@camstack/types 1.2.429 → 1.2.430

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-hRhTSDlN.js");
-const require_event_category = require("./event-category-Ave2VSxY.js");
+const require_sleep = require("./sleep-5zRztaHa.js");
+const require_event_category = require("./event-category-BhzwWQCH.js");
 const require_composition = require("./composition-CpAc0YfQ.js");
 const require_node_color = require("./node-color.js");
 const require_err_msg = require("./err-msg-U7lLUMNz.js");
@@ -8074,7 +8074,7 @@ var ExpressionSourceSchema = zod.z.object({
 *
 * Three vocabularies, each salvaged rather than invented:
 *
-*  - **Triggers** — the only genuinely new surface. Four members, none of which
+*  - **Triggers** — the only genuinely new surface. Six members, none of which
 *    touches notification delivery. The NC keeps its four *pipeline* triggers;
 *    these are device/time triggers and the two sets do not overlap.
 *  - **Conditions** — `ALL`/`ANY`/`NOT` over two leaf kinds, bounded. The
@@ -8198,7 +8198,23 @@ var AutomationTriggerSchema = zod.z.discriminatedUnion("kind", [
 		kind: zod.z.literal("schedule"),
 		cron: zod.z.string().min(1).max(120)
 	}),
-	zod.z.object({ kind: zod.z.literal("manual") })
+	zod.z.object({ kind: zod.z.literal("manual") }),
+	zod.z.object({
+		kind: zod.z.literal("detection"),
+		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
+		*  matches every raw class that maps to it; any other name matches
+		*  exactly. */
+		classes: zod.z.array(zod.z.string().min(1)).min(1),
+		deviceIds: zod.z.array(zod.z.number().int().nonnegative()).min(1),
+		/** The track must have visited at least one of these zones. */
+		zones: zod.z.array(zod.z.string().min(1)).min(1).optional(),
+		/** Best-so-far confidence the track must reach. */
+		minScore: zod.z.number().min(0).max(1).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("interval"),
+		minutes: zod.z.number().int().min(1).max(1440)
+	})
 ]);
 /**
 * One action step.
@@ -8218,28 +8234,47 @@ var AutomationTriggerSchema = zod.z.discriminatedUnion("kind", [
 * is called. The runner still receives a number and is untouched; the
 * resolution is the recipe's job, not the runner's.
 */
+var AutomationWaitStepSchema = zod.z.object({
+	kind: zod.z.literal("wait"),
+	seconds: zod.z.number().min(0).max(300)
+});
+var AutomationCapStepSchema = zod.z.object({
+	kind: zod.z.literal("cap"),
+	/**
+	* One device, several same-family devices (locks / climate family / …),
+	* or `{ $var }` for the device that triggered the run. An array is
+	* fan-out at codegen — each id gets the same cap.method call.
+	*/
+	deviceId: zod.z.union([
+		zod.z.number().int(),
+		zod.z.array(zod.z.number().int()).min(1),
+		zod.z.object({ $var: zod.z.string().min(1) })
+	]),
+	cap: zod.z.string().min(1),
+	method: zod.z.string().min(1),
+	/** Values may carry `{{vars.x}}` slots, or be exactly `{ $var: 'name' }`, which
+	*  SUBSTITUTE and do not evaluate (§3.2.3). Anything beyond substitution is
+	*  the expression leaf. */
+	args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/**
+* The steps an internal Action may contain: cap and wait, and nothing that can
+* call back into an Action — so an Action can never reach itself (no cycles).
+*/
+var ActionStepSchema = zod.z.discriminatedUnion("kind", [AutomationWaitStepSchema, AutomationCapStepSchema]);
 var AutomationActionSchema = zod.z.discriminatedUnion("kind", [
+	AutomationWaitStepSchema,
+	AutomationCapStepSchema,
 	zod.z.object({
-		kind: zod.z.literal("wait"),
-		seconds: zod.z.number().min(0).max(300)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("cap"),
-		/**
-		* One device, several same-family devices (locks / climate family / …),
-		* or `{ $var }` for the device that triggered the run. An array is
-		* fan-out at codegen — each id gets the same cap.method call.
-		*/
-		deviceId: zod.z.union([
-			zod.z.number().int(),
-			zod.z.array(zod.z.number().int()).min(1),
-			zod.z.object({ $var: zod.z.string().min(1) })
-		]),
-		cap: zod.z.string().min(1),
-		method: zod.z.string().min(1),
-		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
-		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
-		args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		kind: zod.z.literal("action"),
+		/** An entry of the `actions` surface (`internal:<uuid>` or `<addonId>:<localId>`). */
+		actionId: zod.z.string().min(1),
+		/** Values for the action's declared variables; the others take their default. */
+		variables: zod.z.record(zod.z.string(), zod.z.union([
+			zod.z.string(),
+			zod.z.number(),
+			zod.z.boolean()
+		])).optional()
 	}),
 	zod.z.object({
 		kind: zod.z.literal("code"),
@@ -8248,10 +8283,45 @@ var AutomationActionSchema = zod.z.discriminatedUnion("kind", [
 		code: zod.z.string().min(1).max(2e4)
 	})
 ]);
+/**
+* How a trigger that arrives while the automation is busy (or cooling down) is
+* handled. One of the automation's execution modes, never a property of its
+* actions. Absent means `single`.
+*
+*  - `single`   — drop the trigger while a run is in progress (traced + logged).
+*  - `restart`  — abort the run in progress (at its next step boundary), start fresh.
+*  - `queued`   — queue up to `max` triggers, drop the rest (traced).
+*  - `parallel` — up to `max` runs at once, drop the rest (traced).
+*  - `cooldown` — `single`, and no new run until `minutes` after the last run
+*    STARTED; persisted across a restart. A manual trigger bypasses only this
+*    wait, never the single/queued limits.
+*/
+var AutomationRunModeSchema = zod.z.discriminatedUnion("mode", [
+	zod.z.object({ mode: zod.z.literal("single") }),
+	zod.z.object({ mode: zod.z.literal("restart") }),
+	zod.z.object({
+		mode: zod.z.literal("queued"),
+		max: zod.z.number().int().min(1).max(10)
+	}),
+	zod.z.object({
+		mode: zod.z.literal("parallel"),
+		max: zod.z.number().int().min(1).max(10)
+	}),
+	zod.z.object({
+		mode: zod.z.literal("cooldown"),
+		minutes: zod.z.number().int().min(1).max(1440)
+	})
+]);
+/** Run traces kept per automation when the recipe does not say. */
+var DEFAULT_TRACE_KEEP = 20;
+var MAX_TRACE_KEEP = 100;
 var AutomationRecipeSchema = zod.z.object({
 	triggers: zod.z.array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
-	actions: zod.z.array(AutomationActionSchema)
+	actions: zod.z.array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
+	keepTraces: zod.z.number().int().min(1).max(100).optional()
 });
 /** Depth of a tree, root container = 1. A bare leaf is depth 1. */
 function conditionDepth(cond) {
@@ -8303,19 +8373,23 @@ function validateRecipeBounds(recipe) {
 /** How often the state mirror is re-read as the backstop for a dropped event
 *  (D8: an event WAKES the evaluation, the reconcile guarantees it). */
 var RECONCILE_MS = 15e3;
+/** What a step trace shows before the step runs. */
+function stepMetaOf(action) {
+	switch (action.kind) {
+		case "wait": return { kind: "wait" };
+		case "code": return { kind: "code" };
+		case "action": return { kind: "action" };
+		case "cap": return {
+			kind: "cap",
+			cap: action.cap,
+			method: action.method,
+			...typeof action.deviceId === "number" ? { deviceId: action.deviceId } : {}
+		};
+	}
+}
 function j(value) {
 	return JSON.stringify(value);
 }
-/** Emit the boolean tree as calls into the generated combinators. */
-function emitCondition(cond, indent) {
-	switch (cond.kind) {
-		case "all": return `allOf([\n${cond.children.map((c) => `${indent}  () => ${emitCondition(c, `${indent}  `)}`).join(",\n")}\n${indent}])`;
-		case "any": return `anyOf([\n${cond.children.map((c) => `${indent}  () => ${emitCondition(c, `${indent}  `)}`).join(",\n")}\n${indent}])`;
-		case "not": return `notOf(() => ${emitCondition(cond.child, indent)})`;
-		case "condition": return `leaf(${j(cond.deviceId)}, ${j(cond.cap)}, ${j(cond.fieldPath)}, ${j(cond.operator)}, ${j(cond.value)})`;
-		case "expression": return `exprLeaf(${j(cond.expr)}, ${j(cond.bindings)})`;
-	}
-}
 function emitTrigger(trigger, index) {
 	switch (trigger.kind) {
 		case "schedule": return `  // trigger ${index}: schedule — armed to the next minute boundary and
@@ -8391,31 +8465,79 @@ function emitTrigger(trigger, index) {
   }`;
 		}
 		case "manual": return `  // trigger ${index}: manual — fired by automation-control.trigger
-  // ("Run actions"), which runs the THEN half with an EMPTY vars bag.`;
+  // ("Run actions"), which runs the THEN half with an EMPTY vars bag. A manual
+  // run bypasses only the cooldown wait, never the single/queued limits.`;
+		case "interval": return `  // trigger ${index}: interval — every ${trigger.minutes} min, first run jittered so
+  // blocks restarted together do not all fire on the same second.
+  {
+    let interval: ReturnType<typeof setInterval> | undefined
+    const first = setTimeout(() => {
+      void run({ kind: 'interval', at: Date.now() })
+      interval = setInterval(() => { void run({ kind: 'interval', at: Date.now() }) }, ${j(trigger.minutes * 6e4)})
+    }, Math.floor(Math.random() * Math.min(${j(trigger.minutes * 6e4)}, 30_000)) + 1)
+    disposers.push(() => {
+      clearTimeout(first)
+      if (interval !== undefined) clearInterval(interval)
+    })
+  }`;
+		case "detection": return `  // trigger ${index}: detection — ONE fire per (device, track); a rejected event is
+  // traced with its reason and never fires.
+  {
+    const filter = new DetectionTriggerFilter(${j(trigger)})
+    disposers.push(
+      ctx.eventBus.subscribe(
+        { category: EventCategory.PipelineAnalyticsTrackLifecycle },
+        (event) => {
+          const decision = filter.evaluate(event.data, Date.now())
+          if (decision.kind === 'ignore') return
+          if (decision.kind === 'reject') {
+            ctx.logger.debug('detection trigger rejected an event', {
+              tags: { deviceId: decision.vars.deviceId },
+              reason: decision.reason,
+            })
+          }
+          void run(
+            { kind: 'detection', at: Date.now(), ...decision.vars },
+            decision.reason,
+            decision.kind === 'fire',
+          )
+        },
+      ),
+    )
+  }`;
 	}
 }
 function emitAction(action, index) {
+	const step = (body) => `    {
+      meta: STEP_META[${index}]!,
+      run: async (scope) => {
+${body}
+      },
+    },`;
 	switch (action.kind) {
-		case "wait": return `      case ${index}: await sleep(${j(action.seconds * 1e3)}); break`;
+		case "wait": return step(`        await sleep(${j(action.seconds * 1e3)})`);
 		case "cap":
-			if (Array.isArray(action.deviceId)) return `      case ${index}: {
-        for (const deviceId of ${j(action.deviceId)}) {
+			if (Array.isArray(action.deviceId)) return step(`        for (const deviceId of ${j(action.deviceId)}) {
+          scope.setDeviceId(deviceId)
           await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)
-        }
-        break
-      }`;
-			return `      case ${index}: {
-        const deviceId = ${typeof action.deviceId === "number" ? j(action.deviceId) : `resolveTarget(vars, ${j(action.deviceId.$var)})`}
-        await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)
-        break
-      }`;
-		case "code": return `      case ${index}: {
-        // inline code action — a fragment of THIS block, bundled by esbuild
+        }`);
+			return step(`        const deviceId = ${typeof action.deviceId === "number" ? j(action.deviceId) : `resolveTarget(vars, ${j(action.deviceId.$var)})`}
+        scope.setDeviceId(deviceId)
+        await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)`);
+		case "action": return step(`        // an Action run, awaited: the step takes THAT run's outcome
+        const result = await ctx.api.actions.run.mutate({
+          actionId: ${j(action.actionId)},
+          variables: substituteVariables(${j(action.variables ?? {})}, vars),
+          wait: true,
+          origin: { blockId: BLOCK_ID ?? undefined },
+        })
+        if (result.outcome !== 'ran') {
+          throw new Error('action ' + ${j(action.actionId)} + ' ' + result.outcome + (result.message === undefined ? '' : ': ' + result.message))
+        }`);
+		case "code": return step(`        // inline code action — a fragment of THIS block, bundled by esbuild
         await (async () => {
 ${action.code.split("\n").map((line) => `          ${line}`).join("\n")}
-        })()
-        break
-      }`;
+        })()`);
 	}
 }
 /**
@@ -8429,9 +8551,31 @@ function generateAutomationBlock(input) {
 	const boundsError = validateRecipeBounds(input.recipe);
 	if (boundsError !== null) throw new Error(`cannot generate an automation from an invalid recipe: ${boundsError}`);
 	const { name, recipe } = input;
-	const conditionExpr = recipe.conditions === void 0 ? "true" : `await ${emitCondition(recipe.conditions, "    ")}`;
-	return `import type { AddonContext } from '@camstack/types'
-import { evaluateExpressionSource, toExpressionValue } from '@camstack/types'
+	const runMode = recipe.runMode ?? { mode: "single" };
+	const stepMeta = recipe.actions.map(stepMetaOf);
+	return `import type {
+  AddonContext,
+  AutomationConditionTraceNode,
+  AutomationRunTrace,
+  AutomationRunVerdict,
+  AutomationStepTrace,
+  RunnableStep,
+} from '@camstack/types'
+import {
+  ConditionMirror,
+  DetectionTriggerFilter,
+  EventCategory,
+  RunGate,
+  buildTriggerTrace,
+  collectMirrorSources,
+  coreBlockIdFromAddonId,
+  evaluateConditionTree,
+  isSkippedTrace,
+  mergeSkipTraces,
+  resolveDeviceTarget,
+  resolveStepArgs,
+  runSteps,
+} from '@camstack/types'
 
 /**
  * ${name}
@@ -8446,6 +8590,20 @@ const AUTOMATION_RECIPE = ${JSON.stringify(recipe, null, 2)} as const
 
 const RECONCILE_MS = ${RECONCILE_MS}
 
+/** How triggers that arrive while busy (or cooling down) are handled. */
+const RUN_MODE = ${j(runMode)} as const
+
+/** Run traces kept (a ring, held in the hub's runs ledger). */
+const KEEP_TRACES = ${recipe.keepTraces ?? 20}
+
+const CONDITIONS = ${recipe.conditions === void 0 ? "undefined" : "AUTOMATION_RECIPE.conditions"}
+
+/** Skips that repeat are folded into one trace; it goes to the hub after this. */
+const SKIP_FLUSH_MS = 5_000
+
+/** Static facts about each action step, for its trace. */
+const STEP_META: ReadonlyArray<{ kind: string; cap?: string; method?: string; deviceId?: number }> = ${j(stepMeta)}
+
 /** A cap is named \`alarm-panel\`; \`ctx.api\` is keyed by the ROUTER name,
  *  \`alarmPanel\`. Indexing ctx.api with the cap name yields undefined and every
  *  action throws, so the conversion is not cosmetic. */
@@ -8496,137 +8654,170 @@ function matchField(field: string, value: number): boolean {
 
 export default function block(ctx: AddonContext) {
   const disposers: Array<() => void> = []
-  const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms))
+  const gate = new RunGate(RUN_MODE)
+  const mirror = new ConditionMirror(collectMirrorSources(CONDITIONS))
+  const BLOCK_ID = coreBlockIdFromAddonId(ctx.id)
+  /** The cooldown stamp: memory is the authority at fire time (D49); the hub ledger is read once at start. */
+  let lastRunStartedAt: number | null = null
+  /** True when the stamp could not be read at start — the first run is let through and says so. */
+  let stampUnknown = false
+  let sendChain: Promise<void> = Promise.resolve()
+  let pendingSkip: AutomationRunTrace | undefined
+  let skipTimer: ReturnType<typeof setTimeout> | undefined
+  let stopped = false
+  let runCounter = 0
+  const runningTokens = new Set<RunToken>()
+  const queue: QueuedRun[] = []
 
-  /** Read one cap field off the state mirror. Returns undefined when the device,
-   *  the cap or the field cannot be resolved — the caller decides what that
-   *  means, and it always logs. */
-  async function readField(
-    deviceId: number,
-    cap: string,
-    fieldPath: string,
-  ): Promise<unknown> {
-    try {
-      const slice = await ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap })
-      let cursor: unknown = slice
-      for (const part of fieldPath.split('.')) {
-        if (cursor === null || typeof cursor !== 'object') return undefined
-        cursor = (cursor as Record<string, unknown>)[part]
+  interface RunToken {
+    aborted: boolean
+    wake?: () => void
+  }
+  interface QueuedRun {
+    readonly trigger: Record<string, unknown>
+    readonly reason: string
+    readonly queuedAt: number
+  }
+
+  /** Sleep that a restart can cut short. */
+  const abortableSleep = (ms: number, token: RunToken): Promise<void> =>
+    new Promise((resolve) => {
+      const timer = setTimeout(resolve, ms)
+      token.wake = () => {
+        clearTimeout(timer)
+        resolve()
       }
-      return cursor
-    } catch {
-      return undefined
+    })
+
+  // ── the hub's runs ledger: the stamp is read ONCE here, the ring is written through RPC ──
+  async function loadState(): Promise<void> {
+    if (BLOCK_ID === null) {
+      ctx.logger.warn('this is not a core-block addon id — no run ledger, cooldown and traces will not survive a restart', { addonId: ctx.id })
+      return
+    }
+    try {
+      const doc = await ctx.api.coreBlocks.getAutomationRunState.query({ blockId: BLOCK_ID })
+      lastRunStartedAt = doc.lastRunStartedAt
+    } catch (err: unknown) {
+      stampUnknown = true
+      ctx.logger.warn('could not read the stored cooldown stamp — the first run is let through', {
+        blockId: BLOCK_ID,
+        error: err instanceof Error ? err.message : String(err),
+      })
     }
   }
 
-  function compare(actual: unknown, operator: string, expected: unknown): boolean {
-    switch (operator) {
-      case 'eq': return actual === expected
-      case 'ne': return actual !== expected
-      case 'gt': return typeof actual === 'number' && typeof expected === 'number' && actual > expected
-      case 'gte': return typeof actual === 'number' && typeof expected === 'number' && actual >= expected
-      case 'lt': return typeof actual === 'number' && typeof expected === 'number' && actual < expected
-      case 'lte': return typeof actual === 'number' && typeof expected === 'number' && actual <= expected
-      case 'contains': return typeof actual === 'string' && typeof expected === 'string' && actual.includes(expected)
-      case 'in': return Array.isArray(expected) && expected.some((v) => v === actual)
-      default: return false
-    }
+  function send(payload: { trace?: AutomationRunTrace; runStartedAt?: number }): Promise<void> {
+    if (BLOCK_ID === null) return Promise.resolve()
+    const blockId = BLOCK_ID
+    sendChain = sendChain.then(async () => {
+      try {
+        await ctx.api.coreBlocks.reportAutomationRun.mutate({ blockId, keepTraces: KEEP_TRACES, ...payload })
+      } catch (err: unknown) {
+        ctx.logger.warn('could not report the run to the hub ledger', {
+          blockId,
+          error: err instanceof Error ? err.message : String(err),
+        })
+      }
+    })
+    return sendChain
   }
 
-  /** A leaf whose device or cap is currently unresolvable is FALSE and logs.
-   *  It never throws the pass away, and it never counts as true. */
-  async function leaf(
-    deviceId: number,
-    cap: string,
-    fieldPath: string,
-    operator: string,
-    expected: unknown,
-  ): Promise<boolean> {
-    const actual = await readField(deviceId, cap, fieldPath)
-    if (actual === undefined) {
-      ctx.logger.warn('condition leaf unresolvable — treated as false', {
-        tags: { deviceId },
-        cap,
-        fieldPath,
-      })
-      return false
+  function flushSkip(): void {
+    if (skipTimer !== undefined) {
+      clearTimeout(skipTimer)
+      skipTimer = undefined
     }
-    return compare(actual, operator, expected)
+    if (pendingSkip === undefined) return
+    const trace = pendingSkip
+    pendingSkip = undefined
+    void send({ trace })
   }
 
-  /** The expression leaf goes through the bounded engine — parsed AST, no
-   *  member access, no loops, hard step/node limits. Never inline JS. */
-  async function exprLeaf(
-    expr: string,
-    bindings: Record<string, { kind?: string; cap?: string; fieldPath?: string; value?: unknown; sourceStableId?: string }>,
-  ): Promise<boolean> {
-    const values: Record<string, string | number | boolean | null> = {}
-    for (const [alias, binding] of Object.entries(bindings)) {
-      if (binding.kind === 'literal') {
-        values[alias] = toExpressionValue(binding.value) ?? null
-        continue
-      }
-      const deviceId = await stableIdToDeviceId(binding.sourceStableId)
-      if (deviceId === undefined) {
-        ctx.logger.warn('condition leaf unresolvable — treated as false', {
-          tags: { deviceId: -1 },
-          binding: alias,
-        })
-        return false
+  /** A skip identical to the one waiting is COUNTED on it; anything else flushes it first. */
+  function record(trace: AutomationRunTrace): void {
+    if (isSkippedTrace(trace)) {
+      if (pendingSkip !== undefined) {
+        const merged = mergeSkipTraces(pendingSkip, trace)
+        if (merged !== null) {
+          pendingSkip = merged
+          return
+        }
+        flushSkip()
       }
-      const raw = await readField(deviceId, binding.cap ?? '', binding.fieldPath ?? '')
-      values[alias] = toExpressionValue(raw) ?? null
+      pendingSkip = trace
+      skipTimer = setTimeout(flushSkip, SKIP_FLUSH_MS)
+      return
     }
-    const result = evaluateExpressionSource(expr, values, Date.now())
-    if (!result.ok) {
-      ctx.logger.warn('expression leaf failed — treated as false', { expr, error: result.error })
-      return false
+    flushSkip()
+    void send({ trace })
+  }
+
+  // ── the condition mirror (D49): memory only at fire time ──
+  async function refreshMirror(): Promise<void> {
+    const report = await mirror.refresh({
+      fetchSlice: (deviceId, cap) => ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap }),
+      fetchStableIds: async () => {
+        const all = await ctx.api.deviceManager.listAll.query({})
+        return new Map(all.devices.flatMap((d: { stableId?: string; id: number }) =>
+          d.stableId === undefined ? [] : [[d.stableId, d.id] as [string, number]]))
+      },
+    })
+    if (report.kept > 0) {
+      ctx.logger.debug('condition mirror kept stale values for sources it could not read', report)
     }
-    return result.value === true
   }
 
-  async function stableIdToDeviceId(stableId: string | undefined): Promise<number | undefined> {
-    if (stableId === undefined) return undefined
+  /** Read one cap field off the state mirror. Returns undefined when the device,
+   *  the cap or the field cannot be resolved — the caller decides what that
+   *  means, and it always logs. (Used by the device-state TRIGGER, which the
+   *  reconcile backs; conditions read the ConditionMirror instead.) */
+  async function readField(
+    deviceId: number,
+    cap: string,
+    fieldPath: string,
+  ): Promise<unknown> {
     try {
-      const all = await ctx.api.deviceManager.listAll.query({})
-      const hit = all.devices.find((d: { stableId?: string; id: number }) => d.stableId === stableId)
-      return hit?.id
+      const slice = await ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap })
+      let cursor: unknown = slice
+      for (const part of fieldPath.split('.')) {
+        if (cursor === null || typeof cursor !== 'object') return undefined
+        cursor = (cursor as Record<string, unknown>)[part]
+      }
+      return cursor
     } catch {
       return undefined
     }
   }
 
-  async function allOf(children: Array<() => Promise<boolean>>): Promise<boolean> {
-    for (const c of children) { if (!(await c())) return false }
-    return true
-  }
-  async function anyOf(children: Array<() => Promise<boolean>>): Promise<boolean> {
-    for (const c of children) { if (await c()) return true }
-    return false
-  }
-  async function notOf(child: () => Promise<boolean>): Promise<boolean> {
-    return !(await child())
-  }
-
   /** A {$var} action target, resolved from the run's bag BEFORE dispatch — the
    *  action runner only ever sees a number. */
   function resolveTarget(vars: Record<string, unknown>, name: string): number {
-    const raw = vars[name]
-    if (typeof raw === 'number') return raw
-    throw new Error('action target var "' + name + '" is not a device id')
+    return resolveDeviceTarget(vars, name)
+  }
+
+  function warnMissingVar(name: string): void {
+    ctx.logger.warn('template referenced a var that was never set', { var: name })
   }
 
-  /** Substitute {{vars.x}} slots. Substitution only — never evaluation. */
+  /** Substitute {{vars.x}} slots and { $var } values. Substitution only — never evaluation. */
   function substitute(value: unknown, vars: Record<string, unknown>): unknown {
-    if (typeof value !== 'string') return value
-    return value.replace(/\\{\\{\\s*vars\\.([A-Za-z_][A-Za-z0-9_]*)\\s*\\}\\}/g, (_m, key: string) => {
-      const v = vars[key]
-      if (v === undefined) {
-        ctx.logger.warn('template referenced a var that was never set', { var: key })
-        return ''
+    return resolveStepArgs(value, vars, warnMissingVar)
+  }
+
+  /** The variables handed to an Action step, substituted and kept to primitives. */
+  function substituteVariables(
+    raw: Record<string, string | number | boolean>,
+    vars: Record<string, unknown>,
+  ): Record<string, string | number | boolean> {
+    const out: Record<string, string | number | boolean> = {}
+    for (const [key, value] of Object.entries(raw)) {
+      const resolved = substitute(value, vars)
+      if (typeof resolved === 'string' || typeof resolved === 'number' || typeof resolved === 'boolean') {
+        out[key] = resolved
       }
-      return String(v)
-    })
+    }
+    return out
   }
 
   async function actuate(
@@ -8636,8 +8827,9 @@ export default function block(ctx: AddonContext) {
     args: Record<string, unknown>,
     vars: Record<string, unknown>,
   ): Promise<void> {
-    const resolved: Record<string, unknown> = {}
-    for (const [k, v] of Object.entries(args)) resolved[k] = substitute(v, vars)
+    const substituted = substitute(args, vars)
+    const resolved: Record<string, unknown> =
+      substituted !== null && typeof substituted === 'object' ? { ...substituted } : {}
     // Forked-addon ctx.api namespaces are tRPC Proxies over a noop function
     // (typeof === 'function'), not plain objects — reject only null/undefined.
     const client: unknown = Reflect.get(ctx.api, capToRouterKey(cap))
@@ -8651,390 +8843,2035 @@ export default function block(ctx: AddonContext) {
     await mutate({ ...resolved, deviceId })
   }
 
-  async function evaluateConditions(): Promise<boolean> {
-    return ${conditionExpr}
-  }
-
-  /** The THEN half. Stops at the first failure — continuing past a failed step
-   *  executes an intent the operator never expressed. */
-  async function runActions(vars: Record<string, unknown>): Promise<void> {
-    for (let step = 0; step < ${recipe.actions.length}; step += 1) {
-      try {
-        switch (step) {
+  /** The THEN half, through the ONE shared step runner: stops at the first
+   *  failure (continuing past a failed step executes an intent the operator
+   *  never expressed); every step is traced, the ones after a failure (or an
+   *  abort) are marked not-run. */
+  async function runActions(
+    vars: Record<string, unknown>,
+    token: RunToken,
+  ): Promise<{ steps: readonly AutomationStepTrace[]; failed: boolean }> {
+    const sleep = (ms: number): Promise<void> => abortableSleep(ms, token)
+    const steps: RunnableStep[] = [
 ${recipe.actions.map((a, i) => emitAction(a, i)).join("\n")}
-        }
-      } catch (err: unknown) {
+    ]
+    return runSteps(steps, {
+      pathPrefix: 'actions',
+      isAborted: () => token.aborted,
+      abortReason: 'aborted by a restart',
+      now: () => Date.now(),
+      onFailure: (failure) => {
         ctx.logger.warn('action failed — stopping the sequence', {
-          step,
-          error: err instanceof Error ? err.message : String(err),
+          ...(failure.deviceId === undefined ? {} : { tags: { deviceId: failure.deviceId } }),
+          step: failure.index,
+          error: failure.message,
         })
+      },
+    })
+  }
+
+  function deviceTags(trigger: Record<string, unknown>): { tags?: { deviceId: number } } {
+    const deviceId = trigger['deviceId']
+    return typeof deviceId === 'number' ? { tags: { deviceId } } : {}
+  }
+
+  function newRunId(at: number): string {
+    runCounter += 1
+    return at.toString(36) + '-' + runCounter.toString(36)
+  }
+
+  /** A trigger that never became a run (rejected, or dropped by the run mode). */
+  function skipTrace(
+    trigger: Record<string, unknown>,
+    reason: string,
+    outcome: AutomationRunTrace['outcome'],
+    verdict: AutomationRunVerdict | undefined,
+    accepted: boolean,
+  ): AutomationRunTrace {
+    const now = Date.now()
+    return {
+      runId: newRunId(now),
+      startedAt: now,
+      endedAt: now,
+      trigger: buildTriggerTrace(trigger, accepted ? 'pass' : 'fail', reason),
+      conditions: [],
+      ...(verdict === undefined ? {} : { verdict }),
+      steps: [],
+      outcome,
+      repeat: 1,
+      lastAt: now,
+    }
+  }
+
+  /** One admitted run: conditions (memory only), the cooldown, the actions. */
+  async function execute(
+    trigger: Record<string, unknown>,
+    reason: string,
+    admission: AutomationRunVerdict,
+  ): Promise<void> {
+    const token: RunToken = { aborted: false }
+    runningTokens.add(token)
+    const startedAt = Date.now()
+    const runId = newRunId(startedAt)
+    let verdict = admission
+    let outcome: AutomationRunTrace['outcome'] = 'ran'
+    let nodes: AutomationConditionTraceNode[] = []
+    let steps: AutomationStepTrace[] = []
+    try {
+      const evaluation = evaluateConditionTree(CONDITIONS, mirror, Date.now())
+      nodes = [...evaluation.nodes]
+      for (const node of nodes) {
+        if (node.kind === 'condition' && node.observed === null && node.deviceId !== undefined) {
+          ctx.logger.warn('condition leaf value unknown — treated as false', {
+            tags: { deviceId: node.deviceId },
+            path: node.path,
+            cap: node.cap,
+            fieldPath: node.fieldPath,
+          })
+        }
+      }
+      if (!evaluation.pass) {
+        outcome = 'skipped-conditions'
+        ctx.logger.debug('automation did not run — conditions were false', { trigger, ...deviceTags(trigger) })
+        return
+      }
+      const letThrough = stampUnknown && RUN_MODE.mode === 'cooldown'
+      const cooldown = letThrough
+        ? { ok: true, bypassed: true, reason: 'cooldown stamp unreadable at start — run let through' }
+        : gate.cooldown({
+            manual: trigger['kind'] === 'manual',
+            now: Date.now(),
+            lastRunStartedAt,
+          })
+      if (!cooldown.ok) {
+        outcome = 'skipped-cooldown'
+        verdict = { mode: RUN_MODE, decision: 'cooldown', reason: cooldown.reason }
+        ctx.logger.info('automation did not run — ' + cooldown.reason, deviceTags(trigger))
         return
       }
+      if (cooldown.bypassed) verdict = { mode: RUN_MODE, decision: 'bypass', reason: cooldown.reason }
+      // Stamped when the actions START, and reported to the hub before they run,
+      // so a restart mid-run cannot fire again inside the window.
+      lastRunStartedAt = startedAt
+      stampUnknown = false
+      await send({ runStartedAt: startedAt })
+      ctx.logger.info('automation running', { trigger, ...deviceTags(trigger) })
+      const vars: Record<string, unknown> = { ...trigger }
+      const result = await runActions(vars, token)
+      steps = result.steps
+      outcome = token.aborted ? 'aborted' : result.failed ? 'failed' : 'ran'
+    } catch (err: unknown) {
+      outcome = 'failed'
+      ctx.logger.warn('automation run failed', { error: err instanceof Error ? err.message : String(err), ...deviceTags(trigger) })
+    } finally {
+      runningTokens.delete(token)
+      const endedAt = Date.now()
+      record({
+        runId,
+        startedAt,
+        endedAt,
+        trigger: buildTriggerTrace(trigger, 'pass', reason),
+        conditions: nodes,
+        verdict,
+        steps,
+        outcome,
+        repeat: 1,
+        lastAt: endedAt,
+      })
+      if (gate.release()) {
+        const next = queue.shift()
+        if (next !== undefined && !stopped) {
+          void execute(next.trigger, next.reason, {
+            mode: RUN_MODE,
+            decision: 'queued',
+            reason: 'queued, then ran after waiting ' + (Date.now() - next.queuedAt) + ' ms',
+          })
+        }
+      }
     }
   }
 
-  async function run(trigger: Record<string, unknown>): Promise<void> {
-    const vars: Record<string, unknown> = { ...trigger }
-    const passed = await evaluateConditions()
-    if (!passed) {
-      ctx.logger.debug('automation did not run — conditions were false', { trigger })
+  /** Every trigger lands here. \`accepted\` = the trigger itself was satisfied
+   *  (a rejected detection event is only traced). */
+  async function run(
+    trigger: Record<string, unknown>,
+    reason = 'fired',
+    accepted = true,
+  ): Promise<void> {
+    await ready
+    if (stopped) return
+    if (!accepted) {
+      record(skipTrace(trigger, reason, 'skipped-trigger', undefined, false))
       return
     }
-    ctx.logger.info('automation running', { trigger })
-    await runActions(vars)
+    const admission = gate.admit()
+    const verdict: AutomationRunVerdict = { mode: RUN_MODE, decision: admission.decision, reason: admission.reason }
+    switch (admission.decision) {
+      case 'drop':
+        ctx.logger.info('automation trigger dropped — ' + admission.reason, deviceTags(trigger))
+        record(skipTrace(trigger, reason, 'skipped-overlap', verdict, true))
+        return
+      case 'queued':
+        ctx.logger.info('automation trigger queued — ' + admission.reason, deviceTags(trigger))
+        queue.push({ trigger, reason, queuedAt: Date.now() })
+        return
+      case 'restart':
+        ctx.logger.info('automation restarting — ' + admission.reason, deviceTags(trigger))
+        for (const running of runningTokens) {
+          running.aborted = true
+          running.wake?.()
+        }
+        break
+      case 'run':
+        break
+    }
+    await execute(trigger, reason, verdict)
+  }
+
+  const ready: Promise<void> = (async () => {
+    await loadState()
+    await refreshMirror()
+  })()
+
+  if (CONDITIONS !== undefined) {
+    disposers.push(
+      ctx.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+        const data = event.data
+        const deviceId = data['deviceId']
+        const capName = data['capName']
+        if (typeof deviceId === 'number' && typeof capName === 'string') {
+          mirror.apply(deviceId, capName, data['slice'])
+        }
+      }),
+    )
+    const mirrorReconcile = setInterval(() => { void refreshMirror() }, RECONCILE_MS)
+    disposers.push(() => clearInterval(mirrorReconcile))
   }
 
 ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
 
   return () => {
+    stopped = true
+    queue.length = 0
+    flushSkip()
+    for (const running of runningTokens) {
+      running.aborted = true
+      running.wake?.()
+    }
     for (const dispose of disposers) dispose()
   }
 }
 `;
 }
 //#endregion
-//#region src/capabilities/addon-pages.cap.ts
+//#region src/automation/condition-eval.ts
 /**
-* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
-* surface that admin-ui consumes through `useAddonPagesListPages()`.
+* Evaluating an automation's condition tree against the ConditionMirror.
 *
-* The provider iterates every `addon-pages-source` (collection) provider
-* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
-* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
-* filesystem `mtime` cache-buster lets the browser pick up addon
-* rebuilds without manual reload.
+* D49: a trigger is a one-shot event, so its gate must never hang on a read
+* that can fail. Every field a condition leaf names is therefore kept in
+* memory — filled at start, updated off device state-changed events, reconciled
+* on a timer — and evaluation reads that memory ONLY. A value the mirror does
+* not hold is UNKNOWN, which is `fail` with a reason, never a throw and never a
+* `pass`. A failed refresh changes nothing: the previous value stays.
 *
-* The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
-* provider. Splitting the public aggregator from the raw collection
-* keeps both ends in codegen — there's no hand-written
-* `addon-pages.router.ts` wrapper anymore.
+* The evaluator returns a node per tree position (containers, leaves, and the
+* ones a short-circuit never reached) with a stable path and a human reason, so
+* the editor can paint each block.
 */
-var AddonPageDeclarationSchema$1 = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	path: zod.z.string(),
-	remoteName: zod.z.string(),
-	bundle: zod.z.string(),
-	section: zod.z.string().optional(),
-	sectionLabel: zod.z.string().optional()
-});
-var AddonPageInfoSchema = zod.z.object({
-	addonId: zod.z.string(),
-	page: AddonPageDeclarationSchema$1,
-	bundleUrl: zod.z.string()
-});
-var addonPagesCapability = {
-	name: "addon-pages",
-	scope: "system",
-	mode: "singleton",
-	methods: { listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageInfoSchema).readonly()) }
+function collectInto(cond, out) {
+	switch (cond.kind) {
+		case "all":
+		case "any":
+			for (const child of cond.children) collectInto(child, out);
+			return;
+		case "not":
+			collectInto(cond.child, out);
+			return;
+		case "condition":
+			out.push({
+				kind: "device",
+				deviceId: cond.deviceId,
+				cap: cond.cap
+			});
+			return;
+		case "expression":
+			for (const binding of Object.values(cond.bindings)) if (binding.kind === "global") out.push({
+				kind: "stable",
+				stableId: binding.sourceStableId,
+				cap: binding.cap
+			});
+			return;
+	}
+}
+/** Every (device, cap) a tree reads, deduplicated. */
+function collectMirrorSources(cond) {
+	if (cond === void 0) return [];
+	const all = [];
+	collectInto(cond, all);
+	const seen = /* @__PURE__ */ new Set();
+	return all.filter((s) => {
+		const key = s.kind === "device" ? `d|${s.deviceId}|${s.cap}` : `s|${s.stableId}|${s.cap}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function sliceKey(deviceId, cap) {
+	return `${deviceId}|${cap}`;
+}
+function pick$1(slice, fieldPath) {
+	let cursor = slice;
+	for (const part of fieldPath.split(".")) {
+		if (cursor === null || typeof cursor !== "object") return void 0;
+		cursor = Reflect.get(cursor, part);
+	}
+	return cursor;
+}
+function isSliceObject(value) {
+	return typeof value === "object" && value !== null;
+}
+var ConditionMirror = class {
+	sources;
+	slices = /* @__PURE__ */ new Map();
+	stableIds = /* @__PURE__ */ new Map();
+	watched;
+	constructor(sources) {
+		this.sources = sources;
+		this.watched = new Set(sources.filter((s) => s.kind === "device").map((s) => sliceKey(s.deviceId, s.cap)));
+	}
+	/** A `device.state-changed` event. Slices nobody reads are ignored. */
+	apply(deviceId, cap, slice) {
+		const key = sliceKey(deviceId, cap);
+		if (!isSliceObject(slice)) return;
+		if (!this.watched.has(key) && !this.isStableTarget(deviceId, cap)) return;
+		this.slices.set(key, slice);
+	}
+	isStableTarget(deviceId, cap) {
+		for (const s of this.sources) if (s.kind === "stable" && s.cap === cap && this.stableIds.get(s.stableId) === deviceId) return true;
+		return false;
+	}
+	read(deviceId, cap, fieldPath) {
+		const slice = this.slices.get(sliceKey(deviceId, cap));
+		return slice === void 0 ? void 0 : pick$1(slice, fieldPath);
+	}
+	readStable(stableId, cap, fieldPath) {
+		const deviceId = this.stableIds.get(stableId);
+		return deviceId === void 0 ? void 0 : this.read(deviceId, cap, fieldPath);
+	}
+	/** Fill / reconcile. A read that fails or answers nothing keeps the old value. */
+	async refresh(fetchers) {
+		let updated = 0;
+		let kept = 0;
+		if (this.sources.some((s) => s.kind === "stable")) try {
+			this.stableIds = await fetchers.fetchStableIds();
+		} catch {}
+		const targets = /* @__PURE__ */ new Map();
+		for (const s of this.sources) {
+			const deviceId = s.kind === "device" ? s.deviceId : this.stableIds.get(s.stableId);
+			if (deviceId === void 0) {
+				kept += 1;
+				continue;
+			}
+			targets.set(sliceKey(deviceId, s.cap), {
+				deviceId,
+				cap: s.cap
+			});
+		}
+		for (const [key, target] of targets) try {
+			const slice = await fetchers.fetchSlice(target.deviceId, target.cap);
+			if (isSliceObject(slice)) {
+				this.slices.set(key, slice);
+				updated += 1;
+			} else kept += 1;
+		} catch {
+			kept += 1;
+		}
+		return {
+			updated,
+			kept
+		};
+	}
 };
-//#endregion
-//#region src/capabilities/addon-pages-source.cap.ts
-/**
-* `addon-pages-source` — collection cap exposing per-provider raw page
-* declarations. Every addon that contributes a UI page registers a
-* provider here. The hub-side singleton aggregator (`addon-pages` cap,
-* see `addon-pages.cap.ts`) walks this collection, stamps versioned
-* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
-* that admin-ui consumes.
-*
-* The split exists because the public listing has a different output
-* shape than the per-provider raw declarations, and we want both ends
-* to flow through codegen instead of relying on a hand-written wrapper.
-*/
-var AddonPageDeclarationSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	path: zod.z.string(),
-	/**
-	* Module Federation remote name — must match the `name` field on the
-	* page addon's `federation()` plugin config. Used by admin-ui's
-	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
-	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
-	* contain hyphens).
-	*/
-	remoteName: zod.z.string(),
-	/**
-	* Bundle filename inside the addon's `dist/` dir served at
-	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
-	* is always `'remoteEntry.js'`; the value is kept on the metadata so
-	* the static-file route can compute an mtime-based cache-buster URL
-	* without a separate filesystem stat.
-	*/
-	bundle: zod.z.string(),
-	/**
-	* Sidebar section this page docks into. Well-known ids: `'detection'`,
-	* `'cluster'`, `'administration'` — the page renders inside that group.
-	* Any OTHER string creates (or joins) a custom section rendered after
-	* the built-in groups; its label comes from `sectionLabel` (first
-	* declaration wins), falling back to the id. Absent → the legacy
-	* "Addon Pages" group.
-	*/
-	section: zod.z.string().optional(),
-	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
-	sectionLabel: zod.z.string().optional()
-});
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the `addon-pages-aggregator` builtin, reads it via
-	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
-	* only, never tRPC (per `ctx.capabilities` seeing only the local
-	* process). The public, enriched listing admin-ui actually consumes is
-	* the separate `addon-pages` cap, unaffected by this change.
-	*/
-listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
+var OPERATOR_SYMBOL = {
+	eq: "=",
+	ne: "≠",
+	gt: ">",
+	gte: "≥",
+	lt: "<",
+	lte: "≤",
+	contains: "contains",
+	in: "in"
 };
+function compare(actual, operator, expected) {
+	switch (operator) {
+		case "eq": return actual === expected;
+		case "ne": return actual !== expected;
+		case "gt": return typeof actual === "number" && typeof expected === "number" && actual > expected;
+		case "gte": return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+		case "lt": return typeof actual === "number" && typeof expected === "number" && actual < expected;
+		case "lte": return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+		case "contains": return typeof actual === "string" && typeof expected === "string" && actual.includes(expected);
+		case "in": return Array.isArray(expected) && expected.some((v) => v === actual);
+	}
+}
+function toTraceValue(value) {
+	if (value === void 0 || value === null) return null;
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
+	if (Array.isArray(value) && value.every((v) => typeof v === "string" || typeof v === "number")) return value;
+	return JSON.stringify(value);
+}
+function show(value) {
+	return Array.isArray(value) ? `[${value.join(", ")}]` : String(value);
+}
+function markSkipped(cond, path, why, out) {
+	out.push({
+		path,
+		kind: cond.kind,
+		outcome: "not-evaluated",
+		reason: why
+	});
+	if (cond.kind === "all" || cond.kind === "any") cond.children.forEach((c, i) => {
+		markSkipped(c, `${path}.${i}`, why, out);
+	});
+	else if (cond.kind === "not") markSkipped(cond.child, `${path}.0`, why, out);
+}
+function evalNode(cond, path, reader, now, out) {
+	switch (cond.kind) {
+		case "condition": {
+			const observed = reader.read(cond.deviceId, cond.cap, cond.fieldPath);
+			const base = {
+				path,
+				kind: cond.kind,
+				deviceId: cond.deviceId,
+				cap: cond.cap,
+				fieldPath: cond.fieldPath,
+				operator: cond.operator,
+				expected: toTraceValue(cond.value),
+				observed: toTraceValue(observed)
+			};
+			if (observed === void 0) {
+				out.push({
+					...base,
+					outcome: "fail",
+					reason: `${cond.fieldPath} value unknown → fail`
+				});
+				return false;
+			}
+			const ok = compare(observed, cond.operator, cond.value);
+			out.push({
+				...base,
+				outcome: ok ? "pass" : "fail",
+				reason: `${cond.fieldPath} ${show(observed)}, expected ${OPERATOR_SYMBOL[cond.operator]} ${show(cond.value)} → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "expression": {
+			const values = {};
+			for (const [alias, binding] of Object.entries(cond.bindings)) {
+				if (binding.kind === "literal") {
+					values[alias] = require_composition.toExpressionValue(binding.value) ?? null;
+					continue;
+				}
+				const raw = binding.kind === "global" ? reader.readStable(binding.sourceStableId, binding.cap, binding.fieldPath) : void 0;
+				if (raw === void 0) {
+					out.push({
+						path,
+						kind: cond.kind,
+						outcome: "fail",
+						reason: `${alias} value unknown → fail`
+					});
+					return false;
+				}
+				values[alias] = require_composition.toExpressionValue(raw) ?? null;
+			}
+			const result = require_composition.evaluateExpressionSource(cond.expr, values, now);
+			if (!result.ok) {
+				out.push({
+					path,
+					kind: cond.kind,
+					outcome: "fail",
+					reason: `${cond.expr}: ${result.error} → fail`
+				});
+				return false;
+			}
+			const ok = result.value === true;
+			out.push({
+				path,
+				kind: cond.kind,
+				outcome: ok ? "pass" : "fail",
+				reason: `${cond.expr} with ${JSON.stringify(values)} → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "not": {
+			const at = out.length;
+			out.push({
+				path,
+				kind: "not",
+				outcome: "not-evaluated",
+				reason: ""
+			});
+			const inner = evalNode(cond.child, `${path}.0`, reader, now, out);
+			const ok = !inner;
+			out.splice(at, 1, {
+				path,
+				kind: "not",
+				outcome: ok ? "pass" : "fail",
+				reason: `not (${inner ? "pass" : "fail"}) → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "all":
+		case "any": {
+			const isAll = cond.kind === "all";
+			const at = out.length;
+			out.push({
+				path,
+				kind: cond.kind,
+				outcome: "not-evaluated",
+				reason: ""
+			});
+			let decided = null;
+			for (let i = 0; i < cond.children.length; i += 1) {
+				const child = cond.children[i];
+				if (child === void 0) continue;
+				if (decided !== null) {
+					markSkipped(child, `${path}.${i}`, `short-circuited by ${path}.${decided}`, out);
+					continue;
+				}
+				const ok = evalNode(child, `${path}.${i}`, reader, now, out);
+				if (isAll ? !ok : ok) decided = i;
+			}
+			const ok = isAll ? decided === null : decided !== null;
+			const reason = isAll ? ok ? `all ${cond.children.length} passed → pass` : `${path}.${decided} failed → fail` : ok ? `${path}.${decided} passed → pass` : `none of ${cond.children.length} passed → fail`;
+			out.splice(at, 1, {
+				path,
+				kind: cond.kind,
+				outcome: ok ? "pass" : "fail",
+				reason
+			});
+			return ok;
+		}
+	}
+}
+/** No condition tree is a pass with no nodes. */
+function evaluateConditionTree(cond, reader, now) {
+	if (cond === void 0) return {
+		pass: true,
+		nodes: []
+	};
+	const nodes = [];
+	return {
+		pass: evalNode(cond, "conditions", reader, now, nodes),
+		nodes
+	};
+}
 //#endregion
-//#region src/capabilities/addon-routes.cap.ts
-var AddonHttpRouteSchema = zod.z.object({
-	method: zod.z.enum([
-		"GET",
-		"POST",
-		"PUT",
-		"DELETE",
-		"PATCH"
-	]),
-	path: zod.z.string(),
-	access: zod.z.enum([
-		"public",
-		"authenticated",
-		"admin"
-	]).optional(),
-	description: zod.z.string().optional(),
-	/** The hub limits this route per client address before the handler runs. */
-	rateLimit: zod.z.enum(["auth"]).optional()
-});
-/**
-* Cross-process route invocation envelope. The hub captures the
-* request as plain data, ships it to the worker via Moleculer, and
-* the worker runs the local handler against a capturing reply. The
-* envelope returned describes what the handler intended (status,
-* headers, body, or a redirect) so the hub can translate it back to
-* the Fastify reply that's actually wired to the socket.
-*/
-var InvokeRequestSchema = zod.z.object({
-	method: zod.z.string(),
-	path: zod.z.string(),
-	params: zod.z.record(zod.z.string(), zod.z.string()),
-	query: zod.z.record(zod.z.string(), zod.z.string()),
-	body: zod.z.unknown(),
-	headers: zod.z.record(zod.z.string(), zod.z.string()),
-	user: zod.z.object({
-		id: zod.z.string(),
-		username: zod.z.string(),
-		isAdmin: zod.z.boolean()
-	}).optional(),
-	scopedToken: zod.z.unknown().optional()
-});
-var InvokeReplyEnvelopeSchema = zod.z.object({
-	status: zod.z.number().int(),
-	headers: zod.z.record(zod.z.string(), zod.z.string()),
-	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
-	*  sending `body`. Status defaults to 302 when this is set unless
-	*  the handler called `reply.code(...)` explicitly. */
-	redirectUrl: zod.z.string().nullable(),
-	/** JSON-serializable body. `undefined` is treated as "no body". */
-	body: zod.z.unknown().optional(),
-	/** Set when the handler called `reply.type(mime)`. */
-	contentType: zod.z.string().optional()
-});
-var addonRoutesCapability = {
-	name: "addon-routes",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: {
-		getRoutes: require_sleep.method(zod.z.void(), zod.z.array(AddonHttpRouteSchema)),
-		/**
-		* Cross-process dispatch entry point. Forked addons implement this
-		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
-		* can route through Moleculer when the handler lives in a worker.
-		*
-		* Local addons can implement it for free with the same helper;
-		* the hub bypasses the wire on co-located addons.
-		*/
-		invoke: require_sleep.method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
+//#region src/catalogs/coco-classmap.ts
+var COCO_80_LABELS = [
+	{
+		id: "person",
+		name: "Person"
 	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
-	mount: { kind: "skip" }
-};
-//#endregion
-//#region src/capabilities/addon-settings.cap.ts
-var ConfigTabDeclarationSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	order: zod.z.number().optional()
-});
-var ConfigSectionWithValuesSchema = zod.z.object({
-	id: zod.z.string(),
-	title: zod.z.string(),
-	titleKey: zod.z.string().optional(),
-	description: zod.z.string().optional(),
-	descriptionKey: zod.z.string().optional(),
-	style: zod.z.enum(["card", "accordion"]).optional(),
-	defaultCollapsed: zod.z.boolean().optional(),
-	columns: zod.z.union([
-		zod.z.literal(1),
-		zod.z.literal(2),
-		zod.z.literal(3),
-		zod.z.literal(4)
-	]).optional(),
-	tab: zod.z.string().optional(),
-	location: zod.z.enum([
-		"settings",
-		"top-tab",
-		"hero"
-	]).optional(),
-	order: zod.z.number().optional(),
-	fields: zod.z.array(zod.z.any())
-});
-var SettingsSchemaWithValuesSchema = zod.z.object({
-	tabs: zod.z.array(ConfigTabDeclarationSchema).optional(),
-	sections: zod.z.array(ConfigSectionWithValuesSchema)
-});
-/** Patch object — keys are field names, values are the new field values. */
-var SettingsPatchSchema = zod.z.record(zod.z.string(), zod.z.unknown());
-/** Standard success response for update operations. */
-var SettingsUpdateResultSchema = zod.z.object({ success: zod.z.literal(true) });
-/**
-* addon-settings — singleton gateway for three-level addon settings.
-*
-* Works like `device-manager`: a single hub-side provider that resolves
-* `addonId` to the target addon and delegates the call. For hub-local
-* addons the call is direct; for remote agents it proxies via the
-* per-addon Moleculer service.
-*
-* Replaces the `$addonHost` Moleculer service. Transport transparency
-* is handled by the provider implementation — callers (admin UI, other
-* addons via `ctx.api`) never know which node hosts the target addon.
-*
-* Three levels:
-*   - **addon**: addon-scoped settings (installation config, API keys, …)
-*   - **global**: settings applied to all devices by default
-*   - **device**: per-device overrides
-*
-* Optional `nodeId` allows explicit node targeting. When absent the
-* provider resolves the addon's host node automatically.
-*/
-/**
-* `addon-settings` is a **hub-centric** cap: the hub hosts the single
-* provider, and `nodeId` in the input is data for the hub provider's
-* internal dispatcher, not a routing hint for the cap-router. See
-* `CapabilityDefinition.nodeIdMode` for the contract.
-*/
-var addonSettingsCapability = {
-	name: "addon-settings",
-	scope: "system",
-	mode: "singleton",
-	nodeIdMode: "data",
-	methods: {
-		getGlobalSettings: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			nodeId: zod.z.string().optional(),
-			overlay: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-			cap: zod.z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateGlobalSettings: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			nodeId: zod.z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		getIntegrationSettings: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			nodeId: zod.z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		getDeviceSettings: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			deviceId: zod.z.number(),
-			nodeId: zod.z.string().optional()
-		}), SettingsSchemaWithValuesSchema.nullable()),
-		updateDeviceSettings: require_sleep.method(zod.z.object({
-			addonId: zod.z.string(),
-			deviceId: zod.z.number(),
-			nodeId: zod.z.string().optional(),
-			patch: SettingsPatchSchema
-		}), SettingsUpdateResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		})
+	{
+		id: "bicycle",
+		name: "Bicycle"
+	},
+	{
+		id: "car",
+		name: "Car"
+	},
+	{
+		id: "motorcycle",
+		name: "Motorcycle"
+	},
+	{
+		id: "airplane",
+		name: "Airplane"
+	},
+	{
+		id: "bus",
+		name: "Bus"
+	},
+	{
+		id: "train",
+		name: "Train"
+	},
+	{
+		id: "truck",
+		name: "Truck"
+	},
+	{
+		id: "boat",
+		name: "Boat"
+	},
+	{
+		id: "traffic light",
+		name: "Traffic Light"
+	},
+	{
+		id: "fire hydrant",
+		name: "Fire Hydrant"
+	},
+	{
+		id: "stop sign",
+		name: "Stop Sign"
+	},
+	{
+		id: "parking meter",
+		name: "Parking Meter"
+	},
+	{
+		id: "bench",
+		name: "Bench"
+	},
+	{
+		id: "bird",
+		name: "Bird"
+	},
+	{
+		id: "cat",
+		name: "Cat"
+	},
+	{
+		id: "dog",
+		name: "Dog"
+	},
+	{
+		id: "horse",
+		name: "Horse"
+	},
+	{
+		id: "sheep",
+		name: "Sheep"
+	},
+	{
+		id: "cow",
+		name: "Cow"
+	},
+	{
+		id: "elephant",
+		name: "Elephant"
+	},
+	{
+		id: "bear",
+		name: "Bear"
+	},
+	{
+		id: "zebra",
+		name: "Zebra"
+	},
+	{
+		id: "giraffe",
+		name: "Giraffe"
+	},
+	{
+		id: "backpack",
+		name: "Backpack"
+	},
+	{
+		id: "umbrella",
+		name: "Umbrella"
+	},
+	{
+		id: "handbag",
+		name: "Handbag"
+	},
+	{
+		id: "tie",
+		name: "Tie"
+	},
+	{
+		id: "suitcase",
+		name: "Suitcase"
+	},
+	{
+		id: "frisbee",
+		name: "Frisbee"
+	},
+	{
+		id: "skis",
+		name: "Skis"
+	},
+	{
+		id: "snowboard",
+		name: "Snowboard"
+	},
+	{
+		id: "sports ball",
+		name: "Sports Ball"
+	},
+	{
+		id: "kite",
+		name: "Kite"
+	},
+	{
+		id: "baseball bat",
+		name: "Baseball Bat"
+	},
+	{
+		id: "baseball glove",
+		name: "Baseball Glove"
+	},
+	{
+		id: "skateboard",
+		name: "Skateboard"
+	},
+	{
+		id: "surfboard",
+		name: "Surfboard"
+	},
+	{
+		id: "tennis racket",
+		name: "Tennis Racket"
+	},
+	{
+		id: "bottle",
+		name: "Bottle"
+	},
+	{
+		id: "wine glass",
+		name: "Wine Glass"
+	},
+	{
+		id: "cup",
+		name: "Cup"
+	},
+	{
+		id: "fork",
+		name: "Fork"
+	},
+	{
+		id: "knife",
+		name: "Knife"
+	},
+	{
+		id: "spoon",
+		name: "Spoon"
+	},
+	{
+		id: "bowl",
+		name: "Bowl"
+	},
+	{
+		id: "banana",
+		name: "Banana"
+	},
+	{
+		id: "apple",
+		name: "Apple"
+	},
+	{
+		id: "sandwich",
+		name: "Sandwich"
+	},
+	{
+		id: "orange",
+		name: "Orange"
+	},
+	{
+		id: "broccoli",
+		name: "Broccoli"
+	},
+	{
+		id: "carrot",
+		name: "Carrot"
+	},
+	{
+		id: "hot dog",
+		name: "Hot Dog"
+	},
+	{
+		id: "pizza",
+		name: "Pizza"
+	},
+	{
+		id: "donut",
+		name: "Donut"
+	},
+	{
+		id: "cake",
+		name: "Cake"
+	},
+	{
+		id: "chair",
+		name: "Chair"
+	},
+	{
+		id: "couch",
+		name: "Couch"
+	},
+	{
+		id: "potted plant",
+		name: "Potted Plant"
+	},
+	{
+		id: "bed",
+		name: "Bed"
+	},
+	{
+		id: "dining table",
+		name: "Dining Table"
+	},
+	{
+		id: "toilet",
+		name: "Toilet"
+	},
+	{
+		id: "tv",
+		name: "TV"
+	},
+	{
+		id: "laptop",
+		name: "Laptop"
+	},
+	{
+		id: "mouse",
+		name: "Mouse"
+	},
+	{
+		id: "remote",
+		name: "Remote"
+	},
+	{
+		id: "keyboard",
+		name: "Keyboard"
+	},
+	{
+		id: "cell phone",
+		name: "Cell Phone"
+	},
+	{
+		id: "microwave",
+		name: "Microwave"
+	},
+	{
+		id: "oven",
+		name: "Oven"
+	},
+	{
+		id: "toaster",
+		name: "Toaster"
+	},
+	{
+		id: "sink",
+		name: "Sink"
+	},
+	{
+		id: "refrigerator",
+		name: "Refrigerator"
+	},
+	{
+		id: "book",
+		name: "Book"
+	},
+	{
+		id: "clock",
+		name: "Clock"
+	},
+	{
+		id: "vase",
+		name: "Vase"
+	},
+	{
+		id: "scissors",
+		name: "Scissors"
+	},
+	{
+		id: "teddy bear",
+		name: "Teddy Bear"
+	},
+	{
+		id: "hair drier",
+		name: "Hair Drier"
+	},
+	{
+		id: "toothbrush",
+		name: "Toothbrush"
+	}
+];
+var MACRO_LABELS = [
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+];
+/**
+* The class names a per-class COUNT can ever be keyed on — the macro ids, and
+* only those.
+*
+* `preserveOriginal: false` below is the whole reason this set exists: the
+* executor maps each raw COCO label onto its macro and DROPS everything else,
+* so a tracked detection's `className` is always one of {@link MACRO_LABELS}.
+* Any surface that indexes counts by class name — the ZoneAnalytics occupancy
+* snapshot's `byClass`, and therefore every occupancy rule — can match nothing
+* else. Derived from the catalog, never hand-listed, so a new macro joins it by
+* being declared once.
+*
+* Cost of not having it, 2026-08-12: the notification rule editor offered the
+* full taxonomy for an occupancy class (occupancy is the one condition that
+* does not go through the engine's macro-expanding `expandClassSelector`), two
+* live rules were authored on `car`, and both counters read 0 forever.
+*/
+var DETECTION_MACRO_CLASSES = new Set(MACRO_LABELS.map((l) => l.id));
+/** True when `className` is a macro the detector can actually emit (and hence a
+*  class a count can be keyed on) — see {@link DETECTION_MACRO_CLASSES}. */
+function isDetectionMacroClass(className) {
+	return DETECTION_MACRO_CLASSES.has(className.trim().toLowerCase());
+}
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+var MACRO_NAMES = new Set(Object.values(COCO_TO_MACRO.mapping));
+function macroOf(className) {
+	return COCO_TO_MACRO.mapping[className] ?? className;
+}
+/** `animal` matches a dog; `dog` matches only a dog (a cat is also an animal). */
+function detectionClassMatches(wanted, actual) {
+	const w = wanted.toLowerCase();
+	const a = actual.toLowerCase();
+	if (w === a) return true;
+	return MACRO_NAMES.has(w) && macroOf(a) === w;
+}
+function isPhase(value) {
+	return value === "start" || value === "update" || value === "end";
+}
+var DetectionTriggerFilter = class {
+	trigger;
+	/** `${deviceId}|${trackId}` → fired at. Insertion-ordered, so the oldest is first. */
+	fired = /* @__PURE__ */ new Map();
+	constructor(trigger) {
+		this.trigger = trigger;
+	}
+	get firedCount() {
+		return this.fired.size;
+	}
+	evaluate(event, now) {
+		const { deviceId, trackId, phase } = event;
+		if (typeof deviceId !== "number" || typeof trackId !== "string" || !isPhase(phase)) return {
+			kind: "ignore",
+			why: "malformed track-lifecycle event"
+		};
+		if (!this.trigger.deviceIds.includes(deviceId)) return {
+			kind: "ignore",
+			why: `device ${deviceId} is not one of the trigger's devices`
+		};
+		const key = `${deviceId}|${trackId}`;
+		if (phase === "end") {
+			this.fired.delete(key);
+			return {
+				kind: "ignore",
+				why: "track ended"
+			};
+		}
+		this.expire(now);
+		const className = typeof event.bestClassName === "string" ? event.bestClassName : "";
+		const score = typeof event.bestConfidence === "number" ? event.bestConfidence : 0;
+		const vars = {
+			deviceId,
+			className,
+			trackId,
+			score
+		};
+		if (this.fired.has(key)) return {
+			kind: "reject",
+			reason: `already fired for track ${trackId}`,
+			vars
+		};
+		if (!this.trigger.classes.some((c) => detectionClassMatches(c, className))) return {
+			kind: "reject",
+			reason: `class ${className || "unknown"} not in [${this.trigger.classes.join(", ")}]`,
+			vars
+		};
+		if (this.trigger.minScore !== void 0 && score < this.trigger.minScore) return {
+			kind: "reject",
+			reason: `score ${score} < ${this.trigger.minScore}`,
+			vars
+		};
+		if (this.trigger.zones !== void 0) {
+			const visited = Array.isArray(event.zonesVisited) ? event.zonesVisited.filter((z) => typeof z === "string") : [];
+			if (!this.trigger.zones.some((z) => visited.includes(z))) return {
+				kind: "reject",
+				reason: `zone mismatch: visited [${visited.join(", ")}], wanted [${this.trigger.zones.join(", ")}]`,
+				vars
+			};
+		}
+		this.remember(key, now);
+		return {
+			kind: "fire",
+			reason: `${className} ${score} on device ${deviceId}`,
+			vars
+		};
+	}
+	remember(key, now) {
+		this.fired.set(key, now);
+		while (this.fired.size > 512) {
+			const oldest = this.fired.keys().next();
+			if (oldest.done === true) break;
+			this.fired.delete(oldest.value);
+		}
+	}
+	expire(now) {
+		for (const [key, at] of this.fired) {
+			if (now - at < 9e5) break;
+			this.fired.delete(key);
+		}
 	}
 };
 //#endregion
-//#region src/capabilities/addon-widgets-source.cap.ts
+//#region src/automation/run-gate.ts
+var MINUTE_MS$1 = 6e4;
+function minutes(ms) {
+	return (ms / MINUTE_MS$1).toFixed(1);
+}
+var RunGate = class {
+	mode;
+	active = 0;
+	pending = 0;
+	constructor(mode) {
+		this.mode = mode;
+	}
+	get activeRuns() {
+		return this.active;
+	}
+	get queuedTriggers() {
+		return this.pending;
+	}
+	admit() {
+		const mode = this.mode;
+		switch (mode.mode) {
+			case "single":
+			case "cooldown":
+				if (this.active > 0) return {
+					decision: "drop",
+					reason: `${mode.mode}: a run is already in progress`
+				};
+				this.active += 1;
+				return {
+					decision: "run",
+					reason: `${mode.mode}: no run in progress`
+				};
+			case "restart":
+				if (this.active > 0) {
+					this.active += 1;
+					return {
+						decision: "restart",
+						reason: `restart: aborting ${this.active - 1} run(s) in progress`
+					};
+				}
+				this.active += 1;
+				return {
+					decision: "run",
+					reason: "restart: no run in progress"
+				};
+			case "queued":
+				if (this.active === 0) {
+					this.active += 1;
+					return {
+						decision: "run",
+						reason: "queued: no run in progress"
+					};
+				}
+				if (this.pending < mode.max) {
+					this.pending += 1;
+					return {
+						decision: "queued",
+						reason: `queued: a run is in progress, waiting ${this.pending} of ${mode.max}`
+					};
+				}
+				return {
+					decision: "drop",
+					reason: `queued: a run is in progress and the queue is full (${mode.max})`
+				};
+			case "parallel":
+				if (this.active < mode.max) {
+					this.active += 1;
+					return {
+						decision: "run",
+						reason: `parallel: ${this.active} of ${mode.max} running`
+					};
+				}
+				return {
+					decision: "drop",
+					reason: `parallel: ${mode.max} runs already in progress`
+				};
+		}
+	}
+	/** The run holding a slot ended (any outcome). True = a queued trigger took the slot. */
+	release() {
+		if (this.active > 0) this.active -= 1;
+		if (this.mode.mode === "queued" && this.pending > 0) {
+			this.pending -= 1;
+			this.active += 1;
+			return true;
+		}
+		return false;
+	}
+	/** Checked AFTER the conditions pass. Always `ok` outside `cooldown` mode. */
+	cooldown(input) {
+		if (this.mode.mode !== "cooldown") return {
+			ok: true,
+			bypassed: false,
+			reason: ""
+		};
+		const waitMs = this.mode.minutes * MINUTE_MS$1;
+		if (input.lastRunStartedAt === null) return {
+			ok: true,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: no earlier run`
+		};
+		const elapsed = input.now - input.lastRunStartedAt;
+		if (elapsed >= waitMs) return {
+			ok: true,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: last run started ${minutes(elapsed)} min ago`
+		};
+		const left = `${minutes(waitMs - elapsed)} min left`;
+		if (input.manual) return {
+			ok: true,
+			bypassed: true,
+			reason: `cooldown ${this.mode.minutes} min bypassed by a manual trigger (${left})`
+		};
+		return {
+			ok: false,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: last run started ${minutes(elapsed)} min ago, ${left}`
+		};
+	}
+};
+//#endregion
+//#region src/automation/trace.ts
 /**
-* `addon-widgets-source` — collection cap exposing per-addon raw widget
-* declarations. Mirrors the addon-pages split: every addon shipping
-* widgets registers a provider on this collection cap; the hub-local
-* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
-* collection, stamps versioned `bundleUrl`s onto each declaration, and
-* exposes the public listing surface that admin-ui consumes.
+* Run traces — what an automation (or, later, an Action run) DID, node by node,
+* so the editor can paint every block green or red with its reason.
 *
-* The split exists because the public listing has a different output
-* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
-* per-provider raw declarations. Both ends flow through codegen.
+* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
+* every condition node (containers and leaves, including the ones a
+* short-circuit never reached), the run-mode verdict and every action step —
+* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Skipped
+* evaluations are traced too, and identical consecutive skips collapse into a
+* repeat count so a trigger that fails every 5 minutes cannot flush real runs.
 *
-* Unified UI-contribution model (Task 10): a widget descriptor IS a
-* `UiContribution` with `kind:'remote'`. The host renders it through the
-* same `ContributionRenderer` / Module-Federation path as every other
-* contributed UI surface — no bespoke widget-rendering path. The widget-
-* only metadata (sizing hints, `requires`) lives as extra fields on the
-* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
-* `kind` / `remote`) carries identity + placement + the MF remote.
+* {@link AutomationStepTraceSchema} is deliberately free of automation
+* vocabulary so an Action run records the same step shape.
 */
-/** Where the widget makes sense to render — maps to a contribution `tab`. */
-var WidgetHostEnum = zod.z.enum([
-	"device-tab",
-	"dashboard",
-	"integration-detail"
+/** A value a trace may show: JSON primitives and short lists, nothing deeper. */
+var TraceValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean(),
+	zod.z.null(),
+	zod.z.array(zod.z.union([zod.z.string(), zod.z.number()]))
 ]);
-var WidgetSizeEnum = zod.z.enum([
-	"xs",
-	"sm",
-	"md",
-	"lg",
-	"xl"
+var AutomationRunOutcomeSchema = zod.z.enum([
+	"ran",
+	"skipped-trigger",
+	"skipped-conditions",
+	"skipped-cooldown",
+	"skipped-overlap",
+	"failed",
+	"aborted"
 ]);
-/**
-* MF remote descriptor — mirrors `UiContributionRemote` from
-* `capability-definition.ts`. Widget remotes expose a single
-* `'./widgets'` module whose default export is a
-* `Record<componentKey, Component>` map; `componentKey` (the widget
-* `stableId`) picks the entry the host mounts.
-*/
-var WidgetRemoteSchema = zod.z.object({
-	remoteName: zod.z.string(),
-	exposedModule: zod.z.string(),
-	componentKey: zod.z.string().optional()
+/** `not-evaluated` = a short-circuit never reached the node. */
+var TraceNodeOutcomeSchema = zod.z.enum([
+	"pass",
+	"fail",
+	"not-evaluated"
+]);
+var AutomationTriggerTraceSchema = zod.z.object({
+	kind: zod.z.string().min(1),
+	outcome: zod.z.enum(["pass", "fail"]),
+	/** Why an event was rejected ("class person not in [dog]") or what fired. */
+	reason: zod.z.string(),
+	/** deviceId, className, trackId, score … — only what the trigger exposes. */
+	vars: zod.z.record(zod.z.string(), TraceValueSchema)
 });
-/**
-* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
-* widget-only metadata. The `UiContribution` core fields:
-*
-*  - `tab`     — where the widget hosts. A widget that runs on the
-*                dashboard declares `tab:'dashboard'`; a device-tab
-*                widget declares the target device-detail tab id.
-*  - `subTab`  — optional sub-tab within `tab`.
-*  - `label`   — operator-facing label.
-*  - `order`   — ordering within `(tab, subTab)`.
-*  - `kind`    — always `'remote'` for widgets.
-*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
-*
+var AutomationConditionTraceNodeSchema = zod.z.object({
+	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	path: zod.z.string().min(1),
+	kind: zod.z.enum([
+		"all",
+		"any",
+		"not",
+		"condition",
+		"expression"
+	]),
+	outcome: TraceNodeOutcomeSchema,
+	reason: zod.z.string(),
+	deviceId: zod.z.number().int().optional(),
+	cap: zod.z.string().optional(),
+	fieldPath: zod.z.string().optional(),
+	operator: zod.z.string().optional(),
+	expected: TraceValueSchema.optional(),
+	/** What the mirror held; `null` when it held nothing (unknown). */
+	observed: TraceValueSchema.optional()
+});
+var AutomationRunVerdictSchema = zod.z.object({
+	mode: AutomationRunModeSchema,
+	decision: zod.z.enum([
+		"run",
+		"queued",
+		"restart",
+		"drop",
+		"cooldown",
+		"bypass"
+	]),
+	reason: zod.z.string()
+});
+/** One executed (or not-run) step — shared by automations and Action runs. */
+var AutomationStepTraceSchema = zod.z.object({
+	/** `actions.<i>` */
+	path: zod.z.string().min(1),
+	kind: zod.z.string().min(1),
+	cap: zod.z.string().optional(),
+	method: zod.z.string().optional(),
+	deviceId: zod.z.number().int().optional(),
+	startedAt: zod.z.number().optional(),
+	endedAt: zod.z.number().optional(),
+	outcome: zod.z.enum([
+		"ok",
+		"error",
+		"not-run"
+	]),
+	message: zod.z.string().optional()
+});
+var AutomationRunTraceSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	startedAt: zod.z.number(),
+	endedAt: zod.z.number(),
+	trigger: AutomationTriggerTraceSchema,
+	conditions: zod.z.array(AutomationConditionTraceNodeSchema),
+	verdict: AutomationRunVerdictSchema.optional(),
+	steps: zod.z.array(AutomationStepTraceSchema),
+	outcome: AutomationRunOutcomeSchema,
+	/** How many identical consecutive skips this trace stands for (>= 1). */
+	repeat: zod.z.number().int().min(1),
+	/** When the latest of those repeats happened. */
+	lastAt: zod.z.number()
+});
+/**
+* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
+* `action:<actionId>`): the cooldown stamp and the trace ring.
+*/
+var AutomationStateDocSchema = zod.z.object({
+	version: zod.z.literal(1),
+	lastRunStartedAt: zod.z.number().nullable(),
+	traces: zod.z.array(AutomationRunTraceSchema)
+});
+/** The state of an owner that never reported. */
+var EMPTY_AUTOMATION_STATE = {
+	version: 1,
+	lastRunStartedAt: null,
+	traces: []
+};
+function isSkippedTrace(trace) {
+	return trace.outcome.startsWith("skipped-");
+}
+/** Numbers vary between repeats of the same cause ("0.41 < 0.6" / "0.43 < 0.6"). */
+function normaliseReason(reason) {
+	return reason.replace(/\d+(\.\d+)?/g, "#");
+}
+/** Two skips with the same signature are the same event repeating. */
+function skipSignature(trace) {
+	return JSON.stringify([
+		trace.outcome,
+		trace.trigger.kind,
+		trace.trigger.outcome,
+		normaliseReason(trace.trigger.reason),
+		trace.verdict === void 0 ? null : [trace.verdict.decision, normaliseReason(trace.verdict.reason)],
+		trace.conditions.map((n) => [n.path, n.outcome])
+	]);
+}
+/**
+* `next` folded into `prev` when both are skips of the same signature (the
+* repeat count and the latest time move on), else null. Used by the block
+* BEFORE it sends, so a trigger that fails every few seconds costs one RPC per
+* flush, not one per skip; the ledger applies the same rule through
+* {@link appendTrace}.
+*/
+function mergeSkipTraces(prev, next) {
+	if (!isSkippedTrace(prev) || !isSkippedTrace(next)) return null;
+	if (skipSignature(prev) !== skipSignature(next)) return null;
+	return {
+		...prev,
+		repeat: prev.repeat + next.repeat,
+		lastAt: next.lastAt,
+		endedAt: next.endedAt
+	};
+}
+/**
+* Append a trace to a ring of at most `keep` entries, without mutating it.
+*
+*  - A skip identical to the previous trace is counted on that trace
+*    (`repeat`, `lastAt`), not appended.
+*  - When the ring is full, the oldest SKIPPED trace goes first; a real run is
+*    evicted only when every trace is a run. A noisy skip stream therefore
+*    cannot push the runs the operator is looking for out of the ring.
+*/
+function appendTrace(ring, trace, keep) {
+	const last = ring[ring.length - 1];
+	const merged = last === void 0 ? null : mergeSkipTraces(last, trace);
+	if (merged !== null) return [...ring.slice(0, -1), merged];
+	const next = [...ring, trace];
+	while (next.length > keep) {
+		const skipAt = next.findIndex((t, i) => i < next.length - 1 && isSkippedTrace(t));
+		next.splice(skipAt === -1 ? 0 : skipAt, 1);
+	}
+	return next;
+}
+/**
+* The trigger stage of a trace from the bag a trigger handed to `run()`:
+* primitives only (a device-state `to` that is an object is left out), minus the
+* bookkeeping keys `kind` and `at`.
+*/
+function buildTriggerTrace(trigger, outcome, reason) {
+	const vars = {};
+	for (const [key, value] of Object.entries(trigger)) {
+		if (key === "kind" || key === "at") continue;
+		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) vars[key] = value;
+	}
+	return {
+		kind: typeof trigger["kind"] === "string" ? trigger["kind"] : "unknown",
+		outcome,
+		reason,
+		vars
+	};
+}
+//#endregion
+//#region src/automation/action.ts
+/**
+* Actions — named, runnable things an operator (or an automation) can start,
+* declared as LIST ENTRIES, never as devices.
+*
+* An entry is either **internal** (a short list of cap/wait steps kept in the
+* hub's `actions` record kind) or declared by an addon through the
+* `action-source` collection (a Home Assistant script, a scene …). The one
+* surface the UI and automations talk to is the `actions` cap; it keeps no
+* catalog of its own (D3) — every `list` asks the providers live.
+*
+* This file is the data half: the entry schema, the variables an entry may
+* declare, and the pure resolution of the values a run was given. It holds no
+* runtime.
+*/
+/** What a variable's value is. `select` takes one of `options`. */
+var ActionVariableTypeSchema = zod.z.enum([
+	"string",
+	"number",
+	"boolean",
+	"select"
+]);
+var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ActionVariableValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]);
+/**
+* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
+* value) or `{{vars.name}}` (inside a string) in their args.
+*/
+var ActionVariableSchema = zod.z.object({
+	name: zod.z.string().regex(ACTION_VARIABLE_NAME_RE),
+	label: zod.z.string().min(1).max(120).optional(),
+	type: ActionVariableTypeSchema,
+	required: zod.z.boolean().optional(),
+	default: ActionVariableValueSchema.optional(),
+	/** The allowed values of a `select`. */
+	options: zod.z.array(zod.z.string().min(1)).min(1).optional()
+}).superRefine((v, ctx) => {
+	if (v.type === "select" && v.options === void 0) ctx.addIssue({
+		code: "custom",
+		message: "a select variable needs options",
+		path: ["options"]
+	});
+	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
+		code: "custom",
+		message: variableValueError(v, v.default) ?? "invalid default",
+		path: ["default"]
+	});
+});
+/** Why `value` is not a legal value for the variable, or null when it is. */
+function variableValueError(variable, value) {
+	switch (variable.type) {
+		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
+		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
+		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
+	}
+}
+/**
+* The values a run starts with: what the caller gave, checked against the
+* declaration, with defaults filled. A value the entry did not declare is
+* REFUSED — a typo in a variable name must not silently run with the default.
+*/
+function resolveActionVariables(declared, given) {
+	const decls = declared ?? [];
+	const provided = given ?? {};
+	for (const name of Object.keys(provided)) if (!decls.some((d) => d.name === name)) return {
+		ok: false,
+		error: `unknown variable "${name}"`
+	};
+	const values = {};
+	for (const decl of decls) {
+		const value = provided[decl.name] ?? decl.default;
+		if (value === void 0) {
+			if (decl.required === true) return {
+				ok: false,
+				error: `variable "${decl.name}" is required`
+			};
+			continue;
+		}
+		const error = variableValueError(decl, value);
+		if (error !== null) return {
+			ok: false,
+			error
+		};
+		values[decl.name] = value;
+	}
+	return {
+		ok: true,
+		values
+	};
+}
+var ActionSourceKindSchema = zod.z.enum(["internal", "addon"]);
+/** Prefix of an internal action's id. */
+var INTERNAL_ACTION_PREFIX = "internal:";
+function internalActionId(uuid) {
+	return `${INTERNAL_ACTION_PREFIX}${uuid}`;
+}
+function isInternalActionId(actionId) {
+	return actionId.startsWith("internal:") && actionId.length > 9;
+}
+/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
+function addonIdOfActionId(actionId) {
+	if (isInternalActionId(actionId)) return null;
+	const at = actionId.indexOf(":");
+	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
+}
+var ActionStatusSchema = zod.z.object({
+	isRunning: zod.z.boolean(),
+	/** Ms epoch the latest run STARTED; null when it never ran. */
+	lastRunAt: zod.z.number().nullable(),
+	/** The latest run's failure; null on success or when it never ran. */
+	lastError: zod.z.string().nullable()
+});
+var IDLE_ACTION_STATUS = {
+	isRunning: false,
+	lastRunAt: null,
+	lastError: null
+};
+var ActionEntrySchema = zod.z.object({
+	/** `internal:<uuid>` or `<addonId>:<localId>`. */
+	id: zod.z.string().min(3),
+	name: zod.z.string().min(1).max(120),
+	/** The addon that declared it; `core-blocks` for an internal one. */
+	addonId: zod.z.string().min(1),
+	source: ActionSourceKindSchema,
+	/** An addon-declared entry is edited where it was declared. */
+	readOnly: zod.z.boolean(),
+	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
+	steps: zod.z.array(ActionStepSchema).min(1).max(50).optional(),
+	variables: zod.z.array(ActionVariableSchema).max(20).optional(),
+	status: ActionStatusSchema
+}).superRefine((entry, ctx) => {
+	if (entry.source === "internal") {
+		if (!isInternalActionId(entry.id)) ctx.addIssue({
+			code: "custom",
+			message: "an internal action id is internal:<uuid>",
+			path: ["id"]
+		});
+		return;
+	}
+	if (entry.steps !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "only an internal action carries steps",
+		path: ["steps"]
+	});
+	if (!entry.readOnly) ctx.addIssue({
+		code: "custom",
+		message: "an addon action is read-only here",
+		path: ["readOnly"]
+	});
+	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
+		code: "custom",
+		message: "an addon action id is <addonId>:<localId>",
+		path: ["id"]
+	});
+});
+/** What an operator writes for an internal action. */
+var ActionInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120),
+	steps: zod.z.array(ActionStepSchema).min(1).max(50),
+	variables: zod.z.array(ActionVariableSchema).max(20).optional()
+});
+/** Who started a run. Absent = the operator pressed it. */
+var ActionRunOriginSchema = zod.z.object({ 
+/** The automation block whose step started it. */
+blockId: zod.z.string().min(1).optional() });
+/** `started` = the caller did not ask to wait. */
+var ActionRunOutcomeSchema = zod.z.union([AutomationRunOutcomeSchema, zod.z.literal("started")]);
+var ActionRunResultSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	outcome: ActionRunOutcomeSchema,
+	/** Why it did not run, or what failed. */
+	message: zod.z.string().optional()
+});
+var ActionErrorCodeSchema = zod.z.enum([
+	"not-found",
+	"read-only",
+	"invalid-variables",
+	"invalid-steps",
+	"not-linked",
+	"busy"
+]);
+/**
+* A refusal with a reason a caller can branch on. The code leads the message
+* (`[read-only] …`) because a cap call flattens an error to its text.
+*/
+var ActionError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(`[${code}] ${message}`);
+		this.name = "ActionError";
+		this.code = code;
+	}
+};
+/** The run-state change `actions.onRunChanged` carries. */
+var ActionRunChangedSchema = zod.z.object({
+	actionId: zod.z.string(),
+	runId: zod.z.string(),
+	isRunning: zod.z.boolean(),
+	/** Set when the run ended. */
+	outcome: AutomationRunOutcomeSchema.optional(),
+	lastRunAt: zod.z.number().nullable(),
+	lastError: zod.z.string().nullable()
+});
+//#endregion
+//#region src/automation/step-runner.ts
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function runSteps(steps, options) {
+	const traces = [];
+	let failed = false;
+	let aborted = false;
+	for (const [index, step] of steps.entries()) {
+		const path = `${options.pathPrefix}.${index}`;
+		if (failed || aborted || options.isAborted()) {
+			if (!failed) aborted = true;
+			traces.push({
+				...step.meta,
+				path,
+				outcome: "not-run",
+				message: failed ? "an earlier step failed" : options.abortReason
+			});
+			continue;
+		}
+		const startedAt = options.now();
+		let deviceId = step.meta.deviceId;
+		const scope = { setDeviceId: (id) => {
+			deviceId = id;
+		} };
+		try {
+			await step.run(scope);
+			traces.push({
+				...step.meta,
+				...deviceId === void 0 ? {} : { deviceId },
+				path,
+				startedAt,
+				endedAt: options.now(),
+				outcome: "ok"
+			});
+		} catch (err) {
+			failed = true;
+			const message = errorMessage(err);
+			options.onFailure({
+				index,
+				path,
+				message,
+				deviceId
+			});
+			traces.push({
+				...step.meta,
+				...deviceId === void 0 ? {} : { deviceId },
+				path,
+				startedAt,
+				endedAt: options.now(),
+				outcome: "error",
+				message
+			});
+		}
+	}
+	return {
+		steps: traces,
+		failed,
+		aborted: aborted && !failed
+	};
+}
+function isVarRef(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && keys[0] === "$var" && typeof Reflect.get(value, "$var") === "string";
+}
+var TEMPLATE_RE = /\{\{\s*vars\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+/**
+* Substitute a step's args from the run's variables. SUBSTITUTION only, never
+* evaluation:
+*  - a value that is exactly `{ $var: 'name' }` becomes the variable's value,
+*    keeping its type (a number stays a number);
+*  - `{{vars.name}}` inside a string becomes its text.
+* A variable that is not set THROWS — a step must not run with a hole where
+* the operator meant a value. (`{{vars.x}}` keeps the automation behaviour:
+* the hole is reported through `onMissing` and rendered empty.)
+*/
+function resolveStepArgs(value, vars, onMissing) {
+	if (isVarRef(value)) {
+		const found = vars[value.$var];
+		if (found === void 0) throw new Error(`variable "${value.$var}" is not set`);
+		return found;
+	}
+	if (typeof value === "string") return value.replace(TEMPLATE_RE, (_m, key) => {
+		const v = vars[key];
+		if (v === void 0) {
+			onMissing(key);
+			return "";
+		}
+		return String(v);
+	});
+	if (Array.isArray(value)) return value.map((v) => resolveStepArgs(v, vars, onMissing));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, resolveStepArgs(v, vars, onMissing)]));
+	return value;
+}
+/** A `{ $var }` device target, resolved from the bag BEFORE dispatch. */
+function resolveDeviceTarget(vars, name) {
+	const raw = vars[name];
+	if (typeof raw === "number") return raw;
+	throw new Error(`action target var "${name}" is not a device id`);
+}
+function stepMetaOfAction(step) {
+	if (step.kind === "wait") return { kind: "wait" };
+	return {
+		kind: "cap",
+		cap: step.cap,
+		method: step.method,
+		...typeof step.deviceId === "number" ? { deviceId: step.deviceId } : {}
+	};
+}
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* The runnable form of an internal Action's steps, bound to one run's
+* variables. Variables are substituted per step, at the moment it runs, so a
+* missing one fails THAT step (traced) and leaves the later ones not-run.
+*/
+function buildActionSteps(steps, vars, deps) {
+	return steps.map((step) => {
+		const meta = stepMetaOfAction(step);
+		if (step.kind === "wait") return {
+			meta,
+			run: () => deps.sleep(step.seconds * 1e3)
+		};
+		return {
+			meta,
+			run: async (scope) => {
+				const resolved = resolveStepArgs(step.args ?? {}, vars, deps.onMissingVar);
+				const args = isPlainRecord(resolved) ? resolved : {};
+				const targets = typeof step.deviceId === "number" ? [step.deviceId] : Array.isArray(step.deviceId) ? step.deviceId : [resolveDeviceTarget(vars, step.deviceId.$var)];
+				for (const deviceId of targets) {
+					scope.setDeviceId(deviceId);
+					await deps.invokeCap({
+						deviceId,
+						cap: step.cap,
+						method: step.method,
+						args
+					});
+				}
+			}
+		};
+	});
+}
+//#endregion
+//#region src/capabilities/addon-pages.cap.ts
+/**
+* `addon-pages` — system-scoped singleton aggregator cap. Public-facing
+* surface that admin-ui consumes through `useAddonPagesListPages()`.
+*
+* The provider iterates every `addon-pages-source` (collection) provider
+* and emits `AddonPageInfo[]` enriched with versioned `bundleUrl` strings
+* pointing at `/api/addon-pages/<addonId>/<bundle>?v=<mtime>`. The
+* filesystem `mtime` cache-buster lets the browser pick up addon
+* rebuilds without manual reload.
+*
+* The hub-local builtin `addon-pages-aggregator` (see
+* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* provider. Splitting the public aggregator from the raw collection
+* keeps both ends in codegen — there's no hand-written
+* `addon-pages.router.ts` wrapper anymore.
+*/
+var AddonPageDeclarationSchema$1 = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	path: zod.z.string(),
+	remoteName: zod.z.string(),
+	bundle: zod.z.string(),
+	section: zod.z.string().optional(),
+	sectionLabel: zod.z.string().optional()
+});
+var AddonPageInfoSchema = zod.z.object({
+	addonId: zod.z.string(),
+	page: AddonPageDeclarationSchema$1,
+	bundleUrl: zod.z.string()
+});
+var addonPagesCapability = {
+	name: "addon-pages",
+	scope: "system",
+	mode: "singleton",
+	methods: { listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageInfoSchema).readonly()) }
+};
+//#endregion
+//#region src/capabilities/addon-pages-source.cap.ts
+/**
+* `addon-pages-source` — collection cap exposing per-provider raw page
+* declarations. Every addon that contributes a UI page registers a
+* provider here. The hub-side singleton aggregator (`addon-pages` cap,
+* see `addon-pages.cap.ts`) walks this collection, stamps versioned
+* `bundleUrl` values, and returns the enriched `AddonPageInfo[]` list
+* that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape than the per-provider raw declarations, and we want both ends
+* to flow through codegen instead of relying on a hand-written wrapper.
+*/
+var AddonPageDeclarationSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	path: zod.z.string(),
+	/**
+	* Module Federation remote name — must match the `name` field on the
+	* page addon's `federation()` plugin config. Used by admin-ui's
+	* `<AddonPageLoader>` to call `loadRemote('<remoteName>/page')`.
+	* Conventionally `addon_<id>_page` (snake_case; MF names cannot
+	* contain hyphens).
+	*/
+	remoteName: zod.z.string(),
+	/**
+	* Bundle filename inside the addon's `dist/` dir served at
+	* `/api/addon-pages/<addonId>/<bundle>`. With Module Federation this
+	* is always `'remoteEntry.js'`; the value is kept on the metadata so
+	* the static-file route can compute an mtime-based cache-buster URL
+	* without a separate filesystem stat.
+	*/
+	bundle: zod.z.string(),
+	/**
+	* Sidebar section this page docks into. Well-known ids: `'detection'`,
+	* `'cluster'`, `'administration'` — the page renders inside that group.
+	* Any OTHER string creates (or joins) a custom section rendered after
+	* the built-in groups; its label comes from `sectionLabel` (first
+	* declaration wins), falling back to the id. Absent → the legacy
+	* "Addon Pages" group.
+	*/
+	section: zod.z.string().optional(),
+	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
+	sectionLabel: zod.z.string().optional()
+});
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: require_sleep.method(zod.z.void(), zod.z.array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
+};
+//#endregion
+//#region src/capabilities/addon-routes.cap.ts
+var AddonHttpRouteSchema = zod.z.object({
+	method: zod.z.enum([
+		"GET",
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]),
+	path: zod.z.string(),
+	access: zod.z.enum([
+		"public",
+		"authenticated",
+		"admin"
+	]).optional(),
+	description: zod.z.string().optional(),
+	/** The hub limits this route per client address before the handler runs. */
+	rateLimit: zod.z.enum(["auth"]).optional()
+});
+/**
+* Cross-process route invocation envelope. The hub captures the
+* request as plain data, ships it to the worker via Moleculer, and
+* the worker runs the local handler against a capturing reply. The
+* envelope returned describes what the handler intended (status,
+* headers, body, or a redirect) so the hub can translate it back to
+* the Fastify reply that's actually wired to the socket.
+*/
+var InvokeRequestSchema = zod.z.object({
+	method: zod.z.string(),
+	path: zod.z.string(),
+	params: zod.z.record(zod.z.string(), zod.z.string()),
+	query: zod.z.record(zod.z.string(), zod.z.string()),
+	body: zod.z.unknown(),
+	headers: zod.z.record(zod.z.string(), zod.z.string()),
+	user: zod.z.object({
+		id: zod.z.string(),
+		username: zod.z.string(),
+		isAdmin: zod.z.boolean()
+	}).optional(),
+	scopedToken: zod.z.unknown().optional()
+});
+var InvokeReplyEnvelopeSchema = zod.z.object({
+	status: zod.z.number().int(),
+	headers: zod.z.record(zod.z.string(), zod.z.string()),
+	/** When set, the hub MUST `reply.redirect(redirectUrl)` instead of
+	*  sending `body`. Status defaults to 302 when this is set unless
+	*  the handler called `reply.code(...)` explicitly. */
+	redirectUrl: zod.z.string().nullable(),
+	/** JSON-serializable body. `undefined` is treated as "no body". */
+	body: zod.z.unknown().optional(),
+	/** Set when the handler called `reply.type(mime)`. */
+	contentType: zod.z.string().optional()
+});
+var addonRoutesCapability = {
+	name: "addon-routes",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: {
+		getRoutes: require_sleep.method(zod.z.void(), zod.z.array(AddonHttpRouteSchema)),
+		/**
+		* Cross-process dispatch entry point. Forked addons implement this
+		* (via `buildAddonRouteProvider`) so the hub's Fastify catch-all
+		* can route through Moleculer when the handler lives in a worker.
+		*
+		* Local addons can implement it for free with the same helper;
+		* the hub bypasses the wire on co-located addons.
+		*/
+		invoke: require_sleep.method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
+	},
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	mount: { kind: "skip" }
+};
+//#endregion
+//#region src/capabilities/addon-settings.cap.ts
+var ConfigTabDeclarationSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	order: zod.z.number().optional()
+});
+var ConfigSectionWithValuesSchema = zod.z.object({
+	id: zod.z.string(),
+	title: zod.z.string(),
+	titleKey: zod.z.string().optional(),
+	description: zod.z.string().optional(),
+	descriptionKey: zod.z.string().optional(),
+	style: zod.z.enum(["card", "accordion"]).optional(),
+	defaultCollapsed: zod.z.boolean().optional(),
+	columns: zod.z.union([
+		zod.z.literal(1),
+		zod.z.literal(2),
+		zod.z.literal(3),
+		zod.z.literal(4)
+	]).optional(),
+	tab: zod.z.string().optional(),
+	location: zod.z.enum([
+		"settings",
+		"top-tab",
+		"hero"
+	]).optional(),
+	order: zod.z.number().optional(),
+	fields: zod.z.array(zod.z.any())
+});
+var SettingsSchemaWithValuesSchema = zod.z.object({
+	tabs: zod.z.array(ConfigTabDeclarationSchema).optional(),
+	sections: zod.z.array(ConfigSectionWithValuesSchema)
+});
+/** Patch object — keys are field names, values are the new field values. */
+var SettingsPatchSchema = zod.z.record(zod.z.string(), zod.z.unknown());
+/** Standard success response for update operations. */
+var SettingsUpdateResultSchema = zod.z.object({ success: zod.z.literal(true) });
+/**
+* addon-settings — singleton gateway for three-level addon settings.
+*
+* Works like `device-manager`: a single hub-side provider that resolves
+* `addonId` to the target addon and delegates the call. For hub-local
+* addons the call is direct; for remote agents it proxies via the
+* per-addon Moleculer service.
+*
+* Replaces the `$addonHost` Moleculer service. Transport transparency
+* is handled by the provider implementation — callers (admin UI, other
+* addons via `ctx.api`) never know which node hosts the target addon.
+*
+* Three levels:
+*   - **addon**: addon-scoped settings (installation config, API keys, …)
+*   - **global**: settings applied to all devices by default
+*   - **device**: per-device overrides
+*
+* Optional `nodeId` allows explicit node targeting. When absent the
+* provider resolves the addon's host node automatically.
+*/
+/**
+* `addon-settings` is a **hub-centric** cap: the hub hosts the single
+* provider, and `nodeId` in the input is data for the hub provider's
+* internal dispatcher, not a routing hint for the cap-router. See
+* `CapabilityDefinition.nodeIdMode` for the contract.
+*/
+var addonSettingsCapability = {
+	name: "addon-settings",
+	scope: "system",
+	mode: "singleton",
+	nodeIdMode: "data",
+	methods: {
+		getGlobalSettings: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			nodeId: zod.z.string().optional(),
+			overlay: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+			cap: zod.z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateGlobalSettings: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			nodeId: zod.z.string().optional(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getIntegrationSettings: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			nodeId: zod.z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		getDeviceSettings: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			deviceId: zod.z.number(),
+			nodeId: zod.z.string().optional()
+		}), SettingsSchemaWithValuesSchema.nullable()),
+		updateDeviceSettings: require_sleep.method(zod.z.object({
+			addonId: zod.z.string(),
+			deviceId: zod.z.number(),
+			nodeId: zod.z.string().optional(),
+			patch: SettingsPatchSchema
+		}), SettingsUpdateResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/addon-widgets-source.cap.ts
+/**
+* `addon-widgets-source` — collection cap exposing per-addon raw widget
+* declarations. Mirrors the addon-pages split: every addon shipping
+* widgets registers a provider on this collection cap; the hub-local
+* aggregator (`addon-widgets`, see `addon-widgets.cap.ts`) walks the
+* collection, stamps versioned `bundleUrl`s onto each declaration, and
+* exposes the public listing surface that admin-ui consumes.
+*
+* The split exists because the public listing has a different output
+* shape (flat enriched metadata with `addonId` + `bundleUrl`) than the
+* per-provider raw declarations. Both ends flow through codegen.
+*
+* Unified UI-contribution model (Task 10): a widget descriptor IS a
+* `UiContribution` with `kind:'remote'`. The host renders it through the
+* same `ContributionRenderer` / Module-Federation path as every other
+* contributed UI surface — no bespoke widget-rendering path. The widget-
+* only metadata (sizing hints, `requires`) lives as extra fields on the
+* descriptor; the `UiContribution` core (`tab` / `label` / `order` /
+* `kind` / `remote`) carries identity + placement + the MF remote.
+*/
+/** Where the widget makes sense to render — maps to a contribution `tab`. */
+var WidgetHostEnum = zod.z.enum([
+	"device-tab",
+	"dashboard",
+	"integration-detail"
+]);
+var WidgetSizeEnum = zod.z.enum([
+	"xs",
+	"sm",
+	"md",
+	"lg",
+	"xl"
+]);
+/**
+* MF remote descriptor — mirrors `UiContributionRemote` from
+* `capability-definition.ts`. Widget remotes expose a single
+* `'./widgets'` module whose default export is a
+* `Record<componentKey, Component>` map; `componentKey` (the widget
+* `stableId`) picks the entry the host mounts.
+*/
+var WidgetRemoteSchema = zod.z.object({
+	remoteName: zod.z.string(),
+	exposedModule: zod.z.string(),
+	componentKey: zod.z.string().optional()
+});
+/**
+* One widget declaration — a `UiContribution` (`kind:'remote'`) plus
+* widget-only metadata. The `UiContribution` core fields:
+*
+*  - `tab`     — where the widget hosts. A widget that runs on the
+*                dashboard declares `tab:'dashboard'`; a device-tab
+*                widget declares the target device-detail tab id.
+*  - `subTab`  — optional sub-tab within `tab`.
+*  - `label`   — operator-facing label.
+*  - `order`   — ordering within `(tab, subTab)`.
+*  - `kind`    — always `'remote'` for widgets.
+*  - `remote`  — the MF remote `{ remoteName, exposedModule, componentKey }`.
+*
 * Widget-only fields retained alongside the contribution core:
 *
 *  - `stableId`      — stable identity within the addon (the MF
@@ -16238,7 +18075,29 @@ var coreBlocksCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "view"
-		})
+		}),
+		/**
+		* An automation block reports one run (or one coalesced skip) to the hub's
+		* `runs` ledger. Only the block itself may: the transport stamps
+		* `callerAddonId`, and anything but `core-block-<blockId>` is refused.
+		* `keepTraces` bounds the ring; `runStartedAt` moves the cooldown stamp.
+		*/
+		reportAutomationRun: require_sleep.method(zod.z.object({
+			blockId: zod.z.string().min(1),
+			trace: AutomationRunTraceSchema.optional(),
+			runStartedAt: zod.z.number().optional(),
+			keepTraces: zod.z.number().int().min(1).max(100).optional()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The cooldown stamp and trace ring a block reads ONCE, at start. Owner-only. */
+		getAutomationRunState: require_sleep.method(zod.z.object({ blockId: zod.z.string().min(1) }), AutomationStateDocSchema, { auth: "admin" }),
+		/** An automation's run traces, newest last. The operator's read. */
+		getTraces: require_sleep.method(zod.z.object({ blockId: zod.z.string().min(1) }), zod.z.object({
+			traces: zod.z.array(AutomationRunTraceSchema),
+			lastError: zod.z.string().nullable()
+		}), { auth: "admin" })
 	}
 };
 //#endregion
@@ -44255,683 +46114,291 @@ var NotificationActionIconSchema = zod.z.enum([
 	"arm-night",
 	"disarm",
 	"light",
-	"alert",
-	"camera"
-]);
-/** A single tap-through action button. */
-var NotificationActionSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	url: zod.z.string().optional(),
-	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
-	icon: NotificationActionIconSchema.optional(),
-	/**
-	* Renders in a warning style where the notifier supports it.
-	*
-	* A HINT, never a gate. The callback's authority is its token and nothing
-	* else — see `notification-center/action-token.ts` for what that does and
-	* does not buy.
-	*/
-	destructive: zod.z.boolean().optional(),
-	/**
-	* How the tap should REACH the url.
-	*
-	* `navigate` (absent, and every button authored before this field) opens it:
-	* the phone leaves the notification and shows whatever the callback returns.
-	* That is right for a button whose answer the operator wants to read.
-	*
-	* `background` fires it as a POST and stays put. It exists for the buttons
-	* whose whole point is not to interrupt — "silence this for 30 minutes" is
-	* an answer to the notification, and being thrown into a browser tab to
-	* confirm it costs more attention than the notification did. A backend that
-	* cannot do a background call renders it as an ordinary link (the adapters
-	* fall back rather than dropping the button), so this is a preference, never
-	* a requirement.
-	*/
-	mode: zod.z.enum(["navigate", "background"]).optional()
-});
-/**
-* The canonical notification. `body` is the only hard field (Apprise model).
-* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
-* NOT a fixed severity enum — each kind declares its own `caps.levels` and
-* the adapter maps this ordinal onto its native level. `level?` is an
-* optional kind-native level id (`emergency`, `silent`, …) that overrides
-* `priority` for that one target.
-*/
-var NotificationSchema = zod.z.object({
-	body: zod.z.string(),
-	title: zod.z.string().optional(),
-	format: NotificationFormatSchema.default("text"),
-	priority: zod.z.number().int().min(1).max(5).default(3),
-	level: zod.z.string().optional(),
-	attachments: zod.z.array(AttachmentSchema).optional(),
-	clickUrl: zod.z.string().optional(),
-	actions: zod.z.array(NotificationActionSchema).optional(),
-	sound: zod.z.string().optional(),
-	ttl: zod.z.number().optional(),
-	tag: zod.z.string().optional(),
-	deviceId: zod.z.number().optional(),
-	eventId: zod.z.string().optional(),
-	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
-});
-/** One declared native severity/priority level for a kind. */
-var TargetKindLevelSchema = zod.z.object({
-	id: zod.z.string(),
-	label: zod.z.string(),
-	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
-	ordinal: zod.z.number().int().min(1).max(5).nullable(),
-	flags: zod.z.object({
-		critical: zod.z.boolean().optional(),
-		silent: zod.z.boolean().optional(),
-		noPush: zod.z.boolean().optional()
-	}).optional(),
-	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
-	requires: zod.z.array(zod.z.string()).optional(),
-	description: zod.z.string().optional()
-});
-/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
-var TargetKindAttachmentsCapsSchema = zod.z.object({
-	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
-	mode: zod.z.enum([
-		"url",
-		"bytes",
-		"both"
-	]),
-	max: zod.z.number().int().nonnegative(),
-	maxBytes: zod.z.number().int().positive().optional()
-});
-/** The full capability block consulted before dispatch. */
-var TargetKindCapsSchema = zod.z.object({
-	attachments: TargetKindAttachmentsCapsSchema,
-	/** Max action buttons (0 = none). */
-	actions: zod.z.number().int().nonnegative(),
-	/**
-	* Whether this kind renders a per-action ICON.
-	*
-	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
-	* run on the addon cap path — three production failures in one day taught
-	* this repo that once. Absent is read as false by the degrade engine, which
-	* is the safe direction: an icon that is not rendered costs nothing, an icon
-	* assumed and dropped costs the operator's trust in the field.
-	*/
-	actionIcons: zod.z.boolean().optional(),
-	levels: zod.z.array(TargetKindLevelSchema),
-	format: zod.z.array(NotificationFormatSchema),
-	clickUrl: zod.z.boolean(),
-	sound: zod.z.boolean(),
-	ttl: zod.z.boolean(),
-	bodyMaxLen: zod.z.number().int().positive()
-});
-/**
-* `configSchema` is a `ConfigUISchema` tree passed through to the admin
-* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
-* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
-* the union is large and not meant for runtime validation here; the exported
-* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
-*/
-var ConfigSchemaPassthrough$2 = zod.z.unknown();
-var TargetKindSchema = zod.z.object({
-	kind: zod.z.string(),
-	label: zod.z.string(),
-	icon: zod.z.string(),
-	/** Stamped by each provider so the concat-fanned catalog stays routable. */
-	addonId: zod.z.string(),
-	/**
-	* URL of the kind's bundled BRAND icon, served by the providing addon over
-	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
-	* when the addon bundles no icon for that kind — the client then falls back
-	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
-	*
-	* Root-relative on purpose: it resolves against whatever origin serves a web
-	* client, and a native client joins it onto its own hub base.
-	*
-	* DECLARED here deliberately. It used to travel as an undeclared passthrough
-	* field that survived only because the runtime cap-router forwards provider
-	* output verbatim — so every consumer had to re-declare it by hand to stop
-	* its own Zod parse from stripping it, and the whole arrangement would have
-	* broken silently the moment output validation was tightened anywhere.
-	*/
-	iconUrl: zod.z.string().optional(),
-	/**
-	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
-	*
-	* The server knows this and therefore says it, because the client cannot
-	* safely guess: a React-Native client renders SVG and raster through two
-	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
-	* not decode SVG on iOS/Android), so without this it silently fell back to a
-	* placeholder glyph for every vector icon while the web build looked fine.
-	*
-	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
-	* not been updated — a client that cannot determine the type should prefer
-	* its raster path, which is the safe default for an unknown image.
-	*/
-	iconMediaType: zod.z.string().optional(),
-	configSchema: ConfigSchemaPassthrough$2,
-	/**
-	* The config keys that decide WHERE this kind's secrets are sent (server,
-	* base URL, instance, chat, recipient). A save that changes any of them
-	* while leaving a secret redacted is refused by the provider (D634), so an
-	* editor uses this to ask for the secret on exactly those edits instead of
-	* on every edit.
-	*
-	* Optional: absent from a provider that holds no secret (the Home Assistant
-	* kinds) and from a provider older than this field — an editor that finds
-	* it absent must assume ANY edit may need the secret.
-	*/
-	destinationKeys: zod.z.array(zod.z.string()).optional(),
-	supportsDiscovery: zod.z.boolean(),
-	caps: TargetKindCapsSchema
-});
-/**
-* A persisted target. `config` holds secrets; providers REDACT secret fields
-* (return a presence marker only) when serving `listTargets` — never
-* round-trip a stored secret to the UI.
-*/
-var TargetSchema = zod.z.object({
-	id: zod.z.string(),
-	name: zod.z.string(),
-	kind: zod.z.string(),
-	addonId: zod.z.string(),
-	enabled: zod.z.boolean(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** A discovery-surfaced candidate (config is partial + non-secret). */
-var DiscoveredTargetSchema = zod.z.object({
-	kind: zod.z.string(),
-	suggestedName: zod.z.string(),
-	config: zod.z.record(zod.z.string(), zod.z.unknown())
-});
-/** The degrade engine's report — what was resolved / dropped / degraded. */
-var RenderedAsSchema = zod.z.object({
-	level: zod.z.string(),
-	format: NotificationFormatSchema,
-	attachmentsSent: zod.z.number().int().nonnegative(),
-	actionsSent: zod.z.number().int().nonnegative(),
-	truncated: zod.z.boolean(),
-	dropped: zod.z.array(zod.z.string())
-});
-var SendResultSchema = zod.z.object({
-	success: zod.z.boolean(),
-	error: zod.z.string().optional(),
-	renderedAs: RenderedAsSchema.optional()
-});
-/** Same shape as SendResult — kept as a distinct name for the test panel. */
-var TestResultSchema = SendResultSchema;
-/**
-* Pre-save credential probe against a partial (unsaved) target config.
-* `resolvedUrl` never includes secrets (token stripped from path).
-*/
-var ProbeTargetConfigResultSchema = zod.z.object({
-	ok: zod.z.boolean(),
-	resolvedUrl: zod.z.string(),
-	httpStatus: zod.z.number().int().optional(),
-	stateInstance: zod.z.string().optional(),
-	error: zod.z.string().optional()
-});
-var notificationOutputCapability = {
-	name: "notification-output",
-	scope: "system",
-	mode: "collection",
-	methods: {
-		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
-		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
-		/**
-		* One target WITH secrets — admin edit / duplicate hydration only.
-		* `listTargets` stays redacted; the editor loads this so password fields
-		* are filled (masked in the input) and a save can round-trip the token
-		* when a destination changes (Duplicate with a new chatId, etc.).
-		*/
-		getTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }),
-		discoverTargets: require_sleep.method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
-			/**
-			* When editing / duplicating, the blank password field never round-trips
-			* the stored token. Pass the source target id so the provider can restore
-			* secrets server-side before dialling (same merge as upsert).
-			*/
-			targetId: zod.z.string().optional()
-		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
-		probeTargetConfig: require_sleep.method(zod.z.object({
-			kind: zod.z.string(),
-			config: zod.z.record(zod.z.string(), zod.z.unknown()),
-			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-			targetId: zod.z.string().optional()
-		}), ProbeTargetConfigResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		send: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			notification: NotificationSchema
-		}), SendResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		testTarget: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			sample: NotificationSchema.optional()
-		}), TestResultSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		upsertTarget: require_sleep.method(zod.z.object({
-			target: TargetSchema,
-			/**
-			* Duplicate flow: create a NEW target id while copying secrets from an
-			* existing row. The UI never holds the stored token; blank / redacted
-			* password fields are restored from this source (D634 still applies if
-			* destinations diverge without a re-typed secret).
-			*/
-			cloneSecretsFrom: zod.z.string().optional()
-		}), TargetSchema, {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		}),
-		setTargetEnabled: require_sleep.method(zod.z.object({
-			targetId: zod.z.string(),
-			enabled: zod.z.boolean()
-		}), zod.z.void(), {
-			kind: "mutation",
-			auth: "admin"
-		})
-	}
-};
-//#endregion
-//#region src/catalogs/coco-classmap.ts
-var COCO_80_LABELS = [
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "bicycle",
-		name: "Bicycle"
-	},
-	{
-		id: "car",
-		name: "Car"
-	},
-	{
-		id: "motorcycle",
-		name: "Motorcycle"
-	},
-	{
-		id: "airplane",
-		name: "Airplane"
-	},
-	{
-		id: "bus",
-		name: "Bus"
-	},
-	{
-		id: "train",
-		name: "Train"
-	},
-	{
-		id: "truck",
-		name: "Truck"
-	},
-	{
-		id: "boat",
-		name: "Boat"
-	},
-	{
-		id: "traffic light",
-		name: "Traffic Light"
-	},
-	{
-		id: "fire hydrant",
-		name: "Fire Hydrant"
-	},
-	{
-		id: "stop sign",
-		name: "Stop Sign"
-	},
-	{
-		id: "parking meter",
-		name: "Parking Meter"
-	},
-	{
-		id: "bench",
-		name: "Bench"
-	},
-	{
-		id: "bird",
-		name: "Bird"
-	},
-	{
-		id: "cat",
-		name: "Cat"
-	},
-	{
-		id: "dog",
-		name: "Dog"
-	},
-	{
-		id: "horse",
-		name: "Horse"
-	},
-	{
-		id: "sheep",
-		name: "Sheep"
-	},
-	{
-		id: "cow",
-		name: "Cow"
-	},
-	{
-		id: "elephant",
-		name: "Elephant"
-	},
-	{
-		id: "bear",
-		name: "Bear"
-	},
-	{
-		id: "zebra",
-		name: "Zebra"
-	},
-	{
-		id: "giraffe",
-		name: "Giraffe"
-	},
-	{
-		id: "backpack",
-		name: "Backpack"
-	},
-	{
-		id: "umbrella",
-		name: "Umbrella"
-	},
-	{
-		id: "handbag",
-		name: "Handbag"
-	},
-	{
-		id: "tie",
-		name: "Tie"
-	},
-	{
-		id: "suitcase",
-		name: "Suitcase"
-	},
-	{
-		id: "frisbee",
-		name: "Frisbee"
-	},
-	{
-		id: "skis",
-		name: "Skis"
-	},
-	{
-		id: "snowboard",
-		name: "Snowboard"
-	},
-	{
-		id: "sports ball",
-		name: "Sports Ball"
-	},
-	{
-		id: "kite",
-		name: "Kite"
-	},
-	{
-		id: "baseball bat",
-		name: "Baseball Bat"
-	},
-	{
-		id: "baseball glove",
-		name: "Baseball Glove"
-	},
-	{
-		id: "skateboard",
-		name: "Skateboard"
-	},
-	{
-		id: "surfboard",
-		name: "Surfboard"
-	},
-	{
-		id: "tennis racket",
-		name: "Tennis Racket"
-	},
-	{
-		id: "bottle",
-		name: "Bottle"
-	},
-	{
-		id: "wine glass",
-		name: "Wine Glass"
-	},
-	{
-		id: "cup",
-		name: "Cup"
-	},
-	{
-		id: "fork",
-		name: "Fork"
-	},
-	{
-		id: "knife",
-		name: "Knife"
-	},
-	{
-		id: "spoon",
-		name: "Spoon"
-	},
-	{
-		id: "bowl",
-		name: "Bowl"
-	},
-	{
-		id: "banana",
-		name: "Banana"
-	},
-	{
-		id: "apple",
-		name: "Apple"
-	},
-	{
-		id: "sandwich",
-		name: "Sandwich"
-	},
-	{
-		id: "orange",
-		name: "Orange"
-	},
-	{
-		id: "broccoli",
-		name: "Broccoli"
-	},
-	{
-		id: "carrot",
-		name: "Carrot"
-	},
-	{
-		id: "hot dog",
-		name: "Hot Dog"
-	},
-	{
-		id: "pizza",
-		name: "Pizza"
-	},
-	{
-		id: "donut",
-		name: "Donut"
-	},
-	{
-		id: "cake",
-		name: "Cake"
-	},
-	{
-		id: "chair",
-		name: "Chair"
-	},
-	{
-		id: "couch",
-		name: "Couch"
-	},
-	{
-		id: "potted plant",
-		name: "Potted Plant"
-	},
-	{
-		id: "bed",
-		name: "Bed"
-	},
-	{
-		id: "dining table",
-		name: "Dining Table"
-	},
-	{
-		id: "toilet",
-		name: "Toilet"
-	},
-	{
-		id: "tv",
-		name: "TV"
-	},
-	{
-		id: "laptop",
-		name: "Laptop"
-	},
-	{
-		id: "mouse",
-		name: "Mouse"
-	},
-	{
-		id: "remote",
-		name: "Remote"
-	},
-	{
-		id: "keyboard",
-		name: "Keyboard"
-	},
-	{
-		id: "cell phone",
-		name: "Cell Phone"
-	},
-	{
-		id: "microwave",
-		name: "Microwave"
-	},
-	{
-		id: "oven",
-		name: "Oven"
-	},
-	{
-		id: "toaster",
-		name: "Toaster"
-	},
-	{
-		id: "sink",
-		name: "Sink"
-	},
-	{
-		id: "refrigerator",
-		name: "Refrigerator"
-	},
-	{
-		id: "book",
-		name: "Book"
-	},
-	{
-		id: "clock",
-		name: "Clock"
-	},
-	{
-		id: "vase",
-		name: "Vase"
-	},
-	{
-		id: "scissors",
-		name: "Scissors"
-	},
-	{
-		id: "teddy bear",
-		name: "Teddy Bear"
-	},
-	{
-		id: "hair drier",
-		name: "Hair Drier"
-	},
-	{
-		id: "toothbrush",
-		name: "Toothbrush"
-	}
-];
-var MACRO_LABELS = [
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-];
+	"alert",
+	"camera"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	url: zod.z.string().optional(),
+	/** Dropped by the degrade engine for a kind with `caps.actionIcons: false`. */
+	icon: NotificationActionIconSchema.optional(),
+	/**
+	* Renders in a warning style where the notifier supports it.
+	*
+	* A HINT, never a gate. The callback's authority is its token and nothing
+	* else — see `notification-center/action-token.ts` for what that does and
+	* does not buy.
+	*/
+	destructive: zod.z.boolean().optional(),
+	/**
+	* How the tap should REACH the url.
+	*
+	* `navigate` (absent, and every button authored before this field) opens it:
+	* the phone leaves the notification and shows whatever the callback returns.
+	* That is right for a button whose answer the operator wants to read.
+	*
+	* `background` fires it as a POST and stays put. It exists for the buttons
+	* whose whole point is not to interrupt — "silence this for 30 minutes" is
+	* an answer to the notification, and being thrown into a browser tab to
+	* confirm it costs more attention than the notification did. A backend that
+	* cannot do a background call renders it as an ordinary link (the adapters
+	* fall back rather than dropping the button), so this is a preference, never
+	* a requirement.
+	*/
+	mode: zod.z.enum(["navigate", "background"]).optional()
+});
 /**
-* The class names a per-class COUNT can ever be keyed on — the macro ids, and
-* only those.
-*
-* `preserveOriginal: false` below is the whole reason this set exists: the
-* executor maps each raw COCO label onto its macro and DROPS everything else,
-* so a tracked detection's `className` is always one of {@link MACRO_LABELS}.
-* Any surface that indexes counts by class name — the ZoneAnalytics occupancy
-* snapshot's `byClass`, and therefore every occupancy rule — can match nothing
-* else. Derived from the catalog, never hand-listed, so a new macro joins it by
-* being declared once.
-*
-* Cost of not having it, 2026-08-12: the notification rule editor offered the
-* full taxonomy for an occupancy class (occupancy is the one condition that
-* does not go through the engine's macro-expanding `expandClassSelector`), two
-* live rules were authored on `car`, and both counters read 0 forever.
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
 */
-var DETECTION_MACRO_CLASSES = new Set(MACRO_LABELS.map((l) => l.id));
-/** True when `className` is a macro the detector can actually emit (and hence a
-*  class a count can be keyed on) — see {@link DETECTION_MACRO_CLASSES}. */
-function isDetectionMacroClass(className) {
-	return DETECTION_MACRO_CLASSES.has(className.trim().toLowerCase());
-}
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
+var NotificationSchema = zod.z.object({
+	body: zod.z.string(),
+	title: zod.z.string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: zod.z.number().int().min(1).max(5).default(3),
+	level: zod.z.string().optional(),
+	attachments: zod.z.array(AttachmentSchema).optional(),
+	clickUrl: zod.z.string().optional(),
+	actions: zod.z.array(NotificationActionSchema).optional(),
+	sound: zod.z.string().optional(),
+	ttl: zod.z.number().optional(),
+	tag: zod.z.string().optional(),
+	deviceId: zod.z.number().optional(),
+	eventId: zod.z.string().optional(),
+	metadata: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = zod.z.object({
+	id: zod.z.string(),
+	label: zod.z.string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: zod.z.number().int().min(1).max(5).nullable(),
+	flags: zod.z.object({
+		critical: zod.z.boolean().optional(),
+		silent: zod.z.boolean().optional(),
+		noPush: zod.z.boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: zod.z.array(zod.z.string()).optional(),
+	description: zod.z.string().optional()
+});
+/** Attachment capabilities for a kind (drives the degrade engine + test panel). */
+var TargetKindAttachmentsCapsSchema = zod.z.object({
+	mediaTypes: zod.z.array(AttachmentMediaTypeSchema),
+	mode: zod.z.enum([
+		"url",
+		"bytes",
+		"both"
+	]),
+	max: zod.z.number().int().nonnegative(),
+	maxBytes: zod.z.number().int().positive().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = zod.z.object({
+	attachments: TargetKindAttachmentsCapsSchema,
+	/** Max action buttons (0 = none). */
+	actions: zod.z.number().int().nonnegative(),
+	/**
+	* Whether this kind renders a per-action ICON.
+	*
+	* `.optional()`, deliberately NOT `.default(false)`: a Zod default does not
+	* run on the addon cap path — three production failures in one day taught
+	* this repo that once. Absent is read as false by the degrade engine, which
+	* is the safe direction: an icon that is not rendered costs nothing, an icon
+	* assumed and dropped costs the operator's trust in the field.
+	*/
+	actionIcons: zod.z.boolean().optional(),
+	levels: zod.z.array(TargetKindLevelSchema),
+	format: zod.z.array(NotificationFormatSchema),
+	clickUrl: zod.z.boolean(),
+	sound: zod.z.boolean(),
+	ttl: zod.z.boolean(),
+	bodyMaxLen: zod.z.number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough$2 = zod.z.unknown();
+var TargetKindSchema = zod.z.object({
+	kind: zod.z.string(),
+	label: zod.z.string(),
+	icon: zod.z.string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: zod.z.string(),
+	/**
+	* URL of the kind's bundled BRAND icon, served by the providing addon over
+	* its own `addon-routes` surface (`/addon/<addonId>/icons/<kind>`). Absent
+	* when the addon bundles no icon for that kind — the client then falls back
+	* to a neutral glyph rather than rendering the raw `icon` NAME as text.
+	*
+	* Root-relative on purpose: it resolves against whatever origin serves a web
+	* client, and a native client joins it onto its own hub base.
+	*
+	* DECLARED here deliberately. It used to travel as an undeclared passthrough
+	* field that survived only because the runtime cap-router forwards provider
+	* output verbatim — so every consumer had to re-declare it by hand to stop
+	* its own Zod parse from stripping it, and the whole arrangement would have
+	* broken silently the moment output validation was tightened anywhere.
+	*/
+	iconUrl: zod.z.string().optional(),
+	/**
+	* Media type of {@link iconUrl} (`image/svg+xml`, `image/png`, …).
+	*
+	* The server knows this and therefore says it, because the client cannot
+	* safely guess: a React-Native client renders SVG and raster through two
+	* DIFFERENT components (`react-native-svg` vs `expo-image` — expo-image does
+	* not decode SVG on iOS/Android), so without this it silently fell back to a
+	* placeholder glyph for every vector icon while the web build looked fine.
+	*
+	* Absent when {@link iconUrl} is absent, or for a legacy provider that has
+	* not been updated — a client that cannot determine the type should prefer
+	* its raster path, which is the safe default for an unknown image.
+	*/
+	iconMediaType: zod.z.string().optional(),
+	configSchema: ConfigSchemaPassthrough$2,
+	/**
+	* The config keys that decide WHERE this kind's secrets are sent (server,
+	* base URL, instance, chat, recipient). A save that changes any of them
+	* while leaving a secret redacted is refused by the provider (D634), so an
+	* editor uses this to ask for the secret on exactly those edits instead of
+	* on every edit.
+	*
+	* Optional: absent from a provider that holds no secret (the Home Assistant
+	* kinds) and from a provider older than this field — an editor that finds
+	* it absent must assume ANY edit may need the secret.
+	*/
+	destinationKeys: zod.z.array(zod.z.string()).optional(),
+	supportsDiscovery: zod.z.boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = zod.z.object({
+	id: zod.z.string(),
+	name: zod.z.string(),
+	kind: zod.z.string(),
+	addonId: zod.z.string(),
+	enabled: zod.z.boolean(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = zod.z.object({
+	kind: zod.z.string(),
+	suggestedName: zod.z.string(),
+	config: zod.z.record(zod.z.string(), zod.z.unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = zod.z.object({
+	level: zod.z.string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: zod.z.number().int().nonnegative(),
+	actionsSent: zod.z.number().int().nonnegative(),
+	truncated: zod.z.boolean(),
+	dropped: zod.z.array(zod.z.string())
+});
+var SendResultSchema = zod.z.object({
+	success: zod.z.boolean(),
+	error: zod.z.string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+/**
+* Pre-save credential probe against a partial (unsaved) target config.
+* `resolvedUrl` never includes secrets (token stripped from path).
+*/
+var ProbeTargetConfigResultSchema = zod.z.object({
+	ok: zod.z.boolean(),
+	resolvedUrl: zod.z.string(),
+	httpStatus: zod.z.number().int().optional(),
+	stateInstance: zod.z.string().optional(),
+	error: zod.z.string().optional()
+});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: require_sleep.method(zod.z.object({}), zod.z.array(TargetKindSchema)),
+		listTargets: require_sleep.method(zod.z.object({}), zod.z.array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: require_sleep.method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: zod.z.string().optional()
+		}), zod.z.array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: require_sleep.method(zod.z.object({
+			kind: zod.z.string(),
+			config: zod.z.record(zod.z.string(), zod.z.unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: zod.z.string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: require_sleep.method(zod.z.object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: zod.z.string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: require_sleep.method(zod.z.object({ targetId: zod.z.string() }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: require_sleep.method(zod.z.object({
+			targetId: zod.z.string(),
+			enabled: zod.z.boolean()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
 };
 //#endregion
 //#region src/catalogs/audio-classmap.ts
@@ -62877,6 +64344,152 @@ var audioMetricsCapability = {
 	history: "none"
 };
 //#endregion
+//#region src/capabilities/action-source.cap.ts
+/**
+* action-source — an addon DECLARES runnable actions (a Home Assistant script,
+* a scene, a vendor routine) as list entries. Never as devices.
+*
+* It mirrors `notification-output`: `listActions` returns an array, so the
+* generated cap mount concat-fans it across every provider; `runAction` and
+* `stopAction` route to ONE provider by the `addonId` the generated collection
+* router extracts from the call input.
+*
+* Nobody but the `actions` surface (the core-blocks builtin) calls this cap.
+* The UI and automations talk to `actions`, which fans out here LIVE on every
+* `list` and keeps no catalog of its own (D3: no shadow registry).
+*
+* `listActions` entries carry `source: 'addon'`, `readOnly: true`, an id of
+* `<addonId>:<localId>` and an idle `status` (the provider may fill what it
+* knows). `actionId` on `runAction` / `stopAction` is the full entry id.
+*/
+var actionSourceCapability = {
+	name: "action-source",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listActions: require_sleep.method(zod.z.object({}), zod.z.array(ActionEntrySchema), { auth: "admin" }),
+		runAction: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			variables: zod.z.record(zod.z.string(), ActionVariableValueSchema).optional()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stopAction: require_sleep.method(zod.z.object({ actionId: zod.z.string().min(1) }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/actions.cap.ts
+/**
+* actions — the ONE surface for runnable actions, for the UI and for
+* automations. Provided by the core-blocks builtin on the hub.
+*
+* An action is a LIST ENTRY, not a device (D883): either internal (cap and wait
+* steps, kept in the hub's `actions` record kind) or declared by an addon over
+* `action-source`. `list` asks every `action-source` provider LIVE and overlays
+* the run status from the hub's `runs` ledger; there is no catalog here to
+* drift (D3).
+*
+* **Permissions follow the camera, as linked devices do.** An action is linked
+* to cameras by the operator (`setLinks`, D356: nothing links itself). A
+* non-admin may `get` / `run` an action only through a camera they may see that
+* links it: they name the camera (`deviceId`, a top-level field so the scope
+* gate sees it) and the provider refuses an action that camera does not link.
+* An admin, and an in-process caller (an automation block), may run any action.
+* Every refusal is typed (`[not-linked] …`) and logged.
+*
+* A second `run` of an action that is already running is REFUSED — traced and
+* logged — never queued.
+*/
+var ActionIdInput = zod.z.object({ actionId: zod.z.string().min(1) });
+var ActionLinksSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	actionIds: zod.z.array(zod.z.string().min(1)).max(100)
+});
+var actionsCapability = {
+	name: "actions",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Every action, live from the providers, with its run status. Admin. */
+		list: require_sleep.method(zod.z.object({}), zod.z.array(ActionEntrySchema), { auth: "admin" }),
+		/**
+		* One action. A non-admin names the camera (`deviceId`) that links it.
+		* `null` when it does not exist.
+		*/
+		get: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			deviceId: zod.z.number().int().nonnegative().optional()
+		}), zod.z.object({ action: ActionEntrySchema.nullable() }), {
+			role: "viewer",
+			auth: "protected",
+			kind: "query",
+			caller: "required"
+		}),
+		/**
+		* Start an action. `wait` holds the call until the run ended (an automation
+		* step does); without it the call returns `started`. A non-admin names the
+		* camera (`deviceId`) that links the action.
+		*/
+		run: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			variables: zod.z.record(zod.z.string(), ActionVariableValueSchema).optional(),
+			wait: zod.z.boolean().optional(),
+			origin: ActionRunOriginSchema.optional(),
+			deviceId: zod.z.number().int().nonnegative().optional()
+		}), ActionRunResultSchema, {
+			role: "viewer",
+			auth: "protected",
+			kind: "mutation",
+			caller: "required"
+		}),
+		stop: require_sleep.method(ActionIdInput, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getTraces: require_sleep.method(ActionIdInput, zod.z.object({ traces: zod.z.array(AutomationRunTraceSchema) }), { auth: "admin" }),
+		/** Internal actions only. A read-only (addon) entry is refused with `[read-only]`. */
+		create: require_sleep.method(zod.z.object({ action: ActionInputSchema }), zod.z.object({ action: ActionEntrySchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		update: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			action: ActionInputSchema.partial()
+		}), zod.z.object({ action: ActionEntrySchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		delete: require_sleep.method(ActionIdInput, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* What a viewer sees under a camera: the actions this camera LINKS, with
+		* their variables, and only when the caller may see the camera. The scope
+		* gate admits the camera; the answer is cut to the linked ones.
+		*/
+		listForCamera: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), zod.z.array(ActionEntrySchema), {
+			role: "viewer",
+			auth: "protected",
+			kind: "query"
+		}),
+		/** The actions a camera links. Admin (the picker). */
+		getLinks: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), ActionLinksSchema, { auth: "admin" }),
+		/** Replace a camera's linked actions with what the operator picked. */
+		setLinks: require_sleep.method(ActionLinksSchema, ActionLinksSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	events: { 
+	/** A run started or ended. Telemetry (D8): `list` is the authority. */
+onRunChanged: { data: ActionRunChangedSchema } }
+};
+//#endregion
 //#region src/capabilities/automation-control.cap.ts
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -85469,6 +87082,104 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"actions.create": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.delete": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"actions.get": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.getLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.getTraces": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.list": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.listForCamera": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.run": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"actions.setLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.stop": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.update": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.listActions": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actionSource.runAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.stopAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonPages.listPages": {
 		capName: "addon-pages",
 		capScope: "system",
@@ -86750,6 +88461,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getAutomationRunState": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getBlockSettings": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86771,6 +88489,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getTraces": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86806,6 +88531,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.reportAutomationRun": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -95168,6 +96900,8 @@ var METHOD_ACCESS_MAP = Object.freeze({
 /** Set of all known cap names — handy for the scope picker. */
 var KNOWN_CAP_NAMES = [
 	"accessories",
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -95453,6 +97187,8 @@ var DEVICE_CAP_NAMES = [
 ];
 /** Every cap declared as `scope: 'system'` — drives the `category:system` matcher. */
 var SYSTEM_CAP_NAMES = [
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -99351,6 +101087,8 @@ var ML = "model and training machinery — no device action";
 var INTERNAL = "internal plumbing between addons — never operator-facing";
 /** Every system-scoped cap, with why it is not a device's vocabulary. */
 var SYSTEM_CAP_VOCABULARY = {
+	"action-source": system(INTERNAL),
+	actions: system("declared actions — run from the Actions page and from the cameras that link them"),
 	"addon-pages": system(UI_PLUMBING),
 	"addon-pages-source": system(UI_PLUMBING),
 	"addon-routes": system(UI_PLUMBING),
@@ -101257,6 +102995,8 @@ var CAP_NAMES_WITH_STATUS = [
 //#region src/generated/capability-router-map.ts
 var CAPABILITY_NAMES = {
 	accessories: "accessories",
+	actionSource: "action-source",
+	actions: "actions",
 	addonPages: "addon-pages",
 	addonPagesSource: "addon-pages-source",
 	addonRoutes: "addon-routes",
@@ -101448,6 +103188,14 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "accessories",
 		name: "accessories"
 	},
+	{
+		key: "actionSource",
+		name: "action-source"
+	},
+	{
+		key: "actions",
+		name: "actions"
+	},
 	{
 		key: "addonPages",
 		name: "addon-pages"
@@ -102196,6 +103944,8 @@ var CAPABILITY_ROUTER_KEYS = [
 */
 var ALL_CAPABILITY_DEFINITIONS = [
 	accessoriesCapability,
+	actionSourceCapability,
+	actionsCapability,
 	addonPagesCapability,
 	addonPagesSourceCapability,
 	addonRoutesCapability,
@@ -102398,6 +104148,31 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"actions.get": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.getLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.listForCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.setLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"addonSettings.getDeviceSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -105169,6 +106944,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 /** Cap-method paths that carry a device reference AND live on a system-scope
 *  cap — the set the v3 device check newly reaches. */
 var SYSTEM_SCOPE_DEVICE_METHODS = [
+	"actions.get",
+	"actions.getLinks",
+	"actions.listForCamera",
+	"actions.run",
+	"actions.setLinks",
 	"addonSettings.getDeviceSettings",
 	"addonSettings.updateDeviceSettings",
 	"audioAnalyzer.attachDevice",
@@ -106383,6 +108163,20 @@ function createSystemProxy(api) {
 		return require_sleep.invokeTrpcLeaf(api, capProp, method, kind, input, push);
 	}
 	return {
+		actions: {
+			list: (input) => dispatch("actions", "list", "query", input),
+			stop: (input) => dispatch("actions", "stop", "mutation", input),
+			getTraces: (input) => dispatch("actions", "getTraces", "query", input),
+			create: (input) => dispatch("actions", "create", "mutation", input),
+			update: (input) => dispatch("actions", "update", "mutation", input),
+			delete: (input) => dispatch("actions", "delete", "mutation", input),
+			setLinks: (input) => dispatch("actions", "setLinks", "mutation", input)
+		},
+		actionSource: {
+			listActions: (input) => dispatch("actionSource", "listActions", "query", input),
+			runAction: (input) => dispatch("actionSource", "runAction", "mutation", input),
+			stopAction: (input) => dispatch("actionSource", "stopAction", "mutation", input)
+		},
 		addonPages: { listPages: (input) => dispatch("addonPages", "listPages", "query", input) },
 		addons: {
 			list: (input) => dispatch("addons", "list", "query", input),
@@ -106526,7 +108320,10 @@ function createSystemProxy(api) {
 			listCompositions: (input) => dispatch("coreBlocks", "listCompositions", "query", input),
 			getCustomization: (input) => dispatch("coreBlocks", "getCustomization", "query", input),
 			listComposableCaps: (input) => dispatch("coreBlocks", "listComposableCaps", "query", input),
-			validateComposition: (input) => dispatch("coreBlocks", "validateComposition", "mutation", input)
+			validateComposition: (input) => dispatch("coreBlocks", "validateComposition", "mutation", input),
+			reportAutomationRun: (input) => dispatch("coreBlocks", "reportAutomationRun", "mutation", input),
+			getAutomationRunState: (input) => dispatch("coreBlocks", "getAutomationRunState", "query", input),
+			getTraces: (input) => dispatch("coreBlocks", "getTraces", "query", input)
 		},
 		decoder: {
 			getInfo: (input) => dispatch("decoder", "getInfo", "query", input),
@@ -117149,6 +118946,21 @@ exports.AcceleratorComputeSchema = AcceleratorComputeSchema;
 exports.AcceleratorKindSchema = AcceleratorKindSchema;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
+exports.ActionEntrySchema = ActionEntrySchema;
+exports.ActionError = ActionError;
+exports.ActionErrorCodeSchema = ActionErrorCodeSchema;
+exports.ActionInputSchema = ActionInputSchema;
+exports.ActionLinksSchema = ActionLinksSchema;
+exports.ActionRunChangedSchema = ActionRunChangedSchema;
+exports.ActionRunOriginSchema = ActionRunOriginSchema;
+exports.ActionRunOutcomeSchema = ActionRunOutcomeSchema;
+exports.ActionRunResultSchema = ActionRunResultSchema;
+exports.ActionSourceKindSchema = ActionSourceKindSchema;
+exports.ActionStatusSchema = ActionStatusSchema;
+exports.ActionStepSchema = ActionStepSchema;
+exports.ActionVariableSchema = ActionVariableSchema;
+exports.ActionVariableTypeSchema = ActionVariableTypeSchema;
+exports.ActionVariableValueSchema = ActionVariableValueSchema;
 exports.ActiveCriterionSchema = require_composition.ActiveCriterionSchema;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
 exports.AddRetrainFrameFromRecordingResultSchema = AddRetrainFrameFromRecordingResultSchema;
@@ -117229,11 +119041,21 @@ exports.AutoTunePlanSchema = AutoTunePlanSchema;
 exports.AutoTuneWarningSchema = AutoTuneWarningSchema;
 exports.AutoUpdateSettingsSchema = AutoUpdateSettingsSchema;
 exports.AutomationActionSchema = AutomationActionSchema;
+exports.AutomationCapStepSchema = AutomationCapStepSchema;
 exports.AutomationConditionOperatorSchema = AutomationConditionOperatorSchema;
 exports.AutomationConditionSchema = AutomationConditionSchema;
+exports.AutomationConditionTraceNodeSchema = AutomationConditionTraceNodeSchema;
 exports.AutomationControlStatusSchema = AutomationControlStatusSchema;
 exports.AutomationRecipeSchema = AutomationRecipeSchema;
+exports.AutomationRunModeSchema = AutomationRunModeSchema;
+exports.AutomationRunOutcomeSchema = AutomationRunOutcomeSchema;
+exports.AutomationRunTraceSchema = AutomationRunTraceSchema;
+exports.AutomationRunVerdictSchema = AutomationRunVerdictSchema;
+exports.AutomationStateDocSchema = AutomationStateDocSchema;
+exports.AutomationStepTraceSchema = AutomationStepTraceSchema;
 exports.AutomationTriggerSchema = AutomationTriggerSchema;
+exports.AutomationTriggerTraceSchema = AutomationTriggerTraceSchema;
+exports.AutomationWaitStepSchema = AutomationWaitStepSchema;
 exports.AvailableIntegrationTypeSchema = AvailableIntegrationTypeSchema;
 exports.BASE_DEVICE_CAPS = BASE_DEVICE_CAPS;
 exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
@@ -117495,6 +119317,7 @@ exports.CompositionTargetSchema = require_composition.CompositionTargetSchema;
 exports.CompositionUnavailableModeSchema = CompositionUnavailableModeSchema;
 exports.CompositionValidationSchema = CompositionValidationSchema;
 exports.CompositionViewSchema = CompositionViewSchema;
+exports.ConditionMirror = ConditionMirror;
 exports.ConfigEntrySchema = ConfigEntrySchema;
 exports.ConfigSectionWithValuesSchema = ConfigSectionWithValuesSchema;
 exports.ConfigTabDeclarationSchema = ConfigTabDeclarationSchema;
@@ -117574,6 +119397,7 @@ exports.DEFAULT_SESSION_PLACEMENT_POLICY = DEFAULT_SESSION_PLACEMENT_POLICY;
 exports.DEFAULT_SHARE_SOURCE = DEFAULT_SHARE_SOURCE;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DEFAULT_TOKEN_EXPIRY = require_sleep.DEFAULT_TOKEN_EXPIRY;
+exports.DEFAULT_TRACE_KEEP = DEFAULT_TRACE_KEEP;
 exports.DEFAULT_VIEWER_SCOPE = DEFAULT_VIEWER_SCOPE;
 exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
 exports.DERIVATIVE_UNITS = require_composition.DERIVATIVE_UNITS;
@@ -117641,6 +119465,7 @@ exports.DetailCropConventionSchema = DetailCropConventionSchema;
 exports.DetectionCatalogClassMapSchema = DetectionCatalogClassMapSchema;
 exports.DetectionSourceSchema = DetectionSourceSchema;
 exports.DetectionSourcesSchema = DetectionSourcesSchema;
+exports.DetectionTriggerFilter = DetectionTriggerFilter;
 exports.DeviceAdminLinkSchema = DeviceAdminLinkSchema;
 exports.DeviceCaStatusSchema = DeviceCaStatusSchema;
 exports.DeviceCertificateLoginMethodSchema = DeviceCertificateLoginMethodSchema;
@@ -117707,6 +119532,7 @@ exports.DoorbellStatusSchema = DoorbellStatusSchema;
 exports.EMBEDDING_MODEL_FAILED = EMBEDDING_MODEL_FAILED;
 exports.EMBEDDING_REQUIREMENTS_FAILED = EMBEDDING_REQUIREMENTS_FAILED;
 exports.EMBEDDING_REQUIREMENTS_UNAVAILABLE = EMBEDDING_REQUIREMENTS_UNAVAILABLE;
+exports.EMPTY_AUTOMATION_STATE = EMPTY_AUTOMATION_STATE;
 exports.ESTIMATE_COMPUTE_RATIO_MAX = ESTIMATE_COMPUTE_RATIO_MAX;
 exports.ESTIMATE_COMPUTE_RATIO_MIN = ESTIMATE_COMPUTE_RATIO_MIN;
 exports.EVENTFUL_CAP_NAMES = EVENTFUL_CAP_NAMES;
@@ -117895,10 +119721,12 @@ exports.ICON_CATEGORIES = ICON_CATEGORIES;
 exports.ICON_ENTRIES = ICON_ENTRIES;
 exports.ICON_KEYS = ICON_KEYS;
 exports.ICON_VIEWER_MODULES = ICON_VIEWER_MODULES;
+exports.IDLE_ACTION_STATUS = IDLE_ACTION_STATUS;
 exports.INFERENCE_DEVICE_EXCLUSION_REASONS = INFERENCE_DEVICE_EXCLUSION_REASONS;
 exports.INITIAL_PULSE = INITIAL_PULSE;
 exports.INITIAL_SPAN = INITIAL_SPAN;
 exports.INTEGRAL_OUTPUTS = require_composition.INTEGRAL_OUTPUTS;
+exports.INTERNAL_ACTION_PREFIX = INTERNAL_ACTION_PREFIX;
 exports.INVERTIBLE_CAPS = INVERTIBLE_CAPS;
 exports.IconKeySchema = IconKeySchema;
 exports.ImageContractSchema = ImageContractSchema;
@@ -118066,6 +119894,7 @@ exports.MAX_KEYS = MAX_KEYS;
 exports.MAX_REASONS_PER_KEY = MAX_REASONS_PER_KEY;
 exports.MAX_REQUEUED_BUCKETS_PER_SERIES = MAX_REQUEUED_BUCKETS_PER_SERIES;
 exports.MAX_SENSOR_TRIGGER_DEVICES = MAX_SENSOR_TRIGGER_DEVICES;
+exports.MAX_TRACE_KEEP = MAX_TRACE_KEEP;
 exports.MAX_TRACK_DEBUG_NOTE_LEN = MAX_TRACK_DEBUG_NOTE_LEN;
 exports.MAX_TRACK_PURITIES = MAX_TRACK_PURITIES;
 exports.MAX_TRACK_RELATIONS = MAX_TRACK_RELATIONS;
@@ -118789,6 +120618,7 @@ exports.RollingWindowSchema = require_composition.RollingWindowSchema;
 exports.RootStepSupplySchema = RootStepSupplySchema;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
+exports.RunGate = RunGate;
 exports.RunnerBootCheckSchema = RunnerBootCheckSchema;
 exports.RunnerCameraConfigSchema = RunnerCameraConfigSchema;
 exports.RunnerCameraDeviceUIFields = RunnerCameraDeviceUIFields;
@@ -119014,6 +120844,8 @@ exports.TokenScopeSchema = TokenScopeSchema;
 exports.TopologyNodeSchema = TopologyNodeSchema;
 exports.TopologyProcessSchema = TopologyProcessSchema;
 exports.TopologyServiceSchema = TopologyServiceSchema;
+exports.TraceNodeOutcomeSchema = TraceNodeOutcomeSchema;
+exports.TraceValueSchema = TraceValueSchema;
 exports.TrackCascadeCountsSchema = TrackCascadeCountsSchema;
 exports.TrackEnvelopeSchema = TrackEnvelopeSchema;
 exports.TrackFlagsPatchSchema = TrackFlagsPatchSchema;
@@ -119165,6 +120997,8 @@ exports.accessoriesCapability = accessoriesCapability;
 exports.accessoryChildrenComplete = accessoryChildrenComplete;
 exports.accessoryChildrenUnknown = accessoryChildrenUnknown;
 exports.accessoryStableId = accessoryStableId;
+exports.actionSourceCapability = actionSourceCapability;
+exports.actionsCapability = actionsCapability;
 exports.actionsForBoundCaps = actionsForBoundCaps;
 exports.actionsForDevice = actionsForDevice;
 exports.actionsForDeviceType = actionsForDeviceType;
@@ -119173,6 +121007,7 @@ exports.activateAlarmProfile = activateAlarmProfile;
 exports.activeForReducer = activeForReducer;
 exports.actuatorMethodRow = actuatorMethodRow;
 exports.addonCatalogHref = addonCatalogHref;
+exports.addonIdOfActionId = addonIdOfActionId;
 exports.addonPagesCapability = addonPagesCapability;
 exports.addonPagesSourceCapability = addonPagesSourceCapability;
 exports.addonRoutesCapability = addonRoutesCapability;
@@ -119199,6 +121034,7 @@ exports.allowedSuppliedEffect = allowedSuppliedEffect;
 exports.ambientLightSensorCapability = ambientLightSensorCapability;
 exports.annotateClipsWithEventLabels = annotateClipsWithEventLabels;
 exports.appFlowLocation = appFlowLocation;
+exports.appendTrace = appendTrace;
 exports.applianceDeviceType = require_composition.applianceDeviceType;
 exports.applianceExport = applianceExport;
 exports.applyBlockingEdit = applyBlockingEdit;
@@ -119246,6 +121082,7 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.bucketStartOf = bucketStartOf;
+exports.buildActionSteps = buildActionSteps;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
 exports.buildAudioArgs = require_composition.buildAudioArgs;
 exports.buildBenchStepTree = buildBenchStepTree;
@@ -119264,6 +121101,7 @@ exports.buildSecretRef = require_sleep.buildSecretRef;
 exports.buildSessionLostAlert = buildSessionLostAlert;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buildSubjectPath = buildSubjectPath;
+exports.buildTriggerTrace = buildTriggerTrace;
 exports.buildVideoArgs = require_composition.buildVideoArgs;
 exports.buildViewerLink = buildViewerLink;
 exports.builtCapabilityBlockers = builtCapabilityBlockers;
@@ -119318,6 +121156,7 @@ exports.codecIsAccepted = codecIsAccepted;
 exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
 exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
 exports.collectKeychainStoredKeys = require_sleep.collectKeychainStoredKeys;
+exports.collectMirrorSources = collectMirrorSources;
 exports.collectModelBoundKeys = collectModelBoundKeys;
 exports.collectSecretConfigKeys = require_sleep.collectSecretConfigKeys;
 exports.collectSecretLeaves = require_sleep.collectSecretLeaves;
@@ -119438,6 +121277,7 @@ exports.describeSystemEventDeliveryProblem = describeSystemEventDeliveryProblem;
 exports.describeSystemEventFamilyProblem = describeSystemEventFamilyProblem;
 exports.describeTopLevelStateFields = describeTopLevelStateFields;
 exports.detectAccessRole = detectAccessRole;
+exports.detectionClassMatches = detectionClassMatches;
 exports.detectionPipelineCapability = detectionPipelineCapability;
 exports.deviceAdminLinkCapability = deviceAdminLinkCapability;
 exports.deviceAdoptionCapability = deviceAdoptionCapability;
@@ -119498,6 +121338,7 @@ exports.estimateNodeBenchmarkDurationMs = estimateNodeBenchmarkDurationMs;
 exports.evaluateAggregate = evaluateAggregate;
 exports.evaluateAst = require_composition.evaluateAst;
 exports.evaluateCompositionField = evaluateCompositionField;
+exports.evaluateConditionTree = evaluateConditionTree;
 exports.evaluateCount = require_composition.evaluateCount;
 exports.evaluateDerivative = require_composition.evaluateDerivative;
 exports.evaluateExpressionSource = require_composition.evaluateExpressionSource;
@@ -119608,6 +121449,7 @@ exports.integralDraft = integralDraft;
 exports.integrateReading = require_composition.integrateReading;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
+exports.internalActionId = internalActionId;
 exports.interpolate = interpolate;
 exports.interpretStoredClusterModel = interpretStoredClusterModel;
 exports.invalidClusterStepModelEntries = invalidClusterStepModelEntries;
@@ -119649,6 +121491,7 @@ exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isHistoryHelper = require_composition.isHistoryHelper;
 exports.isIconKey = isIconKey;
+exports.isInternalActionId = isInternalActionId;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isKeychainStoredField = require_sleep.isKeychainStoredField;
 exports.isKnownTemplateVar = isKnownTemplateVar;
@@ -119677,6 +121520,7 @@ exports.isSecretMarkerLike = require_sleep.isSecretMarkerLike;
 exports.isSecretRef = require_sleep.isSecretRef;
 exports.isSecretRefOwnedBy = require_sleep.isSecretRefOwnedBy;
 exports.isSingleHubAddressRole = isSingleHubAddressRole;
+exports.isSkippedTrace = isSkippedTrace;
 exports.isSoftwareDecode = require_composition.isSoftwareDecode;
 exports.isSourceCap = require_composition.isSourceCap;
 exports.isStateLabelKey = isStateLabelKey;
@@ -119749,6 +121593,7 @@ exports.mergeOverrides = mergeOverrides;
 exports.mergeScalarTarget = mergeScalarTarget;
 exports.mergeSecretStatePaths = require_sleep.mergeSecretStatePaths;
 exports.mergeSettingsBags = mergeSettingsBags;
+exports.mergeSkipTraces = mergeSkipTraces;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
 exports.meterCapability = meterCapability;
@@ -119954,6 +121799,7 @@ exports.requiredTopLevelKeys = requiredTopLevelKeys;
 exports.requiresPython = requiresPython;
 exports.reservedSourceOwner = reservedSourceOwner;
 exports.resetPoolBaseline = resetPoolBaseline;
+exports.resolveActionVariables = resolveActionVariables;
 exports.resolveAddonExecution = resolveAddonExecution;
 exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
@@ -119968,6 +121814,7 @@ exports.resolveCoreBlockFiles = resolveCoreBlockFiles;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
+exports.resolveDeviceTarget = resolveDeviceTarget;
 exports.resolveEffectiveShares = resolveEffectiveShares;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveExportProfiles = resolveExportProfiles;
@@ -119994,6 +121841,7 @@ exports.resolveRunnerId = resolveRunnerId;
 exports.resolveSecretMarkers = require_sleep.resolveSecretMarkers;
 exports.resolveSecretViewsIn = require_sleep.resolveSecretViewsIn;
 exports.resolveServerName = resolveServerName;
+exports.resolveStepArgs = resolveStepArgs;
 exports.resolveStreamMaps = require_composition.resolveStreamMaps;
 exports.resolveVariantModelId = resolveVariantModelId;
 exports.resolveViewableDeviceIds = resolveViewableDeviceIds;
@@ -120022,6 +121870,7 @@ exports.ruleSeedForSection = ruleSeedForSection;
 exports.ruleTriggerZoneIds = ruleTriggerZoneIds;
 exports.runFanOut = runFanOut;
 exports.runInferenceStep = runInferenceStep;
+exports.runSteps = runSteps;
 exports.runningFromDishwasherOperation = runningFromDishwasherOperation;
 exports.runningFromLawnMower = runningFromLawnMower;
 exports.runningFromMediaPlayer = runningFromMediaPlayer;
@@ -120080,6 +121929,7 @@ exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
 exports.signalPercentFromBars = signalPercentFromBars;
 exports.signalPercentFromRssi = signalPercentFromRssi;
 exports.siteZoneKey = siteZoneKey;
+exports.skipSignature = skipSignature;
 exports.sleep = require_sleep.sleep;
 exports.sleepCancellable = require_sleep.sleepCancellable;
 exports.sliceActiveValue = require_composition.sliceActiveValue;