@camstack/addon-provider-homeassistant 1.2.29 → 1.2.31

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { M as deviceExportCapability, Ot as EventCategory, S as buildAddonRouteProvider, Y as oauthIntegrationCapability, a as CameraSwitchIdSchema, c as HvacModeSchema, f as addonRoutesCapability, ft as BaseAddon, i as COCO_TO_MACRO, l as MediaPlayerRepeatSchema, s as FanDirectionSchema, t as AlarmArmModeSchema, wt as string } from "../dist-D_VrlKNr.mjs";
+import { M as deviceExportCapability, Ot as EventCategory, S as buildAddonRouteProvider, Y as oauthIntegrationCapability, a as CameraSwitchIdSchema, c as HvacModeSchema, f as addonRoutesCapability, ft as BaseAddon, i as COCO_TO_MACRO, l as MediaPlayerRepeatSchema, s as FanDirectionSchema, t as AlarmArmModeSchema, wt as string } from "../dist-CyjeVkIa.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/ha-export/topics.ts
 /**
@@ -107,43 +107,57 @@ function toSlug(value) {
 //#endregion
 //#region src/ha-export/camera-entities.ts
 /**
-* The live `camera` entities — one per stream profile, muted and unmuted.
+* The live `camera` entities — one per STREAM of the camera.
 *
-* `HaPlatform` has declared `camera` since the export was written and the
-* catalog never emitted one, so an operator's Home Assistant carried ~73
-* entities about a camera and no picture of it. This module is that half:
-* pure, so the URL policy below is tested rather than reasoned about.
+* ── What was wrong, measured on the operator's Home Assistant ────────────
 *
-* ── The two traps, both measured ────────────────────────────────────────
+* This module used to mint six components per camera (three profiles ×
+* muted/unmuted), each carrying a broker RTSP url on a `state_topic`,
+* behind two url gates: a refusal for a credential in the authority and a
+* refusal for a loopback host. On 2026-08-14 the live registry was read:
+* `platform: camstack` held **165 entities and exactly two `camera` ones**
+* — one per exported camera, `unique_id` `camstack_<stableId>_camera`.
+* None of the twelve announced stream components existed.
 *
-* **1. The password.** `streamCatalog.getCatalog` returns the camera's
-* NATIVE url — `rtsp://admin:hunter2@192.168.1.50:554/…`. Writing that
-* into a `state_update` would put the camera's password into Home
-* Assistant's entity registry and into every debug log it writes, on a
-* host camstack does not own. So the source here is the BROKER restream
-* (`cameraStreams.getProfileRtspEntries`), which carries no credentials,
-* and {@link sanitiseStreamUrl} refuses anything with a userinfo section
-* anyway — a second source, a provider change or a future caller must not
-* be able to leak it by accident. A refusal produces NO entity value; it
-* never produces a redacted-looking URL that would then be dialled.
+* They never could. `custom_components/camstack/camera.py` builds its
+* cameras from the export MEMBERSHIP, not from `cmps`: a still comes from
+* `snapshot.getSnapshot` and live video from `webrtcSession.handleOffer`,
+* which is native WebRTC and has no use for an RTSP address. The
+* component's platform probe answers `camera` — truthfully, it builds the
+* platform — and the hub read that as "it will build MY camera
+* components". Twelve components, two entities, no warning on either
+* side.
 *
-* **2. The host.** The broker binds `127.0.0.1` and mints its restream
-* URLs against whatever address it was asked for. Home Assistant is not
-* on the hub, so a loopback URL yields an entity that exists and never
-* loads — the identical failure the image entities had before
-* `publicBaseUrl` was added. The caller passes `hostname` explicitly
-* (`getProfileRtspEntries({ deviceId, hostname })`) and this module
-* REFUSES a loopback URL rather than publishing one, because "the picture
-* never appears" is indistinguishable from "the camera is down" on a
-* dashboard.
+* ── What this module is now ──────────────────────────────────────────────
 *
-* ── Fan-out ─────────────────────────────────────────────────────────────
+* One component per entry of `webrtcSession.listStreams`, carrying the
+* `target` verbatim so the component hands it back to `handleOffer`. No
+* url crosses, which is why the two gates are gone rather than kept "just
+* in case": there is no address here to leak a password or to point at
+* 127.0.0.1, and a gate guarding a value that no longer exists is the
+* leftover that reads as verification.
 *
-* Three profiles × two mute states is six entities on a fleet of ~880
-* cameras. Only the FIRST is `enabled_by_default`; the rest are
-* registered-and-off, for the operator to switch on per camera. That is
-* the same pressure valve the camera catalog already uses, applied to the
-* one part of this export that could double a camera's entity count.
+* ── The adaptive stream is announced by NOBODY, on purpose ───────────────
+*
+* The component's membership entity IS the adaptive stream: it negotiates
+* no target, it is the device's primary camera (`_attr_name = None`), and
+* it has carried `camstack_<stableId>_camera` since the integration
+* shipped. Announcing a component for it would claim the same
+* `unique_id` — Home Assistant keys its registry on
+* `(platform, integration, unique_id)` — and one of the two would lose the
+* race and be dropped with a "does not generate unique IDs" error. So the
+* operator's existing `camera.videocamera_ingresso` is left exactly where
+* it is and gains SIBLINGS: one per profile, one per substream, which are
+* the streams membership cannot express.
+*
+* ── Fan-out ──────────────────────────────────────────────────────────────
+*
+* Every remaining stream is announced. What arrives ENABLED is the
+* assigned profiles — the pictures an operator picks between on a
+* dashboard. The raw `cam-stream` sources (the camera's own main/sub
+* substreams) are registered-and-off: they are the same pictures the
+* profiles already serve, one layer below the slot the rest of camstack
+* dials, and an operator who wants one switches it on per camera.
 */
 /** Profile slots, in the order an operator reads them. */
 var CAMERA_PROFILE_ORDER = [
@@ -151,143 +165,97 @@ var CAMERA_PROFILE_ORDER = [
 	"mid",
 	"low"
 ];
-/** Hosts that are only routable from the hub itself. */
-var LOOPBACK_HOSTS = [
-	"127.0.0.1",
-	"localhost",
-	"::1",
-	"[::1]",
-	"0.0.0.0"
-];
+/** `high` → 0. An unknown profile sorts after the known ones, stably. */
+function profileRank(profile) {
+	const index = CAMERA_PROFILE_ORDER.indexOf(profile);
+	return index === -1 ? CAMERA_PROFILE_ORDER.length : index;
+}
 /**
-* The one place a stream URL is judged fit to leave the hub.
+* Reading order: adaptive, then the profile slots high → mid → low, then
+* whatever raw sources the camera reports, in the hub's own order.
 *
-* Deliberately a REFUSAL rather than a repair: rewriting a loopback host
-* here would need an address this module does not have, and stripping a
-* userinfo section would produce a URL that dials and fails
-* authentication — both hide the defect instead of reporting it.
+* Rank only. The one stream that does NOT become a component is the
+* adaptive one, and it is filtered by {@link isAnnounced} rather than
+* here, because it is not a drop: it reaches Home Assistant on the
+* membership entity. Every other slot the hub reports becomes an entity —
+* "include all the streams of a camera" is the request this module exists
+* to answer, and a slot silently dropped is a loss the operator cannot see
+* from Home Assistant.
 */
-function sanitiseStreamUrl(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		return {
-			ok: false,
-			reason: "unparseable"
-		};
+function streamRank(target) {
+	switch (target.kind) {
+		case "adaptive": return 0;
+		case "profile": return 1 + profileRank(target.profile);
+		case "cam-stream": return 1 + CAMERA_PROFILE_ORDER.length;
 	}
-	if (parsed.username.length > 0 || parsed.password.length > 0) return {
-		ok: false,
-		reason: "credentials-inline"
-	};
-	if (parsed.hostname.length === 0) return {
-		ok: false,
-		reason: "unparseable"
-	};
-	if (LOOPBACK_HOSTS.includes(parsed.hostname.toLowerCase())) return {
-		ok: false,
-		reason: "loopback-host"
-	};
-	return {
-		ok: true,
-		url
-	};
 }
 /**
-* The host Home Assistant can reach the hub on, from the base URL the
-* media plane already resolved.
+* The adaptive stream is the component's own entity and gets no component.
 *
-* The same answer feeds both planes on purpose. `publicBaseUrl` (or the
-* lowest-priority non-loopback endpoint behind it) is the ONE address the
-* operator has told us Home Assistant can open; a second discovery here
-* could disagree with the one the image entities use, and then half a
-* camera's entities would load.
+* The one filter in this file, and the reason it is not the "drop a slot"
+* kind: the stream still reaches Home Assistant, on the entity that has
+* always carried it. See the identity note above.
 */
-function hostnameFromBaseUrl(baseUrl) {
-	if (baseUrl === null || baseUrl.length === 0) return null;
-	try {
-		const host = new URL(baseUrl).hostname;
-		if (host.length === 0 || LOOPBACK_HOSTS.includes(host.toLowerCase())) return null;
-		return host;
-	} catch {
-		return null;
-	}
+function isAnnounced(target) {
+	return target.kind !== "adaptive";
 }
-/** `high` → 0. An unknown profile sorts after the known ones, stably. */
-function profileRank(profile) {
-	const index = CAMERA_PROFILE_ORDER.indexOf(profile);
-	return index === -1 ? CAMERA_PROFILE_ORDER.length : index;
+/**
+* The entity id of one stream.
+*
+* Derived from the TARGET rather than from `choice.id`, so the ids stay
+* `stream_high` / `stream_mid` / `stream_low` — what this file already
+* announced — instead of following the picker's `profile:high` spelling.
+* An entity id is identity; the picker's id is a React key.
+*/
+function entityIdFor(target) {
+	switch (target.kind) {
+		case "adaptive":
+ /* c8 ignore next -- filtered by isAnnounced before it can be reached */
+		return "stream_adaptive";
+		case "profile": return `stream_${toSlug(target.profile)}`;
+		case "cam-stream": return `stream_${toSlug(target.camStreamId)}`;
+	}
 }
 /**
-* The profiles that produce entities: assigned, restream-enabled, in
-* `high → mid → low` order, capped at {@link MAX_CAMERA_PROFILES}.
+* Enabled by default: the assigned profiles.
 *
-* A DISABLED profile produces nothing. Its `url` is minted all the same
-* by the broker, and publishing it would give the operator a camera
-* entity that dials a restream nobody is serving — a control that lies,
-* in the shape D62 forbids for switches.
+* A raw `cam-stream` is the source a profile slot already points at. It
+* is announced so an operator who wants the camera's own substream can
+* have it, and it is off so that a camera does not arrive with six
+* pictures of the same doorway switched on.
 */
-function activeStreamProfiles(profiles) {
-	return [...profiles].filter((entry) => entry.enabled).sort((a, b) => profileRank(a.profile) - profileRank(b.profile)).slice(0, 3);
+function enabledByDefaultFor(target) {
+	return target.kind !== "cam-stream";
 }
 /**
-* Profile list → the `camera` entities the catalog builds.
+* The label an operator reads on a card.
 *
-* Pure and URL-free: an entity EXISTS because a profile is assigned and
-* enabled, and it carries a value only when {@link cameraStreamValues}
-* judges that profile's URL publishable. The two questions are separate
-* because a URL that becomes publishable later (the operator sets
-* `publicBaseUrl`) must fill an entity that is already in HA's registry,
-* not mint a new one and orphan the automations pointing at the old id.
+* The hub's own label plus the vertical resolution, because that is the
+* one thing that distinguishes three pictures of the same doorway —
+* "Stream high (2160p)" answers "which of these do I put on the wall
+* tablet" and "Stream high" does not. The resolution is only in the label
+* (never in the id), so a re-encoded profile renames an entity and never
+* orphans one.
 */
-function cameraStreamEntities(profiles) {
-	const entities = [];
-	for (const entry of activeStreamProfiles(profiles)) {
-		const slug = toSlug(entry.profile);
-		for (const muted of [false, true]) entities.push({
-			entity: muted ? `stream_${slug}_muted` : `stream_${slug}`,
-			platform: "camera",
-			label: muted ? `Stream ${entry.profile} (muted)` : `Stream ${entry.profile}`,
-			enabledByDefault: entities.length === 0,
-			profile: entry.profile,
-			muted
-		});
-	}
-	return entities;
+function labelFor(choice) {
+	const base = `Stream ${choice.label.toLowerCase()}`;
+	return choice.height === void 0 ? base : `${base} (${choice.height}p)`;
 }
 /**
-* The entities' values: one URL per (profile, mute) pair.
+* Stream list → the `camera` entities the catalog builds.
 *
-* The muted variant is the broker's own `mutedUrl`, not a query-string
-* edit of `url` — deriving one topic by string-editing another is the
-* mistake `topics.ts` records, and the broker is the authority on what a
-* muted alias of a profile is called.
+* Pure, and value-free: a `camera` entity has no state on the push plane
+* at all. It exists because the hub lists the stream, and everything the
+* component needs to show it travels in `stream_target`.
 */
-function cameraStreamValues(deviceKey, profiles) {
-	const values = [];
-	const refused = [];
-	for (const entity of cameraStreamEntities(profiles)) {
-		const source = profiles.find((entry) => entry.profile === entity.profile);
-		if (source === void 0) continue;
-		const decision = sanitiseStreamUrl(entity.muted ? source.mutedUrl : source.url);
-		if (!decision.ok) {
-			refused.push({
-				entity: entity.entity,
-				profile: entity.profile,
-				reason: decision.reason
-			});
-			continue;
-		}
-		values.push({
-			topic: stateTopic(deviceKey, entity.entity),
-			value: decision.url
-		});
-	}
-	return {
-		values,
-		refused
-	};
+function cameraStreamEntities(choices) {
+	return [...choices].filter((choice) => isAnnounced(choice.target)).sort((a, b) => streamRank(a.target) - streamRank(b.target)).map((choice) => ({
+		entity: entityIdFor(choice.target),
+		platform: "camera",
+		label: labelFor(choice),
+		enabledByDefault: enabledByDefaultFor(choice.target),
+		target: choice.target
+	}));
 }
 //#endregion
 //#region src/ha-export/component-support.ts
@@ -1040,6 +1008,29 @@ var ZONE_MACROS = [
 * what the export is for. The three `*_last_image` entities — camera,
 * per macro, per zone × macro — therefore ship enabled. They cost one
 * entity each and carry a signed URL, not bytes.
+*
+* **So are the three things the operator asked for on 2026-08-14**, and
+* each has a reason that is a property of the value rather than a taste:
+*
+*   - **`<macro>_last_detection`, and the camera's own.** "When was a
+*     person last seen" is a timestamp, and half of what an operator
+*     builds on a camera is a duration since one — a `for:` in a
+*     template, a "nobody has been at the door since" notification. A
+*     boolean that is `off` right now cannot answer it.
+*   - **`<macro>_last_label`.** This is where the RECOGNISED FACE and the
+*     read PLATE arrive. It was the single highest-value item in the gap
+*     against the reference integration and it shipped switched off, so
+*     the name camstack worked out was in Home Assistant and invisible.
+*   - **`battery` and `charger` on a battery camera.** A battery
+*     percentage is the headline of a battery device, not a diagnostic
+*     detail about one; `sleeping` stays off because it describes the
+*     power state machine rather than the charge.
+*
+* What stays off is what the valve was built for: the per-macro and
+* per-zone `*_objects` COUNTERS (a count of what is on screen right now,
+* which the `_detected` boolean and the camera-wide `objects` total
+* already answer for automation), the per-zone timestamps, and the
+* doorbell's since-restart counter.
 */
 /**
 * The snooze surface, as a `select`.
@@ -1074,6 +1065,44 @@ var PTZ_BUTTONS = [
 	"ptz_zoom_in",
 	"ptz_zoom_out"
 ];
+/**
+* Platforms whose entity carries no value on the push plane.
+*
+* A `button` is a command. A `camera` is a stream the component fetches
+* for itself (`snapshot.getSnapshot` + `webrtcSession.handleOffer`) from
+* the target it is given. Announcing a `state_topic` for either would
+* declare a value nothing ever publishes — which is precisely how twelve
+* camera components came to sit in an announce that produced no entity.
+*/
+var STATELESS_PLATFORMS = new Set(["button", "camera"]);
+/**
+* Platforms that can carry a command topic.
+*
+* `writable` on a descriptor means "the route table writes exactly this
+* value" — a fact about the CAPABILITY. Whether Home Assistant can offer
+* a control for it is a fact about the PLATFORM, and the two are not the
+* same: `climate-control.fanMode` is written by `setFanMode` and has no
+* closed vocabulary, so its degraded form is a `sensor` and its native
+* form is the climate entity's fan-mode control. Announcing a command
+* topic on the degraded `sensor` would describe a control Home Assistant
+* cannot render — a leftover that reads as verification.
+*/
+var COMMANDABLE_PLATFORMS = new Set([
+	"switch",
+	"button",
+	"select",
+	"number",
+	"alarm_control_panel",
+	"cover",
+	"climate",
+	"lock",
+	"fan",
+	"vacuum",
+	"valve",
+	"humidifier",
+	"water_heater",
+	"media_player"
+]);
 /** 0..100, the shape every camstack percentage declares in its own schema. */
 var PERCENT_RANGE = {
 	min: 0,
@@ -1107,8 +1136,8 @@ function buildComponent(device, spec) {
 		platform: spec.platform,
 		unique_id: `${device.stableId}_${spec.uniqueSuffix ?? spec.entity}`,
 		name: spec.label,
-		...spec.platform === "button" ? {} : { state_topic: stateTopic(deviceKey, spec.entity) },
-		...spec.writable === true ? { command_topic: commandTopic(deviceKey, spec.entity) } : {},
+		...STATELESS_PLATFORMS.has(spec.platform) ? {} : { state_topic: stateTopic(deviceKey, spec.entity) },
+		...spec.writable === true && COMMANDABLE_PLATFORMS.has(spec.platform) ? { command_topic: commandTopic(deviceKey, spec.entity) } : {},
 		...spec.deviceClass !== void 0 ? { device_class: spec.deviceClass } : {},
 		...spec.unit !== void 0 ? { unit_of_measurement: spec.unit } : {},
 		...spec.icon !== void 0 ? { icon: spec.icon } : {},
@@ -1124,7 +1153,8 @@ function buildComponent(device, spec) {
 			payload_on: "true",
 			payload_off: "false"
 		} : {},
-		...spec.platform === "button" ? { payload_press: "PRESS" } : {}
+		...spec.platform === "button" ? { payload_press: "PRESS" } : {},
+		...spec.streamTarget !== void 0 ? { stream_target: spec.streamTarget } : {}
 	};
 }
 function deviceBlock(device) {
@@ -1277,7 +1307,7 @@ function cameraSpecs(device) {
 			label: "Last detection",
 			deviceClass: "timestamp",
 			icon: "mdi:clock",
-			enabledByDefault: false
+			enabledByDefault: true
 		}
 	];
 	if (device.slices.includes("battery")) specs.push({
@@ -1287,14 +1317,14 @@ function cameraSpecs(device) {
 		deviceClass: "battery",
 		unit: "%",
 		entityCategory: "diagnostic",
-		enabledByDefault: false
+		enabledByDefault: true
 	}, {
 		entity: "charger",
 		platform: "binary_sensor",
 		label: "Charging",
 		deviceClass: "battery_charging",
 		entityCategory: "diagnostic",
-		enabledByDefault: false
+		enabledByDefault: true
 	}, {
 		entity: "sleeping",
 		platform: "binary_sensor",
@@ -1426,7 +1456,7 @@ function cameraSpecs(device) {
 			platform: "sensor",
 			label: `${label} last detection`,
 			deviceClass: "timestamp",
-			enabledByDefault: false
+			enabledByDefault: true
 		}, {
 			entity: `${macro}_objects`,
 			platform: "sensor",
@@ -1439,19 +1469,22 @@ function cameraSpecs(device) {
 			platform: "sensor",
 			label: `${label} last label`,
 			icon: "mdi:tag",
-			enabledByDefault: false
+			enabledByDefault: true
 		});
 	}
 	/**
-	* The live picture. Six at most, only the first switched on — see
-	* `camera-entities.ts` for the password and loopback traps this side
-	* deliberately knows nothing about.
+	* The live picture — every stream the hub lists EXCEPT the adaptive one,
+	* which the component's own entity already is. See `camera-entities.ts`
+	* for why the entity carries a WebRTC target and not a url, and why
+	* announcing the adaptive stream would collide on an identity that has
+	* shipped.
 	*/
 	for (const stream of cameraStreamEntities(device.streams ?? [])) specs.push({
 		entity: stream.entity,
 		platform: stream.platform,
 		label: stream.label,
-		enabledByDefault: stream.enabledByDefault
+		enabledByDefault: stream.enabledByDefault,
+		streamTarget: stream.target
 	});
 	/**
 	* The two capability-derived entities a camera carries.
@@ -1492,23 +1525,35 @@ function buildCameraPlan(device) {
 * must name a route `CAP_COMMAND_ROUTES` can resolve, or ship read-only.**
 * The route table now covers every Tier A family, so the rows below are
 * writable wherever the capability declares a method that writes exactly
-* the value the entity carries. Three things still ship read-only, each
-* for a reason that is a property of the value and not of the table:
+* the value the entity carries.
 *
-*   - **A vocabulary that lives on the slice.** `climate-control.fanMode`,
-*     `.preset`, `water-heater.operationMode`, `humidifier.mode`,
-*     `media-player.source` and `vacuum-control.fanSpeed` are free-form
-*     strings whose accepted values are `available*` arrays on the DEVICE.
-*     A `select` needs a closed static list, and inventing one would offer
-*     values the device rejects while hiding the ones it takes. Only an
-*     enum in the cap's own schema becomes a `select` here.
-*   - **A setter that needs two values at once.** `setTargetRange` writes
-*     `targetLow` AND `targetHigh`; two independent `number` entities
-*     cannot make one call without reading each other, and the catalog and
-*     the route table are both pure. Both stay sensors.
-*   - **A value that is not flat.** See below.
+* ── `writable` is about the CAPABILITY, not about the platform ───────────
 *
-* A row that is read-only for one of those reasons says so where it sits.
+* Six values are written by a real method and have no Home Assistant
+* control in the DEGRADED shape: `climate-control.fanMode`, `.preset`,
+* `fan-control.preset`, `water-heater.operationMode`, `humidifier.mode`,
+* `media-player.source` and `vacuum-control.fanSpeed` are free-form
+* strings whose accepted values are `available*` arrays on the DEVICE. A
+* static `select` cannot hold them — it would offer values the device
+* rejects while hiding the ones it takes — so their degraded platform is
+* a `sensor`.
+*
+* They are still marked `writable`, and that is the point: the flag means
+* "`CAP_COMMAND_ROUTES` writes exactly this value", which is what
+* `native-platforms.ts` asks before giving a native climate its fan-mode
+* control or a native vacuum its fan-speed control. `buildComponent`
+* announces a `command_topic` only on a platform that can carry one
+* (`COMMANDABLE_PLATFORMS`), so the degraded `sensor` stays a reading and
+* the native entity gains the control. They were read-only until
+* 2026-08-14 and the native controls silently did not appear, because the
+* one flag was answering two different questions.
+*
+* **`setTargetRange` is the one setter that needs two values at once**,
+* and it is routed by READING the other half first — see the note on
+* `target-high` below. Everything else in this table names one method
+* with one value.
+*
+* Only **a value that is not flat** still ships read-only. See below.
 *
 * ── Why a nested object is never a field ────────────────────────────────
 *
@@ -1548,6 +1593,22 @@ var CAP_ENTITY_MAP = {
 			field: "state",
 			label: "Lock state",
 			icon: "mdi:lock-question"
+		} },
+		/**
+		* `lockControl.open` — the LATCH, which is not `unlock`.
+		*
+		* Home Assistant spells it `LockEntityFeature.OPEN` and its native lock
+		* offers it as a third button; the cap has declared the method since it
+		* was written and nothing routed it, so `NATIVE_CAP_PLATFORMS`'
+		* `open` control resolved to no entity and was skipped every time.
+		* Registered and off in the degraded table for the same reason `stop`
+		* is: a lock without a latch answers the press with the provider's own
+		* refusal, and that is a button most operators never want to see.
+		*/
+		commands: { open: {
+			label: "Open latch",
+			icon: "mdi:door-open",
+			enabledByDefault: false
 		} }
 	},
 	button: {
@@ -1804,12 +1865,17 @@ var CAP_ENTITY_MAP = {
 				range: PERCENT_RANGE,
 				enabledByDefault: false
 			},
-			/** Free-form: the accepted values are `availableFanModes` on the slice. */
+			/**
+			* Free-form: the accepted values are `availableFanModes` on the slice,
+			* so the degraded platform is a `sensor` and only the native climate
+			* renders the control. `setFanMode` is the route.
+			*/
 			"fan-mode": {
 				platform: "sensor",
 				field: "fanMode",
 				label: "Fan mode",
 				icon: "mdi:fan",
+				writable: true,
 				enabledByDefault: false
 			},
 			/** Free-form: the accepted values are `availablePresets` on the slice. */
@@ -1817,15 +1883,21 @@ var CAP_ENTITY_MAP = {
 				platform: "sensor",
 				field: "preset",
 				label: "Preset",
+				writable: true,
 				enabledByDefault: false
 			},
 			/**
-			* Read-only, and not for want of a method: `setTargetRange` writes
-			* `targetLow` AND `targetHigh` in one call. Two independent `number`
-			* entities would each have to read the other's current value to make it,
-			* and both the catalog and the route table are pure. A dual-setpoint
-			* control belongs to the native `climate` platform (Tier B), which
-			* carries the pair as one entity.
+			* The dual setpoint — and the one route in this export that READS
+			* before it writes.
+			*
+			* `setTargetRange` takes `targetLow` AND `targetHigh` together, while
+			* Home Assistant's climate sends the two halves on two topics, so a
+			* command carrying one of them has to learn the other before it can
+			* make the call. `applyCapCommand` therefore reads
+			* `climateControl.getStatus`, substitutes the half it was given, and
+			* calls once. A device reporting `null` for the other half is REFUSED
+			* rather than defaulted: inventing the missing bound is how a
+			* thermostat comes to be told to hold 20 °C to 20 °C.
 			*/
 			"target-high": {
 				platform: "sensor",
@@ -1833,6 +1905,7 @@ var CAP_ENTITY_MAP = {
 				label: "Target high",
 				deviceClass: "temperature",
 				unit: "°C",
+				writable: true,
 				enabledByDefault: false
 			},
 			"target-low": {
@@ -1841,6 +1914,7 @@ var CAP_ENTITY_MAP = {
 				label: "Target low",
 				deviceClass: "temperature",
 				unit: "°C",
+				writable: true,
 				enabledByDefault: false
 			},
 			/**
@@ -1881,11 +1955,15 @@ var CAP_ENTITY_MAP = {
 		*/
 		range: PERCENT_RANGE,
 		extras: {
-			/** Free-form: the accepted values are `availablePresets` on the slice. */
+			/**
+			* Free-form: the accepted values are `availablePresets` on the slice.
+			* `fanControl.setPreset` is the route; the native fan renders it.
+			*/
 			preset: {
 				platform: "sensor",
 				field: "preset",
 				label: "Preset",
+				writable: true,
 				enabledByDefault: false
 			},
 			oscillating: {
@@ -1933,11 +2011,15 @@ var CAP_ENTITY_MAP = {
 				writable: true,
 				range: PERCENT_RANGE
 			},
-			/** Free-form: the accepted values are `availableModes` on the slice. */
+			/**
+			* Free-form: the accepted values are `availableModes` on the slice.
+			* `humidifier.setMode` is the route; the native humidifier renders it.
+			*/
 			mode: {
 				platform: "sensor",
 				field: "mode",
 				label: "Mode",
+				writable: true,
 				enabledByDefault: false
 			},
 			action: {
@@ -1963,11 +2045,18 @@ var CAP_ENTITY_MAP = {
 				writable: true,
 				range: TEMPERATURE_RANGE
 			},
-			/** Free-form: the accepted values are `availableModes` on the slice. */
+			/**
+			* Free-form: the accepted values are `availableModes` on the slice, and
+			* this is the entity Home Assistant's water heater uses as its STATE —
+			* `setOperationMode` is what a native water_heater writes when the
+			* operator picks `eco`. Read-only here left that platform with no
+			* command at all.
+			*/
 			mode: {
 				platform: "sensor",
 				field: "operationMode",
 				label: "Operation mode",
+				writable: true,
 				enabledByDefault: false
 			},
 			away: {
@@ -2020,11 +2109,15 @@ var CAP_ENTITY_MAP = {
 				deviceClass: "battery",
 				unit: "%"
 			},
-			/** Free-form: the accepted values are `availableFanSpeeds` on the slice. */
+			/**
+			* Free-form: the accepted values are `availableFanSpeeds` on the slice.
+			* `vacuumControl.setFanSpeed` is the route; the native vacuum renders it.
+			*/
 			"fan-speed": {
 				platform: "sensor",
 				field: "fanSpeed",
 				label: "Fan speed",
+				writable: true,
 				enabledByDefault: false
 			},
 			progress: {
@@ -2130,11 +2223,16 @@ var CAP_ENTITY_MAP = {
 				icon: "mdi:volume-off",
 				writable: true
 			},
-			/** Free-form: the accepted values are `availableSources` on the slice. */
+			/**
+			* Free-form: the accepted values are `availableSources` on the slice.
+			* `mediaPlayer.selectSource` is the route; the native media_player
+			* renders it as its source list.
+			*/
 			source: {
 				platform: "sensor",
 				field: "source",
 				label: "Source",
+				writable: true,
 				enabledByDefault: false
 			},
 			repeat: {
@@ -2880,6 +2978,21 @@ function parseLocked(value) {
 	if (lower === "unlock" || lower === "unlocked") return false;
 	return null;
 }
+/**
+* A free-form vocabulary value, as the DEVICE spells it.
+*
+* `fanMode`, `preset`, `operationMode`, `mode`, `fanSpeed` and `source` are
+* `z.string().min(1)` in their caps and their accepted values live in an
+* `available*` array on the slice. Nothing here validates against that list:
+* a pure resolution has no slice, and a second copy of the vocabulary would
+* be one firmware away from refusing a mode the device accepts. The device
+* is the authority on its own vocabulary, and its refusal surfaces with its
+* own words. Only EMPTY is refused here, because a blank is never a mode.
+*/
+function parseVocabulary(value) {
+	const trimmed = value.trim();
+	return trimmed.length === 0 ? null : trimmed;
+}
 /** 0..100 inclusive, as `brightness.setBrightness` declares it. */
 function parsePercentage(value) {
 	const parsed = Number(value.trim());
@@ -2943,10 +3056,13 @@ function parseEnum(schema, value) {
 * never built, and a leftover that describes the right design reads as
 * verification.
 *
-* **Every builder names ONE method with ONE value.** Nothing here composes
-* two slice fields into one call, because the resolution is pure and has no
-* slice: `climate-control.setTargetRange` writes `targetLow` and
-* `targetHigh` together and is therefore absent, not approximated.
+* **Every builder names ONE method with ONE value, and none of them reads
+* the device.** Resolution is pure and has no slice, which is why
+* `climate-control.setTargetRange` — the only cap method that takes two
+* values at once — resolves to a `climate-target-edge` carrying the half it
+* was given. The read of the other half belongs to {@link applyCapCommand},
+* which has the device; composing it here would have needed a slice this
+* function must not have.
 */
 var CAP_COMMAND_ROUTES = {
 	switch: { primary: (deviceId, value) => {
@@ -2958,14 +3074,20 @@ var CAP_COMMAND_ROUTES = {
 			on
 		};
 	} },
-	"lock-control": { primary: (deviceId, value) => {
-		const locked = parseLocked(value);
-		return locked === null ? null : {
-			kind: "cap-lock",
-			deviceId,
-			locked
-		};
-	} },
+	"lock-control": {
+		primary: (deviceId, value) => {
+			const locked = parseLocked(value);
+			return locked === null ? null : {
+				kind: "cap-lock",
+				deviceId,
+				locked
+			};
+		},
+		commands: { open: (deviceId) => ({
+			kind: "cap-lock-open",
+			deviceId
+		}) }
+	},
 	brightness: { primary: (deviceId, value) => {
 		const percentage = parsePercentage(value);
 		return percentage === null ? null : {
@@ -3055,6 +3177,45 @@ var CAP_COMMAND_ROUTES = {
 					targetHumidity
 				};
 			},
+			"fan-mode": (deviceId, value) => {
+				const fanMode = parseVocabulary(value);
+				return fanMode === null ? null : {
+					kind: "climate-fan-mode",
+					deviceId,
+					fanMode
+				};
+			},
+			preset: (deviceId, value) => {
+				const preset = parseVocabulary(value);
+				return preset === null ? null : {
+					kind: "climate-preset",
+					deviceId,
+					preset
+				};
+			},
+			/**
+			* The two halves of `setTargetRange`, each bounded by the same range
+			* `target` is. They resolve to an EDGE rather than to a call: the other
+			* half is a fact about the device, and resolution is pure.
+			*/
+			"target-low": (deviceId, value) => {
+				const low = parseBounded(value, TEMPERATURE_MIN, TEMPERATURE_MAX);
+				return low === null ? null : {
+					kind: "climate-target-edge",
+					deviceId,
+					edge: "low",
+					value: low
+				};
+			},
+			"target-high": (deviceId, value) => {
+				const high = parseBounded(value, TEMPERATURE_MIN, TEMPERATURE_MAX);
+				return high === null ? null : {
+					kind: "climate-target-edge",
+					deviceId,
+					edge: "high",
+					value: high
+				};
+			},
 			"swing-vertical": (deviceId, value) => {
 				const on = parseBool(value);
 				return on === null ? null : {
@@ -3085,6 +3246,14 @@ var CAP_COMMAND_ROUTES = {
 			};
 		},
 		extras: {
+			preset: (deviceId, value) => {
+				const preset = parseVocabulary(value);
+				return preset === null ? null : {
+					kind: "fan-preset",
+					deviceId,
+					preset
+				};
+			},
 			oscillating: (deviceId, value) => {
 				const oscillating = parseBool(value);
 				return oscillating === null ? null : {
@@ -3112,14 +3281,24 @@ var CAP_COMMAND_ROUTES = {
 				on
 			};
 		},
-		extras: { "target-humidity": (deviceId, value) => {
-			const humidity = parsePercentage(value);
-			return humidity === null ? null : {
-				kind: "humidifier-humidity",
-				deviceId,
-				humidity
-			};
-		} }
+		extras: {
+			"target-humidity": (deviceId, value) => {
+				const humidity = parsePercentage(value);
+				return humidity === null ? null : {
+					kind: "humidifier-humidity",
+					deviceId,
+					humidity
+				};
+			},
+			mode: (deviceId, value) => {
+				const mode = parseVocabulary(value);
+				return mode === null ? null : {
+					kind: "humidifier-mode",
+					deviceId,
+					mode
+				};
+			}
+		}
 	},
 	"water-heater": { extras: {
 		target: (deviceId, value) => {
@@ -3137,6 +3316,14 @@ var CAP_COMMAND_ROUTES = {
 				deviceId,
 				on
 			};
+		},
+		mode: (deviceId, value) => {
+			const mode = parseVocabulary(value);
+			return mode === null ? null : {
+				kind: "water-heater-mode",
+				deviceId,
+				mode
+			};
 		}
 	} },
 	valve: {
@@ -3166,33 +3353,43 @@ var CAP_COMMAND_ROUTES = {
 			})
 		}
 	},
-	"vacuum-control": { commands: {
-		start: (deviceId) => ({
-			kind: "vacuum-verb",
-			deviceId,
-			verb: "start"
-		}),
-		pause: (deviceId) => ({
-			kind: "vacuum-verb",
-			deviceId,
-			verb: "pause"
-		}),
-		stop: (deviceId) => ({
-			kind: "vacuum-verb",
-			deviceId,
-			verb: "stop"
-		}),
-		"return-to-base": (deviceId) => ({
-			kind: "vacuum-verb",
-			deviceId,
-			verb: "return-to-base"
-		}),
-		locate: (deviceId) => ({
-			kind: "vacuum-verb",
-			deviceId,
-			verb: "locate"
-		})
-	} },
+	"vacuum-control": {
+		extras: { "fan-speed": (deviceId, value) => {
+			const speed = parseVocabulary(value);
+			return speed === null ? null : {
+				kind: "vacuum-fan-speed",
+				deviceId,
+				speed
+			};
+		} },
+		commands: {
+			start: (deviceId) => ({
+				kind: "vacuum-verb",
+				deviceId,
+				verb: "start"
+			}),
+			pause: (deviceId) => ({
+				kind: "vacuum-verb",
+				deviceId,
+				verb: "pause"
+			}),
+			stop: (deviceId) => ({
+				kind: "vacuum-verb",
+				deviceId,
+				verb: "stop"
+			}),
+			"return-to-base": (deviceId) => ({
+				kind: "vacuum-verb",
+				deviceId,
+				verb: "return-to-base"
+			}),
+			locate: (deviceId) => ({
+				kind: "vacuum-verb",
+				deviceId,
+				verb: "locate"
+			})
+		}
+	},
 	"lawn-mower-control": { commands: {
 		start: (deviceId) => ({
 			kind: "mower-verb",
@@ -3243,6 +3440,14 @@ var CAP_COMMAND_ROUTES = {
 					deviceId,
 					repeat
 				};
+			},
+			source: (deviceId, value) => {
+				const source = parseVocabulary(value);
+				return source === null ? null : {
+					kind: "media-source",
+					deviceId,
+					source
+				};
 			}
 		},
 		commands: {
@@ -3532,6 +3737,30 @@ async function applyCapCommand(device, command) {
 			if (command.locked) await device.lockControl.lock({});
 			else await device.lockControl.unlock({});
 			return { ok: true };
+		case "cap-lock-open":
+			if (device.lockControl === void 0) return {
+				ok: false,
+				reason: "no-provider",
+				capName: "lock-control"
+			};
+			/**
+			* A lock without a latch REFUSES this, and the refusal is the answer.
+			* `lock-control` declares `open` unconditionally while the latch is a
+			* property of the hardware, so the provider is the only thing that
+			* knows — reporting success over its refusal would leave Home
+			* Assistant showing a door that opened and did not.
+			*/
+			try {
+				await device.lockControl.open({});
+			} catch (err) {
+				return {
+					ok: false,
+					reason: "refused",
+					capName: "lock-control",
+					error: err instanceof Error ? err.message : String(err)
+				};
+			}
+			return { ok: true };
 		case "cap-brightness":
 			if (device.brightness === void 0) return {
 				ok: false,
@@ -3595,15 +3824,40 @@ async function applyCapCommand(device, command) {
 		});
 		case "climate-mode": return call(device.climateControl, "climate-control", (climate) => climate.setMode({ mode: command.mode }));
 		case "climate-target": return call(device.climateControl, "climate-control", (climate) => climate.setTarget({ target: command.target }));
+		case "climate-fan-mode": return call(device.climateControl, "climate-control", (climate) => climate.setFanMode({ fanMode: command.fanMode }));
+		case "climate-preset": return call(device.climateControl, "climate-control", (climate) => climate.setPreset({ preset: command.preset }));
+		/**
+		* The one read-then-write in this file, and the reason is the cap's
+		* signature rather than a preference: `setTargetRange` takes both edges
+		* and Home Assistant sends them one at a time. The OTHER edge is read
+		* from `getStatus` — the provider's own current answer — and a `null`
+		* there is REFUSED, because a dual-setpoint device that reports no range
+		* has no range to move one edge of, and substituting the single `target`
+		* would silently collapse the band to a point.
+		*/
+		case "climate-target-edge": return call(device.climateControl, "climate-control", async (climate) => {
+			const status = await climate.getStatus({});
+			if (status === null) throw new Error("the device reports no climate status, so setTargetRange has no range");
+			const low = command.edge === "low" ? command.value : status.targetLow;
+			const high = command.edge === "high" ? command.value : status.targetHigh;
+			if (low === null || high === null) throw new Error(`the device reports no ${command.edge === "low" ? "high" : "low"} setpoint, so setTargetRange has nothing to preserve`);
+			await climate.setTargetRange({
+				targetLow: low,
+				targetHigh: high
+			});
+		});
 		case "climate-target-humidity": return call(device.climateControl, "climate-control", (climate) => climate.setTargetHumidity({ targetHumidity: command.targetHumidity }));
 		case "climate-swing": return call(device.climateControl, "climate-control", (climate) => command.axis === "vertical" ? climate.setSwingVertical({ on: command.on }) : climate.setSwingHorizontal({ on: command.on }));
 		case "fan-percentage": return call(device.fanControl, "fan-control", (fan) => fan.setPercentage({ percentage: command.percentage }));
+		case "fan-preset": return call(device.fanControl, "fan-control", (fan) => fan.setPreset({ preset: command.preset }));
 		case "fan-oscillating": return call(device.fanControl, "fan-control", (fan) => fan.setOscillating({ oscillating: command.oscillating }));
 		case "fan-direction": return call(device.fanControl, "fan-control", (fan) => fan.setDirection({ direction: command.direction }));
 		case "humidifier-on": return call(device.humidifier, "humidifier", (humidifier) => humidifier.setOn({ on: command.on }));
 		case "humidifier-humidity": return call(device.humidifier, "humidifier", (humidifier) => humidifier.setTargetHumidity({ humidity: command.humidity }));
+		case "humidifier-mode": return call(device.humidifier, "humidifier", (humidifier) => humidifier.setMode({ mode: command.mode }));
 		case "water-heater-temp": return call(device.waterHeater, "water-heater", (heater) => heater.setTargetTemp({ temp: command.temp }));
 		case "water-heater-away": return call(device.waterHeater, "water-heater", (heater) => heater.setAway({ on: command.on }));
+		case "water-heater-mode": return call(device.waterHeater, "water-heater", (heater) => heater.setOperationMode({ mode: command.mode }));
 		case "valve-position": return call(device.valve, "valve", (valve) => valve.setPosition({ position: command.position }));
 		case "valve-verb": return call(device.valve, "valve", (valve) => {
 			switch (command.verb) {
@@ -3621,6 +3875,7 @@ async function applyCapCommand(device, command) {
 				case "locate": return vacuum.locate({});
 			}
 		});
+		case "vacuum-fan-speed": return call(device.vacuumControl, "vacuum-control", (vacuum) => vacuum.setFanSpeed({ speed: command.speed }));
 		case "mower-verb": return call(device.lawnMowerControl, "lawn-mower-control", (mower) => {
 			switch (command.verb) {
 				case "start": return mower.startMowing({});
@@ -3641,6 +3896,7 @@ async function applyCapCommand(device, command) {
 		case "media-mute": return call(device.mediaPlayer, "media-player", (media) => media.setMute({ muted: command.muted }));
 		case "media-shuffle": return call(device.mediaPlayer, "media-player", (media) => media.setShuffle({ shuffle: command.shuffle }));
 		case "media-repeat": return call(device.mediaPlayer, "media-player", (media) => media.setRepeat({ repeat: command.repeat }));
+		case "media-source": return call(device.mediaPlayer, "media-player", (media) => media.selectSource({ source: command.source }));
 		case "color-mireds": return call(device.color, "color", (color) => color.setColor({ color: {
 			mode: "mired",
 			mireds: command.mireds
@@ -5256,7 +5512,7 @@ var HaExportAddon = class extends BaseAddon {
 		const plateText = readString(data, "plateText");
 		const lastSeen = readNumber(data, "lastSeen") ?? Date.now();
 		const zonesVisited = readStringArray(data, "zonesVisited");
-		const mediaUrl = this.mintTrackMediaUrl(trackId);
+		const mediaUrl = this.mintTrackMediaUrl(trackId, deviceId);
 		const values = projectTrackLifecycle(deviceKey, {
 			deviceId,
 			trackId,
@@ -5722,22 +5978,12 @@ var HaExportAddon = class extends BaseAddon {
 		}
 		if (entry.target.type === "camera") {
 			/**
-			* The live picture. A refused URL is DROPPED WORK and says so: an
-			* entity Home Assistant shows and never loads is indistinguishable
-			* from a camera that is down, and `credentials-inline` in
-			* particular means a source handed us the camera password — which
-			* is a defect to fix, not a value to publish.
+			* The live picture publishes NOTHING here, deliberately. A `camera`
+			* entity's whole content is its `stream_target`, which travelled with
+			* the announce; the component fetches the still and negotiates the
+			* video itself. The url this block used to publish was read by
+			* nobody — see `camera-entities.ts`.
 			*/
-			const streams = cameraStreamValues(key, entry.streams);
-			values.push(...streams.values);
-			for (const refusal of streams.refused) this.warnOnce(entry.deviceId, "camera-streams", refusal.entity, {
-				message: "ha-export: a camera entity exists and its stream URL cannot be published",
-				meta: {
-					entity: refusal.entity,
-					profile: refusal.profile,
-					reason: refusal.reason
-				}
-			});
 			const group = await this.ctx.api.pipelineOrchestrator.getCameraSwitches.query({ deviceId: entry.deviceId });
 			values.push(...projectCameraSwitches(key, group.switches.map((sw) => ({
 				id: sw.id,
@@ -5766,7 +6012,7 @@ var HaExportAddon = class extends BaseAddon {
 		const zones = device.type === "camera" ? await this.loadZones(device.id) : [];
 		const switches = device.type === "camera" ? await this.loadSwitches(device.id) : [];
 		const ptzPresets = device.type === "camera" && boundCaps.includes("ptz") ? await this.loadPresets(device.id) : [];
-		const streams = device.type === "camera" && boundCaps.includes("camera-streams") ? await this.loadStreamProfiles(device.id) : [];
+		const streams = device.type === "camera" && boundCaps.includes("webrtc-session") ? await this.loadStreamChoices(device.id) : [];
 		const manufacturer = readString(device.metadata ?? {}, "manufacturer");
 		const model = readString(device.metadata ?? {}, "model");
 		return {
@@ -5793,42 +6039,30 @@ var HaExportAddon = class extends BaseAddon {
 		};
 	}
 	/**
-	* The camera's assigned profile slots, as broker restream URLs.
+	* Every stream of the camera, as the hub's own picker lists them.
 	*
-	* `getProfileRtspEntries`, never `streamCatalog.getCatalog`: the latter
-	* returns the camera's NATIVE url with its password inline, and this
-	* value is written into Home Assistant's entity registry and its debug
-	* logs. `camera-entities.ts` refuses a credentialed URL as well — two
-	* gates, because the cost of one of them being wrong is the operator's
-	* camera password on a host we do not own.
+	* `webrtcSession.listStreams` rather than
+	* `cameraStreams.getProfileRtspEntries`: the component negotiates live
+	* video through `webrtcSession.handleOffer` and needs the `target`, not
+	* an address. Reading the RTSP entries instead cost this export three
+	* things it no longer pays — a `hostname` argument (the broker binds
+	* `127.0.0.1`, so a camera on a hub with no reachable base url got NO
+	* camera entity at all), a refusal for a credentialed url, and a whole
+	* value plane nothing consumed.
 	*
-	* `hostname` is passed EXPLICITLY. The broker binds `127.0.0.1` and
-	* mints its URLs against whatever address it was asked for; Home
-	* Assistant is not on the hub, so omitting it produces entities that
-	* exist and never load — the identical failure the image entities had
-	* before `publicBaseUrl`.
+	* `listStreams` also reports the camera's raw substreams, which the
+	* profile view could not express.
 	*/
-	async loadStreamProfiles(deviceId) {
-		const hostname = hostnameFromBaseUrl(this.mediaBaseUrl);
-		if (hostname === null) {
-			this.ctx.logger.warn("ha-export: no reachable hub hostname — this camera gets no live camera entity", {
-				tags: { deviceId },
-				meta: { mediaBaseUrl: this.mediaBaseUrl }
-			});
-			return [];
-		}
+	async loadStreamChoices(deviceId) {
 		try {
-			return (await this.ctx.api.cameraStreams.getProfileRtspEntries.query({
-				deviceId,
-				hostname
-			})).map((entry) => ({
-				profile: entry.profile,
-				url: entry.url,
-				mutedUrl: entry.mutedUrl,
-				enabled: entry.enabled
+			return (await this.ctx.api.webrtcSession.listStreams.query({ deviceId })).map((choice) => ({
+				id: choice.id,
+				label: choice.label,
+				target: choice.target,
+				...choice.resolution === null ? {} : { height: choice.resolution.height }
 			}));
 		} catch (err) {
-			this.ctx.logger.warn("ha-export: could not read stream profiles, no camera entity", {
+			this.ctx.logger.warn("ha-export: could not read the camera streams, no camera entity", {
 				tags: { deviceId },
 				meta: { error: errMsg(err) }
 			});
@@ -6341,10 +6575,10 @@ var HaExportAddon = class extends BaseAddon {
 			res.end();
 			return;
 		}
-		const trackId = decodeURIComponent(id);
+		const compositeId = decodeURIComponent(id);
 		if (!verifyMediaSignature({
 			secret: this.mediaSecret,
-			id: trackId,
+			id: compositeId,
 			exp: url.searchParams.get("exp") ?? void 0,
 			sig: url.searchParams.get("sig") ?? void 0,
 			nowMs: Date.now()
@@ -6353,9 +6587,18 @@ var HaExportAddon = class extends BaseAddon {
 			res.end();
 			return;
 		}
+		const sep = compositeId.indexOf(":");
+		const deviceId = sep > 0 ? Number(compositeId.slice(0, sep)) : NaN;
+		const trackId = sep > 0 ? compositeId.slice(sep + 1) : "";
+		if (!Number.isInteger(deviceId) || deviceId <= 0 || trackId.length === 0) {
+			res.statusCode = 400;
+			res.end();
+			return;
+		}
 		try {
 			const first = (await this.ctx.api.pipelineAnalytics.getTrackMedia.query({
 				trackId,
+				deviceId,
 				kinds: [
 					"thumbnailSmall",
 					"thumbnail",
@@ -6388,12 +6631,12 @@ var HaExportAddon = class extends BaseAddon {
 	* cannot open is worse than no image, because it renders as a broken
 	* entity rather than an empty one.
 	*/
-	mintTrackMediaUrl(trackId) {
+	mintTrackMediaUrl(trackId, deviceId) {
 		if (this.mediaBaseUrl === null || this.mediaSecret.length === 0) return null;
 		return buildMediaUrl({
 			baseUrl: this.mediaBaseUrl,
 			routePrefix: MEDIA_ROUTE_PREFIX,
-			id: trackId,
+			id: `${String(deviceId)}:${trackId}`,
 			secret: this.mediaSecret,
 			expMs: Date.now() + MEDIA_URL_TTL_MS
 		});