@camstack/addon-pipeline-orchestrator 1.1.17 → 1.1.19

package/dist/index.mjs

@@ -4627,7 +4627,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-MHm--th-.mjs
+//#region ../types/dist/sleep-BO1nweKv.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -7832,6 +7832,601 @@ var _macroLookup = /* @__PURE__ */ new Map();
 for (const [k, v] of Object.entries(YAMNET_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 for (const [k, v] of Object.entries(APPLE_SA_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 /**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+Object.freeze({});
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -13200,14 +13795,63 @@ var ChildLayoutEntrySchema = object({
 	collapsed: boolean().optional()
 });
 /** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. */
+*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
+*  accessory's status field (`kind` optional/absent for wire compat); a
+*  LITERAL source carries a per-device constant (no sibling is read); a
+*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
+*  source device's full re-sync-stable `stableId`. */
+var DeviceLinkFieldSourceSchema = object({
+	kind: literal("field").optional(),
+	sourceKey: string(),
+	cap: string(),
+	fieldPath: string()
+});
+var DeviceLinkLiteralSourceSchema = object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+});
+var DeviceLinkGlobalSourceSchema = object({
+	kind: literal("global"),
+	sourceStableId: string(),
+	cap: string(),
+	fieldPath: string()
+});
+/** Expression source (Stage X): compute the target field from N named bindings
+*  via the safe expression engine. Bindings are field | literal | global — never
+*  another expression (no nesting). The `superRefine` runs the SAME author-time
+*  validation as `validateExpressionSource` (compiles the expr, checks binding
+*  names + identifier coverage) so every wire boundary that parses a DeviceLink
+*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
+*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
+var DeviceLinkExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema
+	]))
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 var DeviceLinkSchema = object({
 	id: string(),
-	source: object({
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
+	source: union([
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema,
+		DeviceLinkExpressionSourceSchema
+	]),
 	target: object({
 		cap: string(),
 		fieldPath: string(),
@@ -13236,6 +13880,31 @@ var DeviceLinkSchema = object({
 		})
 	]).optional()
 });
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional()
+});
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = object({
+	icon: string().min(1).optional(),
+	label: string().min(1).optional(),
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	hidden: boolean().optional(),
+	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	icon: string().min(1).optional()
+});
 /**
 * Serializable projection of a live IDevice.
 * Returned by listAll, getDevice, getChildren.
@@ -13291,7 +13960,9 @@ var DeviceInfoSchema = object({
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
 	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional()
+	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 var ConfigEntrySchema = object({
 	key: string(),
@@ -13356,7 +14027,9 @@ var DeviceMetaSchema = object({
 	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
-	role: string().nullable().optional()
+	role: string().nullable().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 /** ConfigUISchema passed through as unknown — mirrors device-provider's CreationSchemaOutputSchema */
 var ConfigUISchemaOutput = unknown().nullable();
@@ -13450,7 +14123,19 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ caps: array(object({
+}), method(object({
+	deviceId: number(),
+	display: DeviceDisplayOverrideSchema.nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ defaults: record(string(), RoleDisplayDefaultSchema) }), { kind: "query" }), method(object({ defaults: record(string(), RoleDisplayDefaultSchema) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	includeSynthesizable: boolean().optional()
+}), object({ caps: array(object({
 	cap: string(),
 	fields: array(object({
 		path: string(),
@@ -13460,8 +14145,13 @@ method(object({
 			"boolean",
 			"enum"
 		]),
-		enumValues: array(string()).optional()
-	})).readonly()
+		enumValues: array(string()).optional(),
+		item: boolean().optional()
+	})).readonly(),
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
 })).readonly() }), { kind: "query" }), method(object({
 	deviceId: number(),
 	role: string().nullable()
@@ -13531,7 +14221,11 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum(["native", "wrapped"]),
+		kind: _enum([
+			"native",
+			"wrapped",
+			"linked"
+		]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13540,7 +14234,11 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum(["native", "wrapped"]),
+		kind: _enum([
+			"native",
+			"wrapped",
+			"linked"
+		]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -14958,7 +15656,10 @@ var pipelineOrchestratorCapability = {
 	methods: {
 		/**
 		* Pin a camera's pipeline to a specific agent (L1 affinity).
-		* The orchestrator re-evaluates the assignment immediately.
+		* The orchestrator re-evaluates the assignment immediately and persists
+		* the pin under the canonical `pipelineNodeId` device-store key (the
+		* legacy `preferredAgent` key is nulled on write and kept only as a
+		* read-only fallback for stores written before the unification).
 		*/
 		assignPipeline: method(object({
 			deviceId: number(),
@@ -14969,8 +15670,9 @@ var pipelineOrchestratorCapability = {
 		}),
 		/**
 		* Clear a camera's pipeline pin and let the auto-balancer re-pick
-		* the optimal agent. The orchestrator persists `preferredAgent=null`
-		* (and `pipelineNodeId='auto'`), then re-runs the balancer with the
+		* the optimal agent. The orchestrator persists the canonical
+		* `pipelineNodeId='auto'` (and nulls the legacy `preferredAgent`),
+		* then re-runs the balancer with the
 		* cached `RunnerCameraConfig` and migrates only when the chosen
 		* node differs. The camera stays in `getPipelineAssignments()` —
 		* just with `pinned=false`. If no runner is currently available
@@ -19284,6 +19986,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getSettingsSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -19434,6 +20142,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setDisplay": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setIntegrationId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -19476,6 +20190,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setStreamProfileMap": {
 		capName: "device-manager",
 		capScope: "system",
@@ -24619,9 +25339,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				}
 			}
 		}
-		const pipelinePin = (await this.ctx.settings?.readDeviceStore(runnerConfig.deviceId) ?? {})["pipelineNodeId"];
-		const legacyPreferred = await this.readPreferredAgent(runnerConfig.deviceId);
-		const preferredAgent = typeof pipelinePin === "string" && pipelinePin !== "auto" ? pipelinePin : legacyPreferred;
+		const preferredAgent = await this.readPipelinePin(runnerConfig.deviceId);
 		const decision = balance({
 			nodes: await this.collectAgentLoad({ onlyEnabled: true }),
 			preferredAgent,
@@ -24693,7 +25411,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		if (!this.ctx) throw new Error("PipelineOrchestrator: assignPipeline called before initialize");
 		const eligible = this.detectionEligibleNodes(input.deviceId);
 		if (!eligible.includes(input.agentNodeId)) throw new Error(`Cannot pin camera ${input.deviceId} detection to '${input.agentNodeId}': the node cannot obtain this camera's decoded frames (frame-source nodes: ${eligible.join(", ") || "none"}). Add it to Enabled Decoder Nodes first.`);
-		await this.ctx.settings?.writeDeviceStore(input.deviceId, { [PREFERRED_AGENT_SETTING]: input.agentNodeId }).catch((err) => {
+		await this.ctx.settings?.writeDeviceStore(input.deviceId, {
+			pipelineNodeId: input.agentNodeId,
+			[PREFERRED_AGENT_SETTING]: null
+		}).catch((err) => {
 			const msg = errMsg(err);
 			this.ctx.logger.warn("assignPipeline: failed to persist pin", {
 				tags: { deviceId: input.deviceId },
@@ -24787,13 +25508,26 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		if (!this.ctx) throw new Error("PipelineOrchestrator: rebalance called before initialize");
 		const loads = await this.collectAgentLoad({ onlyEnabled: true });
 		const nodeCaps = await this.buildNodeCaps();
+		const attachedDelta = /* @__PURE__ */ new Map();
+		const bumpAttached = (nodeId, by) => {
+			attachedDelta.set(nodeId, (attachedDelta.get(nodeId) ?? 0) + by);
+		};
+		const talliedLoads = () => loads.map((load) => {
+			const delta = attachedDelta.get(load.nodeId) ?? 0;
+			if (delta === 0) return load;
+			return {
+				...load,
+				attachedCameras: Math.max(0, load.attachedCameras + delta)
+			};
+		});
 		let migrated = 0;
 		for (const [deviceId, config] of this.cameraConfigs) {
 			const current = this.assignments.get(deviceId);
 			if (current?.pinned) continue;
+			const preferredAgent = await this.readPipelinePin(deviceId);
 			const decision = balance({
-				nodes: loads,
-				preferredAgent: await this.readPreferredAgent(deviceId),
+				nodes: talliedLoads(),
+				preferredAgent,
 				nodeCaps,
 				eligibleNodes: this.detectionEligibleNodes(deviceId)
 			});
@@ -24807,14 +25541,18 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				continue;
 			}
 			if (current && current.agentNodeId === decision.agentNodeId) continue;
-			if (current) await this.detachOn(current.agentNodeId, deviceId).catch((err) => {
-				const msg = errMsg(err);
-				this.ctx.logger.debug("rebalance detach-old failed", {
-					tags: { deviceId },
-					meta: { error: msg }
+			if (current) {
+				await this.detachOn(current.agentNodeId, deviceId).catch((err) => {
+					const msg = errMsg(err);
+					this.ctx.logger.debug("rebalance detach-old failed", {
+						tags: { deviceId },
+						meta: { error: msg }
+					});
 				});
-			});
+				bumpAttached(current.agentNodeId, -1);
+			}
 			await this.attachOn(decision.agentNodeId, config);
+			bumpAttached(decision.agentNodeId, 1);
 			this.recordAssignment(deviceId, decision.agentNodeId, "rebalance", false);
 			migrated++;
 		}
@@ -25176,11 +25914,22 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			if (timer) clearTimeout(timer);
 		}
 	}
-	async readPreferredAgent(deviceId) {
+	/**
+	* Resolve the persisted pipeline-node pin for a device. `pipelineNodeId` is
+	* the canonical key (matching the sibling `decoderNodeId` / `audioNodeId`
+	* `'auto'`-sentinel pattern); the legacy `preferredAgent` key is a read-only
+	* fallback kept for backward compatibility with stores written before the
+	* unification. A single device-store read serves both. Returns a concrete
+	* node id, or `null` when neither key holds a pin (auto-balance).
+	*/
+	async readPipelinePin(deviceId) {
 		if (!this.ctx?.settings) return null;
 		try {
-			const value = (await this.ctx.settings.readDeviceStore(deviceId))[PREFERRED_AGENT_SETTING];
-			return typeof value === "string" && value.length > 0 ? value : null;
+			const settings = await this.ctx.settings.readDeviceStore(deviceId);
+			const pipelinePin = settings["pipelineNodeId"];
+			if (typeof pipelinePin === "string" && pipelinePin.length > 0 && pipelinePin !== "auto") return pipelinePin;
+			const legacy = settings[PREFERRED_AGENT_SETTING];
+			return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
 		} catch {
 			return null;
 		}
@@ -25321,7 +26070,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				} });
 				continue;
 			}
-			if (assignment.pinned && this.failoverPolicy.pinnedOnDisconnect === "unpin-and-migrate") await this.ctx.settings?.writeDeviceStore(deviceId, { [PREFERRED_AGENT_SETTING]: null }).catch(() => {});
+			if (assignment.pinned && this.failoverPolicy.pinnedOnDisconnect === "unpin-and-migrate") await this.ctx.settings?.writeDeviceStore(deviceId, {
+				[PREFERRED_AGENT_SETTING]: null,
+				pipelineNodeId: "auto"
+			}).catch(() => {});
 			affected.push({
 				deviceId,
 				config