@camstack/addon-provider-homeassistant 1.2.654 → 1.2.656

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as fanControlCapability, A as bestLocationMatch, At as scriptRunnerCapability, B as climateControlCapability, Bt as valveCapability, C as accessoriesCapability, Ct as quantityFromUnit, D as ambientLightSensorCapability, Dt as runningFromMediaPlayer, E as alarmPanelCapability, Et as runningFromLawnMower, F as buildAddonRouteProvider, Ft as temperatureSensorCapability, G as contactCapability, Gt as RecordSecretUnavailableError, H as connectivityCapability, Ht as waterHeaterCapability, I as buildDeviceAdminUrl, It as tryConvertDelta, J as deviceAdminLinkCapability, Jt as defineAddonMigrations, K as controlCapability, Kt as baseUnitOf, L as buttonCapability, Lt as tryConvertUnit, M as boardKeySourceCapability, Mt as smokeCapability, N as brightnessCapability, Nt as switchCapability, O as automationControlCapability, Ot as runningFromVacuumState, P as brokerCapability, Pt as tamperCapability, Q as eventEmitterCapability, R as calendarSourceCapability, Rt as updateCapability, S as TargetSchema, St as publicEndpointReaderFrom, T as airQualitySensorCapability, Ut as weatherCapability, V as colorCapability, Vt as vibrationCapability, Xt as defineRecordKinds, Y as deviceAdoptionCapability, Yt as defineEntryKind, Z as enumSensorCapability, Zt as entryBody, _t as preconditionOf, an as number, at as ingestReading, bt as pressureSensorCapability, c as BaseDevice, cn as string, ct as mediaPlayerCapability, dn as url, dt as notificationOutputCapability, en as _enum, et as floodCapability, fn as DeviceFeature, ft as notifierCapability, g as EnumSensorDateTimeFormatSchema, gn as EventCategory, gt as powerMeterCapability, hn as errMsg, ht as parseAdminBase, i as HA_BROKER_KIND, in as literal, it as imageCapability, j as binaryCapability, k as batteryCapability, kt as runningStateCapability, l as BaseDeviceProvider, ln as union, lt as motionCapability, mn as DeviceType, nn as boolean, nt as humidifierCapability, on as object, ot as lawnMowerControlCapability, pn as DeviceRole, pt as numericSensorCapability, q as coverCapability, qt as createEvent, rn as discriminatedUnion, rt as humiditySensorCapability, sn as record, st as lockControlCapability, t as haInstanceSettingsPortsOver, tn as array, tt as gasCapability, un as unknown, ut as normalizeUnit, vt as prepareNotification, w as addonRoutesCapability, wt as resolveAttachmentUrls, x as RUNNING_STATE_COLD, yt as presenceCapability, z as carbonMonoxideCapability, zt as vacuumControlCapability } from "./ha-instance-settings-g5pwb3Fi.mjs";
+import { $ as fanControlCapability, $t as createEvent, A as bestLocationMatch, At as runningFromMediaPlayer, B as climateControlCapability, Bt as tryConvertDelta, C as accessoriesCapability, Ct as pressureSensorCapability, D as ambientLightSensorCapability, Dt as resolveAttachmentUrls, E as alarmPanelCapability, Et as quantityFromUnit, F as buildAddonRouteProvider, Ft as smokeCapability, G as contactCapability, Gt as vibrationCapability, H as connectivityCapability, Ht as updateCapability, I as buildDeviceAdminUrl, J as deviceAdminLinkCapability, K as controlCapability, Kt as waterHeaterCapability, L as buttonCapability, Lt as switchCapability, M as boardKeySourceCapability, Mt as runningStateCapability, N as brightnessCapability, Nt as scriptRunnerCapability, O as automationControlCapability, P as brokerCapability, Q as eventEmitterCapability, Qt as baseUnitOf, R as calendarSourceCapability, Rt as tamperCapability, S as TargetSchema, Sn as EventCategory, St as presenceCapability, T as airQualitySensorCapability, Tt as publicEndpointReaderFrom, Ut as vacuumControlCapability, V as colorCapability, Vt as tryConvertUnit, Wt as valveCapability, Xt as RecordSecretUnavailableError, Y as deviceAdoptionCapability, Z as enumSensorCapability, _n as url, at as humiditySensorCapability, b as RUNNING_STATE_COLD, bn as DeviceType, bt as preconditionOf, cn as boolean, ct as integrationInstancesCapability, dn as number, dt as mediaPlayerCapability, en as defineAddonMigrations, et as flattenNestedRecords, fn as object, ft as motionCapability, gn as unknown, gt as numericSensorCapability, hn as union, ht as notifierCapability, it as humidifierCapability, j as binaryCapability, jt as runningFromVacuumState, k as batteryCapability, kt as runningFromLawnMower, ln as discriminatedUnion, lt as lawnMowerControlCapability, m as EnumSensorDateTimeFormatSchema, mn as string, mt as notificationOutputCapability, n as HA_BROKER_KIND, nn as defineRecordKinds, nt as floodCapability, o as BaseDevice, on as _enum, ot as imageCapability, pn as record, pt as normalizeUnit, q as coverCapability, qt as weatherCapability, rn as entryBody, rt as gasCapability, s as BaseDeviceProvider, sn as array, st as ingestReading, t as haInstanceSettingsPortsOver, tn as defineEntryKind, tt as flattenPortsOver, un as literal, ut as lockControlCapability, vn as DeviceFeature, vt as parseAdminBase, w as addonRoutesCapability, x as RecordIntegrationInstances, xn as errMsg, xt as prepareNotification, yn as DeviceRole, yt as powerMeterCapability, z as carbonMonoxideCapability, zt as temperatureSensorCapability } from "./ha-instance-settings-EQ5Ey3Q-.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-admin-link.ts
@@ -5764,22 +5764,16 @@ var TEST_HANDSHAKE_TIMEOUT_MS = 8e3;
 var HaBrokerEntrySchema = object({
 	id: string(),
 	name: string(),
-	/** Either Supervisor (token from env) or long-lived (persisted). */
-	auth: discriminatedUnion("kind", [object({
-		kind: literal("supervisor"),
-		supervisorToken: string().meta({ secret: true })
-	}), object({
-		kind: literal("long-lived"),
-		baseUrl: string(),
-		accessToken: string().meta({ secret: true })
-	})]),
-	/** Optional FK to the integration record that spawned this broker.
-	*  Populated when the wizard's "+ New Integration" flow created the
-	*  broker; null when the operator added it via the Settings panel
-	*  directly. Used by the integration listener to keep the broker
-	*  list in sync with the integrations table (cascade-delete on
-	*  integration removal). */
-	integrationId: string().optional()
+	/** Supervisor (token from env) or long-lived (persisted); picks which fields below are used. */
+	authKind: _enum(["long-lived", "supervisor"]),
+	/** Origin URL of the HA instance; long-lived only. */
+	baseUrl: string().optional(),
+	accessToken: string().optional().meta({ secret: true }),
+	supervisorToken: string().optional().meta({ secret: true }),
+	/** Optional FK to the integration record that spawned this broker. */
+	integrationId: string().optional(),
+	/** The instance's own switch (D996); absent means on. */
+	enabled: boolean().optional()
 });
 /**
 * Validates a `broker.add` `settings` payload for the HA kind. Accepts:
@@ -5804,6 +5798,34 @@ function settingsToAuth(settings) {
 		accessToken: parsed.accessToken
 	};
 }
+/** The flat entry fields of an auth config: the one place the two shapes meet. */
+function authToEntryFields(auth) {
+	return auth.kind === "supervisor" ? {
+		authKind: "supervisor",
+		supervisorToken: auth.supervisorToken
+	} : {
+		authKind: "long-lived",
+		baseUrl: auth.baseUrl,
+		accessToken: auth.accessToken
+	};
+}
+/** The auth config an entry stands for; null while the entry is not filled in. */
+function haAuthOf(entry) {
+	const parsed = HaAuthConfigSchema.safeParse(entry.authKind === "supervisor" ? {
+		kind: "supervisor",
+		supervisorToken: entry.supervisorToken ?? ""
+	} : {
+		kind: "long-lived",
+		baseUrl: entry.baseUrl ?? "",
+		accessToken: entry.accessToken ?? ""
+	});
+	return parsed.success ? parsed.data : null;
+}
+/** The flat settings payload (`settingsToAuth` shape) of an entry; null while it is not filled in. */
+function entryToSettings(entry) {
+	const auth = haAuthOf(entry);
+	return auth === null ? null : authToSettings(auth);
+}
 function authToSettings(auth) {
 	if (auth.kind === "supervisor") return { supervisorToken: auth.supervisorToken };
 	return {
@@ -5866,7 +5888,7 @@ var HaBrokerRegistry = class {
 	*  started concurrently; transient errors don't block bootstrap. */
 	async restore(entries) {
 		this.seedCounterFromEntries(entries);
-		await Promise.all(entries.map(async (entry) => {
+		await Promise.all(entries.filter((entry) => entry.enabled !== false && haAuthOf(entry) !== null).map(async (entry) => {
 			try {
 				await this.startManagerForEntry(entry);
 			} catch (err) {
@@ -5927,7 +5949,7 @@ var HaBrokerRegistry = class {
 		const entry = {
 			id: options.id !== void 0 ? this.adoptId(options.id) : this.allocateId(),
 			name,
-			auth,
+			...authToEntryFields(auth),
 			...options.integrationId !== void 0 ? { integrationId: options.integrationId } : {}
 		};
 		await this.startManagerForEntry(entry);
@@ -5948,7 +5970,7 @@ var HaBrokerRegistry = class {
 		return {
 			id,
 			name: existing.getInfo().name,
-			auth
+			...authToEntryFields(auth)
 		};
 	}
 	/**
@@ -6131,10 +6153,12 @@ var HaBrokerRegistry = class {
 			this.logger.debug("ha-broker already active — reusing existing connection", { meta: { brokerId: entry.id } });
 			return;
 		}
+		const auth = haAuthOf(entry);
+		if (auth === null) throw new Error(`ha-broker '${entry.id}' has no complete credentials`);
 		const manager = new HaIntegrationManager({
 			id: entry.id,
 			name: entry.name,
-			auth: entry.auth,
+			auth,
 			logger: this.logger,
 			eventBus: this.eventBus,
 			onConnected: (brokerId) => this.onBrokerConnected?.(brokerId),
@@ -7194,10 +7218,15 @@ function createHaIconRouteProvider() {
 var haBrokersEntryKind = defineEntryKind("brokers", {
 	title: "Home Assistant brokers",
 	schema: entryBody({
-		auth: HaBrokerEntrySchema.shape.auth,
-		integrationId: string().optional()
+		authKind: HaBrokerEntrySchema.shape.authKind,
+		baseUrl: HaBrokerEntrySchema.shape.baseUrl,
+		accessToken: HaBrokerEntrySchema.shape.accessToken,
+		supervisorToken: HaBrokerEntrySchema.shape.supervisorToken,
+		integrationId: HaBrokerEntrySchema.shape.integrationId,
+		enabled: HaBrokerEntrySchema.shape.enabled
 	}),
-	writeTrigger: "an operator adds, edits or removes a Home Assistant broker connection"
+	writeTrigger: "an operator adds, edits or removes a Home Assistant broker connection",
+	retiredSecretPaths: ["auth.accessToken", "auth.supervisorToken"]
 });
 var haRecordKinds = defineRecordKinds({ 
 /**
@@ -7719,8 +7748,12 @@ function rowToEntry(id, data) {
 	const parsed = HaBrokerEntrySchema.safeParse({
 		id,
 		name: data.name,
-		auth: data.auth,
-		integrationId: data.integrationId
+		authKind: data.authKind,
+		baseUrl: data.baseUrl,
+		accessToken: data.accessToken,
+		supervisorToken: data.supervisorToken,
+		integrationId: data.integrationId,
+		enabled: data.enabled
 	});
 	return parsed.success ? parsed.data : null;
 }
@@ -7759,10 +7792,9 @@ var HaBrokerStore = class HaBrokerStore {
 		}
 	}
 	async upsert(entry) {
-		const { id, name, auth, integrationId } = entry;
+		const { id, integrationId, ...fields } = entry;
 		const body = {
-			name,
-			auth,
+			...Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0)),
 			...integrationId === void 0 ? {} : { integrationId }
 		};
 		const parsed = haBrokersEntryKind.schema.safeParse(body);
@@ -7783,6 +7815,98 @@ var HaBrokerStore = class HaBrokerStore {
 	}
 };
 //#endregion
+//#region src/ha-instances.ts
+/**
+* The Home Assistant connections as `integration-instances` (planning#408 P3): one instance per
+* `brokers` record, over the SAME records and ids (`ha_NNN`) the `broker` cap serves. The body is
+* flat, so the form the instances page edits is the stored shape.
+*/
+var HA_INSTANCE_KIND = "home-assistant";
+function isHaBodyConfigured(body) {
+	return body.authKind === "supervisor" ? (body.supervisorToken ?? "").length > 0 : (body.baseUrl ?? "").length > 0 && (body.accessToken ?? "").length > 0;
+}
+function statusOf(info) {
+	if (info === null) return {
+		state: "unknown",
+		label: "Not connected"
+	};
+	if (info.status === "connected") return {
+		state: "ok",
+		label: "Connected"
+	};
+	if (info.status === "connecting") return {
+		state: "unknown",
+		label: "Connecting"
+	};
+	return {
+		state: "error",
+		label: info.status,
+		...info.error !== null ? { detail: info.error } : {}
+	};
+}
+function buildHaInstances(records, deps) {
+	return new RecordIntegrationInstances(records, haBrokersEntryKind, {
+		description: {
+			role: "both",
+			instanceMode: "multiple",
+			kind: "connection",
+			canTest: true,
+			kinds: [{
+				id: HA_INSTANCE_KIND,
+				label: "Home Assistant"
+			}],
+			allowRestoreId: true
+		},
+		formSchema: () => haBrokerSettingsSchema,
+		initialBody: (name) => ({
+			name,
+			authKind: "long-lived"
+		}),
+		mintId: () => deps.mintId(),
+		kindOf: () => HA_INSTANCE_KIND,
+		health: (_body, id) => {
+			const info = deps.infoOf(id);
+			return {
+				status: statusOf(info),
+				...info?.lastCheckedAt != null ? { lastCheckedAt: info.lastCheckedAt } : {}
+			};
+		},
+		configured: isHaBodyConfigured,
+		onChanged: deps.onChanged,
+		test: async ({ id, values }) => {
+			if (["accessToken", "supervisorToken"].some((key) => {
+				const v = values[key];
+				return typeof v === "string" && v.length > 0 && v !== "__camstack_redacted__";
+			})) {
+				const r = await deps.probe(values);
+				return r.ok ? {
+					success: true,
+					status: "validated",
+					...r.latencyMs !== void 0 ? { latencyMs: r.latencyMs } : {}
+				} : {
+					success: false,
+					status: "rejected",
+					error: r.error ?? "Home Assistant rejected the connection"
+				};
+			}
+			const info = id === null ? null : deps.infoOf(id);
+			if (info === null) return {
+				success: false,
+				status: "inconclusive",
+				error: "Not connected: save the connection first"
+			};
+			return info.status === "connected" ? {
+				success: true,
+				status: "validated"
+			} : {
+				success: false,
+				status: "rejected",
+				error: info.error ?? `status: ${info.status}`
+			};
+		}
+	});
+}
+//#endregion
 //#region src/ha-board-key-source.ts
 /**
 * `board-key-source` for Home Assistant: reads an ESPHome board's API
@@ -7956,6 +8080,38 @@ function createHaBoardKeyProvider(source) {
 	};
 }
 //#endregion
+//#region src/migrations/flatten-broker-records.ts
+/**
+* The Home Assistant broker records keep their connection flat (planning#408 P3): the nested
+* `auth` object (`{ kind, baseUrl, accessToken }` or `{ kind, supervisorToken }`) becomes the top
+* level `authKind`, `baseUrl`, `accessToken` and `supervisorToken`, under the SAME record id, so
+* the devices that carry `ha_NNN` keep their broker. The work is `flattenNestedRecords`: every
+* secret is read before anything is written, read back from its new keychain ref before the
+* nested object goes, and the old refs are deleted last.
+*/
+var FLATTEN_BROKER_RECORDS_ID = "provider-homeassistant/2026-11-04-flatten-broker-records";
+function text(value) {
+	return typeof value === "string" ? value : void 0;
+}
+async function flattenBrokerRecords(ports) {
+	return flattenNestedRecords(ports, {
+		legacyKey: "auth",
+		flatSecretKeys: ["accessToken", "supervisorToken"],
+		toFlat: (legacy) => {
+			const kind = legacy["kind"] === "supervisor" ? "supervisor" : "long-lived";
+			const baseUrl = text(legacy["baseUrl"]);
+			const accessToken = text(legacy["accessToken"]);
+			const supervisorToken = text(legacy["supervisorToken"]);
+			return {
+				authKind: kind,
+				...baseUrl !== void 0 ? { baseUrl } : {},
+				...accessToken !== void 0 ? { accessToken } : {},
+				...supervisorToken !== void 0 ? { supervisorToken } : {}
+			};
+		}
+	});
+}
+//#endregion
 //#region src/migrations/calendar-ids-to-integration.ts
 /**
 * The HA calendars an instance imports are a fact of THAT instance (D985): each Home Assistant
@@ -8045,37 +8201,56 @@ async function planDropSharedCalendarIds(ports) {
 //#endregion
 //#region src/migrations/index.ts
 /** The `provider-homeassistant` catalogue (D987): offered to the engine when the addon initialises. */
-var ADDON_MIGRATIONS = [{
-	meta: {
-		id: "provider-homeassistant/2026-11-03-calendar-ids-to-integration",
-		owner: "provider-homeassistant",
-		level: "addon-state",
-		seq: 1,
-		dependsOn: [],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "procedure",
-		description: "Copy the shared calendar set to the settings of every Home Assistant integration that has none",
-		fixtureMark: "the broker link stored beside the calendars of an integration"
+var ADDON_MIGRATIONS = [
+	{
+		meta: {
+			id: "provider-homeassistant/2026-11-03-calendar-ids-to-integration",
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 1,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "procedure",
+			description: "Copy the shared calendar set to the settings of every Home Assistant integration that has none",
+			fixtureMark: "the broker link stored beside the calendars of an integration"
+		},
+		procedure: copyCalendarIdsToIntegrations
 	},
-	procedure: copyCalendarIdsToIntegrations
-}, {
-	meta: {
-		id: "provider-homeassistant/2026-11-03-drop-shared-calendar-ids",
-		owner: "provider-homeassistant",
-		level: "addon-state",
-		seq: 2,
-		dependsOn: ["provider-homeassistant/2026-11-03-calendar-ids-to-integration"],
-		store: "settings",
-		scope: "cluster",
-		onFailure: "tolerate",
-		bodyKind: "plan",
-		description: "Delete the shared calendar set once every integration shows its own",
-		fixtureMark: "the shared set parked when an integration holds a different one"
+	{
+		meta: {
+			id: "provider-homeassistant/2026-11-03-drop-shared-calendar-ids",
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 2,
+			dependsOn: ["provider-homeassistant/2026-11-03-calendar-ids-to-integration"],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "tolerate",
+			bodyKind: "plan",
+			description: "Delete the shared calendar set once every integration shows its own",
+			fixtureMark: "the shared set parked when an integration holds a different one"
+		},
+		plan: planDropSharedCalendarIds
 	},
-	plan: planDropSharedCalendarIds
-}];
+	{
+		meta: {
+			id: FLATTEN_BROKER_RECORDS_ID,
+			owner: "provider-homeassistant",
+			level: "addon-state",
+			seq: 3,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Flatten the nested auth of every Home Assistant broker record under its own id, moving each token to a top-level keychain secret",
+			fixtureMark: "a non-secret field stored beside the auth of a broker record"
+		},
+		procedure: flattenBrokerRecords
+	}
+];
 //#endregion
 //#region src/ha-calendar-source.ts
 function isCalendarEntity(entityId) {
@@ -8689,10 +8864,7 @@ function planStandaloneReconcile(devices, freshById, brokerId) {
 var ADOPTION_FILTER_DEVICES = "devices";
 var ADOPTION_FILTER_ENTITIES = "entities";
 var HA_KIND = "home-assistant";
-var DEFAULT_CONFIG = {
-	brokers: [],
-	calendarIds: []
-};
+var DEFAULT_CONFIG = { calendarIds: [] };
 /**
 * Home Assistant provider addon.
 *
@@ -8739,6 +8911,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 	}
 	registry = null;
 	brokerStore = null;
+	instances = null;
 	/** Runtime broker rows (records when B2 is live, else settings). */
 	activeBrokers = [];
 	/** Periodic re-sync sweep handle (cleared on shutdown). */
@@ -8753,11 +8926,26 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 	constructor() {
 		super({ ...DEFAULT_CONFIG });
 	}
+	flattenPorts(records) {
+		if (this.ctx.secrets === void 0) throw new Error("provider-homeassistant: ctx.secrets is required");
+		return {
+			readStored: (key) => this.readStoredGlobalKey(key),
+			...haInstanceSettingsPortsOver(this.ctx.api.integrations),
+			...flattenPortsOver(records.kind(haBrokersEntryKind))
+		};
+	}
 	async onInitialize() {
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("provider-homeassistant: ctx.records is required (hub-only addon)");
 		await records.declare(haAllRecordKinds);
 		this.brokerStore = HaBrokerStore.of(records);
+		this.instances = buildHaInstances(records, {
+			mintId: () => this.requireRegistry().allocateId(),
+			infoOf: (id) => this.registry?.get(id) ?? null,
+			onChanged: (id) => this.syncBrokerRuntime(id),
+			probe: (settings) => this.requireRegistry().testSettings(settings)
+		});
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id === FLATTEN_BROKER_RECORDS_ID), this.flattenPorts(records)));
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new HaBrokerRegistry(this.ctx.logger, this.ctx.eventBus);
 		this.registry.setOnBrokerConnected((brokerId) => {
@@ -8774,10 +8962,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			this.reconcileAllConnectedBrokers();
 		}, HaProviderAddon.RESYNC_INTERVAL_MS);
 		this.ctx.logger.info("ha provider initialised", { meta: { brokerCount: this.activeBrokers.length } });
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, {
-			readStored: (key) => this.readStoredGlobalKey(key),
-			...haInstanceSettingsPortsOver(this.ctx.api.integrations)
-		}));
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS.filter((m) => m.meta.id !== FLATTEN_BROKER_RECORDS_ID), this.flattenPorts(records)));
 		await this.reconcileIntegrationsToBrokers();
 		this.subscribeIntegrationLifecycle();
 		return [
@@ -8785,6 +8970,10 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				capability: brokerCapability,
 				provider: this.buildBrokerProvider()
 			},
+			{
+				capability: integrationInstancesCapability,
+				provider: this.requireInstances().toProvider()
+			},
 			{
 				capability: deviceAdoptionCapability,
 				provider: this.buildAdoptionProvider()
@@ -9064,11 +9253,8 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 		for (const entry of persisted) {
 			if (entry.id && liveIds.has(entry.id)) {
 				try {
-					const settings = entry.auth.kind === "supervisor" ? { supervisorToken: entry.auth.supervisorToken } : {
-						baseUrl: entry.auth.baseUrl,
-						accessToken: entry.auth.accessToken
-					};
-					await reg.updateEntry(entry.id, settings);
+					const settings = entryToSettings(entry);
+					if (settings !== null) await reg.updateEntry(entry.id, settings);
 				} catch (err) {
 					this.ctx.logger.warn("ha onConfigChanged: updateEntry failed", { meta: {
 						brokerId: entry.id,
@@ -9078,10 +9264,8 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				continue;
 			}
 			try {
-				const settings = entry.auth.kind === "supervisor" ? { supervisorToken: entry.auth.supervisorToken } : {
-					baseUrl: entry.auth.baseUrl,
-					accessToken: entry.auth.accessToken
-				};
+				const settings = entryToSettings(entry);
+				if (settings === null) continue;
 				const created = await reg.createEntry(entry.name, settings);
 				if (created.id !== entry.id) {
 					const next = persisted.map((b) => b === entry ? {
@@ -9099,21 +9283,59 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 		}
 	}
 	async loadPersistedBrokers() {
-		const store = this.brokerStore;
-		if (store !== null) {
-			const fromRecords = await store.listResolved();
-			if (fromRecords.length > 0) return fromRecords;
+		return this.requireBrokerStore().listResolved();
+	}
+	requireInstances() {
+		if (this.instances === null) throw new Error("provider-homeassistant: instances not ready");
+		return this.instances;
+	}
+	/**
+	* After an instance changed (created, edited, switched, deleted) the runtime follows the record:
+	* a missing record removes the manager and its adopted devices, an off or unfilled one stops the
+	* manager but keeps the devices, a filled one starts or re-authenticates it.
+	*/
+	async syncBrokerRuntime(id) {
+		const reg = this.requireRegistry();
+		const entry = await this.requireBrokerStore().getById(id);
+		this.activeBrokers = await this.loadPersistedBrokers();
+		if (entry === null) {
+			await reg.removeEntry(id);
+			const deviceRegistry = this.ctx.kernel.deviceRegistry;
+			const devices = this.ctx.kernel.devices;
+			if (deviceRegistry && devices) await cascadeRemoveDevicesForBroker({
+				reg: deviceRegistry,
+				devices,
+				addonId: this.ctx.id,
+				brokerId: id,
+				logger: this.ctx.logger
+			});
+			return;
 		}
-		return this.config.brokers;
+		const settings = entry.enabled === false ? null : entryToSettings(entry);
+		if (settings === null) {
+			await reg.removeEntry(id);
+			return;
+		}
+		try {
+			if (reg.get(id) !== null) await reg.updateEntry(id, settings);
+			else await reg.createEntry(entry.name, settings, {
+				id,
+				...entry.integrationId !== void 0 ? { integrationId: entry.integrationId } : {}
+			});
+		} catch (err) {
+			this.ctx.logger.warn("ha instance: could not start the broker", { meta: {
+				brokerId: id,
+				error: errMsg(err)
+			} });
+		}
+	}
+	requireBrokerStore() {
+		if (this.brokerStore === null) throw new Error("provider-homeassistant: broker store not ready");
+		return this.brokerStore;
 	}
 	async persistBrokerEntries(entries) {
 		this.activeBrokers = [...entries];
-		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: entries });
+		await this.requireBrokerStore().replaceAll(entries);
 	}
 	buildBrokerProvider() {
 		const ownerAddonId = this.ctx.id;
@@ -9187,7 +9409,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			getSettings: async ({ id }) => {
 				const entry = this.activeBrokers.find((b) => b.id === id);
 				if (!entry) return null;
-				return authToSettings(entry.auth);
+				return entryToSettings(entry);
 			},
 			setSettings: async ({ id, settings }) => {
 				if (!owns(id)) return;
@@ -9198,7 +9420,7 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			getBrokerConfig: async ({ id }) => {
 				const entry = this.activeBrokers.find((b) => b.id === id);
 				if (!entry) return null;
-				return authToSettings(entry.auth);
+				return entryToSettings(entry);
 			},
 			getSettingsSchema: async ({ kind }) => {
 				if (kind !== HA_KIND) return null;