@camstack/addon-provider-homeassistant 1.2.18 → 1.2.20

package/dist/ha-export/ha-export.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#endregion
-const require_dist = require("../dist-DuKJzmrJ.js");
+const require_dist = require("../dist-Bz5ENMVc.js");
 let node_crypto = require("node:crypto");
 //#region src/ha-export/topics.ts
 /**
@@ -148,6 +148,16 @@ var ZONE_MACROS = [
 * So the flag is a required field on every spec. A new entity — or the
 * synthetic devices the design addendum still owes — cannot inherit a
 * camera's pressure valve by accident.
+*
+* **`last_image` is exempt, on every level of the fan-out** (operator,
+* 2026-08-09). The valve exists to stop a fleet's worth of entities
+* arriving switched on, but the picture IS the reason to look at a
+* notification: an operator who wires `person_detected` into an
+* automation wants the frame with it, and having to hunt through HA's
+* disabled-entity list per camera per macro per zone is the opposite of
+* what the export is for. The three `*_last_image` entities — camera,
+* per macro, per zone × macro — therefore ship enabled. They cost one
+* entity each and carry a signed URL, not bytes.
 */
 /**
 * The snooze surface, as a `select`.
@@ -218,7 +228,14 @@ function deviceBlock(device) {
 */
 function zoneSpecs(zone) {
 	const slug = toSlug(zone.id);
-	const specs = [];
+	const specs = [{
+		entity: `${slug}_objects`,
+		platform: "sensor",
+		label: `${zone.name} objects`,
+		uniqueSuffix: `${zone.id}_objects`,
+		icon: "mdi:counter",
+		enabledByDefault: true
+	}];
 	for (const macro of ZONE_MACROS) {
 		const label = `${zone.name} ${macro}`;
 		specs.push({
@@ -233,7 +250,7 @@ function zoneSpecs(zone) {
 			platform: "image",
 			label: `${label} last image`,
 			uniqueSuffix: `${zone.id}_${macro}_last_image`,
-			enabledByDefault: false
+			enabledByDefault: true
 		}, {
 			entity: `${slug}_${macro}_last_detection`,
 			platform: "sensor",
@@ -275,6 +292,54 @@ function cameraSpecs(device) {
 			label: "Last image",
 			enabledByDefault: true
 		},
+		(
+		/**
+		* The SCENE — everything on camera, in a zone or not, and including
+		* confirmed stationary objects (they are still there). The frame-wide
+		* scope of the same occupancy snapshot the per-zone counters come from,
+		* which was computed and simply never projected.
+		*/
+		{
+			entity: "objects",
+			platform: "sensor",
+			label: "Objects",
+			icon: "mdi:counter",
+			enabledByDefault: true
+		}),
+		(
+		/**
+		* What was heard, and how loud. Fed by `pipeline.audio-inference-result`
+		* — the event this addon did not subscribe to at all, which is why
+		* `audio_detected` below has effectively never moved.
+		*
+		* `audio_last_sound`, NOT `audio_last_label`: `<macro>_last_label` is the
+		* TRACK path's naming, reserved for the macros that carry an
+		* identification (`LABELLED_MACROS`), and `audio` is deliberately not one
+		* of them because the track lifecycle has no label for it. Reusing that
+		* name would put two sources on one topic — the classifier here and the
+		* track projector there — which is the two-knobs failure this repo keeps
+		* paying for. Different source, different entity, different name.
+		*
+		* dBFS is negative-going (0 = full scale), so silence reads as a large
+		* negative number rather than as a missing value. There is no unit
+		* declared: HA has no dBFS device class, and mislabelling it `dB` would
+		* put a plausible wrong unit on a dashboard.
+		*/
+		{
+			entity: "audio_last_sound",
+			platform: "sensor",
+			label: "Audio last sound",
+			icon: "mdi:ear-hearing",
+			enabledByDefault: true
+		}),
+		{
+			entity: "audio_volume",
+			platform: "sensor",
+			label: "Audio level",
+			unit: "dBFS",
+			icon: "mdi:volume-high",
+			enabledByDefault: false
+		},
 		{
 			entity: "last_detection",
 			platform: "sensor",
@@ -350,6 +415,60 @@ function cameraSpecs(device) {
 			enabledByDefault: true
 		});
 	}
+	/**
+	* The doorbell, when the operator has bound the cap to this camera.
+	*
+	* A press is not a detection macro — it is not something the pipeline
+	* classifies — so it is NOT in `EXPORTED_MACROS`, and `MACROS_NOT_EXPORTED`
+	* says a doorbell is an actuator on its own device. Both stay true for the
+	* BUTTON accessory. What was missing is the camera case: a camera with the
+	* `doorbell` cap bound rings, and the operator automates on the ring the same
+	* way they automate on `person_detected`. Reolink's own doorbell is exactly
+	* this shape (`ReolinkSimpleEvent.type === 'doorbell'` at the camera level),
+	* and so is any camera the `virtual-doorbell` wrapper is pointed at.
+	*
+	* Every entity here is fed by the `doorbell` runtime-state slice
+	* (`lastPressedAt`, `pressCountSinceStart`) on `device.state-changed` —
+	* the same road the `battery` slice already travels.
+	*
+	* **`doorbell_last_image` is owed, and the frame for it already exists.**
+	* A press DOES have a picture: `sensor-marker-projector.ts` materialises a
+	* synthetic marker track carrying a `keyFrameSmall` of the camera, taken
+	* before the track is persisted, and the notification names that track as
+	* its media owner. What is missing is only the road to THIS addon:
+	* `persistSyntheticTrack` writes the row directly and emits no
+	* `pipeline-analytics.track-lifecycle`, which is the single event the export
+	* listens to for frames. So the export never hears about the marker while
+	* the notification centre shows its photo — measured 2026-08-09.
+	*
+	* It is NOT fixed by taking a second snapshot here at push time: the marker
+	* projector's own record argues that out (one snapshot, one owner, one
+	* persistence point — the producer's), and a second photograph of a doorway
+	* seconds after the ring is a different picture from the one in the
+	* notification. The fix belongs upstream, at the point that already owns the
+	* frame. Named here rather than shipped as an entity nothing feeds.
+	*/
+	if (device.boundCaps.includes("doorbell")) specs.push({
+		entity: "doorbell_pressed",
+		platform: "binary_sensor",
+		label: "Doorbell pressed",
+		deviceClass: "occupancy",
+		enabledByDefault: true
+	}, {
+		entity: "doorbell_last_pressed",
+		platform: "sensor",
+		label: "Doorbell last pressed",
+		deviceClass: "timestamp",
+		icon: "mdi:bell-ring",
+		enabledByDefault: true
+	}, {
+		entity: "doorbell_press_count",
+		platform: "sensor",
+		label: "Doorbell presses since restart",
+		icon: "mdi:counter",
+		entityCategory: "diagnostic",
+		enabledByDefault: false
+	});
 	specs.push({
 		entity: "snooze",
 		platform: "select",
@@ -370,13 +489,19 @@ function cameraSpecs(device) {
 			entity: `${macro}_last_image`,
 			platform: "image",
 			label: `${label} last image`,
-			enabledByDefault: false
+			enabledByDefault: true
 		}, {
 			entity: `${macro}_last_detection`,
 			platform: "sensor",
 			label: `${label} last detection`,
 			deviceClass: "timestamp",
 			enabledByDefault: false
+		}, {
+			entity: `${macro}_objects`,
+			platform: "sensor",
+			label: `${label} objects`,
+			icon: "mdi:counter",
+			enabledByDefault: false
 		});
 		if (LABELLED_MACROS.includes(macro)) specs.push({
 			entity: `${macro}_last_label`,
@@ -872,9 +997,38 @@ function pruneBrokers(membership, knownBrokerIds) {
 	return next;
 }
 /**
-* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
-* component actually calls. `category:system [create]` was rejected: it would
-* hand `addons.installPackage` to a home-automation bridge.
+* The brokers the operator has switched ON, read from the RAW addon store.
+*
+* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
+* hub happens to know about — so it can never appear in the addon's
+* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
+* present in the defaults ("the store can contain extra keys … without
+* polluting the typed config"), so every `exportTo:*` key is dropped on the
+* way into `this.config` and reading one there yields `undefined` for ever.
+*
+* That is not theoretical. On 2026-08-09 the switch was on
+* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
+* settings FORM reads the store) and every reconcile still logged
+* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
+* its "Not configured" card, and no operator action could have changed
+* either. The store is the single authority — read it, do not mirror it into
+* a typed field that would then be a second one (D62).
+*
+* A broker that is no longer known is not enabled, whatever the store says:
+* a stale `exportTo:` key for a deleted instance must not resurrect it.
+*/
+function enabledBrokerIds(store, knownBrokerIds) {
+	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+}
+/**
+* What a linked Home Assistant NEEDS to function — one entry per thing it
+* actually calls with this token, each named. Not a blast radius, not a
+* conservative under-declaration: `requestedScopes` has exactly one meaning
+* across every integration, and since D103 it is also the ENFORCEMENT input, so
+* an under-declaration is an integration that stops working.
+*
+* `category:system [create]` was rejected and stays rejected: it would hand
+* `addons.installPackage` to a home-automation bridge.
 */
 var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 	integrationId: "homeassistant",
@@ -899,11 +1053,54 @@ var HOME_ASSISTANT_OAUTH_INTEGRATION = {
 			type: "capability",
 			target: "pipeline-orchestrator",
 			access: ["view", "create"]
-		}
+		},
+		(
+		/**
+		* `deviceExport.listExposedDevices` — the membership read that decides WHICH
+		* devices the component imports. It is pinned to this addon so the unpinned
+		* aggregate (which merges Alexa's and HomeKit's exposed sets, D12) cannot
+		* leak another exporter's devices into Home Assistant.
+		*
+		* Missing until 2026-08-09, which broke setup outright: the component's very
+		* first authenticated call is this one, and the hub answered "rejected the
+		* token" — reported by Home Assistant as `Configurazione non riuscita:
+		* deviceExport.listExposedDevices: hub rejected the token`. The call was
+		* introduced with the export filter and the descriptor was never widened for
+		* it. `system` scope, so a capability grant is what it needs — the `addon:`
+		* grant below covers the HTTP command route and does NOT cover this.
+		*/
+		{
+			type: "capability",
+			target: "device-export",
+			access: ["view"]
+		}),
+		(
+		/**
+		* `POST /addon/homeassistant-export/command` — the ONLY path by which an
+		* actuated Home Assistant entity (a camera switch, a PTZ button, reboot,
+		* snooze) reaches CamStack. Added when D103 made the addon-route gate check
+		* the grant instead of accepting any valid hub JWT; without it every HA
+		* control entity answers `403 Token scope mismatch`. `view` is here for the
+		* same addon's future GET routes, so a read does not force a re-link.
+		*/
+		{
+			type: "addon",
+			target: "homeassistant-export",
+			access: ["view", "create"]
+		})
 	],
 	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
 	allowedPrivateHostPaths: ["/auth/external/callback"],
-	requiresPkce: true
+	requiresPkce: true,
+	/**
+	* One year. A Home Assistant config entry is meant to survive indefinitely
+	* and re-linking is a manual trip through the UI, so the 30-day default
+	* silently unlinked a working integration a month after setup. Finite rather
+	* than `'never'` (which Alexa uses): an HA instance refreshes on a timer
+	* while it is running, so a year is far beyond any realistic downtime, and a
+	* bounded token is the better default where nothing is lost by it.
+	*/
+	refreshTokenTtlSec: 365 * 24 * 60 * 60
 };
 //#endregion
 //#region src/ha-export/push-client.ts
@@ -1253,6 +1450,10 @@ function projectZoneOccupancy(deviceKey, input) {
 	const values = [];
 	for (const zone of input.zones) {
 		const slug = toSlug(zone.zoneId);
+		values.push({
+			topic: stateTopic(deviceKey, `${slug}_objects`),
+			value: String(zone.totalObjects)
+		});
 		const totals = new Map(ZONE_MACROS.map((macro) => [macro, 0]));
 		for (const [className, count] of Object.entries(zone.byClass)) {
 			const macro = macroOf(className);
@@ -1264,6 +1465,22 @@ function projectZoneOccupancy(deviceKey, input) {
 			value: String(count)
 		});
 	}
+	if (input.scene !== void 0) {
+		values.push({
+			topic: stateTopic(deviceKey, "objects"),
+			value: String(input.scene.totalObjects)
+		});
+		const totals = new Map(EXPORTED_MACROS.map((macro) => [macro, 0]));
+		for (const [className, count] of Object.entries(input.scene.byClass)) {
+			const macro = macroOf(className);
+			if (macro === null || !totals.has(macro)) continue;
+			totals.set(macro, (totals.get(macro) ?? 0) + count);
+		}
+		for (const [macro, count] of totals) values.push({
+			topic: stateTopic(deviceKey, `${macro}_objects`),
+			value: String(count)
+		});
+	}
 	return values;
 }
 function projectBatterySlice(deviceKey, slice) {
@@ -1299,6 +1516,84 @@ function projectCameraSwitches(deviceKey, switches) {
 		value: bool(sw.enabled)
 	}));
 }
+/**
+* The doorbell slice → its three entities.
+*
+* A press is a PULSE: the slice carries `lastPressedAt`, never a
+* `pressed: true/false`. `doorbell_pressed` is therefore driven by the
+* caller, which knows whether this projection is a fresh press or a
+* reconcile re-read — the same shape `projectMotion` already uses, and the
+* reason the flag is a parameter rather than derived from a timestamp
+* comparison here (a pure function that reads the clock is a pure function
+* that behaves differently in a test).
+*
+* `lastPressedAt: null` publishes NOTHING for the timestamp: HA renders an
+* empty timestamp sensor as `unknown`, which is honest, whereas `0` would
+* render as 1 January 1970 on the operator's dashboard.
+*/
+function projectDoorbellSlice(deviceKey, slice, pressed) {
+	const values = [{
+		topic: stateTopic(deviceKey, "doorbell_pressed"),
+		value: bool(pressed)
+	}, {
+		topic: stateTopic(deviceKey, "doorbell_press_count"),
+		value: String(slice.pressCountSinceStart)
+	}];
+	if (slice.lastPressedAt !== null) values.push({
+		topic: stateTopic(deviceKey, "doorbell_last_pressed"),
+		value: new Date(slice.lastPressedAt).toISOString()
+	});
+	return values;
+}
+/**
+* One audio window → the audio entities.
+*
+* This is the source the catalog's `audio_detected` was always missing.
+* It had only the track lifecycle, which rarely carries an audio macro, so
+* the entity existed and effectively never moved — the note in this
+* package's CLAUDE.md said so without naming the event. The event is
+* `pipeline.audio-inference-result`, and it carries both halves an
+* operator asks for: WHAT was heard and HOW LOUD.
+*
+* The label is the HIGHEST-CONFIDENCE detection of the window, not the
+* first: the analyzer's array order is its own business and depending on
+* it would make the exported label change with an unrelated refactor.
+*
+* A window with no detections publishes NO label. It does not publish an
+* empty string: HA renders that as a valid state, so a quiet minute would
+* blank the last thing heard instead of leaving it — and "what was that
+* noise" is asked after the noise has stopped.
+*
+* The level is published on EVERY window, silence included. That is the
+* point of a volume entity: a flat line is a reading, and dBFS is
+* negative-going (0 = full scale), so no value can be mistaken for one.
+*/
+function projectAudioWindow(deviceKey, input) {
+	const values = [];
+	if (input.dbfs !== void 0 && Number.isFinite(input.dbfs)) values.push({
+		topic: stateTopic(deviceKey, "audio_volume"),
+		value: String(Math.round(input.dbfs * 10) / 10)
+	});
+	const best = input.detections.reduce((top, d) => top === null || d.confidence > top.confidence ? d : top, null);
+	if (best !== null) values.push({
+		topic: stateTopic(deviceKey, "audio_last_sound"),
+		value: best.className
+	});
+	return values;
+}
+/** The `BrokerInfo.kind` tag the Home Assistant provider stamps. */
+var HA_BROKER_KIND = "home-assistant";
+/**
+* Every Home Assistant broker currently registered, cluster-wide.
+*
+* Unpinned by design (see the module docblock) and filtered by `kind`, which is
+* the contract check that matters: whatever mix of providers answered the
+* union, only `home-assistant` brokers are ever exported to over Home
+* Assistant's transport.
+*/
+async function listHomeAssistantBrokers(query) {
+	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
+}
 //#endregion
 //#region src/ha-export/ha-export.addon.ts
 /**
@@ -1336,12 +1631,12 @@ function projectCameraSwitches(deviceKey, switches) {
 *     different sets of cameras, and the per-device Export panel shows
 *     one switch per broker over the single membership store.
 */
-/** The addon that owns the import direction — never export back to it. */
-var HA_PROVIDER_ADDON_ID = "provider-homeassistant";
 var ADDON_ID = "homeassistant-export";
 /** Where the custom component registers its push view inside HA. */
 var PUSH_PATH = "/api/camstack/push";
 var MEDIA_ROUTE_PREFIX = `/addon/${ADDON_ID}/ha-media`;
+/** How long `doorbell_pressed` stays on before its OFF edge is published. */
+var DOORBELL_PULSE_MS = 5e3;
 /** The hub's API port — where the data plane is reverse-proxied. */
 var HUB_API_PORT = 4443;
 /** One PTZ button press, as a relative move. */
@@ -1373,6 +1668,10 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	reconcilePending = null;
 	lastError;
 	entityCount = 0;
+	/** deviceId → the `lastPressedAt` already rung, so a re-read does not ring again. */
+	lastDoorbellPressAt = /* @__PURE__ */ new Map();
+	/** deviceId → the pending OFF edge. HA releases nothing on its own. */
+	doorbellReleaseTimers = /* @__PURE__ */ new Map();
 	unclassified = [];
 	/**
 	* A link that returned repairs NOW, not at the next periodic pass.
@@ -1415,6 +1714,8 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
+			for (const timer of this.doorbellReleaseTimers.values()) clearTimeout(timer);
+			this.doorbellReleaseTimers.clear();
 			this.reachability.dispose();
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
@@ -1471,6 +1772,15 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		this.subscribe({ category: require_dist.EventCategory.MotionOnMotionChanged }, (event) => {
 			this.onMotion(event.data);
 		});
+		/**
+		* The audio window. This is the source `audio_detected` never had: it was
+		* fed only by the track lifecycle, which rarely carries an audio macro, so
+		* the entity existed and effectively never moved. It also carries the
+		* window LEVEL, which nothing else on the export path does.
+		*/
+		this.subscribe({ category: require_dist.EventCategory.PipelineAudioInferenceResult }, (event) => {
+			this.onAudioWindow(event.data);
+		});
 		this.subscribe({ category: require_dist.EventCategory.PipelineAnalyticsTrackLifecycle }, (event) => {
 			this.onTrackLifecycle(event.data);
 		});
@@ -1518,6 +1828,40 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			}));
 			return;
 		}
+		if (capName === "doorbell") {
+			/**
+			* A press is a PULSE — the slice carries `lastPressedAt`, never a
+			* boolean. `doorbell_pressed` is therefore ON only when THIS delivery
+			* advanced the timestamp, and the previous value is remembered per
+			* device rather than compared against the clock: a reconcile re-read of
+			* an unchanged slice must not ring the doorbell again in Home Assistant,
+			* and a press that arrives while the export was restarting must still
+			* ring once. HA auto-releases nothing, so the OFF edge is published on a
+			* short timer — without it the binary sensor latches on for ever and the
+			* next press produces no edge to automate on.
+			*/
+			const lastPressedAt = readNumber(slice, "lastPressedAt");
+			const pressCountSinceStart = readNumber(slice, "pressCountSinceStart") ?? 0;
+			const previous = this.lastDoorbellPressAt.get(deviceId) ?? null;
+			const pressed = lastPressedAt !== null && lastPressedAt !== previous;
+			if (pressed) this.lastDoorbellPressAt.set(deviceId, lastPressedAt);
+			this.push(deviceId, projectDoorbellSlice(deviceKey, {
+				lastPressedAt,
+				pressCountSinceStart
+			}, pressed));
+			if (pressed) {
+				const existing = this.doorbellReleaseTimers.get(deviceId);
+				if (existing !== void 0) clearTimeout(existing);
+				this.doorbellReleaseTimers.set(deviceId, setTimeout(() => {
+					this.doorbellReleaseTimers.delete(deviceId);
+					this.push(deviceId, projectDoorbellSlice(deviceKey, {
+						lastPressedAt,
+						pressCountSinceStart
+					}, false));
+				}, DOORBELL_PULSE_MS));
+			}
+			return;
+		}
 		if (capName === "motion") {
 			const detected = slice["detected"];
 			const lastDetectedAt = readNumber(slice, "lastDetectedAt");
@@ -1590,6 +1934,28 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		}
 		this.push(deviceId, values);
 	}
+	onAudioWindow(data) {
+		const deviceId = readNumber(data, "deviceId");
+		if (deviceId === null) return;
+		const deviceKey = this.keyByDeviceId.get(deviceId);
+		if (deviceKey === void 0) return;
+		const frame = readRecordField(data, "frame");
+		if (frame === null || typeof frame !== "object" || Array.isArray(frame)) return;
+		const dbfs = readNumber(readRecord(frame, "level"), "dbfs");
+		const raw = readRecordField(frame, "detections");
+		const detections = Array.isArray(raw) ? raw.flatMap((entry) => {
+			const className = readString(entry, "className");
+			const confidence = readNumber(entry, "confidence");
+			return className === null || confidence === null ? [] : [{
+				className,
+				confidence
+			}];
+		}) : [];
+		this.push(deviceId, projectAudioWindow(deviceKey, {
+			detections,
+			...dbfs !== null ? { dbfs } : {}
+		}));
+	}
 	onZoneOccupancy(data) {
 		const deviceId = readNumber(data, "deviceId");
 		if (deviceId === null) return;
@@ -1603,11 +1969,20 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			if (zoneId === null) return [];
 			return [{
 				zoneId,
+				totalObjects: readNumber(entry, "totalObjects") ?? 0,
 				byClass: toCountRecord(byClass)
 			}];
 		});
-		if (zones.length === 0) return;
-		this.push(deviceId, projectZoneOccupancy(deviceKey, { zones }));
+		const frame = readRecordField(data, "frame");
+		const scene = frame !== null && typeof frame === "object" && !Array.isArray(frame) ? {
+			totalObjects: readNumber(frame, "totalObjects") ?? 0,
+			byClass: toCountRecord(readRecord(frame, "byClass"))
+		} : void 0;
+		if (zones.length === 0 && scene === void 0) return;
+		this.push(deviceId, projectZoneOccupancy(deviceKey, {
+			zones,
+			...scene !== void 0 ? { scene } : {}
+		}));
 	}
 	/**
 	* Send a device's values to every broker it is exported to.
@@ -1699,7 +2074,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 				* exported back to it: HA would mirror its own entity across the
 				* bridge, and any automation touching it would round-trip.
 				*/
-				if (device.addonId === HA_PROVIDER_ADDON_ID) {
+				if (device.addonId === "provider-homeassistant") {
 					this.ctx.logger.warn("ha-export: refusing to export a device imported from Home Assistant", { tags: { deviceId: numericId } });
 					continue;
 				}
@@ -1824,10 +2199,17 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 				enabled: sw.enabled
 			}))));
 			const occupancy = await this.ctx.api.zoneAnalytics.getCurrentSnapshot.query({ deviceId: entry.deviceId });
-			if (occupancy !== null) values.push(...projectZoneOccupancy(key, { zones: occupancy.zones.map((zone) => ({
-				zoneId: zone.zoneId,
-				byClass: toCountRecord(zone.byClass)
-			})) }));
+			if (occupancy !== null) values.push(...projectZoneOccupancy(key, {
+				zones: occupancy.zones.map((zone) => ({
+					zoneId: zone.zoneId,
+					totalObjects: zone.totalObjects,
+					byClass: toCountRecord(zone.byClass)
+				})),
+				scene: {
+					totalObjects: occupancy.frame.totalObjects,
+					byClass: toCountRecord(occupancy.frame.byClass)
+				}
+			}));
 		}
 		return values;
 	}
@@ -1919,13 +2301,14 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* ones the operator ticked.
 	*
 	* Credentials come through the `broker` cap — the sanctioned no-import
-	* path — and the owning `addonId` is sent with the read: `broker` is a
-	* COLLECTION cap, so an unpinned id-keyed call routes to the
-	* first-registered provider, which returns `null` for a broker it does
-	* not own.
+	* path — and EVERY call carries the owning `addonId`: `broker` is a
+	* COLLECTION cap, so an unpinned call is answered by the
+	* first-registered provider (Homematic, on the operator's hub), which
+	* knows nothing about `ha_*`. `broker-source.ts` holds the pin and the
+	* reasoning.
 	*/
 	async refreshBrokers() {
-		const haBrokers = (await this.ctx.api.broker.list.query({})).filter((broker) => broker.kind === "home-assistant");
+		const haBrokers = await listHomeAssistantBrokers((input) => this.ctx.api.broker.list.query(input));
 		const known = haBrokers.map((broker) => ({
 			id: broker.id,
 			name: broker.name
@@ -1935,6 +2318,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			knownBrokers: known,
 			membership: pruned
 		});
+		await this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -2006,8 +2390,23 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			return null;
 		}
 	}
+	/**
+	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
+	*
+	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
+	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
+	* it is `undefined` there for ever — see `enabledBrokerIds` in
+	* `membership.ts` for what that cost. The store is the authority; this is a
+	* read-through cache of it, refreshed at the top of every reconcile pass and
+	* before the per-device panel renders, never written to.
+	*/
+	enabled = [];
+	async refreshEnabledBrokers(known) {
+		const store = await this.resolveGlobalStore();
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+	}
 	enabledBrokerIds() {
-		return this.config.knownBrokers.filter((broker) => this.config[`exportTo:${broker.id}`] === true).map((broker) => broker.id);
+		return this.enabled;
 	}
 	brokerName(brokerId) {
 		return this.config.knownBrokers.find((broker) => broker.id === brokerId)?.name ?? brokerId;
@@ -2346,7 +2745,8 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* exporters' identically-named fields and the operator sees another
 	* exporter's value in this one's toggle.
 	*/
-	buildContribution(deviceId) {
+	async buildContribution(deviceId) {
+		await this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({