@camstack/addon-post-analysis 1.2.319 → 1.2.320

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_clip_model_registry = require("../clip-model-registry-BjYpZuuI.js");
+const require_clip_model_registry = require("../clip-model-registry-C_aKxHpy.js");
 let node_fs = require("node:fs");
 node_fs = require_clip_model_registry.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -604,7 +604,19 @@ var ARM_ANYWAY_TTL_MS = 5 * 6e4;
 var NcAlarmOpenDeviceSchema = require_clip_model_registry.object({
 	deviceId: require_clip_model_registry.number().int(),
 	name: require_clip_model_registry.string(),
-	state: require_clip_model_registry.string()
+	state: require_clip_model_registry.string(),
+	/**
+	* Cover / lock / switch — default false so an older bridge answer still
+	* parses as a contact-style opening.
+	*/
+	controllable: require_clip_model_registry.boolean().default(false),
+	/** Opening cap that produced the reading; used to actuate secure-on-arm. */
+	cap: require_clip_model_registry._enum([
+		"contact",
+		"cover",
+		"lock-control",
+		"switch"
+	]).optional()
 }).readonly();
 /** Why an Arm anyway was not honoured — see `NcAlarmPanelDevice.armAnyway`. */
 var NcAlarmArmAnywayRejectionSchema = require_clip_model_registry._enum([
@@ -669,23 +681,22 @@ function alarmCoveredDevices(rules, panelDeviceId, mode) {
 /**
 * Refuse or arm — the whole decision, as one partition of the open devices.
 *
-* A device may be open at arm time for exactly two reasons: the mode TOLERATES
-* it (its non-blocking list), or the operator was shown it in a refusal and
-* pressed that refusal's Arm anyway (`acknowledged`). Anything else open
-* refuses — including a device that opened AFTER the refusal the operator is
-* confirming: they were never shown it, and excluding it would arm the alarm
-* around an opening nobody agreed to.
+* A device may be open at arm time when:
+*  - the mode TOLERATES it (`nonBlocking` for contacts),
+*  - it is controllable and NOT on the mode's `blocking` list (default),
+*  - or the operator confirmed it with Arm anyway (`acknowledged`).
 *
-* There is no memory here. A plain arm pressed twice is the same question
-* twice and gets the same answer; the only way past a refusal is the explicit
-* Arm anyway, whose lifecycle (one-shot, stale, expired) the panel owns.
+* Anything else open refuses — including a device that opened AFTER the refusal
+* the operator is confirming.
 *
 * Excluded is EVERY open device — tolerated and acknowledged alike — and the
 * exclusion is two-phase (`alarm-exclusions.ts`): each one is watched again
 * once it has closed and opened.
 */
 function decideArm(input) {
+	const forceBlock = new Set(input.blocking ?? []);
 	const tolerated = new Set([...input.nonBlocking, ...input.acknowledged ?? []]);
+	for (const d of input.open) if (d.controllable && !forceBlock.has(d.deviceId)) tolerated.add(d.deviceId);
 	const blocking = input.open.filter((d) => !tolerated.has(d.deviceId));
 	if (blocking.length > 0) return {
 		kind: "refused",
@@ -1073,39 +1084,24 @@ var NcActionPlane = class {
 * and never open):
 *
 *  - `not-opening` — no opening slice at all: a camera named by an intrusion
-*    rule, a switch. It takes no part in the arm decision.
+*    rule. It takes no part in the arm decision.
 *  - `unknown` — an opening cap's slice IS there, but its field is missing or
 *    is not a word that cap defines, or the slice is a provider's PLACEHOLDER
-*    (`lastChangedAt === 0`: written by a constructor before anybody read the
-*    device — an HA lock's `unlocked`, an HA cover's `closed`, a binary
-*    sensor's `entryOpen: false`). It carries the cap and the raw value (for a
-*    placeholder, the whole slice) so the caller's log line can say what it
-*    saw. It never blocks and is never armed as secure on a guess — and a
-*    placeholder is never taken for a state, so neither the reconcile tick,
-*    the arm check nor an exclusion lift acts on one.
-*  - `reading` — open or secure, with the state word a person will read.
-*    ANY non-zero `lastChangedAt` is a reading, however old — including `1`,
-*    the stamp a provider writes on a value it REPLAYED after a respawn with
-*    no upstream change time (Homematic `HM_SEEDED_CHANGED_AT`): the value is
-*    known, only its change time is not. The transition gate
-*    (`sensor-transition-gate.ts`, "A placeholder slice is not a state") reads
-*    the same stamp as "not a fresh event"; `0` alone means "not read yet".
+*    (`lastChangedAt === 0`). It never blocks and is never armed as secure on a
+*    guess.
+*  - `reading` — open or secure, with the state word a person will read and the
+*    cap that produced it (so secure-on-arm knows what to actuate).
 *
 * A read that FAILED never reaches {@link alarmOpeningFrom}: the caller leaves
 * that id out of its answer (see {@link readAlarmOpenings}).
 *
 * Anything short of fully secure is open: a cover stopped half-way, a lock that
-* jammed, a cover still closing when the arm is decided.
+* jammed, a cover still closing when the arm is decided, a switch that is on.
 *
 * PRECEDENCE, when one device carries more than one opening slice: `contact`
-* first, then `cover`, then `lock-control`. The contact is the physical truth
-* about the opening — a reed switch on the frame says the window is open even
-* when the motor's last reported word says `closed`. A slice that cannot be
-* read falls through to the next; only when none of them reads is the device
-* `unknown`, naming the first unreadable cap.
-*
-* The vocabulary of each word is its cap's own schema (`CoverStateSchema`,
-* `LockStateSchema`) — a word the cap does not define is not guessed at.
+* first, then `cover`, then `lock-control`, then `switch`. The contact is the
+* physical truth about the opening — a reed switch on the frame says the window
+* is open even when the motor's last reported word says `closed`.
 */
 /** The one state word, per cap, that counts as secure. Everything else is open. */
 var COVER_SECURE = "closed";
@@ -1124,11 +1120,12 @@ function fieldOf(slice, field) {
 function isPlaceholder(slice) {
 	return fieldOf(slice, "lastChangedAt") === 0;
 }
-function reading(word, secure) {
+function reading(word, secure, cap) {
 	return {
 		kind: "reading",
 		reading: word === secure ? "secure" : "open",
-		state: word
+		state: word,
+		cap
 	};
 }
 function readContact(runtime) {
@@ -1148,11 +1145,13 @@ function readContact(runtime) {
 	return raw ? {
 		kind: "reading",
 		reading: "open",
-		state: "open"
+		state: "open",
+		cap: "contact"
 	} : {
 		kind: "reading",
 		reading: "secure",
-		state: "closed"
+		state: "closed",
+		cap: "contact"
 	};
 }
 function readCover(runtime) {
@@ -1165,7 +1164,7 @@ function readCover(runtime) {
 	};
 	const raw = fieldOf(slice, "state");
 	const parsed = require_clip_model_registry.CoverStateSchema.safeParse(raw);
-	return parsed.success ? reading(parsed.data, COVER_SECURE) : {
+	return parsed.success ? reading(parsed.data, COVER_SECURE, "cover") : {
 		kind: "unknown",
 		cap: "cover",
 		raw
@@ -1181,19 +1180,46 @@ function readLock(runtime) {
 	};
 	const raw = fieldOf(slice, "state");
 	const parsed = require_clip_model_registry.LockStateSchema.safeParse(raw);
-	return parsed.success ? reading(parsed.data, LOCK_SECURE) : {
+	return parsed.success ? reading(parsed.data, LOCK_SECURE, "lock-control") : {
 		kind: "unknown",
 		cap: "lock-control",
 		raw
 	};
 }
+function readSwitch(runtime) {
+	const slice = sliceOf(runtime, "switch");
+	if (slice === void 0) return { kind: "absent" };
+	if (isPlaceholder(slice)) return {
+		kind: "unknown",
+		cap: "switch",
+		raw: slice
+	};
+	const raw = fieldOf(slice, "on");
+	if (typeof raw !== "boolean") return {
+		kind: "unknown",
+		cap: "switch",
+		raw
+	};
+	return raw ? {
+		kind: "reading",
+		reading: "open",
+		state: "on",
+		cap: "switch"
+	} : {
+		kind: "reading",
+		reading: "secure",
+		state: "off",
+		cap: "switch"
+	};
+}
 /** D630's table over one device's runtime slices — see the header for the three answers. */
 function alarmOpeningFrom(runtime) {
 	let firstUnknown = null;
 	for (const read of [
 		readContact(runtime),
 		readCover(runtime),
-		readLock(runtime)
+		readLock(runtime),
+		readSwitch(runtime)
 	]) {
 		if (read.kind === "reading") return read;
 		if (read.kind === "unknown" && firstUnknown === null) firstUnknown = read;
@@ -1208,13 +1234,14 @@ function alarmOpeningFrom(runtime) {
 var OPENING_CAP_BY_EVENT_KIND = {
 	contact: "contact",
 	cover: "cover",
-	lock: "lock-control"
+	lock: "lock-control",
+	switch: "switch"
 };
 /**
 * The same table, read off one sensor-event row: its `value` IS the slice of
 * the cap its `kind` names, so the event path and the reconcile read answer in
 * one vocabulary — a cover is secure only when `closed`, a lock only when
-* `locked`, whichever path saw it.
+* `locked`, a switch only when off, whichever path saw it.
 */
 function alarmOpeningFromSensorEvent(kind, value) {
 	const cap = OPENING_CAP_BY_EVENT_KIND[kind];
@@ -1235,7 +1262,9 @@ function classifyCoveredOpening(opening) {
 	if (opening.kind === "not-opening" || opening.reading !== "open") return { kind: "skip" };
 	return {
 		kind: "open",
-		state: opening.state
+		state: opening.state,
+		controllable: require_clip_model_registry.isAlarmControllableCap(opening.cap),
+		cap: opening.cap
 	};
 }
 /**
@@ -1892,6 +1921,22 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
 	})).default([]),
 	/**
+	* Controllable openings that DO block when open (opt-in). Loose + guarded like
+	* {@link nonBlocking}.
+	*/
+	blocking: require_clip_model_registry.array(require_clip_model_registry.object({
+		mode: require_clip_model_registry.string(),
+		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
+	})).default([]),
+	/**
+	* Controllable openings that must NOT secure on arm (opt-out). Loose + guarded
+	* like {@link nonBlocking}.
+	*/
+	secureOnArmOff: require_clip_model_registry.array(require_clip_model_registry.object({
+		mode: require_clip_model_registry.string(),
+		deviceIds: require_clip_model_registry.array(require_clip_model_registry.number().int())
+	})).default([]),
+	/**
 	* Per arm mode, the delays that override the global ones (D697). Loose on purpose — `mode` is
 	* a string and the numbers are unbounded here — and read back through
 	* {@link modeDelaysFromPersisted}, never a cast: an entry this release cannot trust is dropped
@@ -1910,7 +1955,7 @@ var ncAlarmPanelSchema = require_clip_model_registry.object({
 * per mode kept — the same "at most one list per mode" the settings schema
 * enforces at the boundary. A type guard (`safeParse`), never a cast.
 */
-function nonBlockingFromPersisted(raw) {
+function modeDeviceListFromPersisted(raw) {
 	const seen = /* @__PURE__ */ new Set();
 	const lists = [];
 	for (const entry of raw) {
@@ -2015,7 +2060,9 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			...this.readDelays(),
 			announceArm: this.config.get("announceArm"),
 			announceTargets: [...this.config.get("announceTargets")],
-			nonBlocking: nonBlockingFromPersisted(this.config.get("nonBlocking")),
+			nonBlocking: modeDeviceListFromPersisted(this.config.get("nonBlocking")),
+			blocking: modeDeviceListFromPersisted(this.config.get("blocking")),
+			secureOnArmOff: modeDeviceListFromPersisted(this.config.get("secureOnArmOff")),
 			modeDelays: modeDelaysFromPersisted(this.config.get("modeDelays")).entries
 		};
 	}
@@ -2042,30 +2089,73 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	async applySettings(patch) {
 		const edits = patch.modeDelays ?? [];
 		const membership = patch.nonBlockingEdit;
+		const blockingEdit = patch.blockingEdit;
+		const secureEdit = patch.secureOnArmEdit;
 		for (const edit of edits) this.refuseUnofferedMode(edit.mode);
 		if (membership !== void 0) {
 			this.refuseUnofferedMode(membership.mode, membership.deviceId);
-			const verdict = require_clip_model_registry.applyNonBlockingEdit(patch.nonBlocking !== void 0 ? patch.nonBlocking : nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			const verdict = require_clip_model_registry.applyNonBlockingEdit(patch.nonBlocking !== void 0 ? patch.nonBlocking : modeDeviceListFromPersisted(this.config.get("nonBlocking")), membership);
 			if (verdict.kind === "refused") {
 				this.ctx.logger.info("alarm settings refused", {
 					tags: { deviceId: membership.deviceId },
 					meta: {
 						panelId: this.id,
 						reason: "list-full",
-						mode: verdict.mode
+						mode: verdict.mode,
+						list: "nonBlocking"
 					}
 				});
 				throw new Error(`the ${verdict.mode} non-blocking list already holds ${verdict.max} devices — remove one first`);
 			}
 		}
+		if (blockingEdit !== void 0) {
+			this.refuseUnofferedMode(blockingEdit.mode, blockingEdit.deviceId);
+			const verdict = require_clip_model_registry.applyBlockingEdit(patch.blocking !== void 0 ? patch.blocking : modeDeviceListFromPersisted(this.config.get("blocking")), blockingEdit);
+			if (verdict.kind === "refused") {
+				this.ctx.logger.info("alarm settings refused", {
+					tags: { deviceId: blockingEdit.deviceId },
+					meta: {
+						panelId: this.id,
+						reason: "list-full",
+						mode: verdict.mode,
+						list: "blocking"
+					}
+				});
+				throw new Error(`the ${verdict.mode} blocking list already holds ${verdict.max} devices — remove one first`);
+			}
+		}
+		if (secureEdit !== void 0) {
+			this.refuseUnofferedMode(secureEdit.mode, secureEdit.deviceId);
+			const verdict = require_clip_model_registry.applySecureOnArmEdit(patch.secureOnArmOff !== void 0 ? patch.secureOnArmOff : modeDeviceListFromPersisted(this.config.get("secureOnArmOff")), secureEdit);
+			if (verdict.kind === "refused") {
+				this.ctx.logger.info("alarm settings refused", {
+					tags: { deviceId: secureEdit.deviceId },
+					meta: {
+						panelId: this.id,
+						reason: "list-full",
+						mode: verdict.mode,
+						list: "secureOnArmOff"
+					}
+				});
+				throw new Error(`the ${verdict.mode} secure-on-arm-off list already holds ${verdict.max} devices — remove one first`);
+			}
+		}
 		const listWrites = [];
 		if (patch.nonBlocking !== void 0) listWrites.push(this.config.set("nonBlocking", patch.nonBlocking.map((l) => ({
 			mode: l.mode,
 			deviceIds: [...l.deviceIds]
 		}))));
+		if (patch.blocking !== void 0) listWrites.push(this.config.set("blocking", patch.blocking.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		}))));
+		if (patch.secureOnArmOff !== void 0) listWrites.push(this.config.set("secureOnArmOff", patch.secureOnArmOff.map((l) => ({
+			mode: l.mode,
+			deviceIds: [...l.deviceIds]
+		}))));
 		let membershipChanged = null;
 		if (membership !== void 0) {
-			const result = require_clip_model_registry.applyNonBlockingEdit(nonBlockingFromPersisted(this.config.get("nonBlocking")), membership);
+			const result = require_clip_model_registry.applyNonBlockingEdit(modeDeviceListFromPersisted(this.config.get("nonBlocking")), membership);
 			if (result.kind === "applied") {
 				membershipChanged = result.changed;
 				if (result.changed) listWrites.push(this.config.set("nonBlocking", result.lists.map((l) => ({
@@ -2074,6 +2164,26 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 				}))));
 			}
 		}
+		if (blockingEdit !== void 0) {
+			const result = require_clip_model_registry.applyBlockingEdit(modeDeviceListFromPersisted(this.config.get("blocking")), blockingEdit);
+			if (result.kind === "applied" && result.changed) {
+				membershipChanged = true;
+				listWrites.push(this.config.set("blocking", result.lists.map((l) => ({
+					mode: l.mode,
+					deviceIds: [...l.deviceIds]
+				}))));
+			}
+		}
+		if (secureEdit !== void 0) {
+			const result = require_clip_model_registry.applySecureOnArmEdit(modeDeviceListFromPersisted(this.config.get("secureOnArmOff")), secureEdit);
+			if (result.kind === "applied" && result.changed) {
+				membershipChanged = true;
+				listWrites.push(this.config.set("secureOnArmOff", result.lists.map((l) => ({
+					mode: l.mode,
+					deviceIds: [...l.deviceIds]
+				}))));
+			}
+		}
 		const persistedDelays = modeDelaysFromPersisted(this.config.get("modeDelays"));
 		const beforeDelays = persistedDelays.entries;
 		const afterDelays = edits.length > 0 ? require_clip_model_registry.applyModeDelaysEdits(beforeDelays, edits) : beforeDelays;
@@ -2212,7 +2322,7 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 		if (read.verdict.kind === "refused") return this.refuse(mode, read.verdict.blocking, now);
 		return this.settleArm(mode, read.verdict.excluded.map((device) => ({
 			device,
-			why: "non-blocking"
+			why: this.exclusionWhyFor(mode, device)
 		})), now);
 	}
 	/**
@@ -2261,12 +2371,14 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 			return outcome;
 		}
 		const tolerated = this.nonBlockingFor(held.mode);
+		const forceBlock = this.blockingFor(held.mode);
 		const unknown = new Set(read.openings.unknown);
 		if (read.verdict.kind === "refused") {
 			const plain = decideArm({
 				mode: held.mode,
 				open: read.openings.open,
-				nonBlocking: tolerated
+				nonBlocking: tolerated,
+				blocking: forceBlock
 			});
 			const blockingNow = plain.kind === "refused" ? plain.blocking : read.verdict.blocking;
 			const shownIds = new Set(blockingNow.map((d) => d.deviceId));
@@ -2396,10 +2508,17 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 				error: String(err)
 			};
 		}
+		const toSecure = openings.open.filter((d) => require_clip_model_registry.alarmDeviceSecureOnArm({
+			controllable: d.controllable,
+			deviceId: d.deviceId,
+			secureOnArmOff: this.secureOnArmOffFor(mode)
+		}));
+		if (toSecure.length > 0) this.armGuard?.secureOnArm(toSecure);
 		const verdict = decideArm({
 			mode,
 			open: openings.open,
 			nonBlocking: this.nonBlockingFor(mode),
+			blocking: this.blockingFor(mode),
 			...acknowledged !== void 0 ? { acknowledged } : {}
 		});
 		return {
@@ -2424,7 +2543,28 @@ var NcAlarmPanelDevice = class extends require_clip_model_registry.BaseDevice {
 	}
 	/** This mode's non-blocking ids, from the persisted lists. */
 	nonBlockingFor(mode) {
-		return nonBlockingFromPersisted(this.config.get("nonBlocking")).find((l) => l.mode === mode)?.deviceIds ?? [];
+		return this.modeListIds("nonBlocking", mode);
+	}
+	/** Controllable openings that force-block when open. */
+	blockingFor(mode) {
+		return this.modeListIds("blocking", mode);
+	}
+	/** Controllable openings that opt out of secure-on-arm. */
+	secureOnArmOffFor(mode) {
+		return this.modeListIds("secureOnArmOff", mode);
+	}
+	modeListIds(key, mode) {
+		return modeDeviceListFromPersisted(this.config.get(key)).find((l) => l.mode === mode)?.deviceIds ?? [];
+	}
+	/** Why an open device was armed around on a plain (non–Arm-anyway) arm. */
+	exclusionWhyFor(mode, device) {
+		if (this.nonBlockingFor(mode).includes(device.deviceId)) return "non-blocking";
+		if (require_clip_model_registry.alarmDeviceSecureOnArm({
+			controllable: device.controllable,
+			deviceId: device.deviceId,
+			secureOnArmOff: this.secureOnArmOffFor(mode)
+		})) return "secure-on-arm";
+		return "non-blocking";
 	}
 	/**
 	* Arm, with these exclusions.
@@ -8618,6 +8758,7 @@ function sameWord(a, b) {
 * therefore moves the table with the arm.
 */
 function alarmSensorStateOf(deviceId, opening, online) {
+	const controllable = opening?.kind === "reading" ? require_clip_model_registry.isAlarmControllableCap(opening.cap) : false;
 	const verdict = classifyCoveredOpening(opening);
 	switch (verdict.kind) {
 		case "unknown": return {
@@ -8625,27 +8766,31 @@ function alarmSensorStateOf(deviceId, opening, online) {
 			reading: "unknown",
 			state: null,
 			unknownWhy: verdict.why,
-			online
+			online,
+			controllable
 		};
 		case "open": return {
 			deviceId,
 			reading: "open",
 			state: verdict.state,
 			unknownWhy: null,
-			online
+			online,
+			controllable: verdict.controllable
 		};
 		case "skip": return opening?.kind === "reading" ? {
 			deviceId,
 			reading: "closed",
 			state: opening.state,
 			unknownWhy: null,
-			online
+			online,
+			controllable
 		} : {
 			deviceId,
 			reading: "not-opening",
 			state: null,
 			unknownWhy: null,
-			online
+			online,
+			controllable: false
 		};
 	}
 }
@@ -20009,19 +20154,39 @@ function planSummaryDevices(rule, isDead, guard) {
 		notes: notes.notes
 	};
 }
+function stripDeadFromLists(lists, isDead) {
+	const dead = lists.flatMap((list) => list.deviceIds.filter(isDead));
+	if (dead.length === 0) return {
+		next: lists,
+		dead
+	};
+	return {
+		dead,
+		next: lists.map((list) => ({
+			...list,
+			deviceIds: list.deviceIds.filter((id) => !isDead(id))
+		}))
+	};
+}
 function planAlarmDevices(alarm, isDead) {
 	if (alarm === null) return null;
-	const nonBlockingDead = alarm.nonBlocking.flatMap((list) => list.deviceIds.filter(isDead));
-	const touched = nonBlockingDead.length > 0;
+	const nonBlocking = stripDeadFromLists(alarm.nonBlocking, isDead);
+	const blocking = stripDeadFromLists(alarm.blocking, isDead);
+	const secureOnArmOff = stripDeadFromLists(alarm.secureOnArmOff, isDead);
 	const forgetExcluded = alarm.excluded.filter(isDead);
-	if (!touched && forgetExcluded.length === 0) return null;
+	const deadIds = [
+		...nonBlocking.dead,
+		...blocking.dead,
+		...secureOnArmOff.dead,
+		...forgetExcluded
+	];
+	if (deadIds.length === 0) return null;
 	return {
-		dropped: deviceSubjects([...new Set([...nonBlockingDead, ...forgetExcluded])]),
+		dropped: deviceSubjects([...new Set(deadIds)]),
 		droppedKind: "device",
-		...touched ? { nonBlocking: alarm.nonBlocking.map((list) => ({
-			...list,
-			deviceIds: list.deviceIds.filter((id) => !isDead(id))
-		})) } : {},
+		...nonBlocking.dead.length > 0 ? { nonBlocking: nonBlocking.next } : {},
+		...blocking.dead.length > 0 ? { blocking: blocking.next } : {},
+		...secureOnArmOff.dead.length > 0 ? { secureOnArmOff: secureOnArmOff.next } : {},
 		forgetExcluded
 	};
 }
@@ -20063,6 +20228,8 @@ function referencedDeviceIds(snapshot) {
 	for (const rule of snapshot.timelapse) add(rule.deviceIds);
 	for (const rule of snapshot.summary) add(rule.deviceIds);
 	for (const list of snapshot.alarm?.nonBlocking ?? []) add(list.deviceIds);
+	for (const list of snapshot.alarm?.blocking ?? []) add(list.deviceIds);
+	for (const list of snapshot.alarm?.secureOnArmOff ?? []) add(list.deviceIds);
 	add(snapshot.alarm?.excluded);
 	add(snapshot.mutedDeviceIds);
 	return ids;
@@ -20407,6 +20574,8 @@ var NcDeletedSubjectPruner = class {
 			summary: this.writable("summary", this.deps.summary.list()),
 			alarm: panel !== null && settings !== void 0 ? {
 				nonBlocking: settings.nonBlocking,
+				blocking: settings.blocking,
+				secureOnArmOff: settings.secureOnArmOff,
 				announceTargets: settings.announceTargets,
 				excluded: panel.excludedDevices()
 			} : null,
@@ -20563,6 +20732,8 @@ var NcDeletedSubjectPruner = class {
 			...NO_SNAPSHOT,
 			alarm: {
 				nonBlocking: settings.nonBlocking,
+				blocking: settings.blocking,
+				secureOnArmOff: settings.secureOnArmOff,
 				announceTargets: settings.announceTargets,
 				excluded: panel.excludedDevices()
 			}
@@ -20571,6 +20742,8 @@ var NcDeletedSubjectPruner = class {
 		try {
 			const patch = {
 				...edit.nonBlocking !== void 0 ? { nonBlocking: edit.nonBlocking } : {},
+				...edit.blocking !== void 0 ? { blocking: edit.blocking } : {},
+				...edit.secureOnArmOff !== void 0 ? { secureOnArmOff: edit.secureOnArmOff } : {},
 				...edit.announceTargets !== void 0 ? { announceTargets: [...edit.announceTargets] } : {}
 			};
 			if (Object.keys(patch).length > 0) await panel.applySettings(patch);
@@ -35573,6 +35746,8 @@ var NC_ALARM_SETTINGS_FALLBACK = {
 	...DEFAULT_DELAYS,
 	announceTargets: [],
 	nonBlocking: [],
+	blocking: [],
+	secureOnArmOff: [],
 	modeDelays: []
 };
 /**
@@ -38577,6 +38752,9 @@ var NotificationCenter = class {
 	alarmArmGuard() {
 		return {
 			openings: (mode) => this.alarmOpenings(mode),
+			secureOnArm: (devices) => {
+				this.secureDevicesOnArm(devices);
+			},
 			announceRefusal: (input) => this.announceArmRefused(input),
 			announceCheckFailed: (input) => this.announceArmCheckFailed(input)
 		};
@@ -38643,7 +38821,9 @@ var NotificationCenter = class {
 			if (verdict.kind === "open") open.push({
 				deviceId,
 				name: name(deviceId),
-				state: verdict.state
+				state: verdict.state,
+				controllable: verdict.controllable,
+				cap: verdict.cap
 			});
 		}
 		this.logger.info("alarm arm check", {
@@ -38662,6 +38842,47 @@ var NotificationCenter = class {
 		};
 	}
 	/**
+	* Fire-and-forget secure actuation for controllable openings on arm.
+	* Failures are WARN per device — they never refuse the arm.
+	*/
+	async secureDevicesOnArm(devices) {
+		for (const device of devices) {
+			const actuation = device.cap !== void 0 ? require_clip_model_registry.secureActuationFor(device.cap) : null;
+			if (actuation === null) continue;
+			try {
+				await this.actuateWithAttribution({
+					deviceId: device.deviceId,
+					cap: actuation.cap,
+					method: actuation.method,
+					args: {
+						deviceId: device.deviceId,
+						...actuation.args
+					}
+				});
+				this.logger.info("alarm secure-on-arm actuated", {
+					tags: { deviceId: device.deviceId },
+					meta: {
+						name: device.name,
+						state: device.state,
+						cap: actuation.cap,
+						method: actuation.method
+					}
+				});
+			} catch (err) {
+				this.logger.warn("alarm secure-on-arm actuation failed — arm continues", {
+					tags: { deviceId: device.deviceId },
+					meta: {
+						name: device.name,
+						state: device.state,
+						cap: actuation.cap,
+						method: actuation.method,
+						error: String(err)
+					}
+				});
+			}
+		}
+	}
+	/**
 	* The refusal, as an ordinary notification.
 	*
 	* Same path every alarm announcement takes (D126: the alarm speaks through