@camstack/addon-provider-homeassistant 1.2.655 → 1.2.657

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { $t as baseUnitOf, At as runExportedAction, Cn as EventCategory, E as addonRoutesCapability, Et as pruneDeletedEntities, G as consumableFormOf, It as sendToExportedTarget, K as consumableKindOf, L as buildAddonRouteProvider, Q as deviceExportCapability, Rt as statusInstanceOf, St as preconditionOf, Xt as BaseAddon, _ as ExportInstanceUnknownError, _n as unknown, an as isReadingQuantity, b as MediaPlayerRepeatSchema, cn as array, d as COCO_TO_MACRO, f as CameraSwitchIdSchema, h as ConsumableStatusSchema, hn as string, m as ConsumableItemSchema, n as listInstancesOrNothing, o as listHomeAssistantBrokers, on as nodePin, p as ConsumableFormSchema, pn as object, r as settingsByBroker, s as AlarmArmModeSchema, t as haInstanceSettingsPortsOver, tn as defineAddonMigrations, u as CAMERA_SWITCH_ORDER, v as FanDirectionSchema, x as PLUG_APPLIANCE_TYPES, y as HvacModeSchema, yt as oauthIntegrationCapability } from "../ha-instance-settings-DLDNOmgL.mjs";
+import { F as buildAddonRouteProvider, It as statusInstanceOf, Jt as BaseAddon, Ot as runExportedAction, Pt as sendToExportedTarget, Qt as baseUnitOf, Sn as EventCategory, U as consumableFormOf, W as consumableKindOf, X as deviceExportCapability, Zt as RevConflictError, _ as HvacModeSchema, _t as oauthIntegrationCapability, a as AlarmArmModeSchema, an as nodePin, bt as preconditionOf, c as CAMERA_SWITCH_ORDER, cn as boolean, d as ConsumableFormSchema, en as defineAddonMigrations, f as ConsumableItemSchema, fn as object, g as FanDirectionSchema, gn as unknown, h as ExportInstanceUnknownError, i as listHomeAssistantBrokers, in as isReadingQuantity, l as COCO_TO_MACRO, mn as string, on as _enum, p as ConsumableStatusSchema, sn as array, t as haInstanceSettingsPortsOver, tn as defineEntryKind, u as CameraSwitchIdSchema, v as MediaPlayerRepeatSchema, w as addonRoutesCapability, wt as pruneDeletedEntities, y as PLUG_APPLIANCE_TYPES } from "../ha-instance-settings-CxalgfRa.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 import "node:zlib";
 import "node:fs";
@@ -5028,133 +5028,6 @@ function verifyExpiringUrl(input) {
 	return timingSafeEqual(a, b);
 }
 //#endregion
-//#region src/ha-export/membership.ts
-function devicesForBroker(membership, brokerId) {
-	return membership[brokerId] ?? [];
-}
-function isExposed(membership, brokerId, deviceId) {
-	return devicesForBroker(membership, brokerId).includes(deviceId);
-}
-/** Every broker a device reaches. Drives the N switches in the panel. */
-function brokersExposing(membership, deviceId) {
-	return Object.keys(membership).filter((brokerId) => isExposed(membership, brokerId, deviceId)).sort();
-}
-/** Every device exported to at least one of the given brokers. */
-function exposedDeviceIds(membership, brokerIds) {
-	const ids = /* @__PURE__ */ new Set();
-	for (const brokerId of brokerIds) for (const deviceId of devicesForBroker(membership, brokerId)) ids.add(deviceId);
-	return [...ids].sort();
-}
-function setExposed(membership, brokerId, deviceId, exposed) {
-	const current = devicesForBroker(membership, brokerId);
-	if (exposed === current.includes(deviceId)) return membership;
-	const next = exposed ? [...current, deviceId].sort() : current.filter((id) => id !== deviceId);
-	return {
-		...membership,
-		[brokerId]: next
-	};
-}
-/**
-* Forget brokers that no longer exist.
-*
-* A removed HA instance must not keep a membership list that reappears if
-* a broker id is ever reused — and a stale key would also inflate
-* `exposedDeviceCount` with devices going nowhere.
-*/
-function pruneBrokers(membership, knownBrokerIds) {
-	const known = new Set(knownBrokerIds);
-	const kept = Object.keys(membership).filter((brokerId) => known.has(brokerId));
-	if (kept.length === Object.keys(membership).length) return membership;
-	const next = {};
-	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
-	return next;
-}
-/**
-* The brokers the operator has switched ON, read from the RAW addon store.
-*
-* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
-* hub happens to know about — so it can never appear in the addon's
-* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
-* present in the defaults ("the store can contain extra keys … without
-* polluting the typed config"), so every `exportTo:*` key is dropped on the
-* way into `this.config` and reading one there yields `undefined` for ever.
-*
-* That is not theoretical. On 2026-08-09 the switch was on
-* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
-* settings FORM reads the store) and every reconcile still logged
-* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
-* its "Not configured" card, and no operator action could have changed
-* either. The store is the single authority — read it, do not mirror it into
-* a typed field that would then be a second one (D62).
-*
-* A broker that is no longer known is not enabled, whatever the store says:
-* a stale `exportTo:` key for a deleted instance must not resurrect it.
-*
-* The switch is a setting of the INSTANCE (D985): `perBroker` carries each broker's integration
-* settings, and a broker whose integration has an `exportTo` answers from it. A broker whose
-* integration has none yet — the migration has not copied it — falls back to the legacy
-* `exportTo:<brokerId>` key, so the move never flips a switch mid-way.
-*/
-function enabledBrokerIds(store, knownBrokerIds, perBroker = NO_INSTANCE_SETTINGS) {
-	return knownBrokerIds.filter((brokerId) => {
-		const own = perBroker.get(brokerId)?.["exportTo"];
-		return typeof own === "boolean" ? own : store[`exportTo:${brokerId}`] === true;
-	});
-}
-var NO_INSTANCE_SETTINGS = /* @__PURE__ */ new Map();
-/** Same brokers, same order, same names — nothing for the form to re-render. */
-function sameBrokers(a, b) {
-	if (a.length !== b.length) return false;
-	return a.every((broker, index) => {
-		const other = b[index];
-		return other !== void 0 && other.id === broker.id && other.name === broker.name;
-	});
-}
-/**
-* What a broker refresh persists — and, above all, what it must NOT.
-*
-* **A patch never names a key it did not change.** That reads like tidiness
-* and is not: `updateGlobalSettings` is a read-modify-write over the addon
-* store, so naming `membership` writes whatever `this.config.membership`
-* currently holds — and `this.config` is not always the store.
-* `BaseAddon.resolveConfig` falls back to the CONSTRUCTOR DEFAULTS whenever
-* the settings read answers empty, and the kernel's `readAddonStore` answers
-* empty for a FAILED read exactly as it does for a missing one, silently. A
-* boot-window read that misses therefore gives the addon `membership: {}`,
-* and the first refresh that merely re-records `knownBrokers` hands that
-* empty object to the store as if the operator had unexported everything.
-*
-* That is not a hypothetical. On 2026-08-24 the hub restarted at 21:49; the
-* export runner came up while the cap resolver was still answering
-* "no provider registered" for hub-resident caps; at 21:55:13 a refresh
-* found `knownBrokers` stale (`[]` vs `[ha_001]`) and wrote BOTH keys. The
-* two exported cameras (104 hall, 101 front door) were erased from the
-* store, `devices` fell from 4 to 2 (the two synthetic devices), and Home
-* Assistant kept every camera entity as a restored/unavailable orphan for
-* three days: no stream ("the hub does not export this camera"), no
-* doorbell, no camera state. Nothing logged it, because from the store's
-* point of view the addon simply asked for `{}`.
-*
-* With the keys split, that pass writes `knownBrokers` alone, the
-* `resolveConfig` that follows the write re-reads a store that still holds
-* the membership, and the next reconcile exports both cameras again.
-*
-* Identity, not deep equality, decides `membership`: `pruneBrokers` returns
-* the SAME reference when it removed nothing, which is precisely the
-* "nothing changed" signal this needs.
-*
-* @returns the patch to persist, or `null` when there is nothing to write.
-*/
-function brokerRefreshPatch(current, next) {
-	const brokersChanged = !sameBrokers(next.knownBrokers, current.knownBrokers);
-	const membershipChanged = next.membership !== current.membership;
-	if (!brokersChanged && !membershipChanged) return null;
-	return {
-		...brokersChanged ? { knownBrokers: next.knownBrokers } : {},
-		...membershipChanged ? { membership: next.membership } : {}
-	};
-}
-//#endregion
 //#region src/ha-export/media-url.ts
 /**
 * Signed, expiring media links.
@@ -5181,19 +5054,6 @@ function brokerRefreshPatch(current, next) {
 */
 /** The hub address roles a Home Assistant media link may be minted on. */
 var HA_MEDIA_ROLES = ["internal", "publicEndpoint"];
-/** The settings key that carries one broker's media role (per-instance, like `exportTo:`). */
-function mediaRoleKey(brokerId) {
-	return `mediaRole:${brokerId}`;
-}
-/**
-* A broker's chosen role; anything stored that is not a known role is `internal`. The role is a
-* setting of the INSTANCE (D985): the integration's `mediaRole` answers when it has one, and a
-* broker the migration has not reached falls back to the legacy `mediaRole:<brokerId>` key.
-*/
-function haMediaRoleOf(store, brokerId, perBroker = NO_INSTANCE_SETTINGS) {
-	const own = perBroker.get(brokerId)?.["mediaRole"];
-	return (own !== void 0 ? own : store[mediaRoleKey(brokerId)]) === "publicEndpoint" ? "publicEndpoint" : "internal";
-}
 /**
 * The base a media link is minted on: the hub's role (D734) — `internal` unless the
 * broker chose `publicEndpoint`. Ranked by `local-network`, never loopback (`null`
@@ -5204,8 +5064,8 @@ function haMediaBaseUrl(book, role = "internal") {
 	return book.roles[role].resolved;
 }
 /** brokerId → media base, each broker on ITS role. Pure: the caller reads the palette per use. */
-function mediaBasesByBroker(store, brokerIds, book, perBroker = NO_INSTANCE_SETTINGS) {
-	return new Map(brokerIds.map((brokerId) => [brokerId, haMediaBaseUrl(book, haMediaRoleOf(store, brokerId, perBroker))]));
+function mediaBasesByBroker(brokerIds, book, roleOf) {
+	return new Map(brokerIds.map((brokerId) => [brokerId, haMediaBaseUrl(book, roleOf(brokerId))]));
 }
 /** How long a minted link stays valid. Long enough for HA to render it. */
 var MEDIA_URL_TTL_MS = 360 * 60 * 1e3;
@@ -5336,7 +5196,139 @@ async function planDropPerBrokerFlags(ports) {
 	}] };
 }
 //#endregion
+//#region src/ha-export/migrations/links-to-record.ts
+/**
+* What the export carries to a Home Assistant instance moves into the instance's
+* `ha-export-links` record (planning#408 P4). Two migrations, both `block-owner`: the addon must
+* not serve a membership it cannot trust (an empty list unexposes every device on the next
+* reconcile), and after them nothing reads the old shape.
+*
+* The old shape, per broker: the `membership` setting (device ids), and the two flags, each kept
+* on the instance's integration (`exportTo`, `mediaRole`) or, for a broker the 2026-11-03
+* migration had not reached, in the dynamic addon keys `exportTo:<brokerId>` /
+* `mediaRole:<brokerId>`. The integration's value won over the key; so it does here.
+*
+*  1. `moveLinksToRecords` (procedure): one record per broker, id = broker id, written with
+*     `ifRev: 0` (an existing record is never overwritten), then read BACK and compared; a
+*     mismatch throws and nothing is deleted.
+*  2. `planDropMovedLinks` (plan): the addon keys are deleted only while every record holds what
+*     they carry; a missing or short record refuses, a read that fails leaves them in place. The
+*     `exportTo` / `mediaRole` values on the integrations are the provider's instance data and
+*     are not touched here; nothing in this addon reads them any more.
+*/
+var MEMBERSHIP_KEY = "membership";
+var EXPORT_PREFIX = "exportTo:";
+var ROLE_PREFIX = "mediaRole:";
+var roleOf = (value) => HA_MEDIA_ROLES.find((role) => role === value);
+function membershipOf$1(value) {
+	const out = /* @__PURE__ */ new Map();
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return out;
+	for (const [brokerId, devices] of Object.entries(value)) {
+		if (!Array.isArray(devices)) continue;
+		out.set(brokerId, devices.filter((device) => typeof device === "string"));
+	}
+	return out;
+}
+function integrationByBroker(rows, warn) {
+	const out = /* @__PURE__ */ new Map();
+	for (const row of [...rows].sort((a, b) => a.integrationId.localeCompare(b.integrationId))) {
+		if (row.brokerId === null) continue;
+		if (out.has(row.brokerId)) {
+			warn(`homeassistant-export: integrations ${out.get(row.brokerId)?.integrationId} and ${row.integrationId} both link broker ${row.brokerId}; the first one answers`);
+			continue;
+		}
+		out.set(row.brokerId, row);
+	}
+	return out;
+}
+/** Every broker the old shape has something for, with the value the old reader would have used. */
+function legacyLinks(stored, rows, warn) {
+	const membership = membershipOf$1(stored[MEMBERSHIP_KEY]);
+	const integrations = integrationByBroker(rows, warn);
+	const brokers = new Set(membership.keys());
+	for (const key of Object.keys(stored)) for (const prefix of [EXPORT_PREFIX, ROLE_PREFIX]) if (key.startsWith(prefix) && key.length > prefix.length) brokers.add(key.slice(prefix.length));
+	for (const [brokerId, row] of integrations) if ("exportTo" in row.settings || "mediaRole" in row.settings) brokers.add(brokerId);
+	return [...brokers].sort().map((brokerId) => {
+		const own = integrations.get(brokerId)?.settings;
+		const ownExport = own?.["exportTo"];
+		const ownRole = own?.["mediaRole"];
+		return {
+			brokerId,
+			exportTo: typeof ownExport === "boolean" ? ownExport : stored[`${EXPORT_PREFIX}${brokerId}`] === true,
+			mediaRole: roleOf(ownRole !== void 0 ? ownRole : stored[`${ROLE_PREFIX}${brokerId}`]) ?? "internal",
+			devices: membership.get(brokerId) ?? []
+		};
+	});
+}
+/** The addon keys the old shape lives in. */
+function legacyKeys(stored) {
+	return Object.keys(stored).filter((key) => key === "membership" || key.startsWith(EXPORT_PREFIX) && key.length > 9 || key.startsWith(ROLE_PREFIX) && key.length > 10);
+}
+var sameDevices = (a, b) => a.length === b.length && a.every((device, index) => device === b[index]);
+async function moveLinksToRecords(ports) {
+	const links = legacyLinks(await ports.readStored(), await ports.listInstances(), ports.warn);
+	if (links.length === 0) return {
+		outcome: "already-done",
+		summary: { moved: 0 }
+	};
+	const created = [];
+	for (const link of links) {
+		const body = {
+			name: link.brokerId,
+			exportTo: link.exportTo,
+			mediaRole: link.mediaRole,
+			devices: link.devices
+		};
+		if (await ports.putLinks(link.brokerId, body) === "created") created.push(link);
+	}
+	if (created.length === 0) return {
+		outcome: "already-done",
+		summary: { moved: 0 }
+	};
+	const held = await ports.readLinks();
+	for (const link of created) {
+		const row = held.get(link.brokerId);
+		if (row === void 0 || row.exportTo !== link.exportTo || row.mediaRole !== link.mediaRole || !sameDevices(row.devices, link.devices)) throw new Error(`the export-links record of ${link.brokerId} does not match the legacy settings; nothing was cleared`);
+	}
+	return {
+		outcome: "done",
+		summary: {
+			moved: created.length,
+			devices: created.reduce((sum, link) => sum + link.devices.length, 0)
+		}
+	};
+}
+var rowId = (key) => `${HA_EXPORT_ADDON_ID}.${key}`;
+async function planDropMovedLinks(ports) {
+	const stored = await ports.readStored();
+	const present = legacyKeys(stored);
+	if (present.length === 0) return { edits: [] };
+	const refuse = (reason) => {
+		ports.warn(`homeassistant-export: the legacy export keys are kept: ${reason}`);
+		throw new Error(`the legacy export keys are not deleted: ${reason}`);
+	};
+	const links = legacyLinks(stored, await ports.listInstances(), ports.warn);
+	const held = await ports.readLinks();
+	for (const link of links) {
+		const row = held.get(link.brokerId);
+		if (row === void 0) return refuse(`no export-links record exists for ${link.brokerId}`);
+		for (const device of link.devices) if (!row.devices.includes(device)) return refuse(`the record of ${link.brokerId} lacks the device ${device}`);
+		if (row.exportTo !== link.exportTo || row.mediaRole !== link.mediaRole) return refuse(`the record of ${link.brokerId} disagrees on the switch or the address role`);
+	}
+	return { edits: [{
+		op: "deleteKeys",
+		scope: ADDON_SETTINGS_TABLE,
+		keys: present.map(rowId),
+		precondition: preconditionOf(Object.fromEntries(present.map((key) => [rowId(key), {
+			addonId: HA_EXPORT_ADDON_ID,
+			key,
+			value: stored[key]
+		}])))
+	}] };
+}
+//#endregion
 //#region src/ha-export/migrations/index.ts
+var LINKS_TO_RECORD_ID = "homeassistant-export/2026-11-04-links-to-record";
 /** The `homeassistant-export` catalogue (D987): offered to the engine when the addon initialises. */
 var ADDON_MIGRATIONS = [
 	{
@@ -5386,51 +5378,249 @@ var ADDON_MIGRATIONS = [
 			fixtureMark: "a legacy flag parked when the integration holds a different one"
 		},
 		plan: planDropPerBrokerFlags
+	},
+	{
+		meta: {
+			id: LINKS_TO_RECORD_ID,
+			owner: "homeassistant-export",
+			level: "addon-state",
+			seq: 4,
+			dependsOn: [],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "procedure",
+			description: "Move each instance export switch, media role and exported devices into its ha-export-links record; the record is read back before anything is deleted",
+			fixtureMark: "the reconcile interval the migration does not know"
+		},
+		procedure: moveLinksToRecords
+	},
+	{
+		meta: {
+			id: "homeassistant-export/2026-11-04-drop-moved-links",
+			owner: "homeassistant-export",
+			level: "addon-state",
+			seq: 5,
+			dependsOn: [LINKS_TO_RECORD_ID],
+			store: "settings",
+			scope: "cluster",
+			onFailure: "block-owner",
+			bodyKind: "plan",
+			description: "Delete the membership, exportTo and mediaRole keys once the records hold what they carried",
+			fixtureMark: "the reconcile interval the migration does not know"
+		},
+		plan: planDropMovedLinks
 	}
 ];
-//#endregion
-//#region src/ha-export/instance-flags.ts
-var exportKey = (brokerId) => `exportTo:${brokerId}`;
-var KEYS = [{
-	flag: "exportTo",
-	keyOf: exportKey
-}, {
-	flag: "mediaRole",
-	keyOf: mediaRoleKey
-}];
-function splitInstanceKeys(patch, instances) {
-	const claimed = /* @__PURE__ */ new Set();
-	const toInstances = /* @__PURE__ */ new Map();
-	for (const row of instances) {
-		if (row.brokerId === null) continue;
-		for (const { flag, keyOf } of KEYS) {
-			const key = keyOf(row.brokerId);
-			if (!(key in patch)) continue;
-			claimed.add(key);
-			toInstances.set(row.integrationId, {
-				...toInstances.get(row.integrationId),
-				[flag]: patch[key]
+var haExportLinksKind = defineEntryKind("ha-export-links", {
+	title: "Home Assistant export links",
+	nameField: "name",
+	schema: object({
+		name: string().min(1),
+		exportTo: boolean(),
+		mediaRole: _enum(HA_MEDIA_ROLES),
+		devices: array(string())
+	}),
+	writeTrigger: "an operator switches the export of a Home Assistant instance, picks its image-link address, or exports a device to it"
+});
+/** A link the operator has not touched: off, on the internal address, no device. */
+function defaultLinks(name) {
+	return {
+		name,
+		exportTo: false,
+		mediaRole: "internal",
+		devices: []
+	};
+}
+/** Every record of the kind, once; a failed read throws (the caller must not serve "nothing"). */
+async function readAllLinks(handle) {
+	const rows = /* @__PURE__ */ new Map();
+	let cursor;
+	do {
+		const page = await handle.query({
+			limit: 1e3,
+			...cursor === void 0 ? {} : { cursor }
+		});
+		for (const row of page.records) rows.set(row.id, row.data);
+		cursor = page.nextCursor ?? void 0;
+	} while (cursor !== void 0);
+	return rows;
+}
+function membershipOf(rows) {
+	const out = {};
+	for (const [brokerId, row] of rows) if (row.devices.length > 0) out[brokerId] = row.devices;
+	return out;
+}
+/**
+* The in-memory copy of the records. This addon is their only writer, so the copy is the
+* synchronous read the event path needs; a write lands in the record first and in the copy
+* after it. `membership()` keeps its identity until a device list changes.
+*/
+var ExportLinks = class ExportLinks {
+	handle;
+	rows;
+	memberships;
+	constructor(handle, rows) {
+		this.handle = handle;
+		this.rows = rows;
+		this.memberships = membershipOf(rows);
+	}
+	static async load(handle) {
+		return new ExportLinks(handle, await readAllLinks(handle));
+	}
+	isEnabled(brokerId) {
+		return this.rows.get(brokerId)?.exportTo === true;
+	}
+	mediaRole(brokerId) {
+		return this.rows.get(brokerId)?.mediaRole ?? "internal";
+	}
+	/** brokerId → exported device ids, for the brokers that export at least one. */
+	membership() {
+		return this.memberships;
+	}
+	brokerIds() {
+		return [...this.rows.keys()];
+	}
+	/** Change the switch and / or the role of one instance; creates the record on first use. */
+	async setFlags(brokerId, name, patch) {
+		const current = this.rows.get(brokerId) ?? defaultLinks(name);
+		const next = {
+			...current,
+			exportTo: patch.exportTo ?? current.exportTo,
+			mediaRole: patch.mediaRole ?? current.mediaRole
+		};
+		if (this.rows.has(brokerId) && sameLinks(current, next)) return;
+		await this.write(brokerId, next);
+	}
+	/** Persist the device lists that differ from the held ones; returns nothing to do as a no-op. */
+	async setMembership(next, nameOf) {
+		for (const brokerId of new Set([...Object.keys(next), ...Object.keys(this.memberships)])) {
+			const devices = next[brokerId] ?? [];
+			const current = this.rows.get(brokerId);
+			if (sameList(current?.devices ?? [], devices)) continue;
+			await this.write(brokerId, {
+				...current ?? defaultLinks(nameOf(brokerId)),
+				devices: [...devices]
 			});
 		}
 	}
-	return {
-		toInstances,
-		rest: Object.fromEntries(Object.entries(patch).filter(([key]) => !claimed.has(key)))
-	};
+	/** Forget the instances that no longer exist; returns the ids it removed. */
+	async prune(knownBrokerIds) {
+		const known = new Set(knownBrokerIds);
+		const gone = [...this.rows.keys()].filter((id) => !known.has(id));
+		for (const id of gone) await this.handle.delete(id);
+		if (gone.length > 0) this.adopt(new Map([...this.rows].filter(([id]) => known.has(id))));
+		return gone;
+	}
+	async write(brokerId, body) {
+		await this.handle.put({
+			id: brokerId,
+			data: body
+		});
+		this.adopt(new Map(this.rows).set(brokerId, body));
+	}
+	adopt(rows) {
+		const devicesChanged = [...new Set([...rows.keys(), ...this.rows.keys()])].some((id) => !sameList(rows.get(id)?.devices ?? [], this.rows.get(id)?.devices ?? []));
+		this.rows = rows;
+		if (devicesChanged) this.memberships = membershipOf(rows);
+	}
+};
+function sameList(a, b) {
+	return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+function sameLinks(a, b) {
+	return a.exportTo === b.exportTo && a.mediaRole === b.mediaRole && sameList(a.devices, b.devices);
+}
+/**
+* The settings form names an instance's two facts as the dynamic keys `exportTo:<brokerId>` and
+* `mediaRole:<brokerId>`. They are form fields, not stored keys: a read overlays them from the
+* records and a write is routed to the record of the broker they name.
+*/
+var exportToFormKey = (brokerId) => `exportTo:${brokerId}`;
+var mediaRoleFormKey = (brokerId) => `mediaRole:${brokerId}`;
+function parseLinkFormKey(key) {
+	for (const flag of ["exportTo", "mediaRole"]) {
+		const prefix = `${flag}:`;
+		if (key.startsWith(prefix) && key.length > prefix.length) return {
+			flag,
+			brokerId: key.slice(prefix.length)
+		};
+	}
+	return null;
 }
 /** The form's dynamic keys carrying each instance's own value. */
-function instanceOverlay(instances) {
+function linkFormOverlay(links) {
 	const overlay = {};
-	for (const row of instances) {
-		if (row.brokerId === null) continue;
-		for (const { flag, keyOf } of KEYS) {
-			const value = row.settings[flag];
-			if (value !== void 0) overlay[keyOf(row.brokerId)] = value;
-		}
+	for (const brokerId of links.brokerIds()) {
+		overlay[exportToFormKey(brokerId)] = links.isEnabled(brokerId);
+		overlay[mediaRoleFormKey(brokerId)] = links.mediaRole(brokerId);
 	}
 	return overlay;
 }
 //#endregion
+//#region src/ha-export/migrations/bind-ports.ts
+/**
+* Binds the `homeassistant-export` catalogue to the addon's stores: the settings, the hub's
+* `integrations` capability (the old home of the two flags, read by the migrations only) and the
+* `ha-export-links` kind.
+*/
+function haExportMigrationPorts(deps) {
+	return {
+		readStored: deps.readStored,
+		...haInstanceSettingsPortsOver(deps.api.integrations),
+		warn: deps.warn,
+		putLinks: async (brokerId, body) => {
+			if (await deps.links.get(brokerId) !== null) return "exists";
+			try {
+				await deps.links.put({
+					id: brokerId,
+					data: body
+				}, { ifRev: 0 });
+			} catch (err) {
+				if (err instanceof RevConflictError) return "exists";
+				throw err;
+			}
+			return "created";
+		},
+		readLinks: () => readAllLinks(deps.links)
+	};
+}
+//#endregion
+//#region src/ha-export/membership.ts
+function devicesForBroker(membership, brokerId) {
+	return membership[brokerId] ?? [];
+}
+function isExposed(membership, brokerId, deviceId) {
+	return devicesForBroker(membership, brokerId).includes(deviceId);
+}
+/** Every broker a device reaches. Drives the N switches in the panel. */
+function brokersExposing(membership, deviceId) {
+	return Object.keys(membership).filter((brokerId) => isExposed(membership, brokerId, deviceId)).sort();
+}
+/** Every device exported to at least one of the given brokers. */
+function exposedDeviceIds(membership, brokerIds) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const brokerId of brokerIds) for (const deviceId of devicesForBroker(membership, brokerId)) ids.add(deviceId);
+	return [...ids].sort();
+}
+function setExposed(membership, brokerId, deviceId, exposed) {
+	const current = devicesForBroker(membership, brokerId);
+	if (exposed === current.includes(deviceId)) return membership;
+	const next = exposed ? [...current, deviceId].sort() : current.filter((id) => id !== deviceId);
+	return {
+		...membership,
+		[brokerId]: next
+	};
+}
+/** Same brokers, same order, same names — nothing for the form to re-render. */
+function sameBrokers(a, b) {
+	if (a.length !== b.length) return false;
+	return a.every((broker, index) => {
+		const other = b[index];
+		return other !== void 0 && other.id === broker.id && other.name === broker.name;
+	});
+}
+//#endregion
 //#region src/ha-export/node-reads.ts
 var UNREAD = {
 	footageUsedBytes: null,
@@ -7485,7 +7675,6 @@ var PTZ_MOVE_BY_DIRECTION = {
 };
 var DEFAULT_CONFIG = {
 	reconcileIntervalSec: 300,
-	membership: {},
 	knownBrokers: [],
 	exportedEntities: {
 		actions: [],
@@ -7598,10 +7787,17 @@ var HaExportAddon = class extends BaseAddon {
 		super({ ...DEFAULT_CONFIG });
 	}
 	async onInitialize() {
-		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, {
+		const records = this.ctx.records;
+		if (records === void 0) throw new Error("ha-export: records are not available");
+		await records.declare({ "ha-export-links": haExportLinksKind });
+		const linksHandle = records.kind(haExportLinksKind);
+		await this.runMigrations(defineAddonMigrations(ADDON_MIGRATIONS, haExportMigrationPorts({
 			readStored: async () => this.resolveGlobalStore(),
-			...this.instancePorts()
-		}));
+			api: this.ctx.api,
+			links: linksHandle,
+			warn: (message) => this.ctx.logger.warn(message)
+		})));
+		this.linkBook = await ExportLinks.load(linksHandle);
 		const secret = this.state("haExportMediaSecret", string(), "");
 		const existing = await secret.get();
 		if (existing.length === 0) {
@@ -7701,29 +7897,43 @@ var HaExportAddon = class extends BaseAddon {
 		];
 	}
 	/**
-	* The form of the addon shows each instance's own switch and media role: the values sit on its
-	* integration (D985), overlaid on the legacy keys the store may still hold.
+	* The form of the addon shows each instance's own switch and media role. They are not settings
+	* of this addon: the values come from the instance's `ha-export-links` record.
 	*/
 	async getGlobalSettings(overlay, cap, nodeId) {
-		const rows = await listInstancesOrNothing(this.instancePorts(), (error) => this.ctx.logger.warn("ha-export: the instance settings could not be read for the form", { meta: { error } }));
 		return super.getGlobalSettings({
 			...overlay,
-			...instanceOverlay(rows)
+			...linkFormOverlay(this.book())
 		}, cap, nodeId);
 	}
 	/**
-	* An operator write: the `exportTo:` / `mediaRole:` keys go to the integration of their broker
-	* (D985), everything else to the addon store as before. A key whose broker has no integration
-	* stays in the store.
+	* An operator write: the `exportTo:` / `mediaRole:` keys go to the record of their broker,
+	* everything else to the addon store as before. A key naming a broker this addon does not know
+	* is refused, never parked.
 	*/
 	async updateGlobalSettingsAsOperator(patch, nodeId) {
-		const ports = this.instancePorts();
-		const { toInstances, rest } = splitInstanceKeys(patch, await ports.listInstances());
-		for (const [integrationId, flags] of toInstances) {
-			if (await ports.patchInstanceSettings(integrationId, flags)) continue;
-			throw new Error(`ha-export: integration ${integrationId} is gone — the setting was not saved`);
+		const rest = {};
+		const flags = /* @__PURE__ */ new Map();
+		for (const [key, value] of Object.entries(patch)) {
+			const field = parseLinkFormKey(key);
+			if (field === null) {
+				rest[key] = value;
+				continue;
+			}
+			this.brokerScope(field.brokerId);
+			const entry = flags.get(field.brokerId) ?? {};
+			if (field.flag === "exportTo") {
+				if (typeof value !== "boolean") throw new Error(`ha-export: ${key} must be true or false`);
+				entry.exportTo = value;
+			} else {
+				const role = HA_MEDIA_ROLES.find((candidate) => candidate === value);
+				if (role === void 0) throw new Error(`ha-export: ${key} is not a known address role`);
+				entry.mediaRole = role;
+			}
+			flags.set(field.brokerId, entry);
 		}
-		if (Object.keys(rest).length > 0 || toInstances.size === 0) {
+		for (const [brokerId, change] of flags) await this.book().setFlags(brokerId, this.brokerName(brokerId), change);
+		if (Object.keys(rest).length > 0 || flags.size === 0) {
 			await super.updateGlobalSettingsAsOperator(rest, nodeId);
 			return;
 		}
@@ -8235,7 +8445,7 @@ var HaExportAddon = class extends BaseAddon {
 			* asking per camera would be the fan-out this repo just finished
 			* removing from a 300 s poll.
 			*/
-			const exposedIds = exposedDeviceIds(this.config.membership, enabled);
+			const exposedIds = exposedDeviceIds(this.membership(), enabled);
 			const cameraDeviceIds = [];
 			for (const idStr of exposedIds) {
 				const numericId = Number(idStr);
@@ -8256,7 +8466,7 @@ var HaExportAddon = class extends BaseAddon {
 			const allCaps = /* @__PURE__ */ new Set();
 			const exportedDeviceLog = [];
 			let entityCount = 0;
-			for (const deviceIdStr of exposedDeviceIds(this.config.membership, enabled)) {
+			for (const deviceIdStr of exposedDeviceIds(this.membership(), enabled)) {
 				const numericId = Number(deviceIdStr);
 				if (!Number.isFinite(numericId)) {
 					this.ctx.logger.warn("ha-export: membership holds a non-numeric device id, skipping", { meta: { deviceId: deviceIdStr } });
@@ -8301,7 +8511,7 @@ var HaExportAddon = class extends BaseAddon {
 				const catalogDevice = built.device;
 				if (catalogDevice === null) continue;
 				for (const cap of catalogDevice.boundCaps) allCaps.add(cap);
-				const brokerIds = brokersExposing(this.config.membership, deviceIdStr).filter((id) => enabled.includes(id));
+				const brokerIds = brokersExposing(this.membership(), deviceIdStr).filter((id) => enabled.includes(id));
 				/**
 				* The plan is built ONCE and announced to every broker that
 				* receives the device, so it can only use platforms ALL of them
@@ -9192,27 +9402,19 @@ var HaExportAddon = class extends BaseAddon {
 		* is pruned on the next pass that returns a NON-empty list without it,
 		* which costs one interval and cannot cost the operator their config.
 		*/
-		const pruned = haBrokers.length === 0 ? this.config.membership : pruneBrokers(this.config.membership, haBrokers.map((broker) => broker.id));
-		if (haBrokers.length === 0 && Object.keys(this.config.membership).length > 0) this.ctx.logger.warn("ha-export: no Home Assistant broker answered — keeping the export membership rather than pruning it", { meta: { brokers: Object.keys(this.config.membership) } });
+		if (haBrokers.length === 0) {
+			if (this.book().brokerIds().length > 0) this.ctx.logger.warn("ha-export: no Home Assistant broker answered — keeping the export links rather than pruning them", { meta: { brokers: this.book().brokerIds() } });
+		} else {
+			const gone = await this.book().prune(haBrokers.map((broker) => broker.id));
+			if (gone.length > 0) this.ctx.logger.info("ha-export: forgot the export links of removed instances", { meta: { brokers: gone } });
+		}
 		/**
-		* ONE key per thing that actually changed — see `brokerRefreshPatch`.
-		*
-		* This used to write `knownBrokers` and `membership` together whenever
-		* EITHER differed. A boot-window settings read that answers empty leaves
-		* `this.config` on its constructor defaults, and that joint write then
-		* persisted `membership: {}` over the operator's real export list on a
-		* pass whose only news was the broker roster. It cost this hub three days
-		* of Home Assistant: 2026-08-24 21:55:13.
+		* Only the roster is a setting; the membership is not, so a boot-window read that answers
+		* empty can no longer erase it (2026-08-24: a refresh wrote `membership: {}` over the
+		* operator's export list). The records are read at boot and a failed read stops it.
 		*/
-		const patch = brokerRefreshPatch({
-			knownBrokers: this.config.knownBrokers,
-			membership: this.config.membership
-		}, {
-			knownBrokers: known,
-			membership: pruned
-		});
-		if (patch !== null) await this.updateGlobalSettings(patch);
-		await this.refreshEnabledBrokers(known);
+		if (!sameBrokers(known, this.config.knownBrokers)) await this.updateGlobalSettings({ knownBrokers: known });
+		this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -9358,30 +9560,27 @@ var HaExportAddon = class extends BaseAddon {
 	/**
 	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
 	*
-	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
-	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
-	* it is `undefined` there for ever — see `enabledBrokerIds` in
-	* `membership.ts` for what that cost. The store is the authority; this is a
-	* read-through cache of it, refreshed at the top of every reconcile pass and
-	* before the per-device panel renders, never written to.
+	* NOT read from `this.config`: the switch is a fact of the instance's `ha-export-links`
+	* record, and this is a read-through cache of it, refreshed at the top of every reconcile pass
+	* and before the per-device panel renders, never written to.
 	*/
 	enabled = [];
-	async refreshEnabledBrokers(known) {
-		const store = await this.resolveGlobalStore();
-		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id), await this.readInstanceSettings());
+	/** The `ha-export-links` records, loaded at boot after the migrations. */
+	linkBook = null;
+	book() {
+		if (this.linkBook === null) throw new Error("ha-export: the export links are not loaded yet");
+		return this.linkBook;
 	}
-	/** The hub's `integrations` capability, as the one reader and writer of an instance's settings. */
-	instancePorts() {
-		return haInstanceSettingsPortsOver(this.ctx.api.integrations);
+	/** brokerId → exported device ids, from the records. */
+	membership() {
+		return this.book().membership();
 	}
-	/**
-	* Each broker's integration settings (D985): the switch and the media role of an instance.
-	* A read that fails answers nothing, so every broker falls back to its legacy key and the
-	* failure is logged — never read as "everything off".
-	*/
-	async readInstanceSettings() {
-		const rows = await listInstancesOrNothing(this.instancePorts(), (error) => this.ctx.logger.warn("ha-export: the instance settings could not be read — the legacy per-broker keys answer", { meta: { error } }));
-		return rows.length === 0 ? NO_INSTANCE_SETTINGS : settingsByBroker(rows);
+	/** Persist a membership change: each instance's record first, the in-memory copy after it. */
+	async persistMembership(next) {
+		await this.book().setMembership(next, (brokerId) => this.brokerName(brokerId));
+	}
+	refreshEnabledBrokers(known) {
+		this.enabled = known.map((broker) => broker.id).filter((id) => this.book().isEnabled(id));
 	}
 	enabledBrokerIds() {
 		return this.enabled;
@@ -9775,14 +9974,14 @@ var HaExportAddon = class extends BaseAddon {
 	}
 	/**
 	* Each broker's media base, read per use: the palette's role the broker chose
-	* (`mediaRole:<brokerId>`, `internal` by default). A role that resolves to nothing
+	* (the `ha-export-links` record's `mediaRole`, `internal` by default). A role that resolves to nothing
 	* is `null` and says so — the image entities then carry no value, which reads as
 	* empty rather than as a broken link.
 	*/
 	async mediaBasesFor(brokerIds, deviceId) {
 		let bases;
 		try {
-			bases = mediaBasesByBroker(await this.resolveGlobalStore(), brokerIds, await this.ctx.api.localNetwork.getAddresses.query(), await this.readInstanceSettings());
+			bases = mediaBasesByBroker(brokerIds, await this.ctx.api.localNetwork.getAddresses.query(), (brokerId) => this.book().mediaRole(brokerId));
 		} catch (err) {
 			this.ctx.logger.debug("ha-export: could not resolve the media base URLs", {
 				tags: { deviceId },
@@ -9818,9 +10017,9 @@ var HaExportAddon = class extends BaseAddon {
 		return [instanceId];
 	}
 	exposedDeviceRows(scope) {
-		return exposedDeviceIds(this.config.membership, scope).map((deviceId) => ({
+		return exposedDeviceIds(this.membership(), scope).map((deviceId) => ({
 			deviceId,
-			exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+			exposedAs: brokersExposing(this.membership(), deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
 		}));
 	}
 	/**
@@ -9830,8 +10029,8 @@ var HaExportAddon = class extends BaseAddon {
 	*/
 	async setBrokerMembership(instanceId, deviceId, exposed) {
 		this.brokerScope(instanceId);
-		const next = setExposed(this.config.membership, instanceId, deviceId, exposed);
-		if (next === this.config.membership) {
+		const next = setExposed(this.membership(), instanceId, deviceId, exposed);
+		if (next === this.membership()) {
 			this.ctx.logger.debug("ha-export: membership already in that state, nothing to do", {
 				tags: { deviceId: Number(deviceId) },
 				meta: {
@@ -9841,7 +10040,7 @@ var HaExportAddon = class extends BaseAddon {
 			});
 			return;
 		}
-		await this.updateGlobalSettings({ membership: next });
+		await this.persistMembership(next);
 		this.ctx.logger.info("ha-export: export membership changed", {
 			tags: { deviceId: Number(deviceId) },
 			meta: {
@@ -9854,7 +10053,7 @@ var HaExportAddon = class extends BaseAddon {
 	globalSettingsSchema() {
 		const brokerFields = this.config.knownBrokers.map((broker) => ({
 			type: "boolean",
-			key: `exportTo:${broker.id}`,
+			key: exportToFormKey(broker.id),
 			label: broker.name,
 			style: "switch",
 			default: false
@@ -9883,7 +10082,7 @@ var HaExportAddon = class extends BaseAddon {
 				columns: 1,
 				fields: this.config.knownBrokers.map((broker) => ({
 					type: "select",
-					key: mediaRoleKey(broker.id),
+					key: mediaRoleFormKey(broker.id),
 					label: `Image links for ${broker.name}`,
 					options: [{
 						value: "internal",
@@ -9924,7 +10123,7 @@ var HaExportAddon = class extends BaseAddon {
 	* exporter's value in this one's toggle.
 	*/
 	async buildContribution(deviceId) {
-		await this.refreshEnabledBrokers(this.config.knownBrokers);
+		this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({
@@ -9932,7 +10131,7 @@ var HaExportAddon = class extends BaseAddon {
 			key: `haExport:${deviceId}:${brokerId}`,
 			label: `Export to ${this.brokerName(brokerId)}`,
 			style: "switch",
-			value: isExposed(this.config.membership, brokerId, idStr),
+			value: isExposed(this.membership(), brokerId, idStr),
 			immediate: true
 		}));
 		return {
@@ -9962,7 +10161,7 @@ var HaExportAddon = class extends BaseAddon {
 	}
 	async applyDeviceSettingsPatch(deviceId, patch) {
 		const idStr = String(deviceId);
-		let next = this.config.membership;
+		let next = this.membership();
 		let touched = false;
 		/**
 		* Driven by the PATCH KEYS, not by the enabled-broker list.
@@ -9992,7 +10191,7 @@ var HaExportAddon = class extends BaseAddon {
 			});
 			return { success: true };
 		}
-		await this.updateGlobalSettings({ membership: next });
+		await this.persistMembership(next);
 		this.ctx.logger.info("ha-export: per-broker export membership changed", {
 			tags: { deviceId },
 			meta: { brokers: brokersExposing(next, idStr) }
@@ -10007,7 +10206,7 @@ var HaExportAddon = class extends BaseAddon {
 		const linkFailure = links.map((link) => link.client.failure).filter((failure) => failure !== null)[0]?.text;
 		return {
 			linkState: enabled.length === 0 ? "unlinked" : healthy === links.length ? "linked" : "error",
-			exposedDeviceCount: exposedDeviceIds(this.config.membership, enabled).length,
+			exposedDeviceCount: exposedDeviceIds(this.membership(), enabled).length,
 			...linkFailure !== void 0 ? { error: linkFailure } : this.lastError !== void 0 ? { error: this.lastError } : {},
 			setup: {
 				fields: [