@camstack/types 1.2.33 → 1.2.35

package/dist/{sleep-C1ssEDf2.mjs → sleep-BeLSE-Rr.mjs}

@@ -1,70 +1,5 @@
 import { t as EventCategory } from "./event-category-41fKf-q9.mjs";
 import { z } from "zod";
-//#region src/disposer-chain.ts
-var DisposerChain = class {
-	disposers = [];
-	disposed = false;
-	onError;
-	constructor(opts = {}) {
-		this.onError = opts.onError ?? ((err, index) => {
-			console.error(`[DisposerChain] disposer #${index} threw`, err);
-		});
-	}
-	/**
-	* Register a teardown callback. Returns an unregister function so
-	* callers can drop a single disposer without disposing the whole
-	* chain.
-	*
-	* If the chain has already been disposed, the callback runs immediately
-	* (sync) — this matches the “register-after-shutdown” edge case where
-	* an addon's late initialization races with kernel restart.
-	*/
-	add(fn) {
-		if (this.disposed) {
-			try {
-				const result = fn();
-				if (result && typeof result.then === "function") result.catch((err) => this.onError(err, -1));
-			} catch (err) {
-				this.onError(err, -1);
-			}
-			return () => void 0;
-		}
-		this.disposers.push(fn);
-		return () => {
-			const idx = this.disposers.indexOf(fn);
-			if (idx >= 0) this.disposers.splice(idx, 1);
-		};
-	}
-	/** True after `dispose()` has been called at least once. */
-	get isDisposed() {
-		return this.disposed;
-	}
-	/** Number of disposers currently registered. */
-	get size() {
-		return this.disposers.length;
-	}
-	/**
-	* Run every registered disposer in LIFO order. Idempotent: subsequent
-	* calls do nothing. Awaits async disposers so callers can sequence
-	* shutdown → restart correctly.
-	*/
-	async dispose() {
-		if (this.disposed) return;
-		this.disposed = true;
-		const drain = this.disposers.slice().toReversed();
-		this.disposers = [];
-		for (let i = 0; i < drain.length; i++) {
-			const fn = drain[i];
-			try {
-				const result = fn();
-				if (result && typeof result.then === "function") await result;
-			} catch (err) {
-				this.onError(err, drain.length - 1 - i);
-			}
-		}
-	}
-};
-//#endregion
 //#region src/interfaces/config-ui.ts
 /** Predefined tabs with standard label, icon, and sort order.
 *
@@ -1084,6 +1019,80 @@ function normalizeAddonInitResult(result) {
 	return result;
 }
 //#endregion
+//#region src/disposer-chain.ts
+var DisposerChain = class {
+	disposers = [];
+	disposed = false;
+	onError;
+	constructor(opts = {}) {
+		this.onError = opts.onError ?? ((err, index) => {
+			console.error(`[DisposerChain] disposer #${index} threw`, err);
+		});
+	}
+	/**
+	* Register a teardown callback. Returns an unregister function so
+	* callers can drop a single disposer without disposing the whole
+	* chain.
+	*
+	* If the chain has already been disposed, the callback runs immediately
+	* (sync) — this matches the “register-after-shutdown” edge case where
+	* an addon's late initialization races with kernel restart.
+	*/
+	add(fn) {
+		if (this.disposed) {
+			try {
+				const result = fn();
+				if (result && typeof result.then === "function") result.catch((err) => this.onError(err, -1));
+			} catch (err) {
+				this.onError(err, -1);
+			}
+			return () => void 0;
+		}
+		this.disposers.push(fn);
+		return () => {
+			const idx = this.disposers.indexOf(fn);
+			if (idx >= 0) this.disposers.splice(idx, 1);
+		};
+	}
+	/** True after `dispose()` has been called at least once. */
+	get isDisposed() {
+		return this.disposed;
+	}
+	/** Number of disposers currently registered. */
+	get size() {
+		return this.disposers.length;
+	}
+	/**
+	* Run every registered disposer in LIFO order. Idempotent: subsequent
+	* calls do nothing. Awaits async disposers so callers can sequence
+	* shutdown → restart correctly.
+	*/
+	async dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		const drain = this.disposers.slice().toReversed();
+		this.disposers = [];
+		for (let i = 0; i < drain.length; i++) {
+			const fn = drain[i];
+			try {
+				const result = fn();
+				if (result && typeof result.then === "function") await result;
+			} catch (err) {
+				this.onError(err, drain.length - 1 - i);
+			}
+		}
+	}
+};
+//#endregion
+//#region src/interfaces/addon-data-plane.ts
+/**
+* Per-listener shared-secret header the hub injects on every reverse-proxied
+* data-plane request and the addon's framework wrapper validates — so only the
+* hub can reach the addon's `127.0.0.1` listener. Defined here (shared by the
+* core proxy and the kernel listener) to keep both off a kernel↔core import.
+*/
+var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = z.enum([
@@ -1898,15 +1907,6 @@ function emitDownForOwnedCaps(registry, owned) {
 	for (const { capName, scope } of owned) registry.emitDown(capName, scope);
 }
 //#endregion
-//#region src/interfaces/addon-data-plane.ts
-/**
-* Per-listener shared-secret header the hub injects on every reverse-proxied
-* data-plane request and the addon's framework wrapper validates — so only the
-* hub can reach the addon's `127.0.0.1` listener. Defined here (shared by the
-* core proxy and the kernel listener) to keep both off a kernel↔core import.
-*/
-var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
-//#endregion
 //#region src/cap-call-context.ts
 /**
 * Per-call node pinning for `ctx.api` capability calls.
@@ -1948,171 +1948,180 @@ function readNodePin(context) {
 	return typeof value === "string" ? value : void 0;
 }
 //#endregion
-//#region src/utils/json-safe.ts
+//#region src/capabilities/capability-definition.ts
 /**
-* Type-safe JSON parsing helpers.
+* Generic types for capability definitions.
 *
-* `JSON.parse` is typed as `any` in lib.es5.d.ts, which triggers
-* `no-unsafe-*` ESLint rules and destroys downstream inference. These
-* wrappers return `unknown` — callers narrow structurally via type
-* guards, `typeof` checks, or helpers like `asRecord`/`asString`.
+* A capability is defined with Zod schemas for methods, events, and settings.
+* TypeScript types are inferred via z.infer<> — zero duplication.
+*
+* Pattern:
+*   1. Define Zod schemas for data, methods, settings
+*   2. Export const capabilityDef = { ... } satisfies CapabilityDefinition
+*   3. Export type IProvider = InferProvider<typeof capabilityDef>
+*   4. Addon implements IProvider
+*   5. Registry auto-mounts tRPC router from definition.methods
 */
 /**
-* Parse JSON and return it as `unknown` — the only entry point for untrusted JSON.
-*
-* The optional generic overload `parseJsonUnknown<T>(text)` returns `T` for
-* call sites that know the shape at parse time (e.g. MQTT payloads with a
-* known protocol schema). This is a **type-level bridge only** — no runtime
-* validation is performed. Callers that need runtime validation should parse
-* as `unknown` and narrow via Zod or structural guards.
+* Resolve the EFFECTIVE mount hint for a cap — the explicit `mount` when
+* present, else the scope/mode/deviceNative-derived default. Single source
+* of truth shared by the runtime builder and any codegen that needs the
+* same classification, so the two can never disagree.
 */
-function parseJsonUnknown(text) {
-	return JSON.parse(text);
-}
-/** Narrow an unknown value to a plain `Record<string, unknown>` or return null. */
-function asJsonObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	return { ...value };
-}
-/** Narrow an unknown value to a `readonly unknown[]` or return an empty array. */
-function asJsonArray(value) {
-	return Array.isArray(value) ? value : [];
-}
-/** Safe string extraction from an unknown record field. */
-function asString(value, fallback = "") {
-	return typeof value === "string" ? value : fallback;
-}
-/** Safe number extraction from an unknown record field. */
-function asNumber(value, fallback = 0) {
-	return typeof value === "number" ? value : fallback;
-}
-/** Safe boolean extraction from an unknown record field. */
-function asBoolean(value, fallback = false) {
-	return typeof value === "boolean" ? value : fallback;
-}
-/** Parse JSON + narrow to object in one step. */
-function parseJsonObject(text) {
-	try {
-		return asJsonObject(parseJsonUnknown(text));
-	} catch {
-		return null;
-	}
-}
-/** Parse JSON + narrow to array in one step. */
-function parseJsonArray(text) {
-	try {
-		const parsed = parseJsonUnknown(text);
-		return Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
+function resolveCapMount(def) {
+	if (def.mount) return def.mount;
+	if (def.deviceNative === true) return { kind: "device-native" };
+	if (def.mode === "collection") return { kind: "collection" };
+	return { kind: "singleton" };
 }
-//#endregion
-//#region src/generated/device-scoped-caps.ts
 /**
-* AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
+* Output schema shared by the contribution + live methods.
 *
-* Every `scope: 'device'` capability name, as plain data — so a forked runner
-* can answer "may a rule actuate this?" without importing the schema barrel
-* (~144MB RSS per runner, D28).
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
 *
-* Coverage: 80 device-scoped capabilities.
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
 */
-var DEVICE_SCOPED_CAPS = new Set([
-	"accessories",
-	"air-quality-sensor",
-	"alarm-panel",
-	"ambient-light-sensor",
-	"audio-analysis",
-	"audio-metrics",
-	"automation-control",
-	"battery",
-	"binary",
-	"brightness",
-	"button",
-	"camera-credentials",
-	"camera-pipeline-config",
-	"camera-streams",
-	"carbon-monoxide",
-	"climate-control",
-	"color",
-	"connectivity",
-	"consumables",
-	"contact",
-	"control",
-	"cover",
-	"day-night",
-	"detection-pipeline",
-	"device-discovery",
-	"device-ops",
-	"device-status",
-	"doorbell",
-	"enum-sensor",
-	"event-emitter",
-	"events",
-	"fan-control",
-	"feature-probe",
-	"flood",
-	"gas",
-	"humidifier",
-	"humidity-sensor",
-	"image",
-	"image-settings",
-	"intercom",
-	"lawn-mower-control",
-	"lock-control",
-	"media-player",
-	"motion",
-	"motion-detection",
-	"motion-trigger",
-	"motion-zones",
-	"native-object-detection",
-	"notifier",
-	"numeric-sensor",
-	"osd",
-	"pet-feeder",
-	"pipeline-analytics",
-	"power-meter",
-	"presence",
-	"pressure-sensor",
-	"privacy-mask",
-	"ptz",
-	"ptz-autotrack",
-	"reboot",
-	"scene-monitor",
-	"script-runner",
-	"smoke",
-	"snapshot",
-	"stream-catalog",
-	"stream-params",
-	"switch",
-	"tamper",
-	"temperature-sensor",
-	"update",
-	"vacuum-control",
-	"valve",
-	"vibration",
-	"videoclips",
-	"water-heater",
-	"weather",
-	"webrtc-session",
-	"zone-analytics",
-	"zone-rules",
-	"zones"
-]);
+var ContributionSectionSchema = z.object({
+	id: z.string(),
+	title: z.string(),
+	description: z.string().optional(),
+	style: z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: z.boolean().optional(),
+	columns: z.union([
+		z.literal(1),
+		z.literal(2),
+		z.literal(3),
+		z.literal(4)
+	]).optional(),
+	tab: z.string().optional(),
+	location: z.enum(["settings", "top-tab"]).optional(),
+	order: z.number().optional(),
+	fields: z.array(z.any())
+});
+var ContributionTabSchema = z.object({
+	id: z.string(),
+	label: z.string(),
+	icon: z.string(),
+	order: z.number().optional()
+});
+var ContributionOutputSchema = z.object({
+	tabs: z.array(ContributionTabSchema).optional(),
+	sections: z.array(ContributionSectionSchema)
+}).nullable();
+var DEVICE_SETTINGS_CONTRIBUTION_METHODS = {
+	getDeviceSettingsContribution: {
+		input: z.object({ deviceId: z.number() }),
+		output: ContributionOutputSchema,
+		kind: "query",
+		auth: "protected"
+	},
+	getDeviceLiveContribution: {
+		input: z.object({ deviceId: z.number() }),
+		output: ContributionOutputSchema,
+		kind: "query",
+		auth: "protected"
+	},
+	applyDeviceSettingsPatch: {
+		input: z.object({
+			deviceId: z.number(),
+			patch: z.record(z.string(), z.unknown())
+		}),
+		output: z.object({ success: z.literal(true) }),
+		kind: "mutation",
+		auth: "admin"
+	}
+};
 /**
-* True when `capName` is a device capability.
+* Schema for the `getStatus` method auto-injected when a cap declares
+* `status`. The runtime shape of the output is the cap's own
+* `status.schema` — but at codegen time we need a concrete Zod to emit
+* a typed tRPC route, so we keep the output as `z.unknown().nullable()`
+* here and tighten it on the client side via the generated
+* `CapStatusTypeMap` (see `scripts/generate-cap-status-types.ts`).
+*/
+var DEVICE_STATUS_METHOD = { getStatus: {
+	input: z.object({ deviceId: z.number() }),
+	output: z.unknown().nullable(),
+	kind: "query",
+	auth: "protected"
+} };
+/**
+* Expand a cap def's methods map with every auto-injected method:
+*   - `exposesDeviceSettings: true`      → 3 contribution methods
+*   - `status: {...}`                    → `getStatus`
 *
-* This is the ONLY boundary on what a notification rule may actuate. A rule can
-* be authored by a non-admin and the runner executes with the addon's
-* privileges, so an unbounded action would be an arbitrary RPC channel with a
-* privilege escalation attached. Device scope excludes the system caps
-* (`device-manager.removeDevice` and friends) by construction.
+* Callers walk `expandCapMethods(def)` instead of `def.methods` when
+* they need the effective runtime method surface (Moleculer actions,
+* proxy shape, tRPC router entries). The cap def stays the single
+* source of truth. Providers still declare their concrete `methods`
+* block; the expansion happens at every consumption point, so there's
+* no accidental divergence between the declared surface and what's
+* actually mounted.
 */
-function isDeviceScopedCap(capName) {
-	return DEVICE_SCOPED_CAPS.has(capName);
+function expandCapMethods(def) {
+	let out = def.methods;
+	if (def.exposesDeviceSettings) out = {
+		...DEVICE_SETTINGS_CONTRIBUTION_METHODS,
+		...out
+	};
+	if (def.status) out = {
+		...DEVICE_STATUS_METHOD,
+		...out
+	};
+	return out;
+}
+function method(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
+	};
+}
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
+/** Shorthand to define an event schema */
+function event(data) {
+	return { data };
+}
+/** Type guard: does this cap declare the D14 device-config archetype? */
+function isDeviceConfigCap(def) {
+	return def?.deviceConfig !== void 0;
 }
 //#endregion
+//#region src/capabilities/admin-ui.cap.ts
+var StaticDirOutputSchema$1 = z.object({ staticDir: z.string() });
+var VersionOutputSchema$1 = z.object({ version: z.string() });
+var adminUiCapability = {
+	name: "admin-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		getStaticDir: method(z.void(), StaticDirOutputSchema$1),
+		getVersion: method(z.void(), VersionOutputSchema$1)
+	}
+};
+//#endregion
 //#region src/device/device-type.ts
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
@@ -2439,165 +2448,144 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	return DeviceRole;
 }({});
 //#endregion
-//#region src/capabilities/capability-definition.ts
-/**
-* Generic types for capability definitions.
-*
-* A capability is defined with Zod schemas for methods, events, and settings.
-* TypeScript types are inferred via z.infer<> — zero duplication.
-*
-* Pattern:
-*   1. Define Zod schemas for data, methods, settings
-*   2. Export const capabilityDef = { ... } satisfies CapabilityDefinition
-*   3. Export type IProvider = InferProvider<typeof capabilityDef>
-*   4. Addon implements IProvider
-*   5. Registry auto-mounts tRPC router from definition.methods
-*/
+//#region src/capabilities/viewer-ui.cap.ts
+var StaticDirOutputSchema = z.object({ staticDir: z.string() });
+var VersionOutputSchema = z.object({ version: z.string() });
 /**
-* Resolve the EFFECTIVE mount hint for a cap — the explicit `mount` when
-* present, else the scope/mode/deviceNative-derived default. Single source
-* of truth shared by the runtime builder and any codegen that needs the
-* same classification, so the two can never disagree.
+* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
+* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
+* `admin-ui` exactly: a singleton, server-internal cap exposing the static
+* dist directory + build version so `main.ts` can mount the SPA under a
+* dedicated prefix.
 */
-function resolveCapMount(def) {
-	if (def.mount) return def.mount;
-	if (def.deviceNative === true) return { kind: "device-native" };
-	if (def.mode === "collection") return { kind: "collection" };
-	return { kind: "singleton" };
-}
+var viewerUiCapability = {
+	name: "viewer-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		getStaticDir: method(z.void(), StaticDirOutputSchema),
+		getVersion: method(z.void(), VersionOutputSchema)
+	}
+};
+//#endregion
+//#region src/capabilities/device-ops.cap.ts
 /**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
+* device-ops — device-scoped cap that unifies the per-IDevice operations
+* previously routed through the `.device-ops` Moleculer bridge service.
 *
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
+* Each worker that hosts live `IDevice` instances auto-registers a native
+* provider for this cap (per device) backed by its local
+* `DeviceRegistry`. Hub-side callers reach it transparently through
+* `ctx.fetchDevice(id).deviceOps.*` — the DeviceProxy injects
+* `deviceId` + `nodeId` and dispatches through the standard cap-router,
+* so there's no parallel bridge path anymore.
+*
+* The surface is intentionally small — every method corresponds to a
+* single action on the live `IDevice` (or `ICameraDevice` for
+* `getStreamSources`). Richer orchestration (enable/disable with
+* integration plumbing, bulk updates) stays in the `device-manager` cap;
+* `device-ops` is the per-device primitive the device-manager routes to.
 */
-var ContributionSectionSchema = z.object({
-	id: z.string(),
-	title: z.string(),
-	description: z.string().optional(),
-	style: z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: z.boolean().optional(),
-	columns: z.union([
-		z.literal(1),
-		z.literal(2),
-		z.literal(3),
-		z.literal(4)
-	]).optional(),
-	tab: z.string().optional(),
-	location: z.enum(["settings", "top-tab"]).optional(),
-	order: z.number().optional(),
-	fields: z.array(z.any())
-});
-var ContributionTabSchema = z.object({
+var StreamSourceEntrySchema = z.object({
 	id: z.string(),
 	label: z.string(),
-	icon: z.string(),
-	order: z.number().optional()
+	protocol: z.enum([
+		"rtsp",
+		"rtmp",
+		"annexb",
+		"http-mjpeg",
+		"webrtc",
+		"custom"
+	]),
+	url: z.string().optional(),
+	resolution: z.object({
+		width: z.number(),
+		height: z.number()
+	}).optional(),
+	fps: z.number().optional(),
+	bitrate: z.number().optional(),
+	codec: z.string().optional(),
+	profileHint: CamProfileSchema.optional(),
+	sdp: z.string().optional()
 });
-var ContributionOutputSchema = z.object({
-	tabs: z.array(ContributionTabSchema).optional(),
-	sections: z.array(ContributionSectionSchema)
-}).nullable();
-var DEVICE_SETTINGS_CONTRIBUTION_METHODS = {
-	getDeviceSettingsContribution: {
-		input: z.object({ deviceId: z.number() }),
-		output: ContributionOutputSchema,
-		kind: "query",
-		auth: "protected"
-	},
-	getDeviceLiveContribution: {
-		input: z.object({ deviceId: z.number() }),
-		output: ContributionOutputSchema,
-		kind: "query",
-		auth: "protected"
-	},
-	applyDeviceSettingsPatch: {
-		input: z.object({
+var ConfigEntrySchema = z.object({
+	key: z.string(),
+	value: z.unknown()
+});
+var RawStateResultSchema = z.object({
+	/** Originating provider id, e.g. 'homeassistant' | 'reolink' | 'hikvision'. */
+	source: z.string(),
+	/** Opaque, DISPLAY-SAFE upstream blob (no secrets/PII). */
+	data: z.record(z.string(), z.unknown())
+});
+var deviceOpsCapability = {
+	name: "device-ops",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {
+		/**
+		* Return stream sources for camera-like devices. Non-camera devices
+		* return an empty array (the bridge did the same; preserved for compat).
+		*/
+		getStreamSources: method(z.object({ deviceId: z.number() }), z.array(StreamSourceEntrySchema)),
+		/**
+		* Return the device's config entries (key + current value). Used by
+		* the device-manager aggregator when reading the driver's schema+values.
+		*/
+		getConfigEntries: method(z.object({ deviceId: z.number() }), z.array(ConfigEntrySchema)),
+		/**
+		* Bulk-apply a config patch via `IDevice.config.setAll`. Covers the
+		* updateConfig / setStreamProfileMap / enable-as-config paths from
+		* the old bridge.
+		*/
+		setConfig: method(z.object({
 			deviceId: z.number(),
-			patch: z.record(z.string(), z.unknown())
-		}),
-		output: z.object({ success: z.literal(true) }),
-		kind: "mutation",
-		auth: "admin"
+			values: z.record(z.string(), z.unknown())
+		}), z.void(), { kind: "mutation" }),
+		/**
+		* Invoke a device custom action on a forked/remote device (the
+		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
+		* `setConfig` — the device-manager calls this when the device is not
+		* hub-local.
+		*/
+		runAction: method(z.object({
+			deviceId: z.number(),
+			action: z.string().min(1),
+			input: z.unknown()
+		}), z.unknown(), { kind: "mutation" }),
+		/**
+		* Invoke `IDevice.removeDevice()` so the driver can release resources
+		* (close sockets, stop background tasks, …). The device-manager still
+		* performs its own persistence cleanup before/after this call.
+		*/
+		removeDevice: method(z.object({ deviceId: z.number() }), z.void(), { kind: "mutation" }),
+		/**
+		* Build the ConfigUISchema (FormBuilder input shape) from the device's
+		* Zod config schema. Runs on the worker that owns the IDevice so the
+		* Zod types stay local (they're function references, not
+		* serializable). Returns a fully JSON-serializable schema with
+		* sections/fields the admin UI renders directly.
+		*
+		* Needed because the hub-side `device-manager.getSettingsSchema`
+		* couldn't reach forked-worker devices — it had no registry entry
+		* and no cross-process lookup, so the UI silently rendered an empty
+		* settings panel for every worker-owned device.
+		*
+		* Returns `null` when the device isn't found on this worker.
+		*/
+		getSettingsSchema: method(z.object({ deviceId: z.number() }), z.unknown().nullable()),
+		/**
+		* Opt-in: return the device's RAW upstream state (the provider's
+		* cached values) as a display-safe `{ source, data }` blob. Returns
+		* `null` when the device exposes no raw state — the State panel hides
+		* its Raw toggle in that case. One-shot (read the provider's existing
+		* cache; no upstream round-trip).
+		*/
+		getRawState: method(z.object({ deviceId: z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
 	}
 };
-/**
-* Schema for the `getStatus` method auto-injected when a cap declares
-* `status`. The runtime shape of the output is the cap's own
-* `status.schema` — but at codegen time we need a concrete Zod to emit
-* a typed tRPC route, so we keep the output as `z.unknown().nullable()`
-* here and tighten it on the client side via the generated
-* `CapStatusTypeMap` (see `scripts/generate-cap-status-types.ts`).
-*/
-var DEVICE_STATUS_METHOD = { getStatus: {
-	input: z.object({ deviceId: z.number() }),
-	output: z.unknown().nullable(),
-	kind: "query",
-	auth: "protected"
-} };
-/**
-* Expand a cap def's methods map with every auto-injected method:
-*   - `exposesDeviceSettings: true`      → 3 contribution methods
-*   - `status: {...}`                    → `getStatus`
-*
-* Callers walk `expandCapMethods(def)` instead of `def.methods` when
-* they need the effective runtime method surface (Moleculer actions,
-* proxy shape, tRPC router entries). The cap def stays the single
-* source of truth. Providers still declare their concrete `methods`
-* block; the expansion happens at every consumption point, so there's
-* no accidental divergence between the declared surface and what's
-* actually mounted.
-*/
-function expandCapMethods(def) {
-	let out = def.methods;
-	if (def.exposesDeviceSettings) out = {
-		...DEVICE_SETTINGS_CONTRIBUTION_METHODS,
-		...out
-	};
-	if (def.status) out = {
-		...DEVICE_STATUS_METHOD,
-		...out
-	};
-	return out;
-}
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A wrapper/system-only method: served exclusively by the cap's system-level
-* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
-* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
-* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
-*/
-function systemMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		systemOnly: true
-	};
-}
-/** Shorthand to define an event schema */
-function event(data) {
-	return { data };
-}
-/** Type guard: does this cap declare the D14 device-config archetype? */
-function isDeviceConfigCap(def) {
-	return def?.deviceConfig !== void 0;
-}
 //#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
@@ -3120,7 +3108,9 @@ function createDeviceProxy(api, binding, opts) {
 			getHistory: (input) => dispatch("notification-rules", "notificationRules", "getHistory", "query", input),
 			listSnoozes: (input) => dispatch("notification-rules", "notificationRules", "listSnoozes", "query", input),
 			createSnooze: (input) => dispatch("notification-rules", "notificationRules", "createSnooze", "mutation", input),
-			cancelSnooze: (input) => dispatch("notification-rules", "notificationRules", "cancelSnooze", "mutation", input)
+			cancelSnooze: (input) => dispatch("notification-rules", "notificationRules", "cancelSnooze", "mutation", input),
+			getAlarmConfig: (input) => dispatch("notification-rules", "notificationRules", "getAlarmConfig", "query", input),
+			setAlarmConfig: (input) => dispatch("notification-rules", "notificationRules", "setAlarmConfig", "mutation", input)
 		},
 		notifier: {
 			send: (input) => dispatch("notifier", "notifier", "send", "mutation", input),
@@ -3445,158 +3435,170 @@ function createDeviceProxy(api, binding, opts) {
 	};
 }
 //#endregion
-//#region src/capabilities/admin-ui.cap.ts
-var StaticDirOutputSchema$1 = z.object({ staticDir: z.string() });
-var VersionOutputSchema$1 = z.object({ version: z.string() });
-var adminUiCapability = {
-	name: "admin-ui",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		getStaticDir: method(z.void(), StaticDirOutputSchema$1),
-		getVersion: method(z.void(), VersionOutputSchema$1)
-	}
-};
-//#endregion
-//#region src/capabilities/viewer-ui.cap.ts
-var StaticDirOutputSchema = z.object({ staticDir: z.string() });
-var VersionOutputSchema = z.object({ version: z.string() });
+//#region src/generated/device-scoped-caps.ts
 /**
-* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
-* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
-* `admin-ui` exactly: a singleton, server-internal cap exposing the static
-* dist directory + build version so `main.ts` can mount the SPA under a
-* dedicated prefix.
+* AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
+*
+* Every `scope: 'device'` capability name, as plain data — so a forked runner
+* can answer "may a rule actuate this?" without importing the schema barrel
+* (~144MB RSS per runner, D28).
+*
+* Coverage: 80 device-scoped capabilities.
 */
-var viewerUiCapability = {
-	name: "viewer-ui",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		getStaticDir: method(z.void(), StaticDirOutputSchema),
-		getVersion: method(z.void(), VersionOutputSchema)
-	}
-};
+var DEVICE_SCOPED_CAPS = new Set([
+	"accessories",
+	"air-quality-sensor",
+	"alarm-panel",
+	"ambient-light-sensor",
+	"audio-analysis",
+	"audio-metrics",
+	"automation-control",
+	"battery",
+	"binary",
+	"brightness",
+	"button",
+	"camera-credentials",
+	"camera-pipeline-config",
+	"camera-streams",
+	"carbon-monoxide",
+	"climate-control",
+	"color",
+	"connectivity",
+	"consumables",
+	"contact",
+	"control",
+	"cover",
+	"day-night",
+	"detection-pipeline",
+	"device-discovery",
+	"device-ops",
+	"device-status",
+	"doorbell",
+	"enum-sensor",
+	"event-emitter",
+	"events",
+	"fan-control",
+	"feature-probe",
+	"flood",
+	"gas",
+	"humidifier",
+	"humidity-sensor",
+	"image",
+	"image-settings",
+	"intercom",
+	"lawn-mower-control",
+	"lock-control",
+	"media-player",
+	"motion",
+	"motion-detection",
+	"motion-trigger",
+	"motion-zones",
+	"native-object-detection",
+	"notifier",
+	"numeric-sensor",
+	"osd",
+	"pet-feeder",
+	"pipeline-analytics",
+	"power-meter",
+	"presence",
+	"pressure-sensor",
+	"privacy-mask",
+	"ptz",
+	"ptz-autotrack",
+	"reboot",
+	"scene-monitor",
+	"script-runner",
+	"smoke",
+	"snapshot",
+	"stream-catalog",
+	"stream-params",
+	"switch",
+	"tamper",
+	"temperature-sensor",
+	"update",
+	"vacuum-control",
+	"valve",
+	"vibration",
+	"videoclips",
+	"water-heater",
+	"weather",
+	"webrtc-session",
+	"zone-analytics",
+	"zone-rules",
+	"zones"
+]);
+/**
+* True when `capName` is a device capability.
+*
+* This is the ONLY boundary on what a notification rule may actuate. A rule can
+* be authored by a non-admin and the runner executes with the addon's
+* privileges, so an unbounded action would be an arbitrary RPC channel with a
+* privilege escalation attached. Device scope excludes the system caps
+* (`device-manager.removeDevice` and friends) by construction.
+*/
+function isDeviceScopedCap(capName) {
+	return DEVICE_SCOPED_CAPS.has(capName);
+}
 //#endregion
-//#region src/capabilities/device-ops.cap.ts
+//#region src/utils/json-safe.ts
 /**
-* device-ops — device-scoped cap that unifies the per-IDevice operations
-* previously routed through the `.device-ops` Moleculer bridge service.
+* Type-safe JSON parsing helpers.
 *
-* Each worker that hosts live `IDevice` instances auto-registers a native
-* provider for this cap (per device) backed by its local
-* `DeviceRegistry`. Hub-side callers reach it transparently through
-* `ctx.fetchDevice(id).deviceOps.*` — the DeviceProxy injects
-* `deviceId` + `nodeId` and dispatches through the standard cap-router,
-* so there's no parallel bridge path anymore.
+* `JSON.parse` is typed as `any` in lib.es5.d.ts, which triggers
+* `no-unsafe-*` ESLint rules and destroys downstream inference. These
+* wrappers return `unknown` — callers narrow structurally via type
+* guards, `typeof` checks, or helpers like `asRecord`/`asString`.
+*/
+/**
+* Parse JSON and return it as `unknown` — the only entry point for untrusted JSON.
 *
-* The surface is intentionally small — every method corresponds to a
-* single action on the live `IDevice` (or `ICameraDevice` for
-* `getStreamSources`). Richer orchestration (enable/disable with
-* integration plumbing, bulk updates) stays in the `device-manager` cap;
-* `device-ops` is the per-device primitive the device-manager routes to.
+* The optional generic overload `parseJsonUnknown<T>(text)` returns `T` for
+* call sites that know the shape at parse time (e.g. MQTT payloads with a
+* known protocol schema). This is a **type-level bridge only** — no runtime
+* validation is performed. Callers that need runtime validation should parse
+* as `unknown` and narrow via Zod or structural guards.
 */
-var StreamSourceEntrySchema = z.object({
-	id: z.string(),
-	label: z.string(),
-	protocol: z.enum([
-		"rtsp",
-		"rtmp",
-		"annexb",
-		"http-mjpeg",
-		"webrtc",
-		"custom"
-	]),
-	url: z.string().optional(),
-	resolution: z.object({
-		width: z.number(),
-		height: z.number()
-	}).optional(),
-	fps: z.number().optional(),
-	bitrate: z.number().optional(),
-	codec: z.string().optional(),
-	profileHint: CamProfileSchema.optional(),
-	sdp: z.string().optional()
-});
-var ConfigEntrySchema = z.object({
-	key: z.string(),
-	value: z.unknown()
-});
-var RawStateResultSchema = z.object({
-	/** Originating provider id, e.g. 'homeassistant' | 'reolink' | 'hikvision'. */
-	source: z.string(),
-	/** Opaque, DISPLAY-SAFE upstream blob (no secrets/PII). */
-	data: z.record(z.string(), z.unknown())
-});
-var deviceOpsCapability = {
-	name: "device-ops",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	methods: {
-		/**
-		* Return stream sources for camera-like devices. Non-camera devices
-		* return an empty array (the bridge did the same; preserved for compat).
-		*/
-		getStreamSources: method(z.object({ deviceId: z.number() }), z.array(StreamSourceEntrySchema)),
-		/**
-		* Return the device's config entries (key + current value). Used by
-		* the device-manager aggregator when reading the driver's schema+values.
-		*/
-		getConfigEntries: method(z.object({ deviceId: z.number() }), z.array(ConfigEntrySchema)),
-		/**
-		* Bulk-apply a config patch via `IDevice.config.setAll`. Covers the
-		* updateConfig / setStreamProfileMap / enable-as-config paths from
-		* the old bridge.
-		*/
-		setConfig: method(z.object({
-			deviceId: z.number(),
-			values: z.record(z.string(), z.unknown())
-		}), z.void(), { kind: "mutation" }),
-		/**
-		* Invoke a device custom action on a forked/remote device (the
-		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
-		* `setConfig` — the device-manager calls this when the device is not
-		* hub-local.
-		*/
-		runAction: method(z.object({
-			deviceId: z.number(),
-			action: z.string().min(1),
-			input: z.unknown()
-		}), z.unknown(), { kind: "mutation" }),
-		/**
-		* Invoke `IDevice.removeDevice()` so the driver can release resources
-		* (close sockets, stop background tasks, …). The device-manager still
-		* performs its own persistence cleanup before/after this call.
-		*/
-		removeDevice: method(z.object({ deviceId: z.number() }), z.void(), { kind: "mutation" }),
-		/**
-		* Build the ConfigUISchema (FormBuilder input shape) from the device's
-		* Zod config schema. Runs on the worker that owns the IDevice so the
-		* Zod types stay local (they're function references, not
-		* serializable). Returns a fully JSON-serializable schema with
-		* sections/fields the admin UI renders directly.
-		*
-		* Needed because the hub-side `device-manager.getSettingsSchema`
-		* couldn't reach forked-worker devices — it had no registry entry
-		* and no cross-process lookup, so the UI silently rendered an empty
-		* settings panel for every worker-owned device.
-		*
-		* Returns `null` when the device isn't found on this worker.
-		*/
-		getSettingsSchema: method(z.object({ deviceId: z.number() }), z.unknown().nullable()),
-		/**
-		* Opt-in: return the device's RAW upstream state (the provider's
-		* cached values) as a display-safe `{ source, data }` blob. Returns
-		* `null` when the device exposes no raw state — the State panel hides
-		* its Raw toggle in that case. One-shot (read the provider's existing
-		* cache; no upstream round-trip).
-		*/
-		getRawState: method(z.object({ deviceId: z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
+function parseJsonUnknown(text) {
+	return JSON.parse(text);
+}
+/** Narrow an unknown value to a plain `Record<string, unknown>` or return null. */
+function asJsonObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	return { ...value };
+}
+/** Narrow an unknown value to a `readonly unknown[]` or return an empty array. */
+function asJsonArray(value) {
+	return Array.isArray(value) ? value : [];
+}
+/** Safe string extraction from an unknown record field. */
+function asString(value, fallback = "") {
+	return typeof value === "string" ? value : fallback;
+}
+/** Safe number extraction from an unknown record field. */
+function asNumber(value, fallback = 0) {
+	return typeof value === "number" ? value : fallback;
+}
+/** Safe boolean extraction from an unknown record field. */
+function asBoolean(value, fallback = false) {
+	return typeof value === "boolean" ? value : fallback;
+}
+/** Parse JSON + narrow to object in one step. */
+function parseJsonObject(text) {
+	try {
+		return asJsonObject(parseJsonUnknown(text));
+	} catch {
+		return null;
 	}
-};
+}
+/** Parse JSON + narrow to array in one step. */
+function parseJsonArray(text) {
+	try {
+		const parsed = parseJsonUnknown(text);
+		return Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/utils/sleep.ts
 /**
@@ -3651,4 +3653,4 @@ function sleepCancellable(ms, signal) {
 	});
 }
 //#endregion
-export { FrameHandleSchema as $, parseJsonArray as A, readinessKey as B, DEVICE_SCOPED_CAPS as C, hydrateSchema as Ct, asJsonObject as D, asJsonArray as E, readNodePin as F, CamProfileSchema as G, BrokerStatsSchema as H, DATAPLANE_SECRET_HEADER as I, CameraStreamSchema as J, CamStreamKindSchema as K, ReadinessRegistry as L, parseJsonUnknown as M, CAP_NODE_PIN_CONTEXT_KEY as N, asNumber as O, nodePin as P, FrameHandleFormatSchema as Q, ReadinessTimeoutError as R, DeviceType as S, collectHydratedFieldValues as St, asBoolean as T, DisposerChain as Tt, BrokerStatusSchema as U, scopeKey as V, CAM_PROFILE_ORDER as W, DecodedFrameSchema as X, DecodedAudioChunkSchema as Y, EncodedPacketSchema as Z, resolveCapMount as _, emitReadiness as _t, viewerUiCapability as a, SubscribeAudioChunksInputSchema as at, DeviceFeature as b, WELL_KNOWN_TAB_MAP as bt, createLazyTrpcSource as c, SubscribeFramesResultSchema as ct, DEVICE_SETTINGS_CONTRIBUTION_METHODS as d, parseProfileBrokerId as dt, ProfileRtspEntrySchema as et, DEVICE_STATUS_METHOD as f, selectAssignedProfileSlots as ft, method as g, createEvent as gt, isDeviceConfigCap as h, createDurableState as ht, deviceOpsCapability as i, StreamSourceSchema as it, parseJsonObject as j, asString as k, createMirrorSource as l, makeProfileBrokerId as lt, expandCapMethods as m, normalizeAddonInitResult as mt, sleepCancellable as n, ProfileSlotStatusSchema as nt, adminUiCapability as o, SubscribeAudioChunksResultSchema as ot, event as p, BaseAddon as pt, CamStreamResolutionSchema as q, RawStateResultSchema as r, StreamSourceEntrySchema$1 as rt, createDeviceProxy as s, SubscribeFramesInputSchema as st, sleep as t, ProfileSlotSchema as tt, createSliceHandle as u, makeSourceBrokerId as ut, systemMethod as v, isEvent as vt, isDeviceScopedCap as w, resolveHydratedFieldValue as wt, DeviceRole as x, collectHydratedFieldEntries as xt, ChargingStatus as y, WELL_KNOWN_TABS as yt, emitDownForOwnedCaps as z };
+export { ProfileRtspEntrySchema as $, method as A, scopeKey as B, DeviceType as C, collectHydratedFieldValues as Ct, event as D, DEVICE_STATUS_METHOD as E, readNodePin as F, CamStreamKindSchema as G, BrokerStatusSchema as H, ReadinessRegistry as I, DecodedAudioChunkSchema as J, CamStreamResolutionSchema as K, ReadinessTimeoutError as L, systemMethod as M, CAP_NODE_PIN_CONTEXT_KEY as N, expandCapMethods as O, nodePin as P, FrameHandleSchema as Q, emitDownForOwnedCaps as R, DeviceRole as S, collectHydratedFieldEntries as St, DEVICE_SETTINGS_CONTRIBUTION_METHODS as T, resolveHydratedFieldValue as Tt, CAM_PROFILE_ORDER as U, BrokerStatsSchema as V, CamProfileSchema as W, EncodedPacketSchema as X, DecodedFrameSchema as Y, FrameHandleFormatSchema as Z, RawStateResultSchema as _, createEvent as _t, asJsonObject as a, SubscribeAudioChunksResultSchema as at, ChargingStatus as b, WELL_KNOWN_TABS as bt, parseJsonArray as c, makeProfileBrokerId as ct, DEVICE_SCOPED_CAPS as d, selectAssignedProfileSlots as dt, ProfileSlotSchema as et, isDeviceScopedCap as f, DATAPLANE_SECRET_HEADER as ft, createSliceHandle as g, createDurableState as gt, createMirrorSource as h, normalizeAddonInitResult as ht, asJsonArray as i, SubscribeAudioChunksInputSchema as it, resolveCapMount as j, isDeviceConfigCap as k, parseJsonObject as l, makeSourceBrokerId as lt, createLazyTrpcSource as m, BaseAddon as mt, sleepCancellable as n, StreamSourceEntrySchema$1 as nt, asNumber as o, SubscribeFramesInputSchema as ot, createDeviceProxy as p, DisposerChain as pt, CameraStreamSchema as q, asBoolean as r, StreamSourceSchema as rt, asString as s, SubscribeFramesResultSchema as st, sleep as t, ProfileSlotStatusSchema as tt, parseJsonUnknown as u, parseProfileBrokerId as ut, deviceOpsCapability as v, emitReadiness as vt, adminUiCapability as w, hydrateSchema as wt, DeviceFeature as x, WELL_KNOWN_TAB_MAP as xt, viewerUiCapability as y, isEvent as yt, readinessKey as z };