@camstack/addon-pipeline-orchestrator 1.1.18 → 1.1.20

package/dist/index.js

@@ -4631,7 +4631,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-MHm--th-.mjs
+//#region ../types/dist/sleep-BiDFW0E7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5460,6 +5460,100 @@ function createDurableState(deps) {
 	};
 }
 /**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -5627,23 +5721,63 @@ var BaseAddon = class {
 	deviceSettingsSchema() {
 		return null;
 	}
-	async getGlobalSettings(overlay, cap, _nodeId) {
+	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		const projected = await this.resolveGlobalStore(nodeId, cap);
 		return hydrateSchema(schema, overlay ? {
-			...raw,
+			...projected,
 			...overlay
-		} : raw);
+		} : projected);
 	}
-	async updateGlobalSettings(patch, _nodeId) {
-		await this._ctx?.settings?.writeAddonStore(patch);
+	/**
+	* The raw addon store PROJECTED onto the target node's bare per-node keys:
+	* every `perNode: true` field carries THAT node's scoped value on its bare
+	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
+	* bare fallback), all `@`-scoped and stray bare per-node keys are dropped.
+	* A no-op passthrough when the schema declares no `perNode` field.
+	*
+	* This is the sanctioned way for a `getGlobalSettings` OVERRIDE that needs
+	* the store for custom option logic (option narrowing, value snapping) to
+	* read it per-node — never `ctx.settings.readAddonStore()` directly.
+	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*/
+	async resolveGlobalStore(nodeId, cap) {
+		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		const keys = this.perNodeKeys(cap);
+		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
+		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
+	}
+	async updateGlobalSettings(patch, nodeId) {
+		const keys = this.perNodeKeys();
+		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
+		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
+		const barePatch = patch;
+		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
+		await this._ctx?.settings?.writeAddonStore(scoped);
+		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
 		this.maybeAutoRestart(patch, this.globalSettingsSchema());
 	}
 	/**
+	* The set of field keys the global settings schema declares `perNode: true`
+	* — derived once per `cap` argument and memoized (schemas are static
+	* declarations). Empty set ⇒ every per-node code path is bypassed and the
+	* settings API behaves exactly like the legacy node-agnostic one.
+	*/
+	_perNodeKeysCache = /* @__PURE__ */ new Map();
+	perNodeKeys(cap) {
+		const cacheKey = cap ?? "";
+		const cached = this._perNodeKeysCache.get(cacheKey);
+		if (cached) return cached;
+		const schema = this.globalSettingsSchema(cap);
+		const keys = new Set(schema ? schema.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		this._perNodeKeysCache.set(cacheKey, keys);
+		return keys;
+	}
+	/**
 	* If any field in `patch` is marked `requiresRestart` in `schema`,
 	* schedule an addon restart for the next tick. Deferred via
 	* `setImmediate` so the tRPC mutation that triggered the write has
@@ -5796,12 +5930,19 @@ var BaseAddon = class {
 	* The merge is shallow: each key in `defaults` is checked against the store.
 	* Only keys present in defaults are read — the store can contain extra keys
 	* (e.g. from older versions) without polluting the typed config.
+	*
+	* Keys the global settings schema declares `perNode: true` resolve from
+	* THIS node's scoped key (`<key>@<localNode>`) via `readNodeValue` — never
+	* from the bare key — so a per-node field resolves to this node's own
+	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
 		const stored = await this.readAddonStoreWithRetry();
+		const perNode = this.perNodeKeys();
+		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
 		for (const key of Object.keys(this.defaults)) {
-			const storedValue = stored[key];
+			const storedValue = perNode.has(key) ? readNodeValue(stored, key, localNode) : stored[key];
 			if (storedValue !== void 0 && storedValue !== null) {
 				const defaultType = typeof this.defaults[key];
 				if (typeof storedValue === defaultType) resolved[key] = storedValue;
@@ -5885,6 +6026,27 @@ var BaseAddon = class {
 	}
 };
 /**
+* Collect the keys of every field marked `perNode: true`, recursing into
+* layout containers (`group` fields and `sub-tabs` tabs) the same way
+* `hydrateSchema` does. Valueless structural fields (separator/info/…)
+* don't declare `perNode` and are excluded by the `in` narrowing.
+*/
+function collectPerNodeFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectPerNodeFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectPerNodeFieldKeys(tab.fields));
+			continue;
+		}
+		if ("perNode" in field && field.perNode === true) collected.push(field.key);
+	}
+	return collected;
+}
+/**
 * Normalize an `ICamstackAddon.initialize()` return value into the
 * `AddonInitResult` envelope. Arrays are wrapped into `{ providers }`;
 * envelopes pass through; void stays void.
@@ -6652,6 +6814,13 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	/** Single still-image entity (HA `image.*`). Read-only display of an
 	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
 	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -7836,6 +8005,601 @@ var _macroLookup = /* @__PURE__ */ new Map();
 for (const [k, v] of Object.entries(YAMNET_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 for (const [k, v] of Object.entries(APPLE_SA_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 /**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+Object.freeze({});
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -9769,7 +10533,8 @@ var MotionAnalysisResultSchema = object({
 });
 method(object({
 	deviceId: number(),
-	frame: FrameInputSchema
+	frame: FrameInputSchema.optional(),
+	frameHandle: FrameHandleSchema.optional()
 }), MotionAnalysisResultSchema, { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), object({
 	deviceId: number(),
 	detected: boolean(),
@@ -10076,11 +10841,20 @@ var pipelineExecutorCapability = {
 		* legacy call shape used by existing benchmark code; once all
 		* callers pass it explicitly we make it required.
 		*
-		* Exactly one of `frame`, `imageBase64`, `referenceImage` must be
-		* provided:
+		* Exactly one of `frame`, `frameHandle`, `imageBase64`,
+		* `referenceImage` must be provided:
 		*  - `frame`: runtime dispatch path (runner → decoded broker frame).
 		*    Carries the raw buffer, dimensions, and format; the executor
 		*    uses it directly without base64 round-tripping.
+		*  - `frameHandle` (CB5): a zero-pixel shm `FrameHandle` for the SAME
+		*    decoded frame. Both runner and executor are hub-local processes
+		*    sharing `/dev/shm`, so the executor maps the named segment and
+		*    reads the pixels back zero-copy — eliminating the ~1.2MB
+		*    re-serialisation over UDS/MsgPack the `frame` path pays per call.
+		*    High-risk: the FrameRing is a latest-wins seqlock with no
+		*    refcount, so a recycled slot yields a null read; the executor
+		*    then degrades to an empty result and the runner ships pixels via
+		*    `frame` as the fallback (queue-depth gated on the runner side).
 		*  - `imageBase64`: one-shot test path (benchmark ImageTab).
 		*  - `referenceImage`: named file from the reference-image store.
 		*/
@@ -10088,6 +10862,12 @@ var pipelineExecutorCapability = {
 			engine: PipelineEngineChoiceSchema.optional(),
 			steps: array(PipelineStepInputSchema).min(1),
 			frame: FrameInputSchema.optional(),
+			/**
+			* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+			* the decoded pixels live in. One more member of the one-of
+			* frame/frameHandle/image/imageBase64/referenceImage group.
+			*/
+			frameHandle: FrameHandleSchema.optional(),
 			imageBase64: string().optional(),
 			/**
 			* Binary JPEG bytes — preferred over `imageBase64` on internal
@@ -10981,6 +11761,113 @@ object({
 	lastFetchedAt: number()
 });
 DeviceType.Sensor;
+/**
+* Feeder connectivity / power status — mirrors the HA petkit device-status
+* enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
+* `on_batteries` (running on battery backup). `null` until first reported.
+*/
+var PetFeederDeviceStatusSchema = _enum([
+	"normal",
+	"offline",
+	"on_batteries"
+]);
+var gramsPortion = number().int().min(4).max(200);
+object({
+	/** Food currently in the bowl (grams). Null when the device has not
+	*  reported a reading yet. On dual-hopper models this is the combined
+	*  bowl reading; per-hopper levels live in `food1`/`food2`. */
+	foodLevel: number().nullable(),
+	/** Hopper-1 food level (grams) on dual-hopper feeders; null on
+	*  single-hopper models. */
+	food1: number().nullable(),
+	/** Hopper-2 food level (grams) on dual-hopper feeders; null on
+	*  single-hopper models. */
+	food2: number().nullable(),
+	/** Derived low-food flag — mirrors the HA `food_level` binary_sensor
+	*  (`device_class: problem`, on = low). True when the bowl is empty /
+	*  below the feeder's low threshold. */
+	lowFood: boolean(),
+	/** Battery charge 0..100 (%). Null on mains-powered models or when the
+	*  device has no battery reading. */
+	batteryPower: number().min(0).max(100).nullable(),
+	/** Days of desiccant life remaining. Null when the model has no
+	*  desiccant sensor. */
+	desiccantLeftDays: number().nullable(),
+	/** True while a feed is in progress. */
+	feeding: boolean(),
+	/** Decoded connectivity / power status (HA petkit device-status enum).
+	*  Null until the device has reported a status. */
+	status: PetFeederDeviceStatusSchema.nullable(),
+	/** Decoded human-readable fault message. Null (or the device's `no_error`
+	*  sentinel) means healthy; a non-null string is an active fault. Pairs
+	*  with `errorCode` for consumers that want the raw integer. */
+	error: string().nullable(),
+	/** Raw device error code (0 / null = no error). */
+	errorCode: number().nullable(),
+	/** True for D4S/D4SH dual-hopper hardware — gates the per-hopper UI. */
+	isDualHopper: boolean(),
+	/** Child-lock (manual-lock) setting — buttons on the unit are disabled. */
+	childLock: boolean(),
+	/** Front indicator-light setting. */
+	indicatorLight: boolean(),
+	/** Play a chime when dispensing. */
+	feedSound: boolean(),
+	/** Speaker / prompt volume level (device-scaled integer). */
+	volume: number(),
+	/** Ms epoch when the slice was last refreshed from the cloud. */
+	lastFetchedAt: number()
+});
+DeviceType.PetFeeder, method(object({
+	deviceId: number().int().nonnegative(),
+	grams: gramsPortion.optional(),
+	hopper1: gramsPortion.optional(),
+	hopper2: gramsPortion.optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	soundId: number().int().nonnegative()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	level: number().int().nonnegative()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Instantaneous power draw in watts. */
 	watts: number().optional(),
@@ -12914,10 +13801,12 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	url: string()
 }), _void()), method(object({
 	sessionId: string(),
-	maxCount: number().default(1)
+	maxCount: number().default(1),
+	waitMs: number().optional()
 }), array(DecodedFrameSchema)), method(object({
 	sessionId: string(),
-	maxCount: number().default(1)
+	maxCount: number().default(1),
+	waitMs: number().optional()
 }), array(FrameHandleSchema)), method(object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()), method(object({ sessionId: string() }), ShmRingStatsSchema.nullable()), method(object({
 	sessionId: string(),
 	config: DecoderSessionConfigSchema.partial()
@@ -13209,30 +14098,57 @@ var ChildLayoutEntrySchema = object({
 *  LITERAL source carries a per-device constant (no sibling is read); a
 *  GLOBAL source (P2e) copies ANY device's status field, addressed by the
 *  source device's full re-sync-stable `stableId`. */
+var DeviceLinkFieldSourceSchema = object({
+	kind: literal("field").optional(),
+	sourceKey: string(),
+	cap: string(),
+	fieldPath: string()
+});
+var DeviceLinkLiteralSourceSchema = object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+});
+var DeviceLinkGlobalSourceSchema = object({
+	kind: literal("global"),
+	sourceStableId: string(),
+	cap: string(),
+	fieldPath: string()
+});
+/** Expression source (Stage X): compute the target field from N named bindings
+*  via the safe expression engine. Bindings are field | literal | global — never
+*  another expression (no nesting). The `superRefine` runs the SAME author-time
+*  validation as `validateExpressionSource` (compiles the expr, checks binding
+*  names + identifier coverage) so every wire boundary that parses a DeviceLink
+*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
+*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
+var DeviceLinkExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema
+	]))
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 var DeviceLinkSchema = object({
 	id: string(),
 	source: union([
-		object({
-			kind: literal("field").optional(),
-			sourceKey: string(),
-			cap: string(),
-			fieldPath: string()
-		}),
-		object({
-			kind: literal("literal"),
-			value: union([
-				string(),
-				number(),
-				boolean(),
-				_null()
-			])
-		}),
-		object({
-			kind: literal("global"),
-			sourceStableId: string(),
-			cap: string(),
-			fieldPath: string()
-		})
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema,
+		DeviceLinkExpressionSourceSchema
 	]),
 	target: object({
 		cap: string(),
@@ -13262,6 +14178,31 @@ var DeviceLinkSchema = object({
 		})
 	]).optional()
 });
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional()
+});
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = object({
+	icon: string().min(1).optional(),
+	label: string().min(1).optional(),
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	hidden: boolean().optional(),
+	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	icon: string().min(1).optional()
+});
 /**
 * Serializable projection of a live IDevice.
 * Returned by listAll, getDevice, getChildren.
@@ -13317,7 +14258,9 @@ var DeviceInfoSchema = object({
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
 	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional()
+	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 var ConfigEntrySchema = object({
 	key: string(),
@@ -13382,7 +14325,9 @@ var DeviceMetaSchema = object({
 	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
-	role: string().nullable().optional()
+	role: string().nullable().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 /** ConfigUISchema passed through as unknown — mirrors device-provider's CreationSchemaOutputSchema */
 var ConfigUISchemaOutput = unknown().nullable();
@@ -13476,6 +14421,15 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	display: DeviceDisplayOverrideSchema.nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ defaults: record(string(), RoleDisplayDefaultSchema) }), { kind: "query" }), method(object({ defaults: record(string(), RoleDisplayDefaultSchema) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	includeSynthesizable: boolean().optional()
@@ -15000,7 +15954,10 @@ var pipelineOrchestratorCapability = {
 	methods: {
 		/**
 		* Pin a camera's pipeline to a specific agent (L1 affinity).
-		* The orchestrator re-evaluates the assignment immediately.
+		* The orchestrator re-evaluates the assignment immediately and persists
+		* the pin under the canonical `pipelineNodeId` device-store key (the
+		* legacy `preferredAgent` key is nulled on write and kept only as a
+		* read-only fallback for stores written before the unification).
 		*/
 		assignPipeline: method(object({
 			deviceId: number(),
@@ -15011,8 +15968,9 @@ var pipelineOrchestratorCapability = {
 		}),
 		/**
 		* Clear a camera's pipeline pin and let the auto-balancer re-pick
-		* the optimal agent. The orchestrator persists `preferredAgent=null`
-		* (and `pipelineNodeId='auto'`), then re-runs the balancer with the
+		* the optimal agent. The orchestrator persists the canonical
+		* `pipelineNodeId='auto'` (and nulls the legacy `preferredAgent`),
+		* then re-runs the balancer with the
 		* cached `RunnerCameraConfig` and migrates only when the chosen
 		* node differs. The camera stays in `getPipelineAssignments()` —
 		* just with `pinned=false`. If no runner is currently available
@@ -17513,7 +18471,10 @@ var HwAccelBackendInputSchema = _enum([
 	"webgpu",
 	"none"
 ]).nullable().optional();
-var HwAccelResolutionSchema = object({ preferred: array(string()).readonly() });
+var HwAccelResolutionSchema = object({
+	preferred: array(string()).readonly(),
+	rationale: string()
+});
 var HardwareEncoderIdSchema = _enum([
 	"h264_videotoolbox",
 	"hevc_videotoolbox",
@@ -17618,10 +18579,7 @@ var ResolvedInferenceConfigSchema = object({
 	format: ModelFormatSchema,
 	reason: string()
 });
-method(_void(), PlatformCapabilitiesSchema), method(_void(), HardwareInfoSchema), method(object({ requirements: array(ModelRequirementSchema).readonly() }), ResolvedInferenceConfigSchema), method(object({
-	prefer: HwAccelBackendInputSchema,
-	nodeId: string().optional()
-}), HwAccelResolutionSchema), method(_void(), HardwareEncodersSchema), method(_void(), HardwareEncodersSchema, {
+method(_void(), PlatformCapabilitiesSchema), method(_void(), HardwareInfoSchema), method(object({ requirements: array(ModelRequirementSchema).readonly() }), ResolvedInferenceConfigSchema), method(object({ prefer: HwAccelBackendInputSchema }), HwAccelResolutionSchema), method(_void(), HardwareEncodersSchema), method(_void(), HardwareEncodersSchema, {
 	kind: "mutation",
 	auth: "admin"
 }), method(_void(), HardwareDecodeAccelsSchema), method(_void(), HardwareDecodeAccelsSchema, {
@@ -19326,6 +20284,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getSettingsSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -19476,6 +20440,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setDisplay": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setIntegrationId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -19518,6 +20488,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setStreamProfileMap": {
 		capName: "device-manager",
 		capScope: "system",
@@ -20568,6 +21544,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"petFeeder.callPet": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.cancelFeed": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.feed": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.markFoodReplenished": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.playSound": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.resetDesiccant": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"petFeeder.setChildLock": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setFeedSound": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setIndicatorLight": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setVolume": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -23940,6 +24976,14 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		if (!this._cameraSettingsState) this._cameraSettingsState = this.state("cameraSettings", CameraSettingsMapSchema, {});
 		return this._cameraSettingsState;
 	}
+	/** One-shot `migrateLegacyFlagsToBindings` guard flag. Absent or
+	*  corrupt ⇒ `false` (the migration runs — same fallback as the old
+	*  raw `store[key] === true` check). */
+	_bindingsMigrationDoneState = null;
+	get bindingsMigrationDoneState() {
+		if (!this._bindingsMigrationDoneState) this._bindingsMigrationDoneState = this.state("bindingsMigration_v1_done", boolean(), false);
+		return this._bindingsMigrationDoneState;
+	}
 	/**
 	* Per-camera zones CRUD provider. Constructed lazily in `onInitialize`
 	* because it captures `this.ctx` for settings + api access; cleared
@@ -24119,7 +25163,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	async onInitialize() {
 		this.initTimestamp = Date.now();
 		try {
-			const stored = await this.ctx.settings?.readAddonStore() ?? {};
+			const stored = await this.resolveGlobalStore();
 			this.globalSettings = { ...stored };
 			this.applyRuntimeSettings(this.globalSettings);
 		} catch (err) {
@@ -24331,7 +25375,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		this.pendingRetryTimer = setInterval(() => void this.retryPendingDispatches(), PENDING_RETRY_INTERVAL_MS);
 		this.ctx.logger.info("Pipeline orchestrator detection-wiring subscriptions installed");
 		this.migrateLegacyFlagsToBindings().catch((err) => {
-			this.ctx.logger.warn("bindings migration failed — will retry on next boot", { meta: { error: errMsg(err) } });
+			this.ctxIfReady?.logger.warn("bindings migration failed — will retry on next boot", { meta: { error: errMsg(err) } });
 		});
 		this.zoneRulesProvider = new ZoneRulesProvider({
 			logger: this.ctx.logger.child("zone-rules"),
@@ -24461,9 +25505,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 	* persist the flag after a successful pass.
 	*/
 	async migrateLegacyFlagsToBindings() {
-		const MIGRATION_KEY = "bindingsMigration_v1_done";
-		const store = await this.ctx.settings?.readAddonStore() ?? {};
-		if (store[MIGRATION_KEY] === true) return;
+		if (await this.bindingsMigrationDoneState.get()) return;
 		let api = this.api;
 		for (let i = 0; !api && i < 30; i++) {
 			await new Promise((r) => setTimeout(r, 200));
@@ -24519,10 +25561,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			});
 			detectionDisabled++;
 		}
-		await this.ctx.settings?.writeAddonStore({
-			...store,
-			[MIGRATION_KEY]: true
-		});
+		await this.bindingsMigrationDoneState.set(true);
 		this.ctx.logger.info("bindings migration complete", { meta: {
 			cameras: cameras.length,
 			audioDisabled,
@@ -24661,9 +25700,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				}
 			}
 		}
-		const pipelinePin = (await this.ctx.settings?.readDeviceStore(runnerConfig.deviceId) ?? {})["pipelineNodeId"];
-		const legacyPreferred = await this.readPreferredAgent(runnerConfig.deviceId);
-		const preferredAgent = typeof pipelinePin === "string" && pipelinePin !== "auto" ? pipelinePin : legacyPreferred;
+		const preferredAgent = await this.readPipelinePin(runnerConfig.deviceId);
 		const decision = balance({
 			nodes: await this.collectAgentLoad({ onlyEnabled: true }),
 			preferredAgent,
@@ -24735,7 +25772,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		if (!this.ctx) throw new Error("PipelineOrchestrator: assignPipeline called before initialize");
 		const eligible = this.detectionEligibleNodes(input.deviceId);
 		if (!eligible.includes(input.agentNodeId)) throw new Error(`Cannot pin camera ${input.deviceId} detection to '${input.agentNodeId}': the node cannot obtain this camera's decoded frames (frame-source nodes: ${eligible.join(", ") || "none"}). Add it to Enabled Decoder Nodes first.`);
-		await this.ctx.settings?.writeDeviceStore(input.deviceId, { [PREFERRED_AGENT_SETTING]: input.agentNodeId }).catch((err) => {
+		await this.ctx.settings?.writeDeviceStore(input.deviceId, {
+			pipelineNodeId: input.agentNodeId,
+			[PREFERRED_AGENT_SETTING]: null
+		}).catch((err) => {
 			const msg = errMsg(err);
 			this.ctx.logger.warn("assignPipeline: failed to persist pin", {
 				tags: { deviceId: input.deviceId },
@@ -24845,7 +25885,7 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		for (const [deviceId, config] of this.cameraConfigs) {
 			const current = this.assignments.get(deviceId);
 			if (current?.pinned) continue;
-			const preferredAgent = await this.readPreferredAgent(deviceId);
+			const preferredAgent = await this.readPipelinePin(deviceId);
 			const decision = balance({
 				nodes: talliedLoads(),
 				preferredAgent,
@@ -25235,11 +26275,22 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 			if (timer) clearTimeout(timer);
 		}
 	}
-	async readPreferredAgent(deviceId) {
+	/**
+	* Resolve the persisted pipeline-node pin for a device. `pipelineNodeId` is
+	* the canonical key (matching the sibling `decoderNodeId` / `audioNodeId`
+	* `'auto'`-sentinel pattern); the legacy `preferredAgent` key is a read-only
+	* fallback kept for backward compatibility with stores written before the
+	* unification. A single device-store read serves both. Returns a concrete
+	* node id, or `null` when neither key holds a pin (auto-balance).
+	*/
+	async readPipelinePin(deviceId) {
 		if (!this.ctx?.settings) return null;
 		try {
-			const value = (await this.ctx.settings.readDeviceStore(deviceId))[PREFERRED_AGENT_SETTING];
-			return typeof value === "string" && value.length > 0 ? value : null;
+			const settings = await this.ctx.settings.readDeviceStore(deviceId);
+			const pipelinePin = settings["pipelineNodeId"];
+			if (typeof pipelinePin === "string" && pipelinePin.length > 0 && pipelinePin !== "auto") return pipelinePin;
+			const legacy = settings[PREFERRED_AGENT_SETTING];
+			return typeof legacy === "string" && legacy.length > 0 ? legacy : null;
 		} catch {
 			return null;
 		}
@@ -25380,7 +26431,10 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 				} });
 				continue;
 			}
-			if (assignment.pinned && this.failoverPolicy.pinnedOnDisconnect === "unpin-and-migrate") await this.ctx.settings?.writeDeviceStore(deviceId, { [PREFERRED_AGENT_SETTING]: null }).catch(() => {});
+			if (assignment.pinned && this.failoverPolicy.pinnedOnDisconnect === "unpin-and-migrate") await this.ctx.settings?.writeDeviceStore(deviceId, {
+				[PREFERRED_AGENT_SETTING]: null,
+				pipelineNodeId: "auto"
+			}).catch(() => {});
 			affected.push({
 				deviceId,
 				config
@@ -27133,8 +28187,8 @@ var PipelineOrchestratorAddon = class PipelineOrchestratorAddon extends BaseAddo
 		] });
 	}
 	async updateGlobalSettings(patch) {
-		await this.ctx.settings.writeAddonStore(patch);
-		const full = await this.ctx.settings?.readAddonStore() ?? {};
+		await super.updateGlobalSettings(patch);
+		const full = await this.resolveGlobalStore();
 		this.globalSettings = { ...full };
 		this.applyRuntimeSettings(full);
 		const pausedIds = [...this.loadShedState.entries()].filter(([, s]) => s.pausedAt !== null).map(([id]) => id);