refactor(setup): unify controller I/O — event-driven relays[] + generic inputs[]

The controller new/edit modal hardcoded both its outputs and its inputs, so an
operator could neither add a generic event-driven relay nor a free-standing input
(e.g. a second radar at the exit). This unifies both into symmetric, first-class
lists. Behaviour for existing booths is unchanged (back-compat, no DB migration).

Outputs — one event→action relays[] list:
- A relay is "when EVENT X happens, do its action": entry/exit/both pulse a
  barrier; a new `radarAlert` event drives a non-barrier alert lamp (blink while
  its trigger input is active, SOLID once the camera confirms a car).
- Dropped the separate config.buttonLight block — the lamp is just a relays[] row
  with direction:"radarAlert" (triggerInput + blink cadence). `alertRelaysOf()`
  replaces `buttonLightOf()`; ButtonLightController keeps its proven 3-state
  machine (serialized UDP, fail-OFF, hot-reload), now keyed per controllerId:relay
  so several alert lamps on one controller run independently. Every barrier
  resolver skips radarAlert rows (no auto-open; barrier-not-a-door intact).

Inputs — one first-class config.inputs[] list (the twin of relays[]):
- Each row is { input, role, relay?, kind?, activeLow?, cooldownSec? } with a
  "+ Add input" button. role ∈ button | presence | alertTrigger; button/presence
  name the relay they serve. An exit radar is just another presence row.
- Keystone `inputsOf(row)`: returns config.inputs[] or SYNTHESIZES it from the
  legacy relays[].button/presenceInput/... fields, so relayForButton /
  relayForPresence resolve identically from either shape — zero-downtime, no
  migration. entry-flow.ts is unchanged (resolves through the same functions).
- Fixed a latent bug this exposed: the alert lamp's camera lock was hardcoded to
  the ENTRY camera. Added relays[].lockLane ("entry"|"exit", default entry); the
  lamp now locks on its own lane's camera, so an exit radar's lamp tracks the exit
  camera. button-light tracks both #entryBusy/#exitBusy.
- Driver: extracted activeLowFrom(config) — merges inputs[] activeLow, legacy
  relays[].presenceActiveLow, and the inputActiveLow escape hatch.

UI: the relay dropdown gained a "Radar alert" option (reveals trigger/lock/blink
inputs); InputEditor is rewritten to a generic list (role select folds loop/radar);
i18n sq+en kept at type-parity.

Tests: new device-resolve.test.ts (inputs[] resolution + legacy fallback identical
+ exit-radar resolves to the exit relay); button-light gains a two-independent-
alert-relays case and an exit-lamp lockLane case; access-dingtian gains
activeLowFrom cases. Full workspace build/lint/test green (i18n parity included).

Wiki + memory updated (button-light-indicator, entry-double-press, dingtian-relay).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/src/button-light.ts

@@ -2,28 +2,33 @@ import { eq, devices, type Db, type DeviceRow } from "@parking/db";
 import type { FastifyBaseLogger } from "fastify";
 import { hasAuxOutput, registry, type AuxOutputDevice } from "@parking/devices";
 import { deviceEvents, type DeviceInputEvent, type LaneStatusEvent } from "./device-events.js";
-import { buttonLightOf, relayForPresence, type ButtonLightSpec } from "./device-resolve.js";
+import { alertRelaysOf, relayForPresence, type RelaySpec } from "./device-resolve.js";
 
-// The entry button's 12 V light, driven by the RADAR input vs. the camera "car in
-// zone" signal (the existing advisory lane-status). A disagreement indicator:
-//   radar present + lane busy (camera confirms a car) → SOLID on
-//   radar present + lane free  (radar sees something, no car) → BLINK (~1 Hz)
+// Alert (radarAlert) relays — non-barrier indicator lamps, e.g. the entry button's 12 V
+// light. Each lamp is a `relays[]` row with event `radarAlert`, driven by ITS trigger
+// input vs. the camera "car in zone" signal (the advisory lane-status). A disagreement
+// indicator:
+//   trigger active + lane busy (camera confirms a car) → SOLID on
+//   trigger active + lane free  (radar sees something, no car) → BLINK (~1 Hz)
 //   otherwise → OFF
 // The lamp is a NON-barrier aux output (setAux latch), so holding/blinking it is fine
 // — barrier-not-a-door applies only to barriers, which still only pulseOpen. The lamp
 // FAILS OFF: any error / shutdown leaves it off, so a dead lamp is "no hint", never a
-// misleading solid "go". See wiki/concepts/button-light-indicator.md.
+// misleading solid "go". A controller may have several alert relays (each its own row +
+// trigger input), keyed independently. See wiki/concepts/button-light-indicator.md.
 
 type LightState = "off" | "solid" | "blink";
 
 const DEFAULT_BLINK_MS = 500;
 
-/** Per-controller live state for the lamp rule. */
+/** Per-lamp live state for the alert rule (one per radarAlert relay). */
 interface LampState {
-  /** Lamp config (relay #, blink ms). Mutable: #reconcile updates it in place when the
-   *  admin changes the button-light config without a restart. */
-  spec: ButtonLightSpec;
-  /** Is the radar (presence input on an entry relay) currently active? */
+  /** The controller this lamp lives on (its deviceId) — for resolving the aux adapter. */
+  readonly controllerId: string;
+  /** Alert relay row (relay #, triggerInput, blink ms). Mutable: #reconcile updates it in
+   *  place when the admin changes the alert config without a restart. */
+  spec: RelaySpec;
+  /** Is the lamp's trigger input (the radar) currently active? */
   present: boolean;
   /** The high-level state we're rendering (to avoid restarting a running blink). */
   rendered: LightState | null;
@@ -50,10 +55,13 @@ export class ButtonLightController {
   readonly #db: Db;
   readonly #logger: FastifyBaseLogger;
   readonly #resolveAux: AuxResolver;
-  /** Per-controller state, keyed by controller deviceId. */
+  /** Per-lamp state, keyed by `${controllerId}:${relay}` (a controller may have several). */
   readonly #lamps = new Map<string, LampState>();
-  /** Latest lane status (entry busy = a camera-confirmed car in the entry zone). */
+  /** Latest lane status — a camera-confirmed car in the entry / exit zone. A lamp locks
+   *  SOLID off its OWN lane's camera (`spec.lockLane`), so an exit radar's lamp tracks the
+   *  exit camera, not the entry one. */
   #entryBusy = false;
+  #exitBusy = false;
   /** Controllers we've already warned lack the aux-output capability (warn once). */
   readonly #warned = new Set<string>();
   #unsubInput: (() => void) | null = null;
@@ -69,7 +77,7 @@ export class ButtonLightController {
   start(): void {
     this.#reconcile();
     // All lamps start OFF (known-safe baseline) regardless of prior device state.
-    for (const [controllerId, lamp] of this.#lamps) this.#apply(controllerId, lamp);
+    for (const lamp of this.#lamps.values()) this.#apply(lamp);
 
     this.#unsubInput = deviceEvents.onInput((e) => this.#onInput(e));
     this.#unsubLane = deviceEvents.onLaneStatus((s) => this.#onLane(s));
@@ -86,34 +94,36 @@ export class ButtonLightController {
     const seen = new Set<string>();
     for (const row of rows) {
       if (!row.enabled) continue;
-      const spec = buttonLightOf(row);
-      if (!spec) continue;
-      seen.add(row.id);
-      const existing = this.#lamps.get(row.id);
-      if (existing) {
-        existing.spec = spec; // pick up a changed relay # / blink cadence
-      } else {
-        this.#lamps.set(row.id, {
-          spec,
-          present: false,
-          rendered: null,
-          blink: null,
-          blinkOn: false,
-          desiredOn: false,
-          confirmedOn: null,
-          sending: false,
-        });
+      for (const spec of alertRelaysOf(row)) {
+        const key = lampKey(row.id, spec.relay);
+        seen.add(key);
+        const existing = this.#lamps.get(key);
+        if (existing) {
+          existing.spec = spec; // pick up a changed trigger input / blink cadence
+        } else {
+          this.#lamps.set(key, {
+            controllerId: row.id,
+            spec,
+            present: false,
+            rendered: null,
+            blink: null,
+            blinkOn: false,
+            desiredOn: false,
+            confirmedOn: null,
+            sending: false,
+          });
+        }
       }
     }
     // Drop lamps whose controller no longer declares one (or was disabled/removed).
-    for (const [id, lamp] of this.#lamps) {
-      if (seen.has(id)) continue;
+    for (const [key, lamp] of this.#lamps) {
+      if (seen.has(key)) continue;
       if (lamp.blink) {
         clearInterval(lamp.blink);
         lamp.blink = null;
       }
-      this.#finalOff(id, lamp); // best-effort fail-OFF before forgetting it
-      this.#lamps.delete(id);
+      this.#finalOff(lamp); // best-effort fail-OFF before forgetting it
+      this.#lamps.delete(key);
     }
   }
 
@@ -123,28 +133,36 @@ export class ButtonLightController {
   #onInput(e: DeviceInputEvent): void {
     // Reconcile first so a lamp added/changed since boot (no restart) is picked up.
     this.#reconcile();
-    const lamp = this.#lamps.get(e.deviceId);
-    if (!lamp) return; // no lamp on this controller
-    const presence = relayForPresence(this.#db, e.deviceId, e.input);
-    if (!presence) return; // not the presence/radar terminal
     const present = e.edge === "on";
-    if (present === lamp.present) return;
-    lamp.present = present;
-    this.#apply(e.deviceId, lamp);
+    for (const lamp of this.#lamps.values()) {
+      if (lamp.controllerId !== e.deviceId) continue;
+      // A lamp's trigger is its own `triggerInput`; if unset, fall back to the controller's
+      // entry-relay presence terminal (resolved the SAME way the entry flow does) so the
+      // lamp and the one-car-one-ticket gate always agree on "a car is here".
+      const trigger =
+        lamp.spec.triggerInput ?? relayForPresence(this.#db, e.deviceId, e.input)?.presenceInput;
+      if (trigger !== e.input) continue; // not this lamp's trigger terminal
+      if (present === lamp.present) continue;
+      lamp.present = present;
+      this.#apply(lamp);
+    }
   }
 
-  /** Lane status changed: entry busy = a camera-confirmed car in the entry zone. */
+  /** Lane status changed: a camera-confirmed car in the entry and/or exit zone. */
   #onLane(s: LaneStatusEvent): void {
-    if (s.entry === this.#entryBusy) return;
+    if (s.entry === this.#entryBusy && s.exit === this.#exitBusy) return;
     this.#entryBusy = s.entry;
-    // Re-render every lamp (the camera signal is site-wide entry status).
-    for (const [controllerId, lamp] of this.#lamps) this.#apply(controllerId, lamp);
+    this.#exitBusy = s.exit;
+    // Re-render every lamp (each picks its own lane's camera in #apply).
+    for (const lamp of this.#lamps.values()) this.#apply(lamp);
   }
 
   /** Compute + render the target state for one lamp. Drives are fire-and-forget (the
    *  timer/state machine is synchronous; the UDP write resolves on its own). */
-  #apply(controllerId: string, lamp: LampState): void {
-    const target: LightState = !lamp.present ? "off" : this.#entryBusy ? "solid" : "blink";
+  #apply(lamp: LampState): void {
+    // SOLID only once THIS lamp's lane camera confirms a car (default entry).
+    const laneBusy = lamp.spec.lockLane === "exit" ? this.#exitBusy : this.#entryBusy;
+    const target: LightState = !lamp.present ? "off" : laneBusy ? "solid" : "blink";
     if (target === lamp.rendered) return; // already rendering this state
 
     // Tear down any running blink before switching states.
@@ -156,10 +174,10 @@ export class ButtonLightController {
 
     if (target === "off") {
       lamp.desiredOn = false;
-      this.#pump(controllerId, lamp);
+      this.#pump(lamp);
     } else if (target === "solid") {
       lamp.desiredOn = true;
-      this.#pump(controllerId, lamp);
+      this.#pump(lamp);
     } else {
       // BLINK: a wall-clock timer flips ONLY the desired flag; #pump does the actual
       // (serialized) UDP send. A symmetric cadence uses one interval; an asymmetric one
@@ -172,7 +190,7 @@ export class ButtonLightController {
       const tick = () => {
         lamp.blinkOn = !lamp.blinkOn;
         lamp.desiredOn = lamp.blinkOn;
-        this.#pump(controllerId, lamp);
+        this.#pump(lamp);
         if (onMs !== offMs && lamp.blink) {
           clearInterval(lamp.blink);
           lamp.blink = setInterval(tick, lamp.blinkOn ? onMs : offMs);
@@ -181,7 +199,7 @@ export class ButtonLightController {
       };
       lamp.blink = setInterval(tick, onMs);
       lamp.blink.unref?.();
-      this.#pump(controllerId, lamp);
+      this.#pump(lamp);
     }
   }
 
@@ -190,10 +208,10 @@ export class ButtonLightController {
    *  the relay stuck on a stale packet. Here a single in-flight send is guaranteed
    *  (`sending` guard); when it resolves, if the desired state moved on we send again —
    *  so the LAST desired state is always the one finally asserted on the device. */
-  #pump(controllerId: string, lamp: LampState): void {
+  #pump(lamp: LampState): void {
     if (lamp.sending) return; // a send is already in flight; it'll re-check on completion
     if (lamp.confirmedOn === lamp.desiredOn) return; // already there — no redundant UDP
-    const aux = this.#resolveAux(controllerId);
+    const aux = this.#resolveAux(lamp.controllerId);
     if (!aux) return;
     const target = lamp.desiredOn;
     lamp.sending = true;
@@ -204,13 +222,13 @@ export class ButtonLightController {
       })
       .catch((err: unknown) => {
         // Leave confirmedOn unchanged so the next pump retries this state. Never escalates.
-        this.#logger.error(`button-light setAux failed (${controllerId} R${lamp.spec.relay}): ${(err as Error).message}`);
+        this.#logger.error(`button-light setAux failed (${lamp.controllerId} R${lamp.spec.relay}): ${(err as Error).message}`);
       })
       .finally(() => {
         lamp.sending = false;
         // Desired state may have changed (or the send failed) while we were busy —
         // re-pump to converge. This is what makes the final state authoritative.
-        if (lamp.confirmedOn !== lamp.desiredOn) this.#pump(controllerId, lamp);
+        if (lamp.confirmedOn !== lamp.desiredOn) this.#pump(lamp);
       });
   }
 
@@ -242,34 +260,48 @@ export class ButtonLightController {
     this.#unsubLane?.();
     this.#unsubInput = null;
     this.#unsubLane = null;
-    for (const [controllerId, lamp] of this.#lamps) {
+    for (const lamp of this.#lamps.values()) {
       if (lamp.blink) {
         clearInterval(lamp.blink);
         lamp.blink = null;
       }
       // Best-effort fail-OFF on shutdown.
-      this.#finalOff(controllerId, lamp);
+      this.#finalOff(lamp);
     }
   }
 
   /** Drive a lamp OFF as a one-shot (used when dropping/stopping a lamp): set desired
    *  OFF and pump. The serialized worker still applies, so this can't collide with an
    *  in-flight send — it converges to OFF. */
-  #finalOff(controllerId: string, lamp: LampState): void {
+  #finalOff(lamp: LampState): void {
     lamp.desiredOn = false;
-    this.#pump(controllerId, lamp);
+    this.#pump(lamp);
   }
 
-  /** Test seam: current high-level state being rendered for a controller. */
-  stateOf(controllerId: string): LightState | null {
-    return this.#lamps.get(controllerId)?.rendered ?? null;
+  /** Test seam: current high-level state being rendered for a lamp (controller + relay).
+   *  `relay` defaults to the controller's only/first alert relay for single-lamp tests. */
+  stateOf(controllerId: string, relay?: number): LightState | null {
+    return this.#lamp(controllerId, relay)?.rendered ?? null;
   }
 
-  /** Test seam: the state last CONFIRMED on the device for a controller (after a
-   *  successful send). null = unknown / nothing sent yet. */
-  confirmedOf(controllerId: string): boolean | null {
-    return this.#lamps.get(controllerId)?.confirmedOn ?? null;
+  /** Test seam: the state last CONFIRMED on the device for a lamp (after a successful
+   *  send). null = unknown / nothing sent yet. `relay` defaults to the only alert relay. */
+  confirmedOf(controllerId: string, relay?: number): boolean | null {
+    return this.#lamp(controllerId, relay)?.confirmedOn ?? null;
   }
+
+  /** Resolve a lamp by controller + relay. When `relay` is omitted, returns the
+   *  controller's single lamp (the common single-alert case); ambiguous if several. */
+  #lamp(controllerId: string, relay?: number): LampState | undefined {
+    if (relay != null) return this.#lamps.get(lampKey(controllerId, relay));
+    for (const lamp of this.#lamps.values()) if (lamp.controllerId === controllerId) return lamp;
+    return undefined;
+  }
+}
+
+/** Composite key for the lamp map (a controller may carry several alert relays). */
+function lampKey(controllerId: string, relay: number): string {
+  return `${controllerId}:${relay}`;
 }
 
 /** Build a controller row's live aux device (exported for reuse/tests). */