@camstack/addon-provider-bosch 0.1.28 → 0.1.30

package/dist/{dist-DEZDBpGW.js → dist-BioIJ3NA.js}

@@ -1,5 +1,5 @@
 require("node:crypto");
-//#region ../types/dist/event-category-CT-hz5Rb.mjs
+//#region ../types/dist/event-category-hdMR7CTW.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -764,6 +764,11 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	*/
 	EventCategory["AccessoriesChanged"] = "accessories.onAccessoriesChanged";
 	/**
+	* An action run started or ended. Emitted by the `actions` surface.
+	* Payload: `ActionRunChanged` (`{ actionId, runId, isRunning, outcome?, lastRunAt, lastError }`).
+	*/
+	EventCategory["ActionsRunChanged"] = "actions.onRunChanged";
+	/**
 	* Progress update from a running model conversion job.
 	* Payload: `{ kind: 'model-convert', phase, sessionId?, pct?, detail? }`.
 	* Emitted by `addon-model-studio` on the converting node.
@@ -938,7 +943,7 @@ var propertyKeyTypes = /* @__PURE__*/ new Set([
 	"number",
 	"symbol"
 ]);
-function escapeRegex(str) {
+function escapeRegex$1(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -1668,7 +1673,7 @@ var $ZodCheckUpperCase = /*@__PURE__*/ $constructor("$ZodCheckUpperCase", (inst,
 });
 var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const escapedRegex = escapeRegex(def.includes);
+	const escapedRegex = escapeRegex$1(def.includes);
 	const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
 	def.pattern = pattern;
 	inst._zod.onattach.push((inst) => {
@@ -1691,7 +1696,7 @@ var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, d
 });
 var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+	const pattern = new RegExp(`^${escapeRegex$1(def.prefix)}.*`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -1713,7 +1718,7 @@ var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (ins
 });
 var $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+	const pattern = new RegExp(`.*${escapeRegex$1(def.suffix)}$`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -2949,7 +2954,7 @@ var $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	const values = getEnumValues(def.entries);
 	const valuesSet = new Set(values);
 	inst._zod.values = valuesSet;
-	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex$1(o) : o.toString()).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (valuesSet.has(input)) return payload;
@@ -2967,7 +2972,7 @@ var $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
 	if (def.values.length === 0) throw new Error("Cannot create literal schema with no valid values");
 	const values = new Set(def.values);
 	inst._zod.values = values;
-	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex$1(o) : o ? escapeRegex$1(o.toString()) : String(o)).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (values.has(input)) return payload;
@@ -5442,7 +5447,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bykKrTgu.mjs
+//#region ../types/dist/sleep-BHjNez61.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8588,6 +8593,8 @@ Object.freeze({ "doorbell": "lastPressedAt" });
 /** Every capability name, so addon code can check a name without the schema graph. */
 var CAP_NAMES = Object.freeze([
 	"accessories",
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -8661,6 +8668,7 @@ var CAP_NAMES = Object.freeze([
 	"filesystem-browse",
 	"flood",
 	"gas",
+	"group-active",
 	"group-commands",
 	"group-status",
 	"heating-valve",
@@ -8683,6 +8691,7 @@ var CAP_NAMES = Object.freeze([
 	"login-method",
 	"media-player",
 	"mesh-network",
+	"meter",
 	"metrics-provider",
 	"model-convert",
 	"model-distributor",
@@ -9481,6 +9490,10 @@ Object.freeze({
 		"path": "detected",
 		"valueType": "boolean"
 	}],
+	"group-active": [{
+		"path": "active",
+		"valueType": "boolean"
+	}],
 	"group-status": [
 		{
 			"path": "included",
@@ -9740,6 +9753,10 @@ Object.freeze({
 			]
 		}
 	],
+	"meter": [{
+		"path": "value",
+		"valueType": "number"
+	}],
 	"motion": [
 		{
 			"path": "detected",
@@ -9880,6 +9897,18 @@ Object.freeze({
 			"path": "foodLevel",
 			"valueType": "number"
 		},
+		{
+			"path": "bowlFood",
+			"valueType": "number"
+		},
+		{
+			"path": "eating",
+			"valueType": "boolean"
+		},
+		{
+			"path": "supportsMarkRefilled",
+			"valueType": "boolean"
+		},
 		{
 			"path": "food1",
 			"valueType": "number"
@@ -10483,7 +10512,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BXKzRBwg.mjs
+//#region ../types/dist/err-msg-DIorGYeC.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -10577,8 +10606,14 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["PetFeeder"] = "pet-feeder";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations. */
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
 	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -10836,7 +10871,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-OhpuespA.mjs
+//#region ../types/dist/composition-Bb8iwHEJ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11151,6 +11186,13 @@ var table = {
 		apply: () => {
 			throw new ExpressionEvalError("latchedAt: stateful evaluation context is required");
 		}
+	},
+	schmitt: {
+		minArgs: 3,
+		maxArgs: 5,
+		apply: () => {
+			throw new ExpressionEvalError("schmitt: stateful evaluation context is required");
+		}
 	}
 };
 Object.freeze(Object.assign(Object.create(null), table));
@@ -11592,6 +11634,99 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
+* One power reading becomes a washer, dryer or dishwasher (D944 helper).
+*
+* Standby of the control board is under 5 W; a motor or a heater is far
+* above that, so 5 W is the line. A door lock or a short pump spike is not
+* a cycle, so running starts only after 30 s above the line.
+*
+* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
+* bursts) lasts several minutes. Ending the cycle on the first dip would
+* report "finished" in the middle of the program, so the stop dwell is
+* 10 minutes on every type. The number is stored per type so one machine
+* can move later without moving the others.
+*/
+var APPLIANCE_TEMPLATE_ID = "appliance";
+var APPLIANCE_KINDS = [
+	"washer",
+	"dryer",
+	"dishwasher"
+];
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+/**
+* Statistics and integrals over a history read (D944).
+*
+* Pure: the same points always give the same answer, so a restart recomputes
+* rather than trusting a buffer. A gauge mean is time-weighted (value × ms),
+* never the mean of the samples. A hole with no held value is not integrated
+* as zero. A truncated read is not published.
+*/
+var STATISTIC_STATS = [
+	"min",
+	"max",
+	"mean",
+	"sum",
+	"count",
+	"change"
+];
+/**
+* The range a statistics or integral helper asks history for (D944).
+*
+* Calendar edges are the hub's timezone, never UTC midnight: a day is 23, 24
+* or 25 hours across a DST change. A tier is eligible only when its retention
+* is strictly longer than the longest that range can be. Forever qualifies.
+* Equal to a tier's retention is a refusal, not a short answer.
+*/
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+var ROLLING_SPANS = [
+	"1h",
+	"24h",
+	"2d",
+	"7d",
+	"30d",
+	"custom"
+];
+var CALENDAR_PERIODS = [
+	"today",
+	"yesterday",
+	"this-week",
+	"this-month"
+];
+var RESET_PERIODS = [
+	"never",
+	"daily",
+	"weekly",
+	"monthly"
+];
+5 * MINUTE_MS;
+24 * HOUR_MS, 2 * DAY_MS, 7 * DAY_MS, 30 * DAY_MS;
+7 * DAY_MS, 30 * DAY_MS, 365 * DAY_MS;
+var rollingWindowObject = object({
+	kind: literal("rolling"),
+	span: _enum(ROLLING_SPANS),
+	customMinutes: number().int().min(5).optional()
+}).check((payload) => {
+	if (payload.value.span === "custom" && payload.value.customMinutes === void 0) payload.issues.push({
+		code: "custom",
+		message: "a custom range needs a duration in minutes",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+	if (payload.value.span !== "custom" && payload.value.customMinutes !== void 0) payload.issues.push({
+		code: "custom",
+		message: "only a custom range carries a duration",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+});
+var RollingWindowSchema = rollingWindowObject;
+var StatisticWindowSchema = discriminatedUnion("kind", [rollingWindowObject, object({
+	kind: literal("calendar"),
+	period: _enum(CALENDAR_PERIODS)
+})]);
+/**
 * A composition source identity: `(addonId, stableId)`, never a numeric device
 * id. Split out so helper schemas can name it without a cycle through
 * `composition.ts` (D659).
@@ -11617,7 +11752,13 @@ var GROUP_TEMPLATE_IDS = [
 	"occupancy",
 	"binary",
 	"switch",
-	"light"
+	"light",
+	"fan",
+	"cover",
+	"valve",
+	"lock",
+	"media-player",
+	"climate"
 ];
 var NUMERIC_AGGREGATES = [
 	"mean",
@@ -11647,14 +11788,73 @@ var HelperMemberSchema = object({
 	cap: string().min(1),
 	fieldPath: string().min(1)
 });
-var HelperSpecSchema = discriminatedUnion("kind", [object({
-	kind: literal("group"),
-	templateId: GroupTemplateIdSchema,
-	aggregate: AggregateReducerSchema,
-	members: array(HelperMemberSchema).min(1).max(64),
-	/** Actuator groups only. Readings leave this unset. */
-	active: ActiveCriterionSchema.optional()
-})]);
+var HelperSpecSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("group"),
+		templateId: GroupTemplateIdSchema,
+		aggregate: AggregateReducerSchema,
+		members: array(HelperMemberSchema).min(1).max(64),
+		/** Actuator groups only. Readings leave this unset. */
+		active: ActiveCriterionSchema.optional()
+	}),
+	object({
+		kind: literal("appliance"),
+		templateId: literal(APPLIANCE_TEMPLATE_ID),
+		appliance: _enum(APPLIANCE_KINDS),
+		thresholdWatts: number().positive(),
+		startDwellMs: number().int().nonnegative(),
+		stopDwellMs: number().int().nonnegative(),
+		member: HelperMemberSchema
+	}),
+	object({
+		kind: literal("statistic"),
+		stat: _enum(STATISTIC_STATS),
+		window: StatisticWindowSchema,
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("integral"),
+		reset: _enum(RESET_PERIODS),
+		output: _enum(["energy", "meter"]),
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("threshold"),
+		source: HelperMemberSchema,
+		high: number(),
+		low: number(),
+		onForMs: number().int().nonnegative(),
+		offForMs: number().int().nonnegative()
+	}),
+	object({
+		kind: literal("arithmetic"),
+		op: _enum([
+			"sum",
+			"difference",
+			"ratio"
+		]),
+		inputs: array(HelperMemberSchema).min(2).max(64)
+	}),
+	object({
+		kind: literal("expression"),
+		expr: string().min(1),
+		inputs: array(object({
+			name: string().min(1),
+			member: HelperMemberSchema
+		})).min(1).max(64),
+		output: _enum(["number", "boolean"])
+	}),
+	object({
+		kind: literal("derivative"),
+		window: RollingWindowSchema,
+		per: _enum([
+			"second",
+			"minute",
+			"hour"
+		]),
+		source: HelperMemberSchema
+	})
+]);
 /** A composed device's stableId is this prefix plus the block id. */
 var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
 /** Longest snippet a `code` source may carry (slice 4). */
@@ -11715,6 +11915,12 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"all"
 		]),
 		reads: array(CompositionFieldReadSchema).min(1).max(64),
+		/**
+		* Set when the reads are an enum state, not a yes/no: the listed states
+		* count as active (a cover is `open`). A state outside the list is inactive;
+		* a read that is not a state at all is left out. Only `any` / `all` use it.
+		*/
+		activeWhen: array(string().min(1)).min(1).optional(),
 		/** `value` is the reading; the others are the member counts. */
 		publish: _enum([
 			"value",
@@ -11728,6 +11934,26 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"omit",
 			"offline"
 		])
+	}),
+	object({
+		kind: literal("series"),
+		read: CompositionFieldReadSchema,
+		/** `value` is the statistic or the integral. The others are the gap counts. */
+		publish: _enum([
+			"value",
+			"included",
+			"excluded",
+			"total"
+		]),
+		/**
+		* What an unanswered `value` does. Counts ignore this. `offline` leaves the
+		* device unseeded until history answers, so a restart cannot publish 0.
+		*/
+		empty: _enum([
+			"null",
+			"omit",
+			"offline"
+		])
 	})
 ]);
 var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
@@ -15239,7 +15465,23 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 		kind: literal("schedule"),
 		cron: string().min(1).max(120)
 	}),
-	object({ kind: literal("manual") })
+	object({ kind: literal("manual") }),
+	object({
+		kind: literal("detection"),
+		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
+		*  matches every raw class that maps to it; any other name matches
+		*  exactly. */
+		classes: array(string().min(1)).min(1),
+		deviceIds: array(number().int().nonnegative()).min(1),
+		/** The track must have visited at least one of these zones. */
+		zones: array(string().min(1)).min(1).optional(),
+		/** Best-so-far confidence the track must reach. */
+		minScore: number().min(0).max(1).optional()
+	}),
+	object({
+		kind: literal("interval"),
+		minutes: number().int().min(1).max(1440)
+	})
 ]);
 /**
 * One action step.
@@ -15259,28 +15501,47 @@ var AutomationTriggerSchema = discriminatedUnion("kind", [
 * is called. The runner still receives a number and is untouched; the
 * resolution is the recipe's job, not the runner's.
 */
+var AutomationWaitStepSchema = object({
+	kind: literal("wait"),
+	seconds: number().min(0).max(300)
+});
+var AutomationCapStepSchema = object({
+	kind: literal("cap"),
+	/**
+	* One device, several same-family devices (locks / climate family / …),
+	* or `{ $var }` for the device that triggered the run. An array is
+	* fan-out at codegen — each id gets the same cap.method call.
+	*/
+	deviceId: union([
+		number().int(),
+		array(number().int()).min(1),
+		object({ $var: string().min(1) })
+	]),
+	cap: string().min(1),
+	method: string().min(1),
+	/** Values may carry `{{vars.x}}` slots, or be exactly `{ $var: 'name' }`, which
+	*  SUBSTITUTE and do not evaluate (§3.2.3). Anything beyond substitution is
+	*  the expression leaf. */
+	args: record(string(), unknown()).optional()
+});
+/**
+* The steps an internal Action may contain: cap and wait, and nothing that can
+* call back into an Action — so an Action can never reach itself (no cycles).
+*/
+var ActionStepSchema = discriminatedUnion("kind", [AutomationWaitStepSchema, AutomationCapStepSchema]);
 var AutomationActionSchema = discriminatedUnion("kind", [
+	AutomationWaitStepSchema,
+	AutomationCapStepSchema,
 	object({
-		kind: literal("wait"),
-		seconds: number().min(0).max(300)
-	}),
-	object({
-		kind: literal("cap"),
-		/**
-		* One device, several same-family devices (locks / climate family / …),
-		* or `{ $var }` for the device that triggered the run. An array is
-		* fan-out at codegen — each id gets the same cap.method call.
-		*/
-		deviceId: union([
-			number().int(),
-			array(number().int()).min(1),
-			object({ $var: string().min(1) })
-		]),
-		cap: string().min(1),
-		method: string().min(1),
-		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
-		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
-		args: record(string(), unknown()).optional()
+		kind: literal("action"),
+		/** An entry of the `actions` surface (`internal:<uuid>` or `<addonId>:<localId>`). */
+		actionId: string().min(1),
+		/** Values for the action's declared variables; the others take their default. */
+		variables: record(string(), union([
+			string(),
+			number(),
+			boolean()
+		])).optional()
 	}),
 	object({
 		kind: literal("code"),
@@ -15289,10 +15550,356 @@ var AutomationActionSchema = discriminatedUnion("kind", [
 		code: string().min(1).max(2e4)
 	})
 ]);
+/**
+* How a trigger that arrives while the automation is busy (or cooling down) is
+* handled. One of the automation's execution modes, never a property of its
+* actions. Absent means `single`.
+*
+*  - `single`   — drop the trigger while a run is in progress (traced + logged).
+*  - `restart`  — abort the run in progress (at its next step boundary), start fresh.
+*  - `queued`   — queue up to `max` triggers, drop the rest (traced).
+*  - `parallel` — up to `max` runs at once, drop the rest (traced).
+*  - `cooldown` — `single`, and no new run until `minutes` after the last run
+*    STARTED; persisted across a restart. A manual trigger bypasses only this
+*    wait, never the single/queued limits.
+*/
+var AutomationRunModeSchema = discriminatedUnion("mode", [
+	object({ mode: literal("single") }),
+	object({ mode: literal("restart") }),
+	object({
+		mode: literal("queued"),
+		max: number().int().min(1).max(10)
+	}),
+	object({
+		mode: literal("parallel"),
+		max: number().int().min(1).max(10)
+	}),
+	object({
+		mode: literal("cooldown"),
+		minutes: number().int().min(1).max(1440)
+	})
+]);
 var AutomationRecipeSchema = object({
 	triggers: array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
-	actions: array(AutomationActionSchema)
+	actions: array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
+	keepTraces: number().int().min(1).max(100).optional()
+});
+new Set([
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+].map((l) => l.id));
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+new Set(Object.values(COCO_TO_MACRO.mapping));
+/**
+* Run traces — what an automation (or, later, an Action run) DID, node by node,
+* so the editor can paint every block green or red with its reason.
+*
+* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
+* every condition node (containers and leaves, including the ones a
+* short-circuit never reached), the run-mode verdict and every action step —
+* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Skipped
+* evaluations are traced too, and identical consecutive skips collapse into a
+* repeat count so a trigger that fails every 5 minutes cannot flush real runs.
+*
+* {@link AutomationStepTraceSchema} is deliberately free of automation
+* vocabulary so an Action run records the same step shape.
+*/
+/** A value a trace may show: JSON primitives and short lists, nothing deeper. */
+var TraceValueSchema = union([
+	string(),
+	number(),
+	boolean(),
+	_null(),
+	array(union([string(), number()]))
+]);
+var AutomationRunOutcomeSchema = _enum([
+	"ran",
+	"skipped-trigger",
+	"skipped-conditions",
+	"skipped-cooldown",
+	"skipped-overlap",
+	"failed",
+	"aborted"
+]);
+/** `not-evaluated` = a short-circuit never reached the node. */
+var TraceNodeOutcomeSchema = _enum([
+	"pass",
+	"fail",
+	"not-evaluated"
+]);
+var AutomationTriggerTraceSchema = object({
+	kind: string().min(1),
+	outcome: _enum(["pass", "fail"]),
+	/** Why an event was rejected ("class person not in [dog]") or what fired. */
+	reason: string(),
+	/** deviceId, className, trackId, score … — only what the trigger exposes. */
+	vars: record(string(), TraceValueSchema)
+});
+var AutomationConditionTraceNodeSchema = object({
+	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	path: string().min(1),
+	kind: _enum([
+		"all",
+		"any",
+		"not",
+		"condition",
+		"expression"
+	]),
+	outcome: TraceNodeOutcomeSchema,
+	reason: string(),
+	deviceId: number().int().optional(),
+	cap: string().optional(),
+	fieldPath: string().optional(),
+	operator: string().optional(),
+	expected: TraceValueSchema.optional(),
+	/** What the mirror held; `null` when it held nothing (unknown). */
+	observed: TraceValueSchema.optional()
+});
+var AutomationRunVerdictSchema = object({
+	mode: AutomationRunModeSchema,
+	decision: _enum([
+		"run",
+		"queued",
+		"restart",
+		"drop",
+		"cooldown",
+		"bypass"
+	]),
+	reason: string()
+});
+/** One executed (or not-run) step — shared by automations and Action runs. */
+var AutomationStepTraceSchema = object({
+	/** `actions.<i>` */
+	path: string().min(1),
+	kind: string().min(1),
+	cap: string().optional(),
+	method: string().optional(),
+	deviceId: number().int().optional(),
+	startedAt: number().optional(),
+	endedAt: number().optional(),
+	outcome: _enum([
+		"ok",
+		"error",
+		"not-run"
+	]),
+	message: string().optional()
+});
+var AutomationRunTraceSchema = object({
+	runId: string().min(1),
+	startedAt: number(),
+	endedAt: number(),
+	trigger: AutomationTriggerTraceSchema,
+	conditions: array(AutomationConditionTraceNodeSchema),
+	verdict: AutomationRunVerdictSchema.optional(),
+	steps: array(AutomationStepTraceSchema),
+	outcome: AutomationRunOutcomeSchema,
+	/** How many identical consecutive skips this trace stands for (>= 1). */
+	repeat: number().int().min(1),
+	/** When the latest of those repeats happened. */
+	lastAt: number()
+});
+/**
+* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
+* `action:<actionId>`): the cooldown stamp and the trace ring.
+*/
+var AutomationStateDocSchema = object({
+	version: literal(1),
+	lastRunStartedAt: number().nullable(),
+	traces: array(AutomationRunTraceSchema)
+});
+/**
+* Actions — named, runnable things an operator (or an automation) can start,
+* declared as LIST ENTRIES, never as devices.
+*
+* An entry is either **internal** (a short list of cap/wait steps kept in the
+* hub's `actions` record kind) or declared by an addon through the
+* `action-source` collection (a Home Assistant script, a scene …). The one
+* surface the UI and automations talk to is the `actions` cap; it keeps no
+* catalog of its own (D3) — every `list` asks the providers live.
+*
+* This file is the data half: the entry schema, the variables an entry may
+* declare, and the pure resolution of the values a run was given. It holds no
+* runtime.
+*/
+/** What a variable's value is. `select` takes one of `options`. */
+var ActionVariableTypeSchema = _enum([
+	"string",
+	"number",
+	"boolean",
+	"select"
+]);
+var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ActionVariableValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
+* value) or `{{vars.name}}` (inside a string) in their args.
+*/
+var ActionVariableSchema = object({
+	name: string().regex(ACTION_VARIABLE_NAME_RE),
+	label: string().min(1).max(120).optional(),
+	type: ActionVariableTypeSchema,
+	required: boolean().optional(),
+	default: ActionVariableValueSchema.optional(),
+	/** The allowed values of a `select`. */
+	options: array(string().min(1)).min(1).optional()
+}).superRefine((v, ctx) => {
+	if (v.type === "select" && v.options === void 0) ctx.addIssue({
+		code: "custom",
+		message: "a select variable needs options",
+		path: ["options"]
+	});
+	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
+		code: "custom",
+		message: variableValueError(v, v.default) ?? "invalid default",
+		path: ["default"]
+	});
+});
+/** Why `value` is not a legal value for the variable, or null when it is. */
+function variableValueError(variable, value) {
+	switch (variable.type) {
+		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
+		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
+		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
+	}
+}
+var ActionSourceKindSchema = _enum(["internal", "addon"]);
+function isInternalActionId(actionId) {
+	return actionId.startsWith("internal:") && actionId.length > 9;
+}
+/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
+function addonIdOfActionId(actionId) {
+	if (isInternalActionId(actionId)) return null;
+	const at = actionId.indexOf(":");
+	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
+}
+var ActionStatusSchema = object({
+	isRunning: boolean(),
+	/** Ms epoch the latest run STARTED; null when it never ran. */
+	lastRunAt: number().nullable(),
+	/** The latest run's failure; null on success or when it never ran. */
+	lastError: string().nullable()
+});
+var ActionEntrySchema = object({
+	/** `internal:<uuid>` or `<addonId>:<localId>`. */
+	id: string().min(3),
+	name: string().min(1).max(120),
+	/** The addon that declared it; `core-blocks` for an internal one. */
+	addonId: string().min(1),
+	source: ActionSourceKindSchema,
+	/** An addon-declared entry is edited where it was declared. */
+	readOnly: boolean(),
+	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
+	steps: array(ActionStepSchema).min(1).max(50).optional(),
+	variables: array(ActionVariableSchema).max(20).optional(),
+	status: ActionStatusSchema
+}).superRefine((entry, ctx) => {
+	if (entry.source === "internal") {
+		if (!isInternalActionId(entry.id)) ctx.addIssue({
+			code: "custom",
+			message: "an internal action id is internal:<uuid>",
+			path: ["id"]
+		});
+		return;
+	}
+	if (entry.steps !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "only an internal action carries steps",
+		path: ["steps"]
+	});
+	if (!entry.readOnly) ctx.addIssue({
+		code: "custom",
+		message: "an addon action is read-only here",
+		path: ["readOnly"]
+	});
+	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
+		code: "custom",
+		message: "an addon action id is <addonId>:<localId>",
+		path: ["id"]
+	});
+});
+/** What an operator writes for an internal action. */
+var ActionInputSchema = object({
+	name: string().min(1).max(120),
+	steps: array(ActionStepSchema).min(1).max(50),
+	variables: array(ActionVariableSchema).max(20).optional()
+});
+/** Who started a run. Absent = the operator pressed it. */
+var ActionRunOriginSchema = object({ 
+/** The automation block whose step started it. */
+blockId: string().min(1).optional() });
+/** `started` = the caller did not ask to wait. */
+var ActionRunOutcomeSchema = union([AutomationRunOutcomeSchema, literal("started")]);
+var ActionRunResultSchema = object({
+	runId: string().min(1),
+	outcome: ActionRunOutcomeSchema,
+	/** Why it did not run, or what failed. */
+	message: string().optional()
+});
+_enum([
+	"not-found",
+	"read-only",
+	"invalid-variables",
+	"invalid-steps",
+	"not-linked",
+	"busy"
+]);
+object({
+	actionId: string(),
+	runId: string(),
+	isRunning: boolean(),
+	/** Set when the run ended. */
+	outcome: AutomationRunOutcomeSchema.optional(),
+	lastRunAt: number().nullable(),
+	lastError: string().nullable()
 });
 /**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
@@ -16887,7 +17494,22 @@ var BrokerProviderInfoSchema = object({
 		*/
 		interactiveConnectPath: string().min(1).optional(),
 		/** Relative hub path to disconnect the linked account (same popup pattern). */
-		interactiveDisconnectPath: string().min(1).optional()
+		interactiveDisconnectPath: string().min(1).optional(),
+		/**
+		* The kind signs in through a server-held interactive session instead of
+		* (or before) typed credentials. `basePath` is a hub-relative route set
+		* served by the owning addon (`/addon/<id>/...`) speaking the sign-in
+		* contract: `POST {basePath}/start` (body: the form's settings) answers
+		* `{ sessionId, loginUrl }`; `GET {basePath}/status?sessionId=` answers
+		* `{ phase: 'starting' | 'awaiting-login' | 'captured' | 'error' |
+		* 'cancelled', loginUrl, error }`; `POST {basePath}/commit`
+		* (`{ sessionId, name, brokerId? }`) stores the credentials on a new or
+		* existing broker and answers `{ brokerId }`; `POST {basePath}/cancel`
+		* (`{ sessionId }`) drops the session. The dialog that edits a broker
+		* offers it as the default path; the fields the session fills are
+		* marked `filledBySignIn` in the kind's settings schema.
+		*/
+		signIn: object({ basePath: string().min(1) }).optional()
 	}))
 });
 var ListInputSchema = object({ 
@@ -17992,7 +18614,8 @@ var CompositionProblemSchema = object({
 		"native-capability-replace",
 		"mixed-quantity",
 		"helper-mismatch",
-		"member-constraint"
+		"member-constraint",
+		"retention"
 	]),
 	path: string(),
 	message: string()
@@ -18226,13 +18849,17 @@ Object.freeze({
 	latchedAt: {
 		kind: "fixed",
 		result: ["number", "null"]
+	},
+	schmitt: {
+		kind: "fixed",
+		result: ["boolean", "null"]
 	}
 });
 /**
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW = {
+var NOW$2 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -18246,6 +18873,8 @@ function numeric(input) {
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
 		aggregates: NUMERIC_AGGREGATES,
@@ -18261,6 +18890,8 @@ function binary(input) {
 		family: "binary",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		quantity: "none",
 		baseUnit: void 0,
@@ -18278,7 +18909,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "humidity",
@@ -18289,7 +18920,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "pressure",
@@ -18300,7 +18931,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "illuminance",
@@ -18311,7 +18942,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "power",
@@ -18322,7 +18953,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "energy",
@@ -18333,7 +18964,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "battery",
@@ -18368,7 +18999,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	binary({
 		id: "motion",
@@ -18462,6 +19093,11 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one switch is on, or when all of them are. Offline and unknown members are left out of that decision, never read as off, and still receive the command.",
 		deviceType: DeviceType.Switch,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: ["switch"]
 	}),
 	actuator({
@@ -18469,34 +19105,136 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one light is on, or when all of them are. Brightness and colour are offered only when every member has them. A command is not sent to a member that lacks it.",
 		deviceType: DeviceType.Light,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: [
 			"switch",
 			"brightness",
 			"color"
 		]
+	}),
+	actuator({
+		id: "fan",
+		summary: "On when at least one fan is on, or when all of them are. Speed, preset, direction and oscillation are offered only when every fan has them. A command is not sent to a fan that lacks it.",
+		deviceType: DeviceType.Fan,
+		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
+		commandCaps: ["switch", "fan-control"]
+	}),
+	actuator({
+		id: "cover",
+		summary: "Open when at least one cover is open or part-open, or only when all of them are. Position and tilt are offered only when every cover has them. A cover that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Cover,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "cover",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["cover"]
+	}),
+	actuator({
+		id: "valve",
+		summary: "Open when at least one valve is open or part-open, or only when all of them are. Position is offered only when every valve has it. A valve that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Valve,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "valve",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["valve"]
+	}),
+	actuator({
+		id: "lock",
+		summary: "Locked when at least one lock is locked, or only when all of them are. A jammed or moving lock is not locked. Locking is one tap; unlocking the group needs a confirmation every time, and nothing is sent without it.",
+		deviceType: DeviceType.Lock,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "lock-control",
+			fieldPath: "state"
+		},
+		activeWhen: ["locked"],
+		commandCaps: ["lock-control"]
+	}),
+	actuator({
+		id: "media-player",
+		summary: "Playing when at least one player is playing, or only when all of them are. Volume is offered only when every player has it. A player that reports nothing is left out, never read as stopped.",
+		deviceType: DeviceType.MediaPlayer,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "media-player",
+			fieldPath: "state"
+		},
+		activeWhen: ["playing", "buffering"],
+		commandCaps: ["media-player"]
+	}),
+	actuator({
+		id: "climate",
+		summary: "Running when at least one thermostat or air conditioner is not off, or only when all of them are. Target temperature and fan are offered only when every device has them. A device that reports nothing is left out, never read as off.",
+		deviceType: DeviceType.Thermostat,
+		memberDeviceTypes: [DeviceType.Thermostat, DeviceType.Climate],
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "climate-control",
+			fieldPath: "mode"
+		},
+		activeWhen: [
+			"heat",
+			"cool",
+			"auto",
+			"heat_cool",
+			"fan_only",
+			"dry"
+		],
+		commandCaps: ["climate-control"]
 	})
 ];
 function actuator(input) {
 	return {
-		...input,
+		id: input.id,
+		summary: input.summary,
+		deviceType: input.deviceType,
+		outputCap: input.outputCap,
+		outputField: input.outputField,
+		commandCaps: input.commandCaps,
 		family: "actuator",
 		role: void 0,
 		memberDeviceType: input.deviceType,
-		outputField: "on",
+		memberDeviceTypes: input.memberDeviceTypes ?? [input.deviceType],
+		activeWhen: input.activeWhen,
 		quantity: "none",
 		baseUnit: void 0,
 		aggregates: BINARY_AGGREGATES,
 		defaultAggregate: "any",
 		empty: "offline",
-		accept: [{
-			cap: "switch",
-			fieldPath: "on"
-		}],
+		accept: [input.member],
 		companions: [CHANGED]
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
+DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * What a composition may BUILD on a device type (G2, D676): the caps a new
@@ -18811,7 +19549,18 @@ method(object({}), object({ blocks: array(CoreBlockSchema) }), { auth: "admin" }
 	kind: "mutation",
 	auth: "admin",
 	access: "view"
-});
+}), method(object({
+	blockId: string().min(1),
+	trace: AutomationRunTraceSchema.optional(),
+	runStartedAt: number().optional(),
+	keepTraces: number().int().min(1).max(100).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ blockId: string().min(1) }), AutomationStateDocSchema, { auth: "admin" }), method(object({ blockId: string().min(1) }), object({
+	traces: array(AutomationRunTraceSchema),
+	lastError: string().nullable()
+}), { auth: "admin" });
 /**
 * `custom-model-registry` — collection cap exposing operator-registered
 * custom detection models. Each provider (today: `addon-model-studio`)
@@ -43794,7 +44543,7 @@ var NetworkAccessStatusSchema = object({
 });
 /**
 * Optional, richer endpoint shape returned by providers that expose
-* MORE than one ingress concurrently (Tailscale Ingress with mixed
+* MORE than one ingress concurrently (Tailscale Funnel with mixed
 * serve+funnel rules, future ngrok multi-tunnel, …). Each entry carries
 * the originating provider config (mode + sourcePort) so the
 * orchestrator UI can label rows distinctly. Providers that expose only
@@ -44187,51 +44936,6 @@ method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSche
 	kind: "mutation",
 	auth: "admin"
 });
-new Set([
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-].map((l) => l.id));
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
 var AUDIO_MACRO_LABELS = [
 	{
 		id: "speech",
@@ -46481,7 +47185,20 @@ var NcRuleInputSchema = object({
 	* save by the hub's grouping guard). `.optional()`, never `.default()`: the addon cap
 	* path does not run Zod defaults.
 	*/
-	groupingSec: number().int().min(5).max(60).optional()
+	groupingSec: number().int().min(5).max(60).optional(),
+	/**
+	* ASK ME TO CONFIRM DETECTIONS (#243): a DETECTION notification of this rule
+	* carries "Correct" / "Wrong" buttons (and, where the channel has room, a
+	* "Wrong, it is a <class>" choice). A tap marks the track for retraining, the
+	* same mark the Library writes, and records whose notification it was and
+	* when. A channel with no buttons gets the same two choices as links.
+	*
+	* `.optional()`, never `.default()` (a Zod default does not run on the addon
+	* cap path): absent and `false` both mean off, which is what every rule
+	* authored before this field meant. An editor turns it off by writing
+	* `false`, so it needs no `clear` key.
+	*/
+	askVerdict: boolean().optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -57024,6 +57741,84 @@ var audioMetricsCapability = {
 	*/
 	history: "none"
 };
+method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
+	actionId: string().min(1),
+	variables: record(string(), ActionVariableValueSchema).optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ actionId: string().min(1) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
+* actions — the ONE surface for runnable actions, for the UI and for
+* automations. Provided by the core-blocks builtin on the hub.
+*
+* An action is a LIST ENTRY, not a device (D883): either internal (cap and wait
+* steps, kept in the hub's `actions` record kind) or declared by an addon over
+* `action-source`. `list` asks every `action-source` provider LIVE and overlays
+* the run status from the hub's `runs` ledger; there is no catalog here to
+* drift (D3).
+*
+* **Permissions follow the camera, as linked devices do.** An action is linked
+* to cameras by the operator (`setLinks`, D356: nothing links itself). A
+* non-admin may `get` / `run` an action only through a camera they may see that
+* links it: they name the camera (`deviceId`, a top-level field so the scope
+* gate sees it) and the provider refuses an action that camera does not link.
+* An admin, and an in-process caller (an automation block), may run any action.
+* Every refusal is typed (`[not-linked] …`) and logged.
+*
+* A second `run` of an action that is already running is REFUSED — traced and
+* logged — never queued.
+*/
+var ActionIdInput = object({ actionId: string().min(1) });
+var ActionLinksSchema = object({
+	deviceId: number().int().nonnegative(),
+	actionIds: array(string().min(1)).max(100)
+});
+method(object({}), array(ActionEntrySchema), { auth: "admin" }), method(object({
+	actionId: string().min(1),
+	deviceId: number().int().nonnegative().optional()
+}), object({ action: ActionEntrySchema.nullable() }), {
+	role: "viewer",
+	auth: "protected",
+	kind: "query",
+	caller: "required"
+}), method(object({
+	actionId: string().min(1),
+	variables: record(string(), ActionVariableValueSchema).optional(),
+	wait: boolean().optional(),
+	origin: ActionRunOriginSchema.optional(),
+	deviceId: number().int().nonnegative().optional()
+}), ActionRunResultSchema, {
+	role: "viewer",
+	auth: "protected",
+	kind: "mutation",
+	caller: "required"
+}), method(ActionIdInput, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ActionIdInput, object({ traces: array(AutomationRunTraceSchema) }), { auth: "admin" }), method(object({ action: ActionInputSchema }), object({ action: ActionEntrySchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	actionId: string().min(1),
+	action: ActionInputSchema.partial()
+}), object({ action: ActionEntrySchema }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(ActionIdInput, _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), array(ActionEntrySchema), {
+	role: "viewer",
+	auth: "protected",
+	kind: "query"
+}), method(object({ deviceId: number().int().nonnegative() }), ActionLinksSchema, { auth: "admin" }), method(ActionLinksSchema, ActionLinksSchema, {
+	kind: "mutation",
+	auth: "admin"
+});
 /**
 * Automation-control cap. Models HA `automation.*` entities on
 * `DeviceType.Automation`. An automation is a trigger+condition+
@@ -57201,7 +57996,8 @@ var BATTERY_DEVICE_TYPES = [
 	DeviceType.Switch,
 	DeviceType.PetFeeder,
 	DeviceType.Container,
-	DeviceType.Thermostat
+	DeviceType.Thermostat,
+	DeviceType.EventEmitter
 ];
 /** Generic Customize target for the percentage reading (D936). */
 var batteryCustomize = {
@@ -60069,7 +60865,17 @@ var groupCommandsCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Switch, DeviceType.Light],
+	deviceTypes: [
+		DeviceType.Switch,
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
+	],
 	methods: {},
 	status: {
 		schema: GroupCommandsSchema,
@@ -60087,6 +60893,49 @@ var groupCommandsCapability = {
 	history: "none"
 };
 /**
+* Whether a helper actuator group counts as active (D944): at least one
+* included member is, or every included member is. What "active" means is the
+* type's: a cover is open, a lock is locked, a media player is playing, a
+* climate device is not off. A group of lights, switches and fans reports
+* `switch.on` instead; this cap is for the types whose own state is not a
+* yes/no. Unknown members are left out (`group-status` counts them) and an
+* empty included set takes the device offline, never `active: false`.
+*/
+var GroupActiveSchema = object({
+	active: boolean().meta({ label: "Active" }),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+var groupActiveCapability = {
+	name: "group-active",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Climate,
+		DeviceType.Thermostat
+	],
+	methods: {},
+	status: {
+		schema: GroupActiveSchema,
+		kind: "push"
+	},
+	runtimeState: GroupActiveSchema,
+	/**
+	* Runtime-state durability: **session** — recomputed from the members on the
+	* next source event; a restored value would outlive the members it named.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
+/**
 * How many members of a helper group answered (D944). Counts are integers,
 * not measurements: zero included is a real count, never a stand-in reading.
 * The reading itself stays on the output capability. History is none — the
@@ -60117,7 +60966,14 @@ var groupStatusCapability = {
 	deviceTypes: [
 		DeviceType.Sensor,
 		DeviceType.Switch,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
 	],
 	methods: {},
 	status: {
@@ -61390,7 +62246,14 @@ var lockControlCapability = {
 		}),
 		unlock: method(object({
 			deviceId: number().int().nonnegative(),
-			code: string().min(1).optional()
+			code: string().min(1).optional(),
+			/**
+			* Honoured by a helper lock GROUP only (D944): unlocking several doors
+			* with one call is refused unless the caller says it was confirmed. A
+			* single lock ignores it. The refusal lives in the callee, so no
+			* automation or API caller reaches the doors by skipping a dialog.
+			*/
+			confirm: boolean().optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
@@ -61427,6 +62290,44 @@ var lockControlCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* A monotonic total between resets (D944). Energy uses `power-meter.kwhTotal`
+* so dashboards keep one series; every other instantaneous reading lands here.
+* `value` is the time integral in the source quantity's accumulated base
+* (base-unit seconds, or kWh on the power meter). `null` is a gap, never zero.
+*/
+var MeterStatusSchema = object({
+	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
+	lastFetchedAt: number()
+});
+var meterCapability = {
+	name: "meter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: MeterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: MeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the total is a cache of the
+	* history integral. A restart shows it only until the history pass
+	* recomputes the open period; it is not an in-memory buffer.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	history: { fields: { value: {
+		kind: "counter",
+		deadband: .001,
+		minIntervalMs: 6e4
+	} } },
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
 * Apple TV, Spotify, Roku, generic OTT receivers, …) on
 * `DeviceType.MediaPlayer`. Disjoint from the camera streaming
@@ -63371,10 +64272,20 @@ var PetFeederDeviceStatusSchema = _enum([
 ]);
 var gramsPortion = number().int().min(4).max(200);
 var PetFeederStatusSchema = object({
-	/** Food currently in the bowl (grams). Null when the device has not
-	*  reported a reading yet. On dual-hopper models this is the combined
-	*  bowl reading; per-hopper levels live in `food1`/`food2`. */
+	/** Food in the TANK (hopper), as the feeder's own sensor reports it
+	*  (`state.food`). A coarse level code, not grams — `0` is empty. The
+	*  amount in the bowl is `bowlFood`. On dual-hopper models this is the
+	*  combined reading; per-hopper levels live in `food1`/`food2`. Null when
+	*  the device has not reported yet. */
 	foodLevel: number().nullable().meta(readingMeta("none")),
+	/** Food in the BOWL as the feeder reports it (`state.bowl`), in the
+	*  feeder's own units. Null when the model reports none. */
+	bowlFood: number().nullable().meta(readingMeta("none")),
+	/** True while the pet is eating (`state.eating`). */
+	eating: boolean(),
+	/** Whether `markFoodReplenished` does anything on this model. When false
+	*  the client must not offer it. */
+	supportsMarkRefilled: boolean(),
 	/** Hopper-1 food level (grams) on dual-hopper feeders; null on
 	*  single-hopper models. */
 	food1: number().nullable().meta(readingMeta("none")),
@@ -63382,8 +64293,8 @@ var PetFeederStatusSchema = object({
 	*  single-hopper models. */
 	food2: number().nullable().meta(readingMeta("none")),
 	/** Derived low-food flag — mirrors the HA `food_level` binary_sensor
-	*  (`device_class: problem`, on = low). True when the bowl is empty /
-	*  below the feeder's low threshold. */
+	*  (`device_class: problem`, on = low). True when the tank reports empty,
+	*  or, on a dual-hopper model, when EITHER hopper is empty. */
 	lowFood: boolean(),
 	/** Battery charge 0..100 (%). Null on mains-powered models or when the
 	*  device has no battery reading. */
@@ -63451,7 +64362,9 @@ var petFeederCapability = {
 			kind: "mutation",
 			auth: "protected"
 		}),
-		/** Mark a hopper as refilled (D4H/D4S/D4SH). */
+		/** Tell the PetKit cloud a hopper was refilled so it stops its low-food
+		*  reminders (D4H/D4S/D4SH only — see `supportsMarkRefilled`). It does not
+		*  change any sensor reading. */
 		markFoodReplenished: method(object({ deviceId: number().int().nonnegative() }), _void(), {
 			kind: "mutation",
 			auth: "protected"
@@ -63524,6 +64437,7 @@ var petFeederCapability = {
 	*/
 	history: { fields: {
 		foodLevel: { kind: "gauge" },
+		bowlFood: { kind: "gauge" },
 		food1: { kind: "gauge" },
 		food2: { kind: "gauge" },
 		batteryPower: {
@@ -63938,9 +64852,9 @@ var PowerMeterStatusSchema = object({
 	/** Cumulative energy in kilowatt-hours since the meter was reset. */
 	kwhTotal: number().optional().meta(readingMeta("energy", { label: "Energy" })),
 	/** Voltage in volts. */
-	volts: number().optional().meta(readingMeta("voltage")),
+	volts: number().optional().meta(readingMeta("voltage", { label: "Voltage" })),
 	/** Current in amperes. */
-	amps: number().optional().meta(readingMeta("current")),
+	amps: number().optional().meta(readingMeta("current", { label: "Current" })),
 	/** Apparent power in volt-amperes. */
 	va: number().optional().meta(readingMeta("apparent-power")),
 	/** Power factor (0..1) if reported. */
@@ -63948,12 +64862,74 @@ var PowerMeterStatusSchema = object({
 	/** Ms epoch when the slice was last updated. */
 	lastFetchedAt: number()
 });
+/**
+* Loads that draw metered mains power (D951). The reading is a feature of the
+* device itself — a plug, a lamp, a fan, an air conditioner, a boiler, a
+* vacuum dock — not a separate sensor beside it. A `Sensor` stays: a clamp
+* meter or a standalone energy monitor IS the device. Cover, lock, valve,
+* camera and the like are left out: their draw is not what anyone meters.
+*/
+var POWER_METER_DEVICE_TYPES = [
+	DeviceType.Sensor,
+	DeviceType.Switch,
+	DeviceType.Light,
+	DeviceType.Fan,
+	DeviceType.Climate,
+	DeviceType.Thermostat,
+	DeviceType.Humidifier,
+	DeviceType.WaterHeater,
+	DeviceType.MediaPlayer,
+	DeviceType.Washer,
+	DeviceType.Dryer,
+	DeviceType.Dishwasher,
+	DeviceType.Vacuum,
+	DeviceType.LawnMower,
+	DeviceType.PetFeeder
+];
+/** Everything but a bare `Sensor`: a sensor that takes its reading from another sensor adds nothing. */
+var POWER_METER_CUSTOMIZE_DEVICE_TYPES = POWER_METER_DEVICE_TYPES.filter((type) => type !== DeviceType.Sensor);
+/** One scalar target per reading; each is sourced from a device of its own (D951). */
+function powerTarget(id, unit) {
+	return {
+		id,
+		cardinality: "scalar",
+		vocabulary: {
+			cap: "power-meter",
+			stateField: id
+		},
+		deviceTypes: POWER_METER_CUSTOMIZE_DEVICE_TYPES,
+		apply: "add",
+		path: id,
+		sources: [{
+			kind: "numeric",
+			requiredUnit: unit,
+			transforms: [{ kind: "identity" }]
+		}],
+		companions: [{
+			kind: "clock",
+			path: "lastFetchedAt",
+			when: "always"
+		}],
+		sourceReport: { status: "assignment-status" },
+		advancedExpression: true
+	};
+}
+/** "Power and energy" extension: watts, energy, voltage and current from other devices (D951). */
+var powerMeterCustomize = {
+	version: 1,
+	targets: [
+		powerTarget("watts", "W"),
+		powerTarget("kwhTotal", "kWh"),
+		powerTarget("volts", "V"),
+		powerTarget("amps", "A")
+	]
+};
 var powerMeterCapability = {
 	name: "power-meter",
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
+	deviceTypes: POWER_METER_DEVICE_TYPES,
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -64010,7 +64986,8 @@ var powerMeterCapability = {
 	} },
 	/** Clock fields: written, but excluded from the compare that decides
 	*  whether persisting is worth a SQLite commit. */
-	volatileStateFields: ["lastFetchedAt"]
+	volatileStateFields: ["lastFetchedAt"],
+	customize: powerMeterCustomize
 };
 /**
 * Presence cap. Models HA `person.*` and `device_tracker.*` entities
@@ -64699,6 +65676,8 @@ var runningCustomize = {
 			stateField: "running"
 		},
 		deviceTypes: [
+			DeviceType.Washer,
+			DeviceType.Dryer,
 			DeviceType.Dishwasher,
 			DeviceType.Vacuum,
 			DeviceType.LawnMower,
@@ -67188,7 +68167,8 @@ var switchCapability = {
 	deviceTypes: [
 		DeviceType.Switch,
 		DeviceType.Siren,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan
 	],
 	methods: { setState: method(object({
 		deviceId: number(),
@@ -69432,6 +70412,7 @@ function runningFromDishwasherOperation(operation, program, previous, fetchedAt,
 	if (operation === "Pause") return nativeSlice(false, "Pause", previous, transitionAtMs, fetchedAt, null);
 	return nativeSlice(false, operation, previous, transitionAtMs, fetchedAt, null);
 }
+DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 /**
 * Frozen unit → spec table. `•` in the doc marks each dimension's canonical
 * unit (`factor: 1, offset: 0`). °F derives from `°C = (°F − 32) × 5/9` ⇒
@@ -69816,7 +70797,7 @@ function tryConvertUnit(value, from, to) {
 	return fromCanonical(toCanonical(value, fromSpec), toSpec);
 }
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Camera, DeviceType.Camera, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.EventEmitter, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Switch, DeviceType.Light, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.MediaPlayer, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.PetFeeder, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -70145,6 +71126,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	featureProbe: featureProbeCapability,
 	flood: floodCapability,
 	gas: gasCapability,
+	groupActive: groupActiveCapability,
 	groupCommands: groupCommandsCapability,
 	groupStatus: groupStatusCapability,
 	heatingValve: heatingValveCapability,
@@ -70156,6 +71138,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	lawnMowerControl: lawnMowerControlCapability,
 	lockControl: lockControlCapability,
 	mediaPlayer: mediaPlayerCapability,
+	meter: meterCapability,
 	motion: motionCapability,
 	motionTrigger: motionTriggerCapability,
 	motionZones: motionZonesCapability,
@@ -71415,7 +72398,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -71432,6 +72415,104 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"actions.create": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.delete": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"actions.get": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.getLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.getTraces": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.list": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.listForCamera": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.run": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"actions.setLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.stop": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.update": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.listActions": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actionSource.runAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.stopAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonPages.listPages": {
 		capName: "addon-pages",
 		capScope: "system",
@@ -72713,6 +73794,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getAutomationRunState": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getBlockSettings": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -72734,6 +73822,13 @@ Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getTraces": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -72769,6 +73864,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.reportAutomationRun": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -74638,6 +75740,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"groupActive.getStatus": {
+		capName: "group-active",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"groupCommands.getStatus": {
 		capName: "group-commands",
 		capScope: "device",
@@ -75604,6 +76713,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"meter.getStatus": {
+		capName: "meter",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"metricsProvider.collectSnapshot": {
 		capName: "metrics-provider",
 		capScope: "system",
@@ -83702,7 +84818,39 @@ var APPLIANCE_CAP_VOCABULARY = {
 				phrase: t("When {device} finishes", "Quando {device} finisce"),
 				icon: "square"
 			}
-		}
+		},
+		overrides: { byType: {
+			[DeviceType.Washer]: {
+				state: { running: {
+					whenTrue: t("When the washing machine starts", "Quando la lavatrice inizia"),
+					whenFalse: t("When the washing machine has finished", "Quando la lavatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the washing machine starts", "Quando la lavatrice inizia") },
+					onFinished: { phrase: t("When the washing machine has finished", "Quando la lavatrice ha finito") }
+				}
+			},
+			[DeviceType.Dryer]: {
+				state: { running: {
+					whenTrue: t("When the dryer starts", "Quando l'asciugatrice inizia"),
+					whenFalse: t("When the dryer has finished", "Quando l'asciugatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dryer starts", "Quando l'asciugatrice inizia") },
+					onFinished: { phrase: t("When the dryer has finished", "Quando l'asciugatrice ha finito") }
+				}
+			},
+			[DeviceType.Dishwasher]: {
+				state: { running: {
+					whenTrue: t("When the dishwasher starts", "Quando la lavastoviglie inizia"),
+					whenFalse: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dishwasher starts", "Quando la lavastoviglie inizia") },
+					onFinished: { phrase: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito") }
+				}
+			}
+		} }
 	},
 	update: {
 		scope: "device",
@@ -84474,6 +85622,10 @@ var SENSOR_CAP_VOCABULARY = {
 			icon: "flame"
 		}]
 	},
+	"group-active": {
+		scope: "device",
+		noun: t("Group state", "Stato del gruppo")
+	},
 	"group-commands": {
 		scope: "device",
 		noun: t("Group command", "Comando di gruppo")
@@ -84530,6 +85682,17 @@ var SENSOR_CAP_VOCABULARY = {
 		}],
 		events: { onMotionChanged: { notOperatorFacing: "the `detected` state trigger phrases both edges, from the mirror that survives a dropped event (D49)" } }
 	},
+	meter: {
+		scope: "device",
+		noun: t("Meter", "Contatore"),
+		state: [{
+			kind: "numeric",
+			field: "value",
+			quantity: t("the total", "il totale"),
+			label: t("Total", "Totale"),
+			icon: "gauge"
+		}]
+	},
 	"numeric-sensor": {
 		scope: "device",
 		noun: t("Sensor", "Sensore"),
@@ -84862,6 +86025,8 @@ var ML = "model and training machinery — no device action";
 var INTERNAL = "internal plumbing between addons — never operator-facing";
 /** Every system-scoped cap, with why it is not a device's vocabulary. */
 var SYSTEM_CAP_VOCABULARY = {
+	"action-source": system(INTERNAL),
+	actions: system("declared actions — run from the Actions page and from the cameras that link them"),
 	"addon-pages": system(UI_PLUMBING),
 	"addon-pages-source": system(UI_PLUMBING),
 	"addon-routes": system(UI_PLUMBING),
@@ -85002,8 +86167,47 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+var HA_AS = "a power sensor (device_class power). Home Assistant has no laundry domain. running-state stays unexported until a null reading can be published as unavailable.";
+var HOMEKIT_REASON = "HomeKit has no laundry-appliance service. The export tab would pair an accessory with nothing on it: running-state is withheld until a null reading can be unavailable, and power is not a HomeKit service this export honours.";
+var ALEXA_REASON = "Alexa has no laundry category in this export, and neither power nor running has an Alexa interface.";
+var GOOGLE_REASON = "Google WASHER, DRYER and DISHWASHER require RunCycle. A power threshold is not that trait, and this export does not publish RunCycle.";
+var MATTER_REASON = "No Matter export is built. The closest device types are Laundry Washer (0x0073) and Laundry Dryer (0x0074); a power threshold is not the Laundry Washer Mode cluster.";
+function withheld(reason) {
+	return {
+		[DeviceType.Washer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dryer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dishwasher]: {
+			exported: false,
+			reason
+		}
+	};
+}
+function offered(received) {
+	return {
+		[DeviceType.Washer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dryer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dishwasher]: {
+			exported: true,
+			as: received
+		}
+	};
+}
+offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -85019,6 +86223,31 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"actions.get": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.getLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.listForCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.setLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"addonSettings.getDeviceSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -85970,6 +87199,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"groupActive.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"groupCommands.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -86180,6 +87414,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"meter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motion.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -87787,7 +89026,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-DeviceType.Camera;
 /**
 * A saved Customize assignment (D936). The schema is the type: callers use
 * `z.infer`, they do not restate the shape.
@@ -89181,6 +90419,448 @@ function ingestReading(input) {
 		value: converted
 	};
 }
+/**
+* Where an OAuth round-trip ends: the admin-ui completion route
+* (`/sso-complete`, the page every popup sign-in already lands on), with the
+* OUTCOME in the URL fragment.
+*
+* The outcome is a status plus a reason CODE from a closed list. It never
+* carries a token, a code, a client secret or a free-form error message: the
+* page words each code itself, and an unknown code reads as `unknown` rather
+* than being echoed. Fragment only, so nothing here reaches a server log.
+*
+* Pure and browser-safe.
+*/
+/** The admin-ui route the hub's OAuth completions land on (relative to its mount). */
+var OAUTH_LANDING_PATH = "/sso-complete";
+/**
+* The landing URL for `outcome`. `origin` is the hub address the flow already
+* runs on (from the `local-network` palette role, never a literal); `null`
+* gives a hub-relative URL.
+*/
+function oauthLandingUrl(origin, outcome) {
+	const params = new URLSearchParams({
+		return: "oauth",
+		status: outcome.status
+	});
+	if (outcome.addonId !== void 0) params.set("addon", outcome.addonId);
+	if (outcome.brokerId !== void 0) params.set("broker", outcome.brokerId);
+	if (outcome.integration !== void 0) params.set("integration", outcome.integration);
+	if (outcome.status === "error") params.set("reason", outcome.reason ?? "unknown");
+	if (outcome.action === "disconnect") params.set("action", "disconnect");
+	return `${origin === null ? "" : origin.replace(/\/+$/, "")}${OAUTH_LANDING_PATH}#${params.toString()}`;
+}
+var LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+function hostWithoutPort(host) {
+	if (host.startsWith("[")) return host.slice(0, host.indexOf("]") + 1);
+	const colon = host.indexOf(":");
+	return colon === -1 ? host : host.slice(0, colon);
+}
+function isLoopbackHost(host) {
+	return LOOPBACK_HOSTS.has(hostWithoutPort(host.toLowerCase()));
+}
+/** An allow-list entry is valid when it is a bare host[:port] and `http` only targets loopback. */
+function isValidUpstream(upstream) {
+	if (upstream.host.length === 0 || !/^[a-z0-9.[\]:-]+$/.test(upstream.host)) return false;
+	return upstream.scheme === "https" || isLoopbackHost(upstream.host);
+}
+function findUpstream(route, host) {
+	const wanted = host.toLowerCase();
+	return route.upstreams.find((upstream) => upstream.host === wanted);
+}
+/** `<basePath>/<host><pathname><search>` — what the browser is sent to. */
+function proxyPathFor(route, host, pathname, search = "") {
+	return `${route.basePath}/${host}${pathname.startsWith("/") ? pathname : `/${pathname}`}${search}`;
+}
+/** Split `/<attemptId>/<host>/<rest…>[?query]` (the data-plane view of a request). */
+function parseProxyPath(rawUrl) {
+	const queryAt = rawUrl.indexOf("?");
+	const path = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+	const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+	const match = /^\/([A-Za-z0-9_-]{8,128})\/([^/]+)(\/.*)?$/.exec(path);
+	if (match === null) return null;
+	const attemptId = match[1];
+	const host = match[2];
+	if (attemptId === void 0 || host === void 0) return null;
+	return {
+		attemptId,
+		host: host.toLowerCase(),
+		pathname: match[3] ?? "/",
+		search
+	};
+}
+/** The vendor URL a proxied request targets, or null when the host would not stay `host`. */
+function upstreamUrlFor(upstream, parsed) {
+	try {
+		const url = new URL(`${upstream.scheme}://${upstream.host}${parsed.pathname}${parsed.search}`);
+		return url.host.toLowerCase() === upstream.host ? url : null;
+	} catch {
+		return null;
+	}
+}
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** A Location (or any URL value) to a vendor host becomes a proxy path; anything else is unchanged. */
+function rewriteLocation(location, currentUpstream, route) {
+	let resolved;
+	try {
+		resolved = new URL(location, `${currentUpstream.scheme}://${currentUpstream.host}/`);
+	} catch {
+		return location;
+	}
+	if (resolved.protocol !== "https:" && resolved.protocol !== "http:") return location;
+	const target = findUpstream(route, resolved.host);
+	if (target === void 0) return location;
+	return `${proxyPathFor(route, target.host, resolved.pathname, resolved.search)}${resolved.hash}`;
+}
+/** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
+var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
+/**
+* Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
+* (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
+* HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
+* escape the proxy mount and land on the hub.
+*/
+function rewriteBody(body, kind, currentUpstream, route) {
+	let out = body;
+	for (const upstream of route.upstreams) {
+		const host = escapeRegex(upstream.host);
+		const plain = new RegExp(`${VALUE_START}(?:https?:)?//${host}(?=[/"'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(plain, `${route.basePath}/${upstream.host}`);
+		const escapedBase = `${route.basePath}/${upstream.host}`.replace(/\//g, "\\/");
+		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(escaped, escapedBase);
+	}
+	const current = `${route.basePath}/${currentUpstream.host}/`;
+	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
+	if (kind === "html") {
+		const attribute = String.raw`(\b(?:href|src|action|formaction|poster|data-href|data-src)\s*=\s*["'])/`;
+		out = out.replace(new RegExp(`${attribute}${notMounted}`, "gi"), `$1${current}`);
+	}
+	if (kind === "html" || kind === "css") {
+		const cssUrl = String.raw`(url\(\s*["']?)/`;
+		out = out.replace(new RegExp(`${cssUrl}${notMounted}`, "gi"), `$1${current}`);
+	}
+	return out;
+}
+/**
+* A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
+* origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+*/
+function rewriteSetCookie(cookie, route) {
+	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+		if (index === 0) return true;
+		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
+		return name !== "domain" && name !== "path";
+	});
+	kept.push(`Path=${route.basePath}/`);
+	return kept.join("; ");
+}
+/**
+* A browser `Referer` that points into this proxy, turned back into the vendor URL it
+* stands for. A Referer that is not ours is dropped (null): it names the hub.
+*/
+function rewriteReferer(referer, route) {
+	let url;
+	try {
+		url = new URL(referer, "http://hub.invalid");
+	} catch {
+		return null;
+	}
+	if (!url.pathname.startsWith(`${route.basePath}/`)) return null;
+	const rest = /^\/([^/]+)(\/.*)?$/.exec(url.pathname.slice(route.basePath.length));
+	const host = rest?.[1]?.toLowerCase();
+	if (host === void 0) return null;
+	const upstream = findUpstream(route, host);
+	if (upstream === void 0) return null;
+	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
+}
+/** Cookies the browser holds for the hub itself must never reach a vendor. */
+function filterForwardedCookies(cookieHeader) {
+	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
+}
+var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
+/** Request headers that are never forwarded to the vendor. */
+var DROP_REQUEST_HEADERS = new Set([
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"accept-encoding",
+	"authorization",
+	"cookie",
+	"origin",
+	"referer",
+	"x-camstack-dataplane-secret",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-forwarded-prefix",
+	"x-real-ip",
+	"forwarded"
+]);
+/**
+* Response headers dropped: framing/CSP/HSTS that break a page under another origin, and
+* the ones that no longer describe the (decoded, possibly rewritten) body.
+*/
+var DROP_RESPONSE_HEADERS = new Set([
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"x-frame-options",
+	"strict-transport-security",
+	"public-key-pins",
+	"report-to",
+	"nel",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive",
+	"set-cookie",
+	"location"
+]);
+function bodyKindOf(contentType) {
+	const type = contentType.toLowerCase();
+	if (type.includes("text/html") || type.includes("application/xhtml")) return "html";
+	if (type.includes("text/css")) return "css";
+	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
+	return null;
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readRequestBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+		size += buf.length;
+		if (size > MAX_REQUEST_BODY_BYTES) return "too-large";
+		chunks.push(buf);
+	}
+	return Buffer.concat(chunks);
+}
+function sendPlain(res, status, text) {
+	res.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(text);
+}
+var VendorLoginProxy = class {
+	#addonId;
+	#prefix;
+	#logger;
+	#now;
+	#fetch;
+	#attempts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#addonId = options.addonId;
+		this.#prefix = options.prefix;
+		this.#logger = options.logger;
+		this.#now = options.now ?? (() => Date.now());
+		this.#fetch = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+	}
+	/** The `DataPlaneHandler` to pass to `ctx.dataPlane.serve({ prefix, access: 'admin', … })`. */
+	handler = (req, res) => this.#handle(req, res);
+	/** Register an attempt. A one-shot capability: refused hosts are rejected up front. */
+	open(spec) {
+		for (const upstream of spec.upstreams) if (!isValidUpstream(upstream)) throw new Error(`vendor login proxy: upstream ${upstream.host} is not allowed`);
+		this.#attempts.set(spec.attemptId, {
+			expiresAtMs: spec.expiresAtMs,
+			upstreams: spec.upstreams,
+			evaluate: async (view) => {
+				const verdict = await spec.terminal(view);
+				if (verdict.kind === "continue") return verdict;
+				return {
+					kind: "done",
+					landing: await spec.onDone(verdict.payload)
+				};
+			}
+		});
+	}
+	close(attemptId) {
+		this.#attempts.delete(attemptId);
+	}
+	isOpen(attemptId) {
+		const attempt = this.#attempts.get(attemptId);
+		return attempt !== void 0 && this.#now() <= attempt.expiresAtMs;
+	}
+	/**
+	* The hub-relative path that opens `vendorUrl` through the proxy for this attempt:
+	* the URL the browser is sent to. Null when the host is not in the attempt's list.
+	*/
+	entryPath(attemptId, vendorUrl) {
+		const attempt = this.#attempts.get(attemptId);
+		if (attempt === void 0) return null;
+		const url = new URL(vendorUrl);
+		if (findUpstream({
+			basePath: "",
+			upstreams: attempt.upstreams
+		}, url.host) === void 0) return null;
+		return `/addon/${this.#addonId}/${this.#prefix}/${attemptId}/${url.host}${url.pathname}${url.search}`;
+	}
+	#routeFor(attemptId, attempt, forwardedPrefix) {
+		return {
+			basePath: `${forwardedPrefix}/addon/${this.#addonId}/${this.#prefix}/${attemptId}`,
+			upstreams: attempt.upstreams
+		};
+	}
+	async #handle(req, res) {
+		try {
+			await this.#serve(req, res);
+		} catch (err) {
+			this.#logger.warn("vendor login proxy: request failed", { meta: {
+				addonId: this.#addonId,
+				error: err instanceof Error ? err.name : "unknown"
+			} });
+			if (!res.headersSent) sendPlain(res, 502, "The sign-in page could not be reached.");
+			else res.end();
+		}
+	}
+	async #serve(req, res) {
+		const parsed = parseProxyPath(req.url ?? "/");
+		if (parsed === null) {
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
+		const attempt = this.#attempts.get(parsed.attemptId);
+		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
+			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: attempt refused", { meta: {
+				addonId: this.#addonId,
+				reason: attempt === void 0 ? "missing" : "expired"
+			} });
+			this.#redirect(res, forwardedPrefix, {
+				status: "error",
+				addonId: this.#addonId,
+				reason: "invalid_state"
+			});
+			return;
+		}
+		const route = this.#routeFor(parsed.attemptId, attempt, forwardedPrefix);
+		const upstream = findUpstream(route, parsed.host);
+		const target = upstream === void 0 ? null : upstreamUrlFor(upstream, parsed);
+		if (upstream === void 0 || target === null) {
+			this.#logger.warn("vendor login proxy: host refused", { meta: {
+				addonId: this.#addonId,
+				host: parsed.host
+			} });
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		let body;
+		if (method !== "GET" && method !== "HEAD") {
+			const read = await readRequestBody(req);
+			if (read === "too-large") {
+				sendPlain(res, 413, "Request too large");
+				return;
+			}
+			body = read;
+		}
+		const headers = this.#requestHeaders(req, route, upstream);
+		const upstreamRes = await this.#fetch(target, {
+			method,
+			headers,
+			redirect: "manual",
+			...body !== void 0 && body.length > 0 ? { body: new Uint8Array(body) } : {}
+		});
+		const location = upstreamRes.headers.get("location");
+		const setCookies = upstreamRes.headers.getSetCookie();
+		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
+		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
+		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
+		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+			addonId: this.#addonId,
+			host: upstream.host,
+			status: upstreamRes.status,
+			method
+		} });
+		const settled = await attempt.evaluate({
+			status: upstreamRes.status,
+			url: target.toString(),
+			location,
+			setCookies,
+			bodyText: text
+		});
+		if (settled.kind === "done") {
+			this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
+				addonId: this.#addonId,
+				status: settled.landing.status
+			} });
+			this.#redirect(res, forwardedPrefix, settled.landing);
+			return;
+		}
+		const out = {};
+		upstreamRes.headers.forEach((value, name) => {
+			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
+		});
+		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
+		out["cache-control"] = "no-store";
+		if (text !== null && kind !== null) {
+			const rewritten = rewriteBody(text, kind, upstream, route);
+			res.writeHead(upstreamRes.status, out);
+			res.end(rewritten);
+			return;
+		}
+		res.writeHead(upstreamRes.status, out);
+		await this.#pipeBody(upstreamRes, res);
+	}
+	#requestHeaders(req, route, upstream) {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			const lower = name.toLowerCase();
+			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
+			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
+		}
+		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
+		if (cookie.length > 0) headers["cookie"] = cookie;
+		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
+		const referer = firstHeader(req.headers["referer"]);
+		if (referer !== void 0) {
+			const back = rewriteReferer(referer, route);
+			if (back !== null) headers["referer"] = back;
+		}
+		return headers;
+	}
+	async #pipeBody(upstreamRes, res) {
+		if (upstreamRes.body === null) {
+			res.end();
+			return;
+		}
+		for await (const chunk of upstreamRes.body) {
+			if (!res.write(chunk)) await new Promise((resolve) => {
+				res.once("drain", resolve);
+				res.once("close", resolve);
+			});
+			if (res.destroyed) return;
+		}
+		res.end();
+	}
+	#redirect(res, forwardedPrefix, outcome) {
+		res.writeHead(302, {
+			location: `${forwardedPrefix}${oauthLandingUrl(null, outcome)}`,
+			"cache-control": "no-store"
+		});
+		res.end();
+	}
+};
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
@@ -89226,6 +90906,12 @@ Object.defineProperty(exports, "RUNNING_STATE_COLD", {
 		return RUNNING_STATE_COLD;
 	}
 });
+Object.defineProperty(exports, "VendorLoginProxy", {
+	enumerable: true,
+	get: function() {
+		return VendorLoginProxy;
+	}
+});
 Object.defineProperty(exports, "_enum", {
 	enumerable: true,
 	get: function() {
@@ -89250,6 +90936,12 @@ Object.defineProperty(exports, "binaryCapability", {
 		return binaryCapability;
 	}
 });
+Object.defineProperty(exports, "boolean", {
+	enumerable: true,
+	get: function() {
+		return boolean;
+	}
+});
 Object.defineProperty(exports, "climateControlCapability", {
 	enumerable: true,
 	get: function() {