@camstack/types 1.2.429 → 1.2.431

package/dist/index.js

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sleep = require("./sleep-hRhTSDlN.js");
-const require_event_category = require("./event-category-Ave2VSxY.js");
+const require_sleep = require("./sleep-5zRztaHa.js");
+const require_event_category = require("./event-category-BhzwWQCH.js");
 const require_composition = require("./composition-CpAc0YfQ.js");
 const require_node_color = require("./node-color.js");
 const require_err_msg = require("./err-msg-U7lLUMNz.js");
@@ -8074,7 +8074,7 @@ var ExpressionSourceSchema = zod.z.object({
 *
 * Three vocabularies, each salvaged rather than invented:
 *
-*  - **Triggers** — the only genuinely new surface. Four members, none of which
+*  - **Triggers** — the only genuinely new surface. Six members, none of which
 *    touches notification delivery. The NC keeps its four *pipeline* triggers;
 *    these are device/time triggers and the two sets do not overlap.
 *  - **Conditions** — `ALL`/`ANY`/`NOT` over two leaf kinds, bounded. The
@@ -8198,7 +8198,23 @@ var AutomationTriggerSchema = zod.z.discriminatedUnion("kind", [
 		kind: zod.z.literal("schedule"),
 		cron: zod.z.string().min(1).max(120)
 	}),
-	zod.z.object({ kind: zod.z.literal("manual") })
+	zod.z.object({ kind: zod.z.literal("manual") }),
+	zod.z.object({
+		kind: zod.z.literal("detection"),
+		/** Class names. A macro class (`animal`, `vehicle`, `person`, `package`)
+		*  matches every raw class that maps to it; any other name matches
+		*  exactly. */
+		classes: zod.z.array(zod.z.string().min(1)).min(1),
+		deviceIds: zod.z.array(zod.z.number().int().nonnegative()).min(1),
+		/** The track must have visited at least one of these zones. */
+		zones: zod.z.array(zod.z.string().min(1)).min(1).optional(),
+		/** Best-so-far confidence the track must reach. */
+		minScore: zod.z.number().min(0).max(1).optional()
+	}),
+	zod.z.object({
+		kind: zod.z.literal("interval"),
+		minutes: zod.z.number().int().min(1).max(1440)
+	})
 ]);
 /**
 * One action step.
@@ -8218,28 +8234,47 @@ var AutomationTriggerSchema = zod.z.discriminatedUnion("kind", [
 * is called. The runner still receives a number and is untouched; the
 * resolution is the recipe's job, not the runner's.
 */
+var AutomationWaitStepSchema = zod.z.object({
+	kind: zod.z.literal("wait"),
+	seconds: zod.z.number().min(0).max(300)
+});
+var AutomationCapStepSchema = zod.z.object({
+	kind: zod.z.literal("cap"),
+	/**
+	* One device, several same-family devices (locks / climate family / …),
+	* or `{ $var }` for the device that triggered the run. An array is
+	* fan-out at codegen — each id gets the same cap.method call.
+	*/
+	deviceId: zod.z.union([
+		zod.z.number().int(),
+		zod.z.array(zod.z.number().int()).min(1),
+		zod.z.object({ $var: zod.z.string().min(1) })
+	]),
+	cap: zod.z.string().min(1),
+	method: zod.z.string().min(1),
+	/** Values may carry `{{vars.x}}` slots, or be exactly `{ $var: 'name' }`, which
+	*  SUBSTITUTE and do not evaluate (§3.2.3). Anything beyond substitution is
+	*  the expression leaf. */
+	args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+/**
+* The steps an internal Action may contain: cap and wait, and nothing that can
+* call back into an Action — so an Action can never reach itself (no cycles).
+*/
+var ActionStepSchema = zod.z.discriminatedUnion("kind", [AutomationWaitStepSchema, AutomationCapStepSchema]);
 var AutomationActionSchema = zod.z.discriminatedUnion("kind", [
+	AutomationWaitStepSchema,
+	AutomationCapStepSchema,
 	zod.z.object({
-		kind: zod.z.literal("wait"),
-		seconds: zod.z.number().min(0).max(300)
-	}),
-	zod.z.object({
-		kind: zod.z.literal("cap"),
-		/**
-		* One device, several same-family devices (locks / climate family / …),
-		* or `{ $var }` for the device that triggered the run. An array is
-		* fan-out at codegen — each id gets the same cap.method call.
-		*/
-		deviceId: zod.z.union([
-			zod.z.number().int(),
-			zod.z.array(zod.z.number().int()).min(1),
-			zod.z.object({ $var: zod.z.string().min(1) })
-		]),
-		cap: zod.z.string().min(1),
-		method: zod.z.string().min(1),
-		/** Values may carry `{{vars.x}}` slots, which SUBSTITUTE and do not
-		*  evaluate (§3.2.3). Anything beyond substitution is the expression leaf. */
-		args: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+		kind: zod.z.literal("action"),
+		/** An entry of the `actions` surface (`internal:<uuid>` or `<addonId>:<localId>`). */
+		actionId: zod.z.string().min(1),
+		/** Values for the action's declared variables; the others take their default. */
+		variables: zod.z.record(zod.z.string(), zod.z.union([
+			zod.z.string(),
+			zod.z.number(),
+			zod.z.boolean()
+		])).optional()
 	}),
 	zod.z.object({
 		kind: zod.z.literal("code"),
@@ -8248,10 +8283,45 @@ var AutomationActionSchema = zod.z.discriminatedUnion("kind", [
 		code: zod.z.string().min(1).max(2e4)
 	})
 ]);
+/**
+* How a trigger that arrives while the automation is busy (or cooling down) is
+* handled. One of the automation's execution modes, never a property of its
+* actions. Absent means `single`.
+*
+*  - `single`   — drop the trigger while a run is in progress (traced + logged).
+*  - `restart`  — abort the run in progress (at its next step boundary), start fresh.
+*  - `queued`   — queue up to `max` triggers, drop the rest (traced).
+*  - `parallel` — up to `max` runs at once, drop the rest (traced).
+*  - `cooldown` — `single`, and no new run until `minutes` after the last run
+*    STARTED; persisted across a restart. A manual trigger bypasses only this
+*    wait, never the single/queued limits.
+*/
+var AutomationRunModeSchema = zod.z.discriminatedUnion("mode", [
+	zod.z.object({ mode: zod.z.literal("single") }),
+	zod.z.object({ mode: zod.z.literal("restart") }),
+	zod.z.object({
+		mode: zod.z.literal("queued"),
+		max: zod.z.number().int().min(1).max(10)
+	}),
+	zod.z.object({
+		mode: zod.z.literal("parallel"),
+		max: zod.z.number().int().min(1).max(10)
+	}),
+	zod.z.object({
+		mode: zod.z.literal("cooldown"),
+		minutes: zod.z.number().int().min(1).max(1440)
+	})
+]);
+/** Run traces kept per automation when the recipe does not say. */
+var DEFAULT_TRACE_KEEP = 20;
+var MAX_TRACE_KEEP = 100;
 var AutomationRecipeSchema = zod.z.object({
 	triggers: zod.z.array(AutomationTriggerSchema),
 	conditions: AutomationConditionSchema.optional(),
-	actions: zod.z.array(AutomationActionSchema)
+	actions: zod.z.array(AutomationActionSchema),
+	runMode: AutomationRunModeSchema.optional(),
+	/** How many run traces the automation keeps (default {@link DEFAULT_TRACE_KEEP}). */
+	keepTraces: zod.z.number().int().min(1).max(100).optional()
 });
 /** Depth of a tree, root container = 1. A bare leaf is depth 1. */
 function conditionDepth(cond) {
@@ -8303,19 +8373,23 @@ function validateRecipeBounds(recipe) {
 /** How often the state mirror is re-read as the backstop for a dropped event
 *  (D8: an event WAKES the evaluation, the reconcile guarantees it). */
 var RECONCILE_MS = 15e3;
+/** What a step trace shows before the step runs. */
+function stepMetaOf(action) {
+	switch (action.kind) {
+		case "wait": return { kind: "wait" };
+		case "code": return { kind: "code" };
+		case "action": return { kind: "action" };
+		case "cap": return {
+			kind: "cap",
+			cap: action.cap,
+			method: action.method,
+			...typeof action.deviceId === "number" ? { deviceId: action.deviceId } : {}
+		};
+	}
+}
 function j(value) {
 	return JSON.stringify(value);
 }
-/** Emit the boolean tree as calls into the generated combinators. */
-function emitCondition(cond, indent) {
-	switch (cond.kind) {
-		case "all": return `allOf([\n${cond.children.map((c) => `${indent}  () => ${emitCondition(c, `${indent}  `)}`).join(",\n")}\n${indent}])`;
-		case "any": return `anyOf([\n${cond.children.map((c) => `${indent}  () => ${emitCondition(c, `${indent}  `)}`).join(",\n")}\n${indent}])`;
-		case "not": return `notOf(() => ${emitCondition(cond.child, indent)})`;
-		case "condition": return `leaf(${j(cond.deviceId)}, ${j(cond.cap)}, ${j(cond.fieldPath)}, ${j(cond.operator)}, ${j(cond.value)})`;
-		case "expression": return `exprLeaf(${j(cond.expr)}, ${j(cond.bindings)})`;
-	}
-}
 function emitTrigger(trigger, index) {
 	switch (trigger.kind) {
 		case "schedule": return `  // trigger ${index}: schedule — armed to the next minute boundary and
@@ -8391,31 +8465,79 @@ function emitTrigger(trigger, index) {
   }`;
 		}
 		case "manual": return `  // trigger ${index}: manual — fired by automation-control.trigger
-  // ("Run actions"), which runs the THEN half with an EMPTY vars bag.`;
+  // ("Run actions"), which runs the THEN half with an EMPTY vars bag. A manual
+  // run bypasses only the cooldown wait, never the single/queued limits.`;
+		case "interval": return `  // trigger ${index}: interval — every ${trigger.minutes} min, first run jittered so
+  // blocks restarted together do not all fire on the same second.
+  {
+    let interval: ReturnType<typeof setInterval> | undefined
+    const first = setTimeout(() => {
+      void run({ kind: 'interval', at: Date.now() })
+      interval = setInterval(() => { void run({ kind: 'interval', at: Date.now() }) }, ${j(trigger.minutes * 6e4)})
+    }, Math.floor(Math.random() * Math.min(${j(trigger.minutes * 6e4)}, 30_000)) + 1)
+    disposers.push(() => {
+      clearTimeout(first)
+      if (interval !== undefined) clearInterval(interval)
+    })
+  }`;
+		case "detection": return `  // trigger ${index}: detection — ONE fire per (device, track); a rejected event is
+  // traced with its reason and never fires.
+  {
+    const filter = new DetectionTriggerFilter(${j(trigger)})
+    disposers.push(
+      ctx.eventBus.subscribe(
+        { category: EventCategory.PipelineAnalyticsTrackLifecycle },
+        (event) => {
+          const decision = filter.evaluate(event.data, Date.now())
+          if (decision.kind === 'ignore') return
+          if (decision.kind === 'reject') {
+            ctx.logger.debug('detection trigger rejected an event', {
+              tags: { deviceId: decision.vars.deviceId },
+              reason: decision.reason,
+            })
+          }
+          void run(
+            { kind: 'detection', at: Date.now(), ...decision.vars },
+            decision.reason,
+            decision.kind === 'fire',
+          )
+        },
+      ),
+    )
+  }`;
 	}
 }
 function emitAction(action, index) {
+	const step = (body) => `    {
+      meta: STEP_META[${index}]!,
+      run: async (scope) => {
+${body}
+      },
+    },`;
 	switch (action.kind) {
-		case "wait": return `      case ${index}: await sleep(${j(action.seconds * 1e3)}); break`;
+		case "wait": return step(`        await sleep(${j(action.seconds * 1e3)})`);
 		case "cap":
-			if (Array.isArray(action.deviceId)) return `      case ${index}: {
-        for (const deviceId of ${j(action.deviceId)}) {
+			if (Array.isArray(action.deviceId)) return step(`        for (const deviceId of ${j(action.deviceId)}) {
+          scope.setDeviceId(deviceId)
           await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)
-        }
-        break
-      }`;
-			return `      case ${index}: {
-        const deviceId = ${typeof action.deviceId === "number" ? j(action.deviceId) : `resolveTarget(vars, ${j(action.deviceId.$var)})`}
-        await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)
-        break
-      }`;
-		case "code": return `      case ${index}: {
-        // inline code action — a fragment of THIS block, bundled by esbuild
+        }`);
+			return step(`        const deviceId = ${typeof action.deviceId === "number" ? j(action.deviceId) : `resolveTarget(vars, ${j(action.deviceId.$var)})`}
+        scope.setDeviceId(deviceId)
+        await actuate(deviceId, ${j(action.cap)}, ${j(action.method)}, ${j(action.args ?? {})}, vars)`);
+		case "action": return step(`        // an Action run, awaited: the step takes THAT run's outcome
+        const result = await ctx.api.actions.run.mutate({
+          actionId: ${j(action.actionId)},
+          variables: substituteVariables(${j(action.variables ?? {})}, vars),
+          wait: true,
+          origin: { blockId: BLOCK_ID ?? undefined },
+        })
+        if (result.outcome !== 'ran') {
+          throw new Error('action ' + ${j(action.actionId)} + ' ' + result.outcome + (result.message === undefined ? '' : ': ' + result.message))
+        }`);
+		case "code": return step(`        // inline code action — a fragment of THIS block, bundled by esbuild
         await (async () => {
 ${action.code.split("\n").map((line) => `          ${line}`).join("\n")}
-        })()
-        break
-      }`;
+        })()`);
 	}
 }
 /**
@@ -8429,9 +8551,31 @@ function generateAutomationBlock(input) {
 	const boundsError = validateRecipeBounds(input.recipe);
 	if (boundsError !== null) throw new Error(`cannot generate an automation from an invalid recipe: ${boundsError}`);
 	const { name, recipe } = input;
-	const conditionExpr = recipe.conditions === void 0 ? "true" : `await ${emitCondition(recipe.conditions, "    ")}`;
-	return `import type { AddonContext } from '@camstack/types'
-import { evaluateExpressionSource, toExpressionValue } from '@camstack/types'
+	const runMode = recipe.runMode ?? { mode: "single" };
+	const stepMeta = recipe.actions.map(stepMetaOf);
+	return `import type {
+  AddonContext,
+  AutomationConditionTraceNode,
+  AutomationRunTrace,
+  AutomationRunVerdict,
+  AutomationStepTrace,
+  RunnableStep,
+} from '@camstack/types'
+import {
+  ConditionMirror,
+  DetectionTriggerFilter,
+  EventCategory,
+  RunGate,
+  buildTriggerTrace,
+  collectMirrorSources,
+  coreBlockIdFromAddonId,
+  evaluateConditionTree,
+  isSkippedTrace,
+  mergeSkipTraces,
+  resolveDeviceTarget,
+  resolveStepArgs,
+  runSteps,
+} from '@camstack/types'
 
 /**
  * ${name}
@@ -8446,6 +8590,20 @@ const AUTOMATION_RECIPE = ${JSON.stringify(recipe, null, 2)} as const
 
 const RECONCILE_MS = ${RECONCILE_MS}
 
+/** How triggers that arrive while busy (or cooling down) are handled. */
+const RUN_MODE = ${j(runMode)} as const
+
+/** Run traces kept (a ring, held in the hub's runs ledger). */
+const KEEP_TRACES = ${recipe.keepTraces ?? 20}
+
+const CONDITIONS = ${recipe.conditions === void 0 ? "undefined" : "AUTOMATION_RECIPE.conditions"}
+
+/** Skips that repeat are folded into one trace; it goes to the hub after this. */
+const SKIP_FLUSH_MS = 5_000
+
+/** Static facts about each action step, for its trace. */
+const STEP_META: ReadonlyArray<{ kind: string; cap?: string; method?: string; deviceId?: number }> = ${j(stepMeta)}
+
 /** A cap is named \`alarm-panel\`; \`ctx.api\` is keyed by the ROUTER name,
  *  \`alarmPanel\`. Indexing ctx.api with the cap name yields undefined and every
  *  action throws, so the conversion is not cosmetic. */
@@ -8496,137 +8654,170 @@ function matchField(field: string, value: number): boolean {
 
 export default function block(ctx: AddonContext) {
   const disposers: Array<() => void> = []
-  const sleep = (ms: number): Promise<void> => new Promise((r) => setTimeout(r, ms))
+  const gate = new RunGate(RUN_MODE)
+  const mirror = new ConditionMirror(collectMirrorSources(CONDITIONS))
+  const BLOCK_ID = coreBlockIdFromAddonId(ctx.id)
+  /** The cooldown stamp: memory is the authority at fire time (D49); the hub ledger is read once at start. */
+  let lastRunStartedAt: number | null = null
+  /** True when the stamp could not be read at start — the first run is let through and says so. */
+  let stampUnknown = false
+  let sendChain: Promise<void> = Promise.resolve()
+  let pendingSkip: AutomationRunTrace | undefined
+  let skipTimer: ReturnType<typeof setTimeout> | undefined
+  let stopped = false
+  let runCounter = 0
+  const runningTokens = new Set<RunToken>()
+  const queue: QueuedRun[] = []
 
-  /** Read one cap field off the state mirror. Returns undefined when the device,
-   *  the cap or the field cannot be resolved — the caller decides what that
-   *  means, and it always logs. */
-  async function readField(
-    deviceId: number,
-    cap: string,
-    fieldPath: string,
-  ): Promise<unknown> {
-    try {
-      const slice = await ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap })
-      let cursor: unknown = slice
-      for (const part of fieldPath.split('.')) {
-        if (cursor === null || typeof cursor !== 'object') return undefined
-        cursor = (cursor as Record<string, unknown>)[part]
+  interface RunToken {
+    aborted: boolean
+    wake?: () => void
+  }
+  interface QueuedRun {
+    readonly trigger: Record<string, unknown>
+    readonly reason: string
+    readonly queuedAt: number
+  }
+
+  /** Sleep that a restart can cut short. */
+  const abortableSleep = (ms: number, token: RunToken): Promise<void> =>
+    new Promise((resolve) => {
+      const timer = setTimeout(resolve, ms)
+      token.wake = () => {
+        clearTimeout(timer)
+        resolve()
       }
-      return cursor
-    } catch {
-      return undefined
+    })
+
+  // ── the hub's runs ledger: the stamp is read ONCE here, the ring is written through RPC ──
+  async function loadState(): Promise<void> {
+    if (BLOCK_ID === null) {
+      ctx.logger.warn('this is not a core-block addon id — no run ledger, cooldown and traces will not survive a restart', { addonId: ctx.id })
+      return
+    }
+    try {
+      const doc = await ctx.api.coreBlocks.getAutomationRunState.query({ blockId: BLOCK_ID })
+      lastRunStartedAt = doc.lastRunStartedAt
+    } catch (err: unknown) {
+      stampUnknown = true
+      ctx.logger.warn('could not read the stored cooldown stamp — the first run is let through', {
+        blockId: BLOCK_ID,
+        error: err instanceof Error ? err.message : String(err),
+      })
     }
   }
 
-  function compare(actual: unknown, operator: string, expected: unknown): boolean {
-    switch (operator) {
-      case 'eq': return actual === expected
-      case 'ne': return actual !== expected
-      case 'gt': return typeof actual === 'number' && typeof expected === 'number' && actual > expected
-      case 'gte': return typeof actual === 'number' && typeof expected === 'number' && actual >= expected
-      case 'lt': return typeof actual === 'number' && typeof expected === 'number' && actual < expected
-      case 'lte': return typeof actual === 'number' && typeof expected === 'number' && actual <= expected
-      case 'contains': return typeof actual === 'string' && typeof expected === 'string' && actual.includes(expected)
-      case 'in': return Array.isArray(expected) && expected.some((v) => v === actual)
-      default: return false
-    }
+  function send(payload: { trace?: AutomationRunTrace; runStartedAt?: number }): Promise<void> {
+    if (BLOCK_ID === null) return Promise.resolve()
+    const blockId = BLOCK_ID
+    sendChain = sendChain.then(async () => {
+      try {
+        await ctx.api.coreBlocks.reportAutomationRun.mutate({ blockId, keepTraces: KEEP_TRACES, ...payload })
+      } catch (err: unknown) {
+        ctx.logger.warn('could not report the run to the hub ledger', {
+          blockId,
+          error: err instanceof Error ? err.message : String(err),
+        })
+      }
+    })
+    return sendChain
   }
 
-  /** A leaf whose device or cap is currently unresolvable is FALSE and logs.
-   *  It never throws the pass away, and it never counts as true. */
-  async function leaf(
-    deviceId: number,
-    cap: string,
-    fieldPath: string,
-    operator: string,
-    expected: unknown,
-  ): Promise<boolean> {
-    const actual = await readField(deviceId, cap, fieldPath)
-    if (actual === undefined) {
-      ctx.logger.warn('condition leaf unresolvable — treated as false', {
-        tags: { deviceId },
-        cap,
-        fieldPath,
-      })
-      return false
+  function flushSkip(): void {
+    if (skipTimer !== undefined) {
+      clearTimeout(skipTimer)
+      skipTimer = undefined
     }
-    return compare(actual, operator, expected)
+    if (pendingSkip === undefined) return
+    const trace = pendingSkip
+    pendingSkip = undefined
+    void send({ trace })
   }
 
-  /** The expression leaf goes through the bounded engine — parsed AST, no
-   *  member access, no loops, hard step/node limits. Never inline JS. */
-  async function exprLeaf(
-    expr: string,
-    bindings: Record<string, { kind?: string; cap?: string; fieldPath?: string; value?: unknown; sourceStableId?: string }>,
-  ): Promise<boolean> {
-    const values: Record<string, string | number | boolean | null> = {}
-    for (const [alias, binding] of Object.entries(bindings)) {
-      if (binding.kind === 'literal') {
-        values[alias] = toExpressionValue(binding.value) ?? null
-        continue
-      }
-      const deviceId = await stableIdToDeviceId(binding.sourceStableId)
-      if (deviceId === undefined) {
-        ctx.logger.warn('condition leaf unresolvable — treated as false', {
-          tags: { deviceId: -1 },
-          binding: alias,
-        })
-        return false
+  /** A skip identical to the one waiting is COUNTED on it; anything else flushes it first. */
+  function record(trace: AutomationRunTrace): void {
+    if (isSkippedTrace(trace)) {
+      if (pendingSkip !== undefined) {
+        const merged = mergeSkipTraces(pendingSkip, trace)
+        if (merged !== null) {
+          pendingSkip = merged
+          return
+        }
+        flushSkip()
       }
-      const raw = await readField(deviceId, binding.cap ?? '', binding.fieldPath ?? '')
-      values[alias] = toExpressionValue(raw) ?? null
+      pendingSkip = trace
+      skipTimer = setTimeout(flushSkip, SKIP_FLUSH_MS)
+      return
     }
-    const result = evaluateExpressionSource(expr, values, Date.now())
-    if (!result.ok) {
-      ctx.logger.warn('expression leaf failed — treated as false', { expr, error: result.error })
-      return false
+    flushSkip()
+    void send({ trace })
+  }
+
+  // ── the condition mirror (D49): memory only at fire time ──
+  async function refreshMirror(): Promise<void> {
+    const report = await mirror.refresh({
+      fetchSlice: (deviceId, cap) => ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap }),
+      fetchStableIds: async () => {
+        const all = await ctx.api.deviceManager.listAll.query({})
+        return new Map(all.devices.flatMap((d: { stableId?: string; id: number }) =>
+          d.stableId === undefined ? [] : [[d.stableId, d.id] as [string, number]]))
+      },
+    })
+    if (report.kept > 0) {
+      ctx.logger.debug('condition mirror kept stale values for sources it could not read', report)
     }
-    return result.value === true
   }
 
-  async function stableIdToDeviceId(stableId: string | undefined): Promise<number | undefined> {
-    if (stableId === undefined) return undefined
+  /** Read one cap field off the state mirror. Returns undefined when the device,
+   *  the cap or the field cannot be resolved — the caller decides what that
+   *  means, and it always logs. (Used by the device-state TRIGGER, which the
+   *  reconcile backs; conditions read the ConditionMirror instead.) */
+  async function readField(
+    deviceId: number,
+    cap: string,
+    fieldPath: string,
+  ): Promise<unknown> {
     try {
-      const all = await ctx.api.deviceManager.listAll.query({})
-      const hit = all.devices.find((d: { stableId?: string; id: number }) => d.stableId === stableId)
-      return hit?.id
+      const slice = await ctx.api.deviceState.getCapSlice.query({ deviceId, capName: cap })
+      let cursor: unknown = slice
+      for (const part of fieldPath.split('.')) {
+        if (cursor === null || typeof cursor !== 'object') return undefined
+        cursor = (cursor as Record<string, unknown>)[part]
+      }
+      return cursor
     } catch {
       return undefined
     }
   }
 
-  async function allOf(children: Array<() => Promise<boolean>>): Promise<boolean> {
-    for (const c of children) { if (!(await c())) return false }
-    return true
-  }
-  async function anyOf(children: Array<() => Promise<boolean>>): Promise<boolean> {
-    for (const c of children) { if (await c()) return true }
-    return false
-  }
-  async function notOf(child: () => Promise<boolean>): Promise<boolean> {
-    return !(await child())
-  }
-
   /** A {$var} action target, resolved from the run's bag BEFORE dispatch — the
    *  action runner only ever sees a number. */
   function resolveTarget(vars: Record<string, unknown>, name: string): number {
-    const raw = vars[name]
-    if (typeof raw === 'number') return raw
-    throw new Error('action target var "' + name + '" is not a device id')
+    return resolveDeviceTarget(vars, name)
   }
 
-  /** Substitute {{vars.x}} slots. Substitution only — never evaluation. */
+  function warnMissingVar(name: string): void {
+    ctx.logger.warn('template referenced a var that was never set', { var: name })
+  }
+
+  /** Substitute {{vars.x}} slots and { $var } values. Substitution only — never evaluation. */
   function substitute(value: unknown, vars: Record<string, unknown>): unknown {
-    if (typeof value !== 'string') return value
-    return value.replace(/\\{\\{\\s*vars\\.([A-Za-z_][A-Za-z0-9_]*)\\s*\\}\\}/g, (_m, key: string) => {
-      const v = vars[key]
-      if (v === undefined) {
-        ctx.logger.warn('template referenced a var that was never set', { var: key })
-        return ''
+    return resolveStepArgs(value, vars, warnMissingVar)
+  }
+
+  /** The variables handed to an Action step, substituted and kept to primitives. */
+  function substituteVariables(
+    raw: Record<string, string | number | boolean>,
+    vars: Record<string, unknown>,
+  ): Record<string, string | number | boolean> {
+    const out: Record<string, string | number | boolean> = {}
+    for (const [key, value] of Object.entries(raw)) {
+      const resolved = substitute(value, vars)
+      if (typeof resolved === 'string' || typeof resolved === 'number' || typeof resolved === 'boolean') {
+        out[key] = resolved
       }
-      return String(v)
-    })
+    }
+    return out
   }
 
   async function actuate(
@@ -8636,8 +8827,9 @@ export default function block(ctx: AddonContext) {
     args: Record<string, unknown>,
     vars: Record<string, unknown>,
   ): Promise<void> {
-    const resolved: Record<string, unknown> = {}
-    for (const [k, v] of Object.entries(args)) resolved[k] = substitute(v, vars)
+    const substituted = substitute(args, vars)
+    const resolved: Record<string, unknown> =
+      substituted !== null && typeof substituted === 'object' ? { ...substituted } : {}
     // Forked-addon ctx.api namespaces are tRPC Proxies over a noop function
     // (typeof === 'function'), not plain objects — reject only null/undefined.
     const client: unknown = Reflect.get(ctx.api, capToRouterKey(cap))
@@ -8651,48 +8843,1693 @@ export default function block(ctx: AddonContext) {
     await mutate({ ...resolved, deviceId })
   }
 
-  async function evaluateConditions(): Promise<boolean> {
-    return ${conditionExpr}
-  }
-
-  /** The THEN half. Stops at the first failure — continuing past a failed step
-   *  executes an intent the operator never expressed. */
-  async function runActions(vars: Record<string, unknown>): Promise<void> {
-    for (let step = 0; step < ${recipe.actions.length}; step += 1) {
-      try {
-        switch (step) {
+  /** The THEN half, through the ONE shared step runner: stops at the first
+   *  failure (continuing past a failed step executes an intent the operator
+   *  never expressed); every step is traced, the ones after a failure (or an
+   *  abort) are marked not-run. */
+  async function runActions(
+    vars: Record<string, unknown>,
+    token: RunToken,
+  ): Promise<{ steps: readonly AutomationStepTrace[]; failed: boolean }> {
+    const sleep = (ms: number): Promise<void> => abortableSleep(ms, token)
+    const steps: RunnableStep[] = [
 ${recipe.actions.map((a, i) => emitAction(a, i)).join("\n")}
-        }
-      } catch (err: unknown) {
+    ]
+    return runSteps(steps, {
+      pathPrefix: 'actions',
+      isAborted: () => token.aborted,
+      abortReason: 'aborted by a restart',
+      now: () => Date.now(),
+      onFailure: (failure) => {
         ctx.logger.warn('action failed — stopping the sequence', {
-          step,
-          error: err instanceof Error ? err.message : String(err),
+          ...(failure.deviceId === undefined ? {} : { tags: { deviceId: failure.deviceId } }),
+          step: failure.index,
+          error: failure.message,
         })
+      },
+    })
+  }
+
+  function deviceTags(trigger: Record<string, unknown>): { tags?: { deviceId: number } } {
+    const deviceId = trigger['deviceId']
+    return typeof deviceId === 'number' ? { tags: { deviceId } } : {}
+  }
+
+  function newRunId(at: number): string {
+    runCounter += 1
+    return at.toString(36) + '-' + runCounter.toString(36)
+  }
+
+  /** A trigger that never became a run (rejected, or dropped by the run mode). */
+  function skipTrace(
+    trigger: Record<string, unknown>,
+    reason: string,
+    outcome: AutomationRunTrace['outcome'],
+    verdict: AutomationRunVerdict | undefined,
+    accepted: boolean,
+  ): AutomationRunTrace {
+    const now = Date.now()
+    return {
+      runId: newRunId(now),
+      startedAt: now,
+      endedAt: now,
+      trigger: buildTriggerTrace(trigger, accepted ? 'pass' : 'fail', reason),
+      conditions: [],
+      ...(verdict === undefined ? {} : { verdict }),
+      steps: [],
+      outcome,
+      repeat: 1,
+      lastAt: now,
+    }
+  }
+
+  /** One admitted run: conditions (memory only), the cooldown, the actions. */
+  async function execute(
+    trigger: Record<string, unknown>,
+    reason: string,
+    admission: AutomationRunVerdict,
+  ): Promise<void> {
+    const token: RunToken = { aborted: false }
+    runningTokens.add(token)
+    const startedAt = Date.now()
+    const runId = newRunId(startedAt)
+    let verdict = admission
+    let outcome: AutomationRunTrace['outcome'] = 'ran'
+    let nodes: AutomationConditionTraceNode[] = []
+    let steps: AutomationStepTrace[] = []
+    try {
+      const evaluation = evaluateConditionTree(CONDITIONS, mirror, Date.now())
+      nodes = [...evaluation.nodes]
+      for (const node of nodes) {
+        if (node.kind === 'condition' && node.observed === null && node.deviceId !== undefined) {
+          ctx.logger.warn('condition leaf value unknown — treated as false', {
+            tags: { deviceId: node.deviceId },
+            path: node.path,
+            cap: node.cap,
+            fieldPath: node.fieldPath,
+          })
+        }
+      }
+      if (!evaluation.pass) {
+        outcome = 'skipped-conditions'
+        ctx.logger.debug('automation did not run — conditions were false', { trigger, ...deviceTags(trigger) })
         return
       }
+      const letThrough = stampUnknown && RUN_MODE.mode === 'cooldown'
+      const cooldown = letThrough
+        ? { ok: true, bypassed: true, reason: 'cooldown stamp unreadable at start — run let through' }
+        : gate.cooldown({
+            manual: trigger['kind'] === 'manual',
+            now: Date.now(),
+            lastRunStartedAt,
+          })
+      if (!cooldown.ok) {
+        outcome = 'skipped-cooldown'
+        verdict = { mode: RUN_MODE, decision: 'cooldown', reason: cooldown.reason }
+        ctx.logger.info('automation did not run — ' + cooldown.reason, deviceTags(trigger))
+        return
+      }
+      if (cooldown.bypassed) verdict = { mode: RUN_MODE, decision: 'bypass', reason: cooldown.reason }
+      // Stamped when the actions START, and reported to the hub before they run,
+      // so a restart mid-run cannot fire again inside the window.
+      lastRunStartedAt = startedAt
+      stampUnknown = false
+      await send({ runStartedAt: startedAt })
+      ctx.logger.info('automation running', { trigger, ...deviceTags(trigger) })
+      const vars: Record<string, unknown> = { ...trigger }
+      const result = await runActions(vars, token)
+      steps = result.steps
+      outcome = token.aborted ? 'aborted' : result.failed ? 'failed' : 'ran'
+    } catch (err: unknown) {
+      outcome = 'failed'
+      ctx.logger.warn('automation run failed', { error: err instanceof Error ? err.message : String(err), ...deviceTags(trigger) })
+    } finally {
+      runningTokens.delete(token)
+      const endedAt = Date.now()
+      record({
+        runId,
+        startedAt,
+        endedAt,
+        trigger: buildTriggerTrace(trigger, 'pass', reason),
+        conditions: nodes,
+        verdict,
+        steps,
+        outcome,
+        repeat: 1,
+        lastAt: endedAt,
+      })
+      if (gate.release()) {
+        const next = queue.shift()
+        if (next !== undefined && !stopped) {
+          void execute(next.trigger, next.reason, {
+            mode: RUN_MODE,
+            decision: 'queued',
+            reason: 'queued, then ran after waiting ' + (Date.now() - next.queuedAt) + ' ms',
+          })
+        }
+      }
     }
   }
 
-  async function run(trigger: Record<string, unknown>): Promise<void> {
-    const vars: Record<string, unknown> = { ...trigger }
-    const passed = await evaluateConditions()
-    if (!passed) {
-      ctx.logger.debug('automation did not run — conditions were false', { trigger })
+  /** Every trigger lands here. \`accepted\` = the trigger itself was satisfied
+   *  (a rejected detection event is only traced). */
+  async function run(
+    trigger: Record<string, unknown>,
+    reason = 'fired',
+    accepted = true,
+  ): Promise<void> {
+    await ready
+    if (stopped) return
+    if (!accepted) {
+      record(skipTrace(trigger, reason, 'skipped-trigger', undefined, false))
       return
     }
-    ctx.logger.info('automation running', { trigger })
-    await runActions(vars)
+    const admission = gate.admit()
+    const verdict: AutomationRunVerdict = { mode: RUN_MODE, decision: admission.decision, reason: admission.reason }
+    switch (admission.decision) {
+      case 'drop':
+        ctx.logger.info('automation trigger dropped — ' + admission.reason, deviceTags(trigger))
+        record(skipTrace(trigger, reason, 'skipped-overlap', verdict, true))
+        return
+      case 'queued':
+        ctx.logger.info('automation trigger queued — ' + admission.reason, deviceTags(trigger))
+        queue.push({ trigger, reason, queuedAt: Date.now() })
+        return
+      case 'restart':
+        ctx.logger.info('automation restarting — ' + admission.reason, deviceTags(trigger))
+        for (const running of runningTokens) {
+          running.aborted = true
+          running.wake?.()
+        }
+        break
+      case 'run':
+        break
+    }
+    await execute(trigger, reason, verdict)
+  }
+
+  const ready: Promise<void> = (async () => {
+    await loadState()
+    await refreshMirror()
+  })()
+
+  if (CONDITIONS !== undefined) {
+    disposers.push(
+      ctx.eventBus.subscribe({ category: EventCategory.DeviceStateChanged }, (event) => {
+        const data = event.data
+        const deviceId = data['deviceId']
+        const capName = data['capName']
+        if (typeof deviceId === 'number' && typeof capName === 'string') {
+          mirror.apply(deviceId, capName, data['slice'])
+        }
+      }),
+    )
+    const mirrorReconcile = setInterval(() => { void refreshMirror() }, RECONCILE_MS)
+    disposers.push(() => clearInterval(mirrorReconcile))
   }
 
 ${recipe.triggers.map((t, i) => emitTrigger(t, i)).join("\n\n")}
 
   return () => {
+    stopped = true
+    queue.length = 0
+    flushSkip()
+    for (const running of runningTokens) {
+      running.aborted = true
+      running.wake?.()
+    }
     for (const dispose of disposers) dispose()
   }
 }
 `;
 }
 //#endregion
+//#region src/automation/condition-eval.ts
+/**
+* Evaluating an automation's condition tree against the ConditionMirror.
+*
+* D49: a trigger is a one-shot event, so its gate must never hang on a read
+* that can fail. Every field a condition leaf names is therefore kept in
+* memory — filled at start, updated off device state-changed events, reconciled
+* on a timer — and evaluation reads that memory ONLY. A value the mirror does
+* not hold is UNKNOWN, which is `fail` with a reason, never a throw and never a
+* `pass`. A failed refresh changes nothing: the previous value stays.
+*
+* The evaluator returns a node per tree position (containers, leaves, and the
+* ones a short-circuit never reached) with a stable path and a human reason, so
+* the editor can paint each block.
+*/
+function collectInto(cond, out) {
+	switch (cond.kind) {
+		case "all":
+		case "any":
+			for (const child of cond.children) collectInto(child, out);
+			return;
+		case "not":
+			collectInto(cond.child, out);
+			return;
+		case "condition":
+			out.push({
+				kind: "device",
+				deviceId: cond.deviceId,
+				cap: cond.cap
+			});
+			return;
+		case "expression":
+			for (const binding of Object.values(cond.bindings)) if (binding.kind === "global") out.push({
+				kind: "stable",
+				stableId: binding.sourceStableId,
+				cap: binding.cap
+			});
+			return;
+	}
+}
+/** Every (device, cap) a tree reads, deduplicated. */
+function collectMirrorSources(cond) {
+	if (cond === void 0) return [];
+	const all = [];
+	collectInto(cond, all);
+	const seen = /* @__PURE__ */ new Set();
+	return all.filter((s) => {
+		const key = s.kind === "device" ? `d|${s.deviceId}|${s.cap}` : `s|${s.stableId}|${s.cap}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function sliceKey(deviceId, cap) {
+	return `${deviceId}|${cap}`;
+}
+function pick$1(slice, fieldPath) {
+	let cursor = slice;
+	for (const part of fieldPath.split(".")) {
+		if (cursor === null || typeof cursor !== "object") return void 0;
+		cursor = Reflect.get(cursor, part);
+	}
+	return cursor;
+}
+function isSliceObject(value) {
+	return typeof value === "object" && value !== null;
+}
+var ConditionMirror = class {
+	sources;
+	slices = /* @__PURE__ */ new Map();
+	stableIds = /* @__PURE__ */ new Map();
+	watched;
+	constructor(sources) {
+		this.sources = sources;
+		this.watched = new Set(sources.filter((s) => s.kind === "device").map((s) => sliceKey(s.deviceId, s.cap)));
+	}
+	/** A `device.state-changed` event. Slices nobody reads are ignored. */
+	apply(deviceId, cap, slice) {
+		const key = sliceKey(deviceId, cap);
+		if (!isSliceObject(slice)) return;
+		if (!this.watched.has(key) && !this.isStableTarget(deviceId, cap)) return;
+		this.slices.set(key, slice);
+	}
+	isStableTarget(deviceId, cap) {
+		for (const s of this.sources) if (s.kind === "stable" && s.cap === cap && this.stableIds.get(s.stableId) === deviceId) return true;
+		return false;
+	}
+	read(deviceId, cap, fieldPath) {
+		const slice = this.slices.get(sliceKey(deviceId, cap));
+		return slice === void 0 ? void 0 : pick$1(slice, fieldPath);
+	}
+	readStable(stableId, cap, fieldPath) {
+		const deviceId = this.stableIds.get(stableId);
+		return deviceId === void 0 ? void 0 : this.read(deviceId, cap, fieldPath);
+	}
+	/** Fill / reconcile. A read that fails or answers nothing keeps the old value. */
+	async refresh(fetchers) {
+		let updated = 0;
+		let kept = 0;
+		if (this.sources.some((s) => s.kind === "stable")) try {
+			this.stableIds = await fetchers.fetchStableIds();
+		} catch {}
+		const targets = /* @__PURE__ */ new Map();
+		for (const s of this.sources) {
+			const deviceId = s.kind === "device" ? s.deviceId : this.stableIds.get(s.stableId);
+			if (deviceId === void 0) {
+				kept += 1;
+				continue;
+			}
+			targets.set(sliceKey(deviceId, s.cap), {
+				deviceId,
+				cap: s.cap
+			});
+		}
+		for (const [key, target] of targets) try {
+			const slice = await fetchers.fetchSlice(target.deviceId, target.cap);
+			if (isSliceObject(slice)) {
+				this.slices.set(key, slice);
+				updated += 1;
+			} else kept += 1;
+		} catch {
+			kept += 1;
+		}
+		return {
+			updated,
+			kept
+		};
+	}
+};
+var OPERATOR_SYMBOL = {
+	eq: "=",
+	ne: "≠",
+	gt: ">",
+	gte: "≥",
+	lt: "<",
+	lte: "≤",
+	contains: "contains",
+	in: "in"
+};
+function compare(actual, operator, expected) {
+	switch (operator) {
+		case "eq": return actual === expected;
+		case "ne": return actual !== expected;
+		case "gt": return typeof actual === "number" && typeof expected === "number" && actual > expected;
+		case "gte": return typeof actual === "number" && typeof expected === "number" && actual >= expected;
+		case "lt": return typeof actual === "number" && typeof expected === "number" && actual < expected;
+		case "lte": return typeof actual === "number" && typeof expected === "number" && actual <= expected;
+		case "contains": return typeof actual === "string" && typeof expected === "string" && actual.includes(expected);
+		case "in": return Array.isArray(expected) && expected.some((v) => v === actual);
+	}
+}
+function toTraceValue(value) {
+	if (value === void 0 || value === null) return null;
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
+	if (Array.isArray(value) && value.every((v) => typeof v === "string" || typeof v === "number")) return value;
+	return JSON.stringify(value);
+}
+function show(value) {
+	return Array.isArray(value) ? `[${value.join(", ")}]` : String(value);
+}
+function markSkipped(cond, path, why, out) {
+	out.push({
+		path,
+		kind: cond.kind,
+		outcome: "not-evaluated",
+		reason: why
+	});
+	if (cond.kind === "all" || cond.kind === "any") cond.children.forEach((c, i) => {
+		markSkipped(c, `${path}.${i}`, why, out);
+	});
+	else if (cond.kind === "not") markSkipped(cond.child, `${path}.0`, why, out);
+}
+function evalNode(cond, path, reader, now, out) {
+	switch (cond.kind) {
+		case "condition": {
+			const observed = reader.read(cond.deviceId, cond.cap, cond.fieldPath);
+			const base = {
+				path,
+				kind: cond.kind,
+				deviceId: cond.deviceId,
+				cap: cond.cap,
+				fieldPath: cond.fieldPath,
+				operator: cond.operator,
+				expected: toTraceValue(cond.value),
+				observed: toTraceValue(observed)
+			};
+			if (observed === void 0) {
+				out.push({
+					...base,
+					outcome: "fail",
+					reason: `${cond.fieldPath} value unknown → fail`
+				});
+				return false;
+			}
+			const ok = compare(observed, cond.operator, cond.value);
+			out.push({
+				...base,
+				outcome: ok ? "pass" : "fail",
+				reason: `${cond.fieldPath} ${show(observed)}, expected ${OPERATOR_SYMBOL[cond.operator]} ${show(cond.value)} → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "expression": {
+			const values = {};
+			for (const [alias, binding] of Object.entries(cond.bindings)) {
+				if (binding.kind === "literal") {
+					values[alias] = require_composition.toExpressionValue(binding.value) ?? null;
+					continue;
+				}
+				const raw = binding.kind === "global" ? reader.readStable(binding.sourceStableId, binding.cap, binding.fieldPath) : void 0;
+				if (raw === void 0) {
+					out.push({
+						path,
+						kind: cond.kind,
+						outcome: "fail",
+						reason: `${alias} value unknown → fail`
+					});
+					return false;
+				}
+				values[alias] = require_composition.toExpressionValue(raw) ?? null;
+			}
+			const result = require_composition.evaluateExpressionSource(cond.expr, values, now);
+			if (!result.ok) {
+				out.push({
+					path,
+					kind: cond.kind,
+					outcome: "fail",
+					reason: `${cond.expr}: ${result.error} → fail`
+				});
+				return false;
+			}
+			const ok = result.value === true;
+			out.push({
+				path,
+				kind: cond.kind,
+				outcome: ok ? "pass" : "fail",
+				reason: `${cond.expr} with ${JSON.stringify(values)} → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "not": {
+			const at = out.length;
+			out.push({
+				path,
+				kind: "not",
+				outcome: "not-evaluated",
+				reason: ""
+			});
+			const inner = evalNode(cond.child, `${path}.0`, reader, now, out);
+			const ok = !inner;
+			out.splice(at, 1, {
+				path,
+				kind: "not",
+				outcome: ok ? "pass" : "fail",
+				reason: `not (${inner ? "pass" : "fail"}) → ${ok ? "pass" : "fail"}`
+			});
+			return ok;
+		}
+		case "all":
+		case "any": {
+			const isAll = cond.kind === "all";
+			const at = out.length;
+			out.push({
+				path,
+				kind: cond.kind,
+				outcome: "not-evaluated",
+				reason: ""
+			});
+			let decided = null;
+			for (let i = 0; i < cond.children.length; i += 1) {
+				const child = cond.children[i];
+				if (child === void 0) continue;
+				if (decided !== null) {
+					markSkipped(child, `${path}.${i}`, `short-circuited by ${path}.${decided}`, out);
+					continue;
+				}
+				const ok = evalNode(child, `${path}.${i}`, reader, now, out);
+				if (isAll ? !ok : ok) decided = i;
+			}
+			const ok = isAll ? decided === null : decided !== null;
+			const reason = isAll ? ok ? `all ${cond.children.length} passed → pass` : `${path}.${decided} failed → fail` : ok ? `${path}.${decided} passed → pass` : `none of ${cond.children.length} passed → fail`;
+			out.splice(at, 1, {
+				path,
+				kind: cond.kind,
+				outcome: ok ? "pass" : "fail",
+				reason
+			});
+			return ok;
+		}
+	}
+}
+/** No condition tree is a pass with no nodes. */
+function evaluateConditionTree(cond, reader, now) {
+	if (cond === void 0) return {
+		pass: true,
+		nodes: []
+	};
+	const nodes = [];
+	return {
+		pass: evalNode(cond, "conditions", reader, now, nodes),
+		nodes
+	};
+}
+//#endregion
+//#region src/catalogs/coco-classmap.ts
+var COCO_80_LABELS = [
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "bicycle",
+		name: "Bicycle"
+	},
+	{
+		id: "car",
+		name: "Car"
+	},
+	{
+		id: "motorcycle",
+		name: "Motorcycle"
+	},
+	{
+		id: "airplane",
+		name: "Airplane"
+	},
+	{
+		id: "bus",
+		name: "Bus"
+	},
+	{
+		id: "train",
+		name: "Train"
+	},
+	{
+		id: "truck",
+		name: "Truck"
+	},
+	{
+		id: "boat",
+		name: "Boat"
+	},
+	{
+		id: "traffic light",
+		name: "Traffic Light"
+	},
+	{
+		id: "fire hydrant",
+		name: "Fire Hydrant"
+	},
+	{
+		id: "stop sign",
+		name: "Stop Sign"
+	},
+	{
+		id: "parking meter",
+		name: "Parking Meter"
+	},
+	{
+		id: "bench",
+		name: "Bench"
+	},
+	{
+		id: "bird",
+		name: "Bird"
+	},
+	{
+		id: "cat",
+		name: "Cat"
+	},
+	{
+		id: "dog",
+		name: "Dog"
+	},
+	{
+		id: "horse",
+		name: "Horse"
+	},
+	{
+		id: "sheep",
+		name: "Sheep"
+	},
+	{
+		id: "cow",
+		name: "Cow"
+	},
+	{
+		id: "elephant",
+		name: "Elephant"
+	},
+	{
+		id: "bear",
+		name: "Bear"
+	},
+	{
+		id: "zebra",
+		name: "Zebra"
+	},
+	{
+		id: "giraffe",
+		name: "Giraffe"
+	},
+	{
+		id: "backpack",
+		name: "Backpack"
+	},
+	{
+		id: "umbrella",
+		name: "Umbrella"
+	},
+	{
+		id: "handbag",
+		name: "Handbag"
+	},
+	{
+		id: "tie",
+		name: "Tie"
+	},
+	{
+		id: "suitcase",
+		name: "Suitcase"
+	},
+	{
+		id: "frisbee",
+		name: "Frisbee"
+	},
+	{
+		id: "skis",
+		name: "Skis"
+	},
+	{
+		id: "snowboard",
+		name: "Snowboard"
+	},
+	{
+		id: "sports ball",
+		name: "Sports Ball"
+	},
+	{
+		id: "kite",
+		name: "Kite"
+	},
+	{
+		id: "baseball bat",
+		name: "Baseball Bat"
+	},
+	{
+		id: "baseball glove",
+		name: "Baseball Glove"
+	},
+	{
+		id: "skateboard",
+		name: "Skateboard"
+	},
+	{
+		id: "surfboard",
+		name: "Surfboard"
+	},
+	{
+		id: "tennis racket",
+		name: "Tennis Racket"
+	},
+	{
+		id: "bottle",
+		name: "Bottle"
+	},
+	{
+		id: "wine glass",
+		name: "Wine Glass"
+	},
+	{
+		id: "cup",
+		name: "Cup"
+	},
+	{
+		id: "fork",
+		name: "Fork"
+	},
+	{
+		id: "knife",
+		name: "Knife"
+	},
+	{
+		id: "spoon",
+		name: "Spoon"
+	},
+	{
+		id: "bowl",
+		name: "Bowl"
+	},
+	{
+		id: "banana",
+		name: "Banana"
+	},
+	{
+		id: "apple",
+		name: "Apple"
+	},
+	{
+		id: "sandwich",
+		name: "Sandwich"
+	},
+	{
+		id: "orange",
+		name: "Orange"
+	},
+	{
+		id: "broccoli",
+		name: "Broccoli"
+	},
+	{
+		id: "carrot",
+		name: "Carrot"
+	},
+	{
+		id: "hot dog",
+		name: "Hot Dog"
+	},
+	{
+		id: "pizza",
+		name: "Pizza"
+	},
+	{
+		id: "donut",
+		name: "Donut"
+	},
+	{
+		id: "cake",
+		name: "Cake"
+	},
+	{
+		id: "chair",
+		name: "Chair"
+	},
+	{
+		id: "couch",
+		name: "Couch"
+	},
+	{
+		id: "potted plant",
+		name: "Potted Plant"
+	},
+	{
+		id: "bed",
+		name: "Bed"
+	},
+	{
+		id: "dining table",
+		name: "Dining Table"
+	},
+	{
+		id: "toilet",
+		name: "Toilet"
+	},
+	{
+		id: "tv",
+		name: "TV"
+	},
+	{
+		id: "laptop",
+		name: "Laptop"
+	},
+	{
+		id: "mouse",
+		name: "Mouse"
+	},
+	{
+		id: "remote",
+		name: "Remote"
+	},
+	{
+		id: "keyboard",
+		name: "Keyboard"
+	},
+	{
+		id: "cell phone",
+		name: "Cell Phone"
+	},
+	{
+		id: "microwave",
+		name: "Microwave"
+	},
+	{
+		id: "oven",
+		name: "Oven"
+	},
+	{
+		id: "toaster",
+		name: "Toaster"
+	},
+	{
+		id: "sink",
+		name: "Sink"
+	},
+	{
+		id: "refrigerator",
+		name: "Refrigerator"
+	},
+	{
+		id: "book",
+		name: "Book"
+	},
+	{
+		id: "clock",
+		name: "Clock"
+	},
+	{
+		id: "vase",
+		name: "Vase"
+	},
+	{
+		id: "scissors",
+		name: "Scissors"
+	},
+	{
+		id: "teddy bear",
+		name: "Teddy Bear"
+	},
+	{
+		id: "hair drier",
+		name: "Hair Drier"
+	},
+	{
+		id: "toothbrush",
+		name: "Toothbrush"
+	}
+];
+var MACRO_LABELS = [
+	{
+		id: "person",
+		name: "Person"
+	},
+	{
+		id: "vehicle",
+		name: "Vehicle"
+	},
+	{
+		id: "animal",
+		name: "Animal"
+	},
+	{
+		id: "package",
+		name: "Package"
+	}
+];
+/**
+* The class names a per-class COUNT can ever be keyed on — the macro ids, and
+* only those.
+*
+* `preserveOriginal: false` below is the whole reason this set exists: the
+* executor maps each raw COCO label onto its macro and DROPS everything else,
+* so a tracked detection's `className` is always one of {@link MACRO_LABELS}.
+* Any surface that indexes counts by class name — the ZoneAnalytics occupancy
+* snapshot's `byClass`, and therefore every occupancy rule — can match nothing
+* else. Derived from the catalog, never hand-listed, so a new macro joins it by
+* being declared once.
+*
+* Cost of not having it, 2026-08-12: the notification rule editor offered the
+* full taxonomy for an occupancy class (occupancy is the one condition that
+* does not go through the engine's macro-expanding `expandClassSelector`), two
+* live rules were authored on `car`, and both counters read 0 forever.
+*/
+var DETECTION_MACRO_CLASSES = new Set(MACRO_LABELS.map((l) => l.id));
+/** True when `className` is a macro the detector can actually emit (and hence a
+*  class a count can be keyed on) — see {@link DETECTION_MACRO_CLASSES}. */
+function isDetectionMacroClass(className) {
+	return DETECTION_MACRO_CLASSES.has(className.trim().toLowerCase());
+}
+var COCO_TO_MACRO = {
+	mapping: {
+		person: "person",
+		bicycle: "vehicle",
+		car: "vehicle",
+		motorcycle: "vehicle",
+		airplane: "vehicle",
+		bus: "vehicle",
+		train: "vehicle",
+		truck: "vehicle",
+		boat: "vehicle",
+		bird: "animal",
+		cat: "animal",
+		dog: "animal",
+		horse: "animal",
+		sheep: "animal",
+		cow: "animal",
+		elephant: "animal",
+		bear: "animal",
+		zebra: "animal",
+		giraffe: "animal",
+		suitcase: "package",
+		backpack: "package",
+		handbag: "package"
+	},
+	preserveOriginal: false
+};
+var MACRO_NAMES = new Set(Object.values(COCO_TO_MACRO.mapping));
+function macroOf(className) {
+	return COCO_TO_MACRO.mapping[className] ?? className;
+}
+/** `animal` matches a dog; `dog` matches only a dog (a cat is also an animal). */
+function detectionClassMatches(wanted, actual) {
+	const w = wanted.toLowerCase();
+	const a = actual.toLowerCase();
+	if (w === a) return true;
+	return MACRO_NAMES.has(w) && macroOf(a) === w;
+}
+function isPhase(value) {
+	return value === "start" || value === "update" || value === "end";
+}
+var DetectionTriggerFilter = class {
+	trigger;
+	/** `${deviceId}|${trackId}` → fired at. Insertion-ordered, so the oldest is first. */
+	fired = /* @__PURE__ */ new Map();
+	constructor(trigger) {
+		this.trigger = trigger;
+	}
+	get firedCount() {
+		return this.fired.size;
+	}
+	evaluate(event, now) {
+		const { deviceId, trackId, phase } = event;
+		if (typeof deviceId !== "number" || typeof trackId !== "string" || !isPhase(phase)) return {
+			kind: "ignore",
+			why: "malformed track-lifecycle event"
+		};
+		if (!this.trigger.deviceIds.includes(deviceId)) return {
+			kind: "ignore",
+			why: `device ${deviceId} is not one of the trigger's devices`
+		};
+		const key = `${deviceId}|${trackId}`;
+		if (phase === "end") {
+			this.fired.delete(key);
+			return {
+				kind: "ignore",
+				why: "track ended"
+			};
+		}
+		this.expire(now);
+		const className = typeof event.bestClassName === "string" ? event.bestClassName : "";
+		const score = typeof event.bestConfidence === "number" ? event.bestConfidence : 0;
+		const vars = {
+			deviceId,
+			className,
+			trackId,
+			score
+		};
+		if (this.fired.has(key)) return {
+			kind: "reject",
+			reason: `already fired for track ${trackId}`,
+			vars
+		};
+		if (!this.trigger.classes.some((c) => detectionClassMatches(c, className))) return {
+			kind: "reject",
+			reason: `class ${className || "unknown"} not in [${this.trigger.classes.join(", ")}]`,
+			vars
+		};
+		if (this.trigger.minScore !== void 0 && score < this.trigger.minScore) return {
+			kind: "reject",
+			reason: `score ${score} < ${this.trigger.minScore}`,
+			vars
+		};
+		if (this.trigger.zones !== void 0) {
+			const visited = Array.isArray(event.zonesVisited) ? event.zonesVisited.filter((z) => typeof z === "string") : [];
+			if (!this.trigger.zones.some((z) => visited.includes(z))) return {
+				kind: "reject",
+				reason: `zone mismatch: visited [${visited.join(", ")}], wanted [${this.trigger.zones.join(", ")}]`,
+				vars
+			};
+		}
+		this.remember(key, now);
+		return {
+			kind: "fire",
+			reason: `${className} ${score} on device ${deviceId}`,
+			vars
+		};
+	}
+	remember(key, now) {
+		this.fired.set(key, now);
+		while (this.fired.size > 512) {
+			const oldest = this.fired.keys().next();
+			if (oldest.done === true) break;
+			this.fired.delete(oldest.value);
+		}
+	}
+	expire(now) {
+		for (const [key, at] of this.fired) {
+			if (now - at < 9e5) break;
+			this.fired.delete(key);
+		}
+	}
+};
+//#endregion
+//#region src/automation/run-gate.ts
+var MINUTE_MS$1 = 6e4;
+function minutes(ms) {
+	return (ms / MINUTE_MS$1).toFixed(1);
+}
+var RunGate = class {
+	mode;
+	active = 0;
+	pending = 0;
+	constructor(mode) {
+		this.mode = mode;
+	}
+	get activeRuns() {
+		return this.active;
+	}
+	get queuedTriggers() {
+		return this.pending;
+	}
+	admit() {
+		const mode = this.mode;
+		switch (mode.mode) {
+			case "single":
+			case "cooldown":
+				if (this.active > 0) return {
+					decision: "drop",
+					reason: `${mode.mode}: a run is already in progress`
+				};
+				this.active += 1;
+				return {
+					decision: "run",
+					reason: `${mode.mode}: no run in progress`
+				};
+			case "restart":
+				if (this.active > 0) {
+					this.active += 1;
+					return {
+						decision: "restart",
+						reason: `restart: aborting ${this.active - 1} run(s) in progress`
+					};
+				}
+				this.active += 1;
+				return {
+					decision: "run",
+					reason: "restart: no run in progress"
+				};
+			case "queued":
+				if (this.active === 0) {
+					this.active += 1;
+					return {
+						decision: "run",
+						reason: "queued: no run in progress"
+					};
+				}
+				if (this.pending < mode.max) {
+					this.pending += 1;
+					return {
+						decision: "queued",
+						reason: `queued: a run is in progress, waiting ${this.pending} of ${mode.max}`
+					};
+				}
+				return {
+					decision: "drop",
+					reason: `queued: a run is in progress and the queue is full (${mode.max})`
+				};
+			case "parallel":
+				if (this.active < mode.max) {
+					this.active += 1;
+					return {
+						decision: "run",
+						reason: `parallel: ${this.active} of ${mode.max} running`
+					};
+				}
+				return {
+					decision: "drop",
+					reason: `parallel: ${mode.max} runs already in progress`
+				};
+		}
+	}
+	/** The run holding a slot ended (any outcome). True = a queued trigger took the slot. */
+	release() {
+		if (this.active > 0) this.active -= 1;
+		if (this.mode.mode === "queued" && this.pending > 0) {
+			this.pending -= 1;
+			this.active += 1;
+			return true;
+		}
+		return false;
+	}
+	/** Checked AFTER the conditions pass. Always `ok` outside `cooldown` mode. */
+	cooldown(input) {
+		if (this.mode.mode !== "cooldown") return {
+			ok: true,
+			bypassed: false,
+			reason: ""
+		};
+		const waitMs = this.mode.minutes * MINUTE_MS$1;
+		if (input.lastRunStartedAt === null) return {
+			ok: true,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: no earlier run`
+		};
+		const elapsed = input.now - input.lastRunStartedAt;
+		if (elapsed >= waitMs) return {
+			ok: true,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: last run started ${minutes(elapsed)} min ago`
+		};
+		const left = `${minutes(waitMs - elapsed)} min left`;
+		if (input.manual) return {
+			ok: true,
+			bypassed: true,
+			reason: `cooldown ${this.mode.minutes} min bypassed by a manual trigger (${left})`
+		};
+		return {
+			ok: false,
+			bypassed: false,
+			reason: `cooldown ${this.mode.minutes} min: last run started ${minutes(elapsed)} min ago, ${left}`
+		};
+	}
+};
+//#endregion
+//#region src/automation/trace.ts
+/**
+* Run traces — what an automation (or, later, an Action run) DID, node by node,
+* so the editor can paint every block green or red with its reason.
+*
+* A trace is data, not a log: it covers the WHOLE tree — the trigger stage,
+* every condition node (containers and leaves, including the ones a
+* short-circuit never reached), the run-mode verdict and every action step —
+* each addressed by a stable path (`conditions.0.1`, `actions.2`, or `steps.N`
+* for an Action run). Skipped
+* evaluations are traced too, and identical consecutive skips collapse into a
+* repeat count so a trigger that fails every 5 minutes cannot flush real runs.
+*
+* {@link AutomationStepTraceSchema} is deliberately free of automation
+* vocabulary so an Action run records the same step shape.
+*/
+/** A value a trace may show: JSON primitives and short lists, nothing deeper. */
+var TraceValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean(),
+	zod.z.null(),
+	zod.z.array(zod.z.union([zod.z.string(), zod.z.number()]))
+]);
+var AutomationRunOutcomeSchema = zod.z.enum([
+	"ran",
+	"skipped-trigger",
+	"skipped-conditions",
+	"skipped-cooldown",
+	"skipped-overlap",
+	"failed",
+	"aborted"
+]);
+/** `not-evaluated` = a short-circuit never reached the node. */
+var TraceNodeOutcomeSchema = zod.z.enum([
+	"pass",
+	"fail",
+	"not-evaluated"
+]);
+var AutomationTriggerTraceSchema = zod.z.object({
+	kind: zod.z.string().min(1),
+	outcome: zod.z.enum(["pass", "fail"]),
+	/** Why an event was rejected ("class person not in [dog]") or what fired. */
+	reason: zod.z.string(),
+	/** deviceId, className, trackId, score … — only what the trigger exposes. */
+	vars: zod.z.record(zod.z.string(), TraceValueSchema)
+});
+var AutomationConditionTraceNodeSchema = zod.z.object({
+	/** `conditions` for the root, `conditions.<i>` for its i-th child, … */
+	path: zod.z.string().min(1),
+	kind: zod.z.enum([
+		"all",
+		"any",
+		"not",
+		"condition",
+		"expression"
+	]),
+	outcome: TraceNodeOutcomeSchema,
+	reason: zod.z.string(),
+	deviceId: zod.z.number().int().optional(),
+	cap: zod.z.string().optional(),
+	fieldPath: zod.z.string().optional(),
+	operator: zod.z.string().optional(),
+	expected: TraceValueSchema.optional(),
+	/** What the mirror held; `null` when it held nothing (unknown). */
+	observed: TraceValueSchema.optional()
+});
+var AutomationRunVerdictSchema = zod.z.object({
+	mode: AutomationRunModeSchema,
+	decision: zod.z.enum([
+		"run",
+		"queued",
+		"restart",
+		"drop",
+		"cooldown",
+		"bypass"
+	]),
+	reason: zod.z.string()
+});
+/** One executed (or not-run) step — shared by automations and Action runs. */
+var AutomationStepTraceSchema = zod.z.object({
+	/** `actions.<i>` */
+	path: zod.z.string().min(1),
+	kind: zod.z.string().min(1),
+	cap: zod.z.string().optional(),
+	method: zod.z.string().optional(),
+	deviceId: zod.z.number().int().optional(),
+	startedAt: zod.z.number().optional(),
+	endedAt: zod.z.number().optional(),
+	outcome: zod.z.enum([
+		"ok",
+		"error",
+		"not-run"
+	]),
+	message: zod.z.string().optional()
+});
+var AutomationRunTraceSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	startedAt: zod.z.number(),
+	endedAt: zod.z.number(),
+	trigger: AutomationTriggerTraceSchema,
+	conditions: zod.z.array(AutomationConditionTraceNodeSchema),
+	verdict: AutomationRunVerdictSchema.optional(),
+	steps: zod.z.array(AutomationStepTraceSchema),
+	outcome: AutomationRunOutcomeSchema,
+	/** How many identical consecutive skips this trace stands for (>= 1). */
+	repeat: zod.z.number().int().min(1),
+	/** When the latest of those repeats happened. */
+	lastAt: zod.z.number()
+});
+/**
+* What the hub's `runs` ledger holds for one owner (`automation:<blockId>` or
+* `action:<actionId>`): the cooldown stamp and the trace ring.
+*/
+var AutomationStateDocSchema = zod.z.object({
+	version: zod.z.literal(1),
+	lastRunStartedAt: zod.z.number().nullable(),
+	traces: zod.z.array(AutomationRunTraceSchema)
+});
+/** The state of an owner that never reported. */
+var EMPTY_AUTOMATION_STATE = {
+	version: 1,
+	lastRunStartedAt: null,
+	traces: []
+};
+function isSkippedTrace(trace) {
+	return trace.outcome.startsWith("skipped-");
+}
+/** Numbers vary between repeats of the same cause ("0.41 < 0.6" / "0.43 < 0.6"). */
+function normaliseReason(reason) {
+	return reason.replace(/\d+(\.\d+)?/g, "#");
+}
+/** Two skips with the same signature are the same event repeating. */
+function skipSignature(trace) {
+	return JSON.stringify([
+		trace.outcome,
+		trace.trigger.kind,
+		trace.trigger.outcome,
+		normaliseReason(trace.trigger.reason),
+		trace.verdict === void 0 ? null : [trace.verdict.decision, normaliseReason(trace.verdict.reason)],
+		trace.conditions.map((n) => [n.path, n.outcome])
+	]);
+}
+/**
+* `next` folded into `prev` when both are skips of the same signature (the
+* repeat count and the latest time move on), else null. Used by the block
+* BEFORE it sends, so a trigger that fails every few seconds costs one RPC per
+* flush, not one per skip; the ledger applies the same rule through
+* {@link appendTrace}.
+*/
+function mergeSkipTraces(prev, next) {
+	if (!isSkippedTrace(prev) || !isSkippedTrace(next)) return null;
+	if (skipSignature(prev) !== skipSignature(next)) return null;
+	return {
+		...prev,
+		repeat: prev.repeat + next.repeat,
+		lastAt: next.lastAt,
+		endedAt: next.endedAt
+	};
+}
+/**
+* Append a trace to a ring of at most `keep` entries, without mutating it.
+*
+*  - A skip identical to the previous trace is counted on that trace
+*    (`repeat`, `lastAt`), not appended.
+*  - When the ring is full, the oldest SKIPPED trace goes first; a real run is
+*    evicted only when every trace is a run. A noisy skip stream therefore
+*    cannot push the runs the operator is looking for out of the ring.
+*/
+function appendTrace(ring, trace, keep) {
+	const last = ring[ring.length - 1];
+	const merged = last === void 0 ? null : mergeSkipTraces(last, trace);
+	if (merged !== null) return [...ring.slice(0, -1), merged];
+	const next = [...ring, trace];
+	while (next.length > keep) {
+		const skipAt = next.findIndex((t, i) => i < next.length - 1 && isSkippedTrace(t));
+		next.splice(skipAt === -1 ? 0 : skipAt, 1);
+	}
+	return next;
+}
+/**
+* The trigger stage of a trace from the bag a trigger handed to `run()`:
+* primitives only (a device-state `to` that is an object is left out), minus the
+* bookkeeping keys `kind` and `at`.
+*/
+function buildTriggerTrace(trigger, outcome, reason) {
+	const vars = {};
+	for (const [key, value] of Object.entries(trigger)) {
+		if (key === "kind" || key === "at") continue;
+		if (typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value === null) vars[key] = value;
+	}
+	return {
+		kind: typeof trigger["kind"] === "string" ? trigger["kind"] : "unknown",
+		outcome,
+		reason,
+		vars
+	};
+}
+//#endregion
+//#region src/automation/action.ts
+/**
+* Actions — named, runnable things an operator (or an automation) can start,
+* declared as LIST ENTRIES, never as devices.
+*
+* An entry is either **internal** (a short list of cap/wait steps kept in the
+* hub's `actions` record kind) or declared by an addon through the
+* `action-source` collection (a Home Assistant script, a scene …). The one
+* surface the UI and automations talk to is the `actions` cap; it keeps no
+* catalog of its own (D3) — every `list` asks the providers live.
+*
+* This file is the data half: the entry schema, the variables an entry may
+* declare, and the pure resolution of the values a run was given. It holds no
+* runtime.
+*/
+/** What a variable's value is. `select` takes one of `options`. */
+var ActionVariableTypeSchema = zod.z.enum([
+	"string",
+	"number",
+	"boolean",
+	"select"
+]);
+var ACTION_VARIABLE_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var ActionVariableValueSchema = zod.z.union([
+	zod.z.string(),
+	zod.z.number(),
+	zod.z.boolean()
+]);
+/**
+* One declared variable. Steps reference it as `{ $var: 'name' }` (the whole
+* value) or `{{vars.name}}` (inside a string) in their args.
+*/
+var ActionVariableSchema = zod.z.object({
+	name: zod.z.string().regex(ACTION_VARIABLE_NAME_RE),
+	label: zod.z.string().min(1).max(120).optional(),
+	type: ActionVariableTypeSchema,
+	required: zod.z.boolean().optional(),
+	default: ActionVariableValueSchema.optional(),
+	/** The allowed values of a `select`. */
+	options: zod.z.array(zod.z.string().min(1)).min(1).optional()
+}).superRefine((v, ctx) => {
+	if (v.type === "select" && v.options === void 0) ctx.addIssue({
+		code: "custom",
+		message: "a select variable needs options",
+		path: ["options"]
+	});
+	if (v.default !== void 0 && variableValueError(v, v.default) !== null) ctx.addIssue({
+		code: "custom",
+		message: variableValueError(v, v.default) ?? "invalid default",
+		path: ["default"]
+	});
+});
+/** Why `value` is not a legal value for the variable, or null when it is. */
+function variableValueError(variable, value) {
+	switch (variable.type) {
+		case "string": return typeof value === "string" ? null : `variable "${variable.name}" must be a string`;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? null : `variable "${variable.name}" must be a number`;
+		case "boolean": return typeof value === "boolean" ? null : `variable "${variable.name}" must be true or false`;
+		case "select": return typeof value === "string" && (variable.options ?? []).includes(value) ? null : `variable "${variable.name}" must be one of ${(variable.options ?? []).join(", ")}`;
+	}
+}
+/**
+* The values a run starts with: what the caller gave, checked against the
+* declaration, with defaults filled. A value the entry did not declare is
+* REFUSED — a typo in a variable name must not silently run with the default.
+*/
+function resolveActionVariables(declared, given) {
+	const decls = declared ?? [];
+	const provided = given ?? {};
+	for (const name of Object.keys(provided)) if (!decls.some((d) => d.name === name)) return {
+		ok: false,
+		error: `unknown variable "${name}"`
+	};
+	const values = {};
+	for (const decl of decls) {
+		const value = provided[decl.name] ?? decl.default;
+		if (value === void 0) {
+			if (decl.required === true) return {
+				ok: false,
+				error: `variable "${decl.name}" is required`
+			};
+			continue;
+		}
+		const error = variableValueError(decl, value);
+		if (error !== null) return {
+			ok: false,
+			error
+		};
+		values[decl.name] = value;
+	}
+	return {
+		ok: true,
+		values
+	};
+}
+var ActionSourceKindSchema = zod.z.enum(["internal", "addon"]);
+/** Prefix of an internal action's id. */
+var INTERNAL_ACTION_PREFIX = "internal:";
+function internalActionId(uuid) {
+	return `${INTERNAL_ACTION_PREFIX}${uuid}`;
+}
+function isInternalActionId(actionId) {
+	return actionId.startsWith("internal:") && actionId.length > 9;
+}
+/** The addon behind a `<addonId>:<localId>` id, or null for anything else (internal included). */
+function addonIdOfActionId(actionId) {
+	if (isInternalActionId(actionId)) return null;
+	const at = actionId.indexOf(":");
+	return at > 0 && at < actionId.length - 1 ? actionId.slice(0, at) : null;
+}
+var ActionStatusSchema = zod.z.object({
+	isRunning: zod.z.boolean(),
+	/** Ms epoch the latest run STARTED; null when it never ran. */
+	lastRunAt: zod.z.number().nullable(),
+	/** The latest run's failure; null on success or when it never ran. */
+	lastError: zod.z.string().nullable()
+});
+var IDLE_ACTION_STATUS = {
+	isRunning: false,
+	lastRunAt: null,
+	lastError: null
+};
+var ActionEntrySchema = zod.z.object({
+	/** `internal:<uuid>` or `<addonId>:<localId>`. */
+	id: zod.z.string().min(3),
+	name: zod.z.string().min(1).max(120),
+	/** The addon that declared it; `core-blocks` for an internal one. */
+	addonId: zod.z.string().min(1),
+	source: ActionSourceKindSchema,
+	/** An addon-declared entry is edited where it was declared. */
+	readOnly: zod.z.boolean(),
+	/** Internal only: cap and wait steps. No action-in-action, so no cycles. */
+	steps: zod.z.array(ActionStepSchema).min(1).max(50).optional(),
+	variables: zod.z.array(ActionVariableSchema).max(20).optional(),
+	status: ActionStatusSchema
+}).superRefine((entry, ctx) => {
+	if (entry.source === "internal") {
+		if (!isInternalActionId(entry.id)) ctx.addIssue({
+			code: "custom",
+			message: "an internal action id is internal:<uuid>",
+			path: ["id"]
+		});
+		return;
+	}
+	if (entry.steps !== void 0) ctx.addIssue({
+		code: "custom",
+		message: "only an internal action carries steps",
+		path: ["steps"]
+	});
+	if (!entry.readOnly) ctx.addIssue({
+		code: "custom",
+		message: "an addon action is read-only here",
+		path: ["readOnly"]
+	});
+	if (addonIdOfActionId(entry.id) === null) ctx.addIssue({
+		code: "custom",
+		message: "an addon action id is <addonId>:<localId>",
+		path: ["id"]
+	});
+});
+/** What an operator writes for an internal action. */
+var ActionInputSchema = zod.z.object({
+	name: zod.z.string().min(1).max(120),
+	steps: zod.z.array(ActionStepSchema).min(1).max(50),
+	variables: zod.z.array(ActionVariableSchema).max(20).optional()
+});
+/** Who started a run. Absent = the operator pressed it. */
+var ActionRunOriginSchema = zod.z.object({ 
+/** The automation block whose step started it. */
+blockId: zod.z.string().min(1).optional() });
+/** `started` = the caller did not ask to wait. */
+var ActionRunOutcomeSchema = zod.z.union([AutomationRunOutcomeSchema, zod.z.literal("started")]);
+var ActionRunResultSchema = zod.z.object({
+	runId: zod.z.string().min(1),
+	outcome: ActionRunOutcomeSchema,
+	/** Why it did not run, or what failed. */
+	message: zod.z.string().optional()
+});
+var ActionErrorCodeSchema = zod.z.enum([
+	"not-found",
+	"read-only",
+	"invalid-variables",
+	"invalid-steps",
+	"not-linked",
+	"busy"
+]);
+/**
+* A refusal with a reason a caller can branch on. The code leads the message
+* (`[read-only] …`) because a cap call flattens an error to its text.
+*/
+var ActionError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(`[${code}] ${message}`);
+		this.name = "ActionError";
+		this.code = code;
+	}
+};
+/** The run-state change `actions.onRunChanged` carries. */
+var ActionRunChangedSchema = zod.z.object({
+	actionId: zod.z.string(),
+	runId: zod.z.string(),
+	isRunning: zod.z.boolean(),
+	/** Set when the run ended. */
+	outcome: AutomationRunOutcomeSchema.optional(),
+	lastRunAt: zod.z.number().nullable(),
+	lastError: zod.z.string().nullable()
+});
+//#endregion
+//#region src/automation/step-runner.ts
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function runSteps(steps, options) {
+	const traces = [];
+	let failed = false;
+	let aborted = false;
+	for (const [index, step] of steps.entries()) {
+		const path = `${options.pathPrefix}.${index}`;
+		if (failed || aborted || options.isAborted()) {
+			if (!failed) aborted = true;
+			traces.push({
+				...step.meta,
+				path,
+				outcome: "not-run",
+				message: failed ? "an earlier step failed" : options.abortReason
+			});
+			continue;
+		}
+		const startedAt = options.now();
+		let deviceId = step.meta.deviceId;
+		const scope = { setDeviceId: (id) => {
+			deviceId = id;
+		} };
+		try {
+			await step.run(scope);
+			traces.push({
+				...step.meta,
+				...deviceId === void 0 ? {} : { deviceId },
+				path,
+				startedAt,
+				endedAt: options.now(),
+				outcome: "ok"
+			});
+		} catch (err) {
+			failed = true;
+			const message = errorMessage(err);
+			options.onFailure({
+				index,
+				path,
+				message,
+				deviceId
+			});
+			traces.push({
+				...step.meta,
+				...deviceId === void 0 ? {} : { deviceId },
+				path,
+				startedAt,
+				endedAt: options.now(),
+				outcome: "error",
+				message
+			});
+		}
+	}
+	return {
+		steps: traces,
+		failed,
+		aborted: aborted && !failed
+	};
+}
+function isVarRef(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && keys[0] === "$var" && typeof Reflect.get(value, "$var") === "string";
+}
+var TEMPLATE_RE = /\{\{\s*vars\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+/**
+* Substitute a step's args from the run's variables. SUBSTITUTION only, never
+* evaluation:
+*  - a value that is exactly `{ $var: 'name' }` becomes the variable's value,
+*    keeping its type (a number stays a number);
+*  - `{{vars.name}}` inside a string becomes its text.
+* A variable that is not set THROWS — a step must not run with a hole where
+* the operator meant a value. (`{{vars.x}}` keeps the automation behaviour:
+* the hole is reported through `onMissing` and rendered empty.)
+*/
+function resolveStepArgs(value, vars, onMissing) {
+	if (isVarRef(value)) {
+		const found = vars[value.$var];
+		if (found === void 0) throw new Error(`variable "${value.$var}" is not set`);
+		return found;
+	}
+	if (typeof value === "string") return value.replace(TEMPLATE_RE, (_m, key) => {
+		const v = vars[key];
+		if (v === void 0) {
+			onMissing(key);
+			return "";
+		}
+		return String(v);
+	});
+	if (Array.isArray(value)) return value.map((v) => resolveStepArgs(v, vars, onMissing));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, resolveStepArgs(v, vars, onMissing)]));
+	return value;
+}
+/** A `{ $var }` device target, resolved from the bag BEFORE dispatch. */
+function resolveDeviceTarget(vars, name) {
+	const raw = vars[name];
+	if (typeof raw === "number") return raw;
+	throw new Error(`action target var "${name}" is not a device id`);
+}
+function stepMetaOfAction(step) {
+	if (step.kind === "wait") return { kind: "wait" };
+	return {
+		kind: "cap",
+		cap: step.cap,
+		method: step.method,
+		...typeof step.deviceId === "number" ? { deviceId: step.deviceId } : {}
+	};
+}
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* The runnable form of an internal Action's steps, bound to one run's
+* variables. Variables are substituted per step, at the moment it runs, so a
+* missing one fails THAT step (traced) and leaves the later ones not-run.
+*/
+function buildActionSteps(steps, vars, deps) {
+	return steps.map((step) => {
+		const meta = stepMetaOfAction(step);
+		if (step.kind === "wait") return {
+			meta,
+			run: () => deps.sleep(step.seconds * 1e3)
+		};
+		return {
+			meta,
+			run: async (scope) => {
+				const resolved = resolveStepArgs(step.args ?? {}, vars, deps.onMissingVar);
+				const args = isPlainRecord(resolved) ? resolved : {};
+				const targets = typeof step.deviceId === "number" ? [step.deviceId] : Array.isArray(step.deviceId) ? step.deviceId : [resolveDeviceTarget(vars, step.deviceId.$var)];
+				for (const deviceId of targets) {
+					scope.setDeviceId(deviceId);
+					await deps.invokeCap({
+						deviceId,
+						cap: step.cap,
+						method: step.method,
+						args
+					});
+				}
+			}
+		};
+	});
+}
+//#endregion
 //#region src/capabilities/addon-pages.cap.ts
 /**
 * `addon-pages` — system-scoped singleton aggregator cap. Public-facing
@@ -16238,7 +18075,29 @@ var coreBlocksCapability = {
 			kind: "mutation",
 			auth: "admin",
 			access: "view"
-		})
+		}),
+		/**
+		* An automation block reports one run (or one coalesced skip) to the hub's
+		* `runs` ledger. Only the block itself may: the transport stamps
+		* `callerAddonId`, and anything but `core-block-<blockId>` is refused.
+		* `keepTraces` bounds the ring; `runStartedAt` moves the cooldown stamp.
+		*/
+		reportAutomationRun: require_sleep.method(zod.z.object({
+			blockId: zod.z.string().min(1),
+			trace: AutomationRunTraceSchema.optional(),
+			runStartedAt: zod.z.number().optional(),
+			keepTraces: zod.z.number().int().min(1).max(100).optional()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** The cooldown stamp and trace ring a block reads ONCE, at start. Owner-only. */
+		getAutomationRunState: require_sleep.method(zod.z.object({ blockId: zod.z.string().min(1) }), AutomationStateDocSchema, { auth: "admin" }),
+		/** An automation's run traces, newest last. The operator's read. */
+		getTraces: require_sleep.method(zod.z.object({ blockId: zod.z.string().min(1) }), zod.z.object({
+			traces: zod.z.array(AutomationRunTraceSchema),
+			lastError: zod.z.string().nullable()
+		}), { auth: "admin" })
 	}
 };
 //#endregion
@@ -41835,7 +43694,7 @@ function autoRankFor(role, endpoint) {
 	if (isPlausibleLan(endpoint)) return 3;
 	return null;
 }
-var LOOPBACK_HOSTS = new Set([
+var LOOPBACK_HOSTS$1 = new Set([
 	"localhost",
 	"0.0.0.0",
 	"::1",
@@ -41843,9 +43702,9 @@ var LOOPBACK_HOSTS = new Set([
 	"::",
 	"[::]"
 ]);
-function isLoopbackHost(hostname) {
+function isLoopbackHost$1(hostname) {
 	const h = hostname.toLowerCase();
-	if (LOOPBACK_HOSTS.has(h) || h.endsWith(".localhost")) return true;
+	if (LOOPBACK_HOSTS$1.has(h) || h.endsWith(".localhost")) return true;
 	return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
 }
 /**
@@ -41880,7 +43739,7 @@ function validateCustomAddress(raw) {
 		ok: false,
 		reason: "The address has no host."
 	};
-	if (isLoopbackHost(parsed.hostname)) return {
+	if (isLoopbackHost$1(parsed.hostname)) return {
 		ok: false,
 		reason: "A loopback address names whoever dials it, never this hub — use an address other machines reach."
 	};
@@ -44542,398 +46401,6 @@ var notificationOutputCapability = {
 	}
 };
 //#endregion
-//#region src/catalogs/coco-classmap.ts
-var COCO_80_LABELS = [
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "bicycle",
-		name: "Bicycle"
-	},
-	{
-		id: "car",
-		name: "Car"
-	},
-	{
-		id: "motorcycle",
-		name: "Motorcycle"
-	},
-	{
-		id: "airplane",
-		name: "Airplane"
-	},
-	{
-		id: "bus",
-		name: "Bus"
-	},
-	{
-		id: "train",
-		name: "Train"
-	},
-	{
-		id: "truck",
-		name: "Truck"
-	},
-	{
-		id: "boat",
-		name: "Boat"
-	},
-	{
-		id: "traffic light",
-		name: "Traffic Light"
-	},
-	{
-		id: "fire hydrant",
-		name: "Fire Hydrant"
-	},
-	{
-		id: "stop sign",
-		name: "Stop Sign"
-	},
-	{
-		id: "parking meter",
-		name: "Parking Meter"
-	},
-	{
-		id: "bench",
-		name: "Bench"
-	},
-	{
-		id: "bird",
-		name: "Bird"
-	},
-	{
-		id: "cat",
-		name: "Cat"
-	},
-	{
-		id: "dog",
-		name: "Dog"
-	},
-	{
-		id: "horse",
-		name: "Horse"
-	},
-	{
-		id: "sheep",
-		name: "Sheep"
-	},
-	{
-		id: "cow",
-		name: "Cow"
-	},
-	{
-		id: "elephant",
-		name: "Elephant"
-	},
-	{
-		id: "bear",
-		name: "Bear"
-	},
-	{
-		id: "zebra",
-		name: "Zebra"
-	},
-	{
-		id: "giraffe",
-		name: "Giraffe"
-	},
-	{
-		id: "backpack",
-		name: "Backpack"
-	},
-	{
-		id: "umbrella",
-		name: "Umbrella"
-	},
-	{
-		id: "handbag",
-		name: "Handbag"
-	},
-	{
-		id: "tie",
-		name: "Tie"
-	},
-	{
-		id: "suitcase",
-		name: "Suitcase"
-	},
-	{
-		id: "frisbee",
-		name: "Frisbee"
-	},
-	{
-		id: "skis",
-		name: "Skis"
-	},
-	{
-		id: "snowboard",
-		name: "Snowboard"
-	},
-	{
-		id: "sports ball",
-		name: "Sports Ball"
-	},
-	{
-		id: "kite",
-		name: "Kite"
-	},
-	{
-		id: "baseball bat",
-		name: "Baseball Bat"
-	},
-	{
-		id: "baseball glove",
-		name: "Baseball Glove"
-	},
-	{
-		id: "skateboard",
-		name: "Skateboard"
-	},
-	{
-		id: "surfboard",
-		name: "Surfboard"
-	},
-	{
-		id: "tennis racket",
-		name: "Tennis Racket"
-	},
-	{
-		id: "bottle",
-		name: "Bottle"
-	},
-	{
-		id: "wine glass",
-		name: "Wine Glass"
-	},
-	{
-		id: "cup",
-		name: "Cup"
-	},
-	{
-		id: "fork",
-		name: "Fork"
-	},
-	{
-		id: "knife",
-		name: "Knife"
-	},
-	{
-		id: "spoon",
-		name: "Spoon"
-	},
-	{
-		id: "bowl",
-		name: "Bowl"
-	},
-	{
-		id: "banana",
-		name: "Banana"
-	},
-	{
-		id: "apple",
-		name: "Apple"
-	},
-	{
-		id: "sandwich",
-		name: "Sandwich"
-	},
-	{
-		id: "orange",
-		name: "Orange"
-	},
-	{
-		id: "broccoli",
-		name: "Broccoli"
-	},
-	{
-		id: "carrot",
-		name: "Carrot"
-	},
-	{
-		id: "hot dog",
-		name: "Hot Dog"
-	},
-	{
-		id: "pizza",
-		name: "Pizza"
-	},
-	{
-		id: "donut",
-		name: "Donut"
-	},
-	{
-		id: "cake",
-		name: "Cake"
-	},
-	{
-		id: "chair",
-		name: "Chair"
-	},
-	{
-		id: "couch",
-		name: "Couch"
-	},
-	{
-		id: "potted plant",
-		name: "Potted Plant"
-	},
-	{
-		id: "bed",
-		name: "Bed"
-	},
-	{
-		id: "dining table",
-		name: "Dining Table"
-	},
-	{
-		id: "toilet",
-		name: "Toilet"
-	},
-	{
-		id: "tv",
-		name: "TV"
-	},
-	{
-		id: "laptop",
-		name: "Laptop"
-	},
-	{
-		id: "mouse",
-		name: "Mouse"
-	},
-	{
-		id: "remote",
-		name: "Remote"
-	},
-	{
-		id: "keyboard",
-		name: "Keyboard"
-	},
-	{
-		id: "cell phone",
-		name: "Cell Phone"
-	},
-	{
-		id: "microwave",
-		name: "Microwave"
-	},
-	{
-		id: "oven",
-		name: "Oven"
-	},
-	{
-		id: "toaster",
-		name: "Toaster"
-	},
-	{
-		id: "sink",
-		name: "Sink"
-	},
-	{
-		id: "refrigerator",
-		name: "Refrigerator"
-	},
-	{
-		id: "book",
-		name: "Book"
-	},
-	{
-		id: "clock",
-		name: "Clock"
-	},
-	{
-		id: "vase",
-		name: "Vase"
-	},
-	{
-		id: "scissors",
-		name: "Scissors"
-	},
-	{
-		id: "teddy bear",
-		name: "Teddy Bear"
-	},
-	{
-		id: "hair drier",
-		name: "Hair Drier"
-	},
-	{
-		id: "toothbrush",
-		name: "Toothbrush"
-	}
-];
-var MACRO_LABELS = [
-	{
-		id: "person",
-		name: "Person"
-	},
-	{
-		id: "vehicle",
-		name: "Vehicle"
-	},
-	{
-		id: "animal",
-		name: "Animal"
-	},
-	{
-		id: "package",
-		name: "Package"
-	}
-];
-/**
-* The class names a per-class COUNT can ever be keyed on — the macro ids, and
-* only those.
-*
-* `preserveOriginal: false` below is the whole reason this set exists: the
-* executor maps each raw COCO label onto its macro and DROPS everything else,
-* so a tracked detection's `className` is always one of {@link MACRO_LABELS}.
-* Any surface that indexes counts by class name — the ZoneAnalytics occupancy
-* snapshot's `byClass`, and therefore every occupancy rule — can match nothing
-* else. Derived from the catalog, never hand-listed, so a new macro joins it by
-* being declared once.
-*
-* Cost of not having it, 2026-08-12: the notification rule editor offered the
-* full taxonomy for an occupancy class (occupancy is the one condition that
-* does not go through the engine's macro-expanding `expandClassSelector`), two
-* live rules were authored on `car`, and both counters read 0 forever.
-*/
-var DETECTION_MACRO_CLASSES = new Set(MACRO_LABELS.map((l) => l.id));
-/** True when `className` is a macro the detector can actually emit (and hence a
-*  class a count can be keyed on) — see {@link DETECTION_MACRO_CLASSES}. */
-function isDetectionMacroClass(className) {
-	return DETECTION_MACRO_CLASSES.has(className.trim().toLowerCase());
-}
-var COCO_TO_MACRO = {
-	mapping: {
-		person: "person",
-		bicycle: "vehicle",
-		car: "vehicle",
-		motorcycle: "vehicle",
-		airplane: "vehicle",
-		bus: "vehicle",
-		train: "vehicle",
-		truck: "vehicle",
-		boat: "vehicle",
-		bird: "animal",
-		cat: "animal",
-		dog: "animal",
-		horse: "animal",
-		sheep: "animal",
-		cow: "animal",
-		elephant: "animal",
-		bear: "animal",
-		zebra: "animal",
-		giraffe: "animal",
-		suitcase: "package",
-		backpack: "package",
-		handbag: "package"
-	},
-	preserveOriginal: false
-};
-//#endregion
 //#region src/catalogs/audio-classmap.ts
 var AUDIO_MACRO_LABELS = [
 	{
@@ -62877,6 +64344,152 @@ var audioMetricsCapability = {
 	history: "none"
 };
 //#endregion
+//#region src/capabilities/action-source.cap.ts
+/**
+* action-source — an addon DECLARES runnable actions (a Home Assistant script,
+* a scene, a vendor routine) as list entries. Never as devices.
+*
+* It mirrors `notification-output`: `listActions` returns an array, so the
+* generated cap mount concat-fans it across every provider; `runAction` and
+* `stopAction` route to ONE provider by the `addonId` the generated collection
+* router extracts from the call input.
+*
+* Nobody but the `actions` surface (the core-blocks builtin) calls this cap.
+* The UI and automations talk to `actions`, which fans out here LIVE on every
+* `list` and keeps no catalog of its own (D3: no shadow registry).
+*
+* `listActions` entries carry `source: 'addon'`, `readOnly: true`, an id of
+* `<addonId>:<localId>` and an idle `status` (the provider may fill what it
+* knows). `actionId` on `runAction` / `stopAction` is the full entry id.
+*/
+var actionSourceCapability = {
+	name: "action-source",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listActions: require_sleep.method(zod.z.object({}), zod.z.array(ActionEntrySchema), { auth: "admin" }),
+		runAction: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			variables: zod.z.record(zod.z.string(), ActionVariableValueSchema).optional()
+		}), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		stopAction: require_sleep.method(zod.z.object({ actionId: zod.z.string().min(1) }), zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
+//#endregion
+//#region src/capabilities/actions.cap.ts
+/**
+* actions — the ONE surface for runnable actions, for the UI and for
+* automations. Provided by the core-blocks builtin on the hub.
+*
+* An action is a LIST ENTRY, not a device (D883): either internal (cap and wait
+* steps, kept in the hub's `actions` record kind) or declared by an addon over
+* `action-source`. `list` asks every `action-source` provider LIVE and overlays
+* the run status from the hub's `runs` ledger; there is no catalog here to
+* drift (D3).
+*
+* **Permissions follow the camera, as linked devices do.** An action is linked
+* to cameras by the operator (`setLinks`, D356: nothing links itself). A
+* non-admin may `get` / `run` an action only through a camera they may see that
+* links it: they name the camera (`deviceId`, a top-level field so the scope
+* gate sees it) and the provider refuses an action that camera does not link.
+* An admin, and an in-process caller (an automation block), may run any action.
+* Every refusal is typed (`[not-linked] …`) and logged.
+*
+* A second `run` of an action that is already running is REFUSED — traced and
+* logged — never queued.
+*/
+var ActionIdInput = zod.z.object({ actionId: zod.z.string().min(1) });
+var ActionLinksSchema = zod.z.object({
+	deviceId: zod.z.number().int().nonnegative(),
+	actionIds: zod.z.array(zod.z.string().min(1)).max(100)
+});
+var actionsCapability = {
+	name: "actions",
+	scope: "system",
+	mode: "singleton",
+	methods: {
+		/** Every action, live from the providers, with its run status. Admin. */
+		list: require_sleep.method(zod.z.object({}), zod.z.array(ActionEntrySchema), { auth: "admin" }),
+		/**
+		* One action. A non-admin names the camera (`deviceId`) that links it.
+		* `null` when it does not exist.
+		*/
+		get: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			deviceId: zod.z.number().int().nonnegative().optional()
+		}), zod.z.object({ action: ActionEntrySchema.nullable() }), {
+			role: "viewer",
+			auth: "protected",
+			kind: "query",
+			caller: "required"
+		}),
+		/**
+		* Start an action. `wait` holds the call until the run ended (an automation
+		* step does); without it the call returns `started`. A non-admin names the
+		* camera (`deviceId`) that links the action.
+		*/
+		run: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			variables: zod.z.record(zod.z.string(), ActionVariableValueSchema).optional(),
+			wait: zod.z.boolean().optional(),
+			origin: ActionRunOriginSchema.optional(),
+			deviceId: zod.z.number().int().nonnegative().optional()
+		}), ActionRunResultSchema, {
+			role: "viewer",
+			auth: "protected",
+			kind: "mutation",
+			caller: "required"
+		}),
+		stop: require_sleep.method(ActionIdInput, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		getTraces: require_sleep.method(ActionIdInput, zod.z.object({ traces: zod.z.array(AutomationRunTraceSchema) }), { auth: "admin" }),
+		/** Internal actions only. A read-only (addon) entry is refused with `[read-only]`. */
+		create: require_sleep.method(zod.z.object({ action: ActionInputSchema }), zod.z.object({ action: ActionEntrySchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		update: require_sleep.method(zod.z.object({
+			actionId: zod.z.string().min(1),
+			action: ActionInputSchema.partial()
+		}), zod.z.object({ action: ActionEntrySchema }), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		delete: require_sleep.method(ActionIdInput, zod.z.void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/**
+		* What a viewer sees under a camera: the actions this camera LINKS, with
+		* their variables, and only when the caller may see the camera. The scope
+		* gate admits the camera; the answer is cut to the linked ones.
+		*/
+		listForCamera: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), zod.z.array(ActionEntrySchema), {
+			role: "viewer",
+			auth: "protected",
+			kind: "query"
+		}),
+		/** The actions a camera links. Admin (the picker). */
+		getLinks: require_sleep.method(zod.z.object({ deviceId: zod.z.number().int().nonnegative() }), ActionLinksSchema, { auth: "admin" }),
+		/** Replace a camera's linked actions with what the operator picked. */
+		setLinks: require_sleep.method(ActionLinksSchema, ActionLinksSchema, {
+			kind: "mutation",
+			auth: "admin"
+		})
+	},
+	events: { 
+	/** A run started or ended. Telemetry (D8): `list` is the authority. */
+onRunChanged: { data: ActionRunChangedSchema } }
+};
+//#endregion
 //#region src/capabilities/automation-control.cap.ts
 /**
 * Automation-control cap. Models HA `automation.*` entities on
@@ -85469,6 +87082,104 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"actions.create": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.delete": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "delete",
+		role: "admin"
+	},
+	"actions.get": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.getLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.getTraces": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.list": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actions.listForCamera": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
+	"actions.run": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "viewer"
+	},
+	"actions.setLinks": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.stop": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actions.update": {
+		capName: "actions",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.listActions": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
+	"actionSource.runAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
+	"actionSource.stopAction": {
+		capName: "action-source",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"addonPages.listPages": {
 		capName: "addon-pages",
 		capScope: "system",
@@ -86750,6 +88461,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getAutomationRunState": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getBlockSettings": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86771,6 +88489,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "view",
 		role: "admin"
 	},
+	"coreBlocks.getTraces": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "view",
+		role: "admin"
+	},
 	"coreBlocks.getTypeDefs": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -86806,6 +88531,13 @@ var METHOD_ACCESS_MAP = Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"coreBlocks.reportAutomationRun": {
+		capName: "core-blocks",
+		capScope: "system",
+		addonId: null,
+		access: "create",
+		role: "admin"
+	},
 	"coreBlocks.restart": {
 		capName: "core-blocks",
 		capScope: "system",
@@ -95168,6 +96900,8 @@ var METHOD_ACCESS_MAP = Object.freeze({
 /** Set of all known cap names — handy for the scope picker. */
 var KNOWN_CAP_NAMES = [
 	"accessories",
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -95453,6 +97187,8 @@ var DEVICE_CAP_NAMES = [
 ];
 /** Every cap declared as `scope: 'system'` — drives the `category:system` matcher. */
 var SYSTEM_CAP_NAMES = [
+	"action-source",
+	"actions",
 	"addon-pages",
 	"addon-pages-source",
 	"addon-routes",
@@ -99351,6 +101087,8 @@ var ML = "model and training machinery — no device action";
 var INTERNAL = "internal plumbing between addons — never operator-facing";
 /** Every system-scoped cap, with why it is not a device's vocabulary. */
 var SYSTEM_CAP_VOCABULARY = {
+	"action-source": system(INTERNAL),
+	actions: system("declared actions — run from the Actions page and from the cameras that link them"),
 	"addon-pages": system(UI_PLUMBING),
 	"addon-pages-source": system(UI_PLUMBING),
 	"addon-routes": system(UI_PLUMBING),
@@ -101257,6 +102995,8 @@ var CAP_NAMES_WITH_STATUS = [
 //#region src/generated/capability-router-map.ts
 var CAPABILITY_NAMES = {
 	accessories: "accessories",
+	actionSource: "action-source",
+	actions: "actions",
 	addonPages: "addon-pages",
 	addonPagesSource: "addon-pages-source",
 	addonRoutes: "addon-routes",
@@ -101448,6 +103188,14 @@ var CAPABILITY_ROUTER_KEYS = [
 		key: "accessories",
 		name: "accessories"
 	},
+	{
+		key: "actionSource",
+		name: "action-source"
+	},
+	{
+		key: "actions",
+		name: "actions"
+	},
 	{
 		key: "addonPages",
 		name: "addon-pages"
@@ -102196,6 +103944,8 @@ var CAPABILITY_ROUTER_KEYS = [
 */
 var ALL_CAPABILITY_DEFINITIONS = [
 	accessoriesCapability,
+	actionSourceCapability,
+	actionsCapability,
 	addonPagesCapability,
 	addonPagesSourceCapability,
 	addonRoutesCapability,
@@ -102398,6 +104148,31 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"actions.get": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.getLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.listForCamera": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
+	"actions.run": [{
+		name: "deviceId",
+		form: "single",
+		optional: true
+	}],
+	"actions.setLinks": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"addonSettings.getDeviceSettings": [{
 		name: "deviceId",
 		form: "single",
@@ -105169,6 +106944,11 @@ var METHOD_DEVICE_SELECTORS = Object.freeze({
 /** Cap-method paths that carry a device reference AND live on a system-scope
 *  cap — the set the v3 device check newly reaches. */
 var SYSTEM_SCOPE_DEVICE_METHODS = [
+	"actions.get",
+	"actions.getLinks",
+	"actions.listForCamera",
+	"actions.run",
+	"actions.setLinks",
 	"addonSettings.getDeviceSettings",
 	"addonSettings.updateDeviceSettings",
 	"audioAnalyzer.attachDevice",
@@ -106383,6 +108163,20 @@ function createSystemProxy(api) {
 		return require_sleep.invokeTrpcLeaf(api, capProp, method, kind, input, push);
 	}
 	return {
+		actions: {
+			list: (input) => dispatch("actions", "list", "query", input),
+			stop: (input) => dispatch("actions", "stop", "mutation", input),
+			getTraces: (input) => dispatch("actions", "getTraces", "query", input),
+			create: (input) => dispatch("actions", "create", "mutation", input),
+			update: (input) => dispatch("actions", "update", "mutation", input),
+			delete: (input) => dispatch("actions", "delete", "mutation", input),
+			setLinks: (input) => dispatch("actions", "setLinks", "mutation", input)
+		},
+		actionSource: {
+			listActions: (input) => dispatch("actionSource", "listActions", "query", input),
+			runAction: (input) => dispatch("actionSource", "runAction", "mutation", input),
+			stopAction: (input) => dispatch("actionSource", "stopAction", "mutation", input)
+		},
 		addonPages: { listPages: (input) => dispatch("addonPages", "listPages", "query", input) },
 		addons: {
 			list: (input) => dispatch("addons", "list", "query", input),
@@ -106526,7 +108320,10 @@ function createSystemProxy(api) {
 			listCompositions: (input) => dispatch("coreBlocks", "listCompositions", "query", input),
 			getCustomization: (input) => dispatch("coreBlocks", "getCustomization", "query", input),
 			listComposableCaps: (input) => dispatch("coreBlocks", "listComposableCaps", "query", input),
-			validateComposition: (input) => dispatch("coreBlocks", "validateComposition", "mutation", input)
+			validateComposition: (input) => dispatch("coreBlocks", "validateComposition", "mutation", input),
+			reportAutomationRun: (input) => dispatch("coreBlocks", "reportAutomationRun", "mutation", input),
+			getAutomationRunState: (input) => dispatch("coreBlocks", "getAutomationRunState", "query", input),
+			getTraces: (input) => dispatch("coreBlocks", "getTraces", "query", input)
 		},
 		decoder: {
 			getInfo: (input) => dispatch("decoder", "getInfo", "query", input),
@@ -116048,6 +117845,421 @@ function parseOauthLandingFragment(hash) {
 	};
 }
 //#endregion
+//#region src/vendor-login-proxy/url-rewrite.ts
+var LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+function hostWithoutPort(host) {
+	if (host.startsWith("[")) return host.slice(0, host.indexOf("]") + 1);
+	const colon = host.indexOf(":");
+	return colon === -1 ? host : host.slice(0, colon);
+}
+function isLoopbackHost(host) {
+	return LOOPBACK_HOSTS.has(hostWithoutPort(host.toLowerCase()));
+}
+/** An allow-list entry is valid when it is a bare host[:port] and `http` only targets loopback. */
+function isValidUpstream(upstream) {
+	if (upstream.host.length === 0 || !/^[a-z0-9.[\]:-]+$/.test(upstream.host)) return false;
+	return upstream.scheme === "https" || isLoopbackHost(upstream.host);
+}
+function findUpstream(route, host) {
+	const wanted = host.toLowerCase();
+	return route.upstreams.find((upstream) => upstream.host === wanted);
+}
+/** `<basePath>/<host><pathname><search>` — what the browser is sent to. */
+function proxyPathFor(route, host, pathname, search = "") {
+	return `${route.basePath}/${host}${pathname.startsWith("/") ? pathname : `/${pathname}`}${search}`;
+}
+/** Split `/<attemptId>/<host>/<rest…>[?query]` (the data-plane view of a request). */
+function parseProxyPath(rawUrl) {
+	const queryAt = rawUrl.indexOf("?");
+	const path = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+	const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+	const match = /^\/([A-Za-z0-9_-]{8,128})\/([^/]+)(\/.*)?$/.exec(path);
+	if (match === null) return null;
+	const attemptId = match[1];
+	const host = match[2];
+	if (attemptId === void 0 || host === void 0) return null;
+	return {
+		attemptId,
+		host: host.toLowerCase(),
+		pathname: match[3] ?? "/",
+		search
+	};
+}
+/** The vendor URL a proxied request targets, or null when the host would not stay `host`. */
+function upstreamUrlFor(upstream, parsed) {
+	try {
+		const url = new URL(`${upstream.scheme}://${upstream.host}${parsed.pathname}${parsed.search}`);
+		return url.host.toLowerCase() === upstream.host ? url : null;
+	} catch {
+		return null;
+	}
+}
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** A Location (or any URL value) to a vendor host becomes a proxy path; anything else is unchanged. */
+function rewriteLocation(location, currentUpstream, route) {
+	let resolved;
+	try {
+		resolved = new URL(location, `${currentUpstream.scheme}://${currentUpstream.host}/`);
+	} catch {
+		return location;
+	}
+	if (resolved.protocol !== "https:" && resolved.protocol !== "http:") return location;
+	const target = findUpstream(route, resolved.host);
+	if (target === void 0) return location;
+	return `${proxyPathFor(route, target.host, resolved.pathname, resolved.search)}${resolved.hash}`;
+}
+/** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
+var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
+/**
+* Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
+* (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
+* HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
+* escape the proxy mount and land on the hub.
+*/
+function rewriteBody(body, kind, currentUpstream, route) {
+	let out = body;
+	for (const upstream of route.upstreams) {
+		const host = escapeRegex(upstream.host);
+		const plain = new RegExp(`${VALUE_START}(?:https?:)?//${host}(?=[/"'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(plain, `${route.basePath}/${upstream.host}`);
+		const escapedBase = `${route.basePath}/${upstream.host}`.replace(/\//g, "\\/");
+		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(escaped, escapedBase);
+	}
+	const current = `${route.basePath}/${currentUpstream.host}/`;
+	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
+	if (kind === "html") {
+		const attribute = String.raw`(\b(?:href|src|action|formaction|poster|data-href|data-src)\s*=\s*["'])/`;
+		out = out.replace(new RegExp(`${attribute}${notMounted}`, "gi"), `$1${current}`);
+	}
+	if (kind === "html" || kind === "css") {
+		const cssUrl = String.raw`(url\(\s*["']?)/`;
+		out = out.replace(new RegExp(`${cssUrl}${notMounted}`, "gi"), `$1${current}`);
+	}
+	return out;
+}
+/**
+* A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
+* origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+*/
+function rewriteSetCookie(cookie, route) {
+	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+		if (index === 0) return true;
+		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
+		return name !== "domain" && name !== "path";
+	});
+	kept.push(`Path=${route.basePath}/`);
+	return kept.join("; ");
+}
+/**
+* A browser `Referer` that points into this proxy, turned back into the vendor URL it
+* stands for. A Referer that is not ours is dropped (null): it names the hub.
+*/
+function rewriteReferer(referer, route) {
+	let url;
+	try {
+		url = new URL(referer, "http://hub.invalid");
+	} catch {
+		return null;
+	}
+	if (!url.pathname.startsWith(`${route.basePath}/`)) return null;
+	const rest = /^\/([^/]+)(\/.*)?$/.exec(url.pathname.slice(route.basePath.length));
+	const host = rest?.[1]?.toLowerCase();
+	if (host === void 0) return null;
+	const upstream = findUpstream(route, host);
+	if (upstream === void 0) return null;
+	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
+}
+/** Cookies the browser holds for the hub itself must never reach a vendor. */
+function filterForwardedCookies(cookieHeader) {
+	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
+}
+//#endregion
+//#region src/vendor-login-proxy/login-proxy.ts
+var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
+/** Request headers that are never forwarded to the vendor. */
+var DROP_REQUEST_HEADERS = new Set([
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"accept-encoding",
+	"authorization",
+	"cookie",
+	"origin",
+	"referer",
+	"x-camstack-dataplane-secret",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-forwarded-prefix",
+	"x-real-ip",
+	"forwarded"
+]);
+/**
+* Response headers dropped: framing/CSP/HSTS that break a page under another origin, and
+* the ones that no longer describe the (decoded, possibly rewritten) body.
+*/
+var DROP_RESPONSE_HEADERS = new Set([
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"x-frame-options",
+	"strict-transport-security",
+	"public-key-pins",
+	"report-to",
+	"nel",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive",
+	"set-cookie",
+	"location"
+]);
+function bodyKindOf(contentType) {
+	const type = contentType.toLowerCase();
+	if (type.includes("text/html") || type.includes("application/xhtml")) return "html";
+	if (type.includes("text/css")) return "css";
+	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
+	return null;
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readRequestBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+		size += buf.length;
+		if (size > MAX_REQUEST_BODY_BYTES) return "too-large";
+		chunks.push(buf);
+	}
+	return Buffer.concat(chunks);
+}
+function sendPlain(res, status, text) {
+	res.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(text);
+}
+var VendorLoginProxy = class {
+	#addonId;
+	#prefix;
+	#logger;
+	#now;
+	#fetch;
+	#attempts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#addonId = options.addonId;
+		this.#prefix = options.prefix;
+		this.#logger = options.logger;
+		this.#now = options.now ?? (() => Date.now());
+		this.#fetch = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+	}
+	/** The `DataPlaneHandler` to pass to `ctx.dataPlane.serve({ prefix, access: 'admin', … })`. */
+	handler = (req, res) => this.#handle(req, res);
+	/** Register an attempt. A one-shot capability: refused hosts are rejected up front. */
+	open(spec) {
+		for (const upstream of spec.upstreams) if (!isValidUpstream(upstream)) throw new Error(`vendor login proxy: upstream ${upstream.host} is not allowed`);
+		this.#attempts.set(spec.attemptId, {
+			expiresAtMs: spec.expiresAtMs,
+			upstreams: spec.upstreams,
+			evaluate: async (view) => {
+				const verdict = await spec.terminal(view);
+				if (verdict.kind === "continue") return verdict;
+				return {
+					kind: "done",
+					landing: await spec.onDone(verdict.payload)
+				};
+			}
+		});
+	}
+	close(attemptId) {
+		this.#attempts.delete(attemptId);
+	}
+	isOpen(attemptId) {
+		const attempt = this.#attempts.get(attemptId);
+		return attempt !== void 0 && this.#now() <= attempt.expiresAtMs;
+	}
+	/**
+	* The hub-relative path that opens `vendorUrl` through the proxy for this attempt:
+	* the URL the browser is sent to. Null when the host is not in the attempt's list.
+	*/
+	entryPath(attemptId, vendorUrl) {
+		const attempt = this.#attempts.get(attemptId);
+		if (attempt === void 0) return null;
+		const url = new URL(vendorUrl);
+		if (findUpstream({
+			basePath: "",
+			upstreams: attempt.upstreams
+		}, url.host) === void 0) return null;
+		return `/addon/${this.#addonId}/${this.#prefix}/${attemptId}/${url.host}${url.pathname}${url.search}`;
+	}
+	#routeFor(attemptId, attempt, forwardedPrefix) {
+		return {
+			basePath: `${forwardedPrefix}/addon/${this.#addonId}/${this.#prefix}/${attemptId}`,
+			upstreams: attempt.upstreams
+		};
+	}
+	async #handle(req, res) {
+		try {
+			await this.#serve(req, res);
+		} catch (err) {
+			this.#logger.warn("vendor login proxy: request failed", { meta: {
+				addonId: this.#addonId,
+				error: err instanceof Error ? err.name : "unknown"
+			} });
+			if (!res.headersSent) sendPlain(res, 502, "The sign-in page could not be reached.");
+			else res.end();
+		}
+	}
+	async #serve(req, res) {
+		const parsed = parseProxyPath(req.url ?? "/");
+		if (parsed === null) {
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
+		const attempt = this.#attempts.get(parsed.attemptId);
+		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
+			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: attempt refused", { meta: {
+				addonId: this.#addonId,
+				reason: attempt === void 0 ? "missing" : "expired"
+			} });
+			this.#redirect(res, forwardedPrefix, {
+				status: "error",
+				addonId: this.#addonId,
+				reason: "invalid_state"
+			});
+			return;
+		}
+		const route = this.#routeFor(parsed.attemptId, attempt, forwardedPrefix);
+		const upstream = findUpstream(route, parsed.host);
+		const target = upstream === void 0 ? null : upstreamUrlFor(upstream, parsed);
+		if (upstream === void 0 || target === null) {
+			this.#logger.warn("vendor login proxy: host refused", { meta: {
+				addonId: this.#addonId,
+				host: parsed.host
+			} });
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		let body;
+		if (method !== "GET" && method !== "HEAD") {
+			const read = await readRequestBody(req);
+			if (read === "too-large") {
+				sendPlain(res, 413, "Request too large");
+				return;
+			}
+			body = read;
+		}
+		const headers = this.#requestHeaders(req, route, upstream);
+		const upstreamRes = await this.#fetch(target, {
+			method,
+			headers,
+			redirect: "manual",
+			...body !== void 0 && body.length > 0 ? { body: new Uint8Array(body) } : {}
+		});
+		const location = upstreamRes.headers.get("location");
+		const setCookies = upstreamRes.headers.getSetCookie();
+		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
+		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
+		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
+		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+			addonId: this.#addonId,
+			host: upstream.host,
+			status: upstreamRes.status,
+			method
+		} });
+		const settled = await attempt.evaluate({
+			status: upstreamRes.status,
+			url: target.toString(),
+			location,
+			setCookies,
+			bodyText: text
+		});
+		if (settled.kind === "done") {
+			this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
+				addonId: this.#addonId,
+				status: settled.landing.status
+			} });
+			this.#redirect(res, forwardedPrefix, settled.landing);
+			return;
+		}
+		const out = {};
+		upstreamRes.headers.forEach((value, name) => {
+			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
+		});
+		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
+		out["cache-control"] = "no-store";
+		if (text !== null && kind !== null) {
+			const rewritten = rewriteBody(text, kind, upstream, route);
+			res.writeHead(upstreamRes.status, out);
+			res.end(rewritten);
+			return;
+		}
+		res.writeHead(upstreamRes.status, out);
+		await this.#pipeBody(upstreamRes, res);
+	}
+	#requestHeaders(req, route, upstream) {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			const lower = name.toLowerCase();
+			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
+			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
+		}
+		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
+		if (cookie.length > 0) headers["cookie"] = cookie;
+		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
+		const referer = firstHeader(req.headers["referer"]);
+		if (referer !== void 0) {
+			const back = rewriteReferer(referer, route);
+			if (back !== null) headers["referer"] = back;
+		}
+		return headers;
+	}
+	async #pipeBody(upstreamRes, res) {
+		if (upstreamRes.body === null) {
+			res.end();
+			return;
+		}
+		for await (const chunk of upstreamRes.body) {
+			if (!res.write(chunk)) await new Promise((resolve) => {
+				res.once("drain", resolve);
+				res.once("close", resolve);
+			});
+			if (res.destroyed) return;
+		}
+		res.end();
+	}
+	#redirect(res, forwardedPrefix, outcome) {
+		res.writeHead(302, {
+			location: `${forwardedPrefix}${oauthLandingUrl(null, outcome)}`,
+			"cache-control": "no-store"
+		});
+		res.end();
+	}
+};
+//#endregion
 //#region src/utils/pool-memory-watchdog.ts
 var MB = 1024 * 1024;
 var DEFAULT_POOL_MEMORY_POLICY = {
@@ -117149,6 +119361,21 @@ exports.AcceleratorComputeSchema = AcceleratorComputeSchema;
 exports.AcceleratorKindSchema = AcceleratorKindSchema;
 exports.AccessoriesStatusSchema = AccessoriesStatusSchema;
 exports.AccessoryKind = AccessoryKind;
+exports.ActionEntrySchema = ActionEntrySchema;
+exports.ActionError = ActionError;
+exports.ActionErrorCodeSchema = ActionErrorCodeSchema;
+exports.ActionInputSchema = ActionInputSchema;
+exports.ActionLinksSchema = ActionLinksSchema;
+exports.ActionRunChangedSchema = ActionRunChangedSchema;
+exports.ActionRunOriginSchema = ActionRunOriginSchema;
+exports.ActionRunOutcomeSchema = ActionRunOutcomeSchema;
+exports.ActionRunResultSchema = ActionRunResultSchema;
+exports.ActionSourceKindSchema = ActionSourceKindSchema;
+exports.ActionStatusSchema = ActionStatusSchema;
+exports.ActionStepSchema = ActionStepSchema;
+exports.ActionVariableSchema = ActionVariableSchema;
+exports.ActionVariableTypeSchema = ActionVariableTypeSchema;
+exports.ActionVariableValueSchema = ActionVariableValueSchema;
 exports.ActiveCriterionSchema = require_composition.ActiveCriterionSchema;
 exports.AddBrokerInputSchema = AddBrokerInputSchema;
 exports.AddRetrainFrameFromRecordingResultSchema = AddRetrainFrameFromRecordingResultSchema;
@@ -117229,11 +119456,21 @@ exports.AutoTunePlanSchema = AutoTunePlanSchema;
 exports.AutoTuneWarningSchema = AutoTuneWarningSchema;
 exports.AutoUpdateSettingsSchema = AutoUpdateSettingsSchema;
 exports.AutomationActionSchema = AutomationActionSchema;
+exports.AutomationCapStepSchema = AutomationCapStepSchema;
 exports.AutomationConditionOperatorSchema = AutomationConditionOperatorSchema;
 exports.AutomationConditionSchema = AutomationConditionSchema;
+exports.AutomationConditionTraceNodeSchema = AutomationConditionTraceNodeSchema;
 exports.AutomationControlStatusSchema = AutomationControlStatusSchema;
 exports.AutomationRecipeSchema = AutomationRecipeSchema;
+exports.AutomationRunModeSchema = AutomationRunModeSchema;
+exports.AutomationRunOutcomeSchema = AutomationRunOutcomeSchema;
+exports.AutomationRunTraceSchema = AutomationRunTraceSchema;
+exports.AutomationRunVerdictSchema = AutomationRunVerdictSchema;
+exports.AutomationStateDocSchema = AutomationStateDocSchema;
+exports.AutomationStepTraceSchema = AutomationStepTraceSchema;
 exports.AutomationTriggerSchema = AutomationTriggerSchema;
+exports.AutomationTriggerTraceSchema = AutomationTriggerTraceSchema;
+exports.AutomationWaitStepSchema = AutomationWaitStepSchema;
 exports.AvailableIntegrationTypeSchema = AvailableIntegrationTypeSchema;
 exports.BASE_DEVICE_CAPS = BASE_DEVICE_CAPS;
 exports.BASE_LIVE_EGRESS_PROFILE = BASE_LIVE_EGRESS_PROFILE;
@@ -117495,6 +119732,7 @@ exports.CompositionTargetSchema = require_composition.CompositionTargetSchema;
 exports.CompositionUnavailableModeSchema = CompositionUnavailableModeSchema;
 exports.CompositionValidationSchema = CompositionValidationSchema;
 exports.CompositionViewSchema = CompositionViewSchema;
+exports.ConditionMirror = ConditionMirror;
 exports.ConfigEntrySchema = ConfigEntrySchema;
 exports.ConfigSectionWithValuesSchema = ConfigSectionWithValuesSchema;
 exports.ConfigTabDeclarationSchema = ConfigTabDeclarationSchema;
@@ -117574,6 +119812,7 @@ exports.DEFAULT_SESSION_PLACEMENT_POLICY = DEFAULT_SESSION_PLACEMENT_POLICY;
 exports.DEFAULT_SHARE_SOURCE = DEFAULT_SHARE_SOURCE;
 exports.DEFAULT_TIMELAPSE_PREVIEW_TEXT = DEFAULT_TIMELAPSE_PREVIEW_TEXT;
 exports.DEFAULT_TOKEN_EXPIRY = require_sleep.DEFAULT_TOKEN_EXPIRY;
+exports.DEFAULT_TRACE_KEEP = DEFAULT_TRACE_KEEP;
 exports.DEFAULT_VIEWER_SCOPE = DEFAULT_VIEWER_SCOPE;
 exports.DEFINITIVE_DEVICE_REFUSALS = DEFINITIVE_DEVICE_REFUSALS;
 exports.DERIVATIVE_UNITS = require_composition.DERIVATIVE_UNITS;
@@ -117641,6 +119880,7 @@ exports.DetailCropConventionSchema = DetailCropConventionSchema;
 exports.DetectionCatalogClassMapSchema = DetectionCatalogClassMapSchema;
 exports.DetectionSourceSchema = DetectionSourceSchema;
 exports.DetectionSourcesSchema = DetectionSourcesSchema;
+exports.DetectionTriggerFilter = DetectionTriggerFilter;
 exports.DeviceAdminLinkSchema = DeviceAdminLinkSchema;
 exports.DeviceCaStatusSchema = DeviceCaStatusSchema;
 exports.DeviceCertificateLoginMethodSchema = DeviceCertificateLoginMethodSchema;
@@ -117707,6 +119947,7 @@ exports.DoorbellStatusSchema = DoorbellStatusSchema;
 exports.EMBEDDING_MODEL_FAILED = EMBEDDING_MODEL_FAILED;
 exports.EMBEDDING_REQUIREMENTS_FAILED = EMBEDDING_REQUIREMENTS_FAILED;
 exports.EMBEDDING_REQUIREMENTS_UNAVAILABLE = EMBEDDING_REQUIREMENTS_UNAVAILABLE;
+exports.EMPTY_AUTOMATION_STATE = EMPTY_AUTOMATION_STATE;
 exports.ESTIMATE_COMPUTE_RATIO_MAX = ESTIMATE_COMPUTE_RATIO_MAX;
 exports.ESTIMATE_COMPUTE_RATIO_MIN = ESTIMATE_COMPUTE_RATIO_MIN;
 exports.EVENTFUL_CAP_NAMES = EVENTFUL_CAP_NAMES;
@@ -117895,10 +120136,12 @@ exports.ICON_CATEGORIES = ICON_CATEGORIES;
 exports.ICON_ENTRIES = ICON_ENTRIES;
 exports.ICON_KEYS = ICON_KEYS;
 exports.ICON_VIEWER_MODULES = ICON_VIEWER_MODULES;
+exports.IDLE_ACTION_STATUS = IDLE_ACTION_STATUS;
 exports.INFERENCE_DEVICE_EXCLUSION_REASONS = INFERENCE_DEVICE_EXCLUSION_REASONS;
 exports.INITIAL_PULSE = INITIAL_PULSE;
 exports.INITIAL_SPAN = INITIAL_SPAN;
 exports.INTEGRAL_OUTPUTS = require_composition.INTEGRAL_OUTPUTS;
+exports.INTERNAL_ACTION_PREFIX = INTERNAL_ACTION_PREFIX;
 exports.INVERTIBLE_CAPS = INVERTIBLE_CAPS;
 exports.IconKeySchema = IconKeySchema;
 exports.ImageContractSchema = ImageContractSchema;
@@ -118066,6 +120309,7 @@ exports.MAX_KEYS = MAX_KEYS;
 exports.MAX_REASONS_PER_KEY = MAX_REASONS_PER_KEY;
 exports.MAX_REQUEUED_BUCKETS_PER_SERIES = MAX_REQUEUED_BUCKETS_PER_SERIES;
 exports.MAX_SENSOR_TRIGGER_DEVICES = MAX_SENSOR_TRIGGER_DEVICES;
+exports.MAX_TRACE_KEEP = MAX_TRACE_KEEP;
 exports.MAX_TRACK_DEBUG_NOTE_LEN = MAX_TRACK_DEBUG_NOTE_LEN;
 exports.MAX_TRACK_PURITIES = MAX_TRACK_PURITIES;
 exports.MAX_TRACK_RELATIONS = MAX_TRACK_RELATIONS;
@@ -118789,6 +121033,7 @@ exports.RollingWindowSchema = require_composition.RollingWindowSchema;
 exports.RootStepSupplySchema = RootStepSupplySchema;
 exports.RtpSourceSchema = RtpSourceSchema;
 exports.RtspRestreamEntrySchema = RtspRestreamEntrySchema;
+exports.RunGate = RunGate;
 exports.RunnerBootCheckSchema = RunnerBootCheckSchema;
 exports.RunnerCameraConfigSchema = RunnerCameraConfigSchema;
 exports.RunnerCameraDeviceUIFields = RunnerCameraDeviceUIFields;
@@ -119014,6 +121259,8 @@ exports.TokenScopeSchema = TokenScopeSchema;
 exports.TopologyNodeSchema = TopologyNodeSchema;
 exports.TopologyProcessSchema = TopologyProcessSchema;
 exports.TopologyServiceSchema = TopologyServiceSchema;
+exports.TraceNodeOutcomeSchema = TraceNodeOutcomeSchema;
+exports.TraceValueSchema = TraceValueSchema;
 exports.TrackCascadeCountsSchema = TrackCascadeCountsSchema;
 exports.TrackEnvelopeSchema = TrackEnvelopeSchema;
 exports.TrackFlagsPatchSchema = TrackFlagsPatchSchema;
@@ -119120,6 +121367,7 @@ exports.VectorStatsInputSchema = VectorStatsInputSchema;
 exports.VectorStatsResultSchema = VectorStatsResultSchema;
 exports.VectorUpsertInputSchema = VectorUpsertInputSchema;
 exports.VectorUpsertResultSchema = VectorUpsertResultSchema;
+exports.VendorLoginProxy = VendorLoginProxy;
 exports.VibrationStatusSchema = VibrationStatusSchema;
 exports.VideoEncodeSchema = VideoEncodeSchema;
 exports.ViewerDeviceAllowSchema = ViewerDeviceAllowSchema;
@@ -119165,6 +121413,8 @@ exports.accessoriesCapability = accessoriesCapability;
 exports.accessoryChildrenComplete = accessoryChildrenComplete;
 exports.accessoryChildrenUnknown = accessoryChildrenUnknown;
 exports.accessoryStableId = accessoryStableId;
+exports.actionSourceCapability = actionSourceCapability;
+exports.actionsCapability = actionsCapability;
 exports.actionsForBoundCaps = actionsForBoundCaps;
 exports.actionsForDevice = actionsForDevice;
 exports.actionsForDeviceType = actionsForDeviceType;
@@ -119173,6 +121423,7 @@ exports.activateAlarmProfile = activateAlarmProfile;
 exports.activeForReducer = activeForReducer;
 exports.actuatorMethodRow = actuatorMethodRow;
 exports.addonCatalogHref = addonCatalogHref;
+exports.addonIdOfActionId = addonIdOfActionId;
 exports.addonPagesCapability = addonPagesCapability;
 exports.addonPagesSourceCapability = addonPagesSourceCapability;
 exports.addonRoutesCapability = addonRoutesCapability;
@@ -119199,6 +121450,7 @@ exports.allowedSuppliedEffect = allowedSuppliedEffect;
 exports.ambientLightSensorCapability = ambientLightSensorCapability;
 exports.annotateClipsWithEventLabels = annotateClipsWithEventLabels;
 exports.appFlowLocation = appFlowLocation;
+exports.appendTrace = appendTrace;
 exports.applianceDeviceType = require_composition.applianceDeviceType;
 exports.applianceExport = applianceExport;
 exports.applyBlockingEdit = applyBlockingEdit;
@@ -119246,6 +121498,7 @@ exports.bindAddonActions = bindAddonActions;
 exports.brightnessCapability = brightnessCapability;
 exports.brokerCapability = brokerCapability;
 exports.bucketStartOf = bucketStartOf;
+exports.buildActionSteps = buildActionSteps;
 exports.buildAddonRouteProvider = buildAddonRouteProvider;
 exports.buildAudioArgs = require_composition.buildAudioArgs;
 exports.buildBenchStepTree = buildBenchStepTree;
@@ -119264,6 +121517,7 @@ exports.buildSecretRef = require_sleep.buildSecretRef;
 exports.buildSessionLostAlert = buildSessionLostAlert;
 exports.buildStreamParamsConfigSchema = buildStreamParamsConfigSchema;
 exports.buildSubjectPath = buildSubjectPath;
+exports.buildTriggerTrace = buildTriggerTrace;
 exports.buildVideoArgs = require_composition.buildVideoArgs;
 exports.buildViewerLink = buildViewerLink;
 exports.builtCapabilityBlockers = builtCapabilityBlockers;
@@ -119318,6 +121572,7 @@ exports.codecIsAccepted = codecIsAccepted;
 exports.collectHydratedFieldEntries = require_sleep.collectHydratedFieldEntries;
 exports.collectHydratedFieldValues = require_sleep.collectHydratedFieldValues;
 exports.collectKeychainStoredKeys = require_sleep.collectKeychainStoredKeys;
+exports.collectMirrorSources = collectMirrorSources;
 exports.collectModelBoundKeys = collectModelBoundKeys;
 exports.collectSecretConfigKeys = require_sleep.collectSecretConfigKeys;
 exports.collectSecretLeaves = require_sleep.collectSecretLeaves;
@@ -119438,6 +121693,7 @@ exports.describeSystemEventDeliveryProblem = describeSystemEventDeliveryProblem;
 exports.describeSystemEventFamilyProblem = describeSystemEventFamilyProblem;
 exports.describeTopLevelStateFields = describeTopLevelStateFields;
 exports.detectAccessRole = detectAccessRole;
+exports.detectionClassMatches = detectionClassMatches;
 exports.detectionPipelineCapability = detectionPipelineCapability;
 exports.deviceAdminLinkCapability = deviceAdminLinkCapability;
 exports.deviceAdoptionCapability = deviceAdoptionCapability;
@@ -119498,6 +121754,7 @@ exports.estimateNodeBenchmarkDurationMs = estimateNodeBenchmarkDurationMs;
 exports.evaluateAggregate = evaluateAggregate;
 exports.evaluateAst = require_composition.evaluateAst;
 exports.evaluateCompositionField = evaluateCompositionField;
+exports.evaluateConditionTree = evaluateConditionTree;
 exports.evaluateCount = require_composition.evaluateCount;
 exports.evaluateDerivative = require_composition.evaluateDerivative;
 exports.evaluateExpressionSource = require_composition.evaluateExpressionSource;
@@ -119608,6 +121865,7 @@ exports.integralDraft = integralDraft;
 exports.integrateReading = require_composition.integrateReading;
 exports.integrationsCapability = integrationsCapability;
 exports.intercomCapability = intercomCapability;
+exports.internalActionId = internalActionId;
 exports.interpolate = interpolate;
 exports.interpretStoredClusterModel = interpretStoredClusterModel;
 exports.invalidClusterStepModelEntries = invalidClusterStepModelEntries;
@@ -119649,6 +121907,7 @@ exports.isFirstLevelMacroClass = isFirstLevelMacroClass;
 exports.isHeldBackTemplateVar = isHeldBackTemplateVar;
 exports.isHistoryHelper = require_composition.isHistoryHelper;
 exports.isIconKey = isIconKey;
+exports.isInternalActionId = isInternalActionId;
 exports.isIsolatedBuiltin = isIsolatedBuiltin;
 exports.isKeychainStoredField = require_sleep.isKeychainStoredField;
 exports.isKnownTemplateVar = isKnownTemplateVar;
@@ -119677,6 +121936,7 @@ exports.isSecretMarkerLike = require_sleep.isSecretMarkerLike;
 exports.isSecretRef = require_sleep.isSecretRef;
 exports.isSecretRefOwnedBy = require_sleep.isSecretRefOwnedBy;
 exports.isSingleHubAddressRole = isSingleHubAddressRole;
+exports.isSkippedTrace = isSkippedTrace;
 exports.isSoftwareDecode = require_composition.isSoftwareDecode;
 exports.isSourceCap = require_composition.isSourceCap;
 exports.isStateLabelKey = isStateLabelKey;
@@ -119749,6 +122009,7 @@ exports.mergeOverrides = mergeOverrides;
 exports.mergeScalarTarget = mergeScalarTarget;
 exports.mergeSecretStatePaths = require_sleep.mergeSecretStatePaths;
 exports.mergeSettingsBags = mergeSettingsBags;
+exports.mergeSkipTraces = mergeSkipTraces;
 exports.mergeSourceInfo = mergeSourceInfo;
 exports.meshNetworkCapability = meshNetworkCapability;
 exports.meterCapability = meterCapability;
@@ -119954,6 +122215,7 @@ exports.requiredTopLevelKeys = requiredTopLevelKeys;
 exports.requiresPython = requiresPython;
 exports.reservedSourceOwner = reservedSourceOwner;
 exports.resetPoolBaseline = resetPoolBaseline;
+exports.resolveActionVariables = resolveActionVariables;
 exports.resolveAddonExecution = resolveAddonExecution;
 exports.resolveAddonGroup = resolveAddonGroup;
 exports.resolveAddonPlacement = resolveAddonPlacement;
@@ -119968,6 +122230,7 @@ exports.resolveCoreBlockFiles = resolveCoreBlockFiles;
 exports.resolveCreateExportSubject = resolveCreateExportSubject;
 exports.resolveDeviceControlKind = resolveDeviceControlKind;
 exports.resolveDeviceProfile = resolveDeviceProfile;
+exports.resolveDeviceTarget = resolveDeviceTarget;
 exports.resolveEffectiveShares = resolveEffectiveShares;
 exports.resolveEgressDecodeHwAccel = resolveEgressDecodeHwAccel;
 exports.resolveExportProfiles = resolveExportProfiles;
@@ -119994,6 +122257,7 @@ exports.resolveRunnerId = resolveRunnerId;
 exports.resolveSecretMarkers = require_sleep.resolveSecretMarkers;
 exports.resolveSecretViewsIn = require_sleep.resolveSecretViewsIn;
 exports.resolveServerName = resolveServerName;
+exports.resolveStepArgs = resolveStepArgs;
 exports.resolveStreamMaps = require_composition.resolveStreamMaps;
 exports.resolveVariantModelId = resolveVariantModelId;
 exports.resolveViewableDeviceIds = resolveViewableDeviceIds;
@@ -120001,6 +122265,10 @@ exports.resultCellKey = resultCellKey;
 exports.resultStandings = resultStandings;
 exports.retrainBoxIou = retrainBoxIou;
 exports.retrainRevisionConflictMessage = retrainRevisionConflictMessage;
+exports.rewriteLoginProxyBody = rewriteBody;
+exports.rewriteLoginProxyLocation = rewriteLocation;
+exports.rewriteLoginProxyReferer = rewriteReferer;
+exports.rewriteLoginProxySetCookie = rewriteSetCookie;
 exports.roleSpec = roleSpec;
 exports.rollingDurationMs = require_composition.rollingDurationMs;
 exports.roomCompositionExample = roomCompositionExample;
@@ -120022,6 +122290,7 @@ exports.ruleSeedForSection = ruleSeedForSection;
 exports.ruleTriggerZoneIds = ruleTriggerZoneIds;
 exports.runFanOut = runFanOut;
 exports.runInferenceStep = runInferenceStep;
+exports.runSteps = runSteps;
 exports.runningFromDishwasherOperation = runningFromDishwasherOperation;
 exports.runningFromLawnMower = runningFromLawnMower;
 exports.runningFromMediaPlayer = runningFromMediaPlayer;
@@ -120080,6 +122349,7 @@ exports.shortSecretRefHash = require_sleep.shortSecretRefHash;
 exports.signalPercentFromBars = signalPercentFromBars;
 exports.signalPercentFromRssi = signalPercentFromRssi;
 exports.siteZoneKey = siteZoneKey;
+exports.skipSignature = skipSignature;
 exports.sleep = require_sleep.sleep;
 exports.sleepCancellable = require_sleep.sleepCancellable;
 exports.sliceActiveValue = require_composition.sliceActiveValue;