@camstack/addon-export-hap 1.2.112 → 1.2.113

package/dist/hap-export.addon.mjs

@@ -7420,7 +7420,7 @@ method(object({ deviceId: number() }), array(StreamSourceEntrySchema)), method(o
 	input: unknown()
 }), unknown(), { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(object({ deviceId: number() }), unknown().nullable()), method(object({ deviceId: number() }), RawStateResultSchema.nullable(), { auth: "protected" });
 //#endregion
-//#region ../types/dist/canonical-hash-rO1sRmEK.mjs
+//#region ../types/dist/canonical-hash-Ch5bSjFG.mjs
 var AUDIO_ENCODER_BY_CODEC = {
 	opus: "libopus",
 	aac: "aac",
@@ -7523,6 +7523,7 @@ function buildVideoArgs(video, outputArgs) {
 	];
 	if (video.preset !== void 0) args.push("-preset", video.preset);
 	if (video.tune !== void 0) args.push("-tune", video.tune);
+	if (video.singleSlicePerFrame === true && video.encoder === "libx264") args.push("-x264-params", "sliced-threads=0");
 	if (video.profile !== void 0) args.push("-profile:v", video.profile);
 	if (video.level !== void 0) args.push("-level", video.level);
 	if (video.pixelFormat !== void 0) args.push("-pix_fmt", video.pixelFormat);
@@ -7924,7 +7925,7 @@ import { errMsg } from '@camstack/types'
 * Extract a human-readable message from an unknown error value.
 * Replaces the ubiquitous `errMsg(err)` pattern.
 */
-function errMsg$15(err) {
+function errMsg$16(err) {
 	if (err instanceof Error) return err.message;
 	if (typeof err === "string") return err;
 	return String(err);
@@ -8001,7 +8002,23 @@ var EncodeProfileSchema = object({
 			"zerolatency",
 			"film",
 			"animation"
-		]).optional()
+		]).optional(),
+		/**
+		* ONE slice per access unit.
+		*
+		* `-tune zerolatency` turns on x264's sliced threads, and a frame then leaves
+		* the encoder as five NAL slices that share one RTP timestamp and carry one
+		* marker bit. A libwebrtc depacketiser sees five frame-starts and one
+		* frame-end per frame: the first pictures render and the video then freezes
+		* for good while the audio, on its own plane, plays on. Measured on this hub
+		* 2026-09-13 against the Echo, and reduced to one slice by this flag alone.
+		*
+		* A NAMED field and not a raw flag, because {@link EgressEncodeSchema} omits
+		* `outputArgs` on purpose: an opaque array is part of the sharing key, so two
+		* consumers meaning the same thing spelled differently would stop sharing one
+		* child. Absent means "whatever the encoder does" — today's behaviour.
+		*/
+		singleSlicePerFrame: boolean().optional()
 	}),
 	audio: union([literal("passthrough"), object({
 		codec: _enum([
@@ -8051,7 +8068,7 @@ var BASE_LIVE_EGRESS_PROFILE = {
 	audio: "passthrough"
 };
 ({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
-({ ...BASE_LIVE_EGRESS_PROFILE });
+({ ...BASE_LIVE_EGRESS_PROFILE }), { ...BASE_LIVE_EGRESS_PROFILE.video };
 /** VBV window for a consumer whose budget is enforced per second (HomeKit). */
 var RATE_CONTROL_TIGHT = {
 	kind: "cbr",
@@ -16974,7 +16991,7 @@ var AlarmArmModeSchema = _enum([
 	"vacation",
 	"custom_bypass"
 ]);
-object({
+var AlarmPanelStatusSchema = object({
 	/** Current lifecycle state. */
 	state: AlarmStateSchema,
 	/** Subset of arm modes the panel accepts. UI renders one button per
@@ -40208,7 +40225,7 @@ var Fmp4FragmentChild = class {
 				meta: {
 					sourceId: this.args.sourceId,
 					decodeHwAccel: requested,
-					error: errMsg$15(err)
+					error: errMsg$16(err)
 				}
 			});
 			this.killChild();
@@ -40387,7 +40404,7 @@ var Fmp4FragmentChild = class {
 				tags: { deviceId: this.args.deviceId },
 				meta: {
 					sourceId: this.args.sourceId,
-					error: errMsg$15(err)
+					error: errMsg$16(err)
 				}
 			});
 		}
@@ -87043,7 +87060,7 @@ function clearPairingFiles(accessoryUuid, logger) {
 }
 //#endregion
 //#region src/hap-setup-uri.ts
-function errMsg$14(e) {
+function errMsg$15(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 /**
@@ -87070,7 +87087,7 @@ function firstExposedAccessorySetupUri(exposed, logger) {
 		try {
 			return first.setupURI();
 		} catch (err) {
-			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$14(err) } });
+			logger.debug("export-hap: setupURI failed on first exposed accessory", { meta: { error: errMsg$15(err) } });
 			return;
 		}
 	}
@@ -87423,7 +87440,7 @@ async function buildBattery(bctx) {
 		const status = await proxy.battery?.getStatus({});
 		if (status !== void 0 && status !== null) applyToService(service, status);
 	} catch (err) {
-		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$13(err) } });
+		log.debug("export-hap: battery getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$14(err) } });
 	}
 	const unsubscribes = [];
 	if (proxy.state.battery) {
@@ -87442,7 +87459,7 @@ async function buildBattery(bctx) {
 function applyToService(service, status) {
 	applyUpdates(service, batteryCharacteristicUpdates(status));
 }
-function errMsg$13(err) {
+function errMsg$14(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -98194,7 +98211,7 @@ var VIDEO_LOOPBACK_RCVBUF_BYTES = 8 * 1024 * 1024;
 * not burst size.
 */
 var AUDIO_LOOPBACK_RCVBUF_BYTES = 1024 * 1024;
-function errMsg$12(err) {
+function errMsg$13(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 /**
@@ -98209,13 +98226,13 @@ function applyReceiveBuffer(socket, requestedBytes) {
 	try {
 		socket.setRecvBufferSize(requestedBytes);
 	} catch (err) {
-		error = errMsg$12(err);
+		error = errMsg$13(err);
 	}
 	let effectiveBytes = null;
 	try {
 		effectiveBytes = socket.getRecvBufferSize();
 	} catch (err) {
-		if (error === null) error = errMsg$12(err);
+		if (error === null) error = errMsg$13(err);
 	}
 	return {
 		requestedBytes,
@@ -98475,20 +98492,20 @@ function buildCameraStreamingDelegate(bctx, advertised) {
 		delegate: {
 			handleSnapshotRequest(request, callback) {
 				handleSnapshot(bctx, request).then((buf) => callback(void 0, buf)).catch((err) => {
-					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: snapshot failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			},
 			prepareStream(request, callback) {
 				prepareStream(request, sessions, bctx).then((resp) => callback(void 0, resp)).catch((err) => {
-					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: prepareStream failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			},
 			handleStreamRequest(request, callback) {
 				handleStreamRequest(request, sessions, bctx, advertised).then(() => callback()).catch((err) => {
-					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$11(err) } });
-					callback(err instanceof Error ? err : new Error(errMsg$11(err)));
+					log.warn("export-hap: handleStreamRequest failed", { meta: { error: errMsg$12(err) } });
+					callback(err instanceof Error ? err : new Error(errMsg$12(err)));
 				});
 			}
 		},
@@ -98604,7 +98621,7 @@ async function prepareStream(request, sessions, bctx) {
 		closeSocket(audioUdp);
 		closeSocket(videoLoopUdp);
 		closeSocket(audioLoopUdp);
-		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$11(err)}`, { cause: err });
+		throw new Error(`export-hap: outbound SrtpSession init failed: ${errMsg$12(err)}`, { cause: err });
 	}
 	let upstreamAudioSrtp = null;
 	try {
@@ -98618,7 +98635,7 @@ async function prepareStream(request, sessions, bctx) {
 			profile: import_src.ProtectionProfileAes128CmHmacSha1_80
 		});
 	} catch (err) {
-		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$11(err) } });
+		bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).warn("export-hap: SrtpSession init failed (upstream audio decrypt disabled)", { meta: { error: errMsg$12(err) } });
 	}
 	const videoSsrc = randomSsrc();
 	const audioSsrc = randomSsrc();
@@ -98735,7 +98752,7 @@ async function prepareStream(request, sessions, bctx) {
 	});
 	audioUdp.on("message", (packet, rinfo) => {
 		handleIncomingAudioRtp(session, packet, rinfo.address, bctx).catch((err) => {
-			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$11(err) } });
+			bctx.ctx.logger.withTags({ deviceId: bctx.numericDeviceId }).debug("export-hap: incoming-audio handler error (dropped)", { meta: { error: errMsg$12(err) } });
 		});
 	});
 	logLoopbackBuffer(tagLog, request.sessionID, "video", videoLoop.buffer);
@@ -98931,7 +98948,7 @@ function readControllerRtcp(session, leg, packet, log) {
 	} catch (err) {
 		drop(session, "inbound-rtcp-decrypt-failed");
 		storeReceiverReports(session, leg, recordUnreadableRtcp(tally));
-		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$11(err)}`, log);
+		logUnreadableRtcp(session, leg, `decrypt: ${errMsg$12(err)}`, log);
 		return;
 	}
 	const outcome = ingestDecryptedRtcp(plaintext, tally);
@@ -99697,7 +99714,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		session.upstreamRtpDecryptFailures += 1;
 		if (session.upstreamRtpDecryptFailures % 100 === 1) log.debug("export-hap: SRTP decrypt failed (rate-limited)", { meta: {
 			failures: session.upstreamRtpDecryptFailures,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 		return;
 	}
@@ -99711,7 +99728,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		rtpPayloadType = parsedRtp.header.payloadType;
 	} catch (err) {
 		drop(session, "upstream-parse-failed");
-		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$11(err) } });
+		log.debug("export-hap: RTP parse failed after decrypt", { meta: { error: errMsg$12(err) } });
 		return;
 	}
 	const negotiatedAudioPt = session.lastStartParams?.audioPt;
@@ -99735,7 +99752,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 	if (session.intercomTalkSessionId === null) {
 		session.intercomTalkSessionId = "";
 		const opened = await openIntercomTalkSession(bctx).catch((err) => {
-			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$11(err) } });
+			log.warn("export-hap: intercom.startTalkSession failed", { meta: { error: errMsg$12(err) } });
 			return null;
 		});
 		if (opened) {
@@ -99762,7 +99779,7 @@ async function handleIncomingAudioRtp(session, packet, sourceAddress, bctx) {
 		drop(session, "upstream-push-failed");
 		log.debug("export-hap: intercom.pushTalkAudio failed (will re-open on next frame)", { meta: {
 			sequenceNumber: session.intercomPcmSequence,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 		session.intercomTalkSessionId = null;
 	}
@@ -99794,7 +99811,7 @@ async function closeIntercomTalkSession(session, bctx) {
 	} catch (err) {
 		log.debug("export-hap: intercom.endTalkSession failed (continuing)", { meta: {
 			sessionId,
-			error: errMsg$11(err)
+			error: errMsg$12(err)
 		} });
 	}
 }
@@ -99819,7 +99836,7 @@ function closeSocket(udp) {
 function randomSsrc() {
 	return Math.floor(Math.random() * 2147483646) + 1 | 0;
 }
-function errMsg$11(err) {
+function errMsg$12(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -99903,14 +99920,14 @@ async function buildDoorbell(input) {
 			}
 			log.info("export-hap: doorbell SINGLE_PRESS pushed to HomeKit", { meta: { ...delivery } });
 		} catch (err) {
-			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$10(err) } });
+			log.warn("export-hap: ringDoorbell() failed", { meta: { error: errMsg$11(err) } });
 		}
 	});
 	return { async dispose() {
 		unsubscribe();
 	} };
 }
-function errMsg$10(err) {
+function errMsg$11(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -99958,7 +99975,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		const detected = await proxy.motion?.isDetected({});
 		if (typeof detected === "boolean") motionService.updateCharacteristic(import_dist.Characteristic.MotionDetected, detected);
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: initial motion hydrate failed (non-fatal)", { meta: { error: errMsg$10(err) } });
 	}
 	let resetTimer = null;
 	const armReset = () => {
@@ -99992,7 +100009,7 @@ async function buildMotionSensor(bctx, existing = null) {
 		}
 	} };
 }
-function errMsg$9(err) {
+function errMsg$10(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -100023,7 +100040,7 @@ async function buildPrivacySwitch(bctx) {
 		const status = await proxy.privacyMask?.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$8(err) } });
+		log.debug("export-hap: privacy-mask getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$9(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -100032,7 +100049,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch (err) {
 			log.warn("export-hap: privacy-mask setMask failed", { meta: {
 				enabled,
-				error: errMsg$8(err)
+				error: errMsg$9(err)
 			} });
 		}
 	});
@@ -100050,7 +100067,7 @@ async function buildPrivacySwitch(bctx) {
 		} catch {}
 	} };
 }
-function errMsg$8(err) {
+function errMsg$9(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -100141,7 +100158,7 @@ async function buildPtz(bctx) {
 			} catch (err) {
 				log.warn("export-hap: ptz.goToPreset failed", { meta: {
 					presetId: preset.id,
-					error: errMsg$7(err)
+					error: errMsg$8(err)
 				} });
 			}
 			armReset(() => service.updateCharacteristic(import_dist.Characteristic.On, false), MOMENTARY_RESET_MS);
@@ -100159,14 +100176,14 @@ async function buildPtz(bctx) {
 					try {
 						await proxy.ptz?.stop({});
 					} catch (err) {
-						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+						log.debug("export-hap: ptz.stop failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 					}
 					service.updateCharacteristic(import_dist.Characteristic.On, false);
 				}, options.ptzPulseMs);
 			} catch (err) {
 				log.warn("export-hap: ptz.continuousMove failed", { meta: {
 					dir: dir.label,
-					error: errMsg$7(err)
+					error: errMsg$8(err)
 				} });
 				service.updateCharacteristic(import_dist.Characteristic.On, false);
 			}
@@ -100189,7 +100206,7 @@ async function readPresets(bctx) {
 			name: p.name
 		}));
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+		ctx.logger.withTags({ deviceId: numericDeviceId }).debug("export-hap: ptz.getPresets failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 		return [];
 	}
 }
@@ -100204,7 +100221,7 @@ async function tryBuildAutotrack(bctx) {
 		const status = await proxy.ptzAutotrack.getStatus({});
 		if (status && typeof status.enabled === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, status.enabled);
 	} catch (err) {
-		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
+		log.debug("export-hap: ptzAutotrack.getStatus failed (non-fatal)", { meta: { error: errMsg$8(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const enabled = value === true;
@@ -100213,13 +100230,13 @@ async function tryBuildAutotrack(bctx) {
 		} catch (err) {
 			log.warn("export-hap: ptzAutotrack.setEnabled failed", { meta: {
 				enabled,
-				error: errMsg$7(err)
+				error: errMsg$8(err)
 			} });
 		}
 	});
 	return { async dispose() {} };
 }
-function errMsg$7(err) {
+function errMsg$8(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101250,13 +101267,13 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		const switchStatus = await proxy.switch?.getStatus({});
 		if (switchStatus && typeof switchStatus.on === "boolean") service.updateCharacteristic(import_dist.Characteristic.On, switchStatus.on);
 	} catch (err) {
-		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$6(err) } });
+		log.debug("export-hap: child switch.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
 	}
 	if (useLightbulb) try {
 		const status = await proxy.brightness?.getStatus({});
 		if (status && typeof status.percentage === "number") service.updateCharacteristic(import_dist.Characteristic.Brightness, status.percentage);
 	} catch (err) {
-		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$6(err) } });
+		log.debug("export-hap: child brightness.getStatus failed (non-fatal)", { meta: { error: errMsg$7(err) } });
 	}
 	if (hasSwitch) service.getCharacteristic(import_dist.Characteristic.On).onSet(async (value) => {
 		const on = value === true;
@@ -101265,7 +101282,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch (err) {
 			log.warn("export-hap: child switch.setState failed", { meta: {
 				on,
-				error: errMsg$6(err)
+				error: errMsg$7(err)
 			} });
 		}
 	});
@@ -101277,7 +101294,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch (err) {
 			log.warn("export-hap: child brightness.setBrightness failed", { meta: {
 				percentage,
-				error: errMsg$6(err)
+				error: errMsg$7(err)
 			} });
 		}
 	});
@@ -101300,7 +101317,7 @@ async function buildChildSwitch(bctx, subtype, deviceType) {
 		} catch {}
 	} };
 }
-function errMsg$6(err) {
+function errMsg$7(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101327,7 +101344,7 @@ async function buildChildServicesFor(input) {
 		for (const h of handles) try {
 			await h.dispose();
 		} catch (err) {
-			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$5(err) } });
+			ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: child service dispose failed (continuing)", { meta: { error: errMsg$6(err) } });
 		}
 	} };
 }
@@ -101343,7 +101360,7 @@ async function listChildren(ctx, parentNumericId) {
 			features: Array.isArray(c.features) ? c.features.filter((f) => typeof f === "string") : []
 		}));
 	} catch (err) {
-		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$5(err) } });
+		ctx.logger.withTags({ deviceId: parentNumericId }).debug("export-hap: deviceManager.getChildren failed (non-fatal)", { meta: { error: errMsg$6(err) } });
 		return [];
 	}
 }
@@ -101359,7 +101376,7 @@ function asDeviceType(raw) {
 	for (const value of Object.values(DeviceType)) if (value === lower) return value;
 	return DeviceType.Generic;
 }
-function errMsg$5(err) {
+function errMsg$6(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101381,12 +101398,18 @@ var SUPPORTED_MAPPER_KINDS = ["camera", "generic"];
 * doctrine the HA exporter writes down, and the thing that confined the
 * previous exporter to cameras when it was ignored.
 *
-* Tier A: the types whose HomeKit services exist today and need no
-* feature-dependent shape. `cover`, `climate`, `fan`, `valve`, `humidifier`,
-* `water-heater`, `alarm-panel`, `button` and `media-player` are deliberately
+* Tier A plus `alarm-panel`: the types whose HomeKit services exist today and
+* need no feature-dependent shape. `cover`, `climate`, `fan`, `valve`,
+* `humidifier`, `water-heater`, `button` and `media-player` are deliberately
 * absent — each needs a service whose semantics the table cannot yet honour,
 * and offering the tab before the mapping exists is how an operator gets an
 * accessory that pairs and does nothing.
+*
+* `alarm-panel` is no longer one of them. It maps to `Service.SecuritySystem`
+* (`builders/generic/security-system.ts`), and the two things the table could
+* not previously honour are now honoured explicitly: HomeKit is only ever
+* offered the arm modes the panel accepts, and a panel that requires a PIN
+* refuses the write out loud instead of pretending to arm.
 */
 var HAP_EXPORTABLE_DEVICE_TYPES = [
 	DeviceType.Camera,
@@ -101396,6 +101419,7 @@ var HAP_EXPORTABLE_DEVICE_TYPES = [
 	DeviceType.Sensor,
 	DeviceType.Lock,
 	DeviceType.Presence,
+	DeviceType.AlarmPanel,
 	DeviceType.Generic
 ];
 /**
@@ -101521,17 +101545,17 @@ async function buildCameraAccessory(input) {
 			for (const h of handles) try {
 				await h.dispose();
 			} catch (err) {
-				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$4(err) } });
+				log.debug("export-hap: builder dispose failed (continuing)", { meta: { error: errMsg$5(err) } });
 			}
 			try {
 				await streams.dispose();
 			} catch (err) {
-				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$4(err) } });
+				log.debug("export-hap: streams dispose failed", { meta: { error: errMsg$5(err) } });
 			}
 		}
 	};
 }
-function errMsg$4(err) {
+function errMsg$5(err) {
 	return err instanceof Error ? err.message : String(err);
 }
 //#endregion
@@ -101560,7 +101584,7 @@ function errMsg$4(err) {
 * counterpart on this service and is deliberately not wired — a Switch that
 * silently buzzes a door open would be a second knob nobody asked for.
 */
-var SUBTYPE = "lock-control";
+var SUBTYPE$1 = "lock-control";
 var readLock = reader(LockControlStatusSchema.pick({ state: true }), (status) => {
 	const current = status.state === "locked" ? import_dist.Characteristic.LockCurrentState.SECURED : status.state === "unlocked" ? import_dist.Characteristic.LockCurrentState.UNSECURED : status.state === "jammed" ? import_dist.Characteristic.LockCurrentState.JAMMED : import_dist.Characteristic.LockCurrentState.UNKNOWN;
 	const target = status.state === "locked" || status.state === "locking" ? import_dist.Characteristic.LockTargetState.SECURED : status.state === "unlocked" || status.state === "unlocking" ? import_dist.Characteristic.LockTargetState.UNSECURED : null;
@@ -101576,7 +101600,7 @@ async function buildLockMechanism(bctx) {
 	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
 	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
 	const label = hapServiceName([displayName], `Lock ${numericDeviceId}`);
-	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE);
+	const service = accessory.addService(import_dist.Service.LockMechanism, label, SUBTYPE$1);
 	applyServiceLabel(service, label);
 	const apply = (status, source) => {
 		const updates = readLock(status);
@@ -101590,7 +101614,7 @@ async function buildLockMechanism(bctx) {
 		const status = await proxy.lockControl?.getStatus({});
 		if (status !== void 0 && status !== null) apply(status, "getStatus");
 	} catch (err) {
-		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$3(err) } });
+		log.debug("export-hap: lock getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$4(err) } });
 	}
 	service.getCharacteristic(import_dist.Characteristic.LockTargetState).onSet(async (value) => {
 		const secure = value === import_dist.Characteristic.LockTargetState.SECURED;
@@ -101600,7 +101624,7 @@ async function buildLockMechanism(bctx) {
 		} catch (err) {
 			log.warn("export-hap: lock command failed", { meta: {
 				secure,
-				error: errMsg$3(err)
+				error: errMsg$4(err)
 			} });
 		}
 	});
@@ -101614,6 +101638,296 @@ async function buildLockMechanism(bctx) {
 		} catch {}
 	} };
 }
+function errMsg$4(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/mappers/builders/generic/security-state.ts
+/** Is this a settled arm state worth remembering? */
+function armedMemoOf(state) {
+	return state === "armed_home" || state === "armed_away" || state === "armed_night" || state === "armed_vacation" || state === "armed_custom_bypass" ? state : null;
+}
+function currentForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemCurrentState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemCurrentState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemCurrentState.AWAY_ARM;
+	}
+}
+function targetForArmed(state) {
+	switch (state) {
+		case "armed_home":
+		case "armed_custom_bypass": return import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM;
+		case "armed_night": return import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM;
+		default: return import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM;
+	}
+}
+function securityStateFor(state, memo) {
+	const settled = armedMemoOf(state);
+	if (settled !== null) return {
+		current: currentForArmed(settled),
+		target: targetForArmed(settled)
+	};
+	switch (state) {
+		case "disarmed": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "arming": return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.DISARMED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		case "disarming": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: import_dist.Characteristic.SecuritySystemTargetState.DISARM
+		};
+		case "pending": return {
+			current: memo === null ? import_dist.Characteristic.SecuritySystemCurrentState.DISARMED : currentForArmed(memo),
+			target: memo === null ? null : targetForArmed(memo)
+		};
+		default: return {
+			current: import_dist.Characteristic.SecuritySystemCurrentState.ALARM_TRIGGERED,
+			target: memo === null ? null : targetForArmed(memo)
+		};
+	}
+}
+/**
+* The arm mode behind a HomeKit target, or `null` for DISARM and for anything
+* outside the four values HomeKit defines.
+*
+* `null` is not an error the caller can ignore: DISARM is a different COMMAND,
+* and a value HomeKit never sends is a write this builder refuses to translate.
+*/
+function alarmArmModeFor(target) {
+	switch (target) {
+		case import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM: return "home";
+		case import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM: return "away";
+		case import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM: return "night";
+		default: return null;
+	}
+}
+//#endregion
+//#region src/mappers/builders/generic/security-target.ts
+/**
+* The panel modes behind each HomeKit target, PRIMARY first.
+*
+* The primary is the mode `alarmArmModeFor` names; the secondary is the other
+* mode `security-state.ts` reports through the same HomeKit value, so the two
+* modules agree in both directions by construction.
+*/
+var MODES_BY_TARGET = new Map([
+	[import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM, ["home", "custom_bypass"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM, ["away", "vacation"]],
+	[import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM, ["night"]]
+]);
+/** Arm targets in the order HomeKit numbers them; DISARM is appended last. */
+var ARM_TARGETS = [
+	import_dist.Characteristic.SecuritySystemTargetState.STAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.AWAY_ARM,
+	import_dist.Characteristic.SecuritySystemTargetState.NIGHT_ARM
+];
+/**
+* The `validValues` for `SecuritySystemTargetState`, or `null` to leave
+* HomeKit's own four values in place.
+*
+* DISARM is always present: disarming is not one of the panel's arm modes and
+* a panel that cannot be disarmed is not a thing this cap can express.
+*/
+function targetValidValuesFor(availableModes) {
+	if (availableModes.length === 0) return null;
+	return [...ARM_TARGETS.filter((target) => (MODES_BY_TARGET.get(target) ?? []).some((mode) => availableModes.includes(mode))), import_dist.Characteristic.SecuritySystemTargetState.DISARM];
+}
+/**
+* The arm mode to send for a HomeKit target, or `null` when there is none.
+*
+* `null` is not a shrug the caller may swallow: DISARM is a different command,
+* and an arm target the panel accepts no mode for is a write this module
+* refuses to translate rather than guess at.
+*/
+function armModeForTarget(target, availableModes) {
+	const primary = alarmArmModeFor(target);
+	if (primary === null) return null;
+	if (availableModes.length === 0) return primary;
+	return (MODES_BY_TARGET.get(target) ?? [primary]).find((mode) => availableModes.includes(mode)) ?? null;
+}
+//#endregion
+//#region src/mappers/builders/generic/security-system.ts
+/**
+* `alarm-panel` → `Service.SecuritySystem`.
+*
+* The lock builder's shape (a current/target pair, a hydrate, an `onSet`, a
+* slice subscription, a dispose) applied to the one device on the fleet where
+* reporting a state that is not true has a consequence worse than a stalled
+* motor. The mapping itself is NOT here: `security-state.ts` owns what the
+* panel's state looks like to HomeKit and `security-target.ts` owns what
+* HomeKit may ask for, both pure and both tested on their own. This file is
+* the service around them.
+*
+* ## The memo
+*
+* `pending`, `disarming` and `triggered` do not carry the mode the panel was
+* armed to — only the last settled state knows it. This builder is the caller
+* `security-state.ts` describes: it remembers the last settled arm and forgets
+* it on `disarmed`, because a memo that outlives a disarm makes the next
+* `arming` claim a target nobody asked for.
+*
+* The memo is deliberately NOT seeded from the controller's own write. HomeKit
+* already holds the target the operator just set; not writing it back is
+* exactly right. The cost is a panel armed from its own keypad during an exit
+* delay, where the target stays at whatever HomeKit last knew — a stale target
+* for the length of the delay, against inventing an intent, and the invention
+* is worse.
+*
+* ## `requiresCode`: the arm is REFUSED, not attempted
+*
+* HomeKit's SecuritySystem has no PIN prompt — there is no characteristic for
+* it and no way to ask the operator mid-write. So a panel that requires a code
+* cannot be armed or disarmed from the Home app, and this builder says so
+* twice: the write fails with `INSUFFICIENT_AUTHORIZATION` (iOS renders the
+* tile's failure) and a WARN names the device, the command and the mode.
+*
+* Sending the command code-less and letting the panel reject it was the
+* alternative. It is worse: the refusal costs a round trip, it is
+* indistinguishable from a broken panel in the log, and repeated code-less
+* attempts are what locks a real alarm panel out.
+*/
+var SUBTYPE = "alarm-panel";
+/** The subset of the status this builder reads. */
+var PanelReadSchema = AlarmPanelStatusSchema.pick({
+	state: true,
+	availableModes: true,
+	requiresCode: true
+});
+/**
+* Turn a panel status into characteristic writes, folding the memo.
+*
+* A payload that does not match the cap's own schema yields NO updates and
+* leaves the memo alone — it is a status we could not read, not a panel that
+* changed. The caller logs the drop; a frozen characteristic is otherwise
+* indistinguishable from a quiet panel.
+*/
+function securityUpdatesFor(status, memo) {
+	const parsed = PanelReadSchema.safeParse(status);
+	if (!parsed.success) return {
+		updates: [],
+		memo,
+		panel: null
+	};
+	const nextMemo = parsed.data.state === "disarmed" ? null : armedMemoOf(parsed.data.state) ?? memo;
+	const { current, target } = securityStateFor(parsed.data.state, nextMemo);
+	return {
+		updates: [{
+			characteristic: import_dist.Characteristic.SecuritySystemCurrentState,
+			value: current
+		}, ...target === null ? [] : [{
+			characteristic: import_dist.Characteristic.SecuritySystemTargetState,
+			value: target
+		}]],
+		memo: nextMemo,
+		panel: {
+			availableModes: parsed.data.availableModes,
+			requiresCode: parsed.data.requiresCode
+		}
+	};
+}
+async function buildSecuritySystem(bctx) {
+	const { ctx, accessory, proxy, numericDeviceId, displayName } = bctx;
+	const log = ctx.logger.withTags({ deviceId: numericDeviceId });
+	const label = hapServiceName([displayName], `Alarm ${numericDeviceId}`);
+	const service = accessory.addService(import_dist.Service.SecuritySystem, label, SUBTYPE);
+	applyServiceLabel(service, label);
+	let memo = null;
+	let availableModes = [];
+	let requiresCode = false;
+	/** Only log the `validValues` narrowing when it actually changes. */
+	let lastValidValues = "";
+	const applyValidValues = () => {
+		const validValues = targetValidValuesFor(availableModes);
+		if (validValues === null) {
+			if (lastValidValues !== "unconstrained") {
+				lastValidValues = "unconstrained";
+				log.info("export-hap: alarm panel named no arm modes — leaving HomeKit’s targets unconstrained", { meta: { subtype: SUBTYPE } });
+			}
+			return;
+		}
+		const key = validValues.join(",");
+		if (key === lastValidValues) return;
+		lastValidValues = key;
+		service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).setProps({ validValues: [...validValues] });
+		log.info("export-hap: alarm panel target constrained to the modes it accepts", { meta: {
+			subtype: SUBTYPE,
+			availableModes: [...availableModes],
+			validValues
+		} });
+	};
+	const apply = (status, source) => {
+		const next = securityUpdatesFor(status, memo);
+		if (next.updates.length === 0) {
+			log.debug("export-hap: alarm panel status did not match the cap schema — no update", { meta: {
+				subtype: SUBTYPE,
+				source
+			} });
+			return;
+		}
+		memo = next.memo;
+		if (next.panel !== null) {
+			availableModes = next.panel.availableModes;
+			requiresCode = next.panel.requiresCode;
+			applyValidValues();
+		}
+		applyUpdates(service, next.updates);
+	};
+	try {
+		const status = await proxy.alarmPanel?.getStatus({});
+		if (status !== void 0 && status !== null) apply(status, "getStatus");
+	} catch (err) {
+		log.debug("export-hap: alarm panel getStatus hydrate failed (non-fatal)", { meta: { error: errMsg$3(err) } });
+	}
+	service.getCharacteristic(import_dist.Characteristic.SecuritySystemTargetState).onSet(async (value) => {
+		const target = typeof value === "number" ? value : Number(value);
+		const disarm = target === import_dist.Characteristic.SecuritySystemTargetState.DISARM;
+		const mode = disarm ? null : armModeForTarget(target, availableModes);
+		if (requiresCode) {
+			log.warn("export-hap: alarm panel requires a PIN — HomeKit cannot supply one, command REFUSED", { meta: {
+				subtype: SUBTYPE,
+				command: disarm ? "disarm" : "arm",
+				mode,
+				target
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INSUFFICIENT_AUTHORIZATION);
+		}
+		if (!disarm && mode === null) {
+			log.warn("export-hap: alarm panel cannot honour this HomeKit arm target — REFUSED", { meta: {
+				subtype: SUBTYPE,
+				target,
+				availableModes: [...availableModes]
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.INVALID_VALUE_IN_REQUEST);
+		}
+		try {
+			if (mode === null) await proxy.alarmPanel?.disarm({});
+			else await proxy.alarmPanel?.arm({ mode });
+		} catch (err) {
+			log.warn("export-hap: alarm panel command failed", { meta: {
+				subtype: SUBTYPE,
+				command: mode === null ? "disarm" : "arm",
+				mode,
+				error: errMsg$3(err)
+			} });
+			throw new import_dist.HapStatusError(import_dist.HAPStatus.SERVICE_COMMUNICATION_FAILURE);
+		}
+	});
+	const unsubscribe = proxy.state.alarmPanel?.subscribe((value) => {
+		if (value === void 0 || value === null) return;
+		apply(value, "slice");
+	}) ?? null;
+	return { async dispose() {
+		try {
+			unsubscribe?.();
+		} catch {}
+	} };
+}
 function errMsg$3(err) {
 	return err instanceof Error ? err.message : String(err);
 }
@@ -101688,11 +102002,16 @@ function errMsg$2(err) {
 *
 * ## Tier
 *
-* Tier A only: the caps whose HomeKit service exists today and needs no
-* feature-dependent shape (`cover` needs `cover-positionable`, `climate-control`
-* needs the dual-setpoint split, `alarm-panel` must survive a refused `arm`).
-* Those are a separate task; adding a row here must never mean adding a service
-* whose semantics this file cannot fully honour.
+* Tier A, plus `alarm-panel`: the caps whose HomeKit service exists today and
+* needs no feature-dependent shape. `cover` still needs `cover-positionable`
+* and `climate-control` the dual-setpoint split; those are a separate task,
+* and adding a row here must never mean adding a service whose semantics this
+* file cannot fully honour.
+*
+* `alarm-panel` earned its row by answering the two questions that kept it
+* out: a target the panel would refuse is never offered (`availableModes` →
+* `validValues`, `security-target.ts`) and an arm a PIN-gated panel cannot
+* accept is refused out loud rather than attempted (`security-system.ts`).
 */
 /** HomeKit's floor for `CurrentAmbientLightLevel`; 0 lux is out of range. */
 var MIN_LUX = 1e-4;
@@ -101834,6 +102153,14 @@ var HAP_CAP_SERVICES = [
 			displayName: name
 		})
 	},
+	{
+		caps: ["alarm-panel"],
+		label: "Alarm",
+		build: ({ bctx, name }) => buildSecuritySystem({
+			...bctx,
+			displayName: name
+		})
+	},
 	{
 		caps: ["battery"],
 		label: BATTERY_SPEC.label,
@@ -101871,7 +102198,8 @@ var ACCESSORY_CATEGORY_BY_TYPE = {
 	[DeviceType.Siren]: import_dist.Categories.SWITCH,
 	[DeviceType.Lock]: import_dist.Categories.DOOR_LOCK,
 	[DeviceType.Sensor]: import_dist.Categories.SENSOR,
-	[DeviceType.Presence]: import_dist.Categories.SENSOR
+	[DeviceType.Presence]: import_dist.Categories.SENSOR,
+	[DeviceType.AlarmPanel]: import_dist.Categories.SECURITY_SYSTEM
 };
 function accessoryCategoryFor(deviceType) {
 	return ACCESSORY_CATEGORY_BY_TYPE[deviceType] ?? import_dist.Categories.OTHER;