@camstack/types 1.2.249 → 1.2.251

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-CvwUEq16.js");
+const require_sleep = require("./sleep-BAgDk7I9.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_err_msg = require("./err-msg-COpsHMw2.js");
 //#region src/generated/cap-input-defaults.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { A as DeviceType, At as DATAPLANE_SECRET_HEADER, Dt as PEER_BYTES_STALL_MS, Et as PEER_BYTES_MAX_OUTSTANDING, G as readNodePin, J as ReadinessTimeoutError, L as expandCapMethods, Lt as emitReadiness, Mt as DisposerChain, Nt as BaseAddon, Ot as PEER_BYTES_TICKET_TTL_MS, Pt as normalizeAddonInitResult, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, W as nodePin, Z as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, q as ReadinessRegistry, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-pM_J7YnY.mjs";
+import { A as DeviceType, At as DATAPLANE_SECRET_HEADER, Dt as PEER_BYTES_STALL_MS, Et as PEER_BYTES_MAX_OUTSTANDING, G as readNodePin, J as ReadinessTimeoutError, L as expandCapMethods, Lt as emitReadiness, Mt as DisposerChain, Nt as BaseAddon, Ot as PEER_BYTES_TICKET_TTL_MS, Pt as normalizeAddonInitResult, S as DEVICE_CHILDREN_BATCH_MAX, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, W as nodePin, Z as scopeKey, a as asJsonObject, b as deviceOpsCapability, d as BOOT_RECOVERY_BACKOFF_MS, f as DEVICE_SCOPED_CAPS, h as createEventBusSliceSource, j as adminUiCapability, m as createDeviceProxy, p as isDeviceScopedCap, q as ReadinessRegistry, s as asString, t as sleep, u as parseJsonUnknown, x as viewerUiCapability } from "./sleep-D_4W7xuQ.mjs";
 import { t as EventCategory } from "./event-category-BVDXG4tB.mjs";
 import { t as errMsg } from "./err-msg-IQTHeDzc.mjs";
 //#region src/generated/cap-input-defaults.ts

package/dist/capabilities/notification-output.cap.d.ts

@@ -308,6 +308,7 @@ export declare const TargetKindSchema: z.ZodObject<{
     iconUrl: z.ZodOptional<z.ZodString>;
     iconMediaType: z.ZodOptional<z.ZodString>;
     configSchema: z.ZodUnknown;
+    destinationKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
     supportsDiscovery: z.ZodBoolean;
     caps: z.ZodObject<{
         attachments: z.ZodObject<{
@@ -438,6 +439,7 @@ export declare const notificationOutputCapability: {
             iconUrl: z.ZodOptional<z.ZodString>;
             iconMediaType: z.ZodOptional<z.ZodString>;
             configSchema: z.ZodUnknown;
+            destinationKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
             supportsDiscovery: z.ZodBoolean;
             caps: z.ZodObject<{
                 attachments: z.ZodObject<{

package/dist/capabilities/settings-store.cap.d.ts

@@ -127,6 +127,16 @@ declare const CollectionIndexSchema: z.ZodObject<{
  * namespace, or none. Making the door enforce it is tracked separately —
  * it renames tables, so it needs a migration.
  *
+ * **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
+ * call to its caller, a `protected` method here was a raw, unredacted read
+ * (and write) of every addon's collections for any role holding
+ * `category:system` — which is every role: a `viewer` could read every
+ * notifier token in plaintext from `notifiers:notification-targets`. No
+ * browser or app client calls this cap. Addons are not affected: an
+ * addon's `ctx.api` cap call is resolved to the provider directly and never
+ * enters the tRPC router (so the tier gates sessions and tokens, never
+ * addons), and the hub itself calls it through the capability registry.
+ *
  *   - `{ collection: 'addon-settings' }` → table `addon-settings`
  *   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
  *     table `my-addon:addon-settings`

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-CvwUEq16.js");
+const require_sleep = require("./sleep-BAgDk7I9.js");
 const require_event_category = require("./event-category-BVfsrBYA.js");
 const require_canonical_hash = require("./canonical-hash-CSE4ioRi.js");
 const require_enums = require("./enums.js");
@@ -8442,7 +8442,7 @@ var brokerCapability = {
 		}),
 		/** Read the broker's cached state for a key. Returns `null` when
 		*  unknown to the broker (never published / unknown entity). */
-		getState: require_sleep.method(GetStateInputSchema, zod.z.unknown().nullable()),
+		getState: require_sleep.method(GetStateInputSchema, zod.z.unknown().nullable(), { auth: "admin" }),
 		/** Status method — explicit registration with a `z.void()` input so
 		*  the codegen-generated tRPC router types its input as
 		*  `{addonId?: string, nodeId?: string}` (system-scoped collection
@@ -10288,6 +10288,16 @@ var CollectionIndexSchema = zod.z.object({
 * namespace, or none. Making the door enforce it is tracked separately —
 * it renames tables, so it needs a migration.
 *
+* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
+* call to its caller, a `protected` method here was a raw, unredacted read
+* (and write) of every addon's collections for any role holding
+* `category:system` — which is every role: a `viewer` could read every
+* notifier token in plaintext from `notifiers:notification-targets`. No
+* browser or app client calls this cap. Addons are not affected: an
+* addon's `ctx.api` cap call is resolved to the provider directly and never
+* enters the tRPC router (so the tier gates sessions and tokens, never
+* addons), and the hub itself calls it through the capability registry.
+*
 *   - `{ collection: 'addon-settings' }` → table `addon-settings`
 *   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
 *     table `my-addon:addon-settings`
@@ -10309,14 +10319,17 @@ var settingsStoreCapability = {
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string()
-		}), zod.z.unknown()),
+		}), zod.z.unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string(),
 			value: zod.z.unknown()
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Rows matching a filter.
 		*
@@ -10337,7 +10350,7 @@ var settingsStoreCapability = {
 			collection: zod.z.string(),
 			filter: QueryFilterSchema.optional(),
 			columns: zod.z.array(zod.z.string()).readonly().optional()
-		}), zod.z.array(SettingsRecordSchema).readonly()),
+		}), zod.z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/**
 		* Make a SLOT hold this row — insert it, or update whatever already
 		* occupies the slot — and answer with the id the row HAS.
@@ -10390,7 +10403,10 @@ var settingsStoreCapability = {
 		}), zod.z.object({ 
 		/** The id the row HAS: assigned by SQLite on an insert, or the existing
 		*  row's own id on an update. */
-id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert a new record. */
 		insert: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -10405,7 +10421,10 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 		* primary key — which is the only place an auto key is knowable.
 		*/
-id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
+id: zod.z.union([zod.z.string(), zod.z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Insert MANY records in ONE transaction, returning how many landed.
 		*
@@ -10433,20 +10452,29 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			records: zod.z.array(BulkRecordSchema).readonly()
-		}), zod.z.object({ inserted: zod.z.number().int() }), { kind: "mutation" }),
+		}), zod.z.object({ inserted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			id: zod.z.string(),
 			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			key: zod.z.string()
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Delete every record matching `filter`, in ONE statement, returning how
 		* many rows went. This exists because its absence made every retention
@@ -10465,7 +10493,10 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			filter: MutationFilterSchema
-		}), zod.z.object({ deleted: zod.z.number().int() }), { kind: "mutation" }),
+		}), zod.z.object({ deleted: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Apply `data` to every record matching `filter`, in one statement,
 		* returning how many rows changed. Same filter contract as
@@ -10476,13 +10507,16 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 			collection: zod.z.string(),
 			filter: MutationFilterSchema,
 			data: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.object({ updated: zod.z.number().int() }), { kind: "mutation" }),
+		}), zod.z.object({ updated: zod.z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string(),
 			filter: QueryFilterSchema.optional()
-		}), zod.z.number()),
+		}), zod.z.number(), { auth: "admin" }),
 		/**
 		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
 		* statement, over the rows `filter` selects.
@@ -10508,7 +10542,7 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 			collection: zod.z.string(),
 			fields: zod.z.array(AggregateFieldSchema).readonly(),
 			filter: QueryFilterSchema.optional()
-		}), AggregateResultSchema),
+		}), AggregateResultSchema, { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
@@ -10520,12 +10554,12 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 		}), zod.z.array(zod.z.object({
 			bucket: zod.z.number().int(),
 			count: zod.z.number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: require_sleep.method(zod.z.object({
 			namespace: zod.z.string().optional(),
 			collection: zod.z.string()
-		}), zod.z.boolean()),
+		}), zod.z.boolean(), { auth: "admin" }),
 		/**
 		* Declare a typed (SQL-backed) collection with explicit columns +
 		* indexes. Idempotent: re-declaring an existing collection with the
@@ -10546,7 +10580,10 @@ id: zod.z.union([zod.z.string(), zod.z.number()]) }), { kind: "mutation" }),
 			collection: zod.z.string(),
 			columns: zod.z.array(CollectionColumnSchema).readonly(),
 			indexes: zod.z.array(CollectionIndexSchema).readonly().optional()
-		}), zod.z.void(), { kind: "mutation" })
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -11800,8 +11837,14 @@ var deviceExportCapability = {
 		getStatus: require_sleep.method(zod.z.void(), DeviceExportStatusSchema),
 		listSupportedDeviceKinds: require_sleep.method(zod.z.void(), zod.z.array(DeviceKindSchema)),
 		listExposedDevices: require_sleep.method(zod.z.void(), zod.z.array(ExposedDeviceSchema)),
-		exposeDevice: require_sleep.method(ExposeInputSchema, zod.z.void(), { kind: "mutation" }),
-		unexposeDevice: require_sleep.method(UnexposeInputSchema, zod.z.void(), { kind: "mutation" })
+		exposeDevice: require_sleep.method(ExposeInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unexposeDevice: require_sleep.method(UnexposeInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -12559,11 +12602,14 @@ var deviceManagerCapability = {
 		/** Remove a device from the DB + in-memory registry. Called by DeviceManagerApi.remove(). */
 		removeDevice: require_sleep.method(DeviceRemovePayloadSchema, zod.z.void(), { kind: "mutation" }),
 		/** Persist device config blob. Called by DeviceConfig.set/setAll(). */
-		persistConfig: require_sleep.method(DevicePersistConfigPayloadSchema, zod.z.void(), { kind: "mutation" }),
+		persistConfig: require_sleep.method(DevicePersistConfigPayloadSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Load persisted config for a device. Called at restore time. */
-		loadConfig: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.record(zod.z.string(), zod.z.unknown())),
+		loadConfig: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.record(zod.z.string(), zod.z.unknown()), { auth: "admin" }),
 		/** Load persisted runtime state. Called at device adopt time. */
-		loadRuntimeState: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.record(zod.z.string(), zod.z.unknown())),
+		loadRuntimeState: require_sleep.method(zod.z.object({ deviceId: zod.z.number() }), zod.z.record(zod.z.string(), zod.z.unknown()), { auth: "admin" }),
 		/** Load operator-organisational meta surface for a device. Called by
 		*  the kernel proxy to populate `DeviceContext.deviceMeta` before
 		*  the device class constructor runs. Returns `null` when the id
@@ -15382,12 +15428,27 @@ var mqttBrokerCapability = {
 	},
 	methods: {
 		listBrokers: require_sleep.method(zod.z.void(), zod.z.array(BrokerInfoSchema)),
-		getBrokerConfig: require_sleep.method(IdInputSchema, BrokerConnectionDetailsSchema),
-		addBroker: require_sleep.method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }),
-		removeBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
-		testConnection: require_sleep.method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }),
-		startEmbeddedBroker: require_sleep.method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }),
-		stopEmbeddedBroker: require_sleep.method(IdInputSchema, zod.z.void(), { kind: "mutation" }),
+		getBrokerConfig: require_sleep.method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }),
+		addBroker: require_sleep.method(AddBrokerInputSchema, AddBrokerResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeBroker: require_sleep.method(IdInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testConnection: require_sleep.method(IdInputSchema, TestResultSchema$1, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		startEmbeddedBroker: require_sleep.method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stopEmbeddedBroker: require_sleep.method(IdInputSchema, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getStatus: require_sleep.method(zod.z.void(), StatusSchema)
 	}
 };
@@ -15708,6 +15769,18 @@ var TargetKindSchema = zod.z.object({
 	*/
 	iconMediaType: zod.z.string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: zod.z.array(zod.z.string()).optional(),
 	supportsDiscovery: zod.z.boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -15752,25 +15825,40 @@ var notificationOutputCapability = {
 	mode: "collection",
 	methods: {
 		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
-		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema)),
+		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
 		discoverTargets: require_sleep.method(zod.z.object({
 			kind: zod.z.string(),
 			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-		}), zod.z.array(DiscoveredTargetSchema)),
+		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
 		send: require_sleep.method(zod.z.object({
 			targetId: zod.z.string(),
 			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		testTarget: require_sleep.method(zod.z.object({
 			targetId: zod.z.string(),
 			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: require_sleep.method(zod.z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: require_sleep.method(zod.z.object({ target: TargetSchema }), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		setTargetEnabled: require_sleep.method(zod.z.object({
 			targetId: zod.z.string(),
 			enabled: zod.z.boolean()
-		}), zod.z.void(), { kind: "mutation" })
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -26403,54 +26491,78 @@ var storageCapability = {
 		resolve: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string()
-		}), zod.z.string()),
+		}), zod.z.string(), { auth: "admin" }),
 		write: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string(),
 			data: zod.z.instanceof(Uint8Array)
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string()
-		}), zod.z.instanceof(Uint8Array)),
+		}), zod.z.instanceof(Uint8Array), { auth: "admin" }),
 		exists: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string()
-		}), zod.z.boolean()),
+		}), zod.z.boolean(), { auth: "admin" }),
 		list: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			prefix: zod.z.string().optional()
-		}), zod.z.array(zod.z.string()).readonly()),
+		}), zod.z.array(zod.z.string()).readonly(), { auth: "admin" }),
 		delete: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string()
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getAvailableSpace: require_sleep.method(zod.z.object({ location: StorageLocationRefSchema }), zod.z.number().nullable()),
 		beginUpload: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string(),
 			sizeBytes: zod.z.number().optional()
-		}), zod.z.object({ uploadId: zod.z.string() }), { kind: "mutation" }),
+		}), zod.z.object({ uploadId: zod.z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		writeChunk: require_sleep.method(zod.z.object({
 			uploadId: zod.z.string(),
 			offset: zod.z.number(),
 			data: zod.z.instanceof(Uint8Array)
-		}), zod.z.void(), { kind: "mutation" }),
-		finalizeUpload: require_sleep.method(zod.z.object({ uploadId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
-		abortUpload: require_sleep.method(zod.z.object({ uploadId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: require_sleep.method(zod.z.object({ uploadId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: require_sleep.method(zod.z.object({ uploadId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		beginDownload: require_sleep.method(zod.z.object({
 			location: StorageLocationRefSchema,
 			relativePath: zod.z.string()
 		}), zod.z.object({
 			downloadId: zod.z.string(),
 			sizeBytes: zod.z.number()
-		}), { kind: "mutation" }),
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		readChunk: require_sleep.method(zod.z.object({
 			downloadId: zod.z.string(),
 			offset: zod.z.number(),
 			length: zod.z.number()
-		}), zod.z.instanceof(Uint8Array)),
-		endDownload: require_sleep.method(zod.z.object({ downloadId: zod.z.string() }), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: require_sleep.method(zod.z.object({ downloadId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listLocations: require_sleep.method(zod.z.object({ type: StorageLocationTypeSchema.optional() }), zod.z.array(StorageLocationSchema).readonly()),
 		listLocationDeclarations: require_sleep.method(zod.z.void(), zod.z.array(StorageLocationDeclarationSchema).readonly()),
 		upsertLocation: require_sleep.method(StorageLocationSchema.omit({
@@ -60678,7 +60790,11 @@ var ALARM = [
 	"alarm-armed",
 	"alarm-disarmed",
 	"alarm-arming",
-	"alarm-arm-refused"
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
 ];
 var COMBINED_ALARM = ["alarm-triggered"];
 var DEVICE_EVENTS = [
@@ -61242,19 +61358,22 @@ var NC_TEMPLATE_VARS = [
 		systemEventKinds: [
 			"alarm-armed",
 			"alarm-arming",
-			"alarm-arm-refused"
+			"alarm-arm-refused",
+			"alarm-pending",
+			"alarm-rearmed",
+			"alarm-check-failed"
 		]
 	},
 	{
 		name: "seconds",
 		label: "Seconds",
-		description: "Arming: the exit delay left. Refusal: how long the retry-to-arm-anyway lasts.",
+		description: "Arming: the exit delay left. Pending: the entry delay left to disarm.",
 		example: "30",
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
 		kinds: ["system"],
-		systemEventKinds: ["alarm-arming", "alarm-arm-refused"]
+		systemEventKinds: ["alarm-arming", "alarm-pending"]
 	},
 	{
 		name: "rules",

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as AudioStreamPickSchema, A as DeviceType, At as DATAPLANE_SECRET_HEADER, B as optionalMethod, Bt as WELL_KNOWN_TAB_MAP, C as customAction, Ct as parseProfileBrokerId, D as ChargingStatus, Dt as PEER_BYTES_STALL_MS, E as deviceCustomAction, Et as PEER_BYTES_MAX_OUTSTANDING, F as PROVIDER_PIN_FIELD, Ft as createDurableState, G as readNodePin, Gt as AUDIO_CHUNK_FORMATS, H as systemMethod, Ht as collectHydratedFieldValues, I as event, It as createEvent, J as ReadinessTimeoutError, Jt as isAudioChunkFormat, K as toNodeId, Kt as audioChunkBytesPerSample, L as expandCapMethods, Lt as emitReadiness, M as DEFAULT_RUNTIME_STATE_DURABILITY, Mt as DisposerChain, N as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Nt as BaseAddon, O as DeviceFeature, Ot as PEER_BYTES_TICKET_TTL_MS, P as DEVICE_STATUS_METHOD, Pt as normalizeAddonInitResult, Q as AudioChunkFormatSchema, R as isDeviceConfigCap, Rt as isEvent, S as DEVICE_CHILDREN_BATCH_MAX, St as makeSourceBrokerId, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, U as CAP_NODE_PIN_CONTEXT_KEY, Ut as hydrateSchema, V as resolveCapMount, Vt as collectHydratedFieldEntries, W as nodePin, Wt as resolveHydratedFieldValue, X as readinessKey, Y as emitDownForOwnedCaps, Z as scopeKey, _ as createMirrorSource, _t as SubscribeAudioChunksInputSchema, a as asJsonObject, at as CamStreamResolutionSchema, b as deviceOpsCapability, bt as SubscribeFramesResultSchema, c as parseJsonArray, ct as DecodedFrameSchema, d as BOOT_RECOVERY_BACKOFF_MS, dt as FrameHandleSchema, et as BrokerStatsSchema, f as DEVICE_SCOPED_CAPS, ft as ProfileRtspEntrySchema, g as createLazyTrpcSource, gt as StreamSourceSchema, h as createEventBusSliceSource, ht as StreamSourceEntrySchema, i as asJsonArray, it as CamStreamKindSchema, j as adminUiCapability, jt as SHARE_VIEW_KINDS, k as DeviceRole, kt as PeerBytesTicketSchema, l as parseJsonObject, lt as EncodedPacketSchema, m as createDeviceProxy, mt as ProfileSlotStatusSchema, n as sleepCancellable, nt as CAM_PROFILE_ORDER, o as asNumber, ot as CameraStreamSchema, p as isDeviceScopedCap, pt as ProfileSlotSchema, q as ReadinessRegistry, qt as expandAudioChunkToF32le, r as asBoolean, rt as CamProfileSchema, s as asString, st as DecodedAudioChunkSchema, t as sleep, tt as BrokerStatusSchema, u as parseJsonUnknown, ut as FrameHandleFormatSchema, v as createSliceHandle, vt as SubscribeAudioChunksResultSchema, w as defineCustomActions, wt as selectAssignedProfileSlots, x as viewerUiCapability, xt as makeProfileBrokerId, y as RawStateResultSchema, yt as SubscribeFramesInputSchema, z as method, zt as WELL_KNOWN_TABS } from "./sleep-pM_J7YnY.mjs";
+import { $ as AudioStreamPickSchema, A as DeviceType, At as DATAPLANE_SECRET_HEADER, B as optionalMethod, Bt as WELL_KNOWN_TAB_MAP, C as customAction, Ct as parseProfileBrokerId, D as ChargingStatus, Dt as PEER_BYTES_STALL_MS, E as deviceCustomAction, Et as PEER_BYTES_MAX_OUTSTANDING, F as PROVIDER_PIN_FIELD, Ft as createDurableState, G as readNodePin, Gt as AUDIO_CHUNK_FORMATS, H as systemMethod, Ht as collectHydratedFieldValues, I as event, It as createEvent, J as ReadinessTimeoutError, Jt as isAudioChunkFormat, K as toNodeId, Kt as audioChunkBytesPerSample, L as expandCapMethods, Lt as emitReadiness, M as DEFAULT_RUNTIME_STATE_DURABILITY, Mt as DisposerChain, N as DEVICE_SETTINGS_CONTRIBUTION_METHODS, Nt as BaseAddon, O as DeviceFeature, Ot as PEER_BYTES_TICKET_TTL_MS, P as DEVICE_STATUS_METHOD, Pt as normalizeAddonInitResult, Q as AudioChunkFormatSchema, R as isDeviceConfigCap, Rt as isEvent, S as DEVICE_CHILDREN_BATCH_MAX, St as makeSourceBrokerId, T as describeCustomActions, Tt as PEER_BYTES_CHUNK_BYTES, U as CAP_NODE_PIN_CONTEXT_KEY, Ut as hydrateSchema, V as resolveCapMount, Vt as collectHydratedFieldEntries, W as nodePin, Wt as resolveHydratedFieldValue, X as readinessKey, Y as emitDownForOwnedCaps, Z as scopeKey, _ as createMirrorSource, _t as SubscribeAudioChunksInputSchema, a as asJsonObject, at as CamStreamResolutionSchema, b as deviceOpsCapability, bt as SubscribeFramesResultSchema, c as parseJsonArray, ct as DecodedFrameSchema, d as BOOT_RECOVERY_BACKOFF_MS, dt as FrameHandleSchema, et as BrokerStatsSchema, f as DEVICE_SCOPED_CAPS, ft as ProfileRtspEntrySchema, g as createLazyTrpcSource, gt as StreamSourceSchema, h as createEventBusSliceSource, ht as StreamSourceEntrySchema, i as asJsonArray, it as CamStreamKindSchema, j as adminUiCapability, jt as SHARE_VIEW_KINDS, k as DeviceRole, kt as PeerBytesTicketSchema, l as parseJsonObject, lt as EncodedPacketSchema, m as createDeviceProxy, mt as ProfileSlotStatusSchema, n as sleepCancellable, nt as CAM_PROFILE_ORDER, o as asNumber, ot as CameraStreamSchema, p as isDeviceScopedCap, pt as ProfileSlotSchema, q as ReadinessRegistry, qt as expandAudioChunkToF32le, r as asBoolean, rt as CamProfileSchema, s as asString, st as DecodedAudioChunkSchema, t as sleep, tt as BrokerStatusSchema, u as parseJsonUnknown, ut as FrameHandleFormatSchema, v as createSliceHandle, vt as SubscribeAudioChunksResultSchema, w as defineCustomActions, wt as selectAssignedProfileSlots, x as viewerUiCapability, xt as makeProfileBrokerId, y as RawStateResultSchema, yt as SubscribeFramesInputSchema, z as method, zt as WELL_KNOWN_TABS } from "./sleep-D_4W7xuQ.mjs";
 import { t as EventCategory } from "./event-category-BVDXG4tB.mjs";
 import { a as buildAudioArgs, c as buildVideoArgs, d as logBannerArgs, f as pickVideoEncoder, i as audioPlanFromEncodeProfile, l as invocationFromEncodeProfile, n as Fmp4BoxSplitter, o as buildFfmpegArgs, p as resolveStreamMaps, r as AUDIO_PRESETS, s as buildInputArgs, t as canonicalHash, u as isSoftwareDecode } from "./canonical-hash-CPK2Dy60.mjs";
 import { EventSourceType } from "./enums.mjs";
@@ -8441,7 +8441,7 @@ var brokerCapability = {
 		}),
 		/** Read the broker's cached state for a key. Returns `null` when
 		*  unknown to the broker (never published / unknown entity). */
-		getState: method(GetStateInputSchema, z.unknown().nullable()),
+		getState: method(GetStateInputSchema, z.unknown().nullable(), { auth: "admin" }),
 		/** Status method — explicit registration with a `z.void()` input so
 		*  the codegen-generated tRPC router types its input as
 		*  `{addonId?: string, nodeId?: string}` (system-scoped collection
@@ -10287,6 +10287,16 @@ var CollectionIndexSchema = z.object({
 * namespace, or none. Making the door enforce it is tracked separately —
 * it renames tables, so it needs a migration.
 *
+* **So every method is `auth: 'admin'` (D634).** Because nothing scopes a
+* call to its caller, a `protected` method here was a raw, unredacted read
+* (and write) of every addon's collections for any role holding
+* `category:system` — which is every role: a `viewer` could read every
+* notifier token in plaintext from `notifiers:notification-targets`. No
+* browser or app client calls this cap. Addons are not affected: an
+* addon's `ctx.api` cap call is resolved to the provider directly and never
+* enters the tRPC router (so the tier gates sessions and tokens, never
+* addons), and the hub itself calls it through the capability registry.
+*
 *   - `{ collection: 'addon-settings' }` → table `addon-settings`
 *   - `{ namespace: 'my-addon', collection: 'addon-settings' }` →
 *     table `my-addon:addon-settings`
@@ -10308,14 +10318,17 @@ var settingsStoreCapability = {
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.unknown()),
+		}), z.unknown(), { auth: "admin" }),
 		/** Set a value by key in a collection (upsert). */
 		set: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string(),
 			value: z.unknown()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Rows matching a filter.
 		*
@@ -10336,7 +10349,7 @@ var settingsStoreCapability = {
 			collection: z.string(),
 			filter: QueryFilterSchema.optional(),
 			columns: z.array(z.string()).readonly().optional()
-		}), z.array(SettingsRecordSchema).readonly()),
+		}), z.array(SettingsRecordSchema).readonly(), { auth: "admin" }),
 		/**
 		* Make a SLOT hold this row — insert it, or update whatever already
 		* occupies the slot — and answer with the id the row HAS.
@@ -10389,7 +10402,10 @@ var settingsStoreCapability = {
 		}), z.object({ 
 		/** The id the row HAS: assigned by SQLite on an insert, or the existing
 		*  row's own id on an update. */
-id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
+id: z.union([z.string(), z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Insert a new record. */
 		insert: method(z.object({
 			namespace: z.string().optional(),
@@ -10404,7 +10420,10 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 		* for an absent one, or the ROWID SQLite assigned on an `INTEGER`
 		* primary key — which is the only place an auto key is knowable.
 		*/
-id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
+id: z.union([z.string(), z.number()]) }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Insert MANY records in ONE transaction, returning how many landed.
 		*
@@ -10432,20 +10451,29 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 			namespace: z.string().optional(),
 			collection: z.string(),
 			records: z.array(BulkRecordSchema).readonly()
-		}), z.object({ inserted: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ inserted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Update an existing record by ID. */
 		update: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			id: z.string(),
 			data: z.record(z.string(), z.unknown())
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Delete a record by key/ID. */
 		delete: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			key: z.string()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Delete every record matching `filter`, in ONE statement, returning how
 		* many rows went. This exists because its absence made every retention
@@ -10464,7 +10492,10 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: MutationFilterSchema
-		}), z.object({ deleted: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ deleted: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Apply `data` to every record matching `filter`, in one statement,
 		* returning how many rows changed. Same filter contract as
@@ -10475,13 +10506,16 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 			collection: z.string(),
 			filter: MutationFilterSchema,
 			data: z.record(z.string(), z.unknown())
-		}), z.object({ updated: z.number().int() }), { kind: "mutation" }),
+		}), z.object({ updated: z.number().int() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Count entries in a collection, optionally filtered. */
 		count: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string(),
 			filter: QueryFilterSchema.optional()
-		}), z.number()),
+		}), z.number(), { auth: "admin" }),
 		/**
 		* `COUNT(*)` and one `SUM` / `MIN` / `MAX` per requested field, in ONE
 		* statement, over the rows `filter` selects.
@@ -10507,7 +10541,7 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 			collection: z.string(),
 			fields: z.array(AggregateFieldSchema).readonly(),
 			filter: QueryFilterSchema.optional()
-		}), AggregateResultSchema),
+		}), AggregateResultSchema, { auth: "admin" }),
 		/** Grouped counts per ((field-origin)/bucketSize) bucket, filtered. */
 		histogram: method(z.object({
 			namespace: z.string().optional(),
@@ -10519,12 +10553,12 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 		}), z.array(z.object({
 			bucket: z.number().int(),
 			count: z.number().int()
-		})).readonly()),
+		})).readonly(), { auth: "admin" }),
 		/** Check if a collection is empty. */
 		isEmpty: method(z.object({
 			namespace: z.string().optional(),
 			collection: z.string()
-		}), z.boolean()),
+		}), z.boolean(), { auth: "admin" }),
 		/**
 		* Declare a typed (SQL-backed) collection with explicit columns +
 		* indexes. Idempotent: re-declaring an existing collection with the
@@ -10545,7 +10579,10 @@ id: z.union([z.string(), z.number()]) }), { kind: "mutation" }),
 			collection: z.string(),
 			columns: z.array(CollectionColumnSchema).readonly(),
 			indexes: z.array(CollectionIndexSchema).readonly().optional()
-		}), z.void(), { kind: "mutation" })
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -11799,8 +11836,14 @@ var deviceExportCapability = {
 		getStatus: method(z.void(), DeviceExportStatusSchema),
 		listSupportedDeviceKinds: method(z.void(), z.array(DeviceKindSchema)),
 		listExposedDevices: method(z.void(), z.array(ExposedDeviceSchema)),
-		exposeDevice: method(ExposeInputSchema, z.void(), { kind: "mutation" }),
-		unexposeDevice: method(UnexposeInputSchema, z.void(), { kind: "mutation" })
+		exposeDevice: method(ExposeInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unexposeDevice: method(UnexposeInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -12558,11 +12601,14 @@ var deviceManagerCapability = {
 		/** Remove a device from the DB + in-memory registry. Called by DeviceManagerApi.remove(). */
 		removeDevice: method(DeviceRemovePayloadSchema, z.void(), { kind: "mutation" }),
 		/** Persist device config blob. Called by DeviceConfig.set/setAll(). */
-		persistConfig: method(DevicePersistConfigPayloadSchema, z.void(), { kind: "mutation" }),
+		persistConfig: method(DevicePersistConfigPayloadSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/** Load persisted config for a device. Called at restore time. */
-		loadConfig: method(z.object({ deviceId: z.number() }), z.record(z.string(), z.unknown())),
+		loadConfig: method(z.object({ deviceId: z.number() }), z.record(z.string(), z.unknown()), { auth: "admin" }),
 		/** Load persisted runtime state. Called at device adopt time. */
-		loadRuntimeState: method(z.object({ deviceId: z.number() }), z.record(z.string(), z.unknown())),
+		loadRuntimeState: method(z.object({ deviceId: z.number() }), z.record(z.string(), z.unknown()), { auth: "admin" }),
 		/** Load operator-organisational meta surface for a device. Called by
 		*  the kernel proxy to populate `DeviceContext.deviceMeta` before
 		*  the device class constructor runs. Returns `null` when the id
@@ -15381,12 +15427,27 @@ var mqttBrokerCapability = {
 	},
 	methods: {
 		listBrokers: method(z.void(), z.array(BrokerInfoSchema)),
-		getBrokerConfig: method(IdInputSchema, BrokerConnectionDetailsSchema),
-		addBroker: method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }),
-		removeBroker: method(IdInputSchema, z.void(), { kind: "mutation" }),
-		testConnection: method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }),
-		startEmbeddedBroker: method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }),
-		stopEmbeddedBroker: method(IdInputSchema, z.void(), { kind: "mutation" }),
+		getBrokerConfig: method(IdInputSchema, BrokerConnectionDetailsSchema, { auth: "admin" }),
+		addBroker: method(AddBrokerInputSchema, AddBrokerResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		removeBroker: method(IdInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testConnection: method(IdInputSchema, TestResultSchema$1, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		startEmbeddedBroker: method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stopEmbeddedBroker: method(IdInputSchema, z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getStatus: method(z.void(), StatusSchema)
 	}
 };
@@ -15707,6 +15768,18 @@ var TargetKindSchema = z.object({
 	*/
 	iconMediaType: z.string().optional(),
 	configSchema: ConfigSchemaPassthrough,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: z.array(z.string()).optional(),
 	supportsDiscovery: z.boolean(),
 	caps: TargetKindCapsSchema
 });
@@ -15751,25 +15824,40 @@ var notificationOutputCapability = {
 	mode: "collection",
 	methods: {
 		listTargetKinds: method(z.object({}), z.array(TargetKindSchema)),
-		listTargets: method(z.object({}), z.array(TargetSchema)),
+		listTargets: method(z.object({}), z.array(TargetSchema), { auth: "admin" }),
 		discoverTargets: method(z.object({
 			kind: z.string(),
 			config: z.record(z.string(), z.unknown()).optional()
-		}), z.array(DiscoveredTargetSchema)),
+		}), z.array(DiscoveredTargetSchema), { auth: "admin" }),
 		send: method(z.object({
 			targetId: z.string(),
 			notification: NotificationSchema
-		}), SendResultSchema, { kind: "mutation" }),
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		testTarget: method(z.object({
 			targetId: z.string(),
 			sample: NotificationSchema.optional()
-		}), TestResultSchema, { kind: "mutation" }),
-		upsertTarget: method(z.object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }),
-		deleteTarget: method(z.object({ targetId: z.string() }), z.void(), { kind: "mutation" }),
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: method(z.object({ target: TargetSchema }), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: method(z.object({ targetId: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		setTargetEnabled: method(z.object({
 			targetId: z.string(),
 			enabled: z.boolean()
-		}), z.void(), { kind: "mutation" })
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
 	}
 };
 //#endregion
@@ -26402,54 +26490,78 @@ var storageCapability = {
 		resolve: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string()
-		}), z.string()),
+		}), z.string(), { auth: "admin" }),
 		write: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string(),
 			data: z.instanceof(Uint8Array)
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		read: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string()
-		}), z.instanceof(Uint8Array)),
+		}), z.instanceof(Uint8Array), { auth: "admin" }),
 		exists: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string()
-		}), z.boolean()),
+		}), z.boolean(), { auth: "admin" }),
 		list: method(z.object({
 			location: StorageLocationRefSchema,
 			prefix: z.string().optional()
-		}), z.array(z.string()).readonly()),
+		}), z.array(z.string()).readonly(), { auth: "admin" }),
 		delete: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string()
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		getAvailableSpace: method(z.object({ location: StorageLocationRefSchema }), z.number().nullable()),
 		beginUpload: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string(),
 			sizeBytes: z.number().optional()
-		}), z.object({ uploadId: z.string() }), { kind: "mutation" }),
+		}), z.object({ uploadId: z.string() }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		writeChunk: method(z.object({
 			uploadId: z.string(),
 			offset: z.number(),
 			data: z.instanceof(Uint8Array)
-		}), z.void(), { kind: "mutation" }),
-		finalizeUpload: method(z.object({ uploadId: z.string() }), z.void(), { kind: "mutation" }),
-		abortUpload: method(z.object({ uploadId: z.string() }), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		finalizeUpload: method(z.object({ uploadId: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		abortUpload: method(z.object({ uploadId: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		beginDownload: method(z.object({
 			location: StorageLocationRefSchema,
 			relativePath: z.string()
 		}), z.object({
 			downloadId: z.string(),
 			sizeBytes: z.number()
-		}), { kind: "mutation" }),
+		}), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		readChunk: method(z.object({
 			downloadId: z.string(),
 			offset: z.number(),
 			length: z.number()
-		}), z.instanceof(Uint8Array)),
-		endDownload: method(z.object({ downloadId: z.string() }), z.void(), { kind: "mutation" }),
+		}), z.instanceof(Uint8Array), { auth: "admin" }),
+		endDownload: method(z.object({ downloadId: z.string() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		listLocations: method(z.object({ type: StorageLocationTypeSchema.optional() }), z.array(StorageLocationSchema).readonly()),
 		listLocationDeclarations: method(z.void(), z.array(StorageLocationDeclarationSchema).readonly()),
 		upsertLocation: method(StorageLocationSchema.omit({
@@ -60677,7 +60789,11 @@ var ALARM = [
 	"alarm-armed",
 	"alarm-disarmed",
 	"alarm-arming",
-	"alarm-arm-refused"
+	"alarm-arm-refused",
+	"alarm-pending",
+	"alarm-rearmed",
+	"alarm-sensor-bypass",
+	"alarm-check-failed"
 ];
 var COMBINED_ALARM = ["alarm-triggered"];
 var DEVICE_EVENTS = [
@@ -61241,19 +61357,22 @@ var NC_TEMPLATE_VARS = [
 		systemEventKinds: [
 			"alarm-armed",
 			"alarm-arming",
-			"alarm-arm-refused"
+			"alarm-arm-refused",
+			"alarm-pending",
+			"alarm-rearmed",
+			"alarm-check-failed"
 		]
 	},
 	{
 		name: "seconds",
 		label: "Seconds",
-		description: "Arming: the exit delay left. Refusal: how long the retry-to-arm-anyway lasts.",
+		description: "Arming: the exit delay left. Pending: the entry delay left to disarm.",
 		example: "30",
 		group: "system",
 		families: ["rule"],
 		fields: [...RULE_TEXT],
 		kinds: ["system"],
-		systemEventKinds: ["alarm-arming", "alarm-arm-refused"]
+		systemEventKinds: ["alarm-arming", "alarm-pending"]
 	},
 	{
 		name: "rules",

package/dist/{sleep-CvwUEq16.js → sleep-BAgDk7I9.js}

@@ -3075,7 +3075,10 @@ var deviceOpsCapability = {
 		setConfig: method(zod.z.object({
 			deviceId: zod.z.number(),
 			values: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.void(), { kind: "mutation" }),
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Invoke a device custom action on a forked/remote device (the
 		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
@@ -3092,7 +3095,10 @@ var deviceOpsCapability = {
 		* (close sockets, stop background tasks, …). The device-manager still
 		* performs its own persistence cleanup before/after this call.
 		*/
-		removeDevice: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+		removeDevice: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Build the ConfigUISchema (FormBuilder input shape) from the device's
 		* Zod config schema. Runs on the worker that owns the IDevice so the

package/dist/{sleep-pM_J7YnY.mjs → sleep-D_4W7xuQ.mjs}

@@ -3075,7 +3075,10 @@ var deviceOpsCapability = {
 		setConfig: method(z.object({
 			deviceId: z.number(),
 			values: z.record(z.string(), z.unknown())
-		}), z.void(), { kind: "mutation" }),
+		}), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Invoke a device custom action on a forked/remote device (the
 		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
@@ -3092,7 +3095,10 @@ var deviceOpsCapability = {
 		* (close sockets, stop background tasks, …). The device-manager still
 		* performs its own persistence cleanup before/after this call.
 		*/
-		removeDevice: method(z.object({ deviceId: z.number() }), z.void(), { kind: "mutation" }),
+		removeDevice: method(z.object({ deviceId: z.number() }), z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
 		/**
 		* Build the ConfigUISchema (FormBuilder input shape) from the device's
 		* Zod config schema. Runs on the worker that owns the IDevice so the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/types",
-  "version": "1.2.249",
+  "version": "1.2.251",
   "description": "Shared types, interfaces, and model catalogs for the CamStack detection ecosystem",
   "keywords": [
     "camstack",