@camstack/addon-provider-onvif 1.1.13 → 1.1.15

package/dist/addon.mjs

@@ -4632,7 +4632,7 @@ function _instanceof(cls, params = {}) {
 	return inst;
 }
 //#endregion
-//#region ../types/dist/sleep-C2M2zF7x.mjs
+//#region ../types/dist/sleep-BiDFW0E7.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -5445,6 +5445,100 @@ function createDurableState(deps) {
 	};
 }
 /**
+* Per-node scoping for the shared addon-settings blob.
+*
+* An addon's settings store is hub-central (the `addon-settings` cap is
+* hub-routed — the hub instance answers for every node), so fields whose
+* value is a NODE fact (decoder backend, engine pick, probed hardware
+* capabilities) persist under the node-scoped key `<key>@<nodeId>` inside
+* the single shared blob. The SCHEMA field key stays bare: the write path
+* ({@link scopePatch}) maps the bare field onto the target node's scoped
+* key; the read/hydrate path ({@link projectStore}) maps THIS node's value
+* back, so UI forms and `resolveConfig` only ever see the bare key.
+*
+* Fields opt in via the `perNode: true` schema marker on `ConfigFieldBase`
+* (`interfaces/config-ui.ts`); `BaseAddon` derives the key set from the
+* schema and routes reads/writes through these helpers.
+*
+* ## No bare-key fallback — deliberate
+*
+* {@link readNodeValue} reads the node-scoped key ONLY. A node with no
+* scoped key resolves to `undefined` so the field's schema `default` wins —
+* NEVER `store[base]` and never another node's value. A bare legacy key in
+* the store is invisible to every node, hub included, so one node's
+* selection can never leak onto another. (This generalizes the
+* `decoder-backend-keys.ts` semantics — the no-fallback variant — over an
+* arbitrary set of per-node field keys.)
+*
+* Pure functions only — no I/O, no imports beyond the language. This is a
+* LEAF module: import it via its deep path, never from the root barrel.
+*/
+/**
+* Normalize a raw kernel node id to the bare node id used for scoping.
+* `localNodeId` can carry a `<node>/<addon>` suffix on forked child
+* processes; per-node settings are per-NODE, so strip the addon segment.
+* `undefined` / `null` / empty falls back to `'hub'`.
+*/
+function normalizeNodeId(raw) {
+	if (raw === void 0 || raw === null || raw === "") return "hub";
+	const slashIdx = raw.indexOf("/");
+	if (slashIdx < 0) return raw;
+	const bare = raw.slice(0, slashIdx);
+	return bare === "" ? "hub" : bare;
+}
+/** The node-scoped store key for a per-node field: `<base>@<nodeId>`. */
+function nodeScopedKey(base, nodeId) {
+	return `${base}@${normalizeNodeId(nodeId)}`;
+}
+/**
+* Read a node's value for a per-node field from the raw shared store:
+* the node-scoped key when present, otherwise `undefined`.
+* Deliberately NO bare-key fallback (see module doc) — the caller lets the
+* schema `default` win on `undefined`.
+*/
+function readNodeValue(store, base, nodeId) {
+	return store[nodeScopedKey(base, nodeId)];
+}
+/**
+* Re-map a UI/settings patch so every bare perNode field persists under the
+* TARGET node's scoped key; all other keys pass through unchanged. Used on
+* the write path so a save for one node never clobbers another node's value
+* (and the bare key is never written). Returns a new object — the input
+* patch is not mutated.
+*/
+function scopePatch(patch, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(patch)) out[perNodeKeys.has(key) ? nodeScopedKey(key, nodeId) : key] = value;
+	return out;
+}
+/**
+* Project the raw shared store onto the bare schema keys for ONE node so a
+* UI schema (whose field keys are bare) hydrates from that node's own
+* values:
+*
+* - EVERY `@`-scoped key (any node's) is dropped from the pass-through.
+* - Every bare perNode key is dropped from the pass-through (a stray bare
+*   legacy key must never hydrate any node — no bare fallback).
+* - THIS node's effective value ({@link readNodeValue}) is then laid onto
+*   each bare perNode key; when the node has no scoped key the bare key is
+*   left ABSENT so the field's schema `default` wins.
+*
+* Returns a new object — the input store is not mutated.
+*/
+function projectStore(store, perNodeKeys, nodeId) {
+	const out = {};
+	for (const [key, value] of Object.entries(store)) {
+		if (key.includes("@")) continue;
+		if (perNodeKeys.has(key)) continue;
+		out[key] = value;
+	}
+	for (const base of perNodeKeys) {
+		const value = readNodeValue(store, base, nodeId);
+		if (value !== void 0) out[base] = value;
+	}
+	return out;
+}
+/**
 * Base class for CamStack addons. Eliminates settings boilerplate:
 *
 * - Typed `config` property with automatic resolution from store + defaults
@@ -5612,23 +5706,63 @@ var BaseAddon = class {
 	deviceSettingsSchema() {
 		return null;
 	}
-	async getGlobalSettings(overlay, cap, _nodeId) {
+	async getGlobalSettings(overlay, cap, nodeId) {
 		const schema = this.globalSettingsSchema(cap);
 		if (!schema) return { sections: [] };
-		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		const projected = await this.resolveGlobalStore(nodeId, cap);
 		return hydrateSchema(schema, overlay ? {
-			...raw,
+			...projected,
 			...overlay
-		} : raw);
+		} : projected);
+	}
+	/**
+	* The raw addon store PROJECTED onto the target node's bare per-node keys:
+	* every `perNode: true` field carries THAT node's scoped value on its bare
+	* key (absent scoped key ⇒ key absent, so the schema `default` wins — no
+	* bare fallback), all `@`-scoped and stray bare per-node keys are dropped.
+	* A no-op passthrough when the schema declares no `perNode` field.
+	*
+	* This is the sanctioned way for a `getGlobalSettings` OVERRIDE that needs
+	* the store for custom option logic (option narrowing, value snapping) to
+	* read it per-node — never `ctx.settings.readAddonStore()` directly.
+	* `nodeId` omitted ⇒ the local node (node-blind injection from ctx).
+	*/
+	async resolveGlobalStore(nodeId, cap) {
+		const raw = await this._ctx?.settings?.readAddonStore() ?? {};
+		const keys = this.perNodeKeys(cap);
+		const node = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
+		return keys.size > 0 ? projectStore(raw, keys, node) : raw;
 	}
-	async updateGlobalSettings(patch, _nodeId) {
-		await this._ctx?.settings?.writeAddonStore(patch);
+	async updateGlobalSettings(patch, nodeId) {
+		const keys = this.perNodeKeys();
+		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
+		const target = normalizeNodeId(nodeId ?? this._ctx?.kernel?.localNodeId);
+		const barePatch = patch;
+		const scoped = keys.size > 0 ? scopePatch(barePatch, keys, target) : barePatch;
+		await this._ctx?.settings?.writeAddonStore(scoped);
+		if (target !== localNode) return;
 		await this.resolveConfig();
 		await this.onConfigChanged();
 		this.emitLifecycle(EventCategory.AddonUpdated, { level: "global" });
 		this.maybeAutoRestart(patch, this.globalSettingsSchema());
 	}
 	/**
+	* The set of field keys the global settings schema declares `perNode: true`
+	* — derived once per `cap` argument and memoized (schemas are static
+	* declarations). Empty set ⇒ every per-node code path is bypassed and the
+	* settings API behaves exactly like the legacy node-agnostic one.
+	*/
+	_perNodeKeysCache = /* @__PURE__ */ new Map();
+	perNodeKeys(cap) {
+		const cacheKey = cap ?? "";
+		const cached = this._perNodeKeysCache.get(cacheKey);
+		if (cached) return cached;
+		const schema = this.globalSettingsSchema(cap);
+		const keys = new Set(schema ? schema.sections.flatMap((section) => collectPerNodeFieldKeys(section.fields)) : []);
+		this._perNodeKeysCache.set(cacheKey, keys);
+		return keys;
+	}
+	/**
 	* If any field in `patch` is marked `requiresRestart` in `schema`,
 	* schedule an addon restart for the next tick. Deferred via
 	* `setImmediate` so the tRPC mutation that triggered the write has
@@ -5781,12 +5915,19 @@ var BaseAddon = class {
 	* The merge is shallow: each key in `defaults` is checked against the store.
 	* Only keys present in defaults are read — the store can contain extra keys
 	* (e.g. from older versions) without polluting the typed config.
+	*
+	* Keys the global settings schema declares `perNode: true` resolve from
+	* THIS node's scoped key (`<key>@<localNode>`) via `readNodeValue` — never
+	* from the bare key — so a per-node field resolves to this node's own
+	* selection at boot (absent scoped key ⇒ the constructor default wins).
 	*/
 	async resolveConfig() {
 		const stored = await this.readAddonStoreWithRetry();
+		const perNode = this.perNodeKeys();
+		const localNode = normalizeNodeId(this._ctx?.kernel?.localNodeId);
 		const resolved = { ...this.defaults };
 		for (const key of Object.keys(this.defaults)) {
-			const storedValue = stored[key];
+			const storedValue = perNode.has(key) ? readNodeValue(stored, key, localNode) : stored[key];
 			if (storedValue !== void 0 && storedValue !== null) {
 				const defaultType = typeof this.defaults[key];
 				if (typeof storedValue === defaultType) resolved[key] = storedValue;
@@ -5870,6 +6011,27 @@ var BaseAddon = class {
 	}
 };
 /**
+* Collect the keys of every field marked `perNode: true`, recursing into
+* layout containers (`group` fields and `sub-tabs` tabs) the same way
+* `hydrateSchema` does. Valueless structural fields (separator/info/…)
+* don't declare `perNode` and are excluded by the `in` narrowing.
+*/
+function collectPerNodeFieldKeys(fields) {
+	const collected = [];
+	for (const field of fields) {
+		if (field.type === "group") {
+			collected.push(...collectPerNodeFieldKeys(field.fields));
+			continue;
+		}
+		if (field.type === "sub-tabs") {
+			for (const tab of field.tabs) collected.push(...collectPerNodeFieldKeys(tab.fields));
+			continue;
+		}
+		if ("perNode" in field && field.perNode === true) collected.push(field.key);
+	}
+	return collected;
+}
+/**
 * Normalize an `ICamstackAddon.initialize()` return value into the
 * `AddonInitResult` envelope. Arrays are wrapped into `{ providers }`;
 * envelopes pass through; void stays void.
@@ -5894,6 +6056,7 @@ var CamStreamKindSchema = _enum([
 	"pull-rtsp",
 	"pull-rtmp",
 	"pull-http",
+	"pull-flv",
 	"pull-rfc4571",
 	"push-annexb",
 	"derived"
@@ -6276,6 +6439,13 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	/** Single still-image entity (HA `image.*`). Read-only display of an
 	*  `entity_picture` signed URL the browser loads directly. `image` cap. */
 	DeviceType["Image"] = "image";
+	/** Smart pet feeder — cloud-connected food dispenser with a bowl food
+	*  level, battery, desiccant life, feeding state and manual-feed /
+	*  call-pet / maintenance actions. Installed with the `pet-feeder` cap;
+	*  dual-hopper models (D4S/D4SH) expose per-hopper portions. Sources:
+	*  native PetKit (`nodepetkit` `FeederDevice`), reusable by other feeder
+	*  integrations sharing the same food/desiccant/hopper surface. */
+	DeviceType["PetFeeder"] = "pet-feeder";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -7436,6 +7606,601 @@ var _macroLookup = /* @__PURE__ */ new Map();
 for (const [k, v] of Object.entries(YAMNET_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 for (const [k, v] of Object.entries(APPLE_SA_TO_MACRO.mapping)) _macroLookup.set(k.toLowerCase(), v);
 /**
+* Error types for the safe expression engine. Two distinct classes so callers
+* can tell a compile-time (grammar) failure from a runtime (evaluation)
+* failure — both are non-fatal to the host: read paths degrade to "skip link".
+*/
+/** Thrown by the tokenizer / parser. Carries a 0-based source `position` when
+*  the failure is anchored to a character (author-facing inline feedback). */
+var ExpressionParseError = class extends Error {
+	position;
+	constructor(message, position) {
+		super(message);
+		this.name = "ExpressionParseError";
+		this.position = position;
+	}
+};
+/** Thrown by the evaluator (unknown identifier, type mismatch, non-finite
+*  result, unknown builtin, step-budget exceeded). */
+var ExpressionEvalError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ExpressionEvalError";
+	}
+};
+/**
+* Resource-bound constants for the safe expression engine.
+*
+* Every bound is defense-in-depth: the grammar is non-Turing-complete (no
+* loops, recursion, lambdas or member access — see `ast.ts`), so evaluation is
+* O(nodeCount) by construction. These caps merely put a hard ceiling on the
+* work a single author-supplied expression can request, so a hostile or
+* accidental pathological string can never spend unbounded CPU/memory.
+*/
+/** Max source length (chars) — checked BEFORE tokenizing so a huge string is
+*  rejected without allocation. */
+var MAX_EXPRESSION_SOURCE_LENGTH = 2048;
+/** A legal binding / identifier name. */
+var EXPRESSION_IDENTIFIER_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Binding names an author may NOT use: `now` is auto-injected; the literal
+*  keywords lex as values, not identifiers, so binding to them is meaningless. */
+var RESERVED_BINDING_NAMES = new Set([
+	"now",
+	"true",
+	"false",
+	"null"
+]);
+/**
+* Tokenizer for the safe expression mini-language. Hand-rolled, single-pass,
+* zero-dependency. The grammar is deliberately boring: decimal numbers,
+* single/double-quoted strings with a tiny escape set, identifiers, the three
+* value keywords (`true`/`false`/`null`) and a fixed punctuator set. Anything
+* outside that — a bare `.`, `=`, `[`, `]`, `{`, `}`, `;`, backtick, `&`, `|` —
+* is a parse error with a source position, so member access / assignment /
+* template literals are lexically impossible.
+*/
+var KEYWORDS = new Set([
+	"true",
+	"false",
+	"null"
+]);
+function isDigit(ch) {
+	return ch >= "0" && ch <= "9";
+}
+function isIdentStart(ch) {
+	return ch >= "A" && ch <= "Z" || ch >= "a" && ch <= "z" || ch === "_";
+}
+function isIdentPart(ch) {
+	return isIdentStart(ch) || isDigit(ch);
+}
+function isWhitespace(ch) {
+	return ch === " " || ch === "	" || ch === "\n" || ch === "\r" || ch === "\f" || ch === "\v";
+}
+/** Tokenize `source` into a flat token list ending with a single `eof` token.
+*  Throws `ExpressionParseError` on any illegal character or unterminated
+*  string. */
+function tokenize(source) {
+	if (source.length > 2048) throw new ExpressionParseError(`expression too long (${source.length} > ${MAX_EXPRESSION_SOURCE_LENGTH} chars)`, 0);
+	const tokens = [];
+	let i = 0;
+	const n = source.length;
+	while (i < n) {
+		const ch = source[i];
+		if (isWhitespace(ch)) {
+			i += 1;
+			continue;
+		}
+		if (isDigit(ch)) {
+			const start = i;
+			while (i < n && isDigit(source[i])) i += 1;
+			if (i < n && source[i] === ".") {
+				if (i + 1 >= n || !isDigit(source[i + 1])) throw new ExpressionParseError("malformed number: decimal point needs a digit", i);
+				i += 1;
+				while (i < n && isDigit(source[i])) i += 1;
+			}
+			const text = source.slice(start, i);
+			const value = Number(text);
+			if (!Number.isFinite(value)) throw new ExpressionParseError(`malformed number: '${text}'`, start);
+			tokens.push({
+				type: "number",
+				value,
+				pos: start
+			});
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			const start = i;
+			i += 1;
+			let out = "";
+			let closed = false;
+			while (i < n) {
+				const c = source[i];
+				if (c === "\\") {
+					const next = i + 1 < n ? source[i + 1] : "";
+					if (next === "\\" || next === "'" || next === "\"") {
+						out += next;
+						i += 2;
+						continue;
+					}
+					throw new ExpressionParseError(`invalid string escape: '\\${next}'`, i);
+				}
+				if (c === quote) {
+					closed = true;
+					i += 1;
+					break;
+				}
+				out += c;
+				i += 1;
+			}
+			if (!closed) throw new ExpressionParseError("unterminated string literal", start);
+			tokens.push({
+				type: "string",
+				value: out,
+				pos: start
+			});
+			continue;
+		}
+		if (isIdentStart(ch)) {
+			const start = i;
+			while (i < n && isIdentPart(source[i])) i += 1;
+			const text = source.slice(start, i);
+			if (KEYWORDS.has(text)) tokens.push({
+				type: "keyword",
+				keyword: keywordOf(text),
+				pos: start
+			});
+			else tokens.push({
+				type: "identifier",
+				name: text,
+				pos: start
+			});
+			continue;
+		}
+		const two = i + 1 < n ? source.slice(i, i + 2) : "";
+		if (two === "<=" || two === ">=" || two === "==" || two === "!=" || two === "&&" || two === "||") {
+			tokens.push({
+				type: "punct",
+				punct: two,
+				pos: i
+			});
+			i += 2;
+			continue;
+		}
+		if (isSinglePunct(ch)) {
+			tokens.push({
+				type: "punct",
+				punct: ch,
+				pos: i
+			});
+			i += 1;
+			continue;
+		}
+		throw new ExpressionParseError(`unexpected character '${ch}'`, i);
+	}
+	tokens.push({
+		type: "eof",
+		pos: n
+	});
+	return tokens;
+}
+function keywordOf(text) {
+	if (text === "true") return "true";
+	if (text === "false") return "false";
+	return "null";
+}
+function isSinglePunct(ch) {
+	return ch === "(" || ch === ")" || ch === "," || ch === "?" || ch === ":" || ch === "+" || ch === "-" || ch === "*" || ch === "/" || ch === "%" || ch === "!" || ch === "<" || ch === ">";
+}
+/**
+* Frozen, null-prototype builtin function table for the expression engine
+* (spec §4 rule 4). The table is the SOLE surface of callable functions: the
+* parser rejects any callee not in it, and the evaluator gates each call on an
+* own-property check against it.
+*
+* Because the object has a NULL prototype AND is `Object.freeze`d:
+*  - it cannot be polluted (no `__proto__` / `constructor` write reaches it);
+*  - a lookup for `toString` / `hasOwnProperty` / `constructor` finds NOTHING
+*    (there is no `Object.prototype` in the chain), so those names are not
+*    callable — they are simply "unknown function" at parse time.
+*
+* Every numeric argument is validated as a finite number and every numeric
+* RESULT is re-checked finite, so `/0`, `sqrt(-1)` (→ NaN) and overflow
+* (`pow(10,400)` → Infinity) all raise `ExpressionEvalError` and fail the link
+* closed rather than emitting a garbage value.
+*/
+function asFiniteNumber(value, name, index) {
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a finite number`);
+	return value;
+}
+function asString$1(value, name, index) {
+	if (typeof value !== "string") throw new ExpressionEvalError(`${name}: argument ${index + 1} must be a string`);
+	return value;
+}
+function finiteResult(value, name) {
+	if (!Number.isFinite(value)) throw new ExpressionEvalError(`${name}: produced a non-finite result`);
+	return value;
+}
+function allFiniteNumbers(args, name) {
+	return args.map((a, idx) => asFiniteNumber(a, name, idx));
+}
+var INF = Number.POSITIVE_INFINITY;
+var table = {
+	min: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.min(...allFiniteNumbers(args, "min")), "min")
+	},
+	max: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(Math.max(...allFiniteNumbers(args, "max")), "max")
+	},
+	abs: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.abs(asFiniteNumber(args[0], "abs", 0)), "abs")
+	},
+	floor: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.floor(asFiniteNumber(args[0], "floor", 0)), "floor")
+	},
+	ceil: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.ceil(asFiniteNumber(args[0], "ceil", 0)), "ceil")
+	},
+	sqrt: {
+		minArgs: 1,
+		maxArgs: 1,
+		apply: (args) => finiteResult(Math.sqrt(asFiniteNumber(args[0], "sqrt", 0)), "sqrt")
+	},
+	round: {
+		minArgs: 1,
+		maxArgs: 2,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "round", 0);
+			const digits = args.length > 1 ? Math.trunc(asFiniteNumber(args[1], "round", 1)) : 0;
+			if (digits < 0 || digits > 100) throw new ExpressionEvalError("round: digits must be between 0 and 100");
+			const factor = 10 ** digits;
+			return finiteResult(Math.round(x * factor) / factor, "round");
+		}
+	},
+	pow: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "pow", 0) ** asFiniteNumber(args[1], "pow", 1), "pow")
+	},
+	clamp: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args) => {
+			const x = asFiniteNumber(args[0], "clamp", 0);
+			const lo = asFiniteNumber(args[1], "clamp", 1);
+			const hi = asFiniteNumber(args[2], "clamp", 2);
+			if (lo > hi) throw new ExpressionEvalError("clamp: lower bound is greater than upper bound");
+			return finiteResult(Math.min(hi, Math.max(lo, x)), "clamp");
+		}
+	},
+	avg: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			const nums = allFiniteNumbers(args, "avg");
+			return finiteResult(nums.reduce((acc, v) => acc + v, 0) / nums.length, "avg");
+		}
+	},
+	sum: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => finiteResult(allFiniteNumbers(args, "sum").reduce((acc, v) => acc + v, 0), "sum")
+	},
+	coalesce: {
+		minArgs: 1,
+		maxArgs: INF,
+		apply: (args) => {
+			for (const a of args) if (a !== null) return a;
+			return null;
+		}
+	},
+	age: {
+		minArgs: 2,
+		maxArgs: 2,
+		apply: (args) => finiteResult(asFiniteNumber(args[0], "age", 0) - asFiniteNumber(args[1], "age", 1), "age")
+	},
+	convert: {
+		minArgs: 3,
+		maxArgs: 3,
+		apply: (args, hooks) => {
+			const x = asFiniteNumber(args[0], "convert", 0);
+			const from = asString$1(args[1], "convert", 1).trim();
+			const to = asString$1(args[2], "convert", 2).trim();
+			if (hooks.convert) {
+				const out = hooks.convert(x, from, to);
+				if (out === null) throw new ExpressionEvalError(`convert: cannot convert '${from}' to '${to}'`);
+				return finiteResult(out, "convert");
+			}
+			if (from === to) return x;
+			throw new ExpressionEvalError("convert: unit conversion table not installed");
+		}
+	}
+};
+Object.freeze(Object.assign(Object.create(null), table));
+/** The set of valid builtin names — used by the parser to reject unknown
+*  callees at parse time (immediate author feedback). */
+var EXPRESSION_BUILTIN_NAMES = new Set(Object.keys(table));
+/**
+* Pratt (precedence-climbing) parser for the safe expression mini-language.
+*
+* Precedence (low → high): ternary `?:` (right-assoc) → `||` → `&&` → equality
+* → relational → additive → multiplicative → unary `! -` → call / primary.
+* Calls are ONLY `IDENT '(' args? ')'` at primary position — the callee is a
+* string validated against the builtin table at parse time, so an unknown
+* function is rejected immediately (author feedback) and a persisted expression
+* that references a since-removed builtin degrades at read.
+*
+* A node counter caps total AST size (`MAX_EXPRESSION_AST_NODES`) and call
+* arity is capped (`MAX_EXPRESSION_CALL_ARGS`) — both raise `ExpressionParseError`.
+*/
+/** Binary/logical operator precedence (higher binds tighter). */
+var BINARY_PRECEDENCE = {
+	"||": 1,
+	"&&": 2,
+	"==": 3,
+	"!=": 3,
+	"<": 4,
+	"<=": 4,
+	">": 4,
+	">=": 4,
+	"+": 5,
+	"-": 5,
+	"*": 6,
+	"/": 6,
+	"%": 6
+};
+function isLogicalOp(op) {
+	return op === "&&" || op === "||";
+}
+function isBinaryOp(op) {
+	return op === "+" || op === "-" || op === "*" || op === "/" || op === "%" || op === "==" || op === "!=" || op === "<" || op === "<=" || op === ">" || op === ">=";
+}
+var Parser = class {
+	tokens;
+	pos = 0;
+	nodeCount = 0;
+	identifiers = /* @__PURE__ */ new Set();
+	callees = /* @__PURE__ */ new Set();
+	constructor(tokens) {
+		this.tokens = tokens;
+	}
+	parse() {
+		const ast = this.parseTernary();
+		const tok = this.peek();
+		if (tok.type !== "eof") throw new ExpressionParseError("unexpected trailing input", tok.pos);
+		return {
+			ast,
+			identifiers: this.identifiers,
+			callees: this.callees,
+			nodeCount: this.nodeCount
+		};
+	}
+	peek() {
+		return this.tokens[this.pos];
+	}
+	next() {
+		return this.tokens[this.pos++];
+	}
+	/** Consume a punctuator token, erroring if the next token isn't it. */
+	expectPunct(punct) {
+		const tok = this.peek();
+		if (tok.type !== "punct" || tok.punct !== punct) throw new ExpressionParseError(`expected '${punct}'`, tok.pos);
+		this.pos += 1;
+	}
+	matchPunct(punct) {
+		const tok = this.peek();
+		if (tok.type === "punct" && tok.punct === punct) {
+			this.pos += 1;
+			return true;
+		}
+		return false;
+	}
+	countNode() {
+		this.nodeCount += 1;
+		if (this.nodeCount > 256) throw new ExpressionParseError("expression too complex", this.peek().pos);
+	}
+	parseTernary() {
+		const test = this.parseBinary(1);
+		if (this.matchPunct("?")) {
+			const consequent = this.parseTernary();
+			this.expectPunct(":");
+			const alternate = this.parseTernary();
+			this.countNode();
+			return {
+				kind: "conditional",
+				test,
+				consequent,
+				alternate
+			};
+		}
+		return test;
+	}
+	parseBinary(minPrec) {
+		let left = this.parseUnary();
+		for (;;) {
+			const tok = this.peek();
+			if (tok.type !== "punct") break;
+			const prec = BINARY_PRECEDENCE[tok.punct];
+			if (prec === void 0 || prec < minPrec) break;
+			const op = tok.punct;
+			this.pos += 1;
+			const right = this.parseBinary(prec + 1);
+			this.countNode();
+			if (isLogicalOp(op)) left = {
+				kind: "logical",
+				op,
+				left,
+				right
+			};
+			else if (isBinaryOp(op)) left = {
+				kind: "binary",
+				op,
+				left,
+				right
+			};
+			else throw new ExpressionParseError(`unexpected operator '${op}'`, tok.pos);
+		}
+		return left;
+	}
+	parseUnary() {
+		const tok = this.peek();
+		if (tok.type === "punct" && (tok.punct === "!" || tok.punct === "-")) {
+			const op = tok.punct;
+			this.pos += 1;
+			const operand = this.parseUnary();
+			this.countNode();
+			return {
+				kind: "unary",
+				op,
+				operand
+			};
+		}
+		return this.parsePrimary();
+	}
+	parsePrimary() {
+		const tok = this.next();
+		switch (tok.type) {
+			case "number":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "string":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.value
+				};
+			case "keyword":
+				this.countNode();
+				return {
+					kind: "literal",
+					value: tok.keyword === "null" ? null : tok.keyword === "true"
+				};
+			case "identifier": {
+				const nextTok = this.peek();
+				if (nextTok.type === "punct" && nextTok.punct === "(") return this.parseCall(tok.name, tok.pos);
+				this.identifiers.add(tok.name);
+				this.countNode();
+				return {
+					kind: "identifier",
+					name: tok.name
+				};
+			}
+			case "punct":
+				if (tok.punct === "(") {
+					const inner = this.parseTernary();
+					this.expectPunct(")");
+					return inner;
+				}
+				throw new ExpressionParseError(`unexpected token '${tok.punct}'`, tok.pos);
+			case "eof": throw new ExpressionParseError("unexpected end of expression", tok.pos);
+		}
+	}
+	parseCall(callee, pos) {
+		if (!EXPRESSION_BUILTIN_NAMES.has(callee)) throw new ExpressionParseError(`unknown function '${callee}'`, pos);
+		this.expectPunct("(");
+		const args = [];
+		if (!this.matchPunct(")")) for (;;) {
+			args.push(this.parseTernary());
+			if (args.length > 16) throw new ExpressionParseError(`too many arguments to '${callee}'`, pos);
+			if (this.matchPunct(",")) continue;
+			this.expectPunct(")");
+			break;
+		}
+		this.callees.add(callee);
+		this.countNode();
+		return {
+			kind: "call",
+			callee,
+			args
+		};
+	}
+};
+/** Tokenize + parse `source` into a validated `ParsedExpression`. Throws
+*  `ExpressionParseError` on any lexical or grammatical failure. */
+function parseExpression(source) {
+	return new Parser(tokenize(source)).parse();
+}
+Object.freeze({});
+/**
+* LRU compile cache for parsed expressions (spec §2.4 "parse once … LRU keyed
+* by expr"). The cache stores BOTH successes and failures (negative caching),
+* so a corrupt persisted string costs exactly one tokenize+parse total — not
+* one per read on a hot resolve path.
+*
+* The cache is a module-level singleton: entries are pure, content-addressed
+* ASTs keyed by the raw source string, so sharing one instance across all
+* callers is safe and maximises hit rate.
+*/
+var cache = /* @__PURE__ */ new Map();
+function getCached(source) {
+	const hit = cache.get(source);
+	if (hit !== void 0) {
+		cache.delete(source);
+		cache.set(source, hit);
+		return hit;
+	}
+	let result;
+	try {
+		result = {
+			ok: true,
+			parsed: parseExpression(source)
+		};
+	} catch (err) {
+		result = {
+			ok: false,
+			error: err instanceof ExpressionParseError ? err.message : String(err)
+		};
+	}
+	cache.set(source, result);
+	if (cache.size > 256) {
+		const oldest = cache.keys().next().value;
+		if (oldest !== void 0) cache.delete(oldest);
+	}
+	return result;
+}
+/** Compile `source`, returning a discriminated result instead of throwing.
+*  Used by read paths that must degrade rather than raise. LRU/negative-cached. */
+function compileExpressionSafe(source) {
+	return getCached(source);
+}
+/**
+* Author-time validation. Returns `null` when the source is valid, else a
+* human-readable error message. Checks: the expression compiles; binding count
+* is within `MAX_EXPRESSION_BINDINGS`; every binding name is a legal identifier,
+* is not reserved (`now`/keywords) and does not shadow a builtin; and every
+* FREE identifier of the AST is covered by a binding or the injected `now`.
+*/
+function validateExpressionSource(src) {
+	const names = Object.keys(src.bindings);
+	if (names.length > 32) return `too many bindings (${names.length} > 32)`;
+	for (const name of names) {
+		if (!EXPRESSION_IDENTIFIER_RE.test(name)) return `invalid binding name '${name}'`;
+		if (RESERVED_BINDING_NAMES.has(name)) return `binding name '${name}' is reserved`;
+		if (EXPRESSION_BUILTIN_NAMES.has(name)) return `binding name '${name}' shadows a builtin function`;
+	}
+	const compiled = compileExpressionSafe(src.expr);
+	if (!compiled.ok) return compiled.error;
+	const bound = new Set(names);
+	for (const id of compiled.parsed.identifiers) {
+		if (id === "now") continue;
+		if (!bound.has(id)) return `expression references unbound identifier '${id}'`;
+	}
+	return null;
+}
+/**
 * Accessory device helpers — shared across drivers.
 *
 * Many vendor-specific drivers register accessory child devices on
@@ -9442,7 +10207,8 @@ var MotionAnalysisResultSchema = object({
 });
 method(object({
 	deviceId: number(),
-	frame: FrameInputSchema
+	frame: FrameInputSchema.optional(),
+	frameHandle: FrameHandleSchema.optional()
 }), MotionAnalysisResultSchema, { kind: "mutation" }), method(object({ deviceId: number() }), _void(), { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), object({
 	deviceId: number(),
 	detected: boolean(),
@@ -9689,6 +10455,12 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	engine: PipelineEngineChoiceSchema.optional(),
 	steps: array(PipelineStepInputSchema).min(1),
 	frame: FrameInputSchema.optional(),
+	/**
+	* CB5 shm passthrough — a `FrameHandle` naming the same ring slot
+	* the decoded pixels live in. One more member of the one-of
+	* frame/frameHandle/image/imageBase64/referenceImage group.
+	*/
+	frameHandle: FrameHandleSchema.optional(),
 	imageBase64: string().optional(),
 	/**
 	* Binary JPEG bytes — preferred over `imageBase64` on internal
@@ -9898,6 +10670,31 @@ var ReportMotionInputSchema = object({
 	regions: array(MotionRegionSchema).readonly().optional()
 });
 /**
+* Where a runner gets a camera's decoded frames (cross-node Phase 2,
+* restream-owner model — P2c).
+*
+* - `local-broker` (DEFAULT): today's path — subscribe to the co-located
+*   stream-broker's shm frame plane. Every pre-P2c attach payload (no
+*   `frameSource` key) parses to this, so the field is additive with zero
+*   behavior change.
+* - `remote-restream`: the detect node is NOT the camera's source-owner.
+*   The runner acquires the owner's COMPRESSED passthrough restream
+*   (`streamBroker.getStreamWithCodec({video:'copy'})` — refcounted, the
+*   double-pull guard) and decodes LOCALLY via a satellite frame plane +
+*   pull-mode decoder session pinned to its own node. The shm ring stays
+*   node-local; only H.264/H.265 packets cross the wire.
+*   `hubHostnameOverride` mirrors the recorder's `recordingHubHostname`:
+*   when set it overrides the `CAMSTACK_HUB_URL`-derived host the runner
+*   dials for the owner's restream.
+*/
+var RunnerFrameSourceSchema = discriminatedUnion("kind", [object({ kind: literal("local-broker") }), object({
+	kind: literal("remote-restream"),
+	/** The camera's source-owner node (slice 1: always the hub). */
+	ownerNodeId: string(),
+	/** Operator override for the owner host the runner dials. */
+	hubHostnameOverride: string().optional()
+})]).describe("Per-camera frame-source mode for the runner (P2c)");
+/**
 * Camera assignment payload sent by `addon-pipeline-orchestrator` to a
 * specific runner instance via `attachCamera`. Carries everything the
 * runner needs to subscribe to the local broker and execute inference.
@@ -9995,7 +10792,15 @@ var RunnerCameraConfigSchema = object({
 	*/
 	onboardMotionDrivesAnalyzer: boolean().default(true),
 	occupancyRecheckSec: number().min(occupancyRecheckSecField.min).max(occupancyRecheckSecField.max).default(occupancyRecheckSecField.default),
-	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default)
+	occupancyRecheckFrames: number().min(occupancyRecheckFramesField.min).max(occupancyRecheckFramesField.max).default(occupancyRecheckFramesField.default),
+	/**
+	* Where this runner gets the camera's decoded frames (P2c). Defaulted so
+	* every existing payload behaves as `local-broker` — the pre-Phase-2 path.
+	* Populated with `remote-restream` by the orchestrator ONLY when the
+	* camera's detect node differs from its source-owner (P2d, gated by the
+	* `remoteSourcingNodes` rollout setting).
+	*/
+	frameSource: RunnerFrameSourceSchema.default({ kind: "local-broker" })
 });
 motionFpsField.min, motionFpsField.max, motionFpsField.step, motionFpsField.default, detectionFpsField.min, detectionFpsField.max, detectionFpsField.step, detectionFpsField.default, motionCooldownMsField.min, motionCooldownMsField.max, motionCooldownMsField.step, motionCooldownMsField.default, occupancyRecheckSecField.min, occupancyRecheckSecField.max, occupancyRecheckSecField.step, occupancyRecheckSecField.default, occupancyRecheckFramesField.min, occupancyRecheckFramesField.max, occupancyRecheckFramesField.step, occupancyRecheckFramesField.default;
 /**
@@ -10360,6 +11165,113 @@ object({
 	lastFetchedAt: number()
 });
 DeviceType.Sensor;
+/**
+* Feeder connectivity / power status — mirrors the HA petkit device-status
+* enum: `normal` (online, mains), `offline` (not reaching PetKit cloud),
+* `on_batteries` (running on battery backup). `null` until first reported.
+*/
+var PetFeederDeviceStatusSchema = _enum([
+	"normal",
+	"offline",
+	"on_batteries"
+]);
+var gramsPortion = number().int().min(4).max(200);
+object({
+	/** Food currently in the bowl (grams). Null when the device has not
+	*  reported a reading yet. On dual-hopper models this is the combined
+	*  bowl reading; per-hopper levels live in `food1`/`food2`. */
+	foodLevel: number().nullable(),
+	/** Hopper-1 food level (grams) on dual-hopper feeders; null on
+	*  single-hopper models. */
+	food1: number().nullable(),
+	/** Hopper-2 food level (grams) on dual-hopper feeders; null on
+	*  single-hopper models. */
+	food2: number().nullable(),
+	/** Derived low-food flag — mirrors the HA `food_level` binary_sensor
+	*  (`device_class: problem`, on = low). True when the bowl is empty /
+	*  below the feeder's low threshold. */
+	lowFood: boolean(),
+	/** Battery charge 0..100 (%). Null on mains-powered models or when the
+	*  device has no battery reading. */
+	batteryPower: number().min(0).max(100).nullable(),
+	/** Days of desiccant life remaining. Null when the model has no
+	*  desiccant sensor. */
+	desiccantLeftDays: number().nullable(),
+	/** True while a feed is in progress. */
+	feeding: boolean(),
+	/** Decoded connectivity / power status (HA petkit device-status enum).
+	*  Null until the device has reported a status. */
+	status: PetFeederDeviceStatusSchema.nullable(),
+	/** Decoded human-readable fault message. Null (or the device's `no_error`
+	*  sentinel) means healthy; a non-null string is an active fault. Pairs
+	*  with `errorCode` for consumers that want the raw integer. */
+	error: string().nullable(),
+	/** Raw device error code (0 / null = no error). */
+	errorCode: number().nullable(),
+	/** True for D4S/D4SH dual-hopper hardware — gates the per-hopper UI. */
+	isDualHopper: boolean(),
+	/** Child-lock (manual-lock) setting — buttons on the unit are disabled. */
+	childLock: boolean(),
+	/** Front indicator-light setting. */
+	indicatorLight: boolean(),
+	/** Play a chime when dispensing. */
+	feedSound: boolean(),
+	/** Speaker / prompt volume level (device-scaled integer). */
+	volume: number(),
+	/** Ms epoch when the slice was last refreshed from the cloud. */
+	lastFetchedAt: number()
+});
+DeviceType.PetFeeder, method(object({
+	deviceId: number().int().nonnegative(),
+	grams: gramsPortion.optional(),
+	hopper1: gramsPortion.optional(),
+	hopper2: gramsPortion.optional()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	soundId: number().int().nonnegative()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	on: boolean()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number().int().nonnegative(),
+	level: number().int().nonnegative()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+});
 object({
 	/** Instantaneous power draw in watts. */
 	watts: number().optional(),
@@ -12481,10 +13393,12 @@ method(object({ codec: string() }), boolean()), method(_void(), object({
 	url: string()
 }), _void()), method(object({
 	sessionId: string(),
-	maxCount: number().default(1)
+	maxCount: number().default(1),
+	waitMs: number().optional()
 }), array(DecodedFrameSchema)), method(object({
 	sessionId: string(),
-	maxCount: number().default(1)
+	maxCount: number().default(1),
+	waitMs: number().optional()
 }), array(FrameHandleSchema)), method(object({ handle: FrameHandleSchema }), DecodedFrameSchema.nullable()), method(object({ sessionId: string() }), ShmRingStatsSchema.nullable()), method(object({
 	sessionId: string(),
 	config: DecoderSessionConfigSchema.partial()
@@ -12771,14 +13685,63 @@ var ChildLayoutEntrySchema = object({
 	collapsed: boolean().optional()
 });
 /** Cap-wire shape of a DeviceLink — structurally mirrors `DeviceLink` in
-*  `device-management.ts`. */
+*  `device-management.ts`. Source is a union: a FIELD source copies a sibling
+*  accessory's status field (`kind` optional/absent for wire compat); a
+*  LITERAL source carries a per-device constant (no sibling is read); a
+*  GLOBAL source (P2e) copies ANY device's status field, addressed by the
+*  source device's full re-sync-stable `stableId`. */
+var DeviceLinkFieldSourceSchema = object({
+	kind: literal("field").optional(),
+	sourceKey: string(),
+	cap: string(),
+	fieldPath: string()
+});
+var DeviceLinkLiteralSourceSchema = object({
+	kind: literal("literal"),
+	value: union([
+		string(),
+		number(),
+		boolean(),
+		_null()
+	])
+});
+var DeviceLinkGlobalSourceSchema = object({
+	kind: literal("global"),
+	sourceStableId: string(),
+	cap: string(),
+	fieldPath: string()
+});
+/** Expression source (Stage X): compute the target field from N named bindings
+*  via the safe expression engine. Bindings are field | literal | global — never
+*  another expression (no nesting). The `superRefine` runs the SAME author-time
+*  validation as `validateExpressionSource` (compiles the expr, checks binding
+*  names + identifier coverage) so every wire boundary that parses a DeviceLink
+*  (tRPC mount, kernel create pre-seed, projection output) validates-at-write.
+*  Compiles are LRU-cached, so repeated validation of the same expr is a hit. */
+var DeviceLinkExpressionSourceSchema = object({
+	kind: literal("expression"),
+	expr: string().min(1).max(MAX_EXPRESSION_SOURCE_LENGTH),
+	bindings: record(string().regex(EXPRESSION_IDENTIFIER_RE), union([
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema
+	]))
+}).superRefine((src, ctx) => {
+	const err = validateExpressionSource(src);
+	if (err !== null) ctx.addIssue({
+		code: "custom",
+		message: err,
+		path: ["expr"]
+	});
+});
 var DeviceLinkSchema = object({
 	id: string(),
-	source: object({
-		sourceKey: string(),
-		cap: string(),
-		fieldPath: string()
-	}),
+	source: union([
+		DeviceLinkFieldSourceSchema,
+		DeviceLinkLiteralSourceSchema,
+		DeviceLinkGlobalSourceSchema,
+		DeviceLinkExpressionSourceSchema
+	]),
 	target: object({
 		cap: string(),
 		fieldPath: string(),
@@ -12807,6 +13770,31 @@ var DeviceLinkSchema = object({
 		})
 	]).optional()
 });
+/** Cap-wire shape of a per-cap display refinement — mirrors
+*  `DeviceCapDisplayOverride` in `device-management.ts`. */
+var DeviceCapDisplayOverrideSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional()
+});
+/** Cap-wire shape of an operator-authored per-device display override —
+*  mirrors `DeviceDisplayOverride` in `device-management.ts`. `precision`
+*  bounds mirror `numeric-sensor.cap.ts` (`int 0-10`). */
+var DeviceDisplayOverrideSchema = object({
+	icon: string().min(1).optional(),
+	label: string().min(1).optional(),
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	hidden: boolean().optional(),
+	perCap: record(string(), DeviceCapDisplayOverrideSchema).optional()
+});
+/** Cap-wire shape of a per-role display default — mirrors `RoleDisplayDefault`
+*  in `device-management.ts`. Keyed by `DeviceRole` string (role strings cross
+*  the wire as plain strings everywhere else — cf. `DeviceInfoSchema.role`). */
+var RoleDisplayDefaultSchema = object({
+	unit: string().min(1).optional(),
+	precision: number().int().min(0).max(10).optional(),
+	icon: string().min(1).optional()
+});
 /**
 * Serializable projection of a live IDevice.
 * Returned by listAll, getDevice, getChildren.
@@ -12862,7 +13850,9 @@ var DeviceInfoSchema = object({
 	*  `DeviceMeta.childLayout`. Absent ⇒ no layout declared. */
 	childLayout: array(ChildLayoutEntrySchema).readonly().optional(),
 	/** Operator-authored cross-device field wirings. See `DeviceMeta.deviceLinks`. */
-	deviceLinks: array(DeviceLinkSchema).readonly().optional()
+	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 var ConfigEntrySchema = object({
 	key: string(),
@@ -12927,7 +13917,9 @@ var DeviceMetaSchema = object({
 	deviceLinks: array(DeviceLinkSchema).readonly().optional(),
 	/** Semantic role string (`DeviceRole`) — propagated from the spawn pre-seed.
 	*  Optional: only present for accessory children that carry a known role. */
-	role: string().nullable().optional()
+	role: string().nullable().optional(),
+	/** Operator-authored per-device display override. See `DeviceMeta.display`. */
+	display: DeviceDisplayOverrideSchema.optional()
 });
 /** ConfigUISchema passed through as unknown — mirrors device-provider's CreationSchemaOutputSchema */
 var ConfigUISchemaOutput = unknown().nullable();
@@ -13021,7 +14013,19 @@ method(object({
 }), _void(), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({ deviceId: number() }), object({ caps: array(object({
+}), method(object({
+	deviceId: number(),
+	display: DeviceDisplayOverrideSchema.nullable()
+}), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({}), object({ defaults: record(string(), RoleDisplayDefaultSchema) }), { kind: "query" }), method(object({ defaults: record(string(), RoleDisplayDefaultSchema) }), _void(), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	includeSynthesizable: boolean().optional()
+}), object({ caps: array(object({
 	cap: string(),
 	fields: array(object({
 		path: string(),
@@ -13031,8 +14035,13 @@ method(object({
 			"boolean",
 			"enum"
 		]),
-		enumValues: array(string()).optional()
-	})).readonly()
+		enumValues: array(string()).optional(),
+		item: boolean().optional()
+	})).readonly(),
+	itemArray: object({
+		path: string(),
+		keyField: string()
+	}).optional()
 })).readonly() }), { kind: "query" }), method(object({
 	deviceId: number(),
 	role: string().nullable()
@@ -13102,7 +14111,11 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum(["native", "wrapped"]),
+		kind: _enum([
+			"native",
+			"wrapped",
+			"linked"
+		]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13111,7 +14124,11 @@ method(object({
 	deviceId: number(),
 	entries: array(object({
 		capName: string(),
-		kind: _enum(["native", "wrapped"]),
+		kind: _enum([
+			"native",
+			"wrapped",
+			"linked"
+		]),
 		providerAddonId: string(),
 		providerNodeId: string(),
 		nativeAddonId: string()
@@ -13601,7 +14618,7 @@ var AddBrokerInputSchema = object({
 });
 var AddBrokerResultSchema = object({ id: string() });
 var IdInputSchema = object({ id: string() });
-var TestResultSchema = discriminatedUnion("ok", [object({
+var TestResultSchema$1 = discriminatedUnion("ok", [object({
 	ok: literal(true),
 	latencyMs: number()
 }), object({
@@ -13624,7 +14641,7 @@ var StatusSchema = object({
 	brokerCount: number(),
 	embeddedRunning: boolean()
 });
-method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
+method(_void(), array(BrokerInfoSchema)), method(IdInputSchema, BrokerConnectionDetailsSchema), method(AddBrokerInputSchema, AddBrokerResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(IdInputSchema, TestResultSchema$1, { kind: "mutation" }), method(StartEmbeddedInputSchema, StartEmbeddedResultSchema, { kind: "mutation" }), method(IdInputSchema, _void(), { kind: "mutation" }), method(_void(), StatusSchema);
 var NetworkEndpointSchema = object({
 	url: string(),
 	hostname: string(),
@@ -13658,23 +14675,198 @@ var NetworkEndpointEntrySchema = NetworkEndpointSchema.extend({
 	sourcePort: number().optional()
 });
 method(_void(), NetworkEndpointSchema, { kind: "mutation" }), method(_void(), _void(), { kind: "mutation" }), method(_void(), NetworkEndpointSchema.nullable()), method(_void(), NetworkAccessStatusSchema), method(_void(), array(NetworkEndpointEntrySchema).readonly());
-method(object({
-	title: string(),
+/**
+* notification-output — canonical, capability-gated notification delivery.
+*
+* Apprise-derived model (see
+* `docs/superpowers/specs/2026-07-03-notification-output-notifier-matrix.md`):
+* callers emit ONE canonical `Notification`; each provider declares a
+* per-kind capability descriptor (`TargetKind`), and the pure degrade
+* engine (`@camstack/types` `prepareNotification`) transcodes / degrades the
+* message to what the kind supports — callers never special-case a service.
+*
+* DESIGN DECISIONS (locked):
+*  - Target CRUD lives on THIS cap (`upsertTarget` / `deleteTarget` /
+*    `setTargetEnabled`), each provider persisting via the `settings-store`
+*    cap. Rationale: the admin UI needs one uniform surface across the
+*    notifiers addon AND the HA addon; the addon-`globalSettingsSchema`-array
+*    alternative would fork the UI per addon and cannot host the
+*    discovery→adopt flow.
+*  - `listTargetKinds` / `listTargets` / `discoverTargets` return arrays →
+*    the generated cap-mount auto-`concatCollection`-fans them across every
+*    registered provider (notifiers addon + HA addon) so one catalog is
+*    routable. `send` / `testTarget` / CRUD route to ONE provider by the
+*    `addonId` the generated collection router extracts from the call input.
+*  - `Attachment.bytes` is `Uint8Array`. Transport-safe: superjson (the tRPC
+*    transformer) + UDS MsgPack both round-trip typed arrays — already used by
+*    `storage` / `storage-provider` / `recording` caps over the same path. No
+*    base64 fallback needed.
+*
+* TODO (deferred, closed-set change — separate decision): add
+* `providerKind: 'notify'` so notification providers surface on the unified
+* admin "Integrations" page.
+*/
+/**
+* Zentik-derived typed-media enum — the superset across every kind. Each
+* adapter picks what it supports and the degrade engine filters the rest.
+*/
+var AttachmentMediaTypeSchema = _enum([
+	"image",
+	"video",
+	"gif",
+	"audio",
+	"icon"
+]);
+/**
+* A single attachment. Exactly one of `url` (remote source, most adapters
+* prefer this) or `bytes` (inline source; required for Pushover-style
+* bytes-only kinds) MUST be present — the degrade engine expresses a
+* url→bytes fetch as a `needsFetch` directive the adapter executes.
+*/
+var AttachmentSchema = object({
+	mediaType: AttachmentMediaTypeSchema,
+	url: string().optional(),
+	bytes: _instanceof(Uint8Array).optional(),
+	mime: string().optional(),
+	name: string().optional()
+}).refine((a) => a.url !== void 0 || a.bytes !== void 0, { message: "Attachment requires either `url` or `bytes`" });
+var NotificationFormatSchema = _enum([
+	"text",
+	"markdown",
+	"html"
+]);
+/** A single tap-through action button. */
+var NotificationActionSchema = object({
+	id: string(),
+	label: string(),
+	url: string().optional()
+});
+/**
+* The canonical notification. `body` is the only hard field (Apprise model).
+* `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
+* NOT a fixed severity enum — each kind declares its own `caps.levels` and
+* the adapter maps this ordinal onto its native level. `level?` is an
+* optional kind-native level id (`emergency`, `silent`, …) that overrides
+* `priority` for that one target.
+*/
+var NotificationSchema = object({
 	body: string(),
-	imageUrl: string().optional(),
+	title: string().optional(),
+	format: NotificationFormatSchema.default("text"),
+	priority: number().int().min(1).max(5).default(3),
+	level: string().optional(),
+	attachments: array(AttachmentSchema).optional(),
+	clickUrl: string().optional(),
+	actions: array(NotificationActionSchema).optional(),
+	sound: string().optional(),
+	ttl: number().optional(),
+	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	priority: _enum([
-		"low",
-		"normal",
-		"high",
-		"critical"
-	]).default("normal"),
 	metadata: record(string(), unknown()).optional()
-}), _void(), { kind: "mutation" }), method(_void(), object({
+});
+/** One declared native severity/priority level for a kind. */
+var TargetKindLevelSchema = object({
+	id: string(),
+	label: string(),
+	/** Which canonical priority (1..5) this level maps to. `null` = qualitative-only. */
+	ordinal: number().int().min(1).max(5).nullable(),
+	flags: object({
+		critical: boolean().optional(),
+		silent: boolean().optional(),
+		noPush: boolean().optional()
+	}).optional(),
+	/** e.g. Pushover `emergency` requires `retry` / `expire`. */
+	requires: array(string()).optional(),
+	description: string().optional()
+});
+/** The full capability block consulted before dispatch. */
+var TargetKindCapsSchema = object({
+	attachments: object({
+		mediaTypes: array(AttachmentMediaTypeSchema),
+		mode: _enum([
+			"url",
+			"bytes",
+			"both"
+		]),
+		max: number().int().nonnegative(),
+		maxBytes: number().int().positive().optional()
+	}),
+	/** Max action buttons (0 = none). */
+	actions: number().int().nonnegative(),
+	levels: array(TargetKindLevelSchema),
+	format: array(NotificationFormatSchema),
+	clickUrl: boolean(),
+	sound: boolean(),
+	ttl: boolean(),
+	bodyMaxLen: number().int().positive()
+});
+/**
+* `configSchema` is a `ConfigUISchema` tree passed through to the admin
+* FormBuilder. Stored as `z.unknown()` at the cap seam (mirrors
+* `device-provider.getChildCreationSchema` `CreationSchemaOutputSchema`) —
+* the union is large and not meant for runtime validation here; the exported
+* `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
+*/
+var ConfigSchemaPassthrough = unknown();
+var TargetKindSchema = object({
+	kind: string(),
+	label: string(),
+	icon: string(),
+	/** Stamped by each provider so the concat-fanned catalog stays routable. */
+	addonId: string(),
+	configSchema: ConfigSchemaPassthrough,
+	supportsDiscovery: boolean(),
+	caps: TargetKindCapsSchema
+});
+/**
+* A persisted target. `config` holds secrets; providers REDACT secret fields
+* (return a presence marker only) when serving `listTargets` — never
+* round-trip a stored secret to the UI.
+*/
+var TargetSchema = object({
+	id: string(),
+	name: string(),
+	kind: string(),
+	addonId: string(),
+	enabled: boolean(),
+	config: record(string(), unknown())
+});
+/** A discovery-surfaced candidate (config is partial + non-secret). */
+var DiscoveredTargetSchema = object({
+	kind: string(),
+	suggestedName: string(),
+	config: record(string(), unknown())
+});
+/** The degrade engine's report — what was resolved / dropped / degraded. */
+var RenderedAsSchema = object({
+	level: string(),
+	format: NotificationFormatSchema,
+	attachmentsSent: number().int().nonnegative(),
+	actionsSent: number().int().nonnegative(),
+	truncated: boolean(),
+	dropped: array(string())
+});
+var SendResultSchema = object({
 	success: boolean(),
-	error: string().optional()
-}), { kind: "mutation" });
+	error: string().optional(),
+	renderedAs: RenderedAsSchema.optional()
+});
+/** Same shape as SendResult — kept as a distinct name for the test panel. */
+var TestResultSchema = SendResultSchema;
+method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema)), method(object({
+	kind: string(),
+	config: record(string(), unknown()).optional()
+}), array(DiscoveredTargetSchema)), method(object({
+	targetId: string(),
+	notification: NotificationSchema
+}), SendResultSchema, { kind: "mutation" }), method(object({
+	targetId: string(),
+	sample: NotificationSchema.optional()
+}), TestResultSchema, { kind: "mutation" }), method(object({ target: TargetSchema }), TargetSchema, { kind: "mutation" }), method(object({ targetId: string() }), _void(), { kind: "mutation" }), method(object({
+	targetId: string(),
+	enabled: boolean()
+}), _void(), { kind: "mutation" });
 /**
 * Zod schemas for persisted record types.
 *
@@ -14178,7 +15370,10 @@ var AgentLoadSummarySchema = object({
 	online: boolean(),
 	load: RunnerLocalLoadSchema,
 	/** Computed score used by the L2 capacity balancer (lower = less loaded). */
-	score: number()
+	score: number(),
+	/** This node's decode hwaccel backend (per-node `probedBestHwaccel`), or null
+	*  when not yet probed — for the cluster Pipeline table UI (P0.2). */
+	decodeHwaccel: string().nullable()
 });
 /**
 * Aggregate metrics across the whole detection cluster. Replaces the legacy
@@ -16739,7 +17934,10 @@ var HwAccelBackendInputSchema = _enum([
 	"webgpu",
 	"none"
 ]).nullable().optional();
-var HwAccelResolutionSchema = object({ preferred: array(string()).readonly() });
+var HwAccelResolutionSchema = object({
+	preferred: array(string()).readonly(),
+	rationale: string()
+});
 var HardwareEncoderIdSchema = _enum([
 	"h264_videotoolbox",
 	"hevc_videotoolbox",
@@ -16754,7 +17952,7 @@ var HardwareEncoderIdSchema = _enum([
 	"libx264",
 	"libx265"
 ]);
-var HardwareEncodersSchema = object({
+object({
 	encoders: array(object({
 		encoder: HardwareEncoderIdSchema,
 		codec: _enum(["H264", "H265"]),
@@ -16773,15 +17971,7 @@ var HardwareEncodersSchema = object({
 	defaultH265: HardwareEncoderIdSchema,
 	probedAt: number()
 });
-/**
-* Decode-side companion to {@link HardwareEncodersSchema}: the `-hwaccel`
-* methods the configured ffmpeg binary actually supports (parsed from
-* `ffmpeg -hwaccels`). Used to gate decode-hwaccel attempts so the transcode
-* egress never spends a spawn on a backend this build cannot offer. Per-stream
-* decode fragility (e.g. VideoToolbox HEVC) is still handled by the egress's
-* software fallback — this only filters out wholly-unsupported backends.
-*/
-var HardwareDecodeAccelsSchema = object({
+object({
 	methods: array(string()).readonly(),
 	probedAt: number()
 });
@@ -16844,16 +18034,7 @@ var ResolvedInferenceConfigSchema = object({
 	format: ModelFormatSchema,
 	reason: string()
 });
-method(_void(), PlatformCapabilitiesSchema), method(_void(), HardwareInfoSchema), method(object({ requirements: array(ModelRequirementSchema).readonly() }), ResolvedInferenceConfigSchema), method(object({
-	prefer: HwAccelBackendInputSchema,
-	nodeId: string().optional()
-}), HwAccelResolutionSchema), method(_void(), HardwareEncodersSchema), method(_void(), HardwareEncodersSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(_void(), HardwareDecodeAccelsSchema), method(_void(), HardwareDecodeAccelsSchema, {
-	kind: "mutation",
-	auth: "admin"
-});
+method(_void(), PlatformCapabilitiesSchema), method(_void(), HardwareInfoSchema), method(object({ requirements: array(ModelRequirementSchema).readonly() }), ResolvedInferenceConfigSchema), method(object({ prefer: HwAccelBackendInputSchema }), HwAccelResolutionSchema);
 var PtzPresetSchema = object({
 	id: string(),
 	name: string()
@@ -16948,6 +18129,16 @@ DeviceType.Camera, DeviceType.Sensor, DeviceType.Switch, method(object({ deviceI
 	kind: "mutation",
 	auth: "admin"
 });
+/**
+* `recording` cap — footage availability + HLS playback manifests + per-device
+* recording config. NOTE on events (source of truth, R5/C3): this cap carries
+* NO event surface — `getPlaybackManifest` returns playlist URLs only. Timeline
+* events (motion/object/audio) come from `pipelineAnalytics` (durable SQLite
+* rows); the recorder's internal EventMap markers are ephemeral in-RAM
+* annotations that are not exposed here and must not be treated as an event
+* feed. Event<->footage joins are by time, padded with the shared `EVENT_PAD_MS`
+* (`interfaces/recording-config.ts`).
+*/
 var RecordingStatusSchema = object({
 	deviceId: number(),
 	enabled: boolean(),
@@ -18584,6 +19775,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.getRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.getSettingsSchema": {
 		capName: "device-manager",
 		capScope: "system",
@@ -18734,6 +19931,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setDisplay": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setIntegrationId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -18776,6 +19979,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.setRoleDisplayDefaults": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.setStreamProfileMap": {
 		capName: "device-manager",
 		capScope: "system",
@@ -19754,13 +20963,49 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"notificationOutput.deleteTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"notificationOutput.discoverTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargetKinds": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"notificationOutput.listTargets": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"notificationOutput.send": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
 		access: "create"
 	},
-	"notificationOutput.sendTest": {
+	"notificationOutput.setTargetEnabled": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.testTarget": {
+		capName: "notification-output",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"notificationOutput.upsertTarget": {
 		capName: "notification-output",
 		capScope: "system",
 		addonId: null,
@@ -19790,6 +21035,66 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"petFeeder.callPet": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.cancelFeed": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.feed": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.markFoodReplenished": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.playSound": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.resetDesiccant": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "delete"
+	},
+	"petFeeder.setChildLock": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setFeedSound": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setIndicatorLight": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
+	"petFeeder.setVolume": {
+		capName: "pet-feeder",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineAnalytics.clearTracks": {
 		capName: "pipeline-analytics",
 		capScope: "device",
@@ -20396,30 +21701,6 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
-	"platformProbe.getHardwareDecodeAccels": {
-		capName: "platform-probe",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"platformProbe.getHardwareEncoders": {
-		capName: "platform-probe",
-		capScope: "system",
-		addonId: null,
-		access: "view"
-	},
-	"platformProbe.refreshHardwareDecodeAccels": {
-		capName: "platform-probe",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
-	"platformProbe.refreshHardwareEncoders": {
-		capName: "platform-probe",
-		capScope: "system",
-		addonId: null,
-		access: "create"
-	},
 	"platformProbe.resolveHwAccel": {
 		capName: "platform-probe",
 		capScope: "system",
@@ -31157,18 +32438,11 @@ var OnvifProviderAddon = class extends BaseDeviceProvider {
 		}] };
 	}
 	async getGlobalSettings() {
-		const raw = await this.ctx.settings?.readAddonStore() ?? {};
+		const raw = await this.resolveGlobalStore();
 		return hydrateSchema(this.buildGlobalSchema(), raw);
 	}
-	async updateGlobalSettings(patch) {
-		await this.ctx.settings?.writeAddonStore(patch);
-	}
 	async _getAddonConfig() {
-		if (!this.ctx.settings) return {
-			id: "onvif-default",
-			name: "ONVIF Cameras"
-		};
-		const raw = await this.ctx.settings.readAddonStore();
+		const raw = await this.resolveGlobalStore();
 		return {
 			id: typeof raw["id"] === "string" ? raw["id"] : "onvif-default",
 			name: typeof raw["name"] === "string" ? raw["name"] : "ONVIF Cameras",