+		}] }
+	};
+}
+//#endregion
 //#region src/handlers/camera-stream.ts
 /**
 * `Alexa.CameraStreamController/InitializeCameraStreams` handler.
@@ -40492,347 +40690,42 @@ async function handleInitializeCameraStreams(header, endpointRaw, payloadRaw, de
 	} };
 }
 //#endregion
-//#region src/handlers/rtc-session.ts
-var InitiateSessionWithOfferDirectiveSchema = object({
-	endpoint: EndpointRefSchema,
-	payload: InitiateSessionWithOfferPayloadSchema
-});
-var SessionDisconnectedDirectiveSchema = object({
-	endpoint: EndpointRefSchema,
-	payload: SessionDisconnectedPayloadSchema
-});
-/**
-* Live egress handles, keyed by `<deviceId>/<sessionId>`.
-*
-* The primitive's refcount has no lease TTL: a holder that vanishes without
-* releasing leaks a child until the broker restarts (D67). This handler is a
-* holder, so it keeps the one piece of state that lets it not be that holder —
-* the `pipelineKey` its `SessionDisconnected` has to release.
-*
-* A module-level map is right here because the directive handlers are free
-* functions called per directive; the entry is written on a successful acquire
-* and deleted on the release path, both of which are the same tick as the
-* directive that owns it.
-*/
-var EGRESS_HANDLES = /* @__PURE__ */ new Map();
-function egressHandleKey(deviceId, sessionId) {
-	return `${deviceId}/${sessionId}`;
-}
-var WEBRTC_PROFILE_NAMES = [
-	"high",
-	"mid",
-	"low"
-];
-function resolveWebrtcTarget(pref) {
-	if (pref === "auto") return void 0;
-	if (WEBRTC_PROFILE_NAMES.includes(pref)) return {
-		kind: "profile",
-		profile: pref
-	};
-	return {
-		kind: "cam-stream",
-		camStreamId: pref
-	};
-}
-async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = InitiateSessionWithOfferDirectiveSchema.safeParse({
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpoint = parsed.data.endpoint;
-	const payload = parsed.data.payload;
-	const parsedId = parseCameraEndpointId(endpoint.endpointId);
-	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `endpointId ${endpoint.endpointId} is not a camera`);
-	const deviceId = parsedId.deviceId;
-	const sessionId = payload.sessionId;
-	const log = deps.logger.withTags({
-		deviceId,
-		sessionId
-	});
-	const sdpOffer = payload.offer.value;
-	if (sdpOffer.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "offer.value is empty");
-	const api = deps.ctx.api;
-	const exposedEntry = deps.listExposed().find((e) => e.deviceId === deviceId);
-	const explicitSourceProfile = exposedEntry?.settings?.sourceProfile;
-	const mappedFromPreference = (() => {
-		const pref = exposedEntry?.settings?.streamPreference;
-		if (pref === "low" || pref === "mid" || pref === "high") return pref;
-	})();
-	const sourceProfile = explicitSourceProfile ?? mappedFromPreference ?? "high";
-	let derivedTarget;
-	/**
-	* The primitive's release handle, when this session acquired one. Recorded so
-	* `SessionDisconnected` can release it: a refcount whose holder disappears is
-	* the one gap D67 leaves open, and the least this handler can do is not BE
-	* that holder.
-	*/
-	let egressPipelineKey = null;
-	const picked = await api.cameraStreams.pickStream.query({
-		deviceId,
-		requirements: {
-			acceptCodecs: ["h264"],
-			minHeight: 480,
-			excludeDerived: true,
-			requireSiblingCodec: ["h265", "hevc"]
-		}
-	}).catch((err) => {
-		log.warn("alexa rtc-session: cameraStreams.pickStream threw — falling back to transcode", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		return null;
-	});
-	if (picked) {
-		log.info("alexa rtc-session: bypassing transcode via cameraStreams.pickStream", { meta: {
-			sourceProfile,
-			selectedCamStreamId: picked.camStreamId,
-			reason: picked.reason
-		} });
-		derivedTarget = {
-			kind: "cam-stream",
-			camStreamId: picked.camStreamId
-		};
-	} else try {
-		const acquired = await acquireAlexaEgress({
-			api,
-			deviceId,
-			sourceProfile,
-			sessionId,
-			logger: log
-		});
-		egressPipelineKey = acquired.pipelineKey;
-		EGRESS_HANDLES.set(egressHandleKey(deviceId, sessionId), acquired.pipelineKey);
-		derivedTarget = {
-			kind: "cam-stream",
-			camStreamId: acquired.camStreamId
-		};
-	} catch (err) {
-		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
-	}
-	try {
-		const result = await api.webrtcSession.handleOffer.mutate({
-			deviceId,
-			sdpOffer,
-			sessionId,
-			target: derivedTarget,
-			relayOnly: false,
-			nonTrickle: true,
-			disableTurn: true,
-			disableIpv6: true,
-			consumerAttribution: {
-				kind: "alexa",
-				sessionId
-			}
-		});
-		log.info("alexa rtc-session: AnswerGenerated", { meta: {
-			returnedSessionId: result.sessionId,
-			sdpAnswerLen: result.sdpAnswer.length
-		} });
-		return { event: {
-			header: {
-				namespace: "Alexa.RTCSessionController",
-				name: "AnswerGeneratedForSession",
-				messageId: header.messageId,
-				correlationToken: header.correlationToken,
-				payloadVersion: "3"
-			},
-			endpoint: { endpointId: endpoint.endpointId },
-			payload: { answer: {
-				format: payload.offer.format ?? "SDP",
-				value: result.sdpAnswer
-			} }
-		} };
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		const mSectionSummary = (() => {
-			const lines = sdpOffer.split(/\r?\n/);
-			const sections = [];
-			let current = null;
-			for (const raw of lines) {
-				const line = raw.trim();
-				if (line.startsWith("m=")) {
-					if (current) sections.push(current);
-					current = {
-						mid: null,
-						kind: line.split(" ")[0]?.slice(2) ?? "unknown",
-						direction: null,
-						codecs: []
-					};
-				} else if (current) {
-					if (line.startsWith("a=mid:")) current.mid = line.slice(6);
-					else if (/^a=(sendonly|recvonly|sendrecv|inactive)$/.test(line)) current.direction = line.slice(2);
-					else if (line.startsWith("a=rtpmap:")) current.codecs.push(line.slice(9));
-				}
-			}
-			if (current) sections.push(current);
-			return sections;
-		})();
-		log.warn("alexa rtc-session: handleOffer failed", { meta: {
-			error: message,
-			offerLen: sdpOffer.length,
-			mSections: mSectionSummary,
-			offerSdp: sdpOffer
-		} });
-		if (egressPipelineKey !== null) {
-			EGRESS_HANDLES.delete(egressHandleKey(deviceId, sessionId));
-			await releaseAlexaEgress({
-				api,
-				deviceId,
-				pipelineKey: egressPipelineKey,
-				logger: log
-			});
-		}
-		return errorEnvelope(header, "INTERNAL_ERROR", `webrtc-session.handleOffer failed: ${message}`);
-	}
-}
-async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SessionDisconnectedDirectiveSchema.safeParse({
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpoint = parsed.data.endpoint;
-	const parsedId = parseCameraEndpointId(endpoint.endpointId);
-	if (parsedId.kind === "camera") {
-		const handleKey = egressHandleKey(parsedId.deviceId, parsed.data.payload.sessionId);
-		const pipelineKey = EGRESS_HANDLES.get(handleKey);
-		if (pipelineKey !== void 0) {
-			EGRESS_HANDLES.delete(handleKey);
-			await releaseAlexaEgress({
-				api: deps.ctx.api,
-				deviceId: parsedId.deviceId,
-				pipelineKey,
-				logger: deps.logger
-			});
-		}
-		try {
-			await deps.ctx.api.webrtcSession.closeSession.mutate({
-				deviceId: parsedId.deviceId,
-				sessionId: parsed.data.payload.sessionId
-			});
-		} catch (err) {
-			deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
-				tags: {
-					deviceId: parsedId.deviceId,
-					sessionId: parsed.data.payload.sessionId
-				},
-				meta: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-	}
-	const disconnectedDeviceId = parsedId.kind === "camera" ? parsedId.deviceId : void 0;
-	deps.logger.info("alexa rtc-session: SessionDisconnected", {
-		tags: {
-			sessionId: parsed.data.payload.sessionId,
-			...disconnectedDeviceId !== void 0 ? { deviceId: disconnectedDeviceId } : {}
-		},
-		meta: { endpointId: endpoint.endpointId }
-	});
-	return { event: {
-		header: {
-			namespace: "Alexa",
-			name: "Response",
-			messageId: header.messageId,
-			correlationToken: header.correlationToken,
-			payloadVersion: "3"
-		},
-		endpoint: { endpointId: endpoint.endpointId },
-		payload: {}
-	} };
-}
-//#endregion
-//#region src/handlers/ptz-preset.ts
-/**
-* `Alexa.ModeController/SetMode` handler — dispatches three PTZ instances:
-*
-*   `ptz.preset` — preset-recall. Decodes the preset name from the mode
-*     value and calls `ptz.goToPreset({deviceId, presetId})`.
-*
-*   `ptz.pan`  — momentary pan. `ptz.pan.left|right|center` issues a
-*     continuousMove pulse stopped on a timer; the dropdown reverts to
-*     `center` server-side so subsequent picks re-trigger the move.
-*
-*   `ptz.tilt` — momentary tilt. Mirrors ptz.pan with up|down|center.
-*/
-var SetModeDirectiveSchema = object({
+//#region src/handlers/power-controller.ts
+var PowerDirectiveSchema = object({
 	header: object({
-		namespace: literal("Alexa.ModeController"),
-		name: literal("SetMode"),
-		instance: string().optional()
+		namespace: literal("Alexa.PowerController"),
+		name: _enum(["TurnOn", "TurnOff"])
 	}),
-	endpoint: EndpointRefSchema,
-	payload: SetModePayloadSchema
+	endpoint: EndpointRefSchema
 });
-var PTZ_PRESET_MODE_PREFIX = "ptz.preset.";
-var PTZ_DIRECTION_PULSE_MS = 1e3;
-var PTZ_PAN_MOVES = {
-	"ptz.pan.left": { pan: -1 },
-	"ptz.pan.right": { pan: 1 },
-	"ptz.pan.center": {}
-};
-var PTZ_TILT_MOVES = {
-	"ptz.tilt.up": { tilt: 1 },
-	"ptz.tilt.down": { tilt: -1 },
-	"ptz.tilt.center": {}
-};
-async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SetModeDirectiveSchema.safeParse({
+async function handlePower(header, endpointRaw, deps, _callerIdentity) {
+	const parsed = PowerDirectiveSchema.safeParse({
 		header: {
 			namespace: header.namespace,
-			name: header.name,
-			instance: header.instance
+			name: header.name
 		},
-		endpoint: endpointRaw,
-		payload: payloadRaw ?? {}
+		endpoint: endpointRaw
 	});
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const instance = parsed.data.header.instance;
-	if (instance !== "ptz.preset" && instance !== "ptz.pan" && instance !== "ptz.tilt") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController instance not supported: ${instance ?? "(missing)"}`);
 	const endpointId = parsed.data.endpoint.endpointId;
 	const parsedId = parseCameraEndpointId(endpointId);
-	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController only supported on camera endpoints — got ${endpointId}`);
-	const mode = parsed.data.payload.mode;
+	const on = parsed.data.header.name === "TurnOn";
 	const api = deps.ctx.api;
-	if (instance === "ptz.pan" || instance === "ptz.tilt") {
-		const move = (instance === "ptz.pan" ? PTZ_PAN_MOVES : PTZ_TILT_MOVES)[mode];
-		if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a valid ${instance} mode`);
-		if (Object.keys(move).length === 0) await api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-			deps.logger.debug("alexa ptz-mode: stop (center) failed (non-fatal)", { meta: {
-				deviceId: parsedId.deviceId,
-				instance,
-				error: err instanceof Error ? err.message : String(err)
-			} });
-		});
-		else try {
-			await api.ptz.continuousMove.mutate({
-				deviceId: parsedId.deviceId,
-				...move
-			});
-			setTimeout(() => {
-				api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
-					deps.logger.debug("alexa ptz-mode: stop after pulse failed (non-fatal)", { meta: {
-						deviceId: parsedId.deviceId,
-						instance,
-						error: err instanceof Error ? err.message : String(err)
-					} });
-				});
-			}, PTZ_DIRECTION_PULSE_MS);
-		} catch (err) {
-			return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
-		}
-		return modeSuccessResponse(header, endpointId, instance, instance === "ptz.pan" ? "ptz.pan.center" : "ptz.tilt.center");
-	}
-	if (!mode.startsWith(PTZ_PRESET_MODE_PREFIX)) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a ptz.preset mode`);
-	const presetName = mode.slice(11);
-	if (presetName.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "preset name missing after prefix");
-	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName);
-	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' not found on device ${parsedId.deviceId}`);
-	await api.ptz.goToPreset.mutate({
-		deviceId: parsedId.deviceId,
-		presetId: preset.id
+	if (parsedId.kind === "autotrack") await api.ptzAutotrack.setEnabled.mutate({
+		deviceId: parsedId.parentDeviceId,
+		enabled: on
 	});
-	return modeSuccessResponse(header, endpointId, "ptz.preset", mode);
-}
-function modeSuccessResponse(header, endpointId, instance, mode) {
+	else if (parsedId.kind === "privacy") await api.privacyMask.setMask.mutate({
+		deviceId: parsedId.parentDeviceId,
+		patch: { enabled: on }
+	});
+	else if (parsedId.kind === "child") await api.switch.setState.mutate({
+		deviceId: parsedId.childDeviceId,
+		on
+	});
+	else if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on camera endpoints — direct the directive at the child accessory");
+	else if (parsedId.kind === "alarm-panel") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on alarm-panel endpoints — use Alexa.SecurityPanelController");
+	else return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
 	return {
 		event: {
 			header: {
@@ -40846,10 +40739,9 @@ function modeSuccessResponse(header, endpointId, instance, mode) {
 			payload: {}
 		},
 		context: { properties: [{
-			namespace: "Alexa.ModeController",
-			instance,
-			name: "mode",
-			value: mode,
+			namespace: "Alexa.PowerController",
+			name: "powerState",
+			value: on ? "ON" : "OFF",
 			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
 			uncertaintyInMilliseconds: 500
 		}] }
@@ -40949,133 +40841,99 @@ function successResponse(header, endpointId, toggleState, instance) {
 	};
 }
 //#endregion
-//#region src/handlers/power-controller.ts
-/**
-* `Alexa.PowerController/{TurnOn,TurnOff}` handler.
-*
-* Routing decodes the endpoint id:
-*   - `${parent}__${child}` → call `switch.setState({deviceId: child, on})`
-*   - `${parent}__autotrack` → call `ptzAutotrack.setEnabled({deviceId: parent, enabled})`
-*   - `${parent}__privacy` → call `privacyMask.setMask({deviceId: parent, patch: { enabled } })`
-*   - `${deviceId}` (bare parent camera) → reject with INVALID_DIRECTIVE
-*     (we never expose PowerController on the camera itself).
-*
-* Auth: verify the directive's scope token (same as every other
-* controller).
-*/
-var PowerDirectiveSchema = object({
-	header: object({
-		namespace: literal("Alexa.PowerController"),
-		name: _enum(["TurnOn", "TurnOff"])
-	}),
-	endpoint: EndpointRefSchema
-});
-async function handlePower(header, endpointRaw, deps, _callerIdentity) {
-	const parsed = PowerDirectiveSchema.safeParse({
-		header: {
-			namespace: header.namespace,
-			name: header.name
-		},
-		endpoint: endpointRaw
-	});
-	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
-	const endpointId = parsed.data.endpoint.endpointId;
-	const parsedId = parseCameraEndpointId(endpointId);
-	const on = parsed.data.header.name === "TurnOn";
-	const api = deps.ctx.api;
-	if (parsedId.kind === "autotrack") await api.ptzAutotrack.setEnabled.mutate({
-		deviceId: parsedId.parentDeviceId,
-		enabled: on
-	});
-	else if (parsedId.kind === "privacy") await api.privacyMask.setMask.mutate({
-		deviceId: parsedId.parentDeviceId,
-		patch: { enabled: on }
-	});
-	else if (parsedId.kind === "child") await api.switch.setState.mutate({
-		deviceId: parsedId.childDeviceId,
-		on
-	});
-	else if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "PowerController is not exposed on camera endpoints — direct the directive at the child accessory");
-	else return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
-	return {
-		event: {
-			header: {
-				namespace: "Alexa",
-				name: "Response",
-				messageId: header.messageId,
-				correlationToken: header.correlationToken,
-				payloadVersion: "3"
-			},
-			endpoint: { endpointId },
-			payload: {}
-		},
-		context: { properties: [{
-			namespace: "Alexa.PowerController",
-			name: "powerState",
-			value: on ? "ON" : "OFF",
-			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
-			uncertaintyInMilliseconds: 500
-		}] }
-	};
-}
-//#endregion
-//#region src/handlers/brightness-controller.ts
+//#region src/handlers/ptz-preset.ts
 /**
-* `Alexa.BrightnessController/SetBrightness` handler.
+* `Alexa.ModeController/SetMode` handler — dispatches three PTZ instances:
 *
-* The Discovery handler declares `Alexa.BrightnessController` only on
-* child accessory endpoints that bind the `brightness` cap (today:
-* Reolink floodlights, Hikvision supplemental lights). Brightness is
-* NEVER exposed on the parent camera endpoint or on the synthetic
-* autotrack endpoint — both reject INVALID_DIRECTIVE here.
+*   `ptz.preset` — preset-recall. Decodes the preset name from the mode
+*     value and calls `ptz.goToPreset({deviceId, presetId})`.
 *
-* Routing:
-*   - `${parent}__${child}` → `brightness.setBrightness({deviceId: child, percentage})`
+*   `ptz.pan`  — momentary pan. `ptz.pan.left|right|center` issues a
+*     continuousMove pulse stopped on a timer; the dropdown reverts to
+*     `center` server-side so subsequent picks re-trigger the move.
 *
-* Auth: same scope-token verification path as the other controllers.
-* The response carries the `Alexa.BrightnessController.brightness`
-* property echoing the new level so the Echo updates its UI without an
-* extra ReportState round-trip.
+*   `ptz.tilt` — momentary tilt. Mirrors ptz.pan with up|down|center.
 */
-var SetBrightnessDirectiveSchema = object({
+var SetModeDirectiveSchema = object({
 	header: object({
-		namespace: literal("Alexa.BrightnessController"),
-		name: literal("SetBrightness")
+		namespace: literal("Alexa.ModeController"),
+		name: literal("SetMode"),
+		instance: string().optional()
 	}),
 	endpoint: EndpointRefSchema,
-	payload: object({ brightness: number().min(0).max(100) })
+	payload: SetModePayloadSchema
 });
-async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
-	const parsed = SetBrightnessDirectiveSchema.safeParse({
+var PTZ_PRESET_MODE_PREFIX = "ptz.preset.";
+var PTZ_DIRECTION_PULSE_MS = 1e3;
+var PTZ_PAN_MOVES = {
+	"ptz.pan.left": { pan: -1 },
+	"ptz.pan.right": { pan: 1 },
+	"ptz.pan.center": {}
+};
+var PTZ_TILT_MOVES = {
+	"ptz.tilt.up": { tilt: 1 },
+	"ptz.tilt.down": { tilt: -1 },
+	"ptz.tilt.center": {}
+};
+async function handleSetMode(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SetModeDirectiveSchema.safeParse({
 		header: {
 			namespace: header.namespace,
-			name: header.name
+			name: header.name,
+			instance: header.instance
 		},
 		endpoint: endpointRaw,
 		payload: payloadRaw ?? {}
 	});
 	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const instance = parsed.data.header.instance;
+	if (instance !== "ptz.preset" && instance !== "ptz.pan" && instance !== "ptz.tilt") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController instance not supported: ${instance ?? "(missing)"}`);
 	const endpointId = parsed.data.endpoint.endpointId;
 	const parsedId = parseCameraEndpointId(endpointId);
-	if (parsedId.kind === "autotrack" || parsedId.kind === "privacy") return errorEnvelope(header, "INVALID_DIRECTIVE", `BrightnessController is not exposed on the ${parsedId.kind} endpoint`);
-	if (parsedId.kind === "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", "BrightnessController is not exposed on camera endpoints — direct the directive at the dimmable child accessory");
-	if (parsedId.kind === "invalid") return errorEnvelope(header, "INVALID_DIRECTIVE", parsedId.reason);
-	const percentage = parsed.data.payload.brightness;
+	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `ModeController only supported on camera endpoints — got ${endpointId}`);
+	const mode = parsed.data.payload.mode;
 	const api = deps.ctx.api;
-	try {
-		await api.brightness.setBrightness.mutate({
-			deviceId: parsedId.childDeviceId,
-			percentage
+	if (instance === "ptz.pan" || instance === "ptz.tilt") {
+		const move = (instance === "ptz.pan" ? PTZ_PAN_MOVES : PTZ_TILT_MOVES)[mode];
+		if (!move) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a valid ${instance} mode`);
+		if (Object.keys(move).length === 0) await api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
+			deps.logger.debug("alexa ptz-mode: stop (center) failed (non-fatal)", { meta: {
+				deviceId: parsedId.deviceId,
+				instance,
+				error: err instanceof Error ? err.message : String(err)
+			} });
 		});
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		deps.logger.warn("alexa brightness-controller: setBrightness failed", { meta: {
-			deviceId: parsedId.childDeviceId,
-			percentage,
-			error: message
-		} });
-		return errorEnvelope(header, "INTERNAL_ERROR", `brightness.setBrightness failed: ${message}`);
+		else try {
+			await api.ptz.continuousMove.mutate({
+				deviceId: parsedId.deviceId,
+				...move
+			});
+			setTimeout(() => {
+				api.ptz.stop.mutate({ deviceId: parsedId.deviceId }).catch((err) => {
+					deps.logger.debug("alexa ptz-mode: stop after pulse failed (non-fatal)", { meta: {
+						deviceId: parsedId.deviceId,
+						instance,
+						error: err instanceof Error ? err.message : String(err)
+					} });
+				});
+			}, PTZ_DIRECTION_PULSE_MS);
+		} catch (err) {
+			return errorEnvelope(header, "INTERNAL_ERROR", `ptz.continuousMove failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		return modeSuccessResponse(header, endpointId, instance, instance === "ptz.pan" ? "ptz.pan.center" : "ptz.tilt.center");
 	}
+	if (!mode.startsWith(PTZ_PRESET_MODE_PREFIX)) return errorEnvelope(header, "INVALID_DIRECTIVE", `mode '${mode}' is not a ptz.preset mode`);
+	const presetName = mode.slice(11);
+	if (presetName.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "preset name missing after prefix");
+	const preset = (await api.ptz.getPresets.query({ deviceId: parsedId.deviceId })).find((p) => p.name === presetName);
+	if (!preset) return errorEnvelope(header, "INVALID_DIRECTIVE", `preset '${presetName}' not found on device ${parsedId.deviceId}`);
+	await api.ptz.goToPreset.mutate({
+		deviceId: parsedId.deviceId,
+		presetId: preset.id
+	});
+	return modeSuccessResponse(header, endpointId, "ptz.preset", mode);
+}
+function modeSuccessResponse(header, endpointId, instance, mode) {
 	return {
 		event: {
 			header: {
@@ -41089,9 +40947,10 @@ async function handleSetBrightness(header, endpointRaw, payloadRaw, deps, _calle
 			payload: {}
 		},
 		context: { properties: [{
-			namespace: "Alexa.BrightnessController",
-			name: "brightness",
-			value: percentage,
+			namespace: "Alexa.ModeController",
+			instance,
+			name: "mode",
+			value: mode,
 			timeOfSample: (/* @__PURE__ */ new Date()).toISOString(),
 			uncertaintyInMilliseconds: 500
 		}] }
@@ -41112,6 +40971,7 @@ async function handleReportState(header, endpointRaw, deps, _callerIdentity) {
 		else if (parsed.kind === "privacy") await collectPrivacyProperties(api, parsed.parentDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "autotrack") await collectAutotrackProperties(api, parsed.parentDeviceId, properties, nowIso, deps.logger);
 		else if (parsed.kind === "child") await collectChildProperties(api, parsed.childDeviceId, properties, nowIso, deps.logger);
+		else if (parsed.kind === "alarm-panel") await collectAlarmPanelProperties(api, parsed.deviceId, properties, nowIso, deps.logger);
 	} catch (err) {
 		deps.logger.warn("alexa report-state: collection failed", { meta: {
 			endpointId,
@@ -41173,6 +41033,42 @@ async function collectCameraProperties(api, deviceId, properties, timeOfSample,
 		uncertaintyInMilliseconds: 0
 	});
 }
+/**
+* The panel's two declared properties.
+*
+* Both are omitted when the panel cannot be read — an `armState` we guessed
+* would be a claim about whether a house is locked, and Alexa rendering the
+* endpoint as unavailable is the truthful outcome of a panel nobody reached.
+* The failure is logged with the device id, never swallowed.
+*/
+async function collectAlarmPanelProperties(api, deviceId, properties, timeOfSample, logger) {
+	const status = await api.alarmPanel.getStatus.query({ deviceId }).catch((err) => {
+		logger.warn("alexa report-state: alarmPanel.getStatus FAILED — Alexa will show the panel as unavailable", {
+			tags: { deviceId },
+			meta: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return null;
+	});
+	const parsed = AlarmPanelStatusSchema.pick({ state: true }).safeParse(status);
+	if (!parsed.success) {
+		if (status !== null) logger.warn("alexa report-state: panel status did not match the cap schema — omitting", { tags: { deviceId } });
+		return;
+	}
+	properties.push({
+		namespace: "Alexa.SecurityPanelController",
+		name: "armState",
+		value: alexaArmStateFor(parsed.data.state),
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	});
+	properties.push({
+		namespace: "Alexa.SecurityPanelController",
+		name: "burglaryAlarm",
+		value: burglaryAlarmFor(parsed.data.state),
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	});
+}
 async function collectPrivacyProperties(api, parentDeviceId, properties, timeOfSample, _logger) {
 	const status = await api.privacyMask.getStatus.query({ deviceId: parentDeviceId }).catch(() => null);
 	const enabled = Boolean(status?.enabled);
@@ -41226,6 +41122,478 @@ async function collectChildProperties(api, childDeviceId, properties, timeOfSamp
 	});
 }
 //#endregion
+//#region src/handlers/rtc-session.ts
+var InitiateSessionWithOfferDirectiveSchema = object({
+	endpoint: EndpointRefSchema,
+	payload: InitiateSessionWithOfferPayloadSchema
+});
+var SessionDisconnectedDirectiveSchema = object({
+	endpoint: EndpointRefSchema,
+	payload: SessionDisconnectedPayloadSchema
+});
+/**
+* Live egress handles, keyed by `<deviceId>/<sessionId>`.
+*
+* The primitive's refcount has no lease TTL: a holder that vanishes without
+* releasing leaks a child until the broker restarts (D67). This handler is a
+* holder, so it keeps the one piece of state that lets it not be that holder —
+* the `pipelineKey` its `SessionDisconnected` has to release.
+*
+* A module-level map is right here because the directive handlers are free
+* functions called per directive; the entry is written on a successful acquire
+* and deleted on the release path, both of which are the same tick as the
+* directive that owns it.
+*/
+var EGRESS_HANDLES = /* @__PURE__ */ new Map();
+function egressHandleKey(deviceId, sessionId) {
+	return `${deviceId}/${sessionId}`;
+}
+var WEBRTC_PROFILE_NAMES = [
+	"high",
+	"mid",
+	"low"
+];
+function resolveWebrtcTarget(pref) {
+	if (pref === "auto") return void 0;
+	if (WEBRTC_PROFILE_NAMES.includes(pref)) return {
+		kind: "profile",
+		profile: pref
+	};
+	return {
+		kind: "cam-stream",
+		camStreamId: pref
+	};
+}
+async function handleInitiateSessionWithOffer(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = InitiateSessionWithOfferDirectiveSchema.safeParse({
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpoint = parsed.data.endpoint;
+	const payload = parsed.data.payload;
+	const parsedId = parseCameraEndpointId(endpoint.endpointId);
+	if (parsedId.kind !== "camera") return errorEnvelope(header, "INVALID_DIRECTIVE", `endpointId ${endpoint.endpointId} is not a camera`);
+	const deviceId = parsedId.deviceId;
+	const sessionId = payload.sessionId;
+	const log = deps.logger.withTags({
+		deviceId,
+		sessionId
+	});
+	const sdpOffer = payload.offer.value;
+	if (sdpOffer.length === 0) return errorEnvelope(header, "INVALID_DIRECTIVE", "offer.value is empty");
+	const api = deps.ctx.api;
+	const exposedEntry = deps.listExposed().find((e) => e.deviceId === deviceId);
+	const explicitSourceProfile = exposedEntry?.settings?.sourceProfile;
+	const mappedFromPreference = (() => {
+		const pref = exposedEntry?.settings?.streamPreference;
+		if (pref === "low" || pref === "mid" || pref === "high") return pref;
+	})();
+	const sourceProfile = explicitSourceProfile ?? mappedFromPreference ?? "high";
+	let derivedTarget;
+	/**
+	* The primitive's release handle, when this session acquired one. Recorded so
+	* `SessionDisconnected` can release it: a refcount whose holder disappears is
+	* the one gap D67 leaves open, and the least this handler can do is not BE
+	* that holder.
+	*/
+	let egressPipelineKey = null;
+	const picked = await api.cameraStreams.pickStream.query({
+		deviceId,
+		requirements: {
+			acceptCodecs: ["h264"],
+			minHeight: 480,
+			excludeDerived: true,
+			requireSiblingCodec: ["h265", "hevc"]
+		}
+	}).catch((err) => {
+		log.warn("alexa rtc-session: cameraStreams.pickStream threw — falling back to transcode", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		return null;
+	});
+	if (picked) {
+		log.info("alexa rtc-session: bypassing transcode via cameraStreams.pickStream", { meta: {
+			sourceProfile,
+			selectedCamStreamId: picked.camStreamId,
+			reason: picked.reason
+		} });
+		derivedTarget = {
+			kind: "cam-stream",
+			camStreamId: picked.camStreamId
+		};
+	} else try {
+		const acquired = await acquireAlexaEgress({
+			api,
+			deviceId,
+			sourceProfile,
+			sessionId,
+			logger: log
+		});
+		egressPipelineKey = acquired.pipelineKey;
+		EGRESS_HANDLES.set(egressHandleKey(deviceId, sessionId), acquired.pipelineKey);
+		derivedTarget = {
+			kind: "cam-stream",
+			camStreamId: acquired.camStreamId
+		};
+	} catch (err) {
+		log.warn("alexa rtc-session: egress acquire failed, falling back to streamPreference target", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		derivedTarget = resolveWebrtcTarget(exposedEntry?.settings?.streamPreference ?? "auto");
+	}
+	try {
+		const result = await api.webrtcSession.handleOffer.mutate({
+			deviceId,
+			sdpOffer,
+			sessionId,
+			target: derivedTarget,
+			relayOnly: false,
+			nonTrickle: true,
+			disableTurn: true,
+			disableIpv6: true,
+			consumerAttribution: {
+				kind: "alexa",
+				sessionId
+			}
+		});
+		log.info("alexa rtc-session: AnswerGenerated", { meta: {
+			returnedSessionId: result.sessionId,
+			sdpAnswerLen: result.sdpAnswer.length
+		} });
+		return { event: {
+			header: {
+				namespace: "Alexa.RTCSessionController",
+				name: "AnswerGeneratedForSession",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: endpoint.endpointId },
+			payload: { answer: {
+				format: payload.offer.format ?? "SDP",
+				value: result.sdpAnswer
+			} }
+		} };
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		const mSectionSummary = (() => {
+			const lines = sdpOffer.split(/\r?\n/);
+			const sections = [];
+			let current = null;
+			for (const raw of lines) {
+				const line = raw.trim();
+				if (line.startsWith("m=")) {
+					if (current) sections.push(current);
+					current = {
+						mid: null,
+						kind: line.split(" ")[0]?.slice(2) ?? "unknown",
+						direction: null,
+						codecs: []
+					};
+				} else if (current) {
+					if (line.startsWith("a=mid:")) current.mid = line.slice(6);
+					else if (/^a=(sendonly|recvonly|sendrecv|inactive)$/.test(line)) current.direction = line.slice(2);
+					else if (line.startsWith("a=rtpmap:")) current.codecs.push(line.slice(9));
+				}
+			}
+			if (current) sections.push(current);
+			return sections;
+		})();
+		log.warn("alexa rtc-session: handleOffer failed", { meta: {
+			error: message,
+			offerLen: sdpOffer.length,
+			mSections: mSectionSummary,
+			offerSdp: sdpOffer
+		} });
+		if (egressPipelineKey !== null) {
+			EGRESS_HANDLES.delete(egressHandleKey(deviceId, sessionId));
+			await releaseAlexaEgress({
+				api,
+				deviceId,
+				pipelineKey: egressPipelineKey,
+				logger: log
+			});
+		}
+		return errorEnvelope(header, "INTERNAL_ERROR", `webrtc-session.handleOffer failed: ${message}`);
+	}
+}
+async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const parsed = SessionDisconnectedDirectiveSchema.safeParse({
+		endpoint: endpointRaw,
+		payload: payloadRaw ?? {}
+	});
+	if (!parsed.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `payload validation failed: ${parsed.error.message}`);
+	const endpoint = parsed.data.endpoint;
+	const parsedId = parseCameraEndpointId(endpoint.endpointId);
+	if (parsedId.kind === "camera") {
+		const handleKey = egressHandleKey(parsedId.deviceId, parsed.data.payload.sessionId);
+		const pipelineKey = EGRESS_HANDLES.get(handleKey);
+		if (pipelineKey !== void 0) {
+			EGRESS_HANDLES.delete(handleKey);
+			await releaseAlexaEgress({
+				api: deps.ctx.api,
+				deviceId: parsedId.deviceId,
+				pipelineKey,
+				logger: deps.logger
+			});
+		}
+		try {
+			await deps.ctx.api.webrtcSession.closeSession.mutate({
+				deviceId: parsedId.deviceId,
+				sessionId: parsed.data.payload.sessionId
+			});
+		} catch (err) {
+			deps.logger.warn("alexa rtc-session: closeSession threw on disconnect (continuing to ack)", {
+				tags: {
+					deviceId: parsedId.deviceId,
+					sessionId: parsed.data.payload.sessionId
+				},
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
+	const disconnectedDeviceId = parsedId.kind === "camera" ? parsedId.deviceId : void 0;
+	deps.logger.info("alexa rtc-session: SessionDisconnected", {
+		tags: {
+			sessionId: parsed.data.payload.sessionId,
+			...disconnectedDeviceId !== void 0 ? { deviceId: disconnectedDeviceId } : {}
+		},
+		meta: { endpointId: endpoint.endpointId }
+	});
+	return { event: {
+		header: {
+			namespace: "Alexa",
+			name: "Response",
+			messageId: header.messageId,
+			correlationToken: header.correlationToken,
+			payloadVersion: "3"
+		},
+		endpoint: { endpointId: endpoint.endpointId },
+		payload: {}
+	} };
+}
+//#endregion
+//#region src/handlers/security-panel.ts
+var ArmPayloadSchema = object({ armState: _enum([
+	"ARMED_STAY",
+	"ARMED_AWAY",
+	"ARMED_NIGHT"
+]) });
+var DisarmPayloadSchema = object({ authorization: object({
+	type: literal("FOUR_DIGIT_PIN"),
+	value: string().min(1)
+}).optional() });
+/** The subset of the panel status the directives read. */
+var PanelReadSchema = AlarmPanelStatusSchema.pick({
+	state: true,
+	availableModes: true,
+	requiresCode: true
+});
+/**
+* `Alexa.SecurityPanelController.ErrorResponse`.
+*
+* A namespace of its own, because the four types that matter here
+* (`AUTHORIZATION_REQUIRED`, `UNAUTHORIZED`, `NOT_READY_FOR_ARM`,
+* `BYPASS_NEEDED`) are only understood under it — the generic `Alexa`
+* `ErrorResponse` from `error-envelope.ts` carries none of them, and a PIN
+* problem reported there is a message the Alexa app cannot act on.
+*/
+function securityPanelError(header, type, message) {
+	return { event: {
+		header: {
+			namespace: "Alexa.SecurityPanelController",
+			name: "ErrorResponse",
+			messageId: header.messageId,
+			correlationToken: header.correlationToken,
+			payloadVersion: "3"
+		},
+		payload: {
+			type,
+			message
+		}
+	} };
+}
+/** Resolve the alarm panel this directive targets, or the refusal to send. */
+function resolveDeviceId(endpointRaw) {
+	const parsedEndpoint = EndpointRefSchema.safeParse(endpointRaw);
+	if (!parsedEndpoint.success) return { reason: "missing or malformed endpoint" };
+	const parsedId = parseCameraEndpointId(parsedEndpoint.data.endpointId);
+	if (parsedId.kind === "alarm-panel") return { deviceId: parsedId.deviceId };
+	return { reason: `SecurityPanelController is only exposed on alarm-panel endpoints — got '${parsedEndpoint.data.endpointId}'` };
+}
+/**
+* What the panel currently accepts, or `null` when it could not be read.
+*
+* `null` is the honest answer and the callers treat it as unknown; nothing
+* here substitutes a default that would read as "accepts nothing, needs no
+* PIN".
+*/
+async function readPanel(api, deviceId, logger, phase) {
+	const raw = await api.alarmPanel.getStatus.query({ deviceId }).catch((err) => {
+		logger.warn("alexa security-panel: alarmPanel.getStatus failed — proceeding without it", {
+			tags: { deviceId },
+			meta: {
+				phase,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return null;
+	});
+	const parsed = PanelReadSchema.safeParse(raw);
+	if (!parsed.success) {
+		if (raw !== null) logger.warn("alexa security-panel: panel status did not match the cap schema", {
+			tags: { deviceId },
+			meta: { phase }
+		});
+		return null;
+	}
+	return parsed.data;
+}
+/** The `context.properties` block for a panel whose state we re-read. */
+function panelProperties(facts, fallback) {
+	const timeOfSample = (/* @__PURE__ */ new Date()).toISOString();
+	const parsedState = facts === null ? null : AlarmPanelStatusSchema.shape.state.parse(facts.state);
+	const armState = parsedState === null ? fallback : alexaArmStateFor(parsedState);
+	const burglary = parsedState === null ? { value: "OK" } : burglaryAlarmFor(parsedState);
+	return [{
+		namespace: "Alexa.SecurityPanelController",
+		name: "armState",
+		value: armState,
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	}, {
+		namespace: "Alexa.SecurityPanelController",
+		name: "burglaryAlarm",
+		value: burglary,
+		timeOfSample,
+		uncertaintyInMilliseconds: 0
+	}];
+}
+async function handleArm(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const target = resolveDeviceId(endpointRaw);
+	if (!("deviceId" in target)) return errorEnvelope(header, "INVALID_DIRECTIVE", target.reason);
+	const { deviceId } = target;
+	const payload = ArmPayloadSchema.safeParse(payloadRaw);
+	if (!payload.success) {
+		deps.logger.warn("alexa security-panel: Arm payload is not an arm state Alexa defines", {
+			tags: { deviceId },
+			meta: { error: payload.error.message }
+		});
+		return errorEnvelope(header, "INVALID_DIRECTIVE", `Arm payload unexpected: ${payload.error.message}`);
+	}
+	const requested = payload.data.armState;
+	const api = deps.ctx.api;
+	const facts = await readPanel(api, deviceId, deps.logger, "arm");
+	if (facts?.requiresCode === true) {
+		deps.logger.warn("alexa security-panel: panel requires a PIN and the Arm directive carries none — REFUSED", {
+			tags: { deviceId },
+			meta: { requested }
+		});
+		return securityPanelError(header, "AUTHORIZATION_REQUIRED", "this panel requires a PIN to arm, and Alexa cannot supply one on an Arm directive");
+	}
+	const mode = alarmArmModeForAlexa(requested, facts?.availableModes ?? []);
+	if (mode === null) {
+		deps.logger.warn("alexa security-panel: panel accepts no mode for this arm state — REFUSED", {
+			tags: { deviceId },
+			meta: {
+				requested,
+				availableModes: facts?.availableModes ?? null
+			}
+		});
+		return securityPanelError(header, "NOT_READY_FOR_ARM", `panel does not accept ${requested}`);
+	}
+	try {
+		await api.alarmPanel.arm.mutate({
+			deviceId,
+			mode
+		});
+	} catch (err) {
+		deps.logger.warn("alexa security-panel: arm command failed", {
+			tags: { deviceId },
+			meta: {
+				requested,
+				mode,
+				error: err instanceof Error ? err.message : String(err)
+			}
+		});
+		return securityPanelError(header, "NOT_READY_FOR_ARM", err instanceof Error ? err.message : String(err));
+	}
+	deps.logger.info("alexa security-panel: armed", {
+		tags: { deviceId },
+		meta: {
+			requested,
+			mode
+		}
+	});
+	const after = await readPanel(api, deviceId, deps.logger, "arm-confirm");
+	if (after?.state === "arming") deps.logger.info("alexa security-panel: panel is in its exit delay — reporting DISARMED until it is set", {
+		tags: { deviceId },
+		meta: {
+			requested,
+			mode
+		}
+	});
+	return {
+		event: {
+			header: {
+				namespace: "Alexa.SecurityPanelController",
+				name: "Arm.Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: `${deviceId}__alarm` },
+			payload: {}
+		},
+		context: { properties: panelProperties(after, requested) }
+	};
+}
+async function handleDisarm(header, endpointRaw, payloadRaw, deps, _callerIdentity) {
+	const target = resolveDeviceId(endpointRaw);
+	if (!("deviceId" in target)) return errorEnvelope(header, "INVALID_DIRECTIVE", target.reason);
+	const { deviceId } = target;
+	const payload = DisarmPayloadSchema.safeParse(payloadRaw ?? {});
+	if (!payload.success) return errorEnvelope(header, "INVALID_DIRECTIVE", `Disarm payload unexpected: ${payload.error.message}`);
+	const code = payload.data.authorization?.value;
+	const api = deps.ctx.api;
+	if ((await readPanel(api, deviceId, deps.logger, "disarm"))?.requiresCode === true && code === void 0) {
+		deps.logger.warn("alexa security-panel: panel requires a PIN and the Disarm directive carried none — REFUSED", { tags: { deviceId } });
+		return securityPanelError(header, "AUTHORIZATION_REQUIRED", "this panel requires a PIN to disarm");
+	}
+	try {
+		await api.alarmPanel.disarm.mutate(code === void 0 ? { deviceId } : {
+			deviceId,
+			code
+		});
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		deps.logger.warn("alexa security-panel: disarm command failed", {
+			tags: { deviceId },
+			meta: {
+				codeSupplied: code !== void 0,
+				error: message
+			}
+		});
+		return code === void 0 ? errorEnvelope(header, "INTERNAL_ERROR", message) : securityPanelError(header, "UNAUTHORIZED", message);
+	}
+	deps.logger.info("alexa security-panel: disarmed", {
+		tags: { deviceId },
+		meta: { codeSupplied: code !== void 0 }
+	});
+	const after = await readPanel(api, deviceId, deps.logger, "disarm-confirm");
+	return {
+		event: {
+			header: {
+				namespace: "Alexa",
+				name: "Response",
+				messageId: header.messageId,
+				correlationToken: header.correlationToken,
+				payloadVersion: "3"
+			},
+			endpoint: { endpointId: `${deviceId}__alarm` },
+			payload: {}
+		},
+		context: { properties: panelProperties(after, "DISARMED") }
+	};
+}
+//#endregion
 //#region src/handlers/stubs.ts
 /**
 * Stub responder for namespaces not yet implemented (CameraStream /
@@ -41305,7 +41673,9 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 		"Alexa.ModeController/SetMode": "create",
 		"Alexa.ToggleController/TurnOn": "create",
 		"Alexa.ToggleController/TurnOff": "create",
-		"Alexa/ReportState": "view"
+		"Alexa/ReportState": "view",
+		"Alexa.SecurityPanelController/Arm": "create",
+		"Alexa.SecurityPanelController/Disarm": "create"
 	};
 	try {
 		const key = `${header.namespace}/${header.name}`;
@@ -41350,6 +41720,14 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 			status: 200,
 			body: await handlePtzDirection(header, endpoint, deps.ptzDirection, callerIdentity)
 		};
+		if (key === "Alexa.SecurityPanelController/Arm") return {
+			status: 200,
+			body: await handleArm(header, endpoint, payload, deps.securityPanel, callerIdentity)
+		};
+		if (key === "Alexa.SecurityPanelController/Disarm") return {
+			status: 200,
+			body: await handleDisarm(header, endpoint, payload, deps.securityPanel, callerIdentity)
+		};
 		if (key === "Alexa/ReportState") return {
 			status: 200,
 			body: await handleReportState(header, endpoint, deps.reportState, callerIdentity)
@@ -42906,7 +43284,13 @@ var DEFAULT_CONFIG = {
 	enforceIngressToken: false,
 	staleEndpointPurgeInput: ""
 };
-var SUPPORTED_KINDS = ["camera", "doorbell"];
+/** UI filter for the Export picker. `alarm-panel` publishes an
+*  `Alexa.SecurityPanelController` endpoint (`endpoints/builder.ts`). */
+var SUPPORTED_KINDS = [
+	"camera",
+	"doorbell",
+	DeviceType.AlarmPanel
+];
 var ExportAlexaAddon = class extends BaseAddon {
 	lwaGateway = null;
 	syncEngine = null;
@@ -42975,6 +43359,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 				reportState: {
 					ctx: this.ctx,
 					logger: this.ctx.logger
+				},
+				securityPanel: {
+					ctx: this.ctx,
+					logger: this.ctx.logger
 				}
 			},
 			lwaTokensCallbackDeps: {