@camstack/addon-provider-homeassistant 1.2.18 → 1.2.19

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("./dist-DuKJzmrJ.js");
+const require_dist = require("./dist-Bz5ENMVc.js");
 let node_crypto = require("node:crypto");
 let node_zlib = require("node:zlib");
 //#region src/ha-device-source.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as tamperCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as url, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, H as notificationOutputCapability, I as imageCapability, J as presenceCapability, K as powerMeterCapability, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as switchCapability, R as lockControlCapability, S as colorCapability, St as unknown, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as scriptRunnerCapability, Y as pressureSensorCapability, Z as smokeCapability, _ as brokerCapability, _t as number, a as EnumSensorDateTimeFormatSchema, at as waterHeaterCapability, b as carbonMonoxideCapability, bt as string, c as addonRoutesCapability, d as ambientLightSensorCapability, dt as DeviceType, et as temperatureSensorCapability, f as automationControlCapability, ft as createEvent, g as brightnessCapability, gt as literal, h as binaryCapability, ht as discriminatedUnion, it as vibrationCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceFeature, m as bestLocationMatch, mt as array, n as BaseDeviceProvider, nt as vacuumControlCapability, o as TargetSchema, ot as weatherCapability, p as batteryCapability, pt as _enum, q as prepareNotification, rt as valveCapability, s as accessoriesCapability, st as errMsg, t as BaseDevice, tt as updateCapability, u as alarmPanelCapability, ut as DeviceRole, v as buildAddonRouteProvider, vt as object, w as contactCapability, wt as EventCategory, x as climateControlCapability, xt as union, y as buttonCapability, yt as record, z as mediaPlayerCapability } from "./dist-UfT_fD3-.mjs";
+import { $ as tamperCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as url, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, H as notificationOutputCapability, I as imageCapability, J as presenceCapability, K as powerMeterCapability, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as switchCapability, R as lockControlCapability, S as colorCapability, St as unknown, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as scriptRunnerCapability, Y as pressureSensorCapability, Z as smokeCapability, _ as brokerCapability, _t as number, a as EnumSensorDateTimeFormatSchema, at as waterHeaterCapability, b as carbonMonoxideCapability, bt as string, c as addonRoutesCapability, d as ambientLightSensorCapability, dt as DeviceType, et as temperatureSensorCapability, f as automationControlCapability, ft as createEvent, g as brightnessCapability, gt as literal, h as binaryCapability, ht as discriminatedUnion, it as vibrationCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceFeature, m as bestLocationMatch, mt as array, n as BaseDeviceProvider, nt as vacuumControlCapability, o as TargetSchema, ot as weatherCapability, p as batteryCapability, pt as _enum, q as prepareNotification, rt as valveCapability, s as accessoriesCapability, st as errMsg, t as BaseDevice, tt as updateCapability, u as alarmPanelCapability, ut as DeviceRole, v as buildAddonRouteProvider, vt as object, w as contactCapability, wt as EventCategory, x as climateControlCapability, xt as union, y as buttonCapability, yt as record, z as mediaPlayerCapability } from "./dist-BSQpoIVg.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-device-source.ts

package/dist/{dist-UfT_fD3-.mjs → dist-BSQpoIVg.mjs}

@@ -15351,21 +15351,32 @@ object({
 *    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
 *    `/api/oauth2/integrations` are built from this collection alone.
 *
-* **Scopes.** `requestedScopes` is baked into every token this integration is
-* ever issued and the operator consents to it once. Derive it from the tRPC
-* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
-* prefer a narrow `capability:` scope to a `category:` one unless the client
-* genuinely needs a whole family. A category scope grants every future member
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
 * of that category too. `category:system [create]` has been rejected once and
 * should stay rejected: it hands `addons.installPackage` to an integration.
 *
-* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
-* the addon and are not scope-checked. Alexa's descriptor is narrower than
-* Home Assistant's for exactly that reason — its Lambda posts directives and
-* the addon does the work, while the Home Assistant component calls tRPC
-* directly with the token. So `requestedScopes` describes the blast radius of
-* the GRANT, not the reach of the integration; do not widen one to describe the
-* other.
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
 *
 * **The boot window.** An addon registers its provider after its runner forks
 * and initialises, so between hub start and that moment this collection is
@@ -15406,7 +15417,30 @@ var OauthIntegrationDescriptorSchema = object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: string().optional()
+	hubUrl: string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
 var oauthIntegrationCapability = {
 	name: "oauth-integration",
@@ -18549,11 +18583,29 @@ var SsoBridgeClaimsSchema = object({
 	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: union([number().int().positive(), literal("never")]).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
-	ttlSec: number().int().positive().optional()
+	/**
+	* Seconds, or `'never'` for a token minted with NO `exp` claim.
+	*
+	* `'never'` is a literal rather than `undefined`/`0` because omitting
+	* this field already means "the 5-minute SSO hand-off default", and
+	* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+	* went through the numeric path would fail at mint time and break
+	* linking rather than produce an eternal token.
+	*/
+	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -25834,7 +25886,12 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	hubUrl: string(),
 	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 	*  that carries one can ONLY be exchanged with the matching verifier. */
-	codeChallenge: string().optional()
+	codeChallenge: string().optional(),
+	/** The integration's declared refresh lifetime — seconds, or `'never'`.
+	*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+	*  code so the link carries its own lifetime; omit for the 30-day
+	*  default. */
+	refreshTtlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"

package/dist/{dist-DuKJzmrJ.js → dist-Bz5ENMVc.js}

@@ -15351,21 +15351,32 @@ object({
 *    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
 *    `/api/oauth2/integrations` are built from this collection alone.
 *
-* **Scopes.** `requestedScopes` is baked into every token this integration is
-* ever issued and the operator consents to it once. Derive it from the tRPC
-* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
-* prefer a narrow `capability:` scope to a `category:` one unless the client
-* genuinely needs a whole family. A category scope grants every future member
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
 * of that category too. `category:system [create]` has been rejected once and
 * should stay rejected: it hands `addons.installPackage` to an integration.
 *
-* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
-* the addon and are not scope-checked. Alexa's descriptor is narrower than
-* Home Assistant's for exactly that reason — its Lambda posts directives and
-* the addon does the work, while the Home Assistant component calls tRPC
-* directly with the token. So `requestedScopes` describes the blast radius of
-* the GRANT, not the reach of the integration; do not widen one to describe the
-* other.
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
 *
 * **The boot window.** An addon registers its provider after its runner forks
 * and initialises, so between hub start and that moment this collection is
@@ -15406,7 +15417,30 @@ var OauthIntegrationDescriptorSchema = object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: string().optional()
+	hubUrl: string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
 var oauthIntegrationCapability = {
 	name: "oauth-integration",
@@ -18549,11 +18583,29 @@ var SsoBridgeClaimsSchema = object({
 	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: union([number().int().positive(), literal("never")]).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
-	ttlSec: number().int().positive().optional()
+	/**
+	* Seconds, or `'never'` for a token minted with NO `exp` claim.
+	*
+	* `'never'` is a literal rather than `undefined`/`0` because omitting
+	* this field already means "the 5-minute SSO hand-off default", and
+	* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+	* went through the numeric path would fail at mint time and break
+	* linking rather than produce an eternal token.
+	*/
+	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -25834,7 +25886,12 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	hubUrl: string(),
 	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 	*  that carries one can ONLY be exchanged with the matching verifier. */
-	codeChallenge: string().optional()
+	codeChallenge: string().optional(),
+	/** The integration's declared refresh lifetime — seconds, or `'never'`.
+	*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+	*  code so the link carries its own lifetime; omit for the 30-day
+	*  default. */
+	refreshTtlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"

package/dist/ha-export/ha-export.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#endregion
-const require_dist = require("../dist-DuKJzmrJ.js");
+const require_dist = require("../dist-Bz5ENMVc.js");
 let node_crypto = require("node:crypto");
 //#region src/ha-export/topics.ts
 /**
@@ -872,9 +872,38 @@ function pruneBrokers(membership, knownBrokerIds) {
 	return next;
 }
 /**
-* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
-* component actually calls. `category:system [create]` was rejected: it would
-* hand `addons.installPackage` to a home-automation bridge.
+* The brokers the operator has switched ON, read from the RAW addon store.
+*
+* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
+* hub happens to know about — so it can never appear in the addon's
+* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
+* present in the defaults ("the store can contain extra keys … without
+* polluting the typed config"), so every `exportTo:*` key is dropped on the
+* way into `this.config` and reading one there yields `undefined` for ever.
+*
+* That is not theoretical. On 2026-08-09 the switch was on
+* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
+* settings FORM reads the store) and every reconcile still logged
+* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
+* its "Not configured" card, and no operator action could have changed
+* either. The store is the single authority — read it, do not mirror it into
+* a typed field that would then be a second one (D62).
+*
+* A broker that is no longer known is not enabled, whatever the store says:
+* a stale `exportTo:` key for a deleted instance must not resurrect it.
+*/
+function enabledBrokerIds(store, knownBrokerIds) {
+	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+}
+/**
+* What a linked Home Assistant NEEDS to function — one entry per thing it
+* actually calls with this token, each named. Not a blast radius, not a
+* conservative under-declaration: `requestedScopes` has exactly one meaning
+* across every integration, and since D103 it is also the ENFORCEMENT input, so
+* an under-declaration is an integration that stops working.
+*
+* `category:system [create]` was rejected and stays rejected: it would hand
+* `addons.installPackage` to a home-automation bridge.
 */
 var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 	integrationId: "homeassistant",
@@ -899,11 +928,54 @@ var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 			type: "capability",
 			target: "pipeline-orchestrator",
 			access: ["view", "create"]
-		}
+		},
+		(
+		/**
+		* `deviceExport.listExposedDevices` — the membership read that decides WHICH
+		* devices the component imports. It is pinned to this addon so the unpinned
+		* aggregate (which merges Alexa's and HomeKit's exposed sets, D12) cannot
+		* leak another exporter's devices into Home Assistant.
+		*
+		* Missing until 2026-08-09, which broke setup outright: the component's very
+		* first authenticated call is this one, and the hub answered "rejected the
+		* token" — reported by Home Assistant as `Configurazione non riuscita:
+		* deviceExport.listExposedDevices: hub rejected the token`. The call was
+		* introduced with the export filter and the descriptor was never widened for
+		* it. `system` scope, so a capability grant is what it needs — the `addon:`
+		* grant below covers the HTTP command route and does NOT cover this.
+		*/
+		{
+			type: "capability",
+			target: "device-export",
+			access: ["view"]
+		}),
+		(
+		/**
+		* `POST /addon/homeassistant-export/command` — the ONLY path by which an
+		* actuated Home Assistant entity (a camera switch, a PTZ button, reboot,
+		* snooze) reaches CamStack. Added when D103 made the addon-route gate check
+		* the grant instead of accepting any valid hub JWT; without it every HA
+		* control entity answers `403 Token scope mismatch`. `view` is here for the
+		* same addon's future GET routes, so a read does not force a re-link.
+		*/
+		{
+			type: "addon",
+			target: "homeassistant-export",
+			access: ["view", "create"]
+		})
 	],
 	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
 	allowedPrivateHostPaths: ["/auth/external/callback"],
-	requiresPkce: true
+	requiresPkce: true,
+	/**
+	* One year. A Home Assistant config entry is meant to survive indefinitely
+	* and re-linking is a manual trip through the UI, so the 30-day default
+	* silently unlinked a working integration a month after setup. Finite rather
+	* than `'never'` (which Alexa uses): an HA instance refreshes on a timer
+	* while it is running, so a year is far beyond any realistic downtime, and a
+	* bounded token is the better default where nothing is lost by it.
+	*/
+	refreshTokenTtlSec: 365 * 24 * 60 * 60
 };
 //#endregion
 //#region src/ha-export/push-client.ts
@@ -1299,6 +1371,19 @@ function projectCameraSwitches(deviceKey, switches) {
 		value: bool(sw.enabled)
 	}));
 }
+/** The `BrokerInfo.kind` tag the Home Assistant provider stamps. */
+var HA_BROKER_KIND = "home-assistant";
+/**
+* Every Home Assistant broker currently registered, cluster-wide.
+*
+* Unpinned by design (see the module docblock) and filtered by `kind`, which is
+* the contract check that matters: whatever mix of providers answered the
+* union, only `home-assistant` brokers are ever exported to over Home
+* Assistant's transport.
+*/
+async function listHomeAssistantBrokers(query) {
+	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
+}
 //#endregion
 //#region src/ha-export/ha-export.addon.ts
 /**
@@ -1336,8 +1421,6 @@ function projectCameraSwitches(deviceKey, switches) {
 *     different sets of cameras, and the per-device Export panel shows
 *     one switch per broker over the single membership store.
 */
-/** The addon that owns the import direction — never export back to it. */
-var HA_PROVIDER_ADDON_ID = "provider-homeassistant";
 var ADDON_ID = "homeassistant-export";
 /** Where the custom component registers its push view inside HA. */
 var PUSH_PATH = "/api/camstack/push";
@@ -1699,7 +1782,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 				* exported back to it: HA would mirror its own entity across the
 				* bridge, and any automation touching it would round-trip.
 				*/
-				if (device.addonId === HA_PROVIDER_ADDON_ID) {
+				if (device.addonId === "provider-homeassistant") {
 					this.ctx.logger.warn("ha-export: refusing to export a device imported from Home Assistant", { tags: { deviceId: numericId } });
 					continue;
 				}
@@ -1919,13 +2002,14 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* ones the operator ticked.
 	*
 	* Credentials come through the `broker` cap — the sanctioned no-import
-	* path — and the owning `addonId` is sent with the read: `broker` is a
-	* COLLECTION cap, so an unpinned id-keyed call routes to the
-	* first-registered provider, which returns `null` for a broker it does
-	* not own.
+	* path — and EVERY call carries the owning `addonId`: `broker` is a
+	* COLLECTION cap, so an unpinned call is answered by the
+	* first-registered provider (Homematic, on the operator's hub), which
+	* knows nothing about `ha_*`. `broker-source.ts` holds the pin and the
+	* reasoning.
 	*/
 	async refreshBrokers() {
-		const haBrokers = (await this.ctx.api.broker.list.query({})).filter((broker) => broker.kind === "home-assistant");
+		const haBrokers = await listHomeAssistantBrokers((input) => this.ctx.api.broker.list.query(input));
 		const known = haBrokers.map((broker) => ({
 			id: broker.id,
 			name: broker.name
@@ -1935,6 +2019,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			knownBrokers: known,
 			membership: pruned
 		});
+		await this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -2006,8 +2091,23 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			return null;
 		}
 	}
+	/**
+	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
+	*
+	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
+	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
+	* it is `undefined` there for ever — see `enabledBrokerIds` in
+	* `membership.ts` for what that cost. The store is the authority; this is a
+	* read-through cache of it, refreshed at the top of every reconcile pass and
+	* before the per-device panel renders, never written to.
+	*/
+	enabled = [];
+	async refreshEnabledBrokers(known) {
+		const store = await this.resolveGlobalStore();
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+	}
 	enabledBrokerIds() {
-		return this.config.knownBrokers.filter((broker) => this.config[`exportTo:${broker.id}`] === true).map((broker) => broker.id);
+		return this.enabled;
 	}
 	brokerName(brokerId) {
 		return this.config.knownBrokers.find((broker) => broker.id === brokerId)?.name ?? brokerId;
@@ -2346,7 +2446,8 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* exporters' identically-named fields and the operator sees another
 	* exporter's value in this one's toggle.
 	*/
-	buildContribution(deviceId) {
+	async buildContribution(deviceId) {
+		await this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { G as oauthIntegrationCapability, O as deviceExportCapability, bt as string, c as addonRoutesCapability, ct as BaseAddon, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, v as buildAddonRouteProvider, wt as EventCategory } from "../dist-UfT_fD3-.mjs";
+import { G as oauthIntegrationCapability, O as deviceExportCapability, bt as string, c as addonRoutesCapability, ct as BaseAddon, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, v as buildAddonRouteProvider, wt as EventCategory } from "../dist-BSQpoIVg.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/ha-export/topics.ts
 /**
@@ -867,9 +867,38 @@ function pruneBrokers(membership, knownBrokerIds) {
 	return next;
 }
 /**
-* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
-* component actually calls. `category:system [create]` was rejected: it would
-* hand `addons.installPackage` to a home-automation bridge.
+* The brokers the operator has switched ON, read from the RAW addon store.
+*
+* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
+* hub happens to know about — so it can never appear in the addon's
+* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
+* present in the defaults ("the store can contain extra keys … without
+* polluting the typed config"), so every `exportTo:*` key is dropped on the
+* way into `this.config` and reading one there yields `undefined` for ever.
+*
+* That is not theoretical. On 2026-08-09 the switch was on
+* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
+* settings FORM reads the store) and every reconcile still logged
+* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
+* its "Not configured" card, and no operator action could have changed
+* either. The store is the single authority — read it, do not mirror it into
+* a typed field that would then be a second one (D62).
+*
+* A broker that is no longer known is not enabled, whatever the store says:
+* a stale `exportTo:` key for a deleted instance must not resurrect it.
+*/
+function enabledBrokerIds(store, knownBrokerIds) {
+	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+}
+/**
+* What a linked Home Assistant NEEDS to function — one entry per thing it
+* actually calls with this token, each named. Not a blast radius, not a
+* conservative under-declaration: `requestedScopes` has exactly one meaning
+* across every integration, and since D103 it is also the ENFORCEMENT input, so
+* an under-declaration is an integration that stops working.
+*
+* `category:system [create]` was rejected and stays rejected: it would hand
+* `addons.installPackage` to a home-automation bridge.
 */
 var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 	integrationId: "homeassistant",
@@ -894,11 +923,54 @@ var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 			type: "capability",
 			target: "pipeline-orchestrator",
 			access: ["view", "create"]
-		}
+		},
+		(
+		/**
+		* `deviceExport.listExposedDevices` — the membership read that decides WHICH
+		* devices the component imports. It is pinned to this addon so the unpinned
+		* aggregate (which merges Alexa's and HomeKit's exposed sets, D12) cannot
+		* leak another exporter's devices into Home Assistant.
+		*
+		* Missing until 2026-08-09, which broke setup outright: the component's very
+		* first authenticated call is this one, and the hub answered "rejected the
+		* token" — reported by Home Assistant as `Configurazione non riuscita:
+		* deviceExport.listExposedDevices: hub rejected the token`. The call was
+		* introduced with the export filter and the descriptor was never widened for
+		* it. `system` scope, so a capability grant is what it needs — the `addon:`
+		* grant below covers the HTTP command route and does NOT cover this.
+		*/
+		{
+			type: "capability",
+			target: "device-export",
+			access: ["view"]
+		}),
+		(
+		/**
+		* `POST /addon/homeassistant-export/command` — the ONLY path by which an
+		* actuated Home Assistant entity (a camera switch, a PTZ button, reboot,
+		* snooze) reaches CamStack. Added when D103 made the addon-route gate check
+		* the grant instead of accepting any valid hub JWT; without it every HA
+		* control entity answers `403 Token scope mismatch`. `view` is here for the
+		* same addon's future GET routes, so a read does not force a re-link.
+		*/
+		{
+			type: "addon",
+			target: "homeassistant-export",
+			access: ["view", "create"]
+		})
 	],
 	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
 	allowedPrivateHostPaths: ["/auth/external/callback"],
-	requiresPkce: true
+	requiresPkce: true,
+	/**
+	* One year. A Home Assistant config entry is meant to survive indefinitely
+	* and re-linking is a manual trip through the UI, so the 30-day default
+	* silently unlinked a working integration a month after setup. Finite rather
+	* than `'never'` (which Alexa uses): an HA instance refreshes on a timer
+	* while it is running, so a year is far beyond any realistic downtime, and a
+	* bounded token is the better default where nothing is lost by it.
+	*/
+	refreshTokenTtlSec: 365 * 24 * 60 * 60
 };
 //#endregion
 //#region src/ha-export/push-client.ts
@@ -1294,6 +1366,19 @@ function projectCameraSwitches(deviceKey, switches) {
 		value: bool(sw.enabled)
 	}));
 }
+/** The `BrokerInfo.kind` tag the Home Assistant provider stamps. */
+var HA_BROKER_KIND = "home-assistant";
+/**
+* Every Home Assistant broker currently registered, cluster-wide.
+*
+* Unpinned by design (see the module docblock) and filtered by `kind`, which is
+* the contract check that matters: whatever mix of providers answered the
+* union, only `home-assistant` brokers are ever exported to over Home
+* Assistant's transport.
+*/
+async function listHomeAssistantBrokers(query) {
+	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
+}
 //#endregion
 //#region src/ha-export/ha-export.addon.ts
 /**
@@ -1331,8 +1416,6 @@ function projectCameraSwitches(deviceKey, switches) {
 *     different sets of cameras, and the per-device Export panel shows
 *     one switch per broker over the single membership store.
 */
-/** The addon that owns the import direction — never export back to it. */
-var HA_PROVIDER_ADDON_ID = "provider-homeassistant";
 var ADDON_ID = "homeassistant-export";
 /** Where the custom component registers its push view inside HA. */
 var PUSH_PATH = "/api/camstack/push";
@@ -1694,7 +1777,7 @@ var HaExportAddon = class extends BaseAddon {
 				* exported back to it: HA would mirror its own entity across the
 				* bridge, and any automation touching it would round-trip.
 				*/
-				if (device.addonId === HA_PROVIDER_ADDON_ID) {
+				if (device.addonId === "provider-homeassistant") {
 					this.ctx.logger.warn("ha-export: refusing to export a device imported from Home Assistant", { tags: { deviceId: numericId } });
 					continue;
 				}
@@ -1914,13 +1997,14 @@ var HaExportAddon = class extends BaseAddon {
 	* ones the operator ticked.
 	*
 	* Credentials come through the `broker` cap — the sanctioned no-import
-	* path — and the owning `addonId` is sent with the read: `broker` is a
-	* COLLECTION cap, so an unpinned id-keyed call routes to the
-	* first-registered provider, which returns `null` for a broker it does
-	* not own.
+	* path — and EVERY call carries the owning `addonId`: `broker` is a
+	* COLLECTION cap, so an unpinned call is answered by the
+	* first-registered provider (Homematic, on the operator's hub), which
+	* knows nothing about `ha_*`. `broker-source.ts` holds the pin and the
+	* reasoning.
 	*/
 	async refreshBrokers() {
-		const haBrokers = (await this.ctx.api.broker.list.query({})).filter((broker) => broker.kind === "home-assistant");
+		const haBrokers = await listHomeAssistantBrokers((input) => this.ctx.api.broker.list.query(input));
 		const known = haBrokers.map((broker) => ({
 			id: broker.id,
 			name: broker.name
@@ -1930,6 +2014,7 @@ var HaExportAddon = class extends BaseAddon {
 			knownBrokers: known,
 			membership: pruned
 		});
+		await this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -2001,8 +2086,23 @@ var HaExportAddon = class extends BaseAddon {
 			return null;
 		}
 	}
+	/**
+	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
+	*
+	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
+	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
+	* it is `undefined` there for ever — see `enabledBrokerIds` in
+	* `membership.ts` for what that cost. The store is the authority; this is a
+	* read-through cache of it, refreshed at the top of every reconcile pass and
+	* before the per-device panel renders, never written to.
+	*/
+	enabled = [];
+	async refreshEnabledBrokers(known) {
+		const store = await this.resolveGlobalStore();
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+	}
 	enabledBrokerIds() {
-		return this.config.knownBrokers.filter((broker) => this.config[`exportTo:${broker.id}`] === true).map((broker) => broker.id);
+		return this.enabled;
 	}
 	brokerName(brokerId) {
 		return this.config.knownBrokers.find((broker) => broker.id === brokerId)?.name ?? brokerId;
@@ -2341,7 +2441,8 @@ var HaExportAddon = class extends BaseAddon {
 	* exporters' identically-named fields and the operator sees another
 	* exporter's value in this one's toggle.
 	*/
-	buildContribution(deviceId) {
+	async buildContribution(deviceId) {
+		await this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-homeassistant",
-  "version": "1.2.18",
+  "version": "1.2.19",
   "description": "Home Assistant device provider addon for CamStack",
   "keywords": [
     "camstack",
@@ -46,8 +46,7 @@
         "brokerKind": "home-assistant",
         "supportsLocationImport": true,
         "execution": {
-          "placement": "hub-only",
-          "group": "notifiers"
+          "placement": "hub-only"
         },
         "capabilities": [
           {