@camstack/addon-post-analysis 1.2.33 → 1.2.35

package/dist/pipeline-analytics/index.js

@@ -2,13 +2,216 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-DPAMoN4x.js");
+const require_dist = require("../dist-Cmb3B0Ij.js");
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 node_path = require_dist.__toESM(node_path);
 let node_crypto = require("node:crypto");
 let sharp = require("sharp");
 sharp = require_dist.__toESM(sharp);
+//#region src/notification-center/action-token.ts
+/**
+* The authority behind a notification button.
+*
+* **Read this before changing anything here.** A button's URL travels through
+* third-party infrastructure — ntfy's server, a push relay, whatever forwarded
+* the message — and is therefore exactly as public as the notification is. The
+* operator decided (2026-08-05) that the token ALONE authorises the action:
+* there is no session check, and a tap does not identify who tapped. Whoever
+* holds the link can run that one action. [D47](../../../../docs/decisions/adr-0047.md).
+*
+* Everything in this file exists to bound that blast radius, since the
+* authorisation model does not:
+*
+*  - **One token, one action, one notification.** The record carries the rule,
+*    the sequence and the device, so a token cannot be re-pointed at anything
+*    else. There is no "run arbitrary sequence" shape to abuse.
+*  - **Single use, claimed ATOMICALLY.** `claim()` is the only way to read a
+*    record and it marks it spent in the same synchronous step, so two taps
+*    arriving together cannot both open a gate. This is why the registry is a
+*    plain in-process Map and not the settings store: a read-then-write across
+*    an async store is a race that a physical actuator would pay for.
+*  - **Short-lived, and the expiry is a COMPARISON, not a sweeper.** A reaper
+*    that failed would leave tokens live indefinitely — the same reasoning the
+*    snooze policy is built on. The sweep here only reclaims memory.
+*  - **In-memory is deliberate.** Tokens do not survive a hub restart, so a
+*    link can never outlive the process that minted it. The cost is real and
+*    accepted: a deploy kills the buttons on notifications already delivered,
+*    which with a short TTL were nearly dead anyway.
+*/
+/** Sign `(id, exp)` — the exact string the verifier recomputes. Same shape as
+*  the artifact plane's, deliberately: one signing convention in this addon. */
+function signActionToken(secret, id, expMs) {
+	return (0, node_crypto.createHmac)("sha256", secret).update(`act:${id}:${expMs}`).digest("hex");
+}
+/**
+* Verify a callback's `(id, exp, sig)`.
+*
+* Constant-time on the signature so a public route cannot be probed for it byte
+* by byte, and expiry-checked BEFORE the compare so an expired link is refused
+* even when its signature is perfect.
+*/
+function verifyActionSignature(input) {
+	if (!Number.isFinite(input.exp) || input.exp <= input.nowMs) return false;
+	const expected = signActionToken(input.secret, input.id, input.exp);
+	const a = Buffer.from(expected, "utf8");
+	const b = Buffer.from(input.sig, "utf8");
+	if (a.length !== b.length) return false;
+	return (0, node_crypto.timingSafeEqual)(a, b);
+}
+/** Build the fully-qualified, signed callback URL for one button. */
+function buildActionUrl(input) {
+	const sig = signActionToken(input.secret, input.id, input.expMs);
+	return `${input.baseUrl.endsWith("/") ? input.baseUrl.slice(0, -1) : input.baseUrl}${input.routePrefix.startsWith("/") ? input.routePrefix : `/${input.routePrefix}`}/${encodeURIComponent(input.id)}?exp=${input.expMs}&sig=${sig}`;
+}
+/**
+* How long a button stays live.
+*
+* Fifteen minutes, not the artifact plane's 24 h. An image link is a read; this
+* one moves something physical, and the window is the only thing limiting who
+* can use a forwarded notification. An operator who wakes hours later opens the
+* app — the button was never the path for that.
+*/
+var DEFAULT_ACTION_TTL_MS = 15 * 6e4;
+var NcActionTokenRegistry = class {
+	grants = /* @__PURE__ */ new Map();
+	now;
+	constructor(now) {
+		this.now = now ?? (() => Date.now());
+	}
+	/** Register a freshly minted grant. The caller owns id generation (it needs
+	*  the id to build the URL before the record exists). */
+	put(grant) {
+		this.grants.set(grant.id, {
+			grant,
+			used: false
+		});
+	}
+	/**
+	* Take the grant, once.
+	*
+	* Synchronous and mutating in one step ON PURPOSE — see the header. Anything
+	* that awaited between the read and the mark would let two taps through, and
+	* the thing on the other end is a lock or a gate.
+	*/
+	claim(id) {
+		const found = this.grants.get(id);
+		if (found === void 0) return {
+			ok: false,
+			reason: "unknown"
+		};
+		if (found.used) return {
+			ok: false,
+			reason: "already-used"
+		};
+		if (found.grant.expiresAt <= this.now()) return {
+			ok: false,
+			reason: "expired"
+		};
+		found.used = true;
+		return {
+			ok: true,
+			grant: found.grant
+		};
+	}
+	/** Drop records that can no longer be claimed. Memory hygiene only — an
+	*  expired record is already refused by {@link claim}, so a sweep that never
+	*  ran would cost bytes, never safety. */
+	sweep() {
+		const now = this.now();
+		let removed = 0;
+		for (const [id, entry] of this.grants) if (entry.used || entry.grant.expiresAt <= now) {
+			this.grants.delete(id);
+			removed += 1;
+		}
+		return removed;
+	}
+	/** Live (unclaimed, unexpired) token count — for the log line that tells an
+	*  operator whether buttons are actually being minted. */
+	get liveCount() {
+		const now = this.now();
+		let n = 0;
+		for (const entry of this.grants.values()) if (!entry.used && entry.grant.expiresAt > now) n += 1;
+		return n;
+	}
+};
+//#endregion
+//#region src/notification-center/action-plane.ts
+/** What the human standing in front of the page is told. */
+var FAILURE_COPY = {
+	unknown: "This button is no longer available.",
+	expired: "This button has expired. Open CamStack to do it there.",
+	"already-used": "Already done — this button had been used."
+};
+function page(title, detail) {
+	return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><style>body{font:16px/1.5 system-ui,sans-serif;margin:0;min-height:100vh;display:grid;place-items:center;background:#111;color:#eee}main{max-width:24rem;padding:2rem;text-align:center}h1{font-size:1.25rem;margin:0 0 .5rem}p{margin:0;color:#aaa}</style><main><h1>${title}</h1><p>${detail}</p></main>`;
+}
+var NcActionPlane = class {
+	deps;
+	now;
+	constructor(deps) {
+		this.deps = deps;
+		this.now = deps.now ?? (() => Date.now());
+	}
+	handler = async (req, res) => {
+		const url = new URL(req.url ?? "/", "http://placeholder");
+		const id = decodeURIComponent(url.pathname.split("/").filter(Boolean).pop() ?? "");
+		if (!verifyActionSignature({
+			secret: this.deps.secret,
+			id,
+			exp: Number(url.searchParams.get("exp")),
+			sig: url.searchParams.get("sig") ?? "",
+			nowMs: this.now()
+		})) {
+			this.deps.logger.warn("nc action callback refused — bad or expired signature", { meta: { id } });
+			this.send(res, 404, page("Not found", "This link is not valid."));
+			return;
+		}
+		const claim = this.deps.registry.claim(id);
+		if (!claim.ok) {
+			this.deps.logger.info("nc action callback not claimable", { meta: {
+				id,
+				reason: claim.reason
+			} });
+			this.send(res, 200, page("Nothing to do", FAILURE_COPY[claim.reason]));
+			return;
+		}
+		const grant = claim.grant;
+		try {
+			await this.deps.run(grant);
+			this.deps.logger.info("nc action ran from a notification button", {
+				tags: { deviceId: grant.deviceId },
+				meta: {
+					ruleId: grant.ruleId,
+					rule: grant.ruleName,
+					sequence: grant.sequence,
+					action: grant.actionId,
+					targetId: grant.targetId ?? null
+				}
+			});
+			this.send(res, 200, page("Done", `${grant.ruleName} — ${grant.sequence}`));
+		} catch (err) {
+			this.deps.logger.warn("nc action failed after the token was spent", {
+				tags: { deviceId: grant.deviceId },
+				meta: {
+					ruleId: grant.ruleId,
+					sequence: grant.sequence,
+					action: grant.actionId,
+					error: String(err)
+				}
+			});
+			this.send(res, 200, page("It did not work", "The action failed and this button is now spent. Open CamStack."));
+		}
+	};
+	send(res, status, html) {
+		res.writeHead(status, {
+			"content-type": "text/html; charset=utf-8",
+			"cache-control": "no-store"
+		});
+		res.end(html);
+	}
+};
+//#endregion
 //#region src/notification-center/artifact-url.ts
 /**
 * Signed, externally-reachable URLs for notification artifacts.
@@ -347,7 +550,132 @@ function mimeFromExtension(file) {
 	return "application/octet-stream";
 }
 //#endregion
+//#region src/notification-center/alarm/alarm-mode-coverage.ts
+/**
+* Whether the panel just BECAME armed, in the sense a person means.
+*
+* Two transitions reach an `armed_*` state and only one of them is an arm:
+*
+*  - `arming`/`disarmed` → `armed_away` is somebody arming the alarm. Announce.
+*  - `triggered` → `armed_away` is the siren's duration ending and the panel
+*    re-arming itself. Announcing it would send "Away armed" in the middle of
+*    a break-in, seconds after the alarm notification, saying nothing new.
+*
+* `armed_home` → `armed_away` IS an arm: the operator changed mode, and the
+* set of devices covered just changed with it — which is the whole content of
+* the message.
+*
+* A null `previous` is the FIRST publish and never announces. A hub restarting
+* while armed re-publishes `armed_away`, and nobody armed anything — every
+* deploy would otherwise send one. Handled here rather than by the caller
+* happening to wire the hook late, because "it works because of the order two
+* unrelated things run in" is how this stops working.
+*/
+function shouldAnnounceArm(previous, next) {
+	if (previous === null) return false;
+	if (!next.startsWith("armed_")) return false;
+	if (previous === next) return false;
+	if (previous === "triggered") return false;
+	return true;
+}
+/** The mode inside an `armed_<mode>` state, or null for any other state. */
+function armModeOf(state, modes) {
+	for (const mode of modes) if (state === armedStateFor(mode)) return mode;
+	return null;
+}
+/** The `deviceState` word a rule must gate on for `mode` to cover it. */
+function armedStateFor(mode) {
+	return `armed_${mode}`;
+}
+/**
+* One entry per mode the panel offers, including modes nothing is gated on.
+*
+* Empty modes are KEPT rather than filtered: "Night arms nothing" is the single
+* most useful thing this can tell an operator, and a list that omits it looks
+* identical to a list where night is covered.
+*/
+function alarmModeCoverage(rules, panelDeviceId, modes) {
+	return modes.map((mode) => coverageFor(rules, panelDeviceId, mode));
+}
+function coverageFor(rules, panelDeviceId, mode) {
+	const wanted = armedStateFor(mode);
+	const ids = /* @__PURE__ */ new Set();
+	let ruleCount = 0;
+	let allDevices = false;
+	for (const rule of rules) {
+		if (!rule.enabled) continue;
+		const gate = rule.conditions.deviceState;
+		if (gate === void 0 || gate.deviceId !== panelDeviceId) continue;
+		if (!gate.states.includes(wanted)) continue;
+		ruleCount += 1;
+		const scope = rule.conditions.devices;
+		if (scope === void 0 || scope.length === 0) {
+			allDevices = true;
+			continue;
+		}
+		for (const id of scope) ids.add(id);
+	}
+	return {
+		mode,
+		ruleCount,
+		allDevices,
+		deviceIds: [...ids].toSorted((a, b) => a - b)
+	};
+}
+/**
+* "Away armed — 3 cameras: Front door, Garage, Gate."
+*
+* Names, not ids: this is read by a person standing at a door. An id that has
+* no name falls back to `Device <id>` rather than being dropped — a silently
+* shorter list would understate what is armed, which is the one error this
+* message must not make.
+*
+* Returns null when the mode covers NOTHING and no rule is gated on it. A
+* notification saying "Night armed" that is followed by nothing happening all
+* night is worse than no notification: it is a false assurance. The caller
+* still logs the arm.
+*/
+function buildArmAnnouncement(coverage, deviceNames) {
+	if (coverage.ruleCount === 0) return null;
+	const title = `${modeLabel(coverage.mode)} armed`;
+	if (coverage.allDevices) return {
+		title,
+		body: `Every device is armed (${plural$1(coverage.ruleCount, "rule")}).`
+	};
+	if (coverage.deviceIds.length === 0) return {
+		title,
+		body: `${plural$1(coverage.ruleCount, "rule")}, no device restriction.`
+	};
+	const names = coverage.deviceIds.map((id) => deviceNames.get(id) ?? `Device ${id}`);
+	return {
+		title,
+		body: `${plural$1(names.length, "device")} armed: ${names.join(", ")}.`
+	};
+}
+function modeLabel(mode) {
+	return mode.charAt(0).toUpperCase() + mode.slice(1).replace(/_/g, " ");
+}
+function plural$1(n, one) {
+	return n === 1 ? `1 ${one}` : `${n} ${one}s`;
+}
+//#endregion
 //#region src/notification-center/alarm/alarm-state-machine.ts
+/**
+* Defaults an operator can change per panel. `home` has no exit delay on
+* purpose — nobody is leaving — but the shared value is applied to every mode
+* until per-mode delays are asked for.
+*
+* `triggeredDurationSec: 0` = "sound until somebody disarms it". That is what
+* the panel did before the field existed, so an install that never opens the
+* tab keeps behaving exactly as it did — a default that silently re-armed
+* every existing alarm after N seconds would be a behaviour change nobody
+* asked for.
+*/
+var DEFAULT_DELAYS = {
+	exitDelaySec: 30,
+	entryDelaySec: 20,
+	triggeredDurationSec: 0
+};
 var DISARMED = {
 	target: "disarmed",
 	fired: false,
@@ -364,6 +692,7 @@ function armedState(mode) {
 * answer is still correct the moment anyone asks.
 */
 function stateAt(m, now) {
+	if (m.clearAt !== void 0 && now >= m.clearAt) return m.target;
 	if (m.fired) return "triggered";
 	if (m.triggerAt !== void 0) return now >= m.triggerAt ? "triggered" : "pending";
 	if (m.armedAt !== void 0) return now >= m.armedAt ? m.target : "arming";
@@ -417,19 +746,24 @@ function disarm(now) {
 * intruder walking past two sensors would otherwise postpone the alarm.
 */
 function trigger(m, delays, now) {
+	const state = stateAt(m, now);
+	if (state === "triggered" || state === "pending") return m;
 	if (!isArmed(m, now)) return m;
-	if (m.fired || m.triggerAt !== void 0) return m;
-	if (delays.entryDelaySec <= 0) return {
-		...m,
-		fired: true,
-		changedAt: now
-	};
+	const base = settle(m, now);
+	const firesAt = now + Math.max(0, delays.entryDelaySec) * 1e3;
 	return {
-		...m,
-		triggerAt: now + delays.entryDelaySec * 1e3,
+		...base,
+		triggerAt: firesAt,
+		...autoClear(delays, firesAt),
+		fired: false,
 		changedAt: now
 	};
 }
+/** `clearAt` iff the operator asked for a bounded siren — see {@link AlarmDelays}. */
+function autoClear(delays, firesAt) {
+	if (delays.triggeredDurationSec <= 0) return {};
+	return { clearAt: firesAt + delays.triggeredDurationSec * 1e3 };
+}
 /**
 * Settle the machine so a stored value never depends on when it is read.
 *
@@ -438,10 +772,16 @@ function trigger(m, delays, now) {
 * than only in the reading of it.
 */
 function settle(m, now) {
+	if (m.clearAt !== void 0 && now >= m.clearAt) return {
+		target: m.target,
+		fired: false,
+		changedAt: m.clearAt
+	};
 	if (m.triggerAt !== void 0 && now >= m.triggerAt) return {
 		target: m.target,
 		fired: true,
-		changedAt: m.triggerAt
+		changedAt: m.triggerAt,
+		...m.clearAt !== void 0 ? { clearAt: m.clearAt } : {}
 	};
 	if (m.armedAt !== void 0 && now >= m.armedAt) return {
 		target: m.target,
@@ -470,21 +810,12 @@ function settle(m, now) {
 * and re-publish when a delay elapses.
 */
 /** Every arm mode a camstack-owned panel offers. */
-var MODES = [
+var NC_ALARM_MODES = [
 	"home",
 	"away",
 	"night"
 ];
 /**
-* Defaults an operator can change per panel. `home` has no exit delay on
-* purpose — nobody is leaving — but the shared value is applied to every mode
-* until per-mode delays are asked for.
-*/
-var DEFAULT_DELAYS = {
-	exitDelaySec: 30,
-	entryDelaySec: 20
-};
-/**
 * How often the panel re-publishes while a delay is running.
 *
 * The state is computed from an INSTANT, so this tick only decides how quickly
@@ -500,30 +831,94 @@ var TICK_MS = 1e3;
 var ncAlarmPanelSchema = require_dist.object({
 	exitDelaySec: require_dist.number().int().min(0).max(600).default(DEFAULT_DELAYS.exitDelaySec),
 	entryDelaySec: require_dist.number().int().min(0).max(600).default(DEFAULT_DELAYS.entryDelaySec),
+	triggeredDurationSec: require_dist.number().int().min(0).max(3600).default(DEFAULT_DELAYS.triggeredDurationSec),
+	/** Send a notification when a mode takes effect. Off until asked for. */
+	announceArm: require_dist.boolean().default(false),
+	/** Target ids that announcement goes to — see `NcAlarmSettingsSchema`. */
+	announceTargets: require_dist.array(require_dist.string()).default([]),
 	machine: require_dist.record(require_dist.string(), require_dist.unknown()).optional()
 });
+/** `armed_home` and friends — the only targets a machine may settle into. */
+function isArmTarget(value) {
+	return value === "disarmed" || typeof value === "string" && value.startsWith("armed_");
+}
+function optionalInstant(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+/**
+* Rebuild the machine from the persisted blob, or null when there is nothing
+* trustworthy in it.
+*
+* A type GUARD, not a cast: the blob has survived a schema change once already
+* (`clearAt` did not exist), and the failure mode of a cast here is an alarm
+* that reports a state it cannot reach. Anything unrecognised falls back to
+* DISARMED, which is the state an operator will notice.
+*
+* Exported for the test that proves a pre-`clearAt` blob still restores.
+*/
+function machineFromPersisted(raw) {
+	if (raw === null || typeof raw !== "object") return null;
+	const rec = { ...raw };
+	if (!isArmTarget(rec["target"]) || typeof rec["changedAt"] !== "number") return null;
+	const armedAt = optionalInstant(rec["armedAt"]);
+	const triggerAt = optionalInstant(rec["triggerAt"]);
+	const clearAt = optionalInstant(rec["clearAt"]);
+	return {
+		target: rec["target"],
+		...armedAt !== void 0 ? { armedAt } : {},
+		...triggerAt !== void 0 ? { triggerAt } : {},
+		...clearAt !== void 0 ? { clearAt } : {},
+		fired: rec["fired"] === true,
+		changedAt: rec["changedAt"]
+	};
+}
 var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	features = [];
 	machine = DISARMED;
 	delays = DEFAULT_DELAYS;
 	ticker = null;
+	onArmed = null;
+	/**
+	* The state the last publish reported. Null until the first one, so the
+	* BOOT publish never announces: a hub restarting while armed would otherwise
+	* announce "Away armed" on every deploy.
+	*/
+	lastPublished = null;
 	constructor(ctx) {
 		super(ctx, ncAlarmPanelSchema, { type: ctx.deviceMeta.type });
-		this.delays = {
-			exitDelaySec: this.config.get("exitDelaySec"),
-			entryDelaySec: this.config.get("entryDelaySec")
-		};
+		this.delays = this.readDelays();
 		this.restore();
 		this.registerAlarmCap();
 		this.publish();
 	}
-	/** Fire a trigger at the panel. Called by the notification center when a rule
-	*  that arms the alarm matches. Ignored unless the panel is armed. */
-	onRuleTriggered(now = Date.now()) {
-		const next = trigger(this.machine, this.delays, now);
-		if (next === this.machine) return;
-		this.machine = next;
-		this.publish(now);
+	/** The operator-visible configuration, as the cap serves it. */
+	settings() {
+		return {
+			...this.readDelays(),
+			announceArm: this.config.get("announceArm"),
+			announceTargets: [...this.config.get("announceTargets")]
+		};
+	}
+	/**
+	* Apply an editor's patch and return what the panel settled on.
+	*
+	* The new delays take effect on the NEXT transition, never retroactively: a
+	* machine already counting down keeps the instants it was given. Re-deriving
+	* `armedAt` from a delay the operator changed mid-exit would move the arm
+	* instant under somebody who is walking out of the door.
+	*/
+	async applySettings(patch) {
+		if (patch.exitDelaySec !== void 0) await this.config.set("exitDelaySec", patch.exitDelaySec);
+		if (patch.entryDelaySec !== void 0) await this.config.set("entryDelaySec", patch.entryDelaySec);
+		if (patch.triggeredDurationSec !== void 0) await this.config.set("triggeredDurationSec", patch.triggeredDurationSec);
+		if (patch.announceArm !== void 0) await this.config.set("announceArm", patch.announceArm);
+		if (patch.announceTargets !== void 0) await this.config.set("announceTargets", [...patch.announceTargets]);
+		this.delays = this.readDelays();
+		return this.settings();
+	}
+	/** Wire the arm announcement. See {@link NcAlarmArmedHook}. */
+	setArmedHook(hook) {
+		this.onArmed = hook;
 	}
 	/** Current lifecycle word — what the `deviceState` gate compares against. */
 	currentState(now = Date.now()) {
@@ -546,19 +941,24 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 				this.publish();
 			},
 			trigger: async () => {
-				this.machine = {
-					...this.machine,
-					fired: true,
-					changedAt: Date.now()
-				};
-				this.publish();
+				const now = Date.now();
+				const next = trigger(this.machine, this.delays, now);
+				if (next === this.machine) {
+					this.ctx.logger.info("alarm trigger ignored — the panel is not armed", {
+						tags: { deviceId: this.id },
+						meta: { state: stateAt(this.machine, now) }
+					});
+					return;
+				}
+				this.machine = next;
+				this.publish(now);
 			}
 		});
 	}
 	status(now = Date.now()) {
 		return {
 			state: stateAt(this.machine, now),
-			availableModes: [...MODES],
+			availableModes: [...NC_ALARM_MODES],
 			requiresCode: false,
 			lastChangedAt: this.machine.changedAt
 		};
@@ -572,11 +972,48 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 	*/
 	publish(now = Date.now()) {
 		this.machine = settle(this.machine, now);
+		const state = stateAt(this.machine, now);
 		this.runtimeState.setCapState("alarm-panel", this.status(now));
 		this.persist();
-		if (this.machine.armedAt !== void 0 || this.machine.triggerAt !== void 0) this.startTicking();
+		this.announceIfArmed(state);
+		if (this.machine.armedAt !== void 0 || this.machine.triggerAt !== void 0 || this.machine.clearAt !== void 0) this.startTicking();
 		else this.stopTicking();
 	}
+	/**
+	* Fire the arm hook on the transition INTO an armed mode.
+	*
+	* Never throws into the publish path: an announcement that could take the
+	* panel's own state update with it would make a notification failure look
+	* like an alarm failure.
+	*/
+	announceIfArmed(state) {
+		const previous = this.lastPublished;
+		this.lastPublished = state;
+		const hook = this.onArmed;
+		if (hook === null) return;
+		if (!shouldAnnounceArm(previous, state)) return;
+		const mode = armModeOf(state, NC_ALARM_MODES);
+		if (mode === null) return;
+		try {
+			hook(mode);
+		} catch (err) {
+			this.ctx.logger.warn("alarm arm announcement failed", {
+				tags: { deviceId: this.id },
+				meta: {
+					mode,
+					error: String(err)
+				}
+			});
+		}
+	}
+	/** The three durations, read from the persisted config. */
+	readDelays() {
+		return {
+			exitDelaySec: this.config.get("exitDelaySec"),
+			entryDelaySec: this.config.get("entryDelaySec"),
+			triggeredDurationSec: this.config.get("triggeredDurationSec")
+		};
+	}
 	startTicking() {
 		if (this.ticker !== null) return;
 		this.ticker = setInterval(() => this.publish(), TICK_MS);
@@ -593,17 +1030,9 @@ var NcAlarmPanelDevice = class extends require_dist.BaseDevice {
 		this.config.set("machine", { ...this.machine });
 	}
 	restore() {
-		const raw = this.config.get("machine");
-		if (raw === null || typeof raw !== "object") return;
-		const m = raw;
-		if (typeof m.target !== "string" || typeof m.changedAt !== "number") return;
-		this.machine = {
-			target: m.target,
-			...typeof m.armedAt === "number" ? { armedAt: m.armedAt } : {},
-			...typeof m.triggerAt === "number" ? { triggerAt: m.triggerAt } : {},
-			fired: m.fired === true,
-			changedAt: m.changedAt
-		};
+		const restored = machineFromPersisted(this.config.get("machine"));
+		if (restored === null) return;
+		this.machine = restored;
 	}
 };
 //#endregion
@@ -4871,14 +5300,21 @@ function readSensorEventType(value) {
 	const eventType = last["eventType"];
 	return typeof eventType === "string" && eventType.length > 0 ? eventType : void 0;
 }
-/** Build the subject for a `device-event` evaluation (a persisted SensorEvent —
-*  one row per linked camera; `deviceId` is the CAMERA). */
+/**
+* Build the subject for a `device-event` evaluation (a persisted SensorEvent —
+* one row per linked camera; `deviceId` is the CAMERA).
+*
+* BOTH ids ride along. The camera is what the notification shows; the sensor is
+* what the operator named in the rule. Carrying only the camera is what made a
+* sensor-scoped rule unmatched — see {@link NcRuleSubject.sourceDeviceId}.
+*/
 function subjectFromSensorEvent(ev) {
 	const eventType = readSensorEventType(ev.value);
 	return {
 		kind: "device-event",
 		recordId: ev.id,
 		deviceId: ev.deviceId,
+		...ev.sourceDeviceId !== ev.deviceId ? { sourceDeviceId: ev.sourceDeviceId } : {},
 		timestamp: ev.timestamp,
 		classNames: [],
 		zones: [],
@@ -5110,7 +5546,7 @@ function evaluateRule(rule, subject, deviceState) {
 		if (current === void 0) return fail("deviceState");
 		if (!toLowerSet(c.deviceState.states).has(current.trim().toLowerCase())) return fail("deviceState");
 	}
-	if (c.devices !== void 0 && c.devices.length > 0 && !c.devices.includes(subject.deviceId)) return fail("devices");
+	if (c.devices !== void 0 && c.devices.length > 0 && !matchesDeviceScope(c.devices, subject)) return fail("devices");
 	if (c.source !== void 0 && c.source !== "any") {
 		if ((subject.source ?? "pipeline") !== c.source) return fail("source");
 	}
@@ -5297,6 +5733,28 @@ function keysPerClass(rule, subject) {
 	return rule.throttle.granularity === "per-class";
 }
 /** Stable cooldown key per the rule's throttle scope + class granularity. */
+/**
+* Does the rule's device scope cover this subject?
+*
+* EITHER id matches, and both are needed for the same rule to be authorable
+* the two ways an operator thinks about it:
+*
+*  - "when anything happens on the front-door CAMERA" → the camera id, which
+*    is what a sensor row is attributed to;
+*  - "when the front-door CONTACT opens" → the sensor id, which is the device
+*    the operator actually cares about and the one they pick in the Devices
+*    tab. Before this, that rule matched nothing, ever, silently.
+*
+* Consequence worth knowing: a sensor linked to N cameras persists N rows, so
+* a SENSOR-scoped rule is evaluated N times for one door opening. The rule's
+* own throttle is what collapses that — `scope: 'rule'` gives one
+* notification, `scope: 'device'` gives one per camera, which is the right
+* choice when each carries its own picture.
+*/
+function matchesDeviceScope(scope, subject) {
+	if (scope.includes(subject.deviceId)) return true;
+	return subject.sourceDeviceId !== void 0 && scope.includes(subject.sourceDeviceId);
+}
 function cooldownKey(rule, subject) {
 	const first = subject.classNames[0];
 	const classKey = keysPerClass(rule, subject) && first !== void 0 ? `:c:${first}` : "";
@@ -5473,7 +5931,7 @@ var NcDispatcher = class {
 				return { ok: true };
 			}
 		}
-		const notification = await this.buildNotification(entry);
+		const notification = await this.buildNotification(entry, target);
 		try {
 			const result = await this.deps.send({
 				addonId: target.addonId,
@@ -5571,6 +6029,82 @@ var NcDispatcher = class {
 			return false;
 		}
 	}
+	/**
+	* Send a Notification-Center-composed message to ONE target.
+	*
+	* Never throws and never retries — see {@link NcAnnouncementSendInput}. Every
+	* way of not delivering produces a line: an announcement that silently did
+	* not arrive is indistinguishable from the alarm not having armed, which is
+	* the exact confusion this feature exists to remove.
+	*/
+	async deliverAnnouncement(input) {
+		const tags = input.deviceId !== void 0 ? { deviceId: input.deviceId } : void 0;
+		let target;
+		try {
+			target = await this.resolveTarget(input.targetId);
+		} catch (err) {
+			this.deps.logger.warn("announcement: target catalog unreachable", {
+				...tags !== void 0 ? { tags } : {},
+				meta: {
+					reason: input.reason,
+					targetId: input.targetId,
+					error: String(err)
+				}
+			});
+			return false;
+		}
+		if (target === null || !target.enabled) {
+			this.deps.logger.warn("announcement: target gone or disabled", {
+				...tags !== void 0 ? { tags } : {},
+				meta: {
+					reason: input.reason,
+					targetId: input.targetId
+				}
+			});
+			return false;
+		}
+		try {
+			const result = await this.deps.send({
+				addonId: target.addonId,
+				targetId: target.id,
+				notification: {
+					title: input.title,
+					body: input.body,
+					priority: 2,
+					...input.deviceId !== void 0 ? { deviceId: input.deviceId } : {}
+				}
+			});
+			if (!result.success) {
+				this.deps.logger.warn("announcement send failed", {
+					...tags !== void 0 ? { tags } : {},
+					meta: {
+						reason: input.reason,
+						targetId: target.id,
+						error: result.error
+					}
+				});
+				return false;
+			}
+			this.deps.logger.info("announcement delivered", {
+				...tags !== void 0 ? { tags } : {},
+				meta: {
+					reason: input.reason,
+					target: target.name
+				}
+			});
+			return true;
+		} catch (err) {
+			this.deps.logger.warn("announcement send threw", {
+				...tags !== void 0 ? { tags } : {},
+				meta: {
+					reason: input.reason,
+					targetId: target.id,
+					error: String(err)
+				}
+			});
+			return false;
+		}
+	}
 	/** Device display names for a set of ids, for the digest's lines. */
 	async resolveDeviceNames(deviceIds) {
 		const out = /* @__PURE__ */ new Map();
@@ -5603,7 +6137,37 @@ var NcDispatcher = class {
 		if (this.now() - this.targetCacheAt > this.targetCacheTtlMs) return null;
 		return this.targetCache.get(targetId) ?? null;
 	}
-	async buildNotification(entry) {
+	/**
+	* This delivery's buttons, or none.
+	*
+	* Never throws. A notification that arrives without its buttons is a
+	* degraded notification; one that does not arrive because the token registry
+	* hiccupped is a missed event. The failure is logged rather than swallowed —
+	* a button the operator authored and never saw is exactly the silence this
+	* repo keeps paying for.
+	*/
+	async mintActions(entry, target) {
+		if (this.deps.buildActions === void 0) return [];
+		try {
+			return await this.deps.buildActions({
+				ruleId: entry.ruleId,
+				ruleName: entry.payload.ruleName,
+				deviceId: entry.deviceId,
+				targetId: target.id
+			});
+		} catch (err) {
+			this.deps.logger.warn("notification buttons could not be minted — sending without them", {
+				tags: { deviceId: entry.deviceId },
+				meta: {
+					ruleId: entry.ruleId,
+					targetId: target.id,
+					error: String(err)
+				}
+			});
+			return [];
+		}
+	}
+	async buildNotification(entry, target) {
 		const subject = entry.payload.subject;
 		const deviceName = await this.deps.getDeviceName(subject.deviceId).catch(() => null) ?? `camera ${subject.deviceId}`;
 		const zoneLabels = await resolveZoneLabels(this.deps.getZoneNames, subject.deviceId, subject.zones);
@@ -5612,6 +6176,7 @@ var NcDispatcher = class {
 		const body = renderTemplate(entry.payload.template?.body, vars) ?? defaultBody(entry, deviceName, zoneLabels);
 		const attachments = await this.withArtifactUrls(await this.resolveAttachments(entry));
 		const params = pickParams(entry.payload.params);
+		const actions = await this.mintActions(entry, target);
 		return {
 			body,
 			title,
@@ -5620,7 +6185,8 @@ var NcDispatcher = class {
 			tag: entry.ruleId,
 			deviceId: subject.deviceId,
 			...subject.eventId !== void 0 ? { eventId: subject.eventId } : {},
-			...attachments.length > 0 ? { attachments } : {}
+			...attachments.length > 0 ? { attachments } : {},
+			...actions.length > 0 ? { actions } : {}
 		};
 	}
 	/**
@@ -6738,6 +7304,60 @@ function rowToEntry$1(id, data) {
 	};
 }
 //#endregion
+//#region src/notification-center/action-buttons.ts
+/** Sequence names the rule actually declares. A button may only name one. */
+function declaredSequences(actions) {
+	const names = /* @__PURE__ */ new Set();
+	for (const sequence of actions.onTrigger ?? []) names.add(sequence.name);
+	return names;
+}
+/**
+* Build the notification's buttons.
+*
+* Returns an empty array rather than `undefined` — the caller decides whether
+* to set the field, and an empty array is the honest answer to "which buttons
+* survived", which `undefined` would conflate with "the rule declared none".
+*/
+function buildActionButtons(input) {
+	const actions = input.actions;
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const button of buttons) {
+		if (!known.has(button.sequence)) continue;
+		if (seen.has(button.id)) continue;
+		seen.add(button.id);
+		out.push({
+			id: button.id,
+			label: button.label,
+			url: input.mintUrl({
+				sequence: button.sequence,
+				actionId: button.id
+			}),
+			...button.icon !== void 0 ? { icon: button.icon } : {},
+			...button.destructive !== void 0 ? { destructive: button.destructive } : {}
+		});
+	}
+	return out;
+}
+/**
+* Which of a rule's buttons name a sequence it does not have.
+*
+* Exported so the caller can LOG the drop. A button silently missing from a
+* notification is the exact shape of failure this repo keeps paying for — the
+* operator authored it, it never appeared, and nothing said why.
+*/
+function unresolvableButtons(actions) {
+	if (actions === void 0) return [];
+	const buttons = actions.buttons ?? [];
+	if (buttons.length === 0) return [];
+	const known = declaredSequences(actions);
+	return buttons.filter((b) => !known.has(b.sequence)).map((b) => `${b.id}→${b.sequence}`);
+}
+//#endregion
 //#region src/notification-center/rule-actions.ts
 var NcRuleActionRunner = class {
 	deps;
@@ -7816,6 +8436,44 @@ var TimelapseStore = class {
 //#endregion
 //#region src/notification-center/index.ts
 /**
+* NotificationCenter — the P1 core of the Notification Center (spec
+* `2026-07-22-notification-center-requirements.md`, decisions D-1/D-2/D-3).
+*
+* A deps-injected, extractable module (TrackCloser pattern) hosted by
+* pipeline-analytics. It couples rule evaluation to the DURABLE persist
+* moments (D-2), never to the telemetry bus:
+*
+*   object-event insert ─▶ onObjectEventPersisted ─▶ immediate rules
+*   TrackCloser.closeExpired ─▶ onTrackClosed ─▶ track-end rules
+*        │ match + throttle
+*        ▼
+*   NcOutbox (durable rows, unique key rule:track:target)
+*        │ drain loop (backoff / dead-letter)
+*        ▼
+*   NcDispatcher ─▶ ctx.api notification-output.send (RPC, hub-routed)
+*
+* Crash gap: on start (evaluation mode) the module scans object events
+* newer than the persisted watermark and re-evaluates them — idempotent
+* through the outbox dedup key (D8: reconcile, never trust an event).
+*
+* Multi-node: rules live in the centralized settings-store; only the
+* designated post-processing node runs evaluation + the drain loop, so a
+* CRUD served elsewhere becomes effective within one rule-reload tick.
+*/
+/**
+* What `getAlarmConfig` answers on a node with no panel.
+*
+* The DEFAULTS, not zeroes: paired with `deviceId: null` this tells a client
+* "there is no panel here" while still describing the shape it would have.
+* Zeroes would render as "no entry delay", which is a claim about an alarm
+* that does not exist.
+*/
+var NC_ALARM_SETTINGS_FALLBACK = {
+	...DEFAULT_DELAYS,
+	announceArm: false,
+	announceTargets: []
+};
+/**
 * How often the "matched NO rule" report may fire per device. Long enough that
 * a busy camera prints one line rather than one per event, short enough that a
 * rule which has stopped matching is visible within minutes rather than by
@@ -7935,9 +8593,14 @@ var NotificationCenter = class NotificationCenter {
 	deviceStates;
 	/** Runs a matched rule's action sequences. Null when no actuator is wired. */
 	actionRunner;
+	/** Grants behind the tap-through buttons. In-process and single-use — read
+	*  `action-token.ts` before assuming anything about what a tap proves. */
+	actionTokens = new NcActionTokenRegistry();
 	/** True when ≥1 enabled `device-event` rule declares an occupancy condition —
 	*  the watcher is idle (zero per-frame cost) otherwise. */
 	occupancyEnabled = false;
+	/** The panel this node owns, or null. See {@link NcAlarmPanelPort}. */
+	alarmPanel = null;
 	/** In-memory cooldown map — seeded from persisted outbox rows on start. */
 	lastFiredAt = /* @__PURE__ */ new Map();
 	/** Per-device rate limit for the "matched NO rule" report — see `reportNoMatch`. */
@@ -7955,6 +8618,109 @@ var NotificationCenter = class NotificationCenter {
 	reloadTimer = null;
 	drainTicks = 0;
 	evaluationActive = false;
+	/**
+	* The tap-through buttons for ONE delivery, each with its own single-use
+	* token.
+	*
+	* Per delivery, not per notification: the first tap spends the token, so two
+	* recipients sharing one would mean the second person's button was already
+	* dead when it arrived.
+	*
+	* Returns `[]` for every ordinary reason — the rule declares no buttons, no
+	* actuator is wired, no reachable URL exists. A button is an enhancement; not
+	* being able to mint one must never cost the notification.
+	*/
+	async mintButtons(input) {
+		const mint = this.deps.mintActionUrl;
+		if (mint === void 0 || this.actionRunner === null) return [];
+		const rule = this.rules.get(input.ruleId);
+		if (rule === null) return [];
+		if ((rule.actions?.buttons ?? []).length === 0) return [];
+		const expMs = this.now() + DEFAULT_ACTION_TTL_MS;
+		const pending = [];
+		const out = buildActionButtons({
+			actions: rule.actions,
+			mintUrl: ({ sequence, actionId }) => {
+				const id = (0, node_crypto.randomUUID)();
+				pending.push({
+					id,
+					url: "",
+					sequence,
+					actionId
+				});
+				return id;
+			}
+		});
+		if (out.length === 0) return [];
+		const resolved = [];
+		for (const [index, action] of out.entries()) {
+			const slot = pending[index];
+			if (slot === void 0) continue;
+			const url = await mint({
+				id: slot.id,
+				expMs
+			});
+			if (url === null) {
+				this.logger.debug("no reachable base URL — notification buttons omitted", {
+					tags: { deviceId: input.deviceId },
+					meta: { ruleId: input.ruleId }
+				});
+				return [];
+			}
+			this.actionTokens.put({
+				id: slot.id,
+				ruleId: input.ruleId,
+				ruleName: input.ruleName,
+				sequence: slot.sequence,
+				deviceId: input.deviceId,
+				actionId: slot.actionId,
+				targetId: input.targetId,
+				expiresAt: expMs
+			});
+			resolved.push({
+				...action,
+				url
+			});
+		}
+		return resolved;
+	}
+	/** The registry the action plane claims against. */
+	get actionTokenRegistry() {
+		return this.actionTokens;
+	}
+	/**
+	* Run the sequence a spent token granted.
+	*
+	* **The grant overrides `enabled`, deliberately.** A sequence reachable only
+	* by a button is written as `enabled: false` — that is how "do not run this
+	* automatically" is expressed — and the runner skips a disabled sequence. For
+	* a granted run the BUTTON is the enablement, and the operator tapping it is
+	* a more explicit instruction than the flag it overrides. The per-sequence
+	* throttle still applies: `minDelaySec` is about how often a gate may
+	* physically move, and a tap does not change that.
+	*
+	* Throws when the sequence is gone or a step failed — the plane turns that
+	* into the page that says so.
+	*/
+	async runGrantedAction(grant) {
+		if (this.actionRunner === null) throw new Error("no actuator is wired on this node");
+		const rule = this.rules.get(grant.ruleId);
+		if (rule === null) throw new Error(`rule ${grant.ruleId} no longer exists`);
+		const sequence = (rule.actions?.onTrigger ?? []).find((s) => s.name === grant.sequence);
+		if (sequence === void 0) throw new Error(`sequence "${grant.sequence}" no longer exists on rule ${rule.name}`);
+		const [outcome] = await this.actionRunner.run({
+			ruleId: rule.id,
+			ruleName: rule.name,
+			deviceId: grant.deviceId,
+			sequences: [{
+				...sequence,
+				enabled: true
+			}]
+		});
+		if (outcome === void 0) throw new Error("the sequence did not run");
+		if (outcome.failedAt !== void 0) throw new Error(`step ${String(outcome.failedAt)} of "${sequence.name}" failed`);
+		if (!outcome.ran) throw new Error(`"${sequence.name}" did not run (${outcome.skippedReason ?? "unknown"})`);
+	}
 	constructor(deps) {
 		this.deps = deps;
 		this.logger = deps.logger;
@@ -8265,9 +9031,105 @@ var NotificationCenter = class NotificationCenter {
 			cancelSnooze: async ({ snoozeId, caller }) => {
 				await this.cancelSnooze(snoozeId, caller);
 				return { success: true };
+			},
+			getAlarmConfig: async () => this.alarmConfig(),
+			setAlarmConfig: async ({ patch }) => {
+				const panel = this.alarmPanel;
+				if (panel === null) throw new Error("this node has no alarm panel");
+				const settings = await panel.applySettings(patch);
+				this.logger.info("alarm settings changed", {
+					tags: { deviceId: panel.deviceId },
+					meta: {
+						exitDelaySec: settings.exitDelaySec,
+						entryDelaySec: settings.entryDelaySec,
+						triggeredDurationSec: settings.triggeredDurationSec,
+						announceArm: settings.announceArm,
+						announceTargets: settings.announceTargets.length
+					}
+				});
+				return this.alarmConfig();
 			}
 		};
 	}
+	/**
+	* Adopt the panel this node owns. Called once by the addon after
+	* `ensureAlarmPanel`; a node without one never calls it and the cap then
+	* answers `deviceId: null`.
+	*/
+	setAlarmPanel(panel) {
+		this.alarmPanel = panel;
+	}
+	/** Settings + the DERIVED coverage. Read together — see the cap doc. */
+	alarmConfig() {
+		const panel = this.alarmPanel;
+		if (panel === null) return {
+			deviceId: null,
+			settings: NC_ALARM_SETTINGS_FALLBACK,
+			coverage: []
+		};
+		return {
+			deviceId: panel.deviceId,
+			settings: panel.settings(),
+			coverage: this.coverageFor(panel).map((c) => ({
+				...c,
+				deviceIds: [...c.deviceIds]
+			}))
+		};
+	}
+	coverageFor(panel) {
+		return alarmModeCoverage(this.rules.list(), panel.deviceId, panel.availableModes());
+	}
+	/**
+	* Say which devices a mode just armed.
+	*
+	* Called by the panel on the transition INTO an armed mode. Fire-and-forget
+	* and never able to fail the panel: `announceArm` returns void, and every
+	* branch that sends nothing logs why — a mode that arms nothing is the most
+	* important thing this can report, and it is exactly the case where no
+	* message goes out.
+	*/
+	announceArm(mode) {
+		this.deliverArmAnnouncement(mode).catch((err) => {
+			this.logger.warn("alarm arm announcement failed", { meta: {
+				mode,
+				error: String(err)
+			} });
+		});
+	}
+	async deliverArmAnnouncement(mode) {
+		const panel = this.alarmPanel;
+		if (panel === null) return;
+		const settings = panel.settings();
+		const tags = { deviceId: panel.deviceId };
+		if (!settings.announceArm) return;
+		if (settings.announceTargets.length === 0) {
+			this.logger.info("alarm armed but no announcement target is configured", {
+				tags,
+				meta: { mode }
+			});
+			return;
+		}
+		const coverage = this.coverageFor(panel).find((c) => c.mode === mode);
+		if (coverage === void 0) return;
+		const message = buildArmAnnouncement(coverage, await this.dispatcher.resolveDeviceNames(coverage.deviceIds));
+		if (message === null) {
+			this.logger.warn("alarm armed into a mode no enabled rule is gated on", {
+				tags,
+				meta: {
+					mode,
+					state: `armed_${mode}`
+				}
+			});
+			return;
+		}
+		for (const targetId of settings.announceTargets) await this.dispatcher.deliverAnnouncement({
+			reason: "alarm-arm",
+			targetId,
+			title: message.title,
+			body: message.body,
+			deviceId: panel.deviceId
+		});
+	}
 	/** Append one evaluation to the serialized chain (see {@link evalChain}). */
 	scheduleEvaluation(subject, kind, logContext) {
 		this.evalChain = this.evalChain.then(async () => {
@@ -8355,6 +9217,15 @@ var NotificationCenter = class NotificationCenter {
 				deviceId: subject.deviceId,
 				sequences
 			});
+			const unresolvable = unresolvableButtons(rule.actions);
+			if (unresolvable.length > 0) this.logger.warn("rule buttons reference sequences that do not exist — not sent", {
+				tags: { deviceId: subject.deviceId },
+				meta: {
+					ruleId: rule.id,
+					rule: rule.name,
+					buttons: unresolvable.join(", ")
+				}
+			});
 			const userTargets = await this.resolveUserTargets(rule, subject.deviceId);
 			if (await this.outbox.enqueue(this.buildEntries(rule, subject, kind, evaluation.matchedOn, userTargets)) > 0) this.lastFiredAt.set(key, now);
 			anyMatched = true;
@@ -22052,6 +22923,95 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		}
 	}
 	/**
+	* The ranked base-URL candidates a notification LINK may use.
+	*
+	* Shared by the artifact plane (media) and the action plane (buttons) — one
+	* resolver, because a second copy would drift and the two would start
+	* minting links on different hosts for the same notification.
+	*/
+	async ncEndpoints() {
+		return collectArtifactEndpoints({
+			markedBaseUrl: await this.markedNotificationEndpoint(),
+			configuredPublicUrl: process.env["CAMSTACK_HUB_PUBLIC_URL"],
+			getConnected: async () => {
+				const status = await this.ctx.api.networkAccess.getStatus.query();
+				this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
+					connected: status.connected,
+					url: status.endpoint?.url ?? null,
+					protocol: status.endpoint?.protocol ?? null
+				} });
+				return status.connected && status.endpoint !== null ? {
+					url: status.endpoint.url,
+					protocol: status.endpoint.protocol
+				} : null;
+			},
+			listExternal: async () => {
+				return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
+					url: e.url,
+					protocol: e.protocol
+				}));
+			},
+			listLan: async (port) => {
+				return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.map((e) => ({
+					baseUrl: e.baseUrl,
+					kind: e.kind,
+					priority: e.priority
+				}));
+			},
+			logger: this.ctx.logger
+		});
+	}
+	/**
+	* Serve the NC ACTION plane: the public route a notification button lands on.
+	*
+	* A sibling of the artifact plane and a strictly more dangerous one — that
+	* route serves bytes, this one MOVES something. Its authority is the token in
+	* the link and nothing else, which is the operator's explicit choice; the
+	* bounds are in `notification-center/action-token.ts` and D47.
+	*
+	* Best-effort like every plane here: no facility ⇒ no route, and the
+	* dispatcher simply mints no buttons, because `mintActionUrl` returns null.
+	*/
+	async serveNcActionPlane(center) {
+		try {
+			const secretState = this.state("ncActionSecret", NcArtifactSecretSchema, "");
+			let secret = await secretState.get();
+			if (secret === "") {
+				secret = (0, node_crypto.randomUUID)().replace(/-/g, "");
+				await secretState.set(secret);
+			}
+			const routePrefix = `/addon/${this.ctx.id}/nc-action`;
+			const plane = new NcActionPlane({
+				registry: center.actionTokenRegistry,
+				secret,
+				logger: this.ctx.logger.child("nc-actions"),
+				run: (grant) => center.runGrantedAction(grant)
+			});
+			const served = await this.ctx.dataPlane?.serve({
+				prefix: "nc-action",
+				access: "public",
+				handler: plane.handler
+			}) ?? null;
+			this.ncActionMintUrl = served === null ? null : async ({ id, expMs }) => {
+				const baseUrl = pickArtifactBaseUrl(await this.ncEndpoints());
+				if (baseUrl === null) return null;
+				return buildActionUrl({
+					baseUrl,
+					routePrefix,
+					id,
+					secret,
+					expMs
+				});
+			};
+			this.ctx.logger.info("nc-action data-plane served", { meta: { served: served !== null } });
+		} catch (err) {
+			this.ctx.logger.warn("nc-action data-plane failed to serve", { meta: { error: require_dist.errMsg(err) } });
+		}
+	}
+	/** Mints a button's callback URL once the action plane is served; null until
+	*  then, and null forever on an install with no reachable public address. */
+	ncActionMintUrl = null;
+	/**
 	* Serve the NC artifact plane: a PUBLIC route whose authority is the HMAC on
 	* each link (see `notification-center/artifact-url.ts`). It exists because
 	* attachments used to carry BYTES only, and the degrade engine drops a
@@ -22079,36 +23039,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				secret,
 				logger: this.ctx.logger.child("nc-artifacts"),
 				routePrefix: `/addon/${this.ctx.id}/nc-artifact`,
-				listEndpoints: async () => collectArtifactEndpoints({
-					markedBaseUrl: await this.markedNotificationEndpoint(),
-					configuredPublicUrl: process.env["CAMSTACK_HUB_PUBLIC_URL"],
-					getConnected: async () => {
-						const status = await this.ctx.api.networkAccess.getStatus.query();
-						this.ctx.logger.debug("artifact base-url: connected ingress", { meta: {
-							connected: status.connected,
-							url: status.endpoint?.url ?? null,
-							protocol: status.endpoint?.protocol ?? null
-						} });
-						return status.connected && status.endpoint !== null ? {
-							url: status.endpoint.url,
-							protocol: status.endpoint.protocol
-						} : null;
-					},
-					listExternal: async () => {
-						return (await this.ctx.api.networkAccess.listEndpoints.query()).map((e) => ({
-							url: e.url,
-							protocol: e.protocol
-						}));
-					},
-					listLan: async (port) => {
-						return (await this.ctx.api.localNetwork.getConnectionEndpoints.query({ port })).endpoints.map((e) => ({
-							baseUrl: e.baseUrl,
-							kind: e.kind,
-							priority: e.priority
-						}));
-					},
-					logger: this.ctx.logger
-				})
+				listEndpoints: () => this.ncEndpoints()
 			});
 			this.ncArtifactDataPlane = await this.ctx.dataPlane?.serve({
 				prefix: "nc-artifact",
@@ -22177,6 +23108,17 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 	*  `notification-rules` provider (CRUD over the central store) is
 	*  registered from every node. */
 	notificationCenter = null;
+	/**
+	* The live alarm panel on THIS node, or null.
+	*
+	* Held, where the earlier note said not to. The objection then was a field
+	* nothing reads growing into a second source of truth for which device the
+	* alarm is — and it stands: the panel is still addressed by stable id
+	* everywhere else. This reference exists because two things now READ it, and
+	* neither can go through the device id: the settings tab, which needs the
+	* panel's own config, and the arm announcement, which the panel pushes.
+	*/
+	alarmPanelDevice = null;
 	/** THE single owner of capture pressure (S3, refactor spec 2026-07-22):
 	*  every native-fetch call site routed so far (the per-frame batch media
 	*  dispatch + `persistKeyFrames`; part B routes the rest) goes through ONE
@@ -22467,14 +23409,18 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					return found === void 0 ? null : { id: found.id };
 				},
 				createDevice: async ({ stableId, integrationId, name }) => {
-					return { id: (await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, {
+					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, {
 						type: NC_ALARM_DEVICE_TYPE,
 						name,
 						integrationId
-					})).id };
+					});
+					this.holdAlarmPanel(device);
+					return { id: device.id };
 				},
 				adoptDevice: async ({ stableId }) => {
-					return { id: (await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, void 0)).id };
+					const device = await devices.create(stableId, NC_ALARM_DEVICE_CLASS, {}, null, void 0);
+					this.holdAlarmPanel(device);
+					return { id: device.id };
 				}
 			});
 			if (result.created) this.ctx.logger.info("notification-center alarm panel ready", { tags: { deviceId: result.deviceId } });
@@ -22482,6 +23428,41 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 			this.ctx.logger.warn("alarm panel could not be ensured — rules still notify", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
+	/**
+	* Keep the constructed panel, if that is what came back.
+	*
+	* An `instanceof` narrowing rather than a cast: `devices.create` promises an
+	* `IDevice`, and the only honest way to know it is the alarm is to ask. A
+	* cast here would compile against any future device class and fail at the
+	* first `settings()` call, in production, with the tab already open.
+	*/
+	holdAlarmPanel(device) {
+		if (!(device instanceof NcAlarmPanelDevice)) {
+			this.ctx.logger.warn("alarm panel is not the expected device class — settings tab disabled");
+			return;
+		}
+		this.alarmPanelDevice = device;
+	}
+	/**
+	* Join the panel and the Notification Center, once both exist.
+	*
+	* They are built in that order (`ensureAlarmPanel` runs before the centre is
+	* constructed) and neither can reach the other on its own, so the join is
+	* here. A node with no panel simply never calls it, and the cap answers
+	* `deviceId: null` — which is what an agent node should say.
+	*/
+	wireAlarmPanel(center) {
+		const panel = this.alarmPanelDevice;
+		if (panel === null) return;
+		center.setAlarmPanel({
+			deviceId: panel.id,
+			settings: () => panel.settings(),
+			applySettings: (patch) => panel.applySettings(patch),
+			availableModes: () => NC_ALARM_MODES
+		});
+		panel.setArmedHook((mode) => center.announceArm(mode));
+		this.ctx.logger.info("alarm panel wired to the notification center", { tags: { deviceId: panel.id } });
+	}
 	async declareCollections(api) {
 		await TrackStore.declare(api.settingsStore);
 		await MediaStore.declare(api.settingsStore);
@@ -22506,7 +23487,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 		let storage = this.ctx.kernel.storage;
 		const mediaRoot = process.env.CAMSTACK_MEDIA_ROOT?.trim();
 		if (mediaRoot) {
-			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-B1HAVV_-.js"));
+			const { FilesystemStorageProvider } = await Promise.resolve().then(() => require("../node-BNgGpVnp.js"));
 			storage = new FilesystemStorageProvider(mediaRoot, { eventMedia: mediaRoot });
 			logger.info("pipeline-analytics: event media rooted at CAMSTACK_MEDIA_ROOT", { meta: { mediaRoot } });
 		}
@@ -22876,6 +23857,7 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				});
 			},
 			isCapDeviceScoped: require_dist.isDeviceScopedCap,
+			mintActionUrl: (input) => this.ncActionMintUrl?.(input) ?? Promise.resolve(null),
 			readDeviceStates: async (ids) => {
 				const out = /* @__PURE__ */ new Map();
 				for (const id of ids) try {
@@ -22937,18 +23919,20 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 					});
 				},
 				send: async (input) => {
-					const { attachments, ...notification } = input.notification;
+					const { attachments, actions, ...notification } = input.notification;
 					return api.notificationOutput.send.mutate({
 						addonId: input.addonId,
 						targetId: input.targetId,
 						notification: {
 							...notification,
-							...attachments !== void 0 ? { attachments: [...attachments] } : {}
+							...attachments !== void 0 ? { attachments: [...attachments] } : {},
+							...actions !== void 0 ? { actions: [...actions] } : {}
 						}
 					});
 				},
 				getMediaForOwner: (ownerKind, ownerId) => stores.mediaStore.listByOwner(ownerKind, ownerId),
-				getDeviceName
+				getDeviceName,
+				buildActions: (input) => this.notificationCenter?.mintButtons(input) ?? Promise.resolve([])
 			},
 			listObjectEventsSince: (since, limit) => stores.eventStore.queryObjectSince({
 				since,
@@ -22964,6 +23948,8 @@ var PipelineAnalyticsAddon = class extends require_dist.BaseAddon {
 				})).tracks;
 			}
 		});
+		this.wireAlarmPanel(this.notificationCenter);
+		await this.serveNcActionPlane(this.notificationCenter);
 		await this.notificationCenter.start({ evaluation: this.isPostProcessingNode });
 	}
 	/** Event-media data-plane: serve thumbnail JPEGs at