@camstack/addon-import-alexa 0.2.156 → 0.2.157

package/dist/addon.js

@@ -34,8 +34,6 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 //#endregion
 let node_crypto = require("node:crypto");
-let node_os = require("node:os");
-node_os = __toESM(node_os, 1);
 let node_fs = require("node:fs");
 node_fs = __toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -43,10 +41,12 @@ let node_path$1 = __toESM(node_path, 1);
 node_path = __toESM(node_path);
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = __toESM(node_fs_promises, 1);
+let node_os = require("node:os");
+node_os = __toESM(node_os, 1);
 let node_child_process = require("node:child_process");
 require("node:zlib");
 let node_url = require("node:url");
-//#region ../types/dist/event-category-CT-hz5Rb.mjs
+//#region ../types/dist/event-category-hdMR7CTW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -811,6 +811,11 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AccessoriesChanged"] = "accessories.onAccessoriesChanged";
 	/**
+	* An action run started or ended. Emitted by the `actions` surface.
+	* Payload: `ActionRunChanged` (`{ actionId, runId, isRunning, outcome?, lastRunAt, lastError }`).
+	*/
+	EventCategory["ActionsRunChanged"] = "actions.onRunChanged";
+	/**
 	* Progress update from a running model conversion job.
 	* Payload: `{ kind: 'model-convert', phase, sessionId?, pct?, detail? }`.
 	* Emitted by `addon-model-studio` on the converting node.
@@ -5622,7 +5627,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BE7IAR2p.mjs
+//#region ../types/dist/sleep-BHjNez61.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8952,6 +8957,8 @@ Object.freeze({ "doorbell": "lastPressedAt" });
 /** Every capability name, so addon code can check a name without the schema graph. */
 var CAP_NAMES = Object.freeze([
 	"accessories",
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -15939,7 +15946,23 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 		kind: literal("schedule"),
 		cron: string().min(1).max(120)
 	}),
-	object({ kind: literal("manual") })
+	object({ kind: literal("manual") }),
+	object({
+		kind: literal("detection"),
+		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
+		*  matches every raw class that maps to it; any other name matches
+		*  exactly. */
+		classes: array(string().min(1)).min(1),
+		deviceIds: array(number().int().nonnegative()).min(1),
+		/** The track must have visited at least one of these zones. */
+		zones: array(string().min(1)).min(1).optional(),
+		/** Best-so-far confidence the track must reach. */
+		minScore: number().min(0).max(1).optional()
+	}),
+	object({
+		kind: literal("interval"),
+		minutes: number().int().min(1).max(1440)
+	})
 ]);
 /**
 * One action step.
@@ -15959,28 +15982,47 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 * is called. The runner still receives a number and is untouched; the
 * resolution is the recipe's job, not the runner's.
 */
+var AutomationWaitStepSchema = object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+});
+var AutomationCapStepSchema = object({
+	kind: literal("cap"),
+	/**
+	* One device, several same-family devices (locks / climate family / …),
+	* or `{ $var }` for the device that triggered the run. An array is
+	* fan-out at codegen — each id gets the same cap.method call.
+	*/
+	deviceId: union([
+		number().int(),
+		array(number().int()).min(1),
+		object({ $var: string().min(1) })
+	]),
+	cap: string().min(1),
+	method: string().min(1),
+	/** Values may carry `{{vars.x}}` slots, or be exactly `{ $var: 'name' }`, which
+	*  SUBSTITUTE and do not evaluate (§3.2.3). Anything beyond substitution is
+	*  the expression leaf. */
+	args: record(string(), unknown()).optional()
+});
+/**
+* The steps an internal Action may contain: cap and wait, and nothing that can
+* call back into an Action — so an Action can never reach itself (no cycles).
+*/
+var ActionStepSchema = discriminatedUnion("kind", [AutomationWaitStepSchema, AutomationCapStepSchema]);
 var AutomationActionSchema = discriminatedUnion("kind", [
+	AutomationWaitStepSchema,
+	AutomationCapStepSchema,
 	object({
-		kind: literal("wait"),
-		seconds: number().min(0).max(300)
-	}),
-	object({
-		kind: literal("cap"),
-		/**
-		* One device, several same-family devices (locks / climate family / …),
-		* or `{ $var }` for the device that triggered the run. An array is
-		* fan-out at codegen — each id gets the same cap.method call.
-		*/
-		deviceId: union([
-			number().int(),
-			array(number().int()).min(1),
-			object({ $var: string().min(1) })
-		]),
-		cap: string().min(1),
-		method: string().min(1),
-		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
-		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
-		args: record(string(), unknown()).optional()
+		kind: literal("action"),
+		/** An entry of the `actions` surface (`internal:<uuid>` or `<addonId>:<localId>`). */
+		actionId: string().min(1),
+		/** Values for the action's declared variables; the others take their default. */
+		variables: record(string(), union([
+			string(),
+			number(),
+			boolean()
+		])).optional()
 	}),
 	object({
 		kind: literal("code"),
@@ -15989,10 +16031,356 @@ var AutomationActionSchema = discriminatedUnion("kind", [
 		code: string().min(1).max(2e4)
 	})
 ]);
+/**
+* How a trigger that arrives while the automation is busy (or cooling down) is
+* handled. One of the automation's execution modes, never a property of its
+* actions. Absent means `single`.
+*
+*  - `single`   — drop the trigger while a run is in progress (traced + logged).
+*  - `restart`  — abort the run in progress (at its next step boundary), start fresh.
+*  - `queued`   — queue up to `max` triggers, drop the rest (traced).
+*  - `parallel` — up to `max` runs at once, drop the rest (traced).
+*  - `cooldown` — `single`, and no new run until `minutes` after the last run
+*    STARTED; persisted across a restart. A manual trigger bypasses only this
+*    wait, never the single/queued limits.
+*/
+var AutomationRunModeSchema = discriminatedUnion("mode", [
+	object({ mode: literal("single") }),
+	object({ mode: literal("restart") }),
+	object({
+		mode: literal("queued"),
+		max: number().int().min(1).max(10)
+	}),
+	object({
+		mode: literal("parallel"),
+		max: number().int().min(1).max(10)
+	}),
+	object({
+		mode: literal("cooldown"),
+		minutes: number().int().min(1).max(1440)
+	})
+]);
 var AutomationRecipeSchema = object({
 	triggers: array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
-	actions: array(AutomationActionSchema)
+	actions: array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
+	keepTraces: number().int().min(1).max(100).optional()
+});
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+new Set(Object.values(COCO_TO_MACRO.mapping));
+/**
+* Run traces — what an automation (or, later, an Action run) DID, node by node,
+* so the editor can paint every block green or red with its reason.
+*
+* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
+* every condition node (containers and leaves, including the ones a
+* short-circuit never reached), the run-mode verdict and every action step —
+* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Skipped
+* evaluations are traced too, and identical consecutive skips collapse into a
+* repeat count so a trigger that fails every 5 minutes cannot flush real runs.
+*
+* {@link AutomationStepTraceSchema} is deliberately free of automation
+* vocabulary so an Action run records the same step shape.
+*/
+/** A value a trace may show: JSON primitives and short lists, nothing deeper. */
+var TraceValueSchema = union([
+	string(),
+	number(),
+	boolean(),
+	_null(),
+	array(union([string(), number()]))
+]);
+var AutomationRunOutcomeSchema = _enum([
+	"ran",
+	"skipped-trigger",
+	"skipped-conditions",
+	"skipped-cooldown",
+	"skipped-overlap",
+	"failed",
+	"aborted"
+]);
+/** `not-evaluated` = a short-circuit never reached the node. */
+var TraceNodeOutcomeSchema = _enum([
+	"pass",
+	"fail",
+	"not-evaluated"
+]);
+var AutomationTriggerTraceSchema = object({
+	kind: string().min(1),
+	outcome: _enum(["pass", "fail"]),
+	/** Why an event was rejected ("class person not in [dog]") or what fired. */
+	reason: string(),
+	/** deviceId, className, trackId, score … — only what the trigger exposes. */
+	vars: record(string(), TraceValueSchema)
+});
+var AutomationConditionTraceNodeSchema = object({
+	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	path: string().min(1),
+	kind: _enum([
+		"all",
+		"any",
+		"not",
+		"condition",
+		"expression"
+	]),
+	outcome: TraceNodeOutcomeSchema,
+	reason: string(),
+	deviceId: number().int().optional(),
+	cap: string().optional(),
+	fieldPath: string().optional(),
+	operator: string().optional(),
+	expected: TraceValueSchema.optional(),
+	/** What the mirror held; `null` when it held nothing (unknown). */
+	observed: TraceValueSchema.optional()
+});
+var AutomationRunVerdictSchema = object({
+	mode: AutomationRunModeSchema,
+	decision: _enum([
+		"run",
+		"queued",
+		"restart",
+		"drop",
+		"cooldown",
+		"bypass"
+	]),
+	reason: string()
+});
+/** One executed (or not-run) step — shared by automations and Action runs. */
+var AutomationStepTraceSchema = object({
+	/** `actions.<i>` */
+	path: string().min(1),
+	kind: string().min(1),
+	cap: string().optional(),
+	method: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number().optional(),
+	endedAt: number().optional(),
+	outcome: _enum([
+		"ok",
+		"error",
+		"not-run"
+	]),
+	message: string().optional()
+});
+var AutomationRunTraceSchema = object({
+	runId: string().min(1),
+	startedAt: number(),
+	endedAt: number(),
+	trigger: AutomationTriggerTraceSchema,
+	conditions: array(AutomationConditionTraceNodeSchema),
+	verdict: AutomationRunVerdictSchema.optional(),
+	steps: array(AutomationStepTraceSchema),
+	outcome: AutomationRunOutcomeSchema,
+	/** How many identical consecutive skips this trace stands for (>= 1). */
+	repeat: number().int().min(1),
+	/** When the latest of those repeats happened. */
+	lastAt: number()
+});
+/**
+* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
+* `action:<actionId>`): the cooldown stamp and the trace ring.
+*/
+var AutomationStateDocSchema = object({
+	version: literal(1),
+	lastRunStartedAt: number().nullable(),
+	traces: array(AutomationRunTraceSchema)
+});
+/**
+* Actions — named, runnable things an operator (or an automation) can start,
+* declared as LIST ENTRIES, never as devices.
+*
+* An entry is either **internal** (a short list of cap/wait steps kept in the
+* hub's `actions` record kind) or declared by an addon through the
+* `action-source` collection (a Home Assistant script, a scene …). The one
+* surface the UI and automations talk to is the `actions` cap; it keeps no
+* catalog of its own (D3) — every `list` asks the providers live.
+*
+* This file is the data half: the entry schema, the variables an entry may
+* declare, and the pure resolution of the values a run was given. It holds no
+* runtime.
+*/
+/** What a variable's value is. `select` takes one of `options`. */
+var ActionVariableTypeSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"select"
+]);
+var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ActionVariableValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
+* value) or `{{vars.name}}` (inside a string) in their args.
+*/
+var ActionVariableSchema = object({
+	name: string().regex(ACTION_VARIABLE_NAME_RE),
+	label: string().min(1).max(120).optional(),
+	type: ActionVariableTypeSchema,
+	required: boolean().optional(),
+	default: ActionVariableValueSchema.optional(),
+	/** The allowed values of a `select`. */
+	options: array(string().min(1)).min(1).optional()
+}).superRefine((v, ctx) => {
+	if (v.type === "select" && v.options === void 0) ctx.addIssue({
+		code: "custom",
+		message: "a select variable needs options",
+		path: ["options"]
+	});
+	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
+		code: "custom",
+		message: variableValueError(v, v.default) ?? "invalid default",
+		path: ["default"]
+	});
+});
+/** Why `value` is not a legal value for the variable, or null when it is. */
+function variableValueError(variable, value) {
+	switch (variable.type) {
+		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
+		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
+		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
+	}
+}
+var ActionSourceKindSchema = _enum(["internal", "addon"]);
+function isInternalActionId(actionId) {
+	return actionId.startsWith("internal:") && actionId.length > 9;
+}
+/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
+function addonIdOfActionId(actionId) {
+	if (isInternalActionId(actionId)) return null;
+	const at = actionId.indexOf(":");
+	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
+}
+var ActionStatusSchema = object({
+	isRunning: boolean(),
+	/** Ms epoch the latest run STARTED; null when it never ran. */
+	lastRunAt: number().nullable(),
+	/** The latest run's failure; null on success or when it never ran. */
+	lastError: string().nullable()
+});
+var ActionEntrySchema = object({
+	/** `internal:<uuid>` or `<addonId>:<localId>`. */
+	id: string().min(3),
+	name: string().min(1).max(120),
+	/** The addon that declared it; `core-blocks` for an internal one. */
+	addonId: string().min(1),
+	source: ActionSourceKindSchema,
+	/** An addon-declared entry is edited where it was declared. */
+	readOnly: boolean(),
+	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
+	steps: array(ActionStepSchema).min(1).max(50).optional(),
+	variables: array(ActionVariableSchema).max(20).optional(),
+	status: ActionStatusSchema
+}).superRefine((entry, ctx) => {
+	if (entry.source === "internal") {
+		if (!isInternalActionId(entry.id)) ctx.addIssue({
+			code: "custom",
+			message: "an internal action id is internal:<uuid>",
+			path: ["id"]
+		});
+		return;
+	}
+	if (entry.steps !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "only an internal action carries steps",
+		path: ["steps"]
+	});
+	if (!entry.readOnly) ctx.addIssue({
+		code: "custom",
+		message: "an addon action is read-only here",
+		path: ["readOnly"]
+	});
+	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
+		code: "custom",
+		message: "an addon action id is <addonId>:<localId>",
+		path: ["id"]
+	});
+});
+/** What an operator writes for an internal action. */
+var ActionInputSchema = object({
+	name: string().min(1).max(120),
+	steps: array(ActionStepSchema).min(1).max(50),
+	variables: array(ActionVariableSchema).max(20).optional()
+});
+/** Who started a run. Absent = the operator pressed it. */
+var ActionRunOriginSchema = object({ 
+/** The automation block whose step started it. */
+blockId: string().min(1).optional() });
+/** `started` = the caller did not ask to wait. */
+var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
+var ActionRunResultSchema = object({
+	runId: string().min(1),
+	outcome: ActionRunOutcomeSchema,
+	/** Why it did not run, or what failed. */
+	message: string().optional()
+});
+_enum([
+	"not-found",
+	"read-only",
+	"invalid-variables",
+	"invalid-steps",
+	"not-linked",
+	"busy"
+]);
+object({
+	actionId: string(),
+	runId: string(),
+	isRunning: boolean(),
+	/** Set when the run ended. */
+	outcome: AutomationRunOutcomeSchema.optional(),
+	lastRunAt: number().nullable(),
+	lastError: string().nullable()
 });
 /**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
@@ -19727,7 +20115,18 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
-});
+}), method(object({
+	blockId: string().min(1),
+	trace: AutomationRunTraceSchema.optional(),
+	runStartedAt: number().optional(),
+	keepTraces: number().int().min(1).max(100).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockId: string().min(1) }), AutomationStateDocSchema, { auth: "admin" }), method(object({ blockId: string().min(1) }), object({
+	traces: array(AutomationRunTraceSchema),
+	lastError: string().nullable()
+}), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -45051,51 +45450,6 @@ var notificationOutputCapability = {
 		})
 	}
 };
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -57901,6 +58255,84 @@ var audioMetricsCapability = {
 	*/
 	history: "none"
 };
+method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
+	actionId: string().min(1),
+	variables: record(string(), ActionVariableValueSchema).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ actionId: string().min(1) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* actions — the ONE surface for runnable actions, for the UI and for
+* automations. Provided by the core-blocks builtin on the hub.
+*
+* An action is a LIST ENTRY, not a device (D883): either internal (cap and wait
+* steps, kept in the hub's `actions` record kind) or declared by an addon over
+* `action-source`. `list` asks every `action-source` provider LIVE and overlays
+* the run status from the hub's `runs` ledger; there is no catalog here to
+* drift (D3).
+*
+* **Permissions follow the camera, as linked devices do.** An action is linked
+* to cameras by the operator (`setLinks`, D356: nothing links itself). A
+* non-admin may `get` / `run` an action only through a camera they may see that
+* links it: they name the camera (`deviceId`, a top-level field so the scope
+* gate sees it) and the provider refuses an action that camera does not link.
+* An admin, and an in-process caller (an automation block), may run any action.
+* Every refusal is typed (`[not-linked] …`) and logged.
+*
+* A second `run` of an action that is already running is REFUSED — traced and
+* logged — never queued.
+*/
+var ActionIdInput = object({ actionId: string().min(1) });
+var ActionLinksSchema = object({
+	deviceId: number().int().nonnegative(),
+	actionIds: array(string().min(1)).max(100)
+});
+method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
+	actionId: string().min(1),
+	deviceId: number().int().nonnegative().optional()
+}), object({ action: ActionEntrySchema.nullable() }), {
+	role: "viewer",
+	auth: "protected",
+	kind: "query",
+	caller: "required"
+}), method(object({
+	actionId: string().min(1),
+	variables: record(string(), ActionVariableValueSchema).optional(),
+	wait: boolean().optional(),
+	origin: ActionRunOriginSchema.optional(),
+	deviceId: number().int().nonnegative().optional()
+}), ActionRunResultSchema, {
+	role: "viewer",
+	auth: "protected",
+	kind: "mutation",
+	caller: "required"
+}), method(ActionIdInput, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ActionIdInput, object({ traces: array(AutomationRunTraceSchema) }), { auth: "admin" }), method(object({ action: ActionInputSchema }), object({ action: ActionEntrySchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	actionId: string().min(1),
+	action: ActionInputSchema.partial()
+}), object({ action: ActionEntrySchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ActionIdInput, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), array(ActionEntrySchema), {
+	role: "viewer",
+	auth: "protected",
+	kind: "query"
+}), method(object({ deviceId: number().int().nonnegative() }), ActionLinksSchema, { auth: "admin" }), method(ActionLinksSchema, ActionLinksSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * Automation-control cap. Models HA `automation.*` entities on
 * `DeviceType.Automation`. An automation is a trigger+condition+
@@ -72084,6 +72516,104 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"actions.create": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.delete": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"actions.get": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.getLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.getTraces": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.list": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.listForCamera": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.run": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"actions.setLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.stop": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.update": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.listActions": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actionSource.runAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.stopAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonPages.listPages": {
 		capName: "addon-pages",
 		capScope: "system",
@@ -73365,6 +73895,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getAutomationRunState": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getBlockSettings": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -73386,6 +73923,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getTraces": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -73421,6 +73965,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.reportAutomationRun": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -85575,6 +86126,8 @@ var ML = "model and training machinery — no device action";
 var INTERNAL = "internal plumbing between addons — never operator-facing";
 /** Every system-scoped cap, with why it is not a device's vocabulary. */
 var SYSTEM_CAP_VOCABULARY = {
+	"action-source": system(INTERNAL),
+	actions: system("declared actions — run from the Actions page and from the cameras that link them"),
 	"addon-pages": system(UI_PLUMBING),
 	"addon-pages-source": system(UI_PLUMBING),
 	"addon-routes": system(UI_PLUMBING),
@@ -85771,6 +86324,31 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"actions.get": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.getLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.listForCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.setLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"addonSettings.getDeviceSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -90115,11 +90693,11 @@ var AlexaBrokerEntrySchema = object({
 * operator's browser uses (alexa-cookie2 rewrites Amazon URLs to absolute
 * `http://<proxyHost>:<proxyPort>/...`), so it is a directly-reachable host —
 * the hub's LAN IP/hostname — NOT behind the hub's HTTPS data-plane mount.
-* Empty `proxyHost` ⇒ auto-detect the host's primary non-loopback IPv4 at
-* login-start time.
+* Empty `proxyHost` ⇒ the first LAN address of the hub's `appConnections`
+* role (local-network palette) at login-start time.
 */
 var alexaProxyLoginSchema = object({
-	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = auto-detect)"),
+	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = the hub LAN address)"),
 	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
 });
 /**
@@ -131627,6 +132205,7 @@ var AlexaProxyLoginSession = class {
 				error: errMsg(err)
 			} });
 		}
+		await stopProxy(remote, this.#logger, this.#opts.sessionId);
 	}
 	/** Mark cancelled + dispose. */
 	async cancel() {
@@ -131680,6 +132259,24 @@ var AlexaProxyLoginSession = class {
 		this.dispose();
 	}
 };
+/** Close the login proxy so its port is free for the next session (idempotent). */
+function stopProxy(remote, logger, sessionId) {
+	return new Promise((resolve) => {
+		try {
+			if (typeof remote.stopProxyServer !== "function") {
+				resolve();
+				return;
+			}
+			remote.stopProxyServer(() => resolve());
+		} catch (err) {
+			logger.warn("alexa proxy-login: stopProxyServer failed", { meta: {
+				sessionId,
+				error: errMsg(err)
+			} });
+			resolve();
+		}
+	});
+}
 /**
 * Lines emitted by alexa-cookie2 that contain raw credential material
 * (cookie values, CSRF tokens, bearer tokens). Any log line matching this
@@ -131707,15 +132304,62 @@ function isStringOrObject(value) {
 	return typeof value === "string" || typeof value === "object" && value !== null;
 }
 //#endregion
+//#region src/alexa-proxy-host.ts
+/** Typed refusal: names WHY no proxy host could be chosen. */
+var AlexaProxyHostError = class extends Error {
+	reason;
+	constructor(reason, message, options) {
+		super(message, options);
+		this.name = "AlexaProxyHostError";
+		this.reason = reason;
+	}
+};
+var PRIVATE_IPV4 = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/;
+var IPV4_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
+/** A host a browser on the hub's network reaches directly: private IPv4, `.local`, or a bare name. */
+function isLanHost(host) {
+	if (host.length === 0) return false;
+	if (IPV4_LITERAL.test(host)) return PRIVATE_IPV4.test(host);
+	if (host.includes(":")) return false;
+	return host.endsWith(".local") || !host.includes(".");
+}
+function lanHostOf(address) {
+	try {
+		const host = new URL(address).hostname;
+		return isLanHost(host) && host !== "localhost" ? host : null;
+	} catch {
+		return null;
+	}
+}
+async function resolveProxyHost(input) {
+	const override = input.override.trim();
+	if (override.length > 0) return override;
+	let addresses;
+	try {
+		addresses = await input.readAppConnections();
+	} catch (err) {
+		input.logger.warn("alexa proxy-login: hub addresses unavailable from local-network", { meta: { error: errMsg(err) } });
+		throw new AlexaProxyHostError("palette-unavailable", "alexa proxy-login: the hub address list is unavailable — set proxyHost in settings", { cause: err });
+	}
+	for (const address of addresses) {
+		const host = lanHostOf(address);
+		if (host !== null) return host;
+	}
+	input.logger.warn("alexa proxy-login: no LAN address among the hub appConnections", { meta: { addresses: [...addresses] } });
+	throw new AlexaProxyHostError("no-lan-address", "alexa proxy-login: the hub has no LAN address the browser can open directly — set proxyHost in settings");
+}
+//#endregion
 //#region src/alexa-proxy-login-manager.ts
 var AlexaProxyLoginManager = class {
 	#logger;
 	#getProxyConfig;
+	#getAppConnectionAddresses;
 	#session = null;
 	#captured = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.#logger = deps.logger;
 		this.#getProxyConfig = deps.getProxyConfig;
+		this.#getAppConnectionAddresses = deps.getAppConnectionAddresses;
 	}
 	/**
 	* Start a fresh proxy-login. Cancels any in-flight session first (single
@@ -131724,8 +132368,11 @@ var AlexaProxyLoginManager = class {
 	async start(amazonDomain) {
 		await this.cancelActive();
 		const { proxyHost, proxyPort } = this.#getProxyConfig();
-		const host = proxyHost.length > 0 ? proxyHost : detectPrimaryIpv4();
-		if (host.length === 0) throw new Error("alexa proxy-login: could not auto-detect a reachable host IP — set proxyHost in settings");
+		const host = await resolveProxyHost({
+			override: proxyHost,
+			readAppConnections: this.#getAppConnectionAddresses,
+			logger: this.#logger
+		});
 		const sessionId = (0, node_crypto.randomBytes)(9).toString("base64url");
 		const session = new AlexaProxyLoginSession({
 			sessionId,
@@ -131793,19 +132440,6 @@ var AlexaProxyLoginManager = class {
 	}
 };
 /**
-* Best-effort primary non-loopback IPv4 of the host. Used when the operator
-* leaves `proxyHost` blank. Returns '' when none found (then the operator must
-* set it explicitly — common on multi-homed/containerised hosts).
-*/
-function detectPrimaryIpv4() {
-	const ifaces = (0, node_os.networkInterfaces)();
-	for (const addrs of Object.values(ifaces)) {
-		if (addrs === void 0) continue;
-		for (const addr of addrs) if (addr.family === "IPv4" && !addr.internal && addr.address.length > 0) return addr.address;
-	}
-	return "";
-}
-/**
 * Serialize the captured `cookieData` blob into the single STRING the broker
 * connection stores in its `cookie` field. `AlexaRemoteClient` already parses a
 * JSON-object cookie string back into the richer object form on init, so we
@@ -135502,7 +136136,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 					proxyHost: cfg.proxyHost,
 					proxyPort: cfg.proxyPort
 				};
-			}
+			},
+			getAppConnectionAddresses: async () => (await this.ctx.api.localNetwork.getAddresses.query()).roles.appConnections.resolved
 		});
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
 		await this.reconcileIntegrationsToBrokers();