@camstack/addon-provider-homeassistant 1.2.653 → 1.2.655

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as humidifierCapability, $t as boolean, A as brightnessCapability, At as switchCapability, Bt as weatherCapability, C as alarmPanelCapability, Ct as runningFromLawnMower, D as bestLocationMatch, Dt as scriptRunnerCapability, E as batteryCapability, Et as runningStateCapability, F as calendarSourceCapability, Ft as updateCapability, G as deviceAdminLinkCapability, H as contactCapability, Ht as RecordSecretUnavailableError, I as carbonMonoxideCapability, It as vacuumControlCapability, J as enumSensorCapability, Jt as entryBody, K as deviceAdoptionCapability, Kt as defineEntryKind, L as climateControlCapability, Lt as valveCapability, M as buildAddonRouteProvider, Mt as temperatureSensorCapability, N as buildDeviceAdminUrl, Nt as tryConvertDelta, O as binaryCapability, P as buttonCapability, Pt as tryConvertUnit, Q as gasCapability, Qt as array, R as colorCapability, Rt as vibrationCapability, S as airQualitySensorCapability, T as automationControlCapability, Tt as runningFromVacuumState, U as controlCapability, Ut as baseUnitOf, W as coverCapability, Wt as createEvent, X as fanControlCapability, Y as eventEmitterCapability, Z as floodCapability, Zt as _enum, _t as pressureSensorCapability, a as BaseDevice, an as string, at as mediaPlayerCapability, b as accessoriesCapability, bt as quantityFromUnit, cn as url, ct as notificationOutputCapability, dn as DeviceType, en as discriminatedUnion, et as humiditySensorCapability, fn as errMsg, ft as parseAdminBase, gt as presenceCapability, ht as prepareNotification, in as record, it as lockControlCapability, j as brokerCapability, jt as tamperCapability, k as boardKeySourceCapability, kt as smokeCapability, ln as DeviceFeature, lt as notifierCapability, nn as number, nt as ingestReading, o as BaseDeviceProvider, on as union, ot as motionCapability, p as EnumSensorDateTimeFormatSchema, pn as EventCategory, pt as powerMeterCapability, qt as defineRecordKinds, rn as object, rt as lawnMowerControlCapability, sn as unknown, st as normalizeUnit, t as HA_BROKER_KIND, tn as literal, tt as imageCapability, un as DeviceRole, ut as numericSensorCapability, v as RUNNING_STATE_COLD, w as ambientLightSensorCapability, wt as runningFromMediaPlayer, x as addonRoutesCapability, xt as resolveAttachmentUrls, y as TargetSchema, yt as publicEndpointReaderFrom, z as connectivityCapability, zt as waterHeaterCapability } from "./ha-broker-source-CKdH9XHn.mjs";
+import { $ as enumSensorCapability, $t as baseUnitOf, A as automationControlCapability, B as calendarSourceCapability, Bt as tamperCapability, C as RecordIntegrationInstances, Cn as EventCategory, Ct as prepareNotification, D as airQualitySensorCapability, Dt as publicEndpointReaderFrom, E as addonRoutesCapability, F as brightnessCapability, Ft as scriptRunnerCapability, Gt as vacuumControlCapability, H as climateControlCapability, Ht as tryConvertDelta, I as brokerCapability, J as controlCapability, Jt as waterHeaterCapability, Kt as valveCapability, L as buildAddonRouteProvider, Lt as smokeCapability, M as bestLocationMatch, Mt as runningFromMediaPlayer, N as binaryCapability, Nt as runningFromVacuumState, O as alarmPanelCapability, Ot as quantityFromUnit, P as boardKeySourceCapability, Pt as runningStateCapability, Qt as RecordSecretUnavailableError, R as buildDeviceAdminUrl, S as RUNNING_STATE_COLD, Sn as errMsg, St as preconditionOf, T as accessoriesCapability, Tt as pressureSensorCapability, U as colorCapability, Ut as tryConvertUnit, V as carbonMonoxideCapability, Vt as temperatureSensorCapability, W as connectivityCapability, Wt as updateCapability, X as deviceAdminLinkCapability, Y as coverCapability, Yt as weatherCapability, Z as deviceAdoptionCapability, _n as unknown, _t as notifierCapability, at as gasCapability, bn as DeviceRole, bt as parseAdminBase, c as BaseDevice, cn as array, ct as imageCapability, dn as literal, dt as lawnMowerControlCapability, en as createEvent, et as eventEmitterCapability, fn as number, ft as lockControlCapability, g as EnumSensorDateTimeFormatSchema, gn as union, gt as notificationOutputCapability, hn as string, ht as normalizeUnit, i as HA_BROKER_KIND, in as entryBody, it as floodCapability, j as batteryCapability, jt as runningFromLawnMower, k as ambientLightSensorCapability, kt as resolveAttachmentUrls, l as BaseDeviceProvider, ln as boolean, lt as ingestReading, mn as record, mt as motionCapability, nn as defineEntryKind, nt as flattenNestedRecords, ot as humidifierCapability, pn as object, pt as mediaPlayerCapability, q as contactCapability, qt as vibrationCapability, rn as defineRecordKinds, rt as flattenPortsOver, sn as _enum, st as humiditySensorCapability, t as haInstanceSettingsPortsOver, tn as defineAddonMigrations, tt as fanControlCapability, un as discriminatedUnion, ut as integrationInstancesCapability, vn as url, vt as numericSensorCapability, w as TargetSchema, wt as presenceCapability, xn as DeviceType, xt as powerMeterCapability, yn as DeviceFeature, z as buttonCapability, zt as switchCapability } from "./ha-instance-settings-DLDNOmgL.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-admin-link.ts
@@ -2496,11 +2496,33 @@ var HaMediaPlayerDevice = class extends HaBaseChildDevice {
 	registerRunningCap() {
 		this.ctx.registerNativeCap(runningStateCapability, { getStatus: async () => this.runtimeState.getCapState("running-state") ?? RUNNING_STATE_COLD });
 	}
+	/** One service call per step, in order: HA has no "N steps" form. */
+	async repeatHaService(service, steps) {
+		for (let step = 0; step < steps; step += 1) await this.callHaService("media_player", service);
+	}
 	registerMediaPlayerCap() {
 		this.ctx.registerNativeCap(mediaPlayerCapability, {
 			getStatus: async () => {
 				return this.runtimeState.getCapState("media-player") ?? COLD_START$10;
 			},
+			turnOn: async () => {
+				await this.callHaService("media_player", "turn_on");
+			},
+			turnOff: async () => {
+				await this.callHaService("media_player", "turn_off");
+			},
+			volumeUp: async ({ steps }) => {
+				await this.repeatHaService("volume_up", steps);
+			},
+			volumeDown: async ({ steps }) => {
+				await this.repeatHaService("volume_down", steps);
+			},
+			channelUp: async ({ steps }) => {
+				await this.repeatHaService("media_next_track", steps);
+			},
+			channelDown: async ({ steps }) => {
+				await this.repeatHaService("media_previous_track", steps);
+			},
 			play: async () => {
 				await this.callHaService("media_player", "media_play");
 			},
@@ -5742,22 +5764,16 @@ var TEST_HANDSHAKE_TIMEOUT_MS = 8e3;
 var HaBrokerEntrySchema = object({
 	id: string(),
 	name: string(),
-	/** Either Supervisor (token from env) or long-lived (persisted). */
-	auth: discriminatedUnion("kind", [object({
-		kind: literal("supervisor"),
-		supervisorToken: string().meta({ secret: true })
-	}), object({
-		kind: literal("long-lived"),
-		baseUrl: string(),
-		accessToken: string().meta({ secret: true })
-	})]),
-	/** Optional FK to the integration record that spawned this broker.
-	*  Populated when the wizard's "+ New Integration" flow created the
-	*  broker; null when the operator added it via the Settings panel
-	*  directly. Used by the integration listener to keep the broker
-	*  list in sync with the integrations table (cascade-delete on
-	*  integration removal). */
-	integrationId: string().optional()
+	/** Supervisor (token from env) or long-lived (persisted); picks which fields below are used. */
+	authKind: _enum(["long-lived", "supervisor"]),
+	/** Origin URL of the HA instance; long-lived only. */
+	baseUrl: string().optional(),
+	accessToken: string().optional().meta({ secret: true }),
+	supervisorToken: string().optional().meta({ secret: true }),
+	/** Optional FK to the integration record that spawned this broker. */
+	integrationId: string().optional(),
+	/** The instance's own switch (D996); absent means on. */
+	enabled: boolean().optional()
 });
 /**
 * Validates a `broker.add` `settings` payload for the HA kind. Accepts:
@@ -5782,6 +5798,34 @@ function settingsToAuth(settings) {
 		accessToken: parsed.accessToken
 	};
 }
+/** The flat entry fields of an auth config: the one place the two shapes meet. */
+function authToEntryFields(auth) {
+	return auth.kind === "supervisor" ? {
+		authKind: "supervisor",
+		supervisorToken: auth.supervisorToken
+	} : {
+		authKind: "long-lived",
+		baseUrl: auth.baseUrl,
+		accessToken: auth.accessToken
+	};
+}
+/** The auth config an entry stands for; null while the entry is not filled in. */
+function haAuthOf(entry) {
+	const parsed = HaAuthConfigSchema.safeParse(entry.authKind === "supervisor" ? {
+		kind: "supervisor",
+		supervisorToken: entry.supervisorToken ?? ""
+	} : {
+		kind: "long-lived",
+		baseUrl: entry.baseUrl ?? "",
+		accessToken: entry.accessToken ?? ""
+	});
+	return parsed.success ? parsed.data : null;
+}
+/** The flat settings payload (`settingsToAuth` shape) of an entry; null while it is not filled in. */
+function entryToSettings(entry) {
+	const auth = haAuthOf(entry);
+	return auth === null ? null : authToSettings(auth);
+}
 function authToSettings(auth) {
 	if (auth.kind === "supervisor") return { supervisorToken: auth.supervisorToken };
 	return {
@@ -5844,7 +5888,7 @@ var HaBrokerRegistry = class {
 	*  started concurrently; transient errors don't block bootstrap. */
 	async restore(entries) {
 		this.seedCounterFromEntries(entries);
-		await Promise.all(entries.map(async (entry) => {
+		await Promise.all(entries.filter((entry) => entry.enabled !== false && haAuthOf(entry) !== null).map(async (entry) => {
 			try {
 				await this.startManagerForEntry(entry);
 			} catch (err) {
@@ -5905,7 +5949,7 @@ var HaBrokerRegistry = class {
 		const entry = {
 			id: options.id !== void 0 ? this.adoptId(options.id) : this.allocateId(),
 			name,
-			auth,
+			...authToEntryFields(auth),
 			...options.integrationId !== void 0 ? { integrationId: options.integrationId } : {}
 		};
 		await this.startManagerForEntry(entry);
@@ -5926,7 +5970,7 @@ var HaBrokerRegistry = class {
 		return {
 			id,
 			name: existing.getInfo().name,
-			auth
+			...authToEntryFields(auth)
 		};
 	}
 	/**
@@ -6109,10 +6153,12 @@ var HaBrokerRegistry = class {
 			this.logger.debug("ha-broker already active — reusing existing connection", { meta: { brokerId: entry.id } });
 			return;
 		}
+		const auth = haAuthOf(entry);
+		if (auth === null) throw new Error(`ha-broker '${entry.id}' has no complete credentials`);
 		const manager = new HaIntegrationManager({
 			id: entry.id,
 			name: entry.name,
-			auth: entry.auth,
+			auth,
 			logger: this.logger,
 			eventBus: this.eventBus,
 			onConnected: (brokerId) => this.onBrokerConnected?.(brokerId),
@@ -6439,6 +6485,8 @@ function mapMediaPlayer(attributes) {
 		if ((sf & 8) !== 0) features.push(DeviceFeature.MediaPlayerMute);
 		if ((sf & 16) !== 0) features.push(DeviceFeature.MediaPlayerPrevious);
 		if ((sf & 32) !== 0) features.push(DeviceFeature.MediaPlayerNext);
+		if ((sf & 384) === 384) features.push(DeviceFeature.MediaPlayerPower);
+		if ((sf & 1024) !== 0) features.push(DeviceFeature.MediaPlayerVolumeStep);
 		if ((sf & 512) !== 0) features.push(DeviceFeature.MediaPlayerPlayMedia);
 		if ((sf & 2048) !== 0) features.push(DeviceFeature.MediaPlayerSelectSource);
 		if ((sf & 4096) !== 0) features.push(DeviceFeature.MediaPlayerStop);
@@ -7170,10 +7218,15 @@ function createHaIconRouteProvider() {
 var haBrokersEntryKind = defineEntryKind("brokers", {
 	title: "Home Assistant brokers",
 	schema: entryBody({
-		auth: HaBrokerEntrySchema.shape.auth,
-		integrationId: string().optional()
+		authKind: HaBrokerEntrySchema.shape.authKind,
+		baseUrl: HaBrokerEntrySchema.shape.baseUrl,
+		accessToken: HaBrokerEntrySchema.shape.accessToken,
+		supervisorToken: HaBrokerEntrySchema.shape.supervisorToken,
+		integrationId: HaBrokerEntrySchema.shape.integrationId,
+		enabled: HaBrokerEntrySchema.shape.enabled
 	}),
-	writeTrigger: "an operator adds, edits or removes a Home Assistant broker connection"
+	writeTrigger: "an operator adds, edits or removes a Home Assistant broker connection",
+	retiredSecretPaths: ["auth.accessToken", "auth.supervisorToken"]
 });
 var haRecordKinds = defineRecordKinds({ 
 /**
@@ -7695,8 +7748,12 @@ function rowToEntry(id, data) {
 	const parsed = HaBrokerEntrySchema.safeParse({
 		id,
 		name: data.name,
-		auth: data.auth,
-		integrationId: data.integrationId
+		authKind: data.authKind,
+		baseUrl: data.baseUrl,
+		accessToken: data.accessToken,
+		supervisorToken: data.supervisorToken,
+		integrationId: data.integrationId,
+		enabled: data.enabled
 	});
 	return parsed.success ? parsed.data : null;
 }
@@ -7735,10 +7792,9 @@ var HaBrokerStore = class HaBrokerStore {
 		}
 	}
 	async upsert(entry) {
-		const { id, name, auth, integrationId } = entry;
+		const { id, integrationId, ...fields } = entry;
 		const body = {
-			name,
-			auth,
+			...Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0)),
 			...integrationId === void 0 ? {} : { integrationId }
 		};
 		const parsed = haBrokersEntryKind.schema.safeParse(body);
@@ -7759,6 +7815,97 @@ var HaBrokerStore = class HaBrokerStore {
 	}
 };
 //#endregion
+//#region src/ha-instances.ts
+/**
+* The Home Assistant connections as `integration-instances` (planning#408 P3): one instance per
+* `brokers` record, over the SAME records and ids (`ha_NNN`) the `broker` cap serves. The body is
+* flat, so the form the instances page edits is the stored shape.
+*/
+var HA_INSTANCE_KIND = "home-assistant";
+function isHaBodyConfigured(body) {
+	return body.authKind === "supervisor" ? (body.supervisorToken ?? "").length > 0 : (body.baseUrl ?? "").length > 0 && (body.accessToken ?? "").length > 0;
+}
+function statusOf(info) {
+	if (info === null) return {
+		state: "unknown",
+		label: "Not connected"
+	};
+	if (info.status === "connected") return {
+		state: "ok",
+		label: "Connected"
+	};
+	if (info.status === "connecting") return {
+		state: "unknown",
+		label: "Connecting"
+	};
+	return {
+		state: "error",
+		label: info.status,
+		...info.error !== null ? { detail: info.error } : {}
+	};
+}
+function buildHaInstances(records, deps) {
+	return new RecordIntegrationInstances(records, haBrokersEntryKind, {
+		description: {
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: true,
+			kinds: [{
+				id: HA_INSTANCE_KIND,
+				label: "Home Assistant"
+			}],
+			allowRestoreId: true
+		},
+		formSchema: () => haBrokerSettingsSchema,
+		initialBody: (name) => ({
+			name,
+			authKind: "long-lived"
+		}),
+		mintId: () => deps.mintId(),
+		kindOf: () => HA_INSTANCE_KIND,
+		health: (_body, id) => {
+			const info = deps.infoOf(id);
+			return {
+				status: statusOf(info),
+				...info?.lastCheckedAt != null ? { lastCheckedAt: info.lastCheckedAt } : {}
+			};
+		},
+		configured: isHaBodyConfigured,
+		onChanged: deps.onChanged,
+		test: async ({ id, values }) => {
+			if (["accessToken", "supervisorToken"].some((key) => {
+				const v = values[key];
+				return typeof v === "string" && v.length > 0 && v !== "__camstack_redacted__";
+			})) {
+				const r = await deps.probe(values);
+				return r.ok ? {
+					success: true,
+					status: "validated",
+					...r.latencyMs !== void 0 ? { latencyMs: r.latencyMs } : {}
+				} : {
+					success: false,
+					status: "rejected",
+					error: r.error ?? "Home Assistant rejected the connection"
+				};
+			}
+			const info = id === null ? null : deps.infoOf(id);
+			if (info === null) return {
+				success: false,
+				status: "inconclusive",
+				error: "Not connected: save the connection first"
+			};
+			return info.status === "connected" ? {
+				success: true,
+				status: "validated"
+			} : {
+				success: false,
+				status: "rejected",
+				error: info.error ?? `status: ${info.status}`
+			};
+		}
+	});
+}
+//#endregion
 //#region src/ha-board-key-source.ts
 /**
 * `board-key-source` for Home Assistant: reads an ESPHome board's API
@@ -7932,6 +8079,178 @@ function createHaBoardKeyProvider(source) {
 	};
 }
 //#endregion
+//#region src/migrations/flatten-broker-records.ts
+/**
+* The Home Assistant broker records keep their connection flat (planning#408 P3): the nested
+* `auth` object (`{ kind, baseUrl, accessToken }` or `{ kind, supervisorToken }`) becomes the top
+* level `authKind`, `baseUrl`, `accessToken` and `supervisorToken`, under the SAME record id, so
+* the devices that carry `ha_NNN` keep their broker. The work is `flattenNestedRecords`: every
+* secret is read before anything is written, read back from its new keychain ref before the
+* nested object goes, and the old refs are deleted last.
+*/
+var FLATTEN_BROKER_RECORDS_ID = "provider-homeassistant/2026-11-04-flatten-broker-records";
+function text(value) {
+	return typeof value === "string" ? value : void 0;
+}
+async function flattenBrokerRecords(ports) {
+	return flattenNestedRecords(ports, {
+		legacyKey: "auth",
+		flatSecretKeys: ["accessToken", "supervisorToken"],
+		toFlat: (legacy) => {
+			const kind = legacy["kind"] === "supervisor" ? "supervisor" : "long-lived";
+			const baseUrl = text(legacy["baseUrl"]);
+			const accessToken = text(legacy["accessToken"]);
+			const supervisorToken = text(legacy["supervisorToken"]);
+			return {
+				authKind: kind,
+				...baseUrl !== void 0 ? { baseUrl } : {},
+				...accessToken !== void 0 ? { accessToken } : {},
+				...supervisorToken !== void 0 ? { supervisorToken } : {}
+			};
+		}
+	});
+}
+//#endregion
+//#region src/migrations/calendar-ids-to-integration.ts
+/**
+* The HA calendars an instance imports are a fact of THAT instance (D985): each Home Assistant
+* integration carries its own `calendarIds` in its settings, and the addon-level `calendarIds`
+* setting (one set of `calendar.*` entity ids for every broker) goes away.
+*
+* Two migrations, in this order:
+*
+* 1. `calendar-ids-to-integration` (procedure) copies the shared set to EVERY integration that
+*    has no `calendarIds` yet. An integration that already has one is never overwritten; one
+*    deleted meanwhile is skipped, never recreated; a stored value that is not a list of strings
+*    is an ambiguity and throws (nothing is guessed).
+* 2. `drop-shared-calendar-ids` (plan) deletes the shared setting after a read-back: every
+*    integration must show its own set. When one holds a set that differs from the shared one,
+*    the shared value is the loser and stays PARKED in place, never deleted.
+*
+* Both are idempotent.
+*/
+var HA_PROVIDER_ID = "provider-homeassistant";
+/** The canonical settings table: one row per key, id `<addonId>.<key>`. */
+var ADDON_SETTINGS_TABLE = "addon-settings";
+var SHARED_CALENDAR_IDS_KEY = "calendarIds";
+async function readSharedSet(ports) {
+	const answer = await ports.readStored(SHARED_CALENDAR_IDS_KEY);
+	if (answer.kind === "unreadable") throw new Error(`provider-homeassistant: the shared calendarIds cannot be read (${answer.reason})`);
+	if (answer.kind === "absent") return null;
+	const value = answer.value;
+	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) throw new Error("provider-homeassistant: the shared calendarIds is not a list of entity ids — nothing copied");
+	return value;
+}
+async function copyCalendarIdsToIntegrations(ports) {
+	const shared = await readSharedSet(ports);
+	if (shared === null) return {
+		outcome: "already-done",
+		summary: { reason: "no-shared-set" }
+	};
+	let copied = 0;
+	let kept = 0;
+	let gone = 0;
+	for (const instance of await ports.listInstances()) {
+		if ("calendarIds" in instance.settings) {
+			kept += 1;
+			continue;
+		}
+		if (await ports.patchInstanceSettings(instance.integrationId, { calendarIds: [...shared] })) copied += 1;
+		else gone += 1;
+	}
+	return {
+		outcome: copied === 0 ? "already-done" : "done",
+		summary: {
+			copied,
+			kept,
+			gone
+		}
+	};
+}
+var asIds = (value) => Array.isArray(value) && value.every((item) => typeof item === "string") ? value : null;
+var sameSet = (a, b) => {
+	const left = new Set(a);
+	const right = new Set(b);
+	return left.size === right.size && [...left].every((id) => right.has(id));
+};
+async function planDropSharedCalendarIds(ports) {
+	const shared = await readSharedSet(ports);
+	if (shared === null) return { edits: [] };
+	const instances = await ports.listInstances();
+	if (instances.length === 0) return { edits: [] };
+	const own = instances.map((instance) => ({
+		integrationId: instance.integrationId,
+		ids: asIds(instance.settings[SHARED_CALENDAR_IDS_KEY])
+	}));
+	const missing = own.filter((entry) => entry.ids === null);
+	if (missing.length > 0) throw new Error(`provider-homeassistant: the shared calendarIds is not dropped, ${missing.map((m) => m.integrationId).join(", ")} has no set of its own`);
+	if (!own.every((entry) => sameSet(entry.ids ?? [], shared))) return { edits: [] };
+	const rowId = `${HA_PROVIDER_ID}.${SHARED_CALENDAR_IDS_KEY}`;
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys: [rowId],
+		precondition: preconditionOf({ [rowId]: {
+			addonId: HA_PROVIDER_ID,
+			key: SHARED_CALENDAR_IDS_KEY,
+			value: shared
+		} })
+	}] };
+}
+//#endregion
+//#region src/migrations/index.ts
+/** The `provider-homeassistant` catalogue (D987): offered to the engine when the addon initialises. */
+var ADDON_MIGRATIONS = [
+	{
+		meta: {
+			id: "provider-homeassistant/2026-11-03-calendar-ids-to-integration",
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 1,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Copy the shared calendar set to the settings of every Home Assistant integration that has none",
+			fixtureMark: "the broker link stored beside the calendars of an integration"
+		},
+		procedure: copyCalendarIdsToIntegrations
+	},
+	{
+		meta: {
+			id: "provider-homeassistant/2026-11-03-drop-shared-calendar-ids",
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 2,
+			dependsOn: ["provider-homeassistant/2026-11-03-calendar-ids-to-integration"],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the shared calendar set once every integration shows its own",
+			fixtureMark: "the shared set parked when an integration holds a different one"
+		},
+		plan: planDropSharedCalendarIds
+	},
+	{
+		meta: {
+			id: FLATTEN_BROKER_RECORDS_ID,
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 3,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Flatten the nested auth of every Home Assistant broker record under its own id, moving each token to a top-level keychain secret",
+			fixtureMark: "a non-secret field stored beside the auth of a broker record"
+		},
+		procedure: flattenBrokerRecords
+	}
+];
+//#endregion
 //#region src/ha-calendar-source.ts
 function isCalendarEntity(entityId) {
 	return entityId.startsWith("calendar.");
@@ -8042,9 +8361,9 @@ function isSelected(entityId, selected) {
 function createHaCalendarSource(deps) {
 	return {
 		listCalendars: async () => {
-			const selected = deps.selectedCalendarIds();
 			const out = [];
-			for (const { manager } of deps.brokers.listManagers()) {
+			for (const { brokerId, manager } of deps.brokers.listManagers()) {
+				const selected = deps.selectedCalendarIds(brokerId);
 				const states = manager.snapshotAllStates();
 				for (const [entityId, raw] of Object.entries(states)) {
 					if (!isCalendarEntity(entityId)) continue;
@@ -8064,10 +8383,10 @@ function createHaCalendarSource(deps) {
 		listEvents: async (input) => {
 			const startIso = new Date(input.startMs).toISOString();
 			const endIso = new Date(input.endMs).toISOString();
-			const selected = deps.selectedCalendarIds();
 			const wanted = input.calendarIds !== void 0 && input.calendarIds.length > 0 ? new Set(input.calendarIds) : null;
 			const out = [];
 			for (const { brokerId, manager } of deps.brokers.listManagers()) {
+				const selected = deps.selectedCalendarIds(brokerId);
 				const states = manager.snapshotAllStates();
 				const entityIds = Object.keys(states).filter((id) => {
 					if (!isCalendarEntity(id)) return false;
@@ -8091,10 +8410,11 @@ function createHaCalendarSource(deps) {
 	};
 }
 /** Discover every HA calendar entity (ignores the import filter) — for settings catalog. */
-function listHaCalendarCatalog(brokers) {
+function listHaCalendarCatalog(brokers, onlyBrokerId) {
 	const out = [];
 	const seen = /* @__PURE__ */ new Set();
-	for (const { manager } of brokers.listManagers()) {
+	for (const { brokerId, manager } of brokers.listManagers()) {
+		if (onlyBrokerId !== void 0 && brokerId !== onlyBrokerId) continue;
 		const states = manager.snapshotAllStates();
 		for (const [entityId, raw] of Object.entries(states)) {
 			if (!isCalendarEntity(entityId) || seen.has(entityId)) continue;
@@ -8543,10 +8863,7 @@ function planStandaloneReconcile(devices, freshById, brokerId) {
 var ADOPTION_FILTER_DEVICES = "devices";
 var ADOPTION_FILTER_ENTITIES = "entities";
 var HA_KIND = "home-assistant";
-var DEFAULT_CONFIG = {
-	brokers: [],
-	calendarIds: []
-};
+var DEFAULT_CONFIG = { calendarIds: [] };
 /**
 * Home Assistant provider addon.
 *
@@ -8593,6 +8910,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 	}
 	registry = null;
 	brokerStore = null;
+	instances = null;
 	/** Runtime broker rows (records when B2 is live, else settings). */
 	activeBrokers = [];
 	/** Periodic re-sync sweep handle (cleared on shutdown). */
@@ -8607,11 +8925,26 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
+	flattenPorts(records) {
+		if (this.ctx.secrets === void 0) throw new Error("provider-homeassistant: ctx.secrets is required");
+		return {
+			readStored: (key) => this.readStoredGlobalKey(key),
+			...haInstanceSettingsPortsOver(this.ctx.api.integrations),
+			...flattenPortsOver(records.kind(haBrokersEntryKind))
+		};
+	}
 	async onInitialize() {
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("provider-homeassistant: ctx.records is required (hub-only addon)");
 		await records.declare(haAllRecordKinds);
 		this.brokerStore = HaBrokerStore.of(records);
+		this.instances = buildHaInstances(records, {
+			mintId: () => this.requireRegistry().allocateId(),
+			infoOf: (id) => this.registry?.get(id) ?? null,
+			onChanged: (id) => this.syncBrokerRuntime(id),
+			probe: (settings) => this.requireRegistry().testSettings(settings)
+		});
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id === FLATTEN_BROKER_RECORDS_ID), this.flattenPorts(records)));
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new HaBrokerRegistry(this.ctx.logger, this.ctx.eventBus);
 		this.registry.setOnBrokerConnected((brokerId) => {
@@ -8628,6 +8961,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			this.reconcileAllConnectedBrokers();
 		}, HaProviderAddon.RESYNC_INTERVAL_MS);
 		this.ctx.logger.info("ha provider initialised", { meta: { brokerCount: this.activeBrokers.length } });
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id !== FLATTEN_BROKER_RECORDS_ID), this.flattenPorts(records)));
 		await this.reconcileIntegrationsToBrokers();
 		this.subscribeIntegrationLifecycle();
 		return [
@@ -8635,6 +8969,10 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				capability: brokerCapability,
 				provider: this.buildBrokerProvider()
 			},
+			{
+				capability: integrationInstancesCapability,
+				provider: this.requireInstances().toProvider()
+			},
 			{
 				capability: deviceAdoptionCapability,
 				provider: this.buildAdoptionProvider()
@@ -8656,7 +8994,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				provider: createHaCalendarSource({
 					brokers: this.requireRegistry(),
 					logger: this.ctx.logger.child("calendar-source"),
-					selectedCalendarIds: () => new Set(this.config.calendarIds ?? [])
+					selectedCalendarIds: (brokerId) => this.calendarIdsOf(brokerId)
 				})
 			}
 		];
@@ -8754,6 +9092,20 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 	*
 	* Idempotent — runs on boot + on every integration.* event.
 	*/
+	/**
+	* Calendars to import, per broker (D985): the integration's own selection, filled by the
+	* reconcile that already reads each integration's settings. A broker whose integration has no
+	* selection yet (the move has not run) uses the legacy shared set, so a boot mid-move never
+	* changes what is imported.
+	*/
+	calendarIdsByBroker = /* @__PURE__ */ new Map();
+	noteInstanceCalendars(brokerId, raw) {
+		if (Array.isArray(raw) && raw.every((id) => typeof id === "string")) this.calendarIdsByBroker.set(brokerId, new Set(raw));
+		else this.calendarIdsByBroker.delete(brokerId);
+	}
+	calendarIdsOf(brokerId) {
+		return this.calendarIdsByBroker.get(brokerId) ?? new Set(this.config.calendarIds ?? []);
+	}
 	async reconcileIntegrationsToBrokers() {
 		const api = this.ctx.api;
 		if (!api.integrations?.list?.query || !api.integrations.getSettings?.query) return;
@@ -8765,6 +9117,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				const settings = await api.integrations.getSettings.query({ id: integration.id });
 				const brokerId = typeof settings["brokerId"] === "string" ? settings["brokerId"] : null;
 				if (!brokerId) continue;
+				this.noteInstanceCalendars(brokerId, settings["calendarIds"]);
 				if (!this.activeBrokers.find((b) => b.id === brokerId)) {
 					this.ctx.logger.warn("integration→broker: linked broker not found", { meta: {
 						integrationId: integration.id,
@@ -8804,23 +9157,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 		eb.subscribe({ category: "integration.disabled" }, handler);
 		eb.subscribe({ category: "integration.deleted" }, handler);
 	}
-	globalSettingsSchema(cap) {
-		if (cap === "calendar-source") return this.schema({ sections: [{
-			id: "ha-calendars-import",
-			title: "Calendars to import",
-			titleKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.title",
-			columns: 1,
-			fields: [{
-				type: "multiselect",
-				key: "calendarIds",
-				label: "Calendars",
-				labelKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.calendarIds.label",
-				options: [],
-				optionsFrom: "_calendarCatalog",
-				description: "Discovered from connected HA brokers. Select at least one to import; leave empty to import none.",
-				descriptionKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.calendarIds.description"
-			}]
-		}] });
+	globalSettingsSchema(_cap) {
 		return this.schema({ sections: [{
 			id: "ha-broker",
 			title: "Home Assistant broker",
@@ -8835,14 +9172,39 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			}]
 		}] });
 	}
-	async getGlobalSettings(overlay, cap, nodeId) {
-		if (cap !== "calendar-source") return super.getGlobalSettings(overlay, cap, nodeId);
-		const catalog = this.registry ? listHaCalendarCatalog(this.registry) : [];
-		return super.getGlobalSettings({
-			...overlay,
-			calendarIds: this.config.calendarIds ?? [],
-			...catalog.length > 0 ? { _calendarCatalog: catalog } : {}
-		}, cap, nodeId);
+	/**
+	* The calendars of ONE Home Assistant instance (D985): picked on its integration, offered from
+	* that broker's own `calendar.*` entities.
+	*/
+	async integrationSettingsSchema(instance) {
+		if (instance.integrationId === null || !this.registry) return null;
+		let brokerId;
+		try {
+			brokerId = (await this.ctx.api.integrations.getSettings.query({ id: instance.integrationId }))["brokerId"];
+		} catch (err) {
+			this.ctx.logger.warn("HA integration form: instance lookup failed — broker form shown", { meta: {
+				integrationId: instance.integrationId,
+				error: errMsg(err)
+			} });
+			return null;
+		}
+		if (typeof brokerId !== "string") return null;
+		const options = listHaCalendarCatalog(this.registry, brokerId);
+		return this.schema({ sections: [{
+			id: "ha-calendars-import",
+			title: "Calendars to import",
+			titleKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.title",
+			columns: 1,
+			fields: [{
+				type: "multiselect",
+				key: "calendarIds",
+				label: "Calendars",
+				labelKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.calendarIds.label",
+				options,
+				description: "Discovered from this Home Assistant instance. Select at least one to import; leave empty to import none.",
+				descriptionKey: "provider-homeassistant:globalSettings.s_ha-calendars-import.calendarIds.description"
+			}]
+		}] });
 	}
 	async onShutdown() {
 		if (this.resyncTimer) {
@@ -8890,11 +9252,8 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 		for (const entry of persisted) {
 			if (entry.id && liveIds.has(entry.id)) {
 				try {
-					const settings = entry.auth.kind === "supervisor" ? { supervisorToken: entry.auth.supervisorToken } : {
-						baseUrl: entry.auth.baseUrl,
-						accessToken: entry.auth.accessToken
-					};
-					await reg.updateEntry(entry.id, settings);
+					const settings = entryToSettings(entry);
+					if (settings !== null) await reg.updateEntry(entry.id, settings);
 				} catch (err) {
 					this.ctx.logger.warn("ha onConfigChanged: updateEntry failed", { meta: {
 						brokerId: entry.id,
@@ -8904,10 +9263,8 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				continue;
 			}
 			try {
-				const settings = entry.auth.kind === "supervisor" ? { supervisorToken: entry.auth.supervisorToken } : {
-					baseUrl: entry.auth.baseUrl,
-					accessToken: entry.auth.accessToken
-				};
+				const settings = entryToSettings(entry);
+				if (settings === null) continue;
 				const created = await reg.createEntry(entry.name, settings);
 				if (created.id !== entry.id) {
 					const next = persisted.map((b) => b === entry ? {
@@ -8925,21 +9282,59 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 		}
 	}
 	async loadPersistedBrokers() {
-		const store = this.brokerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
+		return this.requireBrokerStore().listResolved();
+	}
+	requireInstances() {
+		if (this.instances === null) throw new Error("provider-homeassistant: instances not ready");
+		return this.instances;
+	}
+	/**
+	* After an instance changed (created, edited, switched, deleted) the runtime follows the record:
+	* a missing record removes the manager and its adopted devices, an off or unfilled one stops the
+	* manager but keeps the devices, a filled one starts or re-authenticates it.
+	*/
+	async syncBrokerRuntime(id) {
+		const reg = this.requireRegistry();
+		const entry = await this.requireBrokerStore().getById(id);
+		this.activeBrokers = await this.loadPersistedBrokers();
+		if (entry === null) {
+			await reg.removeEntry(id);
+			const deviceRegistry = this.ctx.kernel.deviceRegistry;
+			const devices = this.ctx.kernel.devices;
+			if (deviceRegistry && devices) await cascadeRemoveDevicesForBroker({
+				reg: deviceRegistry,
+				devices,
+				addonId: this.ctx.id,
+				brokerId: id,
+				logger: this.ctx.logger
+			});
+			return;
+		}
+		const settings = entry.enabled === false ? null : entryToSettings(entry);
+		if (settings === null) {
+			await reg.removeEntry(id);
+			return;
 		}
-		return this.config.brokers;
+		try {
+			if (reg.get(id) !== null) await reg.updateEntry(id, settings);
+			else await reg.createEntry(entry.name, settings, {
+				id,
+				...entry.integrationId !== void 0 ? { integrationId: entry.integrationId } : {}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("ha instance: could not start the broker", { meta: {
+				brokerId: id,
+				error: errMsg(err)
+			} });
+		}
+	}
+	requireBrokerStore() {
+		if (this.brokerStore === null) throw new Error("provider-homeassistant: broker store not ready");
+		return this.brokerStore;
 	}
 	async persistBrokerEntries(entries) {
 		this.activeBrokers = [...entries];
-		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: entries });
+		await this.requireBrokerStore().replaceAll(entries);
 	}
 	buildBrokerProvider() {
 		const ownerAddonId = this.ctx.id;
@@ -9013,7 +9408,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			getSettings: async ({ id }) => {
 				const entry = this.activeBrokers.find((b) => b.id === id);
 				if (!entry) return null;
-				return authToSettings(entry.auth);
+				return entryToSettings(entry);
 			},
 			setSettings: async ({ id, settings }) => {
 				if (!owns(id)) return;
@@ -9024,7 +9419,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			getBrokerConfig: async ({ id }) => {
 				const entry = this.activeBrokers.find((b) => b.id === id);
 				if (!entry) return null;
-				return authToSettings(entry.auth);
+				return entryToSettings(entry);
 			},
 			getSettingsSchema: async ({ kind }) => {
 				if (kind !== HA_KIND) return null;