@camstack/addon-provider-bosch 0.1.11 → 0.1.12

package/dist/home-connect/addon.mjs

@@ -1,5 +1,5 @@
-import { A as object, C as defineCustomActions, D as array, E as _enum, F as EventCategory, M as string, N as union, O as literal, P as unknown, S as customAction, T as isSecretMarkerLike, a as binaryCapability, b as errMsg, c as deviceAdoptionCapability, d as eventEmitterCapability, j as record, l as dishwasherCapability, m as powerMeterCapability, n as BaseDeviceProvider, p as numericSensorCapability, r as DishwasherOperationStateSchema, s as connectionTestCapability, t as BaseDevice, u as enumSensorCapability, v as DeviceRole, w as isSecretMarker, x as createEvent, y as DeviceType } from "../dist-EaW3D8xD.mjs";
-import { n as cascadeRemoveDevicesForIntegration, r as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-CifBq3c2.mjs";
+import { A as object, C as defineCustomActions, D as array, E as _enum, F as EventCategory, M as string, N as union, O as literal, P as unknown, S as customAction, T as isSecretMarkerLike, a as binaryCapability, b as errMsg, c as deviceAdoptionCapability, d as eventEmitterCapability, j as record, l as dishwasherCapability, m as powerMeterCapability, n as BaseDeviceProvider, p as numericSensorCapability, r as DishwasherOperationStateSchema, s as connectionTestCapability, t as BaseDevice, u as enumSensorCapability, v as DeviceRole, w as isSecretMarker, x as createEvent, y as DeviceType } from "../dist-DwSpbpO9.mjs";
+import { n as cascadeRemoveDevicesForIntegration, r as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-ei95Ru3m.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:tls";
 import { inflateRawSync } from "node:zlib";
@@ -33,6 +33,53 @@ var homeConnectActions = defineCustomActions({
 	})
 });
 //#endregion
+//#region src/home-connect/home-connect-container-tracker.ts
+/**
+* Put a reconciler watch on every adopted appliance container not watched yet. Called at
+* init, on connect, on adopt AND after the device restore — in a forked runner the devices
+* are restored only after `onInitialize` returns, so a pass at init sees none of them and
+* the containers were never watched: a description that arrived later derived no children.
+* Returns how many containers it started watching.
+*/
+async function trackHomeConnectContainers(deps, trigger) {
+	let started = 0;
+	let devices;
+	try {
+		devices = await deps.listDevices();
+	} catch (err) {
+		deps.logger.warn("Home Connect could not list its devices to watch their children", { meta: {
+			trigger,
+			error: errMsg(err)
+		} });
+		return 0;
+	}
+	for (const d of devices) {
+		if (d.type !== DeviceType.Container || deps.reconciler.tracks(d.id)) continue;
+		const cfg = await deps.loadConfig(d.id).catch(() => ({}));
+		const brokerId = cfg["brokerId"];
+		const haId = cfg["haId"];
+		if (cfg["system"] !== "home-connect" || typeof brokerId !== "string") continue;
+		if (typeof haId !== "string") continue;
+		deps.reconciler.track({
+			deviceId: d.id,
+			brokerId,
+			haId
+		});
+		started += 1;
+		deps.logger.info("Home Connect watching appliance children", {
+			tags: {
+				deviceId: d.id,
+				integrationId: brokerId
+			},
+			meta: {
+				haId,
+				trigger
+			}
+		});
+	}
+	return started;
+}
+//#endregion
 //#region src/home-connect/home-connect-xml.ts
 var TOKEN_RE = /<!--[\s\S]*?-->|<\?[\s\S]*?\?>|<!\[CDATA\[([\s\S]*?)\]\]>|<!DOCTYPE[^>]*>|<\/([\w:.-]+)\s*>|<([\w:.-]+)((?:\s+[\w:.-]+\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*(\/?)>|([^<]+)/g;
 var ATTR_RE = /([\w:.-]+)\s*=\s*(?:"([^"]*)"|'([^']*)')/g;
@@ -463,8 +510,52 @@ function decodeZipPayload(method, payload) {
 	}
 	return null;
 }
-/** Extract file bodies from a ZIP (store + deflate). */
+var EOCD_SIG = 101010256;
+var CENTRAL_SIG = 33639248;
+var LOCAL_SIG = 67324752;
+/** The end-of-central-directory record is 22 bytes plus a comment of at most 64 KiB. */
+var EOCD_MAX_SCAN = 65557;
+function findEndOfCentralDirectory(zip) {
+	const lowest = Math.max(0, zip.length - EOCD_MAX_SCAN);
+	for (let pos = zip.length - 22; pos >= lowest; pos -= 1) if (readUInt32LE(zip, pos) === EOCD_SIG) return pos;
+	return null;
+}
+/**
+* Entries named by the central directory — the authoritative sizes. A streamed archive (bit 3,
+* as a Java `ZipOutputStream` writes it, and as the cloud IDDF arrives) has ZERO sizes in every
+* local header; only the central directory and the data descriptors carry them.
+*/
+function entriesFromCentralDirectory(zip) {
+	const eocd = findEndOfCentralDirectory(zip);
+	if (eocd === null) return null;
+	const count = readUInt16LE(zip, eocd + 10);
+	let pos = readUInt32LE(zip, eocd + 16);
+	const out = /* @__PURE__ */ new Map();
+	for (let i = 0; i < count && pos + 46 <= zip.length; i += 1) {
+		if (readUInt32LE(zip, pos) !== CENTRAL_SIG) break;
+		const method = readUInt16LE(zip, pos + 10);
+		const compSize = readUInt32LE(zip, pos + 20);
+		const nameLen = readUInt16LE(zip, pos + 28);
+		const extraLen = readUInt16LE(zip, pos + 30);
+		const commentLen = readUInt16LE(zip, pos + 32);
+		const localOffset = readUInt32LE(zip, pos + 42);
+		const name = zip.subarray(pos + 46, pos + 46 + nameLen).toString("utf8");
+		pos += 46 + nameLen + extraLen + commentLen;
+		if (localOffset + 30 > zip.length || readUInt32LE(zip, localOffset) !== LOCAL_SIG) continue;
+		const dataStart = localOffset + 30 + readUInt16LE(zip, localOffset + 26) + readUInt16LE(zip, localOffset + 28);
+		const decoded = decodeZipPayload(method, zip.subarray(dataStart, dataStart + compSize));
+		if (decoded !== null) out.set(name, decoded);
+	}
+	return out;
+}
+/** Extract file bodies from a ZIP (store + deflate): central directory first, local headers as a fallback. */
 function extractZipEntries(zip) {
+	if (zip.length < 22) return /* @__PURE__ */ new Map();
+	const central = entriesFromCentralDirectory(zip);
+	if (central !== null && central.size > 0) return central;
+	return entriesFromLocalHeaders(zip);
+}
+function entriesFromLocalHeaders(zip) {
 	const out = /* @__PURE__ */ new Map();
 	let pos = 0;
 	while (pos + 30 <= zip.length) {
@@ -499,6 +590,13 @@ function parseIddfZipBuffer(zip, haId) {
 		haId
 	});
 }
+/**
+* The IDDF request carries the bearer token and NOTHING else — the reference downloaders send
+* no `Accept`, and the endpoint answered 403 to `accept: application/zip` on a live hub.
+*/
+function homeConnectIddfHeaders(token) {
+	return { authorization: `Bearer ${token}` };
+}
 var HOME_CONNECT_IDDF_URL = (haId) => `https://eu.services.home-connect.com/api/iddf/v1/iddf/${encodeURIComponent(haId)}`;
 //#endregion
 //#region src/home-connect/home-connect-login.ts
@@ -682,10 +780,7 @@ async function appliancesForToken(token, fetchImpl, jar) {
 		if (!appliance) continue;
 		const iddfResponse = await fetchImpl(HOME_CONNECT_IDDF_URL(haId), {
 			method: "GET",
-			headers: {
-				authorization: `Bearer ${token}`,
-				accept: "application/zip"
-			},
+			headers: homeConnectIddfHeaders(token),
 			redirect: "manual"
 		});
 		if (iddfResponse.status < 400 && iddfResponse.arrayBuffer) {
@@ -708,8 +803,8 @@ async function appliancesForToken(token, fetchImpl, jar) {
 /** Load every appliance on the account. A stale access token is refreshed once when a refresh token exists. */
 async function fetchHomeConnectAccount(creds, fetchImpl = homeConnectLoginFetch) {
 	const jar = new CookieJar();
-	let token = creds.token;
-	let refresh = creds.refresh ?? "";
+	const token = creds.token;
+	const refresh = creds.refresh ?? "";
 	try {
 		const appliances = await appliancesForToken(token, fetchImpl, jar);
 		return {
@@ -721,23 +816,76 @@ async function fetchHomeConnectAccount(creds, fetchImpl = homeConnectLoginFetch)
 	} catch (err) {
 		if (refresh.length === 0) throw err;
 	}
-	const refreshed = await exchange(fetchImpl, jar, `${OAUTH_BASE}token`, "POST", { "content-type": "application/x-www-form-urlencoded" }, new URLSearchParams({
-		grant_type: "refresh_token",
-		refresh_token: refresh,
-		client_id: APP_ID$1
-	}).toString());
-	if (refreshed.status >= 400) throw new Error("Home Connect sign-in was rejected");
-	const next = tokensFromBody(refreshed.body);
-	token = next.token;
-	refresh = next.refresh;
-	const appliances = await appliancesForToken(token, fetchImpl, jar);
+	const next = await refreshHomeConnectToken(refresh, fetchImpl);
+	if (!next.ok) throw new Error("Home Connect sign-in was rejected");
+	const appliances = await appliancesForToken(next.token, fetchImpl, jar);
 	return {
-		token,
-		refresh,
+		token: next.token,
+		refresh: next.refresh,
 		appliances,
 		summary: accountSummary(appliances)
 	};
 }
+/**
+* Exchange the refresh token for a new access token. Never throws; a failure says why and
+* carries no credential. A response without a new refresh token keeps the one that was used.
+*/
+async function refreshHomeConnectToken(refresh, fetchImpl = homeConnectLoginFetch) {
+	if (refresh.length === 0) return {
+		ok: false,
+		reason: "no-refresh-token",
+		status: null
+	};
+	let status;
+	let body;
+	try {
+		const refreshed = await exchange(fetchImpl, new CookieJar(), `${OAUTH_BASE}token`, "POST", { "content-type": "application/x-www-form-urlencoded" }, new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: refresh,
+			client_id: APP_ID$1
+		}).toString());
+		status = refreshed.status;
+		body = refreshed.body;
+	} catch (err) {
+		return {
+			ok: false,
+			reason: "network",
+			status: null,
+			error: err instanceof Error ? err.message : "unknown error"
+		};
+	}
+	if (status >= 400) return {
+		ok: false,
+		reason: "rejected",
+		status
+	};
+	try {
+		const next = tokensFromBody(body);
+		return {
+			ok: true,
+			token: next.token,
+			refresh: next.refresh.length > 0 ? next.refresh : refresh
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "unreadable-response",
+			status
+		};
+	}
+}
+/** The access token's JWT `exp` in epoch ms; `null` when the token carries none. */
+function homeConnectTokenExpiresAtMs(token) {
+	const payload = token.split(".")[1];
+	if (!payload) return null;
+	try {
+		const parsed = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+		if (!isRecord$1(parsed) || typeof parsed["exp"] !== "number") return null;
+		return parsed["exp"] * 1e3;
+	} catch {
+		return null;
+	}
+}
 /** Browser login link, matching Home Connect Local (`redirect_url` + the app scope). */
 function beginHomeConnectSignIn() {
 	const verifier = b64url(randomBytes(32));
@@ -2744,34 +2892,141 @@ function accountClient(appliances, makeGateway) {
 		}
 	};
 }
-//#endregion
-//#region src/home-connect/home-connect-iddf-fetch.ts
 function entityCountInStoredDescription(description) {
 	if (description === void 0) return 0;
 	return entityIndexFromDescription(description).size;
 }
-async function fetchHomeConnectIddfCompact(haId, token, fetchImpl) {
+/** How many leading body bytes the unparsable-body probe logs. */
+var HEAD_HEX_BYTES = 16;
+async function fetchHomeConnectIddf(haId, token, fetchImpl) {
 	const response = await fetchImpl(HOME_CONNECT_IDDF_URL(haId), {
 		method: "GET",
-		headers: {
-			authorization: `Bearer ${token}`,
-			accept: "application/zip"
-		},
+		headers: homeConnectIddfHeaders(token),
 		redirect: "manual"
 	});
-	if (response.status >= 400 || !response.arrayBuffer) return null;
-	const bytes = await response.arrayBuffer();
-	return parseIddfZipBuffer(Buffer.from(bytes), haId);
+	const contentType = response.headers.get("content-type");
+	const headers = {
+		status: response.status,
+		contentType,
+		contentEncoding: response.headers.get("content-encoding"),
+		contentDisposition: response.headers.get("content-disposition")
+	};
+	const unread = {
+		...headers,
+		bytes: null,
+		zipEntries: null,
+		zipEntryNames: null,
+		headHex: null
+	};
+	if (response.status === 401) return {
+		ok: false,
+		reason: "unauthorized",
+		entityCount: 0,
+		...unread
+	};
+	if (response.status >= 400) return {
+		ok: false,
+		reason: "http-error",
+		entityCount: 0,
+		...unread
+	};
+	if (!response.arrayBuffer) return {
+		ok: false,
+		reason: "no-body",
+		entityCount: 0,
+		...unread
+	};
+	const body = Buffer.from(await response.arrayBuffer());
+	const compact = parseIddfZipBuffer(body, haId);
+	const read = () => {
+		const names = [...extractZipEntries(body).keys()];
+		return {
+			...headers,
+			bytes: body.length,
+			zipEntries: names.length,
+			zipEntryNames: names,
+			headHex: body.subarray(0, HEAD_HEX_BYTES).toString("hex")
+		};
+	};
+	if (compact === null) return {
+		ok: false,
+		reason: "unparsable-zip",
+		entityCount: 0,
+		...read()
+	};
+	const entityCount = entityCountForCompact(compact);
+	if (entityCount === 0) return {
+		ok: false,
+		reason: "no-entities",
+		entityCount,
+		...read()
+	};
+	return {
+		ok: true,
+		compact,
+		entityCount
+	};
 }
 function compactDescriptionToStored(compact) {
 	return JSON.parse(JSON.stringify(compact));
 }
 function entityCountForCompact(compact) {
-	if (compact === null) return 0;
 	return entityIndexFromDescription(JSON.parse(JSON.stringify(compact))).size;
 }
+function refreshFailureMeta(failure) {
+	return {
+		reason: `refresh-${failure.reason}`,
+		status: failure.status,
+		...failure.error !== void 0 ? { error: failure.error } : {}
+	};
+}
+/** Refresh once; on failure the state is untouched (D49) and the reason is logged. */
+async function refreshOnce(state, trigger, fetchImpl, hooks) {
+	if (state.refreshTried) return false;
+	state.refreshTried = true;
+	const result = await refreshHomeConnectToken(state.refresh, fetchImpl);
+	if (!result.ok) {
+		hooks.onWarn?.("Home Connect access token refresh failed — keeping the stored token", {
+			trigger,
+			...refreshFailureMeta(result)
+		});
+		return false;
+	}
+	state.token = result.token;
+	state.refresh = result.refresh;
+	state.rotated = true;
+	hooks.onInfo?.("Home Connect access token refreshed", { trigger });
+	return true;
+}
+function tokenNeedsRefresh(token, now) {
+	const expiresAt = homeConnectTokenExpiresAtMs(token);
+	return expiresAt !== null && expiresAt - now <= 3e5;
+}
+async function fetchWithRefresh(haId, state, fetchImpl, hooks) {
+	const first = await fetchHomeConnectIddf(haId, state.token, fetchImpl);
+	if (first.ok || first.reason !== "unauthorized") return first;
+	if (!await refreshOnce(state, "unauthorized", fetchImpl, hooks)) return first;
+	return fetchHomeConnectIddf(haId, state.token, fetchImpl);
+}
+function failureMeta(failure) {
+	return {
+		reason: failure.reason,
+		status: failure.status,
+		contentType: failure.contentType,
+		bytes: failure.bytes,
+		zipEntries: failure.zipEntries,
+		zipEntryNames: failure.zipEntryNames,
+		headHex: failure.headHex,
+		contentEncoding: failure.contentEncoding,
+		contentDisposition: failure.contentDisposition,
+		entityCount: failure.entityCount
+	};
+}
 /**
 * Fill missing or outdated IDDF entity maps on stored appliances (TLS first).
+* An access token at or near its expiry is refreshed first, and a 401 refreshes once and
+* retries; a rotated pair is returned on the connection (`tokenRotated`) for the caller to
+* persist. A failed refresh changes nothing (D49).
 * An appliance whose IDDF cannot be fetched keeps whatever it had and is listed in
 * `missing` so the caller can retry — the entity map of ANOTHER model is never
 * substituted: the UIDs differ per model and a wrong map decodes values into the
@@ -2782,47 +3037,71 @@ async function enrichHomeConnectConnection(connection, fetchImpl, hooks = {}) {
 	if (appliances.length === 0) return {
 		connection,
 		changed: false,
+		tokenRotated: false,
 		missing: []
 	};
 	const token = connection.token;
 	if (isSecretMarker(token) || isSecretMarkerLike(token)) return {
 		connection,
 		changed: false,
+		tokenRotated: false,
 		missing: unmapped(appliances)
 	};
+	const refreshStored = connection.refresh ?? "";
+	const state = {
+		token,
+		refresh: isSecretMarker(refreshStored) || isSecretMarkerLike(refreshStored) ? "" : refreshStored,
+		rotated: false,
+		refreshTried: false
+	};
+	const pending = appliances.filter((row) => row.mode === "TLS" && !isCurrentDescription(row.deviceDescription));
+	if (pending.length > 0 && tokenNeedsRefresh(state.token, (hooks.now ?? Date.now)())) await refreshOnce(state, "expired", fetchImpl, hooks);
 	let changed = false;
 	const nextAppliances = [];
 	for (const row of appliances) {
-		if (!(row.mode === "TLS" && !isCurrentDescription(row.deviceDescription))) {
+		if (!pending.includes(row)) {
 			nextAppliances.push(row);
 			continue;
 		}
-		let compact = null;
+		let result = null;
 		try {
-			compact = await fetchHomeConnectIddfCompact(row.haId, token, fetchImpl);
+			result = await fetchWithRefresh(row.haId, state, fetchImpl, hooks);
 		} catch (err) {
-			hooks.onInfo?.("Home Connect IDDF fetch failed", {
+			hooks.onWarn?.("Home Connect IDDF fetch failed", {
 				haId: row.haId,
 				error: errMsg(err)
 			});
 		}
-		if (compact === null || entityCountForCompact(compact) === 0) {
-			hooks.onInfo?.("Home Connect IDDF unavailable — appliance stays degraded until it loads", { haId: row.haId });
+		if (result === null || !result.ok) {
+			hooks.onWarn?.("Home Connect IDDF unavailable — appliance stays degraded until it loads", {
+				haId: row.haId,
+				...result === null ? { reason: "fetch-threw" } : failureMeta(result)
+			});
 			nextAppliances.push(row);
 			continue;
 		}
 		changed = true;
+		hooks.onInfo?.("Home Connect IDDF loaded", {
+			haId: row.haId,
+			entityCount: result.entityCount
+		});
 		nextAppliances.push({
 			...row,
-			deviceDescription: compactDescriptionToStored(compact)
+			deviceDescription: compactDescriptionToStored(result.compact)
 		});
 	}
+	const withAppliances = changed ? {
+		...connection,
+		appliances: nextAppliances
+	} : connection;
 	return {
-		connection: changed ? {
-			...connection,
-			appliances: nextAppliances
-		} : connection,
+		connection: state.rotated ? {
+			...withAppliances,
+			token: state.token,
+			refresh: state.refresh
+		} : withAppliances,
 		changed,
+		tokenRotated: state.rotated,
 		missing: unmapped(nextAppliances)
 	};
 }
@@ -2884,6 +3163,19 @@ var HOME_CONNECT_IDDF_RETRY_MS = [
 	3e5,
 	6e5
 ];
+/** Route the enrich pass's lines to the logger, tagged with the integration (haId in meta). */
+function enrichLogHooks(logger, integrationId) {
+	return {
+		onInfo: (message, meta) => logger?.info(message, {
+			tags: { integrationId },
+			meta
+		}),
+		onWarn: (message, meta) => logger?.warn(message, {
+			tags: { integrationId },
+			meta
+		})
+	};
+}
 async function openStoredOrAccount(connection, deps) {
 	let working = connection;
 	let missing = [];
@@ -2893,12 +3185,7 @@ async function openStoredOrAccount(connection, deps) {
 			tags: { integrationId: deps.integrationId },
 			meta: { tokenIsSecretMarker: isSecretMarker(token) }
 		});
-		const enriched = await enrichHomeConnectConnection(working, deps.fetchImpl ?? homeConnectLoginFetch, { onInfo: (message, meta) => {
-			deps.logger?.info(message, {
-				tags: { integrationId: deps.integrationId },
-				meta
-			});
-		} });
+		const enriched = await enrichHomeConnectConnection(working, deps.fetchImpl ?? homeConnectLoginFetch, enrichLogHooks(deps.logger, deps.integrationId));
 		working = enriched.connection;
 		missing = enriched.missing;
 		if (enriched.changed) deps.logger?.info("Home Connect enriched appliance IDDF from cloud", {
@@ -3084,14 +3371,13 @@ var HomeConnectIntegrationManager = class {
 		const client = this.#client;
 		if (client === null) return;
 		try {
-			const result = await enrichHomeConnectConnection(this.#connection, this.#fetchImpl ?? homeConnectLoginFetch, { onInfo: (message, meta) => {
-				this.#logger.info(message, {
-					tags: { integrationId: this.#id },
-					meta
-				});
-			} });
+			const result = await enrichHomeConnectConnection(this.#connection, this.#fetchImpl ?? homeConnectLoginFetch, enrichLogHooks(this.#logger, this.#id));
 			if (this.#client !== client) return;
 			this.#missing = result.missing;
+			if (result.tokenRotated && !result.changed) {
+				this.#connection = result.connection;
+				this.#onConnectionUpdated?.(this.#id, this.#connection);
+			}
 			if (result.changed) {
 				this.#connection = result.connection;
 				for (const row of result.connection.appliances ?? []) {
@@ -3319,6 +3605,55 @@ function buildHomeConnectConnectionTestProvider(deps) {
 	};
 }
 //#endregion
+//#region src/home-connect/home-connect-connection-persist.ts
+function locked(value) {
+	return isSecretMarker(value) || isSecretMarkerLike(value);
+}
+/**
+* Persist what a connection learned at runtime — enriched IDDF entity maps and a rotated
+* access / refresh token — in ONE `setSettings` write. The tokens are named in `secretKeys`
+* so they land in the keychain, never on the plain blob. Writes nothing when a stored secret
+* cannot be read right now: the write would drop a key it cannot see or be refused. Never
+* throws and never logs a value.
+*/
+function buildHomeConnectConnectionPersister(deps) {
+	return async (integrationId, connection) => {
+		if (!connection.appliances || connection.appliances.length === 0) return;
+		try {
+			const settings = await deps.getSettings(integrationId);
+			const stored = readApplianceSecrets(settings[APPLIANCE_SECRETS_KEY]);
+			const lockedTokens = ["token", "refresh"].filter((key) => locked(settings[key]));
+			if (stored.kind === "unresolved" || stored.kind === "invalid" || lockedTokens.length > 0) {
+				deps.logger.warn("Home Connect not persisting the connection — stored secrets are locked or unreadable", {
+					tags: { integrationId },
+					meta: {
+						applianceSecrets: stored.kind,
+						lockedTokens
+					}
+				});
+				return;
+			}
+			const refresh = connection.refresh ?? "";
+			const merged = homeConnectSettingsForPersist({
+				...settings,
+				token: connection.token,
+				...refresh.length > 0 ? { refresh } : {},
+				appliances: mergeAppliancesForPersist(settings["appliances"], connection.appliances)
+			});
+			await deps.setSettings({
+				id: integrationId,
+				settings: merged,
+				secretKeys: [...HOME_CONNECT_SECRET_KEYS]
+			});
+		} catch (err) {
+			deps.logger.warn("Home Connect failed to persist the connection", {
+				tags: { integrationId },
+				meta: { error: errMsg(err) }
+			});
+		}
+	};
+}
+//#endregion
 //#region src/home-connect/home-connect-units.ts
 /**
 * Units are a property of the ENTITY, fixed for its whole series. A value is never
@@ -3433,14 +3768,20 @@ function operationStateOf(raw) {
 	const parsed = DishwasherOperationStateSchema.safeParse(raw);
 	return parsed.success ? parsed.data : null;
 }
+/** The reported state of EVERY listed event the description has — each read on its own. */
+function eventStates(view, shortNames) {
+	return (view.description?.entities() ?? []).filter((e) => e.kind === "event" && shortNames.includes(featureShortName(e.name))).map((e) => eventActive(valueOf(view, e)));
+}
+/**
+* Any empty-class event raised → `empty`; else any nearly-empty one raised → `low`; else any of
+* them reading clear → `ok`; nothing reported → `null` (unknown, never `ok`).
+*/
 function consumableFromEvents(view, nearlyEmpty, empty) {
-	const nearly = findEntity(view.description, ["event"], nearlyEmpty);
-	const gone = findEntity(view.description, ["event"], empty);
-	if (nearly === void 0 && gone === void 0) return null;
-	if (eventActive(valueOf(view, gone)) === true) return "empty";
-	const nearlyActive = eventActive(valueOf(view, nearly));
-	if (nearlyActive === true) return "low";
-	if (nearlyActive === false) return "ok";
+	const gone = eventStates(view, empty);
+	const nearly = eventStates(view, nearlyEmpty);
+	if (gone.includes(true)) return "empty";
+	if (nearly.includes(true)) return "low";
+	if (gone.includes(false) || nearly.includes(false)) return "ok";
 	return null;
 }
 function programKey(raw) {
@@ -3530,8 +3871,8 @@ function dishwasherStatusFromFeatures(input) {
 		localControlActive: boolOf(valueOf(input, findEntity(description, ["status"], ["LocalControlActive"]))),
 		powerOn: powerRaw === null ? null : powerRaw === "On",
 		powerState: powerRaw,
-		saltLevel: consumableFromEvents(input, ["SaltNearlyEmpty"], ["SaltEmpty"]),
-		rinseAidLevel: consumableFromEvents(input, ["RinseAidNearlyEmpty"], ["RinseAidEmpty"]),
+		saltLevel: consumableFromEvents(input, ["SaltNearlyEmpty"], ["SaltEmpty", "SaltLack"]),
+		rinseAidLevel: consumableFromEvents(input, ["RinseAidNearlyEmpty"], ["RinseAidEmpty", "RinseAidLack"]),
 		halfLoad: optionBool(input, ["HalfLoad"]),
 		hygienePlus: optionBool(input, ["HygienePlus"]),
 		extraDry: optionBool(input, ["ExtraDry"]),
@@ -3941,22 +4282,38 @@ function legacyKindBinding(kind, name) {
 function isSyntheticKey(key) {
 	return key.startsWith("HomeConnect.Info.") || key.startsWith("HomeConnect.Network.");
 }
+/** Keys of persisted children the description does not list (info / network keys never count). */
+function keysMissingFromDescription(persisted, description) {
+	return new Set(persisted.filter((b) => !isSyntheticKey(b.key) && description.entityByName(b.key) === void 0).map((b) => b.key));
+}
 /**
 * The bindings a container should carry: what the description derives now, plus what it
-* already had — unless the entity left the description. A value that is unknown right now
-* (the link dropped) never removes a child; only the appliance dropping the entity does.
+* already had. A child leaves only when its entity is missing from TWO agreeing reads (D49):
+* `missingBefore` is what the previous read lacked — one description that omits an entity is
+* not enough to delete a device. A derived binding for a key the container already carries
+* keeps the existing child's `stableIdSuffix` and name, so a container saved before the
+* derived model (legacy children) keeps its device ids instead of being rebuilt.
 */
-function mergeChildBindings(persisted, derived, description) {
+function mergeChildBindings(persisted, derived, description, missingBefore = /* @__PURE__ */ new Set()) {
+	const missingNow = keysMissingFromDescription(persisted, description);
 	const out = /* @__PURE__ */ new Map();
-	for (const kept of persisted) if (isSyntheticKey(kept.key) || description.entityByName(kept.key) !== void 0) out.set(kept.stableIdSuffix, kept);
-	for (const binding of derived) out.set(binding.stableIdSuffix, binding);
+	const suffixByKey = /* @__PURE__ */ new Map();
+	for (const kept of persisted) {
+		if (missingNow.has(kept.key) && missingBefore.has(kept.key)) continue;
+		out.set(kept.stableIdSuffix, kept);
+		suffixByKey.set(kept.key, kept);
+	}
+	for (const binding of derived) {
+		const existing = suffixByKey.get(binding.key);
+		const merged = existing === void 0 ? binding : {
+			...binding,
+			stableIdSuffix: existing.stableIdSuffix,
+			name: existing.name
+		};
+		out.set(merged.stableIdSuffix, merged);
+	}
 	return [...out.values()].toSorted((a, b) => a.stableIdSuffix.localeCompare(b.stableIdSuffix));
 }
-/**
-* Keeps each adopted appliance's child devices equal to what its description declares.
-* Runs on the addon, outside the container (rebuilding a container from inside itself
-* would tear down the code that asked for it).
-*/
 var HomeConnectChildReconciler = class {
 	#deps;
 	#tracked = /* @__PURE__ */ new Map();
@@ -3969,6 +4326,8 @@ var HomeConnectChildReconciler = class {
 		const entry = {
 			a: appliance,
 			timer: null,
+			missingBefore: /* @__PURE__ */ new Set(),
+			waiting: null,
 			unwatch: this.#deps.watch(appliance.brokerId, appliance.haId, () => this.schedule(appliance.deviceId))
 		};
 		this.#tracked.set(appliance.deviceId, entry);
@@ -4004,8 +4363,18 @@ var HomeConnectChildReconciler = class {
 		const { brokerId, haId } = entry.a;
 		const client = this.#deps.getClient(brokerId);
 		const description = client?.getDescription(haId) ?? null;
-		if (client === null || client.getLinkState(haId) !== "connected") return;
-		if (description === null || description.state === "missing") return;
+		const waiting = client === null || client.getLinkState(haId) !== "connected" ? "link-down" : description === null || description.state === "missing" ? "description-missing" : null;
+		if (waiting !== entry.waiting) {
+			entry.waiting = waiting;
+			if (waiting !== null) this.#deps.logger.info("Home Connect child reconcile waiting", {
+				tags: { deviceId },
+				meta: {
+					haId,
+					reason: waiting
+				}
+			});
+		}
+		if (client === null || description === null || waiting !== null) return;
 		try {
 			const { bindings: persisted, malformed } = await this.#deps.readPersisted(deviceId);
 			if (malformed > 0) {
@@ -4018,7 +4387,13 @@ var HomeConnectChildReconciler = class {
 			const merged = mergeChildBindings(persisted, deriveChildBindings({
 				description,
 				features: client.getFeatures(haId)
-			}), description);
+			}), description, entry.missingBefore);
+			const missingNow = keysMissingFromDescription(merged, description);
+			if (missingNow.size > 0 && missingNow.size !== entry.missingBefore.size) this.#deps.logger.info("Home Connect children kept until a second read agrees they left", {
+				tags: { deviceId },
+				meta: { missing: [...missingNow] }
+			});
+			entry.missingBefore = missingNow;
 			if (JSON.stringify(merged) === JSON.stringify(sorted(persisted))) return;
 			await this.#deps.applyEntities(deviceId, merged);
 			this.#deps.logger.info("Home Connect children re-derived from the appliance description", {
@@ -4040,6 +4415,19 @@ function sorted(list) {
 	return list.toSorted((a, b) => a.stableIdSuffix.localeCompare(b.stableIdSuffix));
 }
 /**
+* A container's persisted bindings from its config. One saved before the derived model has no
+* `entities`, only the legacy `children` the device publishes today: those ARE its bindings,
+* so the first derived write keeps them (same suffixes, same device ids) instead of reading
+* "no bindings" and rebuilding every child.
+*/
+function persistedChildBindingsFromConfig(cfg) {
+	if (cfg["entities"] === void 0) return {
+		bindings: legacyChildBindings(cfg["children"]),
+		malformed: 0
+	};
+	return parsePersistedBindings(cfg["entities"]);
+}
+/**
 * Parse a container's persisted `entities`. A row that does not parse is COUNTED, not dropped
 * silently: the caller must not write a list that would lose it.
 */
@@ -4701,14 +5089,14 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 		} });
 		this.clients.setOnConnected((integrationId) => {
 			this.setIntegrationDevicesOnline(integrationId, true);
-			this.trackAppliances();
+			this.trackAppliances("connected");
 		});
 		this.clients.setOnDisconnected((integrationId) => {
 			this.setIntegrationDevicesOnline(integrationId, false);
 		});
 		this.reconciler = this.buildChildReconciler();
 		await this.reconcileIntegrations();
-		await this.trackAppliances();
+		await this.trackAppliances("init");
 		this.subscribeIntegrationLifecycle();
 		return {
 			providers: [
@@ -4783,30 +5171,13 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 		if (type === DeviceType.Container) return `home-connect:${integrationId}:${haId}:appliance`;
 		return `home-connect:${integrationId}:${haId}`;
 	}
-	async persistIntegrationAppliances(integrationId, connection) {
-		if (!connection.appliances || connection.appliances.length === 0) return;
-		try {
-			const settings = await this.ctx.api.integrations.getSettings.query({ id: integrationId });
-			const stored = readApplianceSecrets(settings[APPLIANCE_SECRETS_KEY]);
-			if (stored.kind === "unresolved" || stored.kind === "invalid") {
-				this.ctx.logger.warn("Home Connect not persisting the enriched IDDF — the stored appliance keys are locked or unreadable", { tags: { integrationId } });
-				return;
-			}
-			const merged = homeConnectSettingsForPersist({
-				...settings,
-				appliances: mergeAppliancesForPersist(settings["appliances"], connection.appliances)
-			});
-			await this.ctx.api.integrations.setSettings.mutate({
-				id: integrationId,
-				settings: merged,
-				secretKeys: [...HOME_CONNECT_SECRET_KEYS]
-			});
-		} catch (err) {
-			this.ctx.logger.warn("Home Connect failed to persist enriched appliance IDDF", {
-				tags: { integrationId },
-				meta: { error: errMsg(err) }
-			});
-		}
+	/** Enriched IDDF maps and a rotated token pair, in one keychain-aware write. */
+	persistIntegrationAppliances(integrationId, connection) {
+		return buildHomeConnectConnectionPersister({
+			getSettings: (id) => this.ctx.api.integrations.getSettings.query({ id }),
+			setSettings: (input) => this.ctx.api.integrations.setSettings.mutate(input),
+			logger: this.ctx.logger
+		})(integrationId, connection);
 	}
 	async reconcileIntegrations() {
 		const reg = this.requireClients();
@@ -4912,7 +5283,7 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 					name,
 					integrationId
 				});
-				this.trackAppliances();
+				this.trackAppliances("adopt");
 				return { deviceId: device.id };
 			},
 			removeDevice: async (id) => {
@@ -4946,31 +5317,32 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 			watch: (integrationId, haId, listener) => homeConnectConnections.watch(integrationId, haId, listener),
 			getClient: (integrationId) => homeConnectConnections.getClient(integrationId),
 			readPersisted: async (deviceId) => {
-				return parsePersistedBindings((await devices().loadConfig(deviceId))["entities"]);
+				return persistedChildBindingsFromConfig(await devices().loadConfig(deviceId));
 			},
 			applyEntities: (deviceId, entities) => devices().applyDerivedSpec(deviceId, { config: { entities: [...entities] } }),
 			logger: this.ctx.logger
 		});
 	}
+	/**
+	* The runner restores devices only AFTER `onInitialize` returned, so the init pass of
+	* {@link trackAppliances} sees none: watch the restored containers here, or a description
+	* that loads later never derives their children.
+	*/
+	async restoreDevices(savedDevices) {
+		await super.restoreDevices(savedDevices);
+		await this.trackAppliances("restore");
+	}
 	/** Keep a reconciler watch on every adopted appliance container. */
-	async trackAppliances() {
-		const reg = this.ctx.kernel.deviceRegistry;
+	async trackAppliances(trigger) {
 		const devices = this.ctx.kernel.devices;
 		const reconciler = this.reconciler;
-		if (!reg || !devices || !reconciler) return;
-		for (const d of reg.getAllForAddon(this.addonId)) {
-			if (d.type !== DeviceType.Container || reconciler.tracks(d.id)) continue;
-			const cfg = await devices.loadConfig(d.id).catch(() => ({}));
-			const brokerId = cfg["brokerId"];
-			const haId = cfg["haId"];
-			if (cfg["system"] !== "home-connect" || typeof brokerId !== "string") continue;
-			if (typeof haId !== "string") continue;
-			reconciler.track({
-				deviceId: d.id,
-				brokerId,
-				haId
-			});
-		}
+		if (!reconciler) return;
+		await trackHomeConnectContainers({
+			listDevices: () => devices.getAll(),
+			loadConfig: (id) => devices.loadConfig(id),
+			reconciler,
+			logger: this.ctx.logger
+		}, trigger);
 	}
 	globalSettingsSchema() {
 		return buildHomeConnectFormSchema();