@camstack/addon-provider-homeassistant 1.2.653 → 1.2.655

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { B as consumableFormOf, Gt as defineAddonMigrations, M as buildAddonRouteProvider, Ot as sendToExportedTarget, Qt as array, St as runExportedAction, Ut as baseUnitOf, V as consumableKindOf, Vt as BaseAddon, Xt as nodePin, Yt as isReadingQuantity, _ as PLUG_APPLIANCE_TYPES, an as string, c as COCO_TO_MACRO, d as ConsumableItemSchema, dt as oauthIntegrationCapability, f as ConsumableStatusSchema, g as MediaPlayerRepeatSchema, h as HvacModeSchema, i as AlarmArmModeSchema, l as CameraSwitchIdSchema, m as FanDirectionSchema, mt as preconditionOf, pn as EventCategory, q as deviceExportCapability, r as listHomeAssistantBrokers, rn as object, s as CAMERA_SWITCH_ORDER, sn as unknown, u as ConsumableFormSchema, vt as pruneDeletedEntities, x as addonRoutesCapability } from "../ha-broker-source-CKdH9XHn.mjs";
+import { $t as baseUnitOf, At as runExportedAction, Cn as EventCategory, E as addonRoutesCapability, Et as pruneDeletedEntities, G as consumableFormOf, It as sendToExportedTarget, K as consumableKindOf, L as buildAddonRouteProvider, Q as deviceExportCapability, Rt as statusInstanceOf, St as preconditionOf, Xt as BaseAddon, _ as ExportInstanceUnknownError, _n as unknown, an as isReadingQuantity, b as MediaPlayerRepeatSchema, cn as array, d as COCO_TO_MACRO, f as CameraSwitchIdSchema, h as ConsumableStatusSchema, hn as string, m as ConsumableItemSchema, n as listInstancesOrNothing, o as listHomeAssistantBrokers, on as nodePin, p as ConsumableFormSchema, pn as object, r as settingsByBroker, s as AlarmArmModeSchema, t as haInstanceSettingsPortsOver, tn as defineAddonMigrations, u as CAMERA_SWITCH_ORDER, v as FanDirectionSchema, x as PLUG_APPLIANCE_TYPES, y as HvacModeSchema, yt as oauthIntegrationCapability } from "../ha-instance-settings-DLDNOmgL.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import "node:zlib";
 import "node:fs";
@@ -4973,25 +4973,6 @@ async function planDropPublicBaseUrl(ports) {
 		}])))
 	}] };
 }
-//#endregion
-//#region src/ha-export/migrations/index.ts
-/** The `homeassistant-export` catalogue (D987): offered to the engine when the addon initialises. */
-var ADDON_MIGRATIONS = [{
-	meta: {
-		id: "homeassistant-export/2026-11-02-drop-public-base-url",
-		owner: "homeassistant-export",
-		level: "addon-state",
-		seq: 1,
-		dependsOn: [],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "plan",
-		description: "Delete the retired publicBaseUrl setting; each instance now chooses a hub address role",
-		fixtureMark: "the reconcile interval the migration does not know"
-	},
-	plan: planDropPublicBaseUrl
-}];
 process.platform, process.env["SystemRoot"];
 /**
 * The ONE derivation of "a signed, expiring URL".
@@ -5047,65 +5028,6 @@ function verifyExpiringUrl(input) {
 	return timingSafeEqual(a, b);
 }
 //#endregion
-//#region src/ha-export/media-url.ts
-/**
-* Signed, expiring media links.
-*
-* Images never cross the push transport. Home Assistant is handed a URL
-* and fetches the bytes itself, on demand, which is what keeps a camera
-* with a `last_image` entity from turning every detection into a
-* multi-megabyte POST.
-*
-* The link is signed rather than protected by a session, because the
-* fetcher is HA's own frontend or a phone — neither of which holds a
-* camstack token.
-*
-* The HMAC itself is NOT restated here. It used to be — this module and the
-* notification artifact plane each carried their own copy, because addons never
-* import each other and neither could reach the other's. That reasoning was
-* right and the conclusion was wrong: both now delegate to the single
-* derivation in `@camstack/types/node`, which every addon may depend on. What
-* stays local is policy — the TTL below, and the id this plane signs.
-*
-* Expiry is checked BEFORE the constant-time compare (in the shared verifier):
-* an expired link is refused whether or not its signature is valid, so a leaked
-* URL stops working on its own.
-*/
-/** The settings key that carries one broker's media role (per-instance, like `exportTo:`). */
-function mediaRoleKey(brokerId) {
-	return `mediaRole:${brokerId}`;
-}
-/** A broker's chosen role; anything stored that is not a known role is `internal`. */
-function haMediaRoleOf(store, brokerId) {
-	return store[mediaRoleKey(brokerId)] === "publicEndpoint" ? "publicEndpoint" : "internal";
-}
-/**
-* The base a media link is minted on: the hub's role (D734) — `internal` unless the
-* broker chose `publicEndpoint`. Ranked by `local-network`, never loopback (`null`
-* when the role resolves to nothing): a link Home Assistant cannot open is worse
-* than no image.
-*/
-function haMediaBaseUrl(book, role = "internal") {
-	return book.roles[role].resolved;
-}
-/** brokerId → media base, each broker on ITS role. Pure: the caller reads the palette per use. */
-function mediaBasesByBroker(store, brokerIds, book) {
-	return new Map(brokerIds.map((brokerId) => [brokerId, haMediaBaseUrl(book, haMediaRoleOf(store, brokerId))]));
-}
-/** How long a minted link stays valid. Long enough for HA to render it. */
-var MEDIA_URL_TTL_MS = 360 * 60 * 1e3;
-function signMedia(secret, id, expMs) {
-	return signExpiringUrl(secret, id, expMs);
-}
-function buildMediaUrl(input) {
-	const base = input.baseUrl.replace(/\/+$/, "");
-	const sig = signMedia(input.secret, input.id, input.expMs);
-	return `${base}${input.routePrefix}/${encodeURIComponent(input.id)}?exp=${input.expMs}&sig=${sig}`;
-}
-function verifyMediaSignature(input) {
-	return verifyExpiringUrl(input);
-}
-//#endregion
 //#region src/ha-export/membership.ts
 function devicesForBroker(membership, brokerId) {
 	return membership[brokerId] ?? [];
@@ -5167,10 +5089,19 @@ function pruneBrokers(membership, knownBrokerIds) {
 *
 * A broker that is no longer known is not enabled, whatever the store says:
 * a stale `exportTo:` key for a deleted instance must not resurrect it.
+*
+* The switch is a setting of the INSTANCE (D985): `perBroker` carries each broker's integration
+* settings, and a broker whose integration has an `exportTo` answers from it. A broker whose
+* integration has none yet — the migration has not copied it — falls back to the legacy
+* `exportTo:<brokerId>` key, so the move never flips a switch mid-way.
 */
-function enabledBrokerIds(store, knownBrokerIds) {
-	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+function enabledBrokerIds(store, knownBrokerIds, perBroker = NO_INSTANCE_SETTINGS) {
+	return knownBrokerIds.filter((brokerId) => {
+		const own = perBroker.get(brokerId)?.["exportTo"];
+		return typeof own === "boolean" ? own : store[`exportTo:${brokerId}`] === true;
+	});
 }
+var NO_INSTANCE_SETTINGS = /* @__PURE__ */ new Map();
 /** Same brokers, same order, same names — nothing for the form to re-render. */
 function sameBrokers(a, b) {
 	if (a.length !== b.length) return false;
@@ -5224,6 +5155,282 @@ function brokerRefreshPatch(current, next) {
 	};
 }
 //#endregion
+//#region src/ha-export/media-url.ts
+/**
+* Signed, expiring media links.
+*
+* Images never cross the push transport. Home Assistant is handed a URL
+* and fetches the bytes itself, on demand, which is what keeps a camera
+* with a `last_image` entity from turning every detection into a
+* multi-megabyte POST.
+*
+* The link is signed rather than protected by a session, because the
+* fetcher is HA's own frontend or a phone — neither of which holds a
+* camstack token.
+*
+* The HMAC itself is NOT restated here. It used to be — this module and the
+* notification artifact plane each carried their own copy, because addons never
+* import each other and neither could reach the other's. That reasoning was
+* right and the conclusion was wrong: both now delegate to the single
+* derivation in `@camstack/types/node`, which every addon may depend on. What
+* stays local is policy — the TTL below, and the id this plane signs.
+*
+* Expiry is checked BEFORE the constant-time compare (in the shared verifier):
+* an expired link is refused whether or not its signature is valid, so a leaked
+* URL stops working on its own.
+*/
+/** The hub address roles a Home Assistant media link may be minted on. */
+var HA_MEDIA_ROLES = ["internal", "publicEndpoint"];
+/** The settings key that carries one broker's media role (per-instance, like `exportTo:`). */
+function mediaRoleKey(brokerId) {
+	return `mediaRole:${brokerId}`;
+}
+/**
+* A broker's chosen role; anything stored that is not a known role is `internal`. The role is a
+* setting of the INSTANCE (D985): the integration's `mediaRole` answers when it has one, and a
+* broker the migration has not reached falls back to the legacy `mediaRole:<brokerId>` key.
+*/
+function haMediaRoleOf(store, brokerId, perBroker = NO_INSTANCE_SETTINGS) {
+	const own = perBroker.get(brokerId)?.["mediaRole"];
+	return (own !== void 0 ? own : store[mediaRoleKey(brokerId)]) === "publicEndpoint" ? "publicEndpoint" : "internal";
+}
+/**
+* The base a media link is minted on: the hub's role (D734) — `internal` unless the
+* broker chose `publicEndpoint`. Ranked by `local-network`, never loopback (`null`
+* when the role resolves to nothing): a link Home Assistant cannot open is worse
+* than no image.
+*/
+function haMediaBaseUrl(book, role = "internal") {
+	return book.roles[role].resolved;
+}
+/** brokerId → media base, each broker on ITS role. Pure: the caller reads the palette per use. */
+function mediaBasesByBroker(store, brokerIds, book, perBroker = NO_INSTANCE_SETTINGS) {
+	return new Map(brokerIds.map((brokerId) => [brokerId, haMediaBaseUrl(book, haMediaRoleOf(store, brokerId, perBroker))]));
+}
+/** How long a minted link stays valid. Long enough for HA to render it. */
+var MEDIA_URL_TTL_MS = 360 * 60 * 1e3;
+function signMedia(secret, id, expMs) {
+	return signExpiringUrl(secret, id, expMs);
+}
+function buildMediaUrl(input) {
+	const base = input.baseUrl.replace(/\/+$/, "");
+	const sig = signMedia(input.secret, input.id, input.expMs);
+	return `${base}${input.routePrefix}/${encodeURIComponent(input.id)}?exp=${input.expMs}&sig=${sig}`;
+}
+function verifyMediaSignature(input) {
+	return verifyExpiringUrl(input);
+}
+//#endregion
+//#region src/ha-export/migrations/per-broker-flags.ts
+/**
+* Whether the export reaches a Home Assistant instance, and which hub address role its image
+* links use, are facts of THAT instance (D985): they live in the instance's integration settings
+* as `exportTo` and `mediaRole`, not in the addon store as one dynamic key per broker
+* (`exportTo:<brokerId>`, `mediaRole:<brokerId>`).
+*
+* Two migrations:
+*
+* 1. `per-broker-flags-to-integration` (procedure) copies each legacy key to the integration that
+*    links its broker. A flag the integration already has is never overwritten; a key whose
+*    broker has no integration any more (a deleted instance) is skipped, never recreated; two
+*    integrations linking one broker are an ambiguity and throw; a value that is not a boolean /
+*    a known role is skipped (the reader already treats it as off / `internal`).
+* 2. `drop-per-broker-flags` (plan) deletes a legacy key only after a read-back: the integration
+*    must show the same flag. A key the integration disagrees with (its own value was there
+*    first) or whose broker has no integration stays PARKED in place, never deleted.
+*
+* Both are idempotent.
+*/
+var PREFIX = {
+	exportTo: "exportTo:",
+	mediaRole: "mediaRole:"
+};
+var validValue = (flag, value) => flag === "exportTo" ? typeof value === "boolean" : typeof value === "string" && HA_MEDIA_ROLES.some((role) => role === value);
+/** Every legacy key with a value the reader understands, per broker. */
+function legacyFlags(stored) {
+	const out = [];
+	for (const [storeKey, value] of Object.entries(stored)) for (const flag of ["exportTo", "mediaRole"]) {
+		const prefix = PREFIX[flag];
+		if (!storeKey.startsWith(prefix) || storeKey.length === prefix.length) continue;
+		if (validValue(flag, value)) out.push({
+			storeKey,
+			brokerId: storeKey.slice(prefix.length),
+			flag,
+			value
+		});
+	}
+	return out;
+}
+/** The one integration per broker; two integrations linking one broker are an ambiguity. */
+function instanceByBroker(rows) {
+	const out = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (row.brokerId === null) continue;
+		const other = out.get(row.brokerId);
+		if (other !== void 0) throw new Error(`homeassistant-export: integrations ${other.integrationId} and ${row.integrationId} both link broker ${row.brokerId} — nothing copied`);
+		out.set(row.brokerId, row);
+	}
+	return out;
+}
+async function copyFlagsToIntegrations(ports) {
+	const legacy = legacyFlags(await ports.readStored());
+	if (legacy.length === 0) return {
+		outcome: "already-done",
+		summary: { reason: "no-legacy-flags" }
+	};
+	const byBroker = instanceByBroker(await ports.listInstances());
+	const pending = /* @__PURE__ */ new Map();
+	let kept = 0;
+	let skipped = 0;
+	for (const entry of legacy) {
+		const instance = byBroker.get(entry.brokerId);
+		if (instance === void 0) {
+			skipped += 1;
+			continue;
+		}
+		if (entry.flag in instance.settings) {
+			kept += 1;
+			continue;
+		}
+		pending.set(instance.integrationId, {
+			...pending.get(instance.integrationId),
+			[entry.flag]: entry.value
+		});
+	}
+	let copied = 0;
+	let gone = 0;
+	for (const [integrationId, patch] of pending) if (await ports.patchInstanceSettings(integrationId, patch)) copied += Object.keys(patch).length;
+	else gone += 1;
+	return {
+		outcome: copied === 0 ? "already-done" : "done",
+		summary: {
+			copied,
+			kept,
+			skipped,
+			gone
+		}
+	};
+}
+async function planDropPerBrokerFlags(ports) {
+	const legacy = legacyFlags(await ports.readStored());
+	if (legacy.length === 0) return { edits: [] };
+	const byBroker = instanceByBroker(await ports.listInstances());
+	const rowId = (key) => `${HA_EXPORT_ADDON_ID}.${key}`;
+	const drop = [];
+	for (const entry of legacy) {
+		const instance = byBroker.get(entry.brokerId);
+		if (instance === void 0) continue;
+		if (!(entry.flag in instance.settings)) throw new Error(`homeassistant-export: ${entry.storeKey} is not dropped, integration ${instance.integrationId} does not show ${entry.flag}`);
+		if (instance.settings[entry.flag] === entry.value) drop.push(entry);
+	}
+	if (drop.length === 0) return { edits: [] };
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys: drop.map((entry) => rowId(entry.storeKey)),
+		precondition: preconditionOf(Object.fromEntries(drop.map((entry) => [rowId(entry.storeKey), {
+			addonId: HA_EXPORT_ADDON_ID,
+			key: entry.storeKey,
+			value: entry.value
+		}])))
+	}] };
+}
+//#endregion
+//#region src/ha-export/migrations/index.ts
+/** The `homeassistant-export` catalogue (D987): offered to the engine when the addon initialises. */
+var ADDON_MIGRATIONS = [
+	{
+		meta: {
+			id: "homeassistant-export/2026-11-02-drop-public-base-url",
+			owner: "homeassistant-export",
+			level: "addon-state",
+			seq: 1,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the retired publicBaseUrl setting; each instance now chooses a hub address role",
+			fixtureMark: "the reconcile interval the migration does not know"
+		},
+		plan: planDropPublicBaseUrl
+	},
+	{
+		meta: {
+			id: "homeassistant-export/2026-11-03-per-broker-flags-to-integration",
+			owner: "homeassistant-export",
+			level: "addon-state",
+			seq: 2,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Copy each exportTo:<broker> and mediaRole:<broker> key to the settings of the integration that links the broker",
+			fixtureMark: "the broker link stored beside the flags of an integration"
+		},
+		procedure: copyFlagsToIntegrations
+	},
+	{
+		meta: {
+			id: "homeassistant-export/2026-11-03-drop-per-broker-flags",
+			owner: "homeassistant-export",
+			level: "addon-state",
+			seq: 3,
+			dependsOn: ["homeassistant-export/2026-11-03-per-broker-flags-to-integration"],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the per-broker keys once the integration shows the same flag",
+			fixtureMark: "a legacy flag parked when the integration holds a different one"
+		},
+		plan: planDropPerBrokerFlags
+	}
+];
+//#endregion
+//#region src/ha-export/instance-flags.ts
+var exportKey = (brokerId) => `exportTo:${brokerId}`;
+var KEYS = [{
+	flag: "exportTo",
+	keyOf: exportKey
+}, {
+	flag: "mediaRole",
+	keyOf: mediaRoleKey
+}];
+function splitInstanceKeys(patch, instances) {
+	const claimed = /* @__PURE__ */ new Set();
+	const toInstances = /* @__PURE__ */ new Map();
+	for (const row of instances) {
+		if (row.brokerId === null) continue;
+		for (const { flag, keyOf } of KEYS) {
+			const key = keyOf(row.brokerId);
+			if (!(key in patch)) continue;
+			claimed.add(key);
+			toInstances.set(row.integrationId, {
+				...toInstances.get(row.integrationId),
+				[flag]: patch[key]
+			});
+		}
+	}
+	return {
+		toInstances,
+		rest: Object.fromEntries(Object.entries(patch).filter(([key]) => !claimed.has(key)))
+	};
+}
+/** The form's dynamic keys carrying each instance's own value. */
+function instanceOverlay(instances) {
+	const overlay = {};
+	for (const row of instances) {
+		if (row.brokerId === null) continue;
+		for (const { flag, keyOf } of KEYS) {
+			const value = row.settings[flag];
+			if (value !== void 0) overlay[keyOf(row.brokerId)] = value;
+		}
+	}
+	return overlay;
+}
+//#endregion
 //#region src/ha-export/node-reads.ts
 var UNREAD = {
 	footageUsedBytes: null,
@@ -7391,7 +7598,10 @@ var HaExportAddon = class extends BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onInitialize() {
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, { readStored: async () => this.resolveGlobalStore() }));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, {
+			readStored: async () => this.resolveGlobalStore(),
+			...this.instancePorts()
+		}));
 		const secret = this.state("haExportMediaSecret", string(), "");
 		const existing = await secret.get();
 		if (existing.length === 0) {
@@ -7427,31 +7637,46 @@ var HaExportAddon = class extends BaseAddon {
 			{
 				capability: deviceExportCapability,
 				provider: {
-					getStatus: async () => this.buildStatus(),
-					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-						deviceId,
-						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					getStatus: async (input) => this.buildStatus(this.brokerScope(statusInstanceOf(input))),
+					listInstances: async () => this.config.knownBrokers.map((broker) => ({
+						instanceId: broker.id,
+						name: broker.name,
+						enabled: this.enabledBrokerIds().includes(broker.id),
+						kind: "home-assistant"
 					})),
-					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					listSupportedDeviceKinds: async ({ instanceId }) => {
+						this.brokerScope(instanceId);
+						return [...SUPPORTED_DEVICE_KINDS];
+					},
+					listExposedDevices: async ({ instanceId }) => this.exposedDeviceRows(this.brokerScope(instanceId)),
+					exposeDevice: async ({ instanceId, deviceId }) => this.setBrokerMembership(instanceId, deviceId, true),
+					unexposeDevice: async ({ instanceId, deviceId }) => this.setBrokerMembership(instanceId, deviceId, false),
 					listSupportedEntityKinds: async () => [
 						"device",
 						"action",
 						"notifier"
 					],
-					listExposedEntities: async () => {
+					listExposedEntities: async ({ instanceId }) => {
+						const scope = this.brokerScope(instanceId);
 						await exportedEntities.pruneDeleted();
-						return [...exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						return [...this.exposedDeviceRows(scope).map((row) => ({
 							entity: {
 								kind: "device",
-								deviceId
+								deviceId: row.deviceId
 							},
-							exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+							exposedAs: row.exposedAs
 						})), ...exportedEntities.list()];
 					},
-					exposeEntity: async ({ entity }) => entity.kind === "device" ? this.setMembershipEverywhere(entity.deviceId, true) : exportedEntities.expose(entity),
-					unexposeEntity: async ({ entity }) => entity.kind === "device" ? this.setMembershipEverywhere(entity.deviceId, false) : exportedEntities.unexpose(entity),
+					exposeEntity: async ({ instanceId, entity }) => {
+						if (entity.kind === "device") return this.setBrokerMembership(instanceId, entity.deviceId, true);
+						this.brokerScope(instanceId);
+						return exportedEntities.expose(entity);
+					},
+					unexposeEntity: async ({ instanceId, entity }) => {
+						if (entity.kind === "device") return this.setBrokerMembership(instanceId, entity.deviceId, false);
+						this.brokerScope(instanceId);
+						return exportedEntities.unexpose(entity);
+					},
 					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
 					getDeviceLiveContribution: async () => null,
 					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
@@ -7475,6 +7700,35 @@ var HaExportAddon = class extends BaseAddon {
 			}
 		];
 	}
+	/**
+	* The form of the addon shows each instance's own switch and media role: the values sit on its
+	* integration (D985), overlaid on the legacy keys the store may still hold.
+	*/
+	async getGlobalSettings(overlay, cap, nodeId) {
+		const rows = await listInstancesOrNothing(this.instancePorts(), (error) => this.ctx.logger.warn("ha-export: the instance settings could not be read for the form", { meta: { error } }));
+		return super.getGlobalSettings({
+			...overlay,
+			...instanceOverlay(rows)
+		}, cap, nodeId);
+	}
+	/**
+	* An operator write: the `exportTo:` / `mediaRole:` keys go to the integration of their broker
+	* (D985), everything else to the addon store as before. A key whose broker has no integration
+	* stays in the store.
+	*/
+	async updateGlobalSettingsAsOperator(patch, nodeId) {
+		const ports = this.instancePorts();
+		const { toInstances, rest } = splitInstanceKeys(patch, await ports.listInstances());
+		for (const [integrationId, flags] of toInstances) {
+			if (await ports.patchInstanceSettings(integrationId, flags)) continue;
+			throw new Error(`ha-export: integration ${integrationId} is gone — the setting was not saved`);
+		}
+		if (Object.keys(rest).length > 0 || toInstances.size === 0) {
+			await super.updateGlobalSettingsAsOperator(rest, nodeId);
+			return;
+		}
+		await this.onConfigChanged();
+	}
 	async onConfigChanged() {
 		for (const link of this.links.values()) link.client.resetBackoff();
 		await this.reconcile("config-changed");
@@ -9114,7 +9368,20 @@ var HaExportAddon = class extends BaseAddon {
 	enabled = [];
 	async refreshEnabledBrokers(known) {
 		const store = await this.resolveGlobalStore();
-		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id), await this.readInstanceSettings());
+	}
+	/** The hub's `integrations` capability, as the one reader and writer of an instance's settings. */
+	instancePorts() {
+		return haInstanceSettingsPortsOver(this.ctx.api.integrations);
+	}
+	/**
+	* Each broker's integration settings (D985): the switch and the media role of an instance.
+	* A read that fails answers nothing, so every broker falls back to its legacy key and the
+	* failure is logged — never read as "everything off".
+	*/
+	async readInstanceSettings() {
+		const rows = await listInstancesOrNothing(this.instancePorts(), (error) => this.ctx.logger.warn("ha-export: the instance settings could not be read — the legacy per-broker keys answer", { meta: { error } }));
+		return rows.length === 0 ? NO_INSTANCE_SETTINGS : settingsByBroker(rows);
 	}
 	enabledBrokerIds() {
 		return this.enabled;
@@ -9515,7 +9782,7 @@ var HaExportAddon = class extends BaseAddon {
 	async mediaBasesFor(brokerIds, deviceId) {
 		let bases;
 		try {
-			bases = mediaBasesByBroker(await this.resolveGlobalStore(), brokerIds, await this.ctx.api.localNetwork.getAddresses.query());
+			bases = mediaBasesByBroker(await this.resolveGlobalStore(), brokerIds, await this.ctx.api.localNetwork.getAddresses.query(), await this.readInstanceSettings());
 		} catch (err) {
 			this.ctx.logger.debug("ha-export: could not resolve the media base URLs", {
 				tags: { deviceId },
@@ -9533,20 +9800,44 @@ var HaExportAddon = class extends BaseAddon {
 		return bases;
 	}
 	/**
-	* The cap-level expose/unexpose applies to EVERY enabled broker.
-	*
-	* The `device-export` cap is the COMMON surface across export targets
-	* and has no notion of a broker; per-broker granularity lives in the
-	* derived Export panel, over the same store. There is exactly one
-	* authority either way.
+	* Every broker this addon knows, enabled or not: a membership write may
+	* target a broker that is switched off (its devices resume when it is turned
+	* back on). A cold `knownBrokers` still counts the enabled ids.
 	*/
-	async setMembershipEverywhere(deviceId, exposed) {
-		let next = this.config.membership;
-		for (const brokerId of this.enabledBrokerIds()) next = setExposed(next, brokerId, deviceId, exposed);
+	knownBrokerIds() {
+		return new Set([...this.config.knownBrokers.map((b) => b.id), ...this.enabledBrokerIds()]);
+	}
+	/**
+	* The brokers a `device-export` read answers over: the named instance, or
+	* (absent) every enabled broker. A broker this addon does not know is
+	* refused, never answered empty.
+	*/
+	brokerScope(instanceId) {
+		if (instanceId === void 0) return this.enabledBrokerIds();
+		if (!this.knownBrokerIds().has(instanceId)) throw new ExportInstanceUnknownError("provider-homeassistant", instanceId);
+		return [instanceId];
+	}
+	exposedDeviceRows(scope) {
+		return exposedDeviceIds(this.config.membership, scope).map((deviceId) => ({
+			deviceId,
+			exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+		}));
+	}
+	/**
+	* A cap-level expose/unexpose changes ONE broker's membership — the named
+	* instance. There is no write without a target and no "everywhere": the
+	* other brokers' membership is not touched.
+	*/
+	async setBrokerMembership(instanceId, deviceId, exposed) {
+		this.brokerScope(instanceId);
+		const next = setExposed(this.config.membership, instanceId, deviceId, exposed);
 		if (next === this.config.membership) {
 			this.ctx.logger.debug("ha-export: membership already in that state, nothing to do", {
 				tags: { deviceId: Number(deviceId) },
-				meta: { exposed }
+				meta: {
+					exposed,
+					brokerId: instanceId
+				}
 			});
 			return;
 		}
@@ -9555,7 +9846,7 @@ var HaExportAddon = class extends BaseAddon {
 			tags: { deviceId: Number(deviceId) },
 			meta: {
 				exposed,
-				brokers: this.enabledBrokerIds()
+				brokerId: instanceId
 			}
 		});
 		await this.reconcile(exposed ? "expose" : "unexpose");
@@ -9709,19 +10000,20 @@ var HaExportAddon = class extends BaseAddon {
 		await this.reconcile("device-panel");
 		return { success: true };
 	}
-	buildStatus() {
-		const enabled = this.enabledBrokerIds();
-		const healthy = [...this.links.values()].filter((link) => link.client.healthy).length;
-		const linkFailure = [...this.links.values()].map((link) => link.client.failure).filter((failure) => failure !== null)[0]?.text;
+	buildStatus(scope) {
+		const enabled = scope;
+		const links = [...this.links.entries()].filter(([brokerId]) => scope.includes(brokerId)).map(([, link]) => link);
+		const healthy = links.filter((link) => link.client.healthy).length;
+		const linkFailure = links.map((link) => link.client.failure).filter((failure) => failure !== null)[0]?.text;
 		return {
-			linkState: enabled.length === 0 ? "unlinked" : healthy === this.links.size ? "linked" : "error",
+			linkState: enabled.length === 0 ? "unlinked" : healthy === links.length ? "linked" : "error",
 			exposedDeviceCount: exposedDeviceIds(this.config.membership, enabled).length,
 			...linkFailure !== void 0 ? { error: linkFailure } : this.lastError !== void 0 ? { error: this.lastError } : {},
 			setup: {
 				fields: [
 					{
 						label: "Home Assistant instances",
-						value: `${healthy} / ${this.links.size} reachable`
+						value: `${healthy} / ${links.length} reachable`
 					},
 					{
 						label: "Last push failure",