@camstack/types 1.2.33 → 1.2.35

package/dist/{sleep-C84-hqFR.js → sleep-C6W2qcHX.js}

@@ -1,70 +1,5 @@
 const require_event_category = require("./event-category-BE4PDZ_3.js");
 let zod = require("zod");
-//#region src/disposer-chain.ts
-var DisposerChain = class {
-	disposers = [];
-	disposed = false;
-	onError;
-	constructor(opts = {}) {
-		this.onError = opts.onError ?? ((err, index) => {
-			console.error(`[DisposerChain] disposer #${index} threw`, err);
-		});
-	}
-	/**
-	* Register a teardown callback. Returns an unregister function so
-	* callers can drop a single disposer without disposing the whole
-	* chain.
-	*
-	* If the chain has already been disposed, the callback runs immediately
-	* (sync) — this matches the “register-after-shutdown” edge case where
-	* an addon's late initialization races with kernel restart.
-	*/
-	add(fn) {
-		if (this.disposed) {
-			try {
-				const result = fn();
-				if (result && typeof result.then === "function") result.catch((err) => this.onError(err, -1));
-			} catch (err) {
-				this.onError(err, -1);
-			}
-			return () => void 0;
-		}
-		this.disposers.push(fn);
-		return () => {
-			const idx = this.disposers.indexOf(fn);
-			if (idx >= 0) this.disposers.splice(idx, 1);
-		};
-	}
-	/** True after `dispose()` has been called at least once. */
-	get isDisposed() {
-		return this.disposed;
-	}
-	/** Number of disposers currently registered. */
-	get size() {
-		return this.disposers.length;
-	}
-	/**
-	* Run every registered disposer in LIFO order. Idempotent: subsequent
-	* calls do nothing. Awaits async disposers so callers can sequence
-	* shutdown → restart correctly.
-	*/
-	async dispose() {
-		if (this.disposed) return;
-		this.disposed = true;
-		const drain = this.disposers.slice().toReversed();
-		this.disposers = [];
-		for (let i = 0; i < drain.length; i++) {
-			const fn = drain[i];
-			try {
-				const result = fn();
-				if (result && typeof result.then === "function") await result;
-			} catch (err) {
-				this.onError(err, drain.length - 1 - i);
-			}
-		}
-	}
-};
-//#endregion
 //#region src/interfaces/config-ui.ts
 /** Predefined tabs with standard label, icon, and sort order.
 *
@@ -1084,6 +1019,80 @@ function normalizeAddonInitResult(result) {
 	return result;
 }
 //#endregion
+//#region src/disposer-chain.ts
+var DisposerChain = class {
+	disposers = [];
+	disposed = false;
+	onError;
+	constructor(opts = {}) {
+		this.onError = opts.onError ?? ((err, index) => {
+			console.error(`[DisposerChain] disposer #${index} threw`, err);
+		});
+	}
+	/**
+	* Register a teardown callback. Returns an unregister function so
+	* callers can drop a single disposer without disposing the whole
+	* chain.
+	*
+	* If the chain has already been disposed, the callback runs immediately
+	* (sync) — this matches the “register-after-shutdown” edge case where
+	* an addon's late initialization races with kernel restart.
+	*/
+	add(fn) {
+		if (this.disposed) {
+			try {
+				const result = fn();
+				if (result && typeof result.then === "function") result.catch((err) => this.onError(err, -1));
+			} catch (err) {
+				this.onError(err, -1);
+			}
+			return () => void 0;
+		}
+		this.disposers.push(fn);
+		return () => {
+			const idx = this.disposers.indexOf(fn);
+			if (idx >= 0) this.disposers.splice(idx, 1);
+		};
+	}
+	/** True after `dispose()` has been called at least once. */
+	get isDisposed() {
+		return this.disposed;
+	}
+	/** Number of disposers currently registered. */
+	get size() {
+		return this.disposers.length;
+	}
+	/**
+	* Run every registered disposer in LIFO order. Idempotent: subsequent
+	* calls do nothing. Awaits async disposers so callers can sequence
+	* shutdown → restart correctly.
+	*/
+	async dispose() {
+		if (this.disposed) return;
+		this.disposed = true;
+		const drain = this.disposers.slice().toReversed();
+		this.disposers = [];
+		for (let i = 0; i < drain.length; i++) {
+			const fn = drain[i];
+			try {
+				const result = fn();
+				if (result && typeof result.then === "function") await result;
+			} catch (err) {
+				this.onError(err, drain.length - 1 - i);
+			}
+		}
+	}
+};
+//#endregion
+//#region src/interfaces/addon-data-plane.ts
+/**
+* Per-listener shared-secret header the hub injects on every reverse-proxied
+* data-plane request and the addon's framework wrapper validates — so only the
+* hub can reach the addon's `127.0.0.1` listener. Defined here (shared by the
+* core proxy and the kernel listener) to keep both off a kernel↔core import.
+*/
+var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
+//#endregion
 //#region src/capabilities/schemas/streaming-shared.ts
 /** Shared Zod schemas used across streaming capabilities. */
 var CamProfileSchema = zod.z.enum([
@@ -1898,15 +1907,6 @@ function emitDownForOwnedCaps(registry, owned) {
 	for (const { capName, scope } of owned) registry.emitDown(capName, scope);
 }
 //#endregion
-//#region src/interfaces/addon-data-plane.ts
-/**
-* Per-listener shared-secret header the hub injects on every reverse-proxied
-* data-plane request and the addon's framework wrapper validates — so only the
-* hub can reach the addon's `127.0.0.1` listener. Defined here (shared by the
-* core proxy and the kernel listener) to keep both off a kernel↔core import.
-*/
-var DATAPLANE_SECRET_HEADER = "x-camstack-dataplane-secret";
-//#endregion
 //#region src/cap-call-context.ts
 /**
 * Per-call node pinning for `ctx.api` capability calls.
@@ -1948,171 +1948,180 @@ function readNodePin(context) {
 	return typeof value === "string" ? value : void 0;
 }
 //#endregion
-//#region src/utils/json-safe.ts
+//#region src/capabilities/capability-definition.ts
 /**
-* Type-safe JSON parsing helpers.
+* Generic types for capability definitions.
 *
-* `JSON.parse` is typed as `any` in lib.es5.d.ts, which triggers
-* `no-unsafe-*` ESLint rules and destroys downstream inference. These
-* wrappers return `unknown` — callers narrow structurally via type
-* guards, `typeof` checks, or helpers like `asRecord`/`asString`.
+* A capability is defined with Zod schemas for methods, events, and settings.
+* TypeScript types are inferred via z.infer<> — zero duplication.
+*
+* Pattern:
+*   1. Define Zod schemas for data, methods, settings
+*   2. Export const capabilityDef = { ... } satisfies CapabilityDefinition
+*   3. Export type IProvider = InferProvider<typeof capabilityDef>
+*   4. Addon implements IProvider
+*   5. Registry auto-mounts tRPC router from definition.methods
 */
 /**
-* Parse JSON and return it as `unknown` — the only entry point for untrusted JSON.
-*
-* The optional generic overload `parseJsonUnknown<T>(text)` returns `T` for
-* call sites that know the shape at parse time (e.g. MQTT payloads with a
-* known protocol schema). This is a **type-level bridge only** — no runtime
-* validation is performed. Callers that need runtime validation should parse
-* as `unknown` and narrow via Zod or structural guards.
+* Resolve the EFFECTIVE mount hint for a cap — the explicit `mount` when
+* present, else the scope/mode/deviceNative-derived default. Single source
+* of truth shared by the runtime builder and any codegen that needs the
+* same classification, so the two can never disagree.
 */
-function parseJsonUnknown(text) {
-	return JSON.parse(text);
-}
-/** Narrow an unknown value to a plain `Record<string, unknown>` or return null. */
-function asJsonObject(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	return { ...value };
-}
-/** Narrow an unknown value to a `readonly unknown[]` or return an empty array. */
-function asJsonArray(value) {
-	return Array.isArray(value) ? value : [];
-}
-/** Safe string extraction from an unknown record field. */
-function asString(value, fallback = "") {
-	return typeof value === "string" ? value : fallback;
-}
-/** Safe number extraction from an unknown record field. */
-function asNumber(value, fallback = 0) {
-	return typeof value === "number" ? value : fallback;
-}
-/** Safe boolean extraction from an unknown record field. */
-function asBoolean(value, fallback = false) {
-	return typeof value === "boolean" ? value : fallback;
-}
-/** Parse JSON + narrow to object in one step. */
-function parseJsonObject(text) {
-	try {
-		return asJsonObject(parseJsonUnknown(text));
-	} catch {
-		return null;
-	}
-}
-/** Parse JSON + narrow to array in one step. */
-function parseJsonArray(text) {
-	try {
-		const parsed = parseJsonUnknown(text);
-		return Array.isArray(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
+function resolveCapMount(def) {
+	if (def.mount) return def.mount;
+	if (def.deviceNative === true) return { kind: "device-native" };
+	if (def.mode === "collection") return { kind: "collection" };
+	return { kind: "singleton" };
 }
-//#endregion
-//#region src/generated/device-scoped-caps.ts
 /**
-* AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
+* Output schema shared by the contribution + live methods.
 *
-* Every `scope: 'device'` capability name, as plain data — so a forked runner
-* can answer "may a rule actuate this?" without importing the schema barrel
-* (~144MB RSS per runner, D28).
+* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
+* tabs[]) without importing from `../interfaces/config-ui.js` — a
+* concrete-but-lenient Zod object keeps tRPC output inference happy
+* (using `z.unknown()` here collapses unrelated router branches to
+* `unknown` when the generator re-inlines the huge AppRouter type).
 *
-* Coverage: 80 device-scoped capabilities.
+* `.passthrough()` on sections/fields accepts whatever FormBuilder
+* extensions the caller adds (showWhen, displayScale, …) without
+* rebuilding every time a new field kind is introduced.
 */
-var DEVICE_SCOPED_CAPS = new Set([
-	"accessories",
-	"air-quality-sensor",
-	"alarm-panel",
-	"ambient-light-sensor",
-	"audio-analysis",
-	"audio-metrics",
-	"automation-control",
-	"battery",
-	"binary",
-	"brightness",
-	"button",
-	"camera-credentials",
-	"camera-pipeline-config",
-	"camera-streams",
-	"carbon-monoxide",
-	"climate-control",
-	"color",
-	"connectivity",
-	"consumables",
-	"contact",
-	"control",
-	"cover",
-	"day-night",
-	"detection-pipeline",
-	"device-discovery",
-	"device-ops",
-	"device-status",
-	"doorbell",
-	"enum-sensor",
-	"event-emitter",
-	"events",
-	"fan-control",
-	"feature-probe",
-	"flood",
-	"gas",
-	"humidifier",
-	"humidity-sensor",
-	"image",
-	"image-settings",
-	"intercom",
-	"lawn-mower-control",
-	"lock-control",
-	"media-player",
-	"motion",
-	"motion-detection",
-	"motion-trigger",
-	"motion-zones",
-	"native-object-detection",
-	"notifier",
-	"numeric-sensor",
-	"osd",
-	"pet-feeder",
-	"pipeline-analytics",
-	"power-meter",
-	"presence",
-	"pressure-sensor",
-	"privacy-mask",
-	"ptz",
-	"ptz-autotrack",
-	"reboot",
-	"scene-monitor",
-	"script-runner",
-	"smoke",
-	"snapshot",
-	"stream-catalog",
-	"stream-params",
-	"switch",
-	"tamper",
-	"temperature-sensor",
-	"update",
-	"vacuum-control",
-	"valve",
-	"vibration",
-	"videoclips",
-	"water-heater",
-	"weather",
-	"webrtc-session",
-	"zone-analytics",
-	"zone-rules",
-	"zones"
-]);
+var ContributionSectionSchema = zod.z.object({
+	id: zod.z.string(),
+	title: zod.z.string(),
+	description: zod.z.string().optional(),
+	style: zod.z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: zod.z.boolean().optional(),
+	columns: zod.z.union([
+		zod.z.literal(1),
+		zod.z.literal(2),
+		zod.z.literal(3),
+		zod.z.literal(4)
+	]).optional(),
+	tab: zod.z.string().optional(),
+	location: zod.z.enum(["settings", "top-tab"]).optional(),
+	order: zod.z.number().optional(),
+	fields: zod.z.array(zod.z.any())
+});
+var ContributionTabSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	order: zod.z.number().optional()
+});
+var ContributionOutputSchema = zod.z.object({
+	tabs: zod.z.array(ContributionTabSchema).optional(),
+	sections: zod.z.array(ContributionSectionSchema)
+}).nullable();
+var DEVICE_SETTINGS_CONTRIBUTION_METHODS = {
+	getDeviceSettingsContribution: {
+		input: zod.z.object({ deviceId: zod.z.number() }),
+		output: ContributionOutputSchema,
+		kind: "query",
+		auth: "protected"
+	},
+	getDeviceLiveContribution: {
+		input: zod.z.object({ deviceId: zod.z.number() }),
+		output: ContributionOutputSchema,
+		kind: "query",
+		auth: "protected"
+	},
+	applyDeviceSettingsPatch: {
+		input: zod.z.object({
+			deviceId: zod.z.number(),
+			patch: zod.z.record(zod.z.string(), zod.z.unknown())
+		}),
+		output: zod.z.object({ success: zod.z.literal(true) }),
+		kind: "mutation",
+		auth: "admin"
+	}
+};
 /**
-* True when `capName` is a device capability.
+* Schema for the `getStatus` method auto-injected when a cap declares
+* `status`. The runtime shape of the output is the cap's own
+* `status.schema` — but at codegen time we need a concrete Zod to emit
+* a typed tRPC route, so we keep the output as `z.unknown().nullable()`
+* here and tighten it on the client side via the generated
+* `CapStatusTypeMap` (see `scripts/generate-cap-status-types.ts`).
+*/
+var DEVICE_STATUS_METHOD = { getStatus: {
+	input: zod.z.object({ deviceId: zod.z.number() }),
+	output: zod.z.unknown().nullable(),
+	kind: "query",
+	auth: "protected"
+} };
+/**
+* Expand a cap def's methods map with every auto-injected method:
+*   - `exposesDeviceSettings: true`      → 3 contribution methods
+*   - `status: {...}`                    → `getStatus`
 *
-* This is the ONLY boundary on what a notification rule may actuate. A rule can
-* be authored by a non-admin and the runner executes with the addon's
-* privileges, so an unbounded action would be an arbitrary RPC channel with a
-* privilege escalation attached. Device scope excludes the system caps
-* (`device-manager.removeDevice` and friends) by construction.
+* Callers walk `expandCapMethods(def)` instead of `def.methods` when
+* they need the effective runtime method surface (Moleculer actions,
+* proxy shape, tRPC router entries). The cap def stays the single
+* source of truth. Providers still declare their concrete `methods`
+* block; the expansion happens at every consumption point, so there's
+* no accidental divergence between the declared surface and what's
+* actually mounted.
 */
-function isDeviceScopedCap(capName) {
-	return DEVICE_SCOPED_CAPS.has(capName);
+function expandCapMethods(def) {
+	let out = def.methods;
+	if (def.exposesDeviceSettings) out = {
+		...DEVICE_SETTINGS_CONTRIBUTION_METHODS,
+		...out
+	};
+	if (def.status) out = {
+		...DEVICE_STATUS_METHOD,
+		...out
+	};
+	return out;
+}
+function method(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		...options?.access !== void 0 ? { access: options.access } : {},
+		...options?.caller !== void 0 ? { caller: options.caller } : {},
+		timeoutMs: options?.timeoutMs
+	};
+}
+/**
+* A wrapper/system-only method: served exclusively by the cap's system-level
+* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
+* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
+* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
+*/
+function systemMethod(input, output, options) {
+	return {
+		...method(input, output, options),
+		systemOnly: true
+	};
+}
+/** Shorthand to define an event schema */
+function event(data) {
+	return { data };
+}
+/** Type guard: does this cap declare the D14 device-config archetype? */
+function isDeviceConfigCap(def) {
+	return def?.deviceConfig !== void 0;
 }
 //#endregion
+//#region src/capabilities/admin-ui.cap.ts
+var StaticDirOutputSchema$1 = zod.z.object({ staticDir: zod.z.string() });
+var VersionOutputSchema$1 = zod.z.object({ version: zod.z.string() });
+var adminUiCapability = {
+	name: "admin-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		getStaticDir: method(zod.z.void(), StaticDirOutputSchema$1),
+		getVersion: method(zod.z.void(), VersionOutputSchema$1)
+	}
+};
+//#endregion
 //#region src/device/device-type.ts
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
@@ -2439,165 +2448,144 @@ var DeviceRole = /* @__PURE__ */ function(DeviceRole) {
 	return DeviceRole;
 }({});
 //#endregion
-//#region src/capabilities/capability-definition.ts
-/**
-* Generic types for capability definitions.
-*
-* A capability is defined with Zod schemas for methods, events, and settings.
-* TypeScript types are inferred via z.infer<> — zero duplication.
-*
-* Pattern:
-*   1. Define Zod schemas for data, methods, settings
-*   2. Export const capabilityDef = { ... } satisfies CapabilityDefinition
-*   3. Export type IProvider = InferProvider<typeof capabilityDef>
-*   4. Addon implements IProvider
-*   5. Registry auto-mounts tRPC router from definition.methods
-*/
+//#region src/capabilities/viewer-ui.cap.ts
+var StaticDirOutputSchema = zod.z.object({ staticDir: zod.z.string() });
+var VersionOutputSchema = zod.z.object({ version: zod.z.string() });
 /**
-* Resolve the EFFECTIVE mount hint for a cap — the explicit `mount` when
-* present, else the scope/mode/deviceNative-derived default. Single source
-* of truth shared by the runtime builder and any codegen that needs the
-* same classification, so the two can never disagree.
+* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
+* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
+* `admin-ui` exactly: a singleton, server-internal cap exposing the static
+* dist directory + build version so `main.ts` can mount the SPA under a
+* dedicated prefix.
 */
-function resolveCapMount(def) {
-	if (def.mount) return def.mount;
-	if (def.deviceNative === true) return { kind: "device-native" };
-	if (def.mode === "collection") return { kind: "collection" };
-	return { kind: "singleton" };
-}
+var viewerUiCapability = {
+	name: "viewer-ui",
+	scope: "system",
+	mode: "singleton",
+	internal: true,
+	methods: {
+		getStaticDir: method(zod.z.void(), StaticDirOutputSchema),
+		getVersion: method(zod.z.void(), VersionOutputSchema)
+	}
+};
+//#endregion
+//#region src/capabilities/device-ops.cap.ts
 /**
-* Output schema shared by the contribution + live methods.
-*
-* Mirrors the `ConfigUISchemaWithValues` shape (sections[] + optional
-* tabs[]) without importing from `../interfaces/config-ui.js` — a
-* concrete-but-lenient Zod object keeps tRPC output inference happy
-* (using `z.unknown()` here collapses unrelated router branches to
-* `unknown` when the generator re-inlines the huge AppRouter type).
+* device-ops — device-scoped cap that unifies the per-IDevice operations
+* previously routed through the `.device-ops` Moleculer bridge service.
 *
-* `.passthrough()` on sections/fields accepts whatever FormBuilder
-* extensions the caller adds (showWhen, displayScale, …) without
-* rebuilding every time a new field kind is introduced.
+* Each worker that hosts live `IDevice` instances auto-registers a native
+* provider for this cap (per device) backed by its local
+* `DeviceRegistry`. Hub-side callers reach it transparently through
+* `ctx.fetchDevice(id).deviceOps.*` — the DeviceProxy injects
+* `deviceId` + `nodeId` and dispatches through the standard cap-router,
+* so there's no parallel bridge path anymore.
+*
+* The surface is intentionally small — every method corresponds to a
+* single action on the live `IDevice` (or `ICameraDevice` for
+* `getStreamSources`). Richer orchestration (enable/disable with
+* integration plumbing, bulk updates) stays in the `device-manager` cap;
+* `device-ops` is the per-device primitive the device-manager routes to.
 */
-var ContributionSectionSchema = zod.z.object({
-	id: zod.z.string(),
-	title: zod.z.string(),
-	description: zod.z.string().optional(),
-	style: zod.z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: zod.z.boolean().optional(),
-	columns: zod.z.union([
-		zod.z.literal(1),
-		zod.z.literal(2),
-		zod.z.literal(3),
-		zod.z.literal(4)
-	]).optional(),
-	tab: zod.z.string().optional(),
-	location: zod.z.enum(["settings", "top-tab"]).optional(),
-	order: zod.z.number().optional(),
-	fields: zod.z.array(zod.z.any())
-});
-var ContributionTabSchema = zod.z.object({
+var StreamSourceEntrySchema = zod.z.object({
 	id: zod.z.string(),
 	label: zod.z.string(),
-	icon: zod.z.string(),
-	order: zod.z.number().optional()
+	protocol: zod.z.enum([
+		"rtsp",
+		"rtmp",
+		"annexb",
+		"http-mjpeg",
+		"webrtc",
+		"custom"
+	]),
+	url: zod.z.string().optional(),
+	resolution: zod.z.object({
+		width: zod.z.number(),
+		height: zod.z.number()
+	}).optional(),
+	fps: zod.z.number().optional(),
+	bitrate: zod.z.number().optional(),
+	codec: zod.z.string().optional(),
+	profileHint: CamProfileSchema.optional(),
+	sdp: zod.z.string().optional()
 });
-var ContributionOutputSchema = zod.z.object({
-	tabs: zod.z.array(ContributionTabSchema).optional(),
-	sections: zod.z.array(ContributionSectionSchema)
-}).nullable();
-var DEVICE_SETTINGS_CONTRIBUTION_METHODS = {
-	getDeviceSettingsContribution: {
-		input: zod.z.object({ deviceId: zod.z.number() }),
-		output: ContributionOutputSchema,
-		kind: "query",
-		auth: "protected"
-	},
-	getDeviceLiveContribution: {
-		input: zod.z.object({ deviceId: zod.z.number() }),
-		output: ContributionOutputSchema,
-		kind: "query",
-		auth: "protected"
-	},
-	applyDeviceSettingsPatch: {
-		input: zod.z.object({
+var ConfigEntrySchema = zod.z.object({
+	key: zod.z.string(),
+	value: zod.z.unknown()
+});
+var RawStateResultSchema = zod.z.object({
+	/** Originating provider id, e.g. 'homeassistant' | 'reolink' | 'hikvision'. */
+	source: zod.z.string(),
+	/** Opaque, DISPLAY-SAFE upstream blob (no secrets/PII). */
+	data: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+var deviceOpsCapability = {
+	name: "device-ops",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	methods: {
+		/**
+		* Return stream sources for camera-like devices. Non-camera devices
+		* return an empty array (the bridge did the same; preserved for compat).
+		*/
+		getStreamSources: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(StreamSourceEntrySchema)),
+		/**
+		* Return the device's config entries (key + current value). Used by
+		* the device-manager aggregator when reading the driver's schema+values.
+		*/
+		getConfigEntries: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ConfigEntrySchema)),
+		/**
+		* Bulk-apply a config patch via `IDevice.config.setAll`. Covers the
+		* updateConfig / setStreamProfileMap / enable-as-config paths from
+		* the old bridge.
+		*/
+		setConfig: method(zod.z.object({
 			deviceId: zod.z.number(),
-			patch: zod.z.record(zod.z.string(), zod.z.unknown())
-		}),
-		output: zod.z.object({ success: zod.z.literal(true) }),
-		kind: "mutation",
-		auth: "admin"
+			values: zod.z.record(zod.z.string(), zod.z.unknown())
+		}), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Invoke a device custom action on a forked/remote device (the
+		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
+		* `setConfig` — the device-manager calls this when the device is not
+		* hub-local.
+		*/
+		runAction: method(zod.z.object({
+			deviceId: zod.z.number(),
+			action: zod.z.string().min(1),
+			input: zod.z.unknown()
+		}), zod.z.unknown(), { kind: "mutation" }),
+		/**
+		* Invoke `IDevice.removeDevice()` so the driver can release resources
+		* (close sockets, stop background tasks, …). The device-manager still
+		* performs its own persistence cleanup before/after this call.
+		*/
+		removeDevice: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
+		/**
+		* Build the ConfigUISchema (FormBuilder input shape) from the device's
+		* Zod config schema. Runs on the worker that owns the IDevice so the
+		* Zod types stay local (they're function references, not
+		* serializable). Returns a fully JSON-serializable schema with
+		* sections/fields the admin UI renders directly.
+		*
+		* Needed because the hub-side `device-manager.getSettingsSchema`
+		* couldn't reach forked-worker devices — it had no registry entry
+		* and no cross-process lookup, so the UI silently rendered an empty
+		* settings panel for every worker-owned device.
+		*
+		* Returns `null` when the device isn't found on this worker.
+		*/
+		getSettingsSchema: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.unknown().nullable()),
+		/**
+		* Opt-in: return the device's RAW upstream state (the provider's
+		* cached values) as a display-safe `{ source, data }` blob. Returns
+		* `null` when the device exposes no raw state — the State panel hides
+		* its Raw toggle in that case. One-shot (read the provider's existing
+		* cache; no upstream round-trip).
+		*/
+		getRawState: method(zod.z.object({ deviceId: zod.z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
 	}
 };
-/**
-* Schema for the `getStatus` method auto-injected when a cap declares
-* `status`. The runtime shape of the output is the cap's own
-* `status.schema` — but at codegen time we need a concrete Zod to emit
-* a typed tRPC route, so we keep the output as `z.unknown().nullable()`
-* here and tighten it on the client side via the generated
-* `CapStatusTypeMap` (see `scripts/generate-cap-status-types.ts`).
-*/
-var DEVICE_STATUS_METHOD = { getStatus: {
-	input: zod.z.object({ deviceId: zod.z.number() }),
-	output: zod.z.unknown().nullable(),
-	kind: "query",
-	auth: "protected"
-} };
-/**
-* Expand a cap def's methods map with every auto-injected method:
-*   - `exposesDeviceSettings: true`      → 3 contribution methods
-*   - `status: {...}`                    → `getStatus`
-*
-* Callers walk `expandCapMethods(def)` instead of `def.methods` when
-* they need the effective runtime method surface (Moleculer actions,
-* proxy shape, tRPC router entries). The cap def stays the single
-* source of truth. Providers still declare their concrete `methods`
-* block; the expansion happens at every consumption point, so there's
-* no accidental divergence between the declared surface and what's
-* actually mounted.
-*/
-function expandCapMethods(def) {
-	let out = def.methods;
-	if (def.exposesDeviceSettings) out = {
-		...DEVICE_SETTINGS_CONTRIBUTION_METHODS,
-		...out
-	};
-	if (def.status) out = {
-		...DEVICE_STATUS_METHOD,
-		...out
-	};
-	return out;
-}
-function method(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
-		...options?.access !== void 0 ? { access: options.access } : {},
-		...options?.caller !== void 0 ? { caller: options.caller } : {},
-		timeoutMs: options?.timeoutMs
-	};
-}
-/**
-* A wrapper/system-only method: served exclusively by the cap's system-level
-* provider (`InferProvider`), and OPTIONAL on `InferNativeProvider` so per-device
-* driver natives don't stub out a wrapper concern (e.g. a cross-device cache
-* overview). The `systemOnly: true` literal is what `InferNativeProvider` keys on.
-*/
-function systemMethod(input, output, options) {
-	return {
-		...method(input, output, options),
-		systemOnly: true
-	};
-}
-/** Shorthand to define an event schema */
-function event(data) {
-	return { data };
-}
-/** Type guard: does this cap declare the D14 device-config archetype? */
-function isDeviceConfigCap(def) {
-	return def?.deviceConfig !== void 0;
-}
 //#endregion
 //#region src/device/device-state-handle.ts
 var DEVICE_STATE_EVENT_CATEGORY = "device.state-changed";
@@ -3120,7 +3108,9 @@ function createDeviceProxy(api, binding, opts) {
 			getHistory: (input) => dispatch("notification-rules", "notificationRules", "getHistory", "query", input),
 			listSnoozes: (input) => dispatch("notification-rules", "notificationRules", "listSnoozes", "query", input),
 			createSnooze: (input) => dispatch("notification-rules", "notificationRules", "createSnooze", "mutation", input),
-			cancelSnooze: (input) => dispatch("notification-rules", "notificationRules", "cancelSnooze", "mutation", input)
+			cancelSnooze: (input) => dispatch("notification-rules", "notificationRules", "cancelSnooze", "mutation", input),
+			getAlarmConfig: (input) => dispatch("notification-rules", "notificationRules", "getAlarmConfig", "query", input),
+			setAlarmConfig: (input) => dispatch("notification-rules", "notificationRules", "setAlarmConfig", "mutation", input)
 		},
 		notifier: {
 			send: (input) => dispatch("notifier", "notifier", "send", "mutation", input),
@@ -3445,158 +3435,170 @@ function createDeviceProxy(api, binding, opts) {
 	};
 }
 //#endregion
-//#region src/capabilities/admin-ui.cap.ts
-var StaticDirOutputSchema$1 = zod.z.object({ staticDir: zod.z.string() });
-var VersionOutputSchema$1 = zod.z.object({ version: zod.z.string() });
-var adminUiCapability = {
-	name: "admin-ui",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		getStaticDir: method(zod.z.void(), StaticDirOutputSchema$1),
-		getVersion: method(zod.z.void(), VersionOutputSchema$1)
-	}
-};
-//#endregion
-//#region src/capabilities/viewer-ui.cap.ts
-var StaticDirOutputSchema = zod.z.object({ staticDir: zod.z.string() });
-var VersionOutputSchema = zod.z.object({ version: zod.z.string() });
+//#region src/generated/device-scoped-caps.ts
 /**
-* viewer-ui — serves the CamStack VIEWER web build (the Expo/React-Native
-* universal client's PWA export) from the hub, alongside admin-ui. Mirrors
-* `admin-ui` exactly: a singleton, server-internal cap exposing the static
-* dist directory + build version so `main.ts` can mount the SPA under a
-* dedicated prefix.
+* AUTO-GENERATED by scripts/generate-device-scoped-caps.ts — DO NOT EDIT.
+*
+* Every `scope: 'device'` capability name, as plain data — so a forked runner
+* can answer "may a rule actuate this?" without importing the schema barrel
+* (~144MB RSS per runner, D28).
+*
+* Coverage: 80 device-scoped capabilities.
 */
-var viewerUiCapability = {
-	name: "viewer-ui",
-	scope: "system",
-	mode: "singleton",
-	internal: true,
-	methods: {
-		getStaticDir: method(zod.z.void(), StaticDirOutputSchema),
-		getVersion: method(zod.z.void(), VersionOutputSchema)
-	}
-};
+var DEVICE_SCOPED_CAPS = new Set([
+	"accessories",
+	"air-quality-sensor",
+	"alarm-panel",
+	"ambient-light-sensor",
+	"audio-analysis",
+	"audio-metrics",
+	"automation-control",
+	"battery",
+	"binary",
+	"brightness",
+	"button",
+	"camera-credentials",
+	"camera-pipeline-config",
+	"camera-streams",
+	"carbon-monoxide",
+	"climate-control",
+	"color",
+	"connectivity",
+	"consumables",
+	"contact",
+	"control",
+	"cover",
+	"day-night",
+	"detection-pipeline",
+	"device-discovery",
+	"device-ops",
+	"device-status",
+	"doorbell",
+	"enum-sensor",
+	"event-emitter",
+	"events",
+	"fan-control",
+	"feature-probe",
+	"flood",
+	"gas",
+	"humidifier",
+	"humidity-sensor",
+	"image",
+	"image-settings",
+	"intercom",
+	"lawn-mower-control",
+	"lock-control",
+	"media-player",
+	"motion",
+	"motion-detection",
+	"motion-trigger",
+	"motion-zones",
+	"native-object-detection",
+	"notifier",
+	"numeric-sensor",
+	"osd",
+	"pet-feeder",
+	"pipeline-analytics",
+	"power-meter",
+	"presence",
+	"pressure-sensor",
+	"privacy-mask",
+	"ptz",
+	"ptz-autotrack",
+	"reboot",
+	"scene-monitor",
+	"script-runner",
+	"smoke",
+	"snapshot",
+	"stream-catalog",
+	"stream-params",
+	"switch",
+	"tamper",
+	"temperature-sensor",
+	"update",
+	"vacuum-control",
+	"valve",
+	"vibration",
+	"videoclips",
+	"water-heater",
+	"weather",
+	"webrtc-session",
+	"zone-analytics",
+	"zone-rules",
+	"zones"
+]);
+/**
+* True when `capName` is a device capability.
+*
+* This is the ONLY boundary on what a notification rule may actuate. A rule can
+* be authored by a non-admin and the runner executes with the addon's
+* privileges, so an unbounded action would be an arbitrary RPC channel with a
+* privilege escalation attached. Device scope excludes the system caps
+* (`device-manager.removeDevice` and friends) by construction.
+*/
+function isDeviceScopedCap(capName) {
+	return DEVICE_SCOPED_CAPS.has(capName);
+}
 //#endregion
-//#region src/capabilities/device-ops.cap.ts
+//#region src/utils/json-safe.ts
 /**
-* device-ops — device-scoped cap that unifies the per-IDevice operations
-* previously routed through the `.device-ops` Moleculer bridge service.
+* Type-safe JSON parsing helpers.
 *
-* Each worker that hosts live `IDevice` instances auto-registers a native
-* provider for this cap (per device) backed by its local
-* `DeviceRegistry`. Hub-side callers reach it transparently through
-* `ctx.fetchDevice(id).deviceOps.*` — the DeviceProxy injects
-* `deviceId` + `nodeId` and dispatches through the standard cap-router,
-* so there's no parallel bridge path anymore.
+* `JSON.parse` is typed as `any` in lib.es5.d.ts, which triggers
+* `no-unsafe-*` ESLint rules and destroys downstream inference. These
+* wrappers return `unknown` — callers narrow structurally via type
+* guards, `typeof` checks, or helpers like `asRecord`/`asString`.
+*/
+/**
+* Parse JSON and return it as `unknown` — the only entry point for untrusted JSON.
 *
-* The surface is intentionally small — every method corresponds to a
-* single action on the live `IDevice` (or `ICameraDevice` for
-* `getStreamSources`). Richer orchestration (enable/disable with
-* integration plumbing, bulk updates) stays in the `device-manager` cap;
-* `device-ops` is the per-device primitive the device-manager routes to.
+* The optional generic overload `parseJsonUnknown<T>(text)` returns `T` for
+* call sites that know the shape at parse time (e.g. MQTT payloads with a
+* known protocol schema). This is a **type-level bridge only** — no runtime
+* validation is performed. Callers that need runtime validation should parse
+* as `unknown` and narrow via Zod or structural guards.
 */
-var StreamSourceEntrySchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	protocol: zod.z.enum([
-		"rtsp",
-		"rtmp",
-		"annexb",
-		"http-mjpeg",
-		"webrtc",
-		"custom"
-	]),
-	url: zod.z.string().optional(),
-	resolution: zod.z.object({
-		width: zod.z.number(),
-		height: zod.z.number()
-	}).optional(),
-	fps: zod.z.number().optional(),
-	bitrate: zod.z.number().optional(),
-	codec: zod.z.string().optional(),
-	profileHint: CamProfileSchema.optional(),
-	sdp: zod.z.string().optional()
-});
-var ConfigEntrySchema = zod.z.object({
-	key: zod.z.string(),
-	value: zod.z.unknown()
-});
-var RawStateResultSchema = zod.z.object({
-	/** Originating provider id, e.g. 'homeassistant' | 'reolink' | 'hikvision'. */
-	source: zod.z.string(),
-	/** Opaque, DISPLAY-SAFE upstream blob (no secrets/PII). */
-	data: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-var deviceOpsCapability = {
-	name: "device-ops",
-	scope: "device",
-	deviceNative: true,
-	mode: "singleton",
-	methods: {
-		/**
-		* Return stream sources for camera-like devices. Non-camera devices
-		* return an empty array (the bridge did the same; preserved for compat).
-		*/
-		getStreamSources: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(StreamSourceEntrySchema)),
-		/**
-		* Return the device's config entries (key + current value). Used by
-		* the device-manager aggregator when reading the driver's schema+values.
-		*/
-		getConfigEntries: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.array(ConfigEntrySchema)),
-		/**
-		* Bulk-apply a config patch via `IDevice.config.setAll`. Covers the
-		* updateConfig / setStreamProfileMap / enable-as-config paths from
-		* the old bridge.
-		*/
-		setConfig: method(zod.z.object({
-			deviceId: zod.z.number(),
-			values: zod.z.record(zod.z.string(), zod.z.unknown())
-		}), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Invoke a device custom action on a forked/remote device (the
-		* cross-process transport for `IDevice.runDeviceAction`). Mirrors
-		* `setConfig` — the device-manager calls this when the device is not
-		* hub-local.
-		*/
-		runAction: method(zod.z.object({
-			deviceId: zod.z.number(),
-			action: zod.z.string().min(1),
-			input: zod.z.unknown()
-		}), zod.z.unknown(), { kind: "mutation" }),
-		/**
-		* Invoke `IDevice.removeDevice()` so the driver can release resources
-		* (close sockets, stop background tasks, …). The device-manager still
-		* performs its own persistence cleanup before/after this call.
-		*/
-		removeDevice: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.void(), { kind: "mutation" }),
-		/**
-		* Build the ConfigUISchema (FormBuilder input shape) from the device's
-		* Zod config schema. Runs on the worker that owns the IDevice so the
-		* Zod types stay local (they're function references, not
-		* serializable). Returns a fully JSON-serializable schema with
-		* sections/fields the admin UI renders directly.
-		*
-		* Needed because the hub-side `device-manager.getSettingsSchema`
-		* couldn't reach forked-worker devices — it had no registry entry
-		* and no cross-process lookup, so the UI silently rendered an empty
-		* settings panel for every worker-owned device.
-		*
-		* Returns `null` when the device isn't found on this worker.
-		*/
-		getSettingsSchema: method(zod.z.object({ deviceId: zod.z.number() }), zod.z.unknown().nullable()),
-		/**
-		* Opt-in: return the device's RAW upstream state (the provider's
-		* cached values) as a display-safe `{ source, data }` blob. Returns
-		* `null` when the device exposes no raw state — the State panel hides
-		* its Raw toggle in that case. One-shot (read the provider's existing
-		* cache; no upstream round-trip).
-		*/
-		getRawState: method(zod.z.object({ deviceId: zod.z.number() }), RawStateResultSchema.nullable(), { auth: "protected" })
+function parseJsonUnknown(text) {
+	return JSON.parse(text);
+}
+/** Narrow an unknown value to a plain `Record<string, unknown>` or return null. */
+function asJsonObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	return { ...value };
+}
+/** Narrow an unknown value to a `readonly unknown[]` or return an empty array. */
+function asJsonArray(value) {
+	return Array.isArray(value) ? value : [];
+}
+/** Safe string extraction from an unknown record field. */
+function asString(value, fallback = "") {
+	return typeof value === "string" ? value : fallback;
+}
+/** Safe number extraction from an unknown record field. */
+function asNumber(value, fallback = 0) {
+	return typeof value === "number" ? value : fallback;
+}
+/** Safe boolean extraction from an unknown record field. */
+function asBoolean(value, fallback = false) {
+	return typeof value === "boolean" ? value : fallback;
+}
+/** Parse JSON + narrow to object in one step. */
+function parseJsonObject(text) {
+	try {
+		return asJsonObject(parseJsonUnknown(text));
+	} catch {
+		return null;
 	}
-};
+}
+/** Parse JSON + narrow to array in one step. */
+function parseJsonArray(text) {
+	try {
+		const parsed = parseJsonUnknown(text);
+		return Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/utils/sleep.ts
 /**