@camstack/addon-provider-bosch 0.1.1 → 0.1.3

package/dist/home-connect/addon.mjs

@@ -1,6 +1,9 @@
-import { C as record, D as EventCategory, E as unknown, S as object, T as union, _ as isSecretMarkerLike, a as connectionTestCapability, b as literal, f as DeviceType, g as isSecretMarker, h as defineCustomActions, m as customAction, n as BaseDeviceProvider, o as deviceAdoptionCapability, p as errMsg, s as dishwasherCapability, t as BaseDevice, v as _enum, w as string, y as array } from "../dist-CY6qHAEx.mjs";
-import { n as cascadeRemoveDevicesForIntegration, t as setIntegrationDevicesOnline } from "../account-integration-offline-CH7JBu8l.mjs";
+import { A as object, C as defineCustomActions, D as array, E as _enum, F as EventCategory, M as string, N as union, O as literal, P as unknown, S as customAction, T as isSecretMarkerLike, a as binaryCapability, b as errMsg, c as deviceAdoptionCapability, d as eventEmitterCapability, j as record, l as dishwasherCapability, m as powerMeterCapability, n as BaseDeviceProvider, p as numericSensorCapability, r as DishwasherOperationStateSchema, s as connectionTestCapability, t as BaseDevice, u as enumSensorCapability, v as DeviceRole, w as isSecretMarker, x as createEvent, y as DeviceType } from "../dist-BiZi19Lw.mjs";
+import { n as cascadeRemoveDevicesForIntegration, t as setIntegrationDevicesOnline } from "../account-integration-offline-BfoLYzxz.mjs";
 import { createHash, randomBytes } from "node:crypto";
+import { connect } from "node:tls";
+import { inflateRawSync } from "node:zlib";
+import { lookup } from "node:dns/promises";
 //#region src/home-connect/custom-actions.ts
 var homeConnectActions = defineCustomActions({
 	beginSignIn: customAction(object({}), object({
@@ -17,9 +20,12 @@ var homeConnectActions = defineCustomActions({
 		callback: string().min(1),
 		state: string().min(1)
 	}), object({
-		token: string().min(1),
-		refresh: string().optional(),
+		token: string().min(1).meta({ secret: true }),
+		refresh: string().optional().meta({ secret: true }),
+		/** JSON of the paired appliances — no credential on it. */
 		appliances: string().min(1),
+		/** JSON of `haId -> { psk, iv64? }`; stored in the keychain, never in `appliances`. */
+		applianceSecrets: string().min(1).meta({ secret: true }),
 		summary: string()
 	}), {
 		kind: "mutation",
@@ -27,9 +33,477 @@ var homeConnectActions = defineCustomActions({
 	})
 });
 //#endregion
+//#region src/home-connect/home-connect-xml.ts
+var TOKEN_RE = /<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<!\[CDATA\[([\s\S]*?)\]\]>|<!DOCTYPE[^>]*>|<\/([\w:.-]+)\s*>|<([\w:.-]+)((?:\s+[\w:.-]+\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*(\/?)>|([^<]+)/g;
+var ATTR_RE = /([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
+function decodeEntities(raw) {
+	return raw.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&apos;/g, "'").replace(/&#x([0-9A-Fa-f]+);/g, (_m, hex) => String.fromCodePoint(Number.parseInt(hex, 16))).replace(/&#(\d+);/g, (_m, dec) => String.fromCodePoint(Number.parseInt(dec, 10))).replace(/&amp;/g, "&");
+}
+function parseAttrs(raw) {
+	const attrs = {};
+	for (const m of raw.matchAll(ATTR_RE)) {
+		const key = m[1];
+		const value = m[2] ?? m[3] ?? "";
+		if (key !== void 0) attrs[key] = decodeEntities(value);
+	}
+	return attrs;
+}
+/** Parse a document; `null` when it has no root element. Tolerates unbalanced tags (closes to the nearest match). */
+function parseXml(xml) {
+	const stack = [];
+	let root = null;
+	for (const m of xml.matchAll(TOKEN_RE)) {
+		const cdata = m[1];
+		const closeName = m[2];
+		const openName = m[3];
+		const text = m[6];
+		if (openName !== void 0) {
+			const el = {
+				name: openName,
+				attrs: parseAttrs(m[4] ?? ""),
+				children: [],
+				text: ""
+			};
+			const parent = stack[stack.length - 1];
+			if (parent) parent.children.push(el);
+			else if (root === null) root = el;
+			if (m[5] !== "/") stack.push(el);
+			continue;
+		}
+		if (closeName !== void 0) {
+			const at = stack.map((e) => e.name).lastIndexOf(closeName);
+			if (at >= 0) stack.length = at;
+			continue;
+		}
+		const parent = stack[stack.length - 1];
+		if (parent) {
+			if (cdata !== void 0) parent.text += cdata;
+			else if (text !== void 0) parent.text += decodeEntities(text);
+		}
+	}
+	return root;
+}
+/** Depth-first walk over every descendant element (the root included). */
+function walkXml(root, visit) {
+	const go = (el, ancestors) => {
+		visit(el, ancestors);
+		const next = [...ancestors, el];
+		for (const child of el.children) go(child, next);
+	};
+	go(root, []);
+}
+function isDescriptionRoot(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseHexUid(raw) {
+	return Number.parseInt(raw, 16);
+}
+function parseFeatureMappingXml(xml) {
+	const features = /* @__PURE__ */ new Map();
+	const enumerations = /* @__PURE__ */ new Map();
+	const root = parseXml(xml);
+	if (root === null) return {
+		features,
+		enumerations
+	};
+	walkXml(root, (el) => {
+		if (el.name === "feature") {
+			const uidHex = el.attrs["refUID"];
+			const name = el.text.trim();
+			if (uidHex && name) features.set(parseHexUid(uidHex), name);
+			return;
+		}
+		if (el.name === "enumDescription") {
+			const enidHex = el.attrs["refENID"];
+			if (!enidHex) return;
+			const members = {};
+			for (const child of el.children) {
+				if (child.name !== "enumMember") continue;
+				const value = child.attrs["refValue"];
+				const label = child.text.trim();
+				if (value !== void 0 && label) members[Number.parseInt(value, 10)] = label;
+			}
+			enumerations.set(parseHexUid(enidHex), members);
+		}
+	});
+	return {
+		features,
+		enumerations
+	};
+}
+var ENTITY_KIND_BY_TAG = {
+	status: "status",
+	setting: "setting",
+	option: "option",
+	command: "command",
+	event: "event",
+	program: "program",
+	activeProgram: "activeProgram",
+	selectedProgram: "selectedProgram"
+};
+var ACCESS_VALUES = [
+	"none",
+	"read",
+	"readWrite",
+	"writeOnly",
+	"readStatic"
+];
+function accessFrom(raw) {
+	return ACCESS_VALUES.find((a) => a === raw);
+}
+function boolAttr(raw) {
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+}
+function numberAttr(raw) {
+	if (raw === void 0 || raw.trim() === "") return void 0;
+	const n = Number(raw);
+	return Number.isFinite(n) ? n : void 0;
+}
+/** A `default="…"` attribute: a number, a boolean, or the text as written. */
+function defaultAttr(raw) {
+	if (raw === void 0) return void 0;
+	if (raw === "true") return true;
+	if (raw === "false") return false;
+	const n = numberAttr(raw);
+	return n !== void 0 ? n : raw;
+}
+function featureName(features, uid, hexUid) {
+	const mapped = features.get(uid);
+	if (mapped === void 0) return `Unmapped.${hexUid.toUpperCase()}`;
+	return mapped.includes(".") ? mapped : `BSH.Common.${mapped}`;
+}
+function entityFromElement(el, kind, mapping) {
+	const uidRaw = el.attrs["uid"];
+	if (!uidRaw) return null;
+	const uid = parseHexUid(uidRaw);
+	if (Number.isNaN(uid)) return null;
+	const enType = el.attrs["enumerationType"];
+	const enumeration = enType ? { ...mapping.enumerations.get(parseHexUid(enType)) } : void 0;
+	const min = numberAttr(el.attrs["min"]);
+	const max = numberAttr(el.attrs["max"]);
+	const stepSize = numberAttr(el.attrs["stepSize"]);
+	const valueType = enumeration !== void 0 ? "enum" : min !== void 0 || max !== void 0 || stepSize !== void 0 ? "number" : "unknown";
+	const unit = el.attrs["unit"];
+	const defaultValue = defaultAttr(el.attrs["default"]);
+	const handling = el.attrs["handling"];
+	const level = el.attrs["level"];
+	const refCid = el.attrs["refCID"];
+	const refDid = el.attrs["refDID"];
+	const access = accessFrom(el.attrs["access"]);
+	const available = boolAttr(el.attrs["available"]);
+	return {
+		uid,
+		name: featureName(mapping.features, uid, uidRaw),
+		kind,
+		...access !== void 0 ? { access } : {},
+		...available !== void 0 ? { available } : {},
+		...enumeration !== void 0 ? { enumeration } : {},
+		valueType,
+		...unit !== void 0 && unit.length > 0 ? { unit } : {},
+		...min !== void 0 ? { min } : {},
+		...max !== void 0 ? { max } : {},
+		...stepSize !== void 0 ? { stepSize } : {},
+		...defaultValue !== void 0 ? { defaultValue } : {},
+		...handling !== void 0 ? { handling } : {},
+		...level !== void 0 ? { level } : {},
+		...refCid !== void 0 ? { refCid } : {},
+		...refDid !== void 0 ? { refDid } : {}
+	};
+}
+function infoFromDeviceXml(root, deviceIdFallback) {
+	const text = (name) => {
+		let found;
+		walkXml(root, (el) => {
+			if (found === void 0 && el.name === name) {
+				const t = el.text.trim();
+				if (t.length > 0) found = t;
+			}
+		});
+		return found;
+	};
+	const brand = text("brand");
+	return {
+		deviceID: deviceIdFallback,
+		deviceType: text("type") ?? "Appliance",
+		model: text("model") ?? deviceIdFallback,
+		...brand !== void 0 ? { brand } : {}
+	};
+}
+function programOptionsOf(program, byUid) {
+	const options = [];
+	for (const child of program.children) {
+		if (child.name !== "option") continue;
+		const ref = child.attrs["refUID"];
+		if (!ref) continue;
+		const def = byUid.get(parseHexUid(ref));
+		if (def === void 0) continue;
+		const access = accessFrom(child.attrs["access"]);
+		const available = boolAttr(child.attrs["available"]);
+		const defaultValue = defaultAttr(child.attrs["default"]);
+		options.push({
+			key: def.name,
+			...access !== void 0 ? { access } : {},
+			...available !== void 0 ? { available } : {},
+			...defaultValue !== void 0 ? { defaultValue } : {}
+		});
+	}
+	return options;
+}
+/** Parse an IDDF XML pair into the compact JSON stored on the appliance connection. */
+function parseHomeConnectIddfXml(input) {
+	const mapping = parseFeatureMappingXml(input.featureMappingXml);
+	const root = parseXml(input.deviceDescriptionXml);
+	const entities = {};
+	const byUid = /* @__PURE__ */ new Map();
+	const programElements = [];
+	if (root !== null) walkXml(root, (el) => {
+		const kind = ENTITY_KIND_BY_TAG[el.name];
+		if (kind === void 0) return;
+		const def = entityFromElement(el, kind, mapping);
+		if (def === null) return;
+		entities[String(def.uid)] = def;
+		byUid.set(def.uid, def);
+		if (kind === "program") programElements.push(el);
+	});
+	const program = [];
+	for (const el of programElements) {
+		const def = byUid.get(parseHexUid(el.attrs["uid"] ?? ""));
+		if (def === void 0) continue;
+		const options = programOptionsOf(el, byUid);
+		program.push({
+			name: def.name.split(".").pop() ?? def.name,
+			uid: def.name,
+			available: def.available !== false,
+			...options.length > 0 ? { options } : {}
+		});
+	}
+	return {
+		version: 2,
+		info: root !== null ? infoFromDeviceXml(root, input.haId) : {
+			deviceID: input.haId,
+			deviceType: "Appliance",
+			model: input.haId
+		},
+		program,
+		entities
+	};
+}
+function enumerationFrom(raw) {
+	if (!isDescriptionRoot(raw)) return void 0;
+	const out = {};
+	for (const [ek, ev] of Object.entries(raw)) if (typeof ev === "string") out[Number.parseInt(ek, 10)] = ev;
+	return out;
+}
+function stringIn(raw, allowed) {
+	return allowed.find((a) => a === raw);
+}
+var ENTITY_KINDS = [
+	"status",
+	"setting",
+	"option",
+	"command",
+	"event",
+	"program",
+	"activeProgram",
+	"selectedProgram"
+];
+var VALUE_TYPES = [
+	"boolean",
+	"number",
+	"enum",
+	"string",
+	"unknown"
+];
+function finiteNumber(raw) {
+	return typeof raw === "number" && Number.isFinite(raw) ? raw : void 0;
+}
+function entityFromJson(key, val) {
+	const name = val["name"];
+	const uid = Number.parseInt(key, 10);
+	if (typeof name !== "string" || Number.isNaN(uid)) return null;
+	const enumeration = enumerationFrom(val["enumeration"]);
+	const kind = stringIn(val["kind"], ENTITY_KINDS);
+	const access = stringIn(val["access"], ACCESS_VALUES);
+	const valueType = stringIn(val["valueType"], VALUE_TYPES);
+	const available = typeof val["available"] === "boolean" ? val["available"] : void 0;
+	const unit = typeof val["unit"] === "string" && val["unit"].length > 0 ? val["unit"] : void 0;
+	const min = finiteNumber(val["min"]);
+	const max = finiteNumber(val["max"]);
+	const stepSize = finiteNumber(val["stepSize"]);
+	const handling = typeof val["handling"] === "string" ? val["handling"] : void 0;
+	const level = typeof val["level"] === "string" ? val["level"] : void 0;
+	const refCid = typeof val["refCid"] === "string" ? val["refCid"] : void 0;
+	const refDid = typeof val["refDid"] === "string" ? val["refDid"] : void 0;
+	const defaultValue = val["defaultValue"];
+	return {
+		uid,
+		name,
+		...kind !== void 0 ? { kind } : {},
+		...access !== void 0 ? { access } : {},
+		...available !== void 0 ? { available } : {},
+		...enumeration !== void 0 ? { enumeration } : {},
+		...valueType !== void 0 ? { valueType } : {},
+		...unit !== void 0 ? { unit } : {},
+		...min !== void 0 ? { min } : {},
+		...max !== void 0 ? { max } : {},
+		...stepSize !== void 0 ? { stepSize } : {},
+		...defaultValue !== void 0 ? { defaultValue } : {},
+		...handling !== void 0 ? { handling } : {},
+		...level !== void 0 ? { level } : {},
+		...refCid !== void 0 ? { refCid } : {},
+		...refDid !== void 0 ? { refDid } : {}
+	};
+}
+function rootFromInput(input) {
+	if (input === void 0 || input === null) return null;
+	if (typeof input === "string") try {
+		const parsed = JSON.parse(input.trim());
+		return isDescriptionRoot(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+	return isDescriptionRoot(input) ? input : null;
+}
+function entityIndexFromDescription(input) {
+	const index = /* @__PURE__ */ new Map();
+	const root = rootFromInput(input);
+	if (root === null) return index;
+	const entities = root["entities"];
+	if (!isDescriptionRoot(entities)) return index;
+	for (const [key, val] of Object.entries(entities)) {
+		if (!isDescriptionRoot(val)) continue;
+		const def = entityFromJson(key, val);
+		if (def !== null) index.set(def.uid, def);
+	}
+	return index;
+}
+/** The programs a stored description lists (empty for the pre-model shape). */
+function programsFromDescription(input) {
+	const raw = rootFromInput(input)?.["program"];
+	if (!Array.isArray(raw)) return [];
+	const out = [];
+	for (const row of raw) {
+		if (!isDescriptionRoot(row)) continue;
+		const uid = row["uid"];
+		const name = row["name"];
+		if (typeof uid !== "string" || typeof name !== "string") continue;
+		const optionsRaw = row["options"];
+		const options = [];
+		if (Array.isArray(optionsRaw)) for (const o of optionsRaw) {
+			if (!isDescriptionRoot(o) || typeof o["key"] !== "string") continue;
+			const access = stringIn(o["access"], ACCESS_VALUES);
+			options.push({
+				key: o["key"],
+				...access !== void 0 ? { access } : {},
+				...typeof o["available"] === "boolean" ? { available: o["available"] } : {},
+				...o["defaultValue"] !== void 0 ? { defaultValue: o["defaultValue"] } : {}
+			});
+		}
+		out.push({
+			name,
+			uid,
+			available: row["available"] !== false,
+			...options.length > 0 ? { options } : {}
+		});
+	}
+	return out;
+}
+/** True when the stored description carries the model this addon reads (kinds + constraints). */
+function isCurrentDescription(input) {
+	const root = rootFromInput(input);
+	return root?.["version"] === 2 && entityIndexFromDescription(root).size > 0;
+}
+function decodeHomeConnectValue(uid, value, index) {
+	const entity = index.get(uid);
+	if (!entity) return null;
+	if (entity.enumeration && (typeof value === "number" || typeof value === "string" && /^\d+$/.test(value))) {
+		const num = typeof value === "number" ? value : Number.parseInt(value, 10);
+		const label = entity.enumeration[num];
+		return {
+			key: entity.name,
+			value: label ?? value
+		};
+	}
+	return {
+		key: entity.name,
+		value
+	};
+}
+function encodeHomeConnectValue(featureName, value, index) {
+	for (const entity of index.values()) {
+		if (entity.name !== featureName) continue;
+		if (entity.enumeration && typeof value === "string") {
+			for (const [num, label] of Object.entries(entity.enumeration)) if (label === value) return {
+				uid: entity.uid,
+				value: Number.parseInt(num, 10)
+			};
+		}
+		return {
+			uid: entity.uid,
+			value
+		};
+	}
+	return null;
+}
+//#endregion
+//#region src/home-connect/home-connect-iddf.ts
+function readUInt16LE(buf, offset) {
+	return buf.readUInt16LE(offset);
+}
+function readUInt32LE(buf, offset) {
+	return buf.readUInt32LE(offset);
+}
+function decodeZipPayload(method, payload) {
+	if (method === 0) return payload;
+	if (method === 8) try {
+		return inflateRawSync(payload);
+	} catch {
+		return null;
+	}
+	return null;
+}
+/** Extract file bodies from a ZIP (store + deflate). */
+function extractZipEntries(zip) {
+	const out = /* @__PURE__ */ new Map();
+	let pos = 0;
+	while (pos + 30 <= zip.length) {
+		const sig = readUInt32LE(zip, pos);
+		if (sig === 101010256) break;
+		if (sig !== 67324752) break;
+		const method = readUInt16LE(zip, pos + 8);
+		const compSize = readUInt32LE(zip, pos + 18);
+		const nameLen = readUInt16LE(zip, pos + 26);
+		const extraLen = readUInt16LE(zip, pos + 28);
+		const nameStart = pos + 30;
+		const name = zip.subarray(nameStart, nameStart + nameLen).toString("utf8");
+		const dataStart = nameStart + nameLen + extraLen;
+		const decoded = decodeZipPayload(method, zip.subarray(dataStart, dataStart + compSize));
+		if (decoded !== null) out.set(name, decoded);
+		pos = dataStart + compSize;
+	}
+	return out;
+}
+function parseIddfZipBuffer(zip, haId) {
+	const entries = extractZipEntries(zip);
+	let deviceXml;
+	let mappingXml;
+	for (const [name, body] of entries) {
+		if (name.endsWith("_DeviceDescription.xml")) deviceXml = body.toString("utf8");
+		if (name.endsWith("_FeatureMapping.xml")) mappingXml = body.toString("utf8");
+	}
+	if (!deviceXml || !mappingXml) return null;
+	return parseHomeConnectIddfXml({
+		deviceDescriptionXml: deviceXml,
+		featureMappingXml: mappingXml,
+		haId
+	});
+}
+var HOME_CONNECT_IDDF_URL = (haId) => `https://eu.services.home-connect.com/api/iddf/v1/iddf/${encodeURIComponent(haId)}`;
+//#endregion
 //#region src/home-connect/home-connect-login.ts
 /** Public OAuth client ids from the Home Connect app login (hcpy). */
-var APP_ID = "9B75AC9EC512F36C84256AC47D813E2C1DD0D6520DF774B020E1E6E2EB29B1F3";
+var APP_ID$1 = "9B75AC9EC512F36C84256AC47D813E2C1DD0D6520DF774B020E1E6E2EB29B1F3";
 var OAUTH_BASE = "https://api.home-connect.com/security/oauth/";
 var ASSET_BASE = "https://eu.services.home-connect.com/";
 var REDIRECT_URI = "hcauth://auth/prod";
@@ -56,7 +530,7 @@ var CookieJar = class {
 function headerList(value) {
 	return value ? [value] : [];
 }
-async function defaultFetch(url, init) {
+async function homeConnectLoginFetch(url, init) {
 	const response = await fetch(url, {
 		method: init.method,
 		headers: { ...init.headers },
@@ -66,7 +540,8 @@ async function defaultFetch(url, init) {
 	return {
 		status: response.status,
 		headers: response.headers,
-		text: () => response.text()
+		text: () => response.text(),
+		arrayBuffer: () => response.arrayBuffer()
 	};
 }
 function b64url(bytes) {
@@ -95,7 +570,7 @@ async function exchange(fetchImpl, jar, url, method, extraHeaders, body) {
 		body: await response.text()
 	};
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringField(record, key) {
@@ -104,7 +579,7 @@ function stringField(record, key) {
 }
 function tokensFromBody(body) {
 	const tokenJson = JSON.parse(body);
-	if (!isRecord(tokenJson)) throw new Error("Home Connect sign-in was rejected");
+	if (!isRecord$1(tokenJson)) throw new Error("Home Connect sign-in was rejected");
 	const token = tokenJson["access_token"];
 	const refresh = tokenJson["refresh_token"];
 	if (typeof token !== "string" || token.length === 0) throw new Error("Home Connect sign-in was rejected");
@@ -128,7 +603,7 @@ function accountIdFromAccessToken(token) {
 	} catch {
 		throw new Error("Home Connect sign-in was rejected");
 	}
-	if (!isRecord(parsed) || typeof parsed["sub"] !== "string" || parsed["sub"].length === 0) throw new Error("Home Connect sign-in was rejected");
+	if (!isRecord$1(parsed) || typeof parsed["sub"] !== "string" || parsed["sub"].length === 0) throw new Error("Home Connect sign-in was rejected");
 	return parsed["sub"];
 }
 function listedFromPaired(row, encryption) {
@@ -137,8 +612,8 @@ function listedFromPaired(row, encryption) {
 	if (!haId) return null;
 	const brand = (stringField(row, "brand") ?? "HomeConnect").toUpperCase();
 	const type = stringField(row, "haType") ?? stringField(row, "type") ?? "Appliance";
-	const tls = isRecord(encryption["tls"]) ? encryption["tls"] : void 0;
-	const aes = isRecord(encryption["aes"]) ? encryption["aes"] : void 0;
+	const tls = isRecord$1(encryption["tls"]) ? encryption["tls"] : void 0;
+	const aes = isRecord$1(encryption["aes"]) ? encryption["aes"] : void 0;
 	const tlsKey = tls ? stringField(tls, "key") : void 0;
 	const aesKey = aes ? stringField(aes, "key") : void 0;
 	const mode = tlsKey ? "TLS" : "AES";
@@ -177,10 +652,10 @@ async function appliancesForToken(token, fetchImpl, jar) {
 	} catch {
 		throw new Error("Home Connect sign-in was rejected");
 	}
-	if (!isRecord(parsed) || !Array.isArray(parsed["appliances"])) throw new Error("Home Connect sign-in was rejected");
+	if (!isRecord$1(parsed) || !Array.isArray(parsed["appliances"])) throw new Error("Home Connect sign-in was rejected");
 	const out = [];
 	for (const row of parsed["appliances"]) {
-		if (!isRecord(row)) continue;
+		if (!isRecord$1(row)) continue;
 		const haId = stringField(row, "haId");
 		if (!haId) continue;
 		const enc = await exchange(fetchImpl, jar, `${ASSET_BASE}api/appliance/v2/appliances/${encodeURIComponent(haId)}/encryption-information`, "GET", {
@@ -194,14 +669,36 @@ async function appliancesForToken(token, fetchImpl, jar) {
 		} catch {
 			continue;
 		}
-		if (!isRecord(encryption)) continue;
+		if (!isRecord$1(encryption)) continue;
 		const appliance = listedFromPaired(row, encryption);
-		if (appliance) out.push(appliance);
+		if (!appliance) continue;
+		const iddfResponse = await fetchImpl(HOME_CONNECT_IDDF_URL(haId), {
+			method: "GET",
+			headers: {
+				authorization: `Bearer ${token}`,
+				accept: "application/zip"
+			},
+			redirect: "manual"
+		});
+		if (iddfResponse.status < 400 && iddfResponse.arrayBuffer) {
+			const compact = parseIddfZipBuffer(Buffer.from(await iddfResponse.arrayBuffer()), haId);
+			if (compact) {
+				out.push({
+					...appliance,
+					connection: {
+						...appliance.connection,
+						deviceDescription: JSON.stringify(compact)
+					}
+				});
+				continue;
+			}
+		}
+		out.push(appliance);
 	}
 	return out;
 }
 /** Load every appliance on the account. A stale access token is refreshed once when a refresh token exists. */
-async function fetchHomeConnectAccount(creds, fetchImpl = defaultFetch) {
+async function fetchHomeConnectAccount(creds, fetchImpl = homeConnectLoginFetch) {
 	const jar = new CookieJar();
 	let token = creds.token;
 	let refresh = creds.refresh ?? "";
@@ -219,7 +716,7 @@ async function fetchHomeConnectAccount(creds, fetchImpl = defaultFetch) {
 	const refreshed = await exchange(fetchImpl, jar, `${OAUTH_BASE}token`, "POST", { "content-type": "application/x-www-form-urlencoded" }, new URLSearchParams({
 		grant_type: "refresh_token",
 		refresh_token: refresh,
-		client_id: APP_ID
+		client_id: APP_ID$1
 	}).toString());
 	if (refreshed.status >= 400) throw new Error("Home Connect sign-in was rejected");
 	const next = tokensFromBody(refreshed.body);
@@ -240,7 +737,7 @@ function beginHomeConnectSignIn() {
 	const state = b64url(randomBytes(16));
 	const authorize = new URL("authorize", OAUTH_BASE);
 	authorize.searchParams.set("redirect_url", REDIRECT_URI);
-	authorize.searchParams.set("client_id", APP_ID);
+	authorize.searchParams.set("client_id", APP_ID$1);
 	authorize.searchParams.set("response_type", "code");
 	authorize.searchParams.set("prompt", "login");
 	authorize.searchParams.set("code_challenge_method", "S256");
@@ -271,13 +768,13 @@ function callbackParams(callback) {
 	};
 }
 /** Exchange the pasted redirect for the account token and each appliance profile. */
-async function completeHomeConnectSignIn(input, fetchImpl = defaultFetch) {
+async function completeHomeConnectSignIn(input, fetchImpl = homeConnectLoginFetch) {
 	const parsed = callbackParams(input.callback);
 	if (parsed.state !== input.state) throw new Error("State mismatch. Create the login link again.");
 	const { code, grantType } = parsed;
 	const token = await exchange(fetchImpl, new CookieJar(), `${OAUTH_BASE}token`, "POST", { "content-type": "application/x-www-form-urlencoded" }, new URLSearchParams({
 		grant_type: grantType,
-		client_id: APP_ID,
+		client_id: APP_ID$1,
 		code,
 		code_verifier: input.verifier,
 		redirect_uri: REDIRECT_URI
@@ -287,29 +784,56 @@ async function completeHomeConnectSignIn(input, fetchImpl = defaultFetch) {
 }
 //#endregion
 //#region src/home-connect/home-connect-discovery.ts
+/** Dishwasher accessory label: `Dishwasher` plus the appliance name. */
+function homeConnectDishwasherEntityName(containerName) {
+	const base = containerName.trim();
+	return base.length > 0 ? `Dishwasher ${base}` : "Dishwasher";
+}
 function deviceTypeForApplianceType(type) {
-	if (type.toLowerCase().includes("dishwasher")) return DeviceType.Dishwasher;
+	if (type.toLowerCase().includes("dishwasher")) return DeviceType.Container;
 	return null;
 }
+/**
+* The container candidate for one appliance. Its sensor children are not listed here:
+* they are the entities the appliance's own description declares, known once it is
+* connected, and they are attached to the container as that description is read.
+*/
+function dishwasherContainerCandidate(app, adoptedId) {
+	const name = app.name.length > 0 ? app.name : app.haId;
+	const children = [{
+		childNativeId: `${app.haId}#dishwasher`,
+		name: homeConnectDishwasherEntityName(name),
+		type: DeviceType.Dishwasher,
+		status: "online",
+		metadata: {
+			serialNumber: app.haId,
+			model: app.type
+		},
+		alreadyAdopted: false,
+		adoptedDeviceId: null,
+		capabilities: ["dishwasher"]
+	}];
+	return {
+		childNativeId: app.haId,
+		name,
+		type: DeviceType.Container,
+		status: "online",
+		metadata: {
+			serialNumber: app.haId,
+			model: app.type
+		},
+		alreadyAdopted: adoptedId !== null,
+		adoptedDeviceId: adoptedId,
+		capabilities: [],
+		children
+	};
+}
 function buildHomeConnectCandidates(input) {
 	const out = [];
 	for (const app of input.appliances) {
-		const camType = deviceTypeForApplianceType(app.type);
-		if (camType === null) continue;
+		if (deviceTypeForApplianceType(app.type) === null) continue;
 		const adoptedId = input.adopted.get(app.haId) ?? null;
-		out.push({
-			childNativeId: app.haId,
-			name: app.name.length > 0 ? app.name : app.haId,
-			type: camType,
-			status: "online",
-			metadata: {
-				serialNumber: app.haId,
-				model: app.type
-			},
-			alreadyAdopted: adoptedId !== null,
-			adoptedDeviceId: adoptedId,
-			capabilities: camType === DeviceType.Dishwasher ? ["dishwasher"] : []
-		});
+		out.push(dishwasherContainerCandidate(app, adoptedId));
 	}
 	return out;
 }
@@ -407,8 +931,7 @@ function buildHomeConnectAdoptionProvider(deps) {
 					integrationId,
 					type: candidate.type,
 					name,
-					applianceType: app.type,
-					availablePrograms: app.availablePrograms
+					applianceType: app.type
 				});
 				adopted.push({
 					childNativeId: haId,
@@ -457,14 +980,45 @@ object({
 	iv64: string().optional(),
 	deviceDescription: homeConnectDeviceDescriptionSchema
 });
-/** One appliance saved at sign-in, so adopt does not need another cloud call. */
-var homeConnectStoredApplianceSchema = object({
+/** Setting key of the keychain-stored credentials of every paired appliance. */
+var APPLIANCE_SECRETS_KEY = "applianceSecrets";
+/**
+* The integration-settings keys that hold a credential — what a write from this addon names
+* as `secretKeys` so the hub moves them into the keychain.
+*/
+var HOME_CONNECT_SECRET_KEYS = [
+	"token",
+	"refresh",
+	APPLIANCE_SECRETS_KEY
+];
+/** One appliance as persisted in the integration's `appliances` setting: no credential on it. */
+var homeConnectApplianceRowSchema = object({
 	haId: string().min(1),
 	name: string(),
 	type: string(),
 	host: string().min(1),
-	psk: string().min(1),
 	mode: HomeConnectModeSchema,
+	deviceDescription: homeConnectDeviceDescriptionSchema
+});
+/**
+* A row as it may still be found on disk: before the keychain move the pairing key
+* (`psk`) and the AES iv (`iv64`) sat on the row, in a JSON textarea, in the clear.
+* Read once, adopted into the keychain, then never written again.
+*/
+var legacyApplianceRowSchema = homeConnectApplianceRowSchema.extend({
+	psk: string().optional(),
+	iv64: string().optional()
+});
+/** What the keychain holds per appliance. */
+var homeConnectApplianceSecretSchema = object({
+	psk: string().min(1),
+	iv64: string().optional()
+});
+/** `applianceSecrets`: one string in the keychain, JSON of `haId -> { psk, iv64? }`. */
+var homeConnectApplianceSecretsSchema = record(string(), homeConnectApplianceSecretSchema);
+/** One appliance in memory: its row and its credential together. */
+var homeConnectStoredApplianceSchema = homeConnectApplianceRowSchema.extend({
+	psk: string().min(1),
 	iv64: string().optional()
 });
 /** The integration is the Home Connect account. Profiles are downloaded once at sign-in. */
@@ -473,10 +1027,74 @@ var homeConnectConfigSchema = object({
 	refresh: string().optional().describe("Home Connect refresh token").meta({ secret: true }),
 	appliances: array(homeConnectStoredApplianceSchema).optional()
 });
+function parseJsonValue(raw) {
+	if (typeof raw !== "string") return raw;
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return void 0;
+	try {
+		return JSON.parse(trimmed);
+	} catch {
+		return raw;
+	}
+}
+function legacyRowsOf(raw) {
+	const value = parseJsonValue(raw);
+	if (!Array.isArray(value)) return [];
+	const rows = [];
+	for (const item of value) {
+		const parsed = legacyApplianceRowSchema.safeParse(item);
+		if (parsed.success) rows.push(parsed.data);
+	}
+	return rows;
+}
+function readApplianceSecrets(raw) {
+	if (isSecretMarker(raw) || isSecretMarkerLike(raw)) return { kind: "unresolved" };
+	const value = parseJsonValue(raw);
+	if (value === void 0 || value === null) return { kind: "none" };
+	const parsed = homeConnectApplianceSecretsSchema.safeParse(value);
+	return parsed.success ? {
+		kind: "secrets",
+		secrets: parsed.data
+	} : { kind: "invalid" };
+}
+/** Rows plus credentials -> the in-memory appliances. A row with no credential cannot be spoken to and is left out. */
+function mergeApplianceSecrets(rows, secrets) {
+	const out = [];
+	for (const { psk: inlinePsk, iv64: inlineIv, ...row } of rows) {
+		const keyed = secrets[row.haId];
+		const psk = inlinePsk !== void 0 && inlinePsk.length > 0 ? inlinePsk : keyed?.psk;
+		if (psk === void 0) continue;
+		const iv64 = inlineIv !== void 0 && inlineIv.length > 0 ? inlineIv : keyed?.iv64;
+		out.push({
+			...row,
+			psk,
+			...iv64 !== void 0 ? { iv64 } : {}
+		});
+	}
+	return out;
+}
+/** In-memory appliances -> the credential-free rows and the secrets map to put in the keychain. */
+function splitApplianceSecrets(appliances) {
+	const rows = [];
+	const secrets = {};
+	for (const { psk, iv64, ...row } of appliances) {
+		rows.push(row);
+		if (psk !== void 0 && psk.length > 0) secrets[row.haId] = {
+			psk,
+			...iv64 !== void 0 && iv64.length > 0 ? { iv64 } : {}
+		};
+	}
+	return {
+		rows,
+		secrets
+	};
+}
 /**
 * Before `integrations.setSettings`: keep objects as-is (serializes as `json`), parse
 * textarea JSON strings into objects so they are not re-serialized as `string` and
-* corrupted on read by `deserializeSetting(String(object))`.
+* corrupted on read by `deserializeSetting(String(object))` — and move any credential
+* still sitting on an appliance row into `applianceSecrets`, so a row is never written
+* with a pairing key on it.
 */
 function homeConnectSettingsForPersist(settings) {
 	const next = { ...settings };
@@ -492,6 +1110,7 @@ function homeConnectSettingsForPersist(settings) {
 		const parsedAppliances = JSON.parse(appliancesRaw);
 		if (Array.isArray(parsedAppliances)) next["appliances"] = parsedAppliances;
 	} catch {}
+	Object.assign(next, moveInlineSecrets(next));
 	const raw = next["deviceDescription"];
 	if (typeof raw !== "string") return next;
 	const trimmed = raw.trim();
@@ -508,10 +1127,71 @@ function homeConnectSettingsForPersist(settings) {
 	}
 	return next;
 }
+/**
+* The `appliances` / `applianceSecrets` pair with every inline credential moved into the
+* secrets map. An empty object when no row carries one (nothing to move). When the stored
+* secrets are unresolved the map is not rewritten: an addon cannot see what it would replace.
+*/
+function moveInlineSecrets(settings) {
+	const rows = legacyRowsOf(settings["appliances"]);
+	if (rows.filter((r) => (r.psk ?? "").length > 0 || (r.iv64 ?? "").length > 0).length === 0) return {};
+	const existing = readApplianceSecrets(settings[APPLIANCE_SECRETS_KEY]);
+	if (existing.kind === "unresolved" || existing.kind === "invalid") return {};
+	const { rows: stripped, secrets: moved } = splitApplianceSecrets(rows);
+	const merged = {
+		...existing.kind === "secrets" ? existing.secrets : {},
+		...moved
+	};
+	return {
+		appliances: stripped,
+		...Object.keys(merged).length > 0 ? { [APPLIANCE_SECRETS_KEY]: JSON.stringify(merged) } : {}
+	};
+}
+/**
+* One-time adopt: the settings that must be written so a pairing key found on an appliance
+* row moves into the keychain. `null` when nothing needs moving. The caller writes it with
+* {@link HOME_CONNECT_SECRET_KEYS} as `secretKeys`.
+*/
+function legacyApplianceSecretPatch(settings) {
+	const moved = moveInlineSecrets({
+		...settings,
+		appliances: parseJsonValue(settings["appliances"])
+	});
+	const rows = moved["appliances"];
+	const secrets = moved[APPLIANCE_SECRETS_KEY];
+	if (!Array.isArray(rows) || typeof secrets !== "string") return null;
+	const parsedRows = [];
+	for (const row of rows) {
+		const parsed = homeConnectApplianceRowSchema.safeParse(row);
+		if (parsed.success) parsedRows.push(parsed.data);
+	}
+	return {
+		appliances: parsedRows,
+		applianceSecrets: secrets
+	};
+}
 function connectionFromSettings(settings) {
-	const parsed = homeConnectConfigSchema.safeParse(homeConnectSettingsForPersist(settings));
+	const normalized = homeConnectSettingsForPersist(settings);
+	const rows = legacyRowsOf(normalized["appliances"]);
+	const secrets = readApplianceSecrets(normalized[APPLIANCE_SECRETS_KEY]);
+	const withoutAppliances = { ...normalized };
+	delete withoutAppliances["appliances"];
+	delete withoutAppliances[APPLIANCE_SECRETS_KEY];
+	const appliances = rows.length > 0 ? mergeApplianceSecrets(rows, secrets.kind === "secrets" ? secrets.secrets : {}) : void 0;
+	const parsed = homeConnectConfigSchema.safeParse({
+		...withoutAppliances,
+		...appliances !== void 0 ? { appliances: [...appliances] } : {}
+	});
 	return parsed.success ? parsed.data : null;
 }
+/** haIds of appliances on the account that have no usable credential (keychain locked, or never stored). */
+function appliancesWithoutCredential(settings) {
+	const normalized = homeConnectSettingsForPersist(settings);
+	const rows = legacyRowsOf(normalized["appliances"]);
+	const secrets = readApplianceSecrets(normalized[APPLIANCE_SECRETS_KEY]);
+	const have = new Set(mergeApplianceSecrets(rows, secrets.kind === "secrets" ? secrets.secrets : {}).map((a) => a.haId));
+	return rows.filter((r) => !have.has(r.haId)).map((r) => r.haId);
+}
 function hasNonEmptyString(settings, key) {
 	const value = settings[key];
 	return typeof value === "string" && value.trim().length > 0;
@@ -617,7 +1297,8 @@ function buildHomeConnectFormSchema() {
 				assignResult: {
 					token: "token",
 					refresh: "refresh",
-					appliances: "appliances"
+					appliances: "appliances",
+					[APPLIANCE_SECRETS_KEY]: APPLIANCE_SECRETS_KEY
 				},
 				successMessage: "{summary}"
 			},
@@ -641,6 +1322,13 @@ function buildHomeConnectFormSchema() {
 				label: "Appliances",
 				required: true,
 				showWhen: pairedOnly
+			},
+			{
+				type: "password",
+				key: APPLIANCE_SECRETS_KEY,
+				label: "Appliance keys",
+				required: true,
+				showWhen: pairedOnly
 			}
 		]
 	}] };
@@ -649,16 +1337,38 @@ function buildHomeConnectFormSchema() {
 function homeConnectWsUrl(config) {
 	return `${config.mode === "TLS" ? "wss" : "ws"}://${config.host.replace(/^https?:\/\//, "").replace(/\/$/, "")}/homeconnect`;
 }
+/**
+* The `appliances` rows to write back after the connection learned something (an IDDF): every
+* stored row stays — a row with no credential is still a paired appliance — and a row the
+* connection knows is replaced by its fresher version.
+*/
+function mergeAppliancesForPersist(storedAppliances, fromConnection) {
+	const stored = legacyRowsOf(storedAppliances);
+	const known = new Map(fromConnection.map((a) => [a.haId, a]));
+	const out = stored.map((row) => ({ ...known.get(row.haId) ?? row }));
+	for (const fresh of fromConnection) if (!stored.some((r) => r.haId === fresh.haId)) out.push({ ...fresh });
+	return out;
+}
 //#endregion
 //#region src/home-connect/home-connect-gateway.ts
+/**
+* Where devices find the client of their integration. A device that started before
+* its integration connected, or whose integration was restarted (a NEW client), still
+* hears about it: `watch` follows the integration, not one client instance.
+*/
 var HomeConnectConnectionResolver = class {
 	#surfaces = /* @__PURE__ */ new Map();
+	#watchers = /* @__PURE__ */ new Map();
 	set(integrationId, surface) {
-		if (surface === null) {
-			this.#surfaces.delete(integrationId);
-			return;
+		const previous = this.#surfaces.get(integrationId);
+		if (surface === null) this.#surfaces.delete(integrationId);
+		else this.#surfaces.set(integrationId, surface);
+		if (previous?.client === surface?.client) return;
+		for (const watcher of this.#watchers.get(integrationId) ?? []) {
+			watcher.detach?.();
+			watcher.detach = this.#attach(surface?.client ?? null, watcher);
+			watcher.listener({ kind: "client" });
 		}
-		this.#surfaces.set(integrationId, surface);
 	}
 	appliances(integrationId) {
 		return this.#surfaces.get(integrationId)?.appliances ?? [];
@@ -672,60 +1382,906 @@ var HomeConnectConnectionResolver = class {
 	getClient(integrationId) {
 		return this.#surfaces.get(integrationId)?.client ?? null;
 	}
+	/**
+	* Hear about everything that can change what `haId` shows: its features, its link,
+	* its description, and the client itself appearing, vanishing or being replaced.
+	*/
+	watch(integrationId, haId, listener) {
+		const watcher = {
+			haId,
+			listener,
+			detach: null
+		};
+		watcher.detach = this.#attach(this.getClient(integrationId), watcher);
+		const set = this.#watchers.get(integrationId) ?? /* @__PURE__ */ new Set();
+		set.add(watcher);
+		this.#watchers.set(integrationId, set);
+		return () => {
+			watcher.detach?.();
+			watcher.detach = null;
+			set.delete(watcher);
+		};
+	}
+	#attach(client, watcher) {
+		if (client === null) return null;
+		const unsubs = [client.onFeatureChange((haId, key) => {
+			if (haId === watcher.haId) watcher.listener({
+				kind: "feature",
+				key
+			});
+		}), client.onLinkChange((haId) => {
+			if (haId === watcher.haId) watcher.listener({ kind: "link" });
+		})];
+		const description = client.getDescription(watcher.haId);
+		if (description !== null) unsubs.push(description.onChange(() => watcher.listener({ kind: "description" })));
+		return () => {
+			for (const unsub of unsubs) unsub();
+		};
+	}
 	clear() {
-		this.#surfaces.clear();
+		for (const id of [...this.#surfaces.keys()]) this.set(id, null);
 	}
 };
 var homeConnectConnections = new HomeConnectConnectionResolver();
 //#endregion
-//#region src/home-connect/home-connect-ws-client.ts
-var WS_OPEN = 1;
-function programNamesFromLegacyList(programsRaw) {
-	const programs = [];
-	if (!Array.isArray(programsRaw)) return programs;
-	for (const p of programsRaw) if (typeof p === "string") programs.push(p);
-	return programs;
+//#region src/home-connect/home-connect-description-store.ts
+var ACCESS = [
+	"none",
+	"read",
+	"readWrite",
+	"writeOnly",
+	"readStatic"
+];
+/** Kind of a legacy description entity (stored before kinds were recorded), from its feature name. */
+function kindFromFeatureName(name) {
+	if (name.endsWith("Root.ActiveProgram")) return "activeProgram";
+	if (name.endsWith("Root.SelectedProgram")) return "selectedProgram";
+	if (name.includes(".Setting.")) return "setting";
+	if (name.includes(".Option.")) return "option";
+	if (name.includes(".Event.")) return "event";
+	if (name.includes(".Command.")) return "command";
+	if (name.includes(".Program.")) return "program";
+	return "status";
 }
-function programNamesFromHaDeviceDescription(programsRaw) {
-	const programs = [];
-	if (!Array.isArray(programsRaw)) return programs;
-	for (const p of programsRaw) if (typeof p === "object" && p !== null) {
-		const name = p["name"];
-		if (typeof name === "string") programs.push(name);
-	} else if (typeof p === "string") programs.push(p);
-	return programs;
+function overlayFromRow(row) {
+	const access = ACCESS.find((a) => a === row["access"]);
+	const num = (key) => {
+		const v = row[key];
+		return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+	};
+	const min = num("min");
+	const max = num("max");
+	const stepSize = num("stepSize");
+	return {
+		...typeof row["available"] === "boolean" ? { available: row["available"] } : {},
+		...access !== void 0 ? { access } : {},
+		...min !== void 0 ? { min } : {},
+		...max !== void 0 ? { max } : {},
+		...stepSize !== void 0 ? { stepSize } : {},
+		...row["default"] !== void 0 ? { defaultValue: row["default"] } : {}
+	};
 }
-function parseLegacyAppliancesList(rawList) {
-	if (!Array.isArray(rawList)) return [];
-	const appliances = [];
-	for (const item of rawList) {
-		if (typeof item !== "object" || item === null) continue;
-		const row = item;
-		const haId = row["haId"];
-		const name = row["name"];
-		const type = row["type"];
-		if (typeof haId !== "string") continue;
-		appliances.push({
-			haId,
-			name: typeof name === "string" ? name : haId,
-			type: typeof type === "string" ? type : "Dishwasher",
-			availablePrograms: programNamesFromLegacyList(row["programs"])
-		});
+/**
+* The live description of ONE appliance: the stored IDDF plus whatever the
+* appliance reported since (`/ro/descriptionChange`). The session decodes with it,
+* the devices read constraints from it; neither keeps a second copy.
+*/
+var HomeConnectDescriptionStore = class {
+	#base;
+	#programs;
+	#overlay = /* @__PURE__ */ new Map();
+	#listeners = /* @__PURE__ */ new Set();
+	#views = null;
+	constructor(initial) {
+		this.#base = entityIndexFromDescription(initial);
+		this.#programs = programsFromDescription(initial);
 	}
-	return appliances;
+	get state() {
+		return this.#base.size > 0 ? "complete" : "missing";
+	}
+	get size() {
+		return this.#base.size;
+	}
+	/** Swap in a freshly fetched description (the live overlay is dropped: it described the old one). */
+	replace(next) {
+		this.#base = entityIndexFromDescription(next);
+		this.#programs = programsFromDescription(next);
+		this.#overlay.clear();
+		this.#views = null;
+		this.#notify();
+	}
+	/** Apply description-change rows; returns the feature names whose constraints moved. */
+	applyChanges(rows) {
+		const touched = [];
+		for (const row of rows) {
+			const uid = row["uid"];
+			if (typeof uid !== "number") continue;
+			const base = this.#base.get(uid);
+			if (base === void 0) continue;
+			const next = overlayFromRow(row);
+			if (Object.keys(next).length === 0) continue;
+			this.#overlay.set(uid, {
+				...this.#overlay.get(uid),
+				...next
+			});
+			touched.push(base.name);
+		}
+		if (touched.length > 0) {
+			this.#views = null;
+			this.#notify();
+		}
+		return touched;
+	}
+	onChange(listener) {
+		this.#listeners.add(listener);
+		return () => this.#listeners.delete(listener);
+	}
+	#notify() {
+		for (const fn of this.#listeners) fn();
+	}
+	#resolved() {
+		if (this.#views !== null) return this.#views;
+		const out = /* @__PURE__ */ new Map();
+		for (const [uid, def] of this.#base) {
+			const overlay = this.#overlay.get(uid);
+			out.set(uid, {
+				...def,
+				...overlay,
+				kind: def.kind ?? kindFromFeatureName(def.name)
+			});
+		}
+		this.#views = out;
+		return out;
+	}
+	/** The decode / encode index: uid → entity with the overlay applied. */
+	index() {
+		return this.#resolved();
+	}
+	entity(uid) {
+		return this.#resolved().get(uid);
+	}
+	entityByName(name) {
+		for (const view of this.#resolved().values()) if (view.name === name) return view;
+	}
+	entityOfKind(kind) {
+		for (const view of this.#resolved().values()) if (view.kind === kind) return view;
+	}
+	entities() {
+		return [...this.#resolved().values()];
+	}
+	programs() {
+		return this.#programs;
+	}
+};
+//#endregion
+//#region src/home-connect/home-connect-tls-wire.ts
+function decodePsk64(psk64) {
+	return Buffer.from(`${psk64}===`, "base64url");
 }
-function parseHaDeviceDescription(record) {
-	const info = record["info"];
-	if (typeof info !== "object" || info === null) return [];
-	const infoRec = info;
-	const deviceID = infoRec["deviceID"];
-	if (typeof deviceID !== "string") return [];
-	const deviceType = infoRec["deviceType"];
-	const model = infoRec["model"];
-	return [{
-		haId: deviceID,
-		name: typeof model === "string" && model.length > 0 ? model : deviceID,
-		type: typeof deviceType === "string" ? deviceType : "Dishwasher",
+function parseHttpHeaders(buffer) {
+	const marker = buffer.indexOf("\r\n\r\n");
+	if (marker < 0) return null;
+	return {
+		headers: buffer.subarray(0, marker + 4),
+		rest: buffer.subarray(marker + 4)
+	};
+}
+function readWsFrame(buffer) {
+	if (buffer.length < 2) return null;
+	const b0 = buffer.at(0);
+	const b1 = buffer.at(1);
+	if (b0 === void 0 || b1 === void 0) return null;
+	const opcode = b0 & 15;
+	const masked = (b1 & 128) !== 0;
+	let payloadLen = b1 & 127;
+	let offset = 2;
+	if (payloadLen === 126) {
+		if (buffer.length < 4) return null;
+		payloadLen = buffer.readUInt16BE(2);
+		offset = 4;
+	} else if (payloadLen === 127) {
+		if (buffer.length < 10) return null;
+		payloadLen = Number(buffer.readBigUInt64BE(2));
+		offset = 10;
+	}
+	const maskLen = masked ? 4 : 0;
+	if (buffer.length < offset + maskLen + payloadLen) return null;
+	let payload = buffer.subarray(offset + maskLen, offset + maskLen + payloadLen);
+	if (masked) {
+		const mask = buffer.subarray(offset, offset + 4);
+		const unmasked = Buffer.alloc(payload.length);
+		for (let i = 0; i < payload.length; i += 1) unmasked[i] = (payload.at(i) ?? 0) ^ (mask.at(i % 4) ?? 0);
+		payload = unmasked;
+	}
+	return {
+		opcode,
+		payload,
+		consumed: offset + maskLen + payloadLen
+	};
+}
+/** One masked client frame (RFC 6455: every client-to-server frame is masked). */
+function writeWsFrame(opcode, payload) {
+	const mask = randomBytes(4);
+	const headerLen = payload.length < 126 ? 2 : payload.length < 65536 ? 4 : 10;
+	const frame = Buffer.alloc(headerLen + 4 + payload.length);
+	frame[0] = 128 | opcode;
+	if (payload.length < 126) {
+		frame[1] = 128 | payload.length;
+		mask.copy(frame, 2);
+		for (let i = 0; i < payload.length; i += 1) {
+			const pb = payload.at(i) ?? 0;
+			const mb = mask.at(i % 4) ?? 0;
+			frame[6 + i] = pb ^ mb;
+		}
+	} else if (payload.length < 65536) {
+		frame[1] = 254;
+		frame.writeUInt16BE(payload.length, 2);
+		mask.copy(frame, 4);
+		for (let i = 0; i < payload.length; i += 1) {
+			const pb = payload.at(i) ?? 0;
+			const mb = mask.at(i % 4) ?? 0;
+			frame[8 + i] = pb ^ mb;
+		}
+	} else {
+		frame[1] = 255;
+		frame.writeBigUInt64BE(BigInt(payload.length), 2);
+		mask.copy(frame, 10);
+		for (let i = 0; i < payload.length; i += 1) {
+			const pb = payload.at(i) ?? 0;
+			const mb = mask.at(i % 4) ?? 0;
+			frame[14 + i] = pb ^ mb;
+		}
+	}
+	return frame;
+}
+function createHomeConnectTlsWire(input) {
+	let socket = null;
+	let open = false;
+	const textListeners = /* @__PURE__ */ new Set();
+	const closedListeners = /* @__PURE__ */ new Set();
+	let recvBuffer = Buffer.alloc(0);
+	let upgraded = false;
+	let closeAnnounced = false;
+	function emitText(text) {
+		for (const fn of textListeners) fn(text);
+	}
+	function emitClosed() {
+		if (!open && !closeAnnounced) return;
+		open = false;
+		closeAnnounced = false;
+		for (const fn of closedListeners) fn();
+	}
+	function drainFrames() {
+		while (true) {
+			const parsed = readWsFrame(recvBuffer);
+			if (!parsed) return;
+			recvBuffer = Buffer.from(recvBuffer.subarray(parsed.consumed));
+			switch (parsed.opcode) {
+				case 9:
+					socket?.write(writeWsFrame(10, parsed.payload));
+					break;
+				case 8:
+					socket?.destroy();
+					break;
+				case 10: break;
+				default: if (parsed.payload.length > 0) emitText(parsed.payload.toString("utf8"));
+			}
+		}
+	}
+	return {
+		get open() {
+			return open;
+		},
+		async connect() {
+			if (open) return;
+			const psk = decodePsk64(input.psk);
+			await new Promise((resolve, reject) => {
+				socket = connect({
+					host: input.connectAddress,
+					port: 443,
+					servername: input.host,
+					ciphers: "PSK",
+					minVersion: "TLSv1.2",
+					maxVersion: "TLSv1.2",
+					rejectUnauthorized: false,
+					checkServerIdentity: () => void 0,
+					pskCallback: () => ({
+						psk,
+						identity: ""
+					})
+				}, () => {
+					const key = randomBytes(16).toString("base64");
+					const req = [
+						"GET /homeconnect HTTP/1.1",
+						`Host: ${input.host}`,
+						"Upgrade: websocket",
+						"Connection: Upgrade",
+						`Sec-WebSocket-Key: ${key}`,
+						"Sec-WebSocket-Version: 13",
+						"",
+						""
+					].join("\r\n");
+					socket?.write(req);
+				});
+				socket.on("data", (chunk) => {
+					recvBuffer = Buffer.concat([recvBuffer, chunk]);
+					if (!upgraded) {
+						const parsed = parseHttpHeaders(recvBuffer);
+						if (!parsed) return;
+						if (!(parsed.headers.toString("utf8").split("\r\n")[0] ?? "").includes("101")) {
+							reject(/* @__PURE__ */ new Error("Home Connect WebSocket upgrade failed"));
+							socket?.destroy();
+							return;
+						}
+						upgraded = true;
+						recvBuffer = Buffer.from(parsed.rest);
+						open = true;
+						closeAnnounced = true;
+						resolve();
+						drainFrames();
+						return;
+					}
+					drainFrames();
+				});
+				socket.on("error", (err) => {
+					reject(err);
+					socket?.destroy();
+				});
+				socket.on("close", () => emitClosed());
+			});
+		},
+		send(text) {
+			if (!socket || !open) throw new Error("Home Connect TLS wire not open");
+			socket.write(writeWsFrame(1, Buffer.from(text, "utf8")));
+		},
+		close() {
+			const closing = socket;
+			socket = null;
+			closing?.destroy();
+			emitClosed();
+		},
+		onText(listener) {
+			textListeners.add(listener);
+			return () => textListeners.delete(listener);
+		},
+		onClosed(listener) {
+			closedListeners.add(listener);
+			return () => closedListeners.delete(listener);
+		}
+	};
+}
+//#endregion
+//#region src/home-connect/home-connect-message.ts
+var HC_ACTION = {
+	GET: "GET",
+	POST: "POST",
+	RESPONSE: "RESPONSE",
+	NOTIFY: "NOTIFY"
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var ACTIONS = Object.values(HC_ACTION);
+function actionOf(raw) {
+	return ACTIONS.find((a) => a === raw) ?? null;
+}
+function loadHomeConnectMessage(raw) {
+	const row = JSON.parse(raw);
+	if (!isRecord(row)) throw new Error("Invalid Home Connect message");
+	const sID = row["sID"];
+	const msgID = row["msgID"];
+	const resource = row["resource"];
+	const version = row["version"];
+	const action = row["action"];
+	if (typeof sID !== "number" || typeof msgID !== "number" || typeof resource !== "string" || typeof version !== "number" || typeof action !== "string") throw new Error("Invalid Home Connect message fields");
+	const knownAction = actionOf(action);
+	if (knownAction === null) throw new Error(`Unknown Home Connect action: ${action}`);
+	let data;
+	const dataRaw = row["data"];
+	if (dataRaw !== void 0) data = (Array.isArray(dataRaw) ? dataRaw : [dataRaw]).filter(isRecord);
+	const code = row["code"];
+	return {
+		sID,
+		msgID,
+		resource,
+		version,
+		action: knownAction,
+		data,
+		code: typeof code === "number" ? code : void 0
+	};
+}
+function dumpHomeConnectMessage(input) {
+	const msg = {
+		sID: input.sID,
+		msgID: input.msgID,
+		resource: input.resource,
+		version: input.version,
+		action: input.action
+	};
+	if (input.data !== void 0) msg["data"] = Array.isArray(input.data) ? input.data : [input.data];
+	if (input.code !== void 0) msg["code"] = input.code;
+	return JSON.stringify(msg);
+}
+function responseTo(init, data) {
+	return {
+		sID: init.sID,
+		msgID: init.msgID,
+		resource: init.resource,
+		version: init.version,
+		action: HC_ACTION.RESPONSE,
+		data: [data]
+	};
+}
+//#endregion
+//#region src/home-connect/home-connect-session.ts
+var APP_NAME = "CamStack";
+var APP_ID = "camstack-hc";
+/** Max wait for appliance `/ei/initialValues` after the socket opens. */
+var HOME_CONNECT_INIT_RESOURCE_TIMEOUT_MS = 12e3;
+/** A response `code` at or above this is the appliance refusing the request. */
+var RESPONSE_ERROR_CODE_MIN = 400;
+function scalarFields(row) {
+	const out = {};
+	for (const [key, value] of Object.entries(row)) if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") out[key] = value;
+	return out;
+}
+var HomeConnectSession = class {
+	#wire;
+	#description;
+	#onFeature;
+	#onEmptyEntityIndex;
+	#onClosed;
+	#onInfo;
+	#onDescriptionChange;
+	#logger;
+	#logTags;
+	#keepaliveMs;
+	#requestTimeoutMs;
+	#sid = 0;
+	#nextMsgId = 1;
+	#serviceVersions = {};
+	#pending = /* @__PURE__ */ new Map();
+	#warnedUnknownUids = /* @__PURE__ */ new Set();
+	#warnedEmptyIndex = false;
+	#undecodableCount = 0;
+	#connected = false;
+	#closing = false;
+	#unsubText = null;
+	#unsubClosed = null;
+	#keepalive = null;
+	#missedProbes = 0;
+	constructor(options) {
+		this.#wire = options.wire;
+		this.#description = options.description;
+		this.#onFeature = options.onFeature;
+		this.#onEmptyEntityIndex = options.onEmptyEntityIndex;
+		this.#onClosed = options.onClosed;
+		this.#onInfo = options.onInfo;
+		this.#onDescriptionChange = options.onDescriptionChange;
+		this.#logger = options.logger;
+		this.#logTags = options.logTags ?? {};
+		this.#keepaliveMs = options.keepaliveMs ?? 3e4;
+		this.#requestTimeoutMs = options.requestTimeoutMs ?? 5e3;
+	}
+	get connected() {
+		return this.#connected;
+	}
+	async connect() {
+		if (this.#connected) return;
+		this.#closing = false;
+		this.#unsubText = this.#wire.onText((text) => this.#handleIncoming(text));
+		this.#unsubClosed = this.#wire.onClosed(() => this.#handleWireClosed());
+		try {
+			await this.#handshake();
+		} catch (err) {
+			await this.close();
+			throw err;
+		}
+		this.#connected = true;
+		this.#startKeepalive();
+	}
+	async #handshake() {
+		const initPromise = this.#waitForResource("/ei/initialValues");
+		await this.#wire.connect();
+		const init = loadHomeConnectMessage(await initPromise);
+		this.#sid = init.sID;
+		const edMsgId = (init.data?.[0])?.["edMsgID"];
+		if (typeof edMsgId === "number") this.#nextMsgId = edMsgId;
+		this.#wire.send(dumpHomeConnectMessage(responseTo(init, {
+			deviceType: init.version === 1 ? 2 : "Application",
+			deviceName: APP_NAME,
+			deviceID: APP_ID
+		})));
+		const services = await this.#sendGet("/ci/services", 1);
+		this.#setServiceVersions(services);
+		if (this.#serviceVersions["ei"] === 2) await this.#sendNotify("/ei/deviceReady");
+		if ("iz" in this.#serviceVersions) await this.#sendGet("/iz/info", this.#serviceVersions["iz"] ?? 1).catch(() => void 0);
+		const mandatory = await this.#sendGet("/ro/allMandatoryValues", this.#serviceVersions["ro"] ?? 1);
+		this.#applyValuePayload(mandatory.data);
+		if (this.#description.size === 0) this.#onEmptyEntityIndex?.();
+		await this.#loadOptionalResources();
+	}
+	/**
+	* Description changes and the info services are best-effort: an appliance that
+	* lacks one still serves values, and the failure is logged, not fatal.
+	*/
+	async #loadOptionalResources() {
+		const ro = this.#serviceVersions["ro"] ?? 1;
+		await this.#sendGet("/ro/allDescriptionChanges", ro).then((msg) => this.#applyDescriptionChanges(msg.data)).catch((err) => this.#warn("allDescriptionChanges unavailable", err));
+		for (const [service, resource] of [["ci", "/ci/info"], ["ni", "/ni/info"]]) {
+			if (!(service in this.#serviceVersions)) continue;
+			await this.#sendGet(resource, this.#serviceVersions[service] ?? 1).then((msg) => {
+				const row = msg.data?.[0];
+				if (row !== void 0) this.#onInfo?.(service, scalarFields(row));
+			}).catch((err) => this.#warn(`${resource} unavailable`, err));
+		}
+	}
+	/** Re-read every mandatory value (after the description arrived late, or a gap). */
+	async resync() {
+		if (!this.#connected) return;
+		const msg = await this.#sendGet("/ro/allMandatoryValues", this.#serviceVersions["ro"] ?? 1);
+		this.#applyValuePayload(msg.data);
+	}
+	async close() {
+		this.#closing = true;
+		this.#connected = false;
+		this.#stopKeepalive();
+		this.#unsubText?.();
+		this.#unsubText = null;
+		this.#unsubClosed?.();
+		this.#unsubClosed = null;
+		this.#rejectAllPending(/* @__PURE__ */ new Error("Home Connect session closed"));
+		this.#wire.close();
+	}
+	/**
+	* POST one value. The feature changes ONLY when the appliance confirms with a
+	* `/ro/values` notification — nothing is echoed here, so a refused write never
+	* leaves a value the appliance does not hold.
+	*/
+	async setFeatureByName(key, value) {
+		const encoded = encodeHomeConnectValue(key, value, this.#description.index());
+		if (!encoded) throw new Error(`Unknown Home Connect feature: ${key}`);
+		await this.#post("/ro/values", [{
+			uid: encoded.uid,
+			value: encoded.value
+		}]);
+	}
+	/** Select (not start) a program, with its option values. */
+	async selectProgram(programName, options = {}) {
+		if (!this.#description.entityOfKind("selectedProgram")) throw new Error("Home Connect appliance has no selected-program entity");
+		await this.#postProgram("/ro/selectedProgram", programName, options);
+	}
+	/** Start a program (the selected one when `programName` is omitted by the caller resolving it). */
+	async startProgram(programName, options = {}) {
+		if (!this.#description.entityOfKind("activeProgram")) throw new Error("Home Connect appliance has no active-program entity");
+		await this.#postProgram("/ro/activeProgram", programName, options);
+	}
+	async #postProgram(resource, programName, options) {
+		const program = this.#description.entityByName(programName);
+		if (!program || program.kind !== "program") throw new Error(`Unknown Home Connect program: ${programName}`);
+		const optionRows = [];
+		for (const [key, value] of Object.entries(options)) {
+			const encoded = encodeHomeConnectValue(key, value, this.#description.index());
+			if (!encoded) throw new Error(`Unknown Home Connect program option: ${key}`);
+			optionRows.push({
+				uid: encoded.uid,
+				value: encoded.value
+			});
+		}
+		await this.#post(resource, [{
+			program: program.uid,
+			...optionRows.length > 0 ? { options: optionRows } : {}
+		}]);
+	}
+	async #post(resource, data) {
+		if (!this.#connected) throw new Error("Home Connect session not connected");
+		const ro = this.#serviceVersions["ro"] ?? 1;
+		const response = await this.#sendAndWaitResponse({
+			sID: this.#sid,
+			msgID: this.#allocMsgId(),
+			resource,
+			version: ro,
+			action: HC_ACTION.POST,
+			data
+		});
+		if (response.code !== void 0 && response.code >= RESPONSE_ERROR_CODE_MIN) throw new Error(`Home Connect appliance refused ${resource} (code ${response.code})`);
+	}
+	#setServiceVersions(message) {
+		const versions = {};
+		for (const row of message.data ?? []) {
+			const service = row["service"];
+			const version = row["version"];
+			if (typeof service === "string" && typeof version === "number") versions[service] = version;
+		}
+		this.#serviceVersions = versions;
+	}
+	#applyValuePayload(data) {
+		if (!data) return;
+		for (const row of data) this.#applyUidRow(row);
+	}
+	#applyUidRow(row) {
+		const uidRaw = row["uid"];
+		if (typeof uidRaw !== "number") return;
+		const index = this.#description.index();
+		const entity = index.get(uidRaw);
+		if (entity === void 0) {
+			this.#noteUnknownUid(uidRaw, row["value"]);
+			return;
+		}
+		const value = row["value"];
+		if (entity.kind === "activeProgram" || entity.kind === "selectedProgram") {
+			this.#onFeature(entity.name, this.#programNameOf(value));
+			return;
+		}
+		const decoded = decodeHomeConnectValue(uidRaw, value, index);
+		if (decoded) this.#onFeature(decoded.key, decoded.value);
+	}
+	/** A program entity's value is the program's uid; `0` / absent = no program. */
+	#programNameOf(value) {
+		if (typeof value !== "number" || value === 0) return null;
+		return this.#description.entity(value)?.name ?? null;
+	}
+	#noteUnknownUid(uid, value) {
+		if (this.#description.size === 0) {
+			if (!this.#warnedEmptyIndex) {
+				this.#warnedEmptyIndex = true;
+				this.#onEmptyEntityIndex?.();
+			}
+		}
+		if (this.#warnedUnknownUids.has(uid)) return;
+		this.#warnedUnknownUids.add(uid);
+		this.#logger?.warn("Home Connect value for a uid the description does not list — dropped", {
+			tags: this.#logTags,
+			meta: {
+				uid,
+				valueType: typeof value
+			}
+		});
+	}
+	#applyDescriptionChanges(data) {
+		if (!data) return;
+		const touched = this.#description.applyChanges(data);
+		if (touched.length > 0) this.#onDescriptionChange?.(touched);
+	}
+	#applyProgramNotify(data, kind) {
+		const row = data?.[0];
+		if (row === void 0) return;
+		const entity = this.#description.entityOfKind(kind === "active" ? "activeProgram" : "selectedProgram");
+		if (entity !== void 0) this.#onFeature(entity.name, this.#programNameOf(row["program"]));
+		const options = row["options"];
+		if (Array.isArray(options)) {
+			for (const option of options) if (typeof option === "object" && option !== null && !Array.isArray(option)) this.#applyUidRow({ ...option });
+		}
+	}
+	#handleIncoming(text) {
+		let message;
+		try {
+			message = loadHomeConnectMessage(text);
+		} catch (err) {
+			this.#noteUndecodable(err);
+			return;
+		}
+		if (message.action === HC_ACTION.RESPONSE) {
+			const waiter = this.#pending.get(message.msgID);
+			if (waiter) {
+				clearTimeout(waiter.timer);
+				this.#pending.delete(message.msgID);
+				waiter.resolve(message);
+			}
+			return;
+		}
+		if (message.action !== HC_ACTION.NOTIFY) return;
+		switch (message.resource) {
+			case "/ro/values":
+				this.#applyValuePayload(message.data);
+				return;
+			case "/ro/descriptionChange":
+			case "/ro/allDescriptionChanges":
+				this.#applyDescriptionChanges(message.data);
+				return;
+			case "/ro/activeProgram":
+				this.#applyProgramNotify(message.data, "active");
+				return;
+			case "/ro/selectedProgram":
+				this.#applyProgramNotify(message.data, "selected");
+				return;
+			default: return;
+		}
+	}
+	/** Warn on the first undecodable frame, then at powers of ten — a stuck peer must not flood the log. */
+	#noteUndecodable(err) {
+		this.#undecodableCount += 1;
+		const n = this.#undecodableCount;
+		if (n !== 1 && n !== 10 && n !== 100 && n % 1e3 !== 0) return;
+		this.#logger?.warn("Home Connect frame dropped — undecodable", {
+			tags: this.#logTags,
+			meta: {
+				error: errMsg(err),
+				droppedSoFar: n
+			}
+		});
+	}
+	#warn(message, err) {
+		this.#logger?.warn(`Home Connect ${message}`, {
+			tags: this.#logTags,
+			meta: { error: errMsg(err) }
+		});
+	}
+	#handleWireClosed() {
+		if (this.#closing) return;
+		const wasConnected = this.#connected;
+		this.#connected = false;
+		this.#stopKeepalive();
+		this.#rejectAllPending(/* @__PURE__ */ new Error("Home Connect wire closed"));
+		if (wasConnected) this.#onClosed?.("wire closed");
+	}
+	#startKeepalive() {
+		this.#stopKeepalive();
+		this.#missedProbes = 0;
+		if (this.#keepaliveMs <= 0) return;
+		this.#keepalive = setInterval(() => {
+			this.#probe();
+		}, this.#keepaliveMs);
+	}
+	#stopKeepalive() {
+		if (this.#keepalive !== null) clearInterval(this.#keepalive);
+		this.#keepalive = null;
+	}
+	/**
+	* A cheap request the appliance must answer. A dead socket that never reports
+	* closed (NAT drop, appliance power loss) surfaces here as a timeout, and the
+	* session is torn down so the owner reconnects.
+	*/
+	async #probe() {
+		if (!this.#connected) return;
+		try {
+			await this.#sendGet("/ci/services", 1);
+			this.#missedProbes = 0;
+		} catch (err) {
+			if (!this.#connected) return;
+			this.#missedProbes += 1;
+			if (this.#missedProbes < 3) return;
+			this.#warn("keepalive failed repeatedly — dropping the connection", err);
+			this.#wire.close();
+		}
+	}
+	#waitForResource(resource) {
+		return new Promise((resolve, reject) => {
+			let settled = false;
+			const finish = (fn) => {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timer);
+				unsubText();
+				unsubClosed();
+				fn();
+			};
+			const unsubText = this.#wire.onText((text) => {
+				try {
+					if (loadHomeConnectMessage(text).resource === resource) finish(() => resolve(text));
+				} catch {}
+			});
+			const unsubClosed = this.#wire.onClosed(() => {
+				finish(() => reject(/* @__PURE__ */ new Error("Home Connect wire closed before init")));
+			});
+			const timer = setTimeout(() => {
+				finish(() => reject(/* @__PURE__ */ new Error(`Home Connect init timeout waiting for ${resource}`)));
+			}, HOME_CONNECT_INIT_RESOURCE_TIMEOUT_MS);
+		});
+	}
+	async #sendGet(resource, version) {
+		return this.#sendAndWaitResponse({
+			sID: this.#sid,
+			msgID: this.#allocMsgId(),
+			resource,
+			version,
+			action: HC_ACTION.GET
+		});
+	}
+	async #sendNotify(resource) {
+		const msg = {
+			sID: this.#sid,
+			msgID: this.#allocMsgId(),
+			resource,
+			version: this.#serviceVersions[resource.slice(1, 3)] ?? 1,
+			action: HC_ACTION.NOTIFY
+		};
+		this.#wire.send(dumpHomeConnectMessage(msg));
+	}
+	#allocMsgId() {
+		const id = this.#nextMsgId;
+		this.#nextMsgId += 1;
+		return id;
+	}
+	#rejectAllPending(err) {
+		for (const pending of this.#pending.values()) {
+			clearTimeout(pending.timer);
+			pending.reject(err);
+		}
+		this.#pending.clear();
+	}
+	async #sendAndWaitResponse(outgoing) {
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				if (this.#pending.delete(outgoing.msgID)) reject(/* @__PURE__ */ new Error(`Home Connect response timeout for ${outgoing.resource}`));
+			}, this.#requestTimeoutMs);
+			this.#pending.set(outgoing.msgID, {
+				resource: outgoing.resource,
+				resolve,
+				reject,
+				timer
+			});
+			try {
+				this.#wire.send(dumpHomeConnectMessage(outgoing));
+			} catch (err) {
+				clearTimeout(timer);
+				this.#pending.delete(outgoing.msgID);
+				reject(err instanceof Error ? err : new Error(errMsg(err)));
+			}
+		});
+	}
+};
+//#endregion
+//#region src/home-connect/home-connect-ws-client.ts
+/** Feature-name prefixes for the fields `/ci/info` and `/ni/info` carry (no IDDF entity declares them). */
+var HOME_CONNECT_INFO_PREFIX = "HomeConnect.Info.";
+var HOME_CONNECT_NETWORK_PREFIX = "HomeConnect.Network.";
+/** Reconnect delays after a dropped or refused socket; the last one repeats. */
+var HOME_CONNECT_RECONNECT_BACKOFF_MS = [
+	1e3,
+	2e3,
+	5e3,
+	1e4,
+	3e4,
+	6e4
+];
+var WS_OPEN = 1;
+function programNamesFromLegacyList(programsRaw) {
+	const programs = [];
+	if (!Array.isArray(programsRaw)) return programs;
+	for (const p of programsRaw) if (typeof p === "string") programs.push(p);
+	return programs;
+}
+function programNamesFromHaDeviceDescription(programsRaw) {
+	const programs = [];
+	if (!Array.isArray(programsRaw)) return programs;
+	for (const p of programsRaw) if (isPlainObject(p)) {
+		const name = p["name"];
+		if (typeof name === "string") programs.push(name);
+	} else if (typeof p === "string") programs.push(p);
+	return programs;
+}
+function parseLegacyAppliancesList(rawList) {
+	if (!Array.isArray(rawList)) return [];
+	const appliances = [];
+	for (const item of rawList) {
+		if (!isPlainObject(item)) continue;
+		const row = item;
+		const haId = row["haId"];
+		const name = row["name"];
+		const type = row["type"];
+		if (typeof haId !== "string") continue;
+		appliances.push({
+			haId,
+			name: typeof name === "string" ? name : haId,
+			type: typeof type === "string" ? type : "Dishwasher",
+			availablePrograms: programNamesFromLegacyList(row["programs"])
+		});
+	}
+	return appliances;
+}
+function parseHaDeviceDescription(record) {
+	const info = record["info"];
+	if (!isPlainObject(info)) return [];
+	const infoRec = info;
+	const deviceID = infoRec["deviceID"];
+	if (typeof deviceID !== "string") return [];
+	const deviceType = infoRec["deviceType"];
+	const model = infoRec["model"];
+	return [{
+		haId: deviceID,
+		name: typeof model === "string" && model.length > 0 ? model : deviceID,
+		type: typeof deviceType === "string" ? deviceType : "Dishwasher",
 		availablePrograms: programNamesFromHaDeviceDescription(record["program"])
 	}];
 }
@@ -753,10 +2309,233 @@ function parseDeviceDescription(input) {
 		return { appliances: [] };
 	}
 }
+function usesProtocolStack(config, deps) {
+	if (deps.wireFactory) return true;
+	return config.mode === "TLS";
+}
+async function resolveConnectAddress(host) {
+	try {
+		const result = await lookup(host, { verbatim: true });
+		return typeof result === "string" ? result : result.address;
+	} catch {
+		return host.replace(/^https?:\/\//, "").split("/")[0] ?? host;
+	}
+}
+var defaultWireFactory = (input) => {
+	if (input.mode === "TLS") return createHomeConnectTlsWire({
+		host: input.host,
+		connectAddress: input.connectAddress,
+		psk: input.psk
+	});
+	throw new Error("Home Connect AES local socket is not implemented — use TLS pairing");
+};
 function createHomeConnectWsClient(config, deps = {}) {
-	const wsFactory = deps.wsFactory ?? defaultWsFactory;
-	const url = homeConnectWsUrl(config);
 	const appliances = [...parseDeviceDescription(config.deviceDescription).appliances];
+	const description = new HomeConnectDescriptionStore(config.deviceDescription);
+	const primaryHaId = appliances[0]?.haId ?? config.host;
+	if (usesProtocolStack(config, deps)) return createProtocolHomeConnectClient({
+		config,
+		appliances,
+		description,
+		primaryHaId,
+		wireFactory: deps.wireFactory ?? defaultWireFactory,
+		deps
+	});
+	if (description.size > 0 && config.mode === "AES") deps.onProtocolWarn?.("aes-legacy-fallback-with-entities");
+	return createLegacySubscribeClient(config, deps, appliances);
+}
+function infoFeatureName(service, field) {
+	return `${service === "ci" ? HOME_CONNECT_INFO_PREFIX : HOME_CONNECT_NETWORK_PREFIX}${field}`;
+}
+function createProtocolHomeConnectClient(input) {
+	const { deps, description } = input;
+	const featureStore = /* @__PURE__ */ new Map();
+	const listeners = /* @__PURE__ */ new Set();
+	const linkListeners = /* @__PURE__ */ new Set();
+	const backoff = deps.backoffMs ?? HOME_CONNECT_RECONNECT_BACKOFF_MS;
+	const jitter = deps.random ?? Math.random;
+	const haId = input.primaryHaId;
+	let session = null;
+	let link = "disconnected";
+	let wanted = false;
+	let attempt = 0;
+	let retryTimer = null;
+	let opening = null;
+	let warnedEmptyIndex = false;
+	function ensureFeatures() {
+		let map = featureStore.get(haId);
+		if (!map) {
+			map = /* @__PURE__ */ new Map();
+			featureStore.set(haId, map);
+		}
+		return map;
+	}
+	function applyFeature(key, value) {
+		ensureFeatures().set(key, value);
+		for (const fn of listeners) fn(haId, key, value);
+	}
+	function setLink(next) {
+		if (link === next) return;
+		link = next;
+		for (const fn of linkListeners) fn(haId, next);
+	}
+	function applyInfo(service, fields) {
+		for (const [field, value] of Object.entries(fields)) applyFeature(infoFeatureName(service, field), value);
+	}
+	function dropSession() {
+		session = null;
+		ensureFeatures().clear();
+		setLink("disconnected");
+	}
+	async function openOnce() {
+		setLink("connecting");
+		const connectAddress = await (deps.resolveAddress ?? resolveConnectAddress)(input.config.host);
+		if (!wanted) throw new Error("Home Connect client closed");
+		const next = new HomeConnectSession({
+			wire: input.wireFactory({
+				host: input.config.host,
+				connectAddress,
+				psk: input.config.psk,
+				mode: input.config.mode,
+				iv64: input.config.iv64
+			}),
+			description,
+			onFeature: applyFeature,
+			onInfo: applyInfo,
+			onDescriptionChange: (names) => {
+				for (const name of names) for (const fn of listeners) fn(haId, name, ensureFeatures().get(name));
+			},
+			onEmptyEntityIndex: () => {
+				if (warnedEmptyIndex) return;
+				warnedEmptyIndex = true;
+				deps.onProtocolWarn?.("empty-entity-index");
+			},
+			onClosed: (reason) => {
+				if (session !== next) return;
+				deps.logger?.warn("Home Connect link dropped — reconnecting", {
+					tags: deps.logTags ?? {},
+					meta: {
+						haId,
+						reason
+					}
+				});
+				dropSession();
+				scheduleReconnect();
+			},
+			logger: deps.logger,
+			logTags: deps.logTags,
+			keepaliveMs: deps.keepaliveMs
+		});
+		session = next;
+		try {
+			await next.connect();
+		} catch (err) {
+			if (session === next) session = null;
+			throw err;
+		}
+		if (!wanted) {
+			if (session === next) session = null;
+			await next.close();
+			throw new Error("Home Connect client closed");
+		}
+		attempt = 0;
+		setLink("connected");
+	}
+	function scheduleReconnect() {
+		if (!wanted || retryTimer !== null) return;
+		const base = backoff[Math.min(attempt, backoff.length - 1)] ?? 6e4;
+		const delay = Math.round(base * (1 + (jitter() - .5) * .4));
+		attempt += 1;
+		retryTimer = setTimeout(() => {
+			retryTimer = null;
+			if (!wanted || opening !== null || link === "connected") return;
+			opening = openOnce().catch((err) => {
+				deps.logger?.warn("Home Connect reconnect failed", {
+					tags: deps.logTags ?? {},
+					meta: {
+						haId,
+						attempt,
+						error: errMsg(err)
+					}
+				});
+				setLink("disconnected");
+				scheduleReconnect();
+			}).finally(() => {
+				opening = null;
+			});
+		}, delay);
+	}
+	return {
+		async connect() {
+			wanted = true;
+			if (retryTimer !== null) clearTimeout(retryTimer);
+			retryTimer = null;
+			if (link === "connected") return;
+			if (opening !== null) return opening;
+			const attemptPromise = openOnce();
+			opening = attemptPromise.then(() => void 0, () => void 0);
+			try {
+				await attemptPromise;
+			} catch (err) {
+				setLink("disconnected");
+				scheduleReconnect();
+				throw err;
+			} finally {
+				opening = null;
+			}
+		},
+		close() {
+			wanted = false;
+			if (retryTimer !== null) clearTimeout(retryTimer);
+			retryTimer = null;
+			const closing = session;
+			session = null;
+			ensureFeatures().clear();
+			setLink("disconnected");
+			if (closing) closing.close();
+		},
+		getAppliances() {
+			return input.appliances;
+		},
+		getFeatures(targetHaId) {
+			if (targetHaId !== haId && !featureStore.has(targetHaId)) return /* @__PURE__ */ new Map();
+			return featureStore.get(targetHaId) ?? ensureFeatures();
+		},
+		async setFeature(targetHaId, key, value) {
+			await requireSession(session, targetHaId, haId).setFeatureByName(key, value);
+		},
+		onFeatureChange(listener) {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		},
+		getLinkState: () => link,
+		onLinkChange(listener) {
+			linkListeners.add(listener);
+			return () => linkListeners.delete(listener);
+		},
+		getDescription: (targetHaId) => targetHaId === haId ? description : null,
+		async setDescription(targetHaId, next) {
+			if (targetHaId !== haId) throw new Error(`Unknown appliance ${targetHaId}`);
+			description.replace(next);
+			await session?.resync();
+		},
+		async selectProgram(targetHaId, program, options) {
+			await requireSession(session, targetHaId, haId).selectProgram(program, options);
+		},
+		async startProgram(targetHaId, program, options) {
+			await requireSession(session, targetHaId, haId).startProgram(program, options);
+		}
+	};
+}
+function requireSession(session, targetHaId, haId) {
+	if (!session?.connected) throw new Error("Home Connect WebSocket not connected");
+	if (targetHaId !== haId) throw new Error(`Unknown appliance ${targetHaId}`);
+	return session;
+}
+function createLegacySubscribeClient(config, deps, appliances) {
+	const linkListeners = /* @__PURE__ */ new Set();
+	const wsFactory = deps.wsFactory ?? defaultWsFactoryLegacy;
+	const url = homeConnectWsUrl(config);
 	const featureStore = /* @__PURE__ */ new Map();
 	const listeners = /* @__PURE__ */ new Set();
 	let ws = null;
@@ -781,6 +2560,7 @@ function createHomeConnectWsClient(config, deps = {}) {
 				ws = socket;
 				const onOpen = () => {
 					connected = true;
+					for (const app of appliances) for (const fn of linkListeners) fn(app.haId, "connected");
 					socket.removeEventListener("open", onOpen);
 					socket.removeEventListener("error", onError);
 					for (const app of appliances) socket.send(JSON.stringify({
@@ -797,31 +2577,12 @@ function createHomeConnectWsClient(config, deps = {}) {
 				socket.addEventListener("message", (ev) => {
 					if (!ev.data) return;
 					try {
-						const msg = JSON.parse(ev.data);
-						if (typeof msg !== "object" || msg === null) return;
-						const row = msg;
+						const row = JSON.parse(ev.data);
+						if (!isPlainObject(row)) return;
 						if (row["type"] === "feature") {
-							const haId = row["haId"];
+							const msgHaId = row["haId"];
 							const key = row["key"];
-							if (typeof haId === "string" && typeof key === "string") applyFeature(haId, key, row["value"]);
-						}
-						if (row["type"] === "appliance") {
-							const haId = row["haId"];
-							const name = row["name"];
-							const type = row["type"];
-							const programs = row["programs"];
-							if (typeof haId === "string") {
-								const programList = [];
-								if (Array.isArray(programs)) {
-									for (const p of programs) if (typeof p === "string") programList.push(p);
-								}
-								appliances.push({
-									haId,
-									name: typeof name === "string" ? name : haId,
-									type: typeof type === "string" ? type : "Dishwasher",
-									availablePrograms: programList
-								});
-							}
+							if (typeof msgHaId === "string" && typeof key === "string") applyFeature(msgHaId, key, row["value"]);
 						}
 					} catch {}
 				});
@@ -846,20 +2607,33 @@ function createHomeConnectWsClient(config, deps = {}) {
 				key,
 				value
 			}));
-			applyFeature(haId, key, value);
 		},
 		onFeatureChange(listener) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
+		},
+		getLinkState: () => connected ? "connected" : "disconnected",
+		onLinkChange(listener) {
+			linkListeners.add(listener);
+			return () => linkListeners.delete(listener);
+		},
+		getDescription: () => null,
+		async setDescription() {
+			throw new Error("Home Connect AES local socket has no description model");
+		},
+		async selectProgram() {
+			throw new Error("Home Connect AES local socket cannot select a program");
+		},
+		async startProgram() {
+			throw new Error("Home Connect AES local socket cannot start a program");
 		}
 	};
 }
 function isWsLike(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const ws = value;
-	return typeof ws["readyState"] === "number" && typeof ws["send"] === "function" && typeof ws["close"] === "function" && typeof ws["addEventListener"] === "function" && typeof ws["removeEventListener"] === "function";
+	if (!isPlainObject(value)) return false;
+	return typeof value["readyState"] === "number" && typeof value["send"] === "function" && typeof value["close"] === "function" && typeof value["addEventListener"] === "function" && typeof value["removeEventListener"] === "function";
 }
-function defaultWsFactory(url) {
+function defaultWsFactoryLegacy(url) {
 	const WS = globalThis.WebSocket;
 	if (typeof WS !== "function") throw new Error(`WebSocket unavailable — cannot connect to ${url}`);
 	const socket = new WS(url);
@@ -887,14 +2661,23 @@ function accountClient(appliances, makeGateway) {
 	const children = /* @__PURE__ */ new Map();
 	for (const app of appliances) children.set(app.haId, makeGateway(app.connection));
 	const listeners = /* @__PURE__ */ new Set();
+	const linkListeners = /* @__PURE__ */ new Set();
 	const unsubs = [];
-	for (const [haId, child] of children) unsubs.push(child.onFeatureChange((eventHaId, key, value) => {
+	for (const [haId, member] of children) unsubs.push(member.onFeatureChange((eventHaId, key, value) => {
 		const id = eventHaId.length > 0 ? eventHaId : haId;
 		for (const fn of listeners) fn(id, key, value);
+	}), member.onLinkChange((eventHaId, state) => {
+		const id = eventHaId.length > 0 ? eventHaId : haId;
+		for (const fn of linkListeners) fn(id, state);
 	}));
+	function member(haId) {
+		const found = children.get(haId);
+		if (!found) throw new Error(`Home Connect appliance ${haId} is not on this account`);
+		return found;
+	}
 	return {
 		async connect() {
-			const results = await Promise.allSettled([...children.values()].map((child) => child.connect()));
+			const results = await Promise.allSettled([...children.values()].map((c) => c.connect()));
 			if (results.length > 0 && results.every((result) => result.status === "rejected")) {
 				const first = results[0];
 				if (first?.status === "rejected") throw first.reason;
@@ -902,26 +2685,153 @@ function accountClient(appliances, makeGateway) {
 		},
 		close() {
 			for (const unsub of unsubs) unsub();
-			for (const child of children.values()) child.close();
+			for (const c of children.values()) c.close();
 		},
 		getAppliances: () => listed,
 		getFeatures(haId) {
 			return children.get(haId)?.getFeatures(haId) ?? /* @__PURE__ */ new Map();
 		},
 		async setFeature(haId, key, value) {
-			const child = children.get(haId);
-			if (!child) throw new Error(`Home Connect appliance ${haId} is not on this account`);
-			await child.setFeature(haId, key, value);
+			await member(haId).setFeature(haId, key, value);
 		},
 		onFeatureChange(listener) {
 			listeners.add(listener);
 			return () => listeners.delete(listener);
+		},
+		getLinkState: (haId) => children.get(haId)?.getLinkState(haId) ?? "disconnected",
+		onLinkChange(listener) {
+			linkListeners.add(listener);
+			return () => linkListeners.delete(listener);
+		},
+		getDescription: (haId) => children.get(haId)?.getDescription(haId) ?? null,
+		async setDescription(haId, description) {
+			await member(haId).setDescription(haId, description);
+		},
+		async selectProgram(haId, program, options) {
+			await member(haId).selectProgram(haId, program, options);
+		},
+		async startProgram(haId, program, options) {
+			await member(haId).startProgram(haId, program, options);
 		}
 	};
 }
 //#endregion
-//#region src/home-connect/home-connect-integration-manager.ts
-function storedAppliance(row) {
+//#region src/home-connect/home-connect-iddf-fetch.ts
+function entityCountInStoredDescription(description) {
+	if (description === void 0) return 0;
+	return entityIndexFromDescription(description).size;
+}
+async function fetchHomeConnectIddfCompact(haId, token, fetchImpl) {
+	const response = await fetchImpl(HOME_CONNECT_IDDF_URL(haId), {
+		method: "GET",
+		headers: {
+			authorization: `Bearer ${token}`,
+			accept: "application/zip"
+		},
+		redirect: "manual"
+	});
+	if (response.status >= 400 || !response.arrayBuffer) return null;
+	const bytes = await response.arrayBuffer();
+	return parseIddfZipBuffer(Buffer.from(bytes), haId);
+}
+function compactDescriptionToStored(compact) {
+	return JSON.parse(JSON.stringify(compact));
+}
+function entityCountForCompact(compact) {
+	if (compact === null) return 0;
+	return entityIndexFromDescription(JSON.parse(JSON.stringify(compact))).size;
+}
+/**
+* Fill missing or outdated IDDF entity maps on stored appliances (TLS first).
+* An appliance whose IDDF cannot be fetched keeps whatever it had and is listed in
+* `missing` so the caller can retry — the entity map of ANOTHER model is never
+* substituted: the UIDs differ per model and a wrong map decodes values into the
+* wrong features.
+*/
+async function enrichHomeConnectConnection(connection, fetchImpl, hooks = {}) {
+	const appliances = connection.appliances ?? [];
+	if (appliances.length === 0) return {
+		connection,
+		changed: false,
+		missing: []
+	};
+	const token = connection.token;
+	if (isSecretMarker(token) || isSecretMarkerLike(token)) return {
+		connection,
+		changed: false,
+		missing: unmapped(appliances)
+	};
+	let changed = false;
+	const nextAppliances = [];
+	for (const row of appliances) {
+		if (!(row.mode === "TLS" && !isCurrentDescription(row.deviceDescription))) {
+			nextAppliances.push(row);
+			continue;
+		}
+		let compact = null;
+		try {
+			compact = await fetchHomeConnectIddfCompact(row.haId, token, fetchImpl);
+		} catch (err) {
+			hooks.onInfo?.("Home Connect IDDF fetch failed", {
+				haId: row.haId,
+				error: errMsg(err)
+			});
+		}
+		if (compact === null || entityCountForCompact(compact) === 0) {
+			hooks.onInfo?.("Home Connect IDDF unavailable — appliance stays degraded until it loads", { haId: row.haId });
+			nextAppliances.push(row);
+			continue;
+		}
+		changed = true;
+		nextAppliances.push({
+			...row,
+			deviceDescription: compactDescriptionToStored(compact)
+		});
+	}
+	return {
+		connection: changed ? {
+			...connection,
+			appliances: nextAppliances
+		} : connection,
+		changed,
+		missing: unmapped(nextAppliances)
+	};
+}
+function unmapped(appliances) {
+	return appliances.filter((a) => a.mode === "TLS" && entityCountInStoredDescription(a.deviceDescription) === 0).map((a) => a.haId);
+}
+//#endregion
+//#region src/home-connect/home-connect-stored-appliance.ts
+function stubDeviceDescriptionObject(row) {
+	return { info: {
+		deviceID: row.haId,
+		deviceType: row.type,
+		model: row.name
+	} };
+}
+function stubDeviceDescription(row) {
+	return JSON.stringify(stubDeviceDescriptionObject(row));
+}
+function serializedDeviceDescription(row) {
+	if (row.deviceDescription === void 0) return stubDeviceDescription(row);
+	if (typeof row.deviceDescription === "string") return row.deviceDescription;
+	return JSON.stringify(row.deviceDescription);
+}
+function isDescriptionRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseLoginDeviceDescription(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return {};
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (isDescriptionRecord(parsed)) return { deviceDescription: parsed };
+	} catch {
+		return {};
+	}
+	return {};
+}
+function listedApplianceFromStored(row) {
 	return {
 		haId: row.haId,
 		name: row.name,
@@ -931,21 +2841,70 @@ function storedAppliance(row) {
 			psk: row.psk,
 			mode: row.mode,
 			iv64: row.iv64 ?? "",
-			deviceDescription: JSON.stringify({ info: {
-				deviceID: row.haId,
-				deviceType: row.type,
-				model: row.name
-			} })
+			deviceDescription: serializedDeviceDescription(row)
 		}
 	};
 }
-async function openStoredOrAccount(connection) {
-	const stored = connection.appliances ?? [];
-	if (stored.length > 0) return accountClient(stored.map(storedAppliance), defaultHomeConnectWsClientFactory);
-	return openHomeConnectAccount({
-		token: connection.token,
-		refresh: connection.refresh ?? ""
-	});
+//#endregion
+//#region src/home-connect/home-connect-integration-manager.ts
+/** Delays between IDDF fetch retries for an appliance that has no entity map; the last repeats. */
+var HOME_CONNECT_IDDF_RETRY_MS = [
+	3e4,
+	6e4,
+	12e4,
+	3e5,
+	6e5
+];
+async function openStoredOrAccount(connection, deps) {
+	let working = connection;
+	let missing = [];
+	if ((working.appliances ?? []).length > 0) {
+		const token = working.token;
+		if (isSecretMarker(token) || isSecretMarkerLike(token)) deps.logger?.warn("Home Connect skipping IDDF enrich — access token not resolved yet", {
+			tags: { integrationId: deps.integrationId },
+			meta: { tokenIsSecretMarker: isSecretMarker(token) }
+		});
+		const enriched = await enrichHomeConnectConnection(working, deps.fetchImpl ?? homeConnectLoginFetch, { onInfo: (message, meta) => {
+			deps.logger?.info(message, {
+				tags: { integrationId: deps.integrationId },
+				meta
+			});
+		} });
+		working = enriched.connection;
+		missing = enriched.missing;
+		if (enriched.changed) deps.logger?.info("Home Connect enriched appliance IDDF from cloud", {
+			tags: { integrationId: deps.integrationId },
+			meta: { applianceCount: working.appliances?.length ?? 0 }
+		});
+		for (const haId of missing) deps.logger?.warn("Home Connect appliance has no IDDF entity map — publishing it degraded and retrying the fetch", {
+			tags: { integrationId: deps.integrationId },
+			meta: { haId }
+		});
+		const warnProtocol = (code) => {
+			deps.logger?.warn("Home Connect local protocol warning", {
+				tags: { integrationId: deps.integrationId },
+				meta: { code }
+			});
+		};
+		return {
+			connection: working,
+			missing,
+			client: accountClient((working.appliances ?? []).map(listedApplianceFromStored), (gateway) => createHomeConnectWsClient(gateway, {
+				onProtocolWarn: warnProtocol,
+				logger: deps.logger,
+				logTags: { integrationId: deps.integrationId }
+			}))
+		};
+	}
+	return {
+		connection: working,
+		missing,
+		client: await openHomeConnectAccount({
+			token: working.token,
+			refresh: working.refresh ?? "",
+			fetchImpl: deps.fetchImpl
+		})
+	};
 }
 var HomeConnectIntegrationManager = class {
 	#id;
@@ -956,10 +2915,18 @@ var HomeConnectIntegrationManager = class {
 	#onDisconnected;
 	#surfaceSink;
 	#makeClient;
+	#fetchImpl;
+	#onConnectionUpdated;
+	#iddfRetryMs;
 	#client = null;
+	#unsubLink = null;
+	#links = /* @__PURE__ */ new Map();
 	#status = "disconnected";
 	#lastCheckedAt = null;
 	#error = null;
+	#missing = [];
+	#iddfAttempt = 0;
+	#iddfTimer = null;
 	constructor(options) {
 		this.#id = options.id;
 		this.#name = options.name;
@@ -969,6 +2936,9 @@ var HomeConnectIntegrationManager = class {
 		this.#onDisconnected = options.onDisconnected;
 		this.#surfaceSink = options.surfaceSink;
 		this.#makeClient = options.makeClient ?? null;
+		this.#fetchImpl = options.fetchImpl;
+		this.#onConnectionUpdated = options.onConnectionUpdated;
+		this.#iddfRetryMs = options.iddfRetryMs ?? HOME_CONNECT_IDDF_RETRY_MS;
 	}
 	getConnection() {
 		return this.#connection;
@@ -980,7 +2950,10 @@ var HomeConnectIntegrationManager = class {
 			name: this.#name,
 			kind: "home-connect",
 			status: this.#status,
-			info: { applianceCount },
+			info: {
+				applianceCount,
+				descriptionMissing: [...this.#missing]
+			},
 			lastCheckedAt: this.#lastCheckedAt,
 			error: this.#error
 		};
@@ -989,8 +2962,23 @@ var HomeConnectIntegrationManager = class {
 		if (this.#client !== null) return;
 		this.#status = "connecting";
 		this.#error = null;
-		const client = this.#makeClient ? this.#makeClient(this.#connection) : await openStoredOrAccount(this.#connection);
+		const before = this.#connection;
+		let client;
+		if (this.#makeClient) client = this.#makeClient(this.#connection);
+		else {
+			const opened = await openStoredOrAccount(this.#connection, {
+				integrationId: this.#id,
+				fetchImpl: this.#fetchImpl,
+				logger: this.#logger
+			});
+			client = opened.client;
+			this.#connection = opened.connection;
+			this.#missing = opened.missing;
+			if (!sameHomeConnectConnection(before, this.#connection)) this.#onConnectionUpdated?.(this.#id, this.#connection);
+		}
 		this.#client = client;
+		this.#links.clear();
+		this.#unsubLink = client.onLinkChange((haId, state) => this.#onLink(haId, state));
 		const seededAppliances = client.getAppliances();
 		if (seededAppliances.length > 0) this.#surfaceSink.set(this.#id, {
 			appliances: seededAppliances,
@@ -998,48 +2986,129 @@ var HomeConnectIntegrationManager = class {
 		});
 		try {
 			await client.connect();
-			const surface = {
+			this.#surfaceSink.set(this.#id, {
 				appliances: client.getAppliances(),
 				client
-			};
-			this.#surfaceSink.set(this.#id, surface);
-			this.#status = "connected";
+			});
 			this.#lastCheckedAt = Date.now();
-			this.#onConnected(this.#id);
+			for (const appliance of client.getAppliances()) this.#links.set(appliance.haId, client.getLinkState(appliance.haId));
+			this.#refreshStatus();
+			this.#scheduleIddfRetry();
 		} catch (err) {
-			this.#status = "error";
 			this.#error = errMsg(err);
 			this.#lastCheckedAt = Date.now();
+			this.#refreshStatus();
 			const appliances = client.getAppliances();
 			if (appliances.length > 0) {
 				this.#surfaceSink.set(this.#id, {
 					appliances,
 					client
 				});
-				this.#logger.warn("HomeConnectIntegrationManager: connect failed, keeping appliance inventory from pairing", { meta: {
-					integrationId: this.#id,
-					error: this.#error,
-					applianceCount: appliances.length
-				} });
+				this.#scheduleIddfRetry();
+				this.#logger.warn("HomeConnectIntegrationManager: connect failed, keeping appliance inventory from pairing", {
+					tags: { integrationId: this.#id },
+					meta: {
+						error: this.#error,
+						applianceCount: appliances.length
+					}
+				});
 				return;
 			}
+			this.#unsubLink?.();
+			this.#unsubLink = null;
+			this.#client = null;
+			client.close();
+			this.#status = "error";
 			this.#surfaceSink.set(this.#id, null);
 			this.#onDisconnected(this.#id);
 			throw err;
 		}
 	}
+	#onLink(haId, state) {
+		this.#links.set(haId, state);
+		this.#lastCheckedAt = Date.now();
+		if (state === "connected") this.#error = null;
+		this.#refreshStatus();
+	}
+	/** `connected` while at least one appliance link is up; the callbacks fire on the edge. */
+	#refreshStatus() {
+		const states = [...this.#links.values()];
+		const wasConnected = this.#status === "connected";
+		let next;
+		if (states.some((s) => s === "connected")) next = "connected";
+		else if (states.some((s) => s === "connecting")) next = "connecting";
+		else next = this.#error !== null ? "error" : "disconnected";
+		this.#status = next;
+		if (next === "connected" && !wasConnected) this.#onConnected(this.#id);
+		if (next !== "connected" && wasConnected) this.#onDisconnected(this.#id);
+	}
+	#scheduleIddfRetry() {
+		if (this.#missing.length === 0 || this.#iddfTimer !== null || this.#client === null) return;
+		const delay = this.#iddfRetryMs[Math.min(this.#iddfAttempt, this.#iddfRetryMs.length - 1)] ?? 6e5;
+		this.#iddfAttempt += 1;
+		this.#iddfTimer = setTimeout(() => {
+			this.#iddfTimer = null;
+			this.#retryIddf();
+		}, delay);
+	}
+	async #retryIddf() {
+		const client = this.#client;
+		if (client === null) return;
+		try {
+			const result = await enrichHomeConnectConnection(this.#connection, this.#fetchImpl ?? homeConnectLoginFetch, { onInfo: (message, meta) => {
+				this.#logger.info(message, {
+					tags: { integrationId: this.#id },
+					meta
+				});
+			} });
+			if (this.#client !== client) return;
+			this.#missing = result.missing;
+			if (result.changed) {
+				this.#connection = result.connection;
+				for (const row of result.connection.appliances ?? []) {
+					if (row.deviceDescription === void 0 || result.missing.includes(row.haId)) continue;
+					await client.setDescription(row.haId, row.deviceDescription).catch((err) => {
+						this.#logger.warn("Home Connect could not apply the fetched IDDF", {
+							tags: { integrationId: this.#id },
+							meta: {
+								haId: row.haId,
+								error: errMsg(err)
+							}
+						});
+					});
+				}
+				this.#onConnectionUpdated?.(this.#id, this.#connection);
+				this.#logger.info("Home Connect IDDF loaded after retry", {
+					tags: { integrationId: this.#id },
+					meta: { stillMissing: result.missing.length }
+				});
+			}
+		} catch (err) {
+			this.#logger.warn("Home Connect IDDF retry failed", {
+				tags: { integrationId: this.#id },
+				meta: { error: errMsg(err) }
+			});
+		}
+		this.#scheduleIddfRetry();
+	}
 	async stop() {
 		const client = this.#client;
 		this.#client = null;
+		if (this.#iddfTimer !== null) clearTimeout(this.#iddfTimer);
+		this.#iddfTimer = null;
+		this.#iddfAttempt = 0;
+		this.#unsubLink?.();
+		this.#unsubLink = null;
+		this.#links.clear();
 		this.#status = "disconnected";
 		this.#surfaceSink.set(this.#id, null);
 		if (client) try {
 			client.close();
 		} catch (err) {
-			this.#logger.warn("HomeConnectIntegrationManager: client close failed", { meta: {
-				integrationId: this.#id,
-				error: errMsg(err)
-			} });
+			this.#logger.warn("HomeConnectIntegrationManager: client close failed", {
+				tags: { integrationId: this.#id },
+				meta: { error: errMsg(err) }
+			});
 		}
 		this.#onDisconnected(this.#id);
 	}
@@ -1056,12 +3125,15 @@ var HomeConnectClientRegistry = class {
 	#onConnected;
 	#onDisconnected;
 	#makeManager;
+	#onConnectionUpdated;
 	#entries = /* @__PURE__ */ new Map();
 	constructor(logger, deps = {}) {
 		this.#logger = logger;
 		this.#onConnected = deps.onConnected ?? (() => void 0);
 		this.#onDisconnected = deps.onDisconnected ?? (() => void 0);
+		this.#onConnectionUpdated = deps.onConnectionUpdated;
 		const makeClient = deps.makeClient;
+		const fetchImpl = deps.fetchImpl;
 		this.#makeManager = deps.makeManager ?? ((opts) => new HomeConnectIntegrationManager({
 			id: opts.integrationId,
 			name: opts.name,
@@ -1070,7 +3142,9 @@ var HomeConnectClientRegistry = class {
 			onConnected: opts.onConnected,
 			onDisconnected: opts.onDisconnected,
 			surfaceSink: homeConnectConnections,
-			makeClient
+			makeClient,
+			fetchImpl,
+			onConnectionUpdated: this.#onConnectionUpdated
 		}));
 	}
 	setOnConnected(cb) {
@@ -1087,7 +3161,7 @@ var HomeConnectClientRegistry = class {
 				await existing.manager.applyConnection(connection);
 				this.#entries.set(integrationId, {
 					manager: existing.manager,
-					connection
+					connection: existing.manager.getConnection()
 				});
 			} catch (err) {
 				this.#logger.warn("HomeConnectClientRegistry: applyConnection failed", { meta: {
@@ -1111,6 +3185,10 @@ var HomeConnectClientRegistry = class {
 		});
 		try {
 			await manager.start();
+			this.#entries.set(integrationId, {
+				manager,
+				connection: manager.getConnection()
+			});
 		} catch (err) {
 			this.#logger.warn("HomeConnectClientRegistry: manager start failed", { meta: {
 				integrationId,
@@ -1174,13 +3252,12 @@ function buildHomeConnectConnectionTestProvider(deps) {
 	return {
 		describeTest: async () => ({ label: TEST_LABEL }),
 		testSettings: async ({ settings }) => {
-			const normalized = homeConnectSettingsForPersist(typeof settings === "object" && settings !== null ? settings : {});
-			const parsed = homeConnectConfigSchema.safeParse(normalized);
-			if (!parsed.success) return {
+			const parsed = connectionFromSettings(typeof settings === "object" && settings !== null ? Object.fromEntries(Object.entries(settings)) : {});
+			if (parsed === null) return {
 				outcome: "rejected",
-				error: `Home Connect settings incomplete: ${parsed.error.issues.map((issue) => issue.path.join(".") || "(root)").join(", ")}`
+				error: "Home Connect settings incomplete: sign in to read the account token."
 			};
-			const saved = parsed.data.appliances ?? [];
+			const saved = parsed.appliances ?? [];
 			if (saved.length > 0) {
 				const names = saved.map((app) => app.name).join(", ");
 				return {
@@ -1191,7 +3268,7 @@ function buildHomeConnectConnectionTestProvider(deps) {
 			}
 			const startedAt = Date.now();
 			try {
-				const account = await fetchHomeConnectAccount(parsed.data, deps.fetchImpl);
+				const account = await fetchHomeConnectAccount(parsed, deps.fetchImpl);
 				return {
 					outcome: "validated",
 					latencyMs: Date.now() - startedAt,
@@ -1212,124 +3289,828 @@ function buildHomeConnectConnectionTestProvider(deps) {
 		}
 	};
 }
-var HC_FEATURE_ACTIVE_PROGRAM = "BSH.Common.Setting.Program.Active";
-var HC_FEATURE_REMAINING = "BSH.Common.Option.RemainingProgramTime";
-var HC_FEATURE_PROGRESS = "BSH.Common.Option.ProgramProgress";
-var HC_FEATURE_DOOR = "BSH.Common.Status.DoorState";
-var HC_FEATURE_REMOTE_START = "BSH.Common.Status.RemoteControlActive";
-var HC_FEATURE_POWER = "BSH.Common.Setting.PowerState";
-var HC_FEATURE_SALT = "BSH.Common.Setting.SaltLevel";
-var HC_FEATURE_RINSE = "BSH.Common.Setting.RinseAidLevel";
-var HC_FEATURE_HALF_LOAD = "BSH.Common.Option.HalfLoad";
-var HC_FEATURE_HYGIENE = "BSH.Common.Option.HygienePlus";
-var OPERATION_TO_STATE = {
-	Ready: "idle",
-	Inactive: "idle",
-	Run: "running",
-	Pause: "paused",
-	Finished: "finished",
-	Error: "error"
+//#endregion
+//#region src/home-connect/home-connect-units.ts
+/**
+* Units are a property of the ENTITY, fixed for its whole series. A value is never
+* re-labelled by its magnitude (`n >= 10_000` ⇒ "it must be ml" turned one sensor's
+* history into two incompatible series).
+*
+* The unit comes from, in order:
+*  1. the unit the appliance's own description declares for the entity;
+*  2. the few features whose unit is part of the Home Connect interface itself
+*     (durations are seconds, a forecast and a progress are percent);
+*  3. nothing — the series is then published without a unit, never with a guess.
+*/
+var SECONDS_FEATURES = new Set([
+	"RemainingProgramTime",
+	"StartInRelative",
+	"FinishInRelative",
+	"ElapsedProgramTime",
+	"EstimatedTotalProgramTime"
+]);
+var PERCENT_FEATURES = new Set([
+	"ProgramProgress",
+	"EnergyForecast",
+	"WaterForecast"
+]);
+/** Last dotted segment of a feature name (`BSH.Common.Option.StartInRelative` -> `StartInRelative`). */
+function featureShortName(featureName) {
+	return featureName.split(".").pop() ?? featureName;
+}
+/** The unit of an entity's series, or `null` when neither the description nor the interface fixes one. */
+function resolveUnit(entity) {
+	if (entity.unit !== void 0) return entity.unit;
+	const short = featureShortName(entity.name);
+	if (SECONDS_FEATURES.has(short)) return "s";
+	if (PERCENT_FEATURES.has(short)) return "%";
+	return null;
+}
+var KWH_PER_UNIT = {
+	kWh: 1,
+	Wh: 1 / 1e3,
+	MWh: 1e3,
+	kJ: 1 / 3600,
+	MJ: 1 / 3.6,
+	J: 1 / 36e5
+};
+/** Whether a unit is an energy unit this addon can express in kWh. */
+function isEnergyUnit(unit) {
+	return unit !== null && Object.hasOwn(KWH_PER_UNIT, unit);
+}
+/**
+* Convert an energy reading to kWh using the unit the description declared.
+* `null` for an undeclared or unknown unit — a counter in the wrong unit is worse than no counter.
+*/
+function energyToKwh(value, unit) {
+	if (unit === null) return null;
+	const factor = KWH_PER_UNIT[unit];
+	return factor === void 0 ? null : value * factor;
+}
+/** A whole number of seconds from a raw reading; `null` when it is not a usable duration. */
+function secondsFrom(raw) {
+	const n = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+	if (!Number.isFinite(n) || n < 0) return null;
+	return Math.round(n);
+}
+//#endregion
+//#region src/home-connect/home-connect-domain-mapping.ts
+/** `OperationState` values the appliance reports when an event / flag is on. */
+var EVENT_ACTIVE_VALUES = new Set(["Present", "Confirmed"]);
+/** An event entity carries its present state; `Present` and `Confirmed` both mean "still raised". */
+function eventActive(value) {
+	if (typeof value === "string") {
+		if (EVENT_ACTIVE_VALUES.has(value)) return true;
+		if (value === "Off") return false;
+		return null;
+	}
+	if (typeof value === "boolean") return value;
+	return null;
+}
+/** First entity of one of `kinds` whose last name segment is one of `shortNames`. */
+function findEntity(description, kinds, shortNames) {
+	if (description === null) return void 0;
+	return description.entities().find((e) => kinds.includes(e.kind) && shortNames.includes(featureShortName(e.name)));
+}
+function valueOf(view, entity) {
+	return entity === void 0 ? void 0 : view.features.get(entity.name);
+}
+function boolOf(raw) {
+	return typeof raw === "boolean" ? raw : null;
+}
+function stringOf(raw) {
+	return typeof raw === "string" && raw.length > 0 ? raw : null;
+}
+function numberOf(raw) {
+	return typeof raw === "number" && Number.isFinite(raw) ? raw : null;
+}
+function availabilityOf(view) {
+	if (view.link !== "connected") return "offline";
+	if (view.description === null || view.description.state === "missing") return "description-missing";
+	return "available";
+}
+var OPERATION_TO_STATE = {
+	Inactive: "idle",
+	Ready: "idle",
+	DelayedStart: "idle",
+	ActionRequired: "idle",
+	Run: "running",
+	Aborting: "running",
+	Pause: "paused",
+	Finished: "finished",
+	Error: "error"
+};
+function operationStateOf(raw) {
+	const parsed = DishwasherOperationStateSchema.safeParse(raw);
+	return parsed.success ? parsed.data : null;
+}
+function consumableFromEvents(view, nearlyEmpty, empty) {
+	const nearly = findEntity(view.description, ["event"], nearlyEmpty);
+	const gone = findEntity(view.description, ["event"], empty);
+	if (nearly === void 0 && gone === void 0) return null;
+	if (eventActive(valueOf(view, gone)) === true) return "empty";
+	const nearlyActive = eventActive(valueOf(view, nearly));
+	if (nearlyActive === true) return "low";
+	if (nearlyActive === false) return "ok";
+	return null;
+}
+function programKey(raw) {
+	return stringOf(raw);
+}
+/** Active events (raised right now) as feature keys. */
+function activeEventsOf(view) {
+	return (view.description?.entities() ?? []).filter((e) => e.kind === "event" && eventActive(valueOf(view, e)) === true);
+}
+function optionBool(view, shortNames) {
+	return boolOf(valueOf(view, findEntity(view.description, ["option", "setting"], shortNames)));
+}
+/** Programs the appliance currently offers, as feature keys. */
+function availableProgramKeys(description) {
+	return description.programs().filter((p) => description.entityByName(p.uid)?.available !== false).map((p) => p.uid);
+}
+var COLD_DISHWASHER_STATUS = {
+	availability: "offline",
+	state: "unavailable",
+	operationState: null,
+	program: null,
+	selectedProgram: null,
+	availablePrograms: [],
+	remainingSeconds: null,
+	delayedStartSeconds: null,
+	progressPercent: null,
+	doorOpen: null,
+	doorLocked: null,
+	remoteStartAllowed: null,
+	remoteControlActive: null,
+	localControlActive: null,
+	powerOn: null,
+	powerState: null,
+	saltLevel: null,
+	rinseAidLevel: null,
+	halfLoad: null,
+	hygienePlus: null,
+	extraDry: null,
+	intensiveZone: null,
+	varioSpeedPlus: null,
+	childLock: null,
+	activeEvents: [],
+	errorCode: null,
+	errorLabel: null,
+	lastFetchedAt: 0
+};
+/**
+* Map the decoded Home Connect values → {@link DishwasherStatus}. Pure — the only
+* place the dishwasher slice is assembled. A field the appliance has not reported
+* (or that the description does not list) is `null`; nothing is defaulted to
+* `false`, `0` or `Ready`.
+*/
+function dishwasherStatusFromFeatures(input) {
+	const availability = availabilityOf(input);
+	const description = input.description;
+	if (availability !== "available" || description === null) return {
+		...COLD_DISHWASHER_STATUS,
+		availability,
+		availablePrograms: description !== null ? [...availableProgramKeys(description)] : [],
+		lastFetchedAt: input.lastValueAt
+	};
+	const op = operationStateOf(valueOf(input, findEntity(description, ["status"], ["OperationState"])));
+	const doorRaw = stringOf(valueOf(input, findEntity(description, ["status"], ["DoorState"])));
+	const powerRaw = stringOf(valueOf(input, findEntity(description, ["setting"], ["PowerState"])));
+	const events = activeEventsOf(input);
+	const alert = events.find((e) => e.level === "alert" || e.level === "critical") ?? events[0];
+	const state = op === null ? "unavailable" : OPERATION_TO_STATE[op];
+	const remaining = valueOf(input, findEntity(description, ["option"], ["RemainingProgramTime"]));
+	const delayed = valueOf(input, findEntity(description, ["option"], ["StartInRelative"]));
+	const progress = numberOf(valueOf(input, findEntity(description, ["option"], ["ProgramProgress"])));
+	const activeEntity = description.entityOfKind("activeProgram");
+	const selectedEntity = description.entityOfKind("selectedProgram");
+	return {
+		availability,
+		state,
+		operationState: op,
+		program: programKey(valueOf(input, activeEntity)),
+		selectedProgram: programKey(valueOf(input, selectedEntity)),
+		availablePrograms: [...availableProgramKeys(description)],
+		remainingSeconds: secondsFrom(remaining),
+		delayedStartSeconds: secondsFrom(delayed),
+		progressPercent: progress !== null && progress >= 0 && progress <= 100 ? progress : null,
+		doorOpen: doorRaw === null ? null : doorRaw === "Open",
+		doorLocked: doorRaw === null ? null : doorRaw === "Locked",
+		remoteStartAllowed: boolOf(valueOf(input, findEntity(description, ["status"], ["RemoteControlStartAllowed"]))),
+		remoteControlActive: boolOf(valueOf(input, findEntity(description, ["status"], ["RemoteControlActive"]))),
+		localControlActive: boolOf(valueOf(input, findEntity(description, ["status"], ["LocalControlActive"]))),
+		powerOn: powerRaw === null ? null : powerRaw === "On",
+		powerState: powerRaw,
+		saltLevel: consumableFromEvents(input, ["SaltNearlyEmpty"], ["SaltEmpty"]),
+		rinseAidLevel: consumableFromEvents(input, ["RinseAidNearlyEmpty"], ["RinseAidEmpty"]),
+		halfLoad: optionBool(input, ["HalfLoad"]),
+		hygienePlus: optionBool(input, ["HygienePlus"]),
+		extraDry: optionBool(input, ["ExtraDry"]),
+		intensiveZone: optionBool(input, ["IntensivZone", "IntensiveZone"]),
+		varioSpeedPlus: optionBool(input, ["VarioSpeedPlus", "VarioSpeed"]),
+		childLock: boolOf(valueOf(input, findEntity(description, ["setting"], ["ChildLock"]))),
+		activeEvents: events.map((e) => e.name),
+		errorCode: null,
+		errorLabel: op === "Error" ? alert?.name ?? "Error" : null,
+		lastFetchedAt: input.lastValueAt
+	};
+}
+function primitiveOrNull(raw) {
+	return typeof raw === "boolean" || typeof raw === "string" || typeof raw === "number" ? raw : null;
+}
+function descriptorType(entity, current, fallback) {
+	if (entity.enumeration !== void 0) return "enum";
+	if (entity.valueType === "number") return "number";
+	if (entity.valueType === "boolean") return "boolean";
+	for (const sample of [current, fallback]) {
+		if (typeof sample === "boolean") return "boolean";
+		if (typeof sample === "number") return "number";
+		if (typeof sample === "string") return "string";
+	}
+	return entity.min !== void 0 || entity.max !== void 0 ? "number" : "boolean";
+}
+function descriptorOf(entity, features, override) {
+	const defaultValue = override?.defaultValue ?? entity.defaultValue;
+	const type = descriptorType(entity, features.get(entity.name), defaultValue);
+	return {
+		key: entity.name,
+		name: featureShortName(entity.name),
+		type,
+		access: override?.access ?? entity.access ?? "read",
+		available: (override?.available ?? entity.available) !== false,
+		unit: type === "number" ? resolveUnit(entity) : null,
+		min: entity.min ?? null,
+		max: entity.max ?? null,
+		step: entity.stepSize ?? null,
+		enumValues: entity.enumeration !== void 0 ? Object.values(entity.enumeration) : null,
+		defaultValue: primitiveOrNull(defaultValue)
+	};
+}
+function commandAvailable(description, short) {
+	return findEntity(description, ["command"], [short])?.available === true;
+}
+/** The honest descriptor of the appliance: programs with their options, every option / setting, the commands it takes. */
+function dishwasherOptionsFromDescription(input) {
+	const availability = availabilityOf(input);
+	const description = input.description;
+	if (description === null || description.state === "missing") return {
+		availability,
+		supportsStart: false,
+		supportsPause: false,
+		supportsResume: false,
+		supportsStop: false,
+		supportsPower: false,
+		programs: [],
+		options: []
+	};
+	const settable = description.entities().filter((e) => e.kind === "option" || e.kind === "setting");
+	const power = findEntity(description, ["setting"], ["PowerState"]);
+	const programs = description.programs().map((program) => {
+		const entity = description.entityByName(program.uid);
+		return {
+			key: program.uid,
+			name: program.name,
+			available: entity?.available !== false,
+			options: (program.options ?? []).flatMap((ref) => {
+				const option = description.entityByName(ref.key);
+				return option === void 0 ? [] : [descriptorOf(option, input.features, {
+					...ref.access !== void 0 ? { access: ref.access } : {},
+					...ref.available !== void 0 ? { available: ref.available } : {},
+					...ref.defaultValue !== void 0 ? { defaultValue: ref.defaultValue } : {}
+				})];
+			})
+		};
+	});
+	return {
+		availability,
+		supportsStart: description.entityOfKind("activeProgram") !== void 0,
+		supportsPause: commandAvailable(description, "PauseProgram"),
+		supportsResume: commandAvailable(description, "ResumeProgram"),
+		supportsStop: commandAvailable(description, "AbortProgram"),
+		supportsPower: power !== void 0 && (power.access === "readWrite" || power.access === "writeOnly"),
+		programs,
+		options: settable.map((e) => descriptorOf(e, input.features))
+	};
+}
+/** Command entities by their short name — what pause / resume / stop write. */
+var HC_COMMAND_PAUSE = "PauseProgram";
+var HC_COMMAND_RESUME = "ResumeProgram";
+var HC_COMMAND_STOP = "AbortProgram";
+//#endregion
+//#region src/home-connect/home-connect-child-bindings.ts
+/** The capability a bound child registers. */
+var HomeConnectChildCapSchema = _enum([
+	"numeric-sensor",
+	"power-meter",
+	"enum-sensor",
+	"binary"
+]);
+/** How the raw value becomes the slice value. */
+var HomeConnectChildConvertSchema = _enum([
+	"none",
+	"energy-total-kwh",
+	"event-active"
+]);
+/**
+* One appliance entity exposed as one child device. Persisted on the container, so a
+* child's identity (`stableIdSuffix`) survives restarts and description reloads.
+*/
+var HomeConnectChildBindingSchema = object({
+	/** Stable, derived from the feature key — never from a uid, which differs per model. */
+	stableIdSuffix: string().min(1),
+	/** Feature key the child reads (`BSH.Common.Status.DoorState`, `HomeConnect.Network.rssi`). */
+	key: string().min(1),
+	cap: HomeConnectChildCapSchema,
+	convert: HomeConnectChildConvertSchema,
+	role: _enum(DeviceRole),
+	/** Display name, without the appliance label. */
+	name: string().min(1),
+	/** Unit of an info field the description does not declare (`dBm` for a signal strength). */
+	unit: string().min(1).optional()
+});
+function slugFeatureKey(key) {
+	return key.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+/** `OperationState` -> `Operation state`. */
+function humanizeFeatureName(short) {
+	const spaced = short.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").replace(/[-_]+/g, " ").trim();
+	return spaced.length === 0 ? short : spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+var FRIENDLY_NAMES = {
+	StartInRelative: "Delayed start",
+	RemoteControlActive: "Remote control active",
+	RemoteControlStartAllowed: "Remote start allowed",
+	BackendConnected: "Cloud connection",
+	CloudConnected: "Cloud connection"
+};
+/** Whether an entity is already carried whole by the dishwasher device and so is not a child. */
+var NOT_A_CHILD_KINDS = new Set([
+	"command",
+	"program",
+	"activeProgram",
+	"selectedProgram"
+]);
+/** What an entity's values look like — from its description first, its current value second. */
+function valueClassOf(entity, current) {
+	if (entity.kind === "event") return "binary";
+	if (entity.enumeration !== void 0 || entity.valueType === "enum") return "enum";
+	if (entity.valueType === "number") return "numeric";
+	if (entity.valueType === "boolean") return "binary";
+	if (typeof current === "boolean") return "binary";
+	if (typeof current === "number") return "numeric";
+	if (typeof current === "string") return "enum";
+	return null;
+}
+function roleFor(entity, cls, unit) {
+	if (cls === "enum") return DeviceRole.EnumSensor;
+	if (cls === "binary") return entity.name.endsWith("Connected") ? DeviceRole.ConnectivitySensor : DeviceRole.BinarySensor;
+	if (unit === "°C" || unit === "°F") return DeviceRole.TemperatureSensor;
+	return DeviceRole.NumericSensor;
+}
+function isCumulativeEnergy(entity) {
+	return featureShortName(entity.name) === "EnergyConsumption" && entity.name.includes(".Statistic.");
+}
+/** A consumption entity is either the running total or the figure of one cycle — the name says which. */
+function nameFor(entity, short) {
+	if (short === "EnergyConsumption" || short === "WaterConsumption") {
+		const what = short === "EnergyConsumption" ? "Energy used" : "Water used";
+		return entity.name.includes(".Statistic.") ? `${what} (total)` : `${what} (cycle)`;
+	}
+	return FRIENDLY_NAMES[short] ?? humanizeFeatureName(short);
+}
+function bindingForEntity(entity, current) {
+	if (NOT_A_CHILD_KINDS.has(entity.kind)) return null;
+	const cls = valueClassOf(entity, current);
+	if (cls === null) return null;
+	const short = featureShortName(entity.name);
+	const unit = cls === "numeric" ? resolveUnit(entity) : null;
+	const name = nameFor(entity, short);
+	const base = {
+		stableIdSuffix: slugFeatureKey(entity.name),
+		key: entity.name,
+		name
+	};
+	if (cls === "binary") return {
+		...base,
+		cap: "binary",
+		convert: entity.kind === "event" ? "event-active" : "none",
+		role: roleFor(entity, cls, unit)
+	};
+	if (cls === "enum") return {
+		...base,
+		cap: "enum-sensor",
+		convert: "none",
+		role: roleFor(entity, cls, unit)
+	};
+	if (isCumulativeEnergy(entity) && isEnergyUnit(unit)) return {
+		...base,
+		name: "Energy total",
+		cap: "power-meter",
+		convert: "energy-total-kwh",
+		role: DeviceRole.EnergySensor
+	};
+	return {
+		...base,
+		cap: "numeric-sensor",
+		convert: "none",
+		role: roleFor(entity, cls, unit)
+	};
+}
+function infoLabel(key) {
+	const isNetwork = key.startsWith(HOME_CONNECT_NETWORK_PREFIX);
+	const field = key.slice((isNetwork ? HOME_CONNECT_NETWORK_PREFIX : HOME_CONNECT_INFO_PREFIX).length);
+	return `${isNetwork ? "Network" : "Appliance"} ${humanizeFeatureName(field).toLowerCase()}`;
+}
+/** Info fields whose unit is part of the Home Connect interface (a Wi-Fi signal is dBm). */
+var INFO_UNITS = { rssi: "dBm" };
+function bindingForInfo(key, current) {
+	const base = {
+		stableIdSuffix: slugFeatureKey(key),
+		key,
+		name: infoLabel(key)
+	};
+	if (typeof current === "number") {
+		const unit = INFO_UNITS[key.split(".").pop() ?? ""];
+		return {
+			...base,
+			cap: "numeric-sensor",
+			convert: "none",
+			role: DeviceRole.NumericSensor,
+			...unit !== void 0 ? { unit } : {}
+		};
+	}
+	if (typeof current === "boolean") return {
+		...base,
+		cap: "binary",
+		convert: "none",
+		role: DeviceRole.BinarySensor
+	};
+	if (typeof current === "string") return {
+		...base,
+		cap: "enum-sensor",
+		convert: "none",
+		role: DeviceRole.EnumSensor
+	};
+	return null;
+}
+/**
+* Every entity of the appliance's description, plus the `/ci` and `/ni` fields it
+* sent, as child bindings. Nothing the appliance declares is dropped for not being
+* in a catalog: a friendlier name is all a catalog adds.
+*
+* An entity whose value type cannot be told from its description is bound once a
+* value shows it; until then it is absent (not guessed).
+*/
+function deriveChildBindings(input) {
+	const out = /* @__PURE__ */ new Map();
+	for (const entity of input.description.entities()) {
+		const binding = bindingForEntity(entity, input.features.get(entity.name));
+		if (binding !== null) out.set(binding.stableIdSuffix, binding);
+	}
+	for (const [key, value] of input.features) {
+		if (!key.startsWith("HomeConnect.Info.") && !key.startsWith("HomeConnect.Network.")) continue;
+		const binding = bindingForInfo(key, value);
+		if (binding !== null) out.set(binding.stableIdSuffix, binding);
+	}
+	return [...out.values()].toSorted((a, b) => a.stableIdSuffix.localeCompare(b.stableIdSuffix));
+}
+/**
+* The slice a child publishes for one raw value, or `null` when the value is not
+* known / not usable — in which case the child publishes NOTHING (it goes offline),
+* rather than a `0` / `false` / `unknown` that reads as a measurement.
+*/
+function childSliceFromValue(input) {
+	const { binding, raw, nowMs } = input;
+	if (raw === void 0 || raw === null) return null;
+	switch (binding.cap) {
+		case "binary": {
+			const on = binding.convert === "event-active" ? eventActive(raw) : typeof raw === "boolean" ? raw : null;
+			return on === null ? null : {
+				cap: "binary",
+				status: {
+					on,
+					lastChangedAt: nowMs
+				}
+			};
+		}
+		case "enum-sensor": return typeof raw === "string" || typeof raw === "number" ? {
+			cap: "enum-sensor",
+			status: {
+				value: String(raw),
+				lastFetchedAt: nowMs
+			}
+		} : null;
+		case "power-meter": {
+			if (typeof raw !== "number") return null;
+			const kwh = energyToKwh(raw, input.entity === void 0 ? null : resolveUnit(input.entity));
+			return kwh === null ? null : {
+				cap: "power-meter",
+				status: {
+					kwhTotal: kwh,
+					unit: "kWh",
+					lastFetchedAt: nowMs
+				}
+			};
+		}
+		case "numeric-sensor": {
+			if (typeof raw !== "number" || !Number.isFinite(raw)) return null;
+			const unit = input.entity === void 0 ? binding.unit ?? null : resolveUnit(input.entity);
+			return {
+				cap: "numeric-sensor",
+				status: {
+					value: raw,
+					...unit !== null ? { unit } : {},
+					lastFetchedAt: nowMs
+				}
+			};
+		}
+	}
+}
+var LEGACY_CHILD_KEYS = {
+	"energy-forecast": {
+		key: "BSH.Common.Option.EnergyForecast",
+		cap: "numeric-sensor",
+		role: DeviceRole.NumericSensor
+	},
+	"water-forecast": {
+		key: "BSH.Common.Option.WaterForecast",
+		cap: "numeric-sensor",
+		role: DeviceRole.NumericSensor
+	},
+	"energy-consumed": {
+		key: "BSH.Common.Option.EnergyConsumption",
+		cap: "numeric-sensor",
+		role: DeviceRole.NumericSensor
+	},
+	"water-consumed": {
+		key: "BSH.Common.Option.WaterConsumption",
+		cap: "numeric-sensor",
+		role: DeviceRole.NumericSensor
+	},
+	"remote-control-level": {
+		key: "BSH.Common.Status.RemoteControlLevel",
+		cap: "enum-sensor",
+		role: DeviceRole.EnumSensor
+	},
+	"delayed-start": {
+		key: "BSH.Common.Option.StartInRelative",
+		cap: "numeric-sensor",
+		role: DeviceRole.NumericSensor
+	},
+	"interior-light": {
+		key: "BSH.Common.Setting.AmbientLightEnabled",
+		cap: "binary",
+		role: DeviceRole.BinarySensor
+	},
+	connectivity: {
+		key: "BSH.Common.Status.BackendConnected",
+		cap: "binary",
+		role: DeviceRole.ConnectivitySensor
+	},
+	"program-phase": {
+		key: "Dishcare.Dishwasher.Status.ProgramPhase",
+		cap: "enum-sensor",
+		role: DeviceRole.EnumSensor
+	}
 };
-function mapConsumable(raw) {
-	if (raw === "Full" || raw === "OK" || raw === "Ok") return "ok";
-	if (raw === "Low" || raw === "NearlyEmpty") return "low";
-	if (raw === "Empty") return "empty";
-	return null;
+/**
+* The bindings that keep a container's EXISTING children alive until its description has been
+* read once: a container saved with the old fixed `children` list has no `entities` yet, and a
+* spec without those children would make the kernel delete them (removal by absence) before any
+* replacement exists. They keep their stable suffix; the first successful derive replaces them.
+*/
+function legacyChildBindings(children) {
+	if (!Array.isArray(children)) return [];
+	const out = [];
+	for (const row of children) {
+		if (typeof row !== "object" || row === null) continue;
+		const suffix = Reflect.get(row, "stableIdSuffix");
+		const name = Reflect.get(row, "name");
+		if (typeof suffix !== "string") continue;
+		const known = LEGACY_CHILD_KEYS[suffix];
+		if (known === void 0) continue;
+		out.push({
+			stableIdSuffix: suffix,
+			key: known.key,
+			cap: known.cap,
+			convert: "none",
+			role: known.role,
+			name: typeof name === "string" && name.length > 0 ? name : suffix
+		});
+	}
+	return out;
 }
-function readBool(raw) {
-	return raw === true || raw === "On" || raw === "Open" || raw === "Connected";
+function isSyntheticKey(key) {
+	return key.startsWith("HomeConnect.Info.") || key.startsWith("HomeConnect.Network.");
 }
-function readString(raw) {
-	return typeof raw === "string" && raw.length > 0 ? raw : null;
+/**
+* The bindings a container should carry: what the description derives now, plus what it
+* already had — unless the entity left the description. A value that is unknown right now
+* (the link dropped) never removes a child; only the appliance dropping the entity does.
+*/
+function mergeChildBindings(persisted, derived, description) {
+	const out = /* @__PURE__ */ new Map();
+	for (const kept of persisted) if (isSyntheticKey(kept.key) || description.entityByName(kept.key) !== void 0) out.set(kept.stableIdSuffix, kept);
+	for (const binding of derived) out.set(binding.stableIdSuffix, binding);
+	return [...out.values()].toSorted((a, b) => a.stableIdSuffix.localeCompare(b.stableIdSuffix));
 }
-function readNumber(raw) {
-	if (typeof raw === "number" && Number.isFinite(raw)) return raw;
-	if (typeof raw === "string") {
-		const n = Number(raw);
-		return Number.isFinite(n) ? n : null;
+/**
+* Keeps each adopted appliance's child devices equal to what its description declares.
+* Runs on the addon, outside the container (rebuilding a container from inside itself
+* would tear down the code that asked for it).
+*/
+var HomeConnectChildReconciler = class {
+	#deps;
+	#tracked = /* @__PURE__ */ new Map();
+	#stopped = false;
+	constructor(deps) {
+		this.#deps = deps;
 	}
-	return null;
+	track(appliance) {
+		if (this.#stopped || this.#tracked.has(appliance.deviceId)) return;
+		const entry = {
+			a: appliance,
+			timer: null,
+			unwatch: this.#deps.watch(appliance.brokerId, appliance.haId, () => this.schedule(appliance.deviceId))
+		};
+		this.#tracked.set(appliance.deviceId, entry);
+		this.schedule(appliance.deviceId);
+	}
+	untrack(deviceId) {
+		const entry = this.#tracked.get(deviceId);
+		if (!entry) return;
+		if (entry.timer !== null) clearTimeout(entry.timer);
+		entry.unwatch();
+		this.#tracked.delete(deviceId);
+	}
+	stop() {
+		this.#stopped = true;
+		for (const id of this.#tracked.keys()) this.untrack(id);
+	}
+	tracks(deviceId) {
+		return this.#tracked.has(deviceId);
+	}
+	schedule(deviceId) {
+		const entry = this.#tracked.get(deviceId);
+		if (!entry) return;
+		if (entry.timer !== null) clearTimeout(entry.timer);
+		entry.timer = setTimeout(() => {
+			entry.timer = null;
+			this.reconcile(deviceId);
+		}, this.#deps.debounceMs ?? 3e3);
+	}
+	/** One pass for one appliance; exposed for the adoption path and tests. */
+	async reconcile(deviceId) {
+		const entry = this.#tracked.get(deviceId);
+		if (!entry) return;
+		const { brokerId, haId } = entry.a;
+		const client = this.#deps.getClient(brokerId);
+		const description = client?.getDescription(haId) ?? null;
+		if (client === null || client.getLinkState(haId) !== "connected") return;
+		if (description === null || description.state === "missing") return;
+		try {
+			const { bindings: persisted, malformed } = await this.#deps.readPersisted(deviceId);
+			if (malformed > 0) {
+				this.#deps.logger.warn("Home Connect child reconcile skipped — persisted rows are unreadable", {
+					tags: { deviceId },
+					meta: { malformed }
+				});
+				return;
+			}
+			const merged = mergeChildBindings(persisted, deriveChildBindings({
+				description,
+				features: client.getFeatures(haId)
+			}), description);
+			if (JSON.stringify(merged) === JSON.stringify(sorted(persisted))) return;
+			await this.#deps.applyEntities(deviceId, merged);
+			this.#deps.logger.info("Home Connect children re-derived from the appliance description", {
+				tags: { deviceId },
+				meta: {
+					before: persisted.length,
+					after: merged.length
+				}
+			});
+		} catch (err) {
+			this.#deps.logger.warn("Home Connect child reconcile failed", {
+				tags: { deviceId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+};
+function sorted(list) {
+	return list.toSorted((a, b) => a.stableIdSuffix.localeCompare(b.stableIdSuffix));
 }
 /**
-* Map BSH.Common.* feature values → {@link DishwasherStatus}. Pure — the only
-* place dishwasher slice assembly happens for Home Connect local.
+* Parse a container's persisted `entities`. A row that does not parse is COUNTED, not dropped
+* silently: the caller must not write a list that would lose it.
 */
-function dishwasherStatusFromFeatures(input) {
-	const { features, availablePrograms, nowMs } = input;
-	const op = readString(features.get("BSH.Common.Status.OperationState")) ?? "Ready";
-	const state = OPERATION_TO_STATE[op] ?? "unavailable";
-	const program = readString(features.get(HC_FEATURE_ACTIVE_PROGRAM));
-	let remainingMinutes = readNumber(features.get(HC_FEATURE_REMAINING));
-	if (remainingMinutes !== null && remainingMinutes > 600) remainingMinutes = Math.round(remainingMinutes / 60);
-	const progressPercent = readNumber(features.get(HC_FEATURE_PROGRESS));
-	const doorOpen = features.get(HC_FEATURE_DOOR) === "Open";
-	const remoteStartAllowed = readBool(features.get(HC_FEATURE_REMOTE_START));
-	const powerOn = features.get(HC_FEATURE_POWER) !== "Off";
+function parsePersistedBindings(raw) {
+	if (!Array.isArray(raw)) return {
+		bindings: [],
+		malformed: 0
+	};
+	const bindings = [];
+	let malformed = 0;
+	for (const row of raw) {
+		const parsed = HomeConnectChildBindingSchema.safeParse(row);
+		if (parsed.success) bindings.push(parsed.data);
+		else malformed += 1;
+	}
 	return {
-		state,
-		program,
-		availablePrograms: [...availablePrograms],
-		remainingMinutes,
-		progressPercent,
-		doorOpen,
-		remoteStartAllowed,
-		powerOn,
-		saltLevel: mapConsumable(features.get(HC_FEATURE_SALT)),
-		rinseAidLevel: mapConsumable(features.get(HC_FEATURE_RINSE)),
-		halfLoad: readBool(features.get(HC_FEATURE_HALF_LOAD)),
-		hygienePlus: readBool(features.get(HC_FEATURE_HYGIENE)),
-		errorCode: state === "error" ? 1 : null,
-		errorLabel: state === "error" ? op : null,
-		lastFetchedAt: nowMs
+		bindings,
+		malformed
 	};
 }
-/** Command resource keys for WS POST-style mutations. */
-var HC_CMD_START = "BSH.Common.Command.StartProgram";
-var HC_CMD_PAUSE = "BSH.Common.Command.PauseProgram";
-var HC_CMD_STOP = "BSH.Common.Command.AbortProgram";
-var HC_CMD_SET_PROGRAM = "BSH.Common.Setting.Program.Active";
-var HC_CMD_SET_POWER = "BSH.Common.Setting.PowerState";
+//#endregion
+//#region src/home-connect/home-connect-option-validation.ts
+/** A step grid tolerance: `0.1 + 0.2`-style float noise must not reject a valid step. */
+var STEP_EPSILON = 1e-9;
+/**
+* Check a write against what the appliance's own description allows, and answer
+* the feature key to write. Throws an error that says WHY — a value the appliance
+* would refuse (or worse, clamp) never leaves this process unexplained.
+*
+* The description is the authority: the entity must be listed, a setting or option,
+* writable, available now, and the value inside its declared range / on its step /
+* among its members.
+*/
+function assertWritable(description, key, value) {
+	if (description === null || description.state === "missing") throw new Error(`Cannot set ${key}: the appliance description is not loaded`);
+	const entity = description.entityByName(key);
+	if (entity === void 0) throw new Error(`${key} is not in this appliance's description`);
+	if (entity.kind !== "option" && entity.kind !== "setting") throw new Error(`${key} is a ${entity.kind}, not a setting or option`);
+	if (entity.access !== "readWrite" && entity.access !== "writeOnly") throw new Error(`${key} is not writable (access: ${entity.access ?? "unknown"})`);
+	if (entity.available === false) throw new Error(`${key} is not available right now`);
+	if (entity.enumeration !== void 0) {
+		const members = Object.values(entity.enumeration);
+		if (typeof value !== "string" || !members.includes(value)) throw new Error(`${key} accepts ${members.join(" | ")}, not ${String(value)}`);
+		return key;
+	}
+	if (typeof value === "number") assertNumberInRange(key, value, entity.min, entity.max, entity.stepSize);
+	else if (entity.valueType === "number") throw new Error(`${key} takes a number, not ${typeof value}`);
+	else if (entity.valueType === "boolean" && typeof value !== "boolean") throw new Error(`${key} takes true or false, not ${typeof value}`);
+	return key;
+}
+function assertNumberInRange(key, value, min, max, step) {
+	if (!Number.isFinite(value)) throw new Error(`${key} needs a finite number`);
+	if (min !== void 0 && value < min) throw new Error(`${key} must be at least ${min}`);
+	if (max !== void 0 && value > max) throw new Error(`${key} must be at most ${max}`);
+	if (step !== void 0 && step > 0) {
+		const origin = min ?? 0;
+		const steps = (value - origin) / step;
+		if (Math.abs(steps - Math.round(steps)) > STEP_EPSILON) throw new Error(`${key} must be a multiple of ${step}${origin !== 0 ? ` from ${origin}` : ""}`);
+	}
+}
+/** The program must be listed and currently offered. */
+function assertProgramAvailable(description, program) {
+	if (description === null || description.state === "missing") throw new Error("Cannot pick a program: the appliance description is not loaded");
+	if (!description.programs().some((p) => p.uid === program)) throw new Error(`${program} is not a program of this appliance`);
+	if (description.entityByName(program)?.available === false) throw new Error(`${program} is not available right now`);
+}
+/**
+* A program started with options: each must be one the program lists, offered in
+* that program (not marked unavailable there), and valid as a write.
+*/
+function assertProgramOptions(description, program, options) {
+	const entries = Object.entries(options);
+	if (entries.length === 0) return;
+	const listed = description?.programs().find((p) => p.uid === program)?.options ?? [];
+	for (const [key, value] of entries) {
+		const ref = listed.find((o) => o.key === key);
+		if (ref === void 0) throw new Error(`${key} is not an option of ${program}`);
+		if (ref.available === false || ref.access === "read" || ref.access === "readStatic") throw new Error(`${key} cannot be set for ${program}`);
+		assertWritable(description, key, value);
+	}
+}
 //#endregion
 //#region src/home-connect/devices/home-connect-dishwasher-device.ts
 var homeConnectDishwasherSchema = object({
 	haId: string().min(1),
 	brokerId: string().min(1),
 	applianceType: string().optional(),
-	availablePrograms: array(string()).default([]),
 	system: literal("home-connect").optional(),
 	integrationId: string().optional()
 });
 var DISH_CAP = "dishwasher";
-var COLD_START = {
-	state: "unavailable",
-	program: null,
-	availablePrograms: [],
-	remainingMinutes: null,
-	progressPercent: null,
-	doorOpen: false,
-	remoteStartAllowed: false,
-	powerOn: false,
-	saltLevel: null,
-	rinseAidLevel: null,
-	halfLoad: false,
-	hygienePlus: false,
-	errorCode: null,
-	errorLabel: null,
-	lastFetchedAt: 0
+/** The option short names of the boolean setters, in the spellings an appliance uses. */
+var OPTION_NAMES = {
+	halfLoad: ["HalfLoad"],
+	hygienePlus: ["HygienePlus"],
+	extraDry: ["ExtraDry"],
+	intensiveZone: ["IntensivZone", "IntensiveZone"],
+	varioSpeedPlus: ["VarioSpeedPlus", "VarioSpeed"]
 };
 var HomeConnectDishwasherDevice = class extends BaseDevice {
 	features = [];
 	#haId;
 	#brokerId;
-	#availablePrograms;
-	#featureUnsub = null;
+	#unwatch = null;
 	constructor(ctx) {
 		const persisted = homeConnectDishwasherSchema.parse(ctx.persistedConfig ?? {});
-		super(ctx, homeConnectDishwasherSchema, { type: ctx.deviceMeta.type });
+		super(ctx, homeConnectDishwasherSchema, { type: DeviceType.Dishwasher });
 		this.#haId = persisted.haId;
 		this.#brokerId = persisted.brokerId;
-		this.#availablePrograms = persisted.availablePrograms;
-		this.online = true;
 		this.updateSourceInfo({
 			id: this.#haId,
 			system: "home-connect"
@@ -1338,94 +4119,539 @@ var HomeConnectDishwasherDevice = class extends BaseDevice {
 	async onActivate() {
 		await super.onActivate();
 		this.registerDishwasherCap();
-		this.runtimeState.setCapState(DISH_CAP, COLD_START);
-		this.attachFeatureListener();
-		this.recomputeSlice();
+		this.runtimeState.setCapState(DISH_CAP, COLD_DISHWASHER_STATUS);
+		this.markOnline(false);
+		this.#unwatch = homeConnectConnections.watch(this.#brokerId, this.#haId, (event) => this.recomputeSlice(event));
+		this.recomputeSlice({ kind: "client" });
 	}
 	async removeDevice() {
-		this.#featureUnsub?.();
-		this.#featureUnsub = null;
+		this.#unwatch?.();
+		this.#unwatch = null;
 		await super.removeDevice();
 	}
-	attachFeatureListener() {
-		const client = homeConnectConnections.getClient(this.#brokerId);
-		if (!client) return;
-		this.#featureUnsub = client.onFeatureChange((haId, _key, _value) => {
-			if (haId !== this.#haId) return;
-			this.recomputeSlice();
-		});
+	client() {
+		return homeConnectConnections.getClient(this.#brokerId);
 	}
-	recomputeSlice() {
-		const client = homeConnectConnections.getClient(this.#brokerId);
-		if (!client) {
-			this.runtimeState.setCapState(DISH_CAP, {
-				...COLD_START,
-				lastFetchedAt: Date.now()
-			});
-			return;
-		}
+	view() {
+		const client = this.client();
+		return {
+			features: client?.getFeatures(this.#haId) ?? /* @__PURE__ */ new Map(),
+			description: client?.getDescription(this.#haId) ?? null,
+			link: client?.getLinkState(this.#haId) ?? "disconnected"
+		};
+	}
+	recomputeSlice(event) {
+		const previous = this.runtimeState.getCapState(DISH_CAP);
+		const lastValueAt = event.kind === "feature" && !event.key.startsWith("HomeConnect.Info.") && !event.key.startsWith("HomeConnect.Network.") ? Date.now() : previous?.lastFetchedAt ?? 0;
 		const slice = dishwasherStatusFromFeatures({
-			features: client.getFeatures(this.#haId),
-			availablePrograms: this.#availablePrograms,
-			nowMs: Date.now()
+			...this.view(),
+			lastValueAt
 		});
 		this.runtimeState.setCapState(DISH_CAP, slice);
+		this.markOnline(slice.availability !== "offline");
 	}
 	requireClient() {
-		const client = homeConnectConnections.getClient(this.#brokerId);
-		if (!client) throw new Error(`Home Connect client unavailable (haId=${this.#haId})`);
+		const client = this.client();
+		if (!client) throw new Error("Home Connect client unavailable — the integration is not connected");
+		if (client.getLinkState(this.#haId) !== "connected") throw new Error("The appliance is not connected right now");
 		return client;
 	}
+	/** Write a command entity of the description (`PauseProgram`, …); refuses one it does not offer. */
+	async command(shortName) {
+		const client = this.requireClient();
+		const entity = findEntity(client.getDescription(this.#haId), ["command"], [shortName]);
+		if (entity === void 0 || entity.available !== true) throw new Error(`This appliance does not offer ${shortName} right now`);
+		await this.logged(`command ${shortName}`, client.setFeature(this.#haId, entity.name, true));
+	}
+	async setOptionByShortName(shortNames, value) {
+		const client = this.requireClient();
+		const entity = findEntity(client.getDescription(this.#haId), ["option", "setting"], shortNames);
+		if (entity === void 0) throw new Error(`This appliance has no ${shortNames.join(" / ")} option`);
+		await this.writeKey(client, entity.name, value);
+	}
+	async writeKey(client, key, value) {
+		const checked = assertWritable(client.getDescription(this.#haId), key, value);
+		await this.logged(`set ${checked}`, client.setFeature(this.#haId, checked, value));
+	}
+	/** A write that fails says so on the device's own log line, then fails to the caller. */
+	async logged(what, pending) {
+		try {
+			await pending;
+		} catch (err) {
+			this.ctx.logger.warn(`Home Connect ${what} failed`, {
+				tags: { deviceId: this.id },
+				meta: { error: errMsg(err) }
+			});
+			throw err;
+		}
+	}
 	registerDishwasherCap() {
 		this.ctx.registerNativeCap(dishwasherCapability, {
-			getStatus: async () => this.runtimeState.getCapState(DISH_CAP) ?? COLD_START,
-			start: async () => {
-				await this.requireClient().setFeature(this.#haId, HC_CMD_START, {});
-			},
-			pause: async () => {
-				await this.requireClient().setFeature(this.#haId, HC_CMD_PAUSE, {});
-			},
-			stop: async () => {
-				await this.requireClient().setFeature(this.#haId, HC_CMD_STOP, {});
+			getStatus: async () => this.runtimeState.getCapState(DISH_CAP) ?? COLD_DISHWASHER_STATUS,
+			getOptions: async () => dishwasherOptionsFromDescription(this.view()),
+			start: async ({ program, options }) => {
+				const client = this.requireClient();
+				const description = client.getDescription(this.#haId);
+				const target = program ?? this.runtimeState.getCapState(DISH_CAP)?.selectedProgram ?? null;
+				if (target === null) throw new Error("No program is selected — pick one to start");
+				assertProgramAvailable(description, target);
+				assertProgramOptions(description, target, options ?? {});
+				await this.logged(`start ${target}`, client.startProgram(this.#haId, target, options));
 			},
+			pause: async () => this.command(HC_COMMAND_PAUSE),
+			resume: async () => this.command(HC_COMMAND_RESUME),
+			stop: async () => this.command(HC_COMMAND_STOP),
 			setProgram: async ({ program }) => {
-				await this.requireClient().setFeature(this.#haId, HC_CMD_SET_PROGRAM, program);
+				const client = this.requireClient();
+				assertProgramAvailable(client.getDescription(this.#haId), program);
+				await this.logged(`select ${program}`, client.selectProgram(this.#haId, program));
 			},
 			setPower: async ({ on }) => {
-				await this.requireClient().setFeature(this.#haId, HC_CMD_SET_POWER, on ? "On" : "Off");
+				const client = this.requireClient();
+				const entity = findEntity(client.getDescription(this.#haId), ["setting"], ["PowerState"]);
+				if (entity === void 0) throw new Error("This appliance has no power state setting");
+				const members = Object.values(entity.enumeration ?? {});
+				const target = on ? "On" : members.includes("Off") ? "Off" : "Standby";
+				await this.writeKey(client, entity.name, target);
 			},
-			setHalfLoad: async ({ on }) => {
-				await this.requireClient().setFeature(this.#haId, HC_FEATURE_HALF_LOAD, on);
-			},
-			setHygienePlus: async ({ on }) => {
-				await this.requireClient().setFeature(this.#haId, HC_FEATURE_HYGIENE, on);
+			setHalfLoad: async ({ on }) => this.setOptionByShortName(OPTION_NAMES.halfLoad, on),
+			setHygienePlus: async ({ on }) => this.setOptionByShortName(OPTION_NAMES.hygienePlus, on),
+			setExtraDry: async ({ on }) => this.setOptionByShortName(OPTION_NAMES.extraDry, on),
+			setIntensiveZone: async ({ on }) => this.setOptionByShortName(OPTION_NAMES.intensiveZone, on),
+			setVarioSpeedPlus: async ({ on }) => this.setOptionByShortName(OPTION_NAMES.varioSpeedPlus, on),
+			setChildLock: async ({ on }) => this.setOptionByShortName(["ChildLock"], on),
+			setOption: async ({ key, value }) => this.writeKey(this.requireClient(), key, value)
+		});
+	}
+};
+//#endregion
+//#region src/home-connect/devices/home-connect-event-device.ts
+var homeConnectEventSchema = object({
+	haId: string().min(1),
+	brokerId: string().min(1),
+	system: literal("home-connect").optional(),
+	integrationId: string().optional()
+});
+var EVENT_CAP = "event-emitter";
+/**
+* The appliance's events (`<event>` entities: salt low, rinse aid low, program finished,
+* aborted, …) as the generic event emitter: the vocabulary is the event feature keys of
+* the description, verbatim, and an event fires when it is RAISED.
+*
+* A value seen while the link is still being established (the handshake's initial values)
+* is the baseline, not a new event: a reconnect must not announce "program finished" again.
+*/
+var HomeConnectEventDevice = class extends BaseDevice {
+	features = [];
+	#haId;
+	#brokerId;
+	/** Edge detector: was this event raised the last time we looked? Not part of any slice. */
+	#raised = /* @__PURE__ */ new Map();
+	#seq = 0;
+	#unwatch = null;
+	constructor(ctx) {
+		const persisted = homeConnectEventSchema.parse(ctx.persistedConfig ?? {});
+		super(ctx, homeConnectEventSchema, { type: DeviceType.EventEmitter });
+		this.#haId = persisted.haId;
+		this.#brokerId = persisted.brokerId;
+		this.updateSourceInfo({
+			id: `${this.#haId}:events`,
+			system: "home-connect"
+		});
+	}
+	async onActivate() {
+		await super.onActivate();
+		this.registerCap();
+		this.publish(this.eventTypes(), this.runtimeState.getCapState(EVENT_CAP));
+		this.#unwatch = homeConnectConnections.watch(this.#brokerId, this.#haId, (e) => this.onChange(e));
+	}
+	async removeDevice() {
+		this.#unwatch?.();
+		this.#unwatch = null;
+		await super.removeDevice();
+	}
+	eventTypes() {
+		return ((homeConnectConnections.getClient(this.#brokerId)?.getDescription(this.#haId))?.entities() ?? []).filter((e) => e.kind === "event").map((e) => e.name);
+	}
+	publish(eventTypes, previous, lastEvent) {
+		this.runtimeState.setCapState(EVENT_CAP, {
+			eventTypes: [...eventTypes],
+			lastEvent: lastEvent ?? previous?.lastEvent ?? null,
+			eventCountSinceStart: (previous?.eventCountSinceStart ?? 0) + (lastEvent !== void 0 ? 1 : 0)
+		});
+	}
+	onChange(event) {
+		const client = homeConnectConnections.getClient(this.#brokerId);
+		const previous = this.runtimeState.getCapState(EVENT_CAP);
+		const types = this.eventTypes();
+		const connected = client !== null && client.getLinkState(this.#haId) === "connected";
+		if (client !== null && !connected && event.kind === "feature" && types.includes(event.key)) {
+			const baseline = eventActive(client.getFeatures(this.#haId).get(event.key));
+			if (baseline !== null) this.#raised.set(event.key, baseline);
+			return;
+		}
+		if (client === null || !connected) {
+			this.#raised.clear();
+			this.markOnline(false);
+			return;
+		}
+		this.markOnline(true);
+		if (event.kind !== "feature" || !types.includes(event.key)) {
+			this.publish(types, previous);
+			return;
+		}
+		const value = client.getFeatures(this.#haId).get(event.key);
+		const active = eventActive(value);
+		const wasRaised = this.#raised.get(event.key) === true;
+		if (active !== null) this.#raised.set(event.key, active);
+		if (active !== true || wasRaised) {
+			this.publish(types, previous);
+			return;
+		}
+		const entity = client.getDescription(this.#haId)?.entityByName(event.key);
+		const fire = {
+			deviceId: this.id,
+			eventType: event.key,
+			data: {
+				value: typeof value === "string" ? value : null,
+				...entity?.level !== void 0 ? { level: entity.level } : {},
+				...entity?.handling !== void 0 ? { handling: entity.handling } : {}
 			},
-			setOption: async ({ key, value }) => {
-				await this.requireClient().setFeature(this.#haId, key, value);
+			timestamp: Date.now(),
+			seq: ++this.#seq
+		};
+		this.ctx.eventBus.emit(createEvent(EventCategory.EventEmitted, {
+			type: "device",
+			id: this.stableId,
+			deviceId: this.id,
+			addonId: this.ctx.deviceMeta.addonId
+		}, fire));
+		this.publish(types, previous, fire);
+	}
+	registerCap() {
+		this.ctx.registerNativeCap(eventEmitterCapability, { getStatus: async () => this.runtimeState.getCapState(EVENT_CAP) ?? {
+			eventTypes: [],
+			lastEvent: null,
+			eventCountSinceStart: 0
+		} });
+	}
+};
+//#endregion
+//#region src/home-connect/devices/home-connect-sensor-device.ts
+var homeConnectSensorSchema = object({
+	haId: string().min(1),
+	brokerId: string().min(1),
+	binding: HomeConnectChildBindingSchema,
+	system: literal("home-connect").optional(),
+	integrationId: string().optional()
+});
+/**
+* What `getStatus` answers before the appliance has reported anything. `lastFetchedAt: 0`
+* is the cap's "never fetched" marker; the number beside it is a placeholder the type
+* demands, and it is NEVER written to the runtime slice — a sensor with no value is
+* offline and has no slice, so nothing reads the placeholder as a measurement.
+*/
+var NEVER_NUMERIC = {
+	value: 0,
+	lastFetchedAt: 0
+};
+var NEVER_POWER = { lastFetchedAt: 0 };
+var NEVER_ENUM = {
+	value: "",
+	lastFetchedAt: 0
+};
+var NEVER_BINARY = {
+	on: false,
+	lastChangedAt: 0
+};
+/**
+* One Home Connect entity as a Sensor accessory child of the appliance container. The
+* entity it reads is its `binding.key` — one key, never "the first of several that
+* happens to be present".
+*/
+var HomeConnectSensorDevice = class extends BaseDevice {
+	features = [];
+	#haId;
+	#brokerId;
+	#binding;
+	#unwatch = null;
+	constructor(ctx) {
+		const persisted = homeConnectSensorSchema.parse(ctx.persistedConfig ?? {});
+		super(ctx, homeConnectSensorSchema, { type: ctx.deviceMeta.type });
+		this.#haId = persisted.haId;
+		this.#brokerId = persisted.brokerId;
+		this.#binding = persisted.binding;
+		this.updateSourceInfo({
+			id: `${this.#haId}:${this.#binding.stableIdSuffix}`,
+			system: "home-connect"
+		});
+	}
+	async onActivate() {
+		await super.onActivate();
+		this.registerCap();
+		this.markOnline(false);
+		this.#unwatch = homeConnectConnections.watch(this.#brokerId, this.#haId, () => this.recompute());
+		this.recompute();
+	}
+	async removeDevice() {
+		this.#unwatch?.();
+		this.#unwatch = null;
+		await super.removeDevice();
+	}
+	recompute() {
+		const client = homeConnectConnections.getClient(this.#brokerId);
+		if (!client || client.getLinkState(this.#haId) !== "connected") {
+			this.markOnline(false);
+			return;
+		}
+		const slice = childSliceFromValue({
+			binding: this.#binding,
+			entity: client.getDescription(this.#haId)?.entityByName(this.#binding.key),
+			raw: client.getFeatures(this.#haId).get(this.#binding.key),
+			nowMs: Date.now()
+		});
+		if (slice === null) {
+			this.markOnline(false);
+			return;
+		}
+		if (slice.cap === "binary") {
+			const previous = this.runtimeState.getCapState("binary");
+			if (previous !== void 0 && previous.on === slice.status.on && previous.lastChangedAt > 0) {
+				this.markOnline(true);
+				return;
 			}
+		}
+		this.runtimeState.setCapState(slice.cap, slice.status);
+		this.markOnline(true);
+	}
+	registerCap() {
+		switch (this.#binding.cap) {
+			case "numeric-sensor":
+				this.ctx.registerNativeCap(numericSensorCapability, { getStatus: async () => this.runtimeState.getCapState("numeric-sensor") ?? NEVER_NUMERIC });
+				return;
+			case "power-meter":
+				this.ctx.registerNativeCap(powerMeterCapability, { getStatus: async () => this.runtimeState.getCapState("power-meter") ?? NEVER_POWER });
+				return;
+			case "enum-sensor":
+				this.ctx.registerNativeCap(enumSensorCapability, { getStatus: async () => this.runtimeState.getCapState("enum-sensor") ?? NEVER_ENUM });
+				return;
+			case "binary":
+				this.ctx.registerNativeCap(binaryCapability, { getStatus: async () => this.runtimeState.getCapState("binary") ?? NEVER_BINARY });
+				return;
+		}
+	}
+};
+//#endregion
+//#region src/home-connect/devices/home-connect-appliance-device.ts
+var homeConnectApplianceSchema = object({
+	haId: string().min(1),
+	brokerId: string().min(1),
+	applianceType: string().optional(),
+	/** One entry per appliance entity exposed as a child, maintained from the appliance's description. */
+	entities: array(unknown()).optional(),
+	/** Children persisted before the description-derived model; read only to keep them alive. */
+	children: array(unknown()).optional(),
+	system: literal("home-connect").optional(),
+	integrationId: string().optional()
+});
+/** Device metadata keys the `/ci/info` fields map onto (the conventional `DeviceMetadata` keys). */
+var INFO_TO_METADATA = {
+	brand: "manufacturer",
+	vib: "model",
+	serialNumber: "serialNumber",
+	sn: "serialNumber",
+	softwareVersion: "firmware",
+	swVersion: "firmware",
+	hardwareVersion: "hardware",
+	hwVersion: "hardware",
+	mac: "mac"
+};
+/** One Home Connect appliance as a container: the dishwasher, an event emitter, and one child per entity. */
+var HomeConnectApplianceDevice = class extends BaseDevice {
+	features = [];
+	integrationId;
+	brokerId;
+	haId;
+	applianceType;
+	#unwatch = null;
+	#lastInfo = "";
+	constructor(ctx) {
+		const cfg = homeConnectApplianceSchema.parse(ctx.persistedConfig ?? {});
+		super(ctx, homeConnectApplianceSchema, { type: DeviceType.Container });
+		this.brokerId = cfg.brokerId;
+		this.haId = cfg.haId;
+		this.integrationId = cfg.integrationId;
+		this.applianceType = cfg.applianceType;
+		this.updateSourceInfo({
+			id: cfg.haId,
+			system: "home-connect"
+		});
+	}
+	async onActivate() {
+		await super.onActivate();
+		this.#unwatch = homeConnectConnections.watch(this.brokerId, this.haId, (event) => this.onChange(event));
+		this.onChange({ kind: "client" });
+	}
+	async removeDevice() {
+		this.#unwatch?.();
+		this.#unwatch = null;
+		await super.removeDevice();
+	}
+	onChange(event) {
+		const client = homeConnectConnections.getClient(this.brokerId);
+		this.markOnline(client?.getLinkState(this.haId) === "connected");
+		if (client === null) return;
+		if (event.kind === "feature" && !event.key.startsWith("HomeConnect.Info.") && !event.key.startsWith("HomeConnect.Network.")) return;
+		this.publishInfo(client.getFeatures(this.haId));
+	}
+	/** `/ci/info` as device metadata (manufacturer, model, serial, firmware, …); pushed only when it changed. */
+	async publishInfo(features) {
+		const patch = {};
+		for (const [field, metadataKey] of Object.entries(INFO_TO_METADATA)) {
+			const value = features.get(`${HOME_CONNECT_INFO_PREFIX}${field}`);
+			if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") patch[metadataKey] = value;
+		}
+		const serialized = JSON.stringify(patch);
+		if (Object.keys(patch).length === 0 || serialized === this.#lastInfo) return;
+		const action = this.ctx.api.deviceManager?.setMetadata;
+		if (!action) return;
+		try {
+			await action.mutate({
+				deviceId: this.id,
+				patch
+			});
+			this.#lastInfo = serialized;
+		} catch (err) {
+			this.ctx.logger.warn("Home Connect could not publish the appliance info", {
+				tags: { deviceId: this.id },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
+	getAccessoryChildren() {
+		const cfg = this.config.values;
+		const bindings = cfg.entities !== void 0 ? parsePersistedBindings(cfg.entities).bindings : legacyChildBindings(cfg.children);
+		const containerName = this.name;
+		const link = {
+			haId: this.haId,
+			brokerId: this.brokerId,
+			system: "home-connect",
+			...this.integrationId !== void 0 ? { integrationId: this.integrationId } : {}
+		};
+		const integration = this.integrationId !== void 0 ? { integrationId: this.integrationId } : {};
+		const out = [{
+			stableIdSuffix: "dishwasher",
+			meta: {
+				type: DeviceType.Dishwasher,
+				name: homeConnectDishwasherEntityName(containerName),
+				linkDeviceId: this.id,
+				...integration
+			},
+			config: {
+				...link,
+				...this.applianceType !== void 0 ? { applianceType: this.applianceType } : {}
+			},
+			factory: (childCtx) => new HomeConnectDishwasherDevice(childCtx)
+		}];
+		if (bindings.some((b) => b.convert === "event-active")) out.push({
+			stableIdSuffix: "events",
+			meta: {
+				type: DeviceType.EventEmitter,
+				name: `${containerName} — Events`,
+				linkDeviceId: this.id,
+				...integration
+			},
+			config: link,
+			factory: (childCtx) => new HomeConnectEventDevice(childCtx)
+		});
+		for (const binding of bindings) out.push({
+			stableIdSuffix: binding.stableIdSuffix,
+			meta: {
+				type: DeviceType.Sensor,
+				role: binding.role,
+				name: `${containerName} — ${binding.name}`,
+				linkDeviceId: this.id,
+				...integration
+			},
+			config: {
+				...link,
+				binding
+			},
+			factory: (childCtx) => new HomeConnectSensorDevice(childCtx)
 		});
+		return out;
 	}
 };
 //#endregion
+//#region src/home-connect/home-connect-secret-adopt.ts
+/**
+* One-time adopt: an integration saved before the keychain move carries each appliance's
+* pairing key (`psk`, `iv64`) on its row, in clear text. Plan the move into `applianceSecrets`
+* (keychain), with the rows stripped.
+*
+* `null` when there is nothing to move — settings already migrated, or the stored keys are
+* locked (the move could not see what it would replace). Idempotent.
+*/
+function planLegacyApplianceSecretAdopt(deps, integrationId, settings) {
+	const patch = legacyApplianceSecretPatch(settings);
+	if (patch === null) return null;
+	const next = {
+		...settings,
+		...patch
+	};
+	return {
+		settings: next,
+		persist: async () => {
+			try {
+				await deps.setSettings({
+					id: integrationId,
+					settings: next,
+					secretKeys: [...HOME_CONNECT_SECRET_KEYS]
+				});
+				deps.logger.info("Home Connect moved the appliance pairing keys into the keychain", {
+					tags: { integrationId },
+					meta: { appliances: patch.appliances.length }
+				});
+			} catch (err) {
+				deps.logger.warn("Home Connect could not move the appliance pairing keys into the keychain", {
+					tags: { integrationId },
+					meta: { error: errMsg(err) }
+				});
+			}
+		}
+	};
+}
+//#endregion
 //#region src/home-connect/addon.ts
 var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 	addonId = "bosch-home-connect";
 	providerName = "Bosch Home Connect";
-	deviceClasses = { [DeviceType.Dishwasher]: HomeConnectDishwasherDevice };
+	deviceClasses = {
+		[DeviceType.Container]: HomeConnectApplianceDevice,
+		[DeviceType.Dishwasher]: HomeConnectDishwasherDevice,
+		[DeviceType.Sensor]: HomeConnectSensorDevice,
+		[DeviceType.EventEmitter]: HomeConnectEventDevice
+	};
 	clients = null;
+	reconciler = null;
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
-		this.clients = new HomeConnectClientRegistry(this.ctx.logger);
+		this.clients = new HomeConnectClientRegistry(this.ctx.logger, { onConnectionUpdated: (integrationId, connection) => {
+			this.persistIntegrationAppliances(integrationId, connection);
+		} });
 		this.clients.setOnConnected((integrationId) => {
 			this.setIntegrationDevicesOnline(integrationId, true);
+			this.trackAppliances();
 		});
 		this.clients.setOnDisconnected((integrationId) => {
 			this.setIntegrationDevicesOnline(integrationId, false);
 		});
+		this.reconciler = this.buildChildReconciler();
 		await this.reconcileIntegrations();
+		await this.trackAppliances();
 		this.subscribeIntegrationLifecycle();
 		return {
 			providers: [
@@ -1456,19 +4682,21 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 						callback: input.callback,
 						state: input.state
 					});
-					const appliances = account.appliances.map((app) => ({
+					const { rows, secrets } = splitApplianceSecrets(account.appliances.map((app) => ({
 						haId: app.haId,
 						name: app.name,
 						type: app.type,
 						host: app.connection.host,
 						psk: app.connection.psk,
 						mode: app.connection.mode,
-						...app.connection.iv64.length > 0 ? { iv64: app.connection.iv64 } : {}
-					}));
+						...app.connection.iv64.length > 0 ? { iv64: app.connection.iv64 } : {},
+						...parseLoginDeviceDescription(app.connection.deviceDescription)
+					})));
 					return {
 						token: account.token,
 						...account.refresh.length > 0 ? { refresh: account.refresh } : {},
-						appliances: JSON.stringify(appliances),
+						appliances: JSON.stringify(rows),
+						applianceSecrets: JSON.stringify(secrets),
 						summary: account.summary
 					};
 				}
@@ -1476,6 +4704,8 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 		};
 	}
 	async onShutdown() {
+		this.reconciler?.stop();
+		this.reconciler = null;
 		try {
 			await this.clients?.shutdown();
 		} catch (err) {
@@ -1488,25 +4718,62 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 		if (!this.clients) throw new Error("Home Connect provider not initialised");
 		return this.clients;
 	}
-	generateStableId(_type, config) {
+	generateStableId(type, config) {
 		const integrationId = config?.["brokerId"];
 		if (typeof integrationId !== "string" || integrationId.length === 0) throw new Error("home-connect generateStableId: brokerId required");
 		const haId = config?.["haId"];
 		if (typeof haId !== "string" || haId.length === 0) throw new Error("home-connect generateStableId: haId required");
+		if (type === DeviceType.Container) return `home-connect:${integrationId}:${haId}:appliance`;
 		return `home-connect:${integrationId}:${haId}`;
 	}
+	async persistIntegrationAppliances(integrationId, connection) {
+		if (!connection.appliances || connection.appliances.length === 0) return;
+		try {
+			const settings = await this.ctx.api.integrations.getSettings.query({ id: integrationId });
+			const stored = readApplianceSecrets(settings[APPLIANCE_SECRETS_KEY]);
+			if (stored.kind === "unresolved" || stored.kind === "invalid") {
+				this.ctx.logger.warn("Home Connect not persisting the enriched IDDF — the stored appliance keys are locked or unreadable", { tags: { integrationId } });
+				return;
+			}
+			const merged = homeConnectSettingsForPersist({
+				...settings,
+				appliances: mergeAppliancesForPersist(settings["appliances"], connection.appliances)
+			});
+			await this.ctx.api.integrations.setSettings.mutate({
+				id: integrationId,
+				settings: merged,
+				secretKeys: [...HOME_CONNECT_SECRET_KEYS]
+			});
+		} catch (err) {
+			this.ctx.logger.warn("Home Connect failed to persist enriched appliance IDDF", {
+				tags: { integrationId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	}
 	async reconcileIntegrations() {
 		const reg = this.requireClients();
 		try {
 			const mine = (await this.ctx.api.integrations.list.query()).filter((i) => i.addonId === this.ctx.id && i.enabled);
 			const surviving = /* @__PURE__ */ new Set();
+			const secretMoves = [];
 			for (const integration of mine) try {
-				const settings = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
+				const stored = await this.ctx.api.integrations.getSettings.query({ id: integration.id });
+				const adopt = planLegacyApplianceSecretAdopt({
+					setSettings: (input) => this.ctx.api.integrations.setSettings.mutate(input),
+					logger: this.ctx.logger
+				}, integration.id, stored);
+				if (adopt !== null) secretMoves.push(adopt);
+				const settings = adopt?.settings ?? stored;
 				const connection = connectionFromSettings(settings);
 				if (!connection) {
 					logHomeConnectSettingsGap(this.ctx.logger, integration.id, settings);
 					continue;
 				}
+				for (const haId of appliancesWithoutCredential(settings)) this.ctx.logger.warn("Home Connect appliance has no usable pairing key — cannot connect to it", {
+					tags: { integrationId: integration.id },
+					meta: { haId }
+				});
 				await reg.upsert(integration.id, integration.name, connection);
 				const brokerInfo = reg.getInfo(integration.id);
 				const applianceCount = typeof brokerInfo?.info["applianceCount"] === "number" ? brokerInfo.info["applianceCount"] : 0;
@@ -1521,6 +4788,7 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 					error: errMsg(err)
 				} });
 			}
+			for (const move of secretMoves) move.persist();
 			const vanished = reg.list().filter((id) => !surviving.has(id));
 			await reg.retain(surviving);
 			const deviceReg = this.ctx.kernel.deviceRegistry;
@@ -1569,28 +4837,29 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 				}
 				return out;
 			},
-			adoptDevice: async ({ haId, integrationId, type, name, applianceType, availablePrograms }) => {
+			adoptDevice: async ({ haId, integrationId, type, name, applianceType }) => {
 				const devices = this.ctx.kernel.devices;
 				if (!devices) throw new Error("home-connect adopt: devices unavailable");
+				if (type !== DeviceType.Container) throw new Error(`home-connect adopt: expected Container, got ${type}`);
 				const config = {
 					haId,
 					brokerId: integrationId,
 					applianceType,
-					availablePrograms: [...availablePrograms],
+					entities: this.initialEntities(integrationId, haId),
 					system: "home-connect",
-					integrationId,
-					name
+					integrationId
 				};
 				const stableId = this.generateStableId(type, config);
-				const DeviceClass = this.deviceClasses[type];
-				if (!DeviceClass) throw new Error(`home-connect adopt: unsupported type ${type}`);
-				return { deviceId: (await devices.create(stableId, DeviceClass, config, null, {
-					type,
+				const device = await devices.create(stableId, HomeConnectApplianceDevice, config, null, {
+					type: DeviceType.Container,
 					name,
 					integrationId
-				})).id };
+				});
+				this.trackAppliances();
+				return { deviceId: device.id };
 			},
 			removeDevice: async (id) => {
+				this.reconciler?.untrack(id);
 				await this.ctx.kernel.devices?.remove(id);
 			},
 			findDeviceConfig: async (id) => {
@@ -1601,6 +4870,51 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 			logger: this.ctx.logger
 		});
 	}
+	initialEntities(integrationId, haId) {
+		const client = homeConnectConnections.getClient(integrationId);
+		const description = client?.getDescription(haId) ?? null;
+		if (client === null || description === null || description.state === "missing") return [];
+		return [...deriveChildBindings({
+			description,
+			features: client.getFeatures(haId)
+		})];
+	}
+	buildChildReconciler() {
+		const devices = () => {
+			const api = this.ctx.kernel.devices;
+			if (!api) throw new Error("home-connect: devices unavailable");
+			return api;
+		};
+		return new HomeConnectChildReconciler({
+			watch: (integrationId, haId, listener) => homeConnectConnections.watch(integrationId, haId, listener),
+			getClient: (integrationId) => homeConnectConnections.getClient(integrationId),
+			readPersisted: async (deviceId) => {
+				return parsePersistedBindings((await devices().loadConfig(deviceId))["entities"]);
+			},
+			applyEntities: (deviceId, entities) => devices().applyDerivedSpec(deviceId, { config: { entities: [...entities] } }),
+			logger: this.ctx.logger
+		});
+	}
+	/** Keep a reconciler watch on every adopted appliance container. */
+	async trackAppliances() {
+		const reg = this.ctx.kernel.deviceRegistry;
+		const devices = this.ctx.kernel.devices;
+		const reconciler = this.reconciler;
+		if (!reg || !devices || !reconciler) return;
+		for (const d of reg.getAllForAddon(this.addonId)) {
+			if (d.type !== DeviceType.Container || reconciler.tracks(d.id)) continue;
+			const cfg = await devices.loadConfig(d.id).catch(() => ({}));
+			const brokerId = cfg["brokerId"];
+			const haId = cfg["haId"];
+			if (cfg["system"] !== "home-connect" || typeof brokerId !== "string") continue;
+			if (typeof haId !== "string") continue;
+			reconciler.track({
+				deviceId: d.id,
+				brokerId,
+				haId
+			});
+		}
+	}
 	globalSettingsSchema() {
 		return buildHomeConnectFormSchema();
 	}