homebridge-mynest 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project are documented here. From the first release onward, [release-please](https://github.com/googleapis/release-please) owns this file — do not hand-edit version headings after `0.1.0` ships.
 
+## [2.0.2](https://github.com/tbaur/homebridge-mynest/compare/v2.0.1...v2.0.2) (2026-10-05)
+
+
+### Bug Fixes
+
+* log one diagnostics health warning ([ede8013](https://github.com/tbaur/homebridge-mynest/commit/ede8013cccdf0cf31396755e03a04a2ce7b96966))
+
+## [2.0.1](https://github.com/tbaur/homebridge-mynest/compare/v2.0.0...v2.0.1) (2026-09-05)
+
+
+### Bug Fixes
+
+* clamp published thermostat setpoints and report failed writes ([#46](https://github.com/tbaur/homebridge-mynest/issues/46)) ([c5bf879](https://github.com/tbaur/homebridge-mynest/commit/c5bf87993934dd17d43653bceb296c674a3fd7cc))
+
 ## [2.0.0](https://github.com/tbaur/homebridge-mynest/compare/v1.1.0...v2.0.0) (2026-08-05)
 
 

package/README.md

@@ -3,7 +3,7 @@
 [![Tests](https://github.com/tbaur/homebridge-mynest/actions/workflows/test.yml/badge.svg)](https://github.com/tbaur/homebridge-mynest/actions/workflows/test.yml)
 [![npm version](https://img.shields.io/npm/v/homebridge-mynest?style=flat-square)](https://www.npmjs.com/package/homebridge-mynest)
 [![npm downloads](https://img.shields.io/npm/dt/homebridge-mynest?style=flat-square)](https://www.npmjs.com/package/homebridge-mynest)
-[![Node.js](https://img.shields.io/badge/node-22%20%7C%7C%2024-green)](https://nodejs.org)
+[![Node.js](https://img.shields.io/badge/node-22%20%7C%7C%2024%20%7C%7C%2026-green)](https://nodejs.org)
 [![Homebridge](https://img.shields.io/badge/homebridge-2.x-purple)](https://homebridge.io)
 [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
@@ -12,32 +12,27 @@ Expose Nest thermostats, Nest Protect smoke/CO alarms, and Nest Temperature Sens
 ## Features
 
 ### Device Support
-
-- **Thermostats** — Current temperature, mode, activity, setpoints, humidity when Nest reports it; each thermostat includes an Eco Mode switch; optional house-wide Nest Eco Mode switch (`exposeGlobalEcoSwitch`); HomeKit can change mode/setpoints/Eco when Allow thermostat control is enabled (opt-in)
-- **Nest Protect** — Smoke and CO from REST when available; battery / online from REST and/or Observe; optional occupancy and Protect temperature
-- **Temperature Sensors** — Nest Temperature Sensor (kryptonite) pucks
-- **Dual transport** — Merges Nest REST subscribe with HTTP/2 Observe so Observe-only devices still appear
-
-### Honesty about Nest's APIs
-
-- **Occupancy is not motion** — Nest publishes `auto_away` for mains-powered Protects: roughly a ten-minute presence verdict. Battery Protects, power-unknown Protects, and Observe-only Protects get no occupancy sensor rather than a stuck "empty house"; when REST later goes stale, a last occupancy reading stays published but is marked inactive/faulted
-- **Smoke/CO honesty without accessory churn** — Observe-only Protects omit smoke/CO until REST reports alarm state; if REST later goes down, tiles stay in HomeKit (rooms/automations keep their targets) but are marked inactive/faulted rather than freezing a live all-clear. Battery and online may remain from Observe
-- **Thermostats are Observe-first** — Modern Nest thermostats may be missing from REST entirely; this plugin does not rely on REST-only discovery for HVAC
+- **Thermostats:** temperature, mode, activity, setpoints, humidity when Nest reports it, plus an Eco Mode switch per thermostat
+- **Optional house-wide Eco switch:** `exposeGlobalEcoSwitch`
+- **Thermostat writes:** mode, setpoints, and Eco only when **Allow thermostat control** is on (off by default)
+- **Nest Protect:** smoke and CO from REST when available; battery and online from REST and/or Observe
+- **Optional Protect occupancy and temperature**
+- **Temperature Sensors:** Nest Temperature Sensor (kryptonite) pucks
+- **Dual transport:** Nest REST subscribe merged with HTTP/2 Observe, so Observe-only devices still appear
 
 ### Reliability
-
-- **No accessory churn on outages or token expiry** — Devices leave HomeKit only after Nest-confirmed drops (two-strike + truncation guards on Observe and REST). A cloud blip, REST-only boot, or expired access token stops updates but does not unregister thermostats, Protects, or temp sensors (paste a fresh token and restart)
-- **Circuit breakers** — Independent REST and Observe breakers fail fast when Nest's edge is returning sustained 5xx / network failures, then probe again after a short cooldown (auth and 403 paths keep their own handling)
-- **Diagnostics** *(optional)* — Opt-in health/activity heartbeats, boot/shutdown snapshots, and healthy/degraded transitions in the Homebridge log (REST + Observe transport gauges, breaker state, device inventory, API latency)
+- **No accessory churn** on a cloud blip or expired token. Devices leave HomeKit only after Nest-confirmed drops
+- **Circuit breakers** on REST and Observe so a dead Nest edge fails fast
+- **Diagnostics** *(optional):* health heartbeats in the Homebridge log, with one warning when health becomes degraded
 
 ### Quality
-
 <!-- Canonical test count lives here only; keep other docs number-free to avoid multi-place updates. -->
-- **Built for Homebridge 2** — Live updates use stored getters + `updateValue(...)`, not the removed `getValue()` or stale `.value` reads
-- **576 tests** — Jest suite with a per-area coverage floor on every source directory (statements, branches, functions, and lines), and a CI step that fails if the suite leaks an open handle
-- **Strict TypeScript** — `strict` mode with unused locals/params and no implicit returns, plus type-aware linting (no floating promises)
-- **Secret hygiene** — Access tokens are redacted from logs, and untrusted Nest responses cannot reach `Object.prototype`
-- **No analytics** — Zero tracking or data collection
+- **576 tests** with a per-area coverage floor, and a CI step that fails if the suite leaks an open handle
+- **Built for Homebridge 2:** stored getters and `updateValue(...)`, not the removed `getValue()`
+- **Secret hygiene:** access tokens are redacted from logs
+- **No analytics**
+
+Every option, occupancy caveat, and troubleshooting step is in [Detailed documentation](docs/README-DETAILED.md).
 
 ## Quick Start
 
@@ -45,17 +40,15 @@ Expose Nest thermostats, Nest Protect smoke/CO alarms, and Nest Temperature Sens
 
 **Homebridge UI** (recommended): Plugins → Search `mynest` → Install
 
-**Command line:**
-
 ```bash
 npm install -g homebridge-mynest
 ```
 
 ### 2. Get a Nest Account token
 
-You need a Nest Account (not Google-only) access token from [home.nest.com/session](https://home.nest.com/session). Steps and threat model: [docs/AUTH.md](https://github.com/tbaur/homebridge-mynest/blob/main/docs/AUTH.md).
+You need a Nest Account (not Google-only) access token from [home.nest.com/session](https://home.nest.com/session). Steps and threat model: [docs/AUTH.md](docs/AUTH.md).
 
-Prefer treating that token like a password; Nest Account sessions are account-scoped credentials.
+Treat that token like a password. Nest Account sessions are account-scoped credentials.
 
 ### 3. Configure
 
@@ -77,14 +70,14 @@ Use the Homebridge UI, or add the platform to `config.json`:
 
 Thermostats, Protects, and temperature sensors appear in the Home app as Nest reports them. The log should show `Connected to Nest (REST up; Observe connecting)`, then device adds, then `Platform ready`.
 
-Thermostat control (mode, setpoints, Eco) stays off until you enable **Allow thermostat control**. Optionally enable **Expose global Eco switch** for a house-wide Nest Eco Mode tile.
+Thermostat control stays off until you enable **Allow thermostat control**. Optionally enable **Expose global Eco switch**.
 
 ## Supported Devices
 
 | Nest device | HomeKit accessory | Notes |
 | --- | --- | --- |
-| Thermostat | Thermostat + Eco Mode switch | Observe is source of truth; mode/setpoints/Eco writable when `allowThermostatControl` is on (opt-in). Optional house-wide Eco switch via `exposeGlobalEcoSwitch`. |
-| Nest Protect | Smoke + CO (+ optional occupancy / temp) | Smoke/CO require REST `topaz`; occupancy is ~10-minute presence |
+| Thermostat | Thermostat + Eco Mode switch | Observe is source of truth. Writes need `allowThermostatControl`. |
+| Nest Protect | Smoke + CO (+ optional occupancy / temp) | Smoke/CO require REST `topaz`. Occupancy is ~10-minute presence, not motion. |
 | Temperature Sensor | Temperature Sensor | Battery + temperature |
 
 Cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account-only homes are out of scope.
@@ -95,54 +88,51 @@ Cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account
 
 | Option | Default | Description |
 | --- | --- | --- |
-| `name` | `MyNest` | Required. Plugin instance name shown in Homebridge logs. |
-| `accessToken` | — | Required. Nest Account `access_token` from [docs/AUTH.md](https://github.com/tbaur/homebridge-mynest/blob/main/docs/AUTH.md). |
-| `allowThermostatControl` | `false` | Opt in to send mode/setpoint/Eco changes to Nest via BatchUpdateState. |
-| `exposeGlobalEcoSwitch` | `false` | Publish a Nest Eco Mode switch that sets Eco on every thermostat. Writes require `allowThermostatControl`. |
-| `exposeProtectOccupancy` | `true` | Occupancy from REST `auto_away` when Nest computes it on a mains-powered Protect. |
+| `name` | `MyNest` | Required. Plugin instance name in Homebridge logs. |
+| `accessToken` | — | Required. Nest Account `access_token`. See [docs/AUTH.md](docs/AUTH.md). |
+| `allowThermostatControl` | `false` | Send mode/setpoint/Eco changes to Nest. |
+| `exposeGlobalEcoSwitch` | `false` | One switch that sets Eco on every thermostat. Writes still need `allowThermostatControl`. |
+| `exposeProtectOccupancy` | `true` | Occupancy from REST `auto_away` on a mains-powered Protect. |
 | `exposeProtectTemperature` | `false` | Temperature/humidity measured by each Protect. |
 | `ignoredDeviceIds` | `[]` | Device IDs or serials to leave out of HomeKit. |
 | `fieldTest` | `false` | Use Nest field-test hosts. |
-| `diagnosticsInterval` | `0` | Seconds between health heartbeats in the log; `0` off, else `30`–`86400` (24h). |
-| `structuredLogs` | `false` | When diagnostics are enabled, also emit a machine-readable JSON line alongside each human summary. |
+| `diagnosticsInterval` | `0` | Seconds between health heartbeats; `0` off, else `30`–`86400`. |
+| `structuredLogs` | `false` | With diagnostics, also emit a JSON line. |
 | `debug` | `false` | Verbose logging; tokens are redacted. |
 
-## Protect occupancy
-
-Nest does not expose a reliable Protect motion event stream to third-party clients. What this plugin publishes (when REST `auto_away` exists on a mains-powered Protect) is Nest's own presence hold-off — on the order of **ten minutes** after the room empties, clearing when activity is seen again. Do not build automations that expect pathlight-speed motion.
+The [detailed documentation](docs/README-DETAILED.md#full-configuration-reference) explains each option and what happens when REST or Observe is down.
 
 ## Not Working?
 
-1. **Authentication error** — Token missing, truncated, Google JWT/`ya29.`, or revoked. Capture a fresh Nest Account token ([docs/AUTH.md](https://github.com/tbaur/homebridge-mynest/blob/main/docs/AUTH.md)).
-2. **Thermostat missing** — Modern thermostats are Observe-only on some accounts. With default logging the plugin warns within about a minute if Observe produced no frames, and again every five minutes if a connected stream goes quiet; set `debug: true` for stream detail. From a git checkout you can also run `npm run verify` against the live account — see [DEVELOPMENT.md](https://github.com/tbaur/homebridge-mynest/blob/main/DEVELOPMENT.md).
-3. **Thermostat in Settings but no room tile** — Remove and re-add the **MyNest** child bridge in the Home app (or whatever you set as **Name**), then assign rooms again. Same-UUID republish does not clear Apple Home's stuck presentation.
-4. **Eco / setpoint changes snap back** — Enable **Allow thermostat control**. With control off, HomeKit can still move the UI (required for tiles) but Nest ignores the write and the plugin reverts.
-5. **Protect without smoke/CO** — Likely Observe-only (missing from REST). The accessory still appears; alarm tiles wait for REST.
-6. **No occupancy** — Battery Protect, power unknown, Observe-only Protect, or `exposeProtectOccupancy` off.
+1. **Authentication error:** token missing, truncated, Google JWT/`ya29.`, or revoked. Capture a fresh Nest Account token ([docs/AUTH.md](docs/AUTH.md)).
+2. **Thermostat missing:** modern thermostats are Observe-only on some accounts. Enable `debug` for stream detail.
+3. **Eco / setpoint changes snap back:** enable **Allow thermostat control**.
+4. **Protect without smoke/CO:** likely Observe-only. The accessory still appears; alarm tiles wait for REST.
+5. **No occupancy:** battery Protect, power unknown, Observe-only, or `exposeProtectOccupancy` off. Occupancy is not motion.
 
-## Security
+The [full troubleshooting list](docs/README-DETAILED.md#troubleshooting) covers more cases, including a stuck Home app tile.
 
-This plugin holds a Nest Account `access_token` in Homebridge's plaintext `config.json`. That token is account-scoped Nest credentials — anyone who can read the file can act as the Nest web app for the home. Secure the host, prefer rotating the token if it may have leaked, and never paste tokens into issues or logs.
+## Security
 
-Details: [SECURITY.md](https://github.com/tbaur/homebridge-mynest/blob/main/SECURITY.md) and [docs/AUTH.md](https://github.com/tbaur/homebridge-mynest/blob/main/docs/AUTH.md).
+This plugin holds a Nest Account `access_token` in Homebridge's plaintext `config.json`. Anyone who can read that file can act as the Nest web app for the home. Secure the host, rotate the token if it may have leaked, and never paste tokens into issues or logs.
 
-Nest publishes no consumer API and can change or revoke sessions without notice. This plugin uses Nest Account tokens only and rejects Google cookie / `ya29.` shapes on purpose.
+See [SECURITY.md](SECURITY.md) and [docs/AUTH.md](docs/AUTH.md).
 
 ## Requirements
 
-- **Homebridge 2.x** — Homebridge 1.x is not supported
-- **Node.js 22 or 24** — this mirrors Homebridge 2's own `engines` constraint, so newer Node versions are excluded until Homebridge supports them; CI tests both
+- **Homebridge 2.x** (Homebridge 1.x is not supported)
+- **Node.js 22, 24, or 26**
 - A Nest Account (not Google-only) with an `access_token` from [home.nest.com/session](https://home.nest.com/session)
 
 ## More Info
 
-- [Authentication](https://github.com/tbaur/homebridge-mynest/blob/main/docs/AUTH.md) — capturing the Nest Account token
-- [Protocol notes](https://github.com/tbaur/homebridge-mynest/blob/main/docs/PROTOCOL.md) — reverse-engineered Nest behaviour
-- [Development](https://github.com/tbaur/homebridge-mynest/blob/main/DEVELOPMENT.md) — architecture and local setup
-- [Contributing](https://github.com/tbaur/homebridge-mynest/blob/main/CONTRIBUTING.md)
-- [Code of conduct](https://github.com/tbaur/homebridge-mynest/blob/main/CODE_OF_CONDUCT.md)
-- [Security policy](https://github.com/tbaur/homebridge-mynest/blob/main/SECURITY.md)
-- [Changelog](https://github.com/tbaur/homebridge-mynest/blob/main/CHANGELOG.md)
+- [Detailed documentation](docs/README-DETAILED.md)
+- [Authentication](docs/AUTH.md)
+- [Protocol notes](docs/PROTOCOL.md)
+- [Development](DEVELOPMENT.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security policy](SECURITY.md)
+- [Changelog](CHANGELOG.md)
 - [Report issues](https://github.com/tbaur/homebridge-mynest/issues)
 
 ## License

package/config.schema.json

@@ -6,18 +6,17 @@
   "footerDisplay": "Thermostat mode/setpoints/Eco write through Nest BatchUpdateState only when Allow thermostat control is enabled (off by default). Each thermostat gets an Eco Mode switch; optionally enable Expose global Eco switch for all-at-once. Protect occupancy is Nest's ~10-minute presence verdict (auto_away), not motion. Treat the access token like a password.",
   "schema": {
     "type": "object",
+    "required": ["name", "accessToken"],
     "properties": {
       "name": {
         "title": "Name",
         "type": "string",
         "default": "MyNest",
-        "required": true,
         "description": "Name shown in the Homebridge log."
       },
       "accessToken": {
         "title": "Nest access token",
         "type": "string",
-        "required": true,
         "minLength": 32,
         "x-schema-form": {
           "type": "password"
@@ -52,7 +51,6 @@
         "title": "Ignored device IDs",
         "type": "array",
         "default": [],
-        "required": false,
         "description": "Nest device IDs or serial numbers to leave out of HomeKit. IDs appear in the Homebridge log when devices are added.",
         "items": {
           "type": "string",

package/dist/accessories/global-eco.js

@@ -148,6 +148,12 @@ class GlobalEcoAccessory {
             this.#clearPending();
             this.#log.warn(`${settings_1.GLOBAL_ECO_DISPLAY_NAME}: Eco update failed: ${(0, sanitizers_1.sanitizeError)(error)}`);
             setImmediate(() => this.#binder.refresh());
+            // Same distinction the thermostat draws: a refusal above resolves, but a
+            // write that reached Nest and failed is reported so the user is not left
+            // watching a switch flip back with no stated reason. The deferred refresh
+            // clears HAP's error status a tick later, so it cannot stick.
+            const { HAPStatus, HapStatusError } = this.#platform.api.hap;
+            throw new HapStatusError(-70402 /* HAPStatus.SERVICE_COMMUNICATION_FAILURE */);
         }
     }
     #applyAccessoryInformation() {

package/dist/accessories/thermostat.js

@@ -25,6 +25,23 @@ function midpoint(low, high) {
     }
     return (low + high) / 2;
 }
+/**
+ * A Nest setpoint on the grid this accessory publishes.
+ *
+ * HAP quantizes and clamps whatever it is handed against the characteristic's
+ * props, so pushing Nest's raw Celsius leaves HomeKit holding a number the
+ * plugin never computed. A thermostat set to Fahrenheit makes that the normal
+ * case rather than an edge one: it stores 72 °F as 22.222 °C, and every push
+ * lands a quarter degree from what the Nest app shows. Doing the arithmetic
+ * here keeps `onGet`, plugin state, and HomeKit's cache on one number.
+ *
+ * Quantize first and anchor the grid at {@link MIN_SETPOINT_C}, because that is
+ * what HAP does with `minStep` and `minValue`.
+ */
+function toPublishedSetpoint(celsius) {
+    const steps = Math.round((celsius - settings_1.MIN_SETPOINT_C) / settings_1.SETPOINT_STEP_C);
+    return (0, thermostat_write_1.clampSetpoint)(steps * settings_1.SETPOINT_STEP_C + settings_1.MIN_SETPOINT_C);
+}
 class ThermostatAccessory extends base_1.NestAccessory {
     #service;
     #ecoService = null;
@@ -120,9 +137,18 @@ class ThermostatAccessory extends base_1.NestAccessory {
      * Send a Nest write when control is enabled; otherwise refresh so HomeKit
      * does not keep a slider position Nest never accepted.
      *
-     * Nest errors are logged and the last good values are pushed back — never
-     * rethrown into HAP `onSet`, which would mark the accessory "No Response"
-     * for a long sticky period in the Home app.
+     * A refused write and a failed one are different events and must not look
+     * alike. Refused means `allowThermostatControl` is off: nothing malfunctioned,
+     * the plugin is doing what it was configured to do, so `onSet` resolves and
+     * the last good values are pushed back.
+     *
+     * A write that reached Nest and failed is reported as a HAP communication
+     * failure, so the user learns their change was dropped instead of watching a
+     * slider spring back for no stated reason — and an automation awaiting the
+     * write sees it fail rather than succeed. Safe here only because every
+     * characteristic is bound with an `onGet` handler and the deferred refresh
+     * pushes a value a tick later: HAP resets the error status on both paths, so
+     * the failure cannot settle into a sticky "No Response".
      */
     async #write(patch) {
         try {
@@ -137,6 +163,11 @@ class ThermostatAccessory extends base_1.NestAccessory {
         catch (error) {
             this.log.warn(`${this.identity.name}: thermostat update failed: ${(0, sanitizers_1.sanitizeError)(error)}`);
             this.#revertHomeKitValues();
+            // `HapStatusError` rather than the Nest error: rethrowing that would put a
+            // stack trace in the Homebridge log through HAP's unhandled-error path,
+            // and Nest's message is already logged above without the token in it.
+            const { HAPStatus, HapStatusError } = this.platform.api.hap;
+            throw new HapStatusError(-70402 /* HAPStatus.SERVICE_COMMUNICATION_FAILURE */);
         }
     }
     /**
@@ -179,6 +210,11 @@ class ThermostatAccessory extends base_1.NestAccessory {
             },
         });
     }
+    /**
+     * Send an Eco write, drawing the same line between refused and failed as
+     * {@link #write}: a refusal is the configured behaviour and resolves, while a
+     * write that reached Nest and failed is reported as a communication failure.
+     */
     async #writeEco(ecoOn) {
         try {
             const sent = await this.platform.applyEcoWrite(this.deviceId, ecoOn);
@@ -192,6 +228,8 @@ class ThermostatAccessory extends base_1.NestAccessory {
         catch (error) {
             this.log.warn(`${this.identity.name}: Eco update failed: ${(0, sanitizers_1.sanitizeError)(error)}`);
             this.#revertHomeKitValues();
+            const { HAPStatus, HapStatusError } = this.platform.api.hap;
+            throw new HapStatusError(-70402 /* HAPStatus.SERVICE_COMMUNICATION_FAILURE */);
         }
     }
     /**
@@ -230,7 +268,7 @@ class ThermostatAccessory extends base_1.NestAccessory {
         const characteristic = this.binder.bind(this.#service, type, () => {
             const value = read();
             if (value !== undefined) {
-                return value;
+                return toPublishedSetpoint(value);
             }
             const current = this.#service.getCharacteristic(type).value;
             return typeof current === 'number'
@@ -240,8 +278,21 @@ class ThermostatAccessory extends base_1.NestAccessory {
                 ? current
                 : settings_1.MIN_SETPOINT_C;
         }, options.write ? { write: options.write } : {});
-        if (typeof characteristic.value === 'number' && characteristic.value < settings_1.MIN_SETPOINT_C) {
-            characteristic.updateValue(settings_1.MIN_SETPOINT_C);
+        // Correct both bounds; only the floor used to be. `setProps` clamps a
+        // cached value into the range itself, but it reports doing so, and Heating
+        // Threshold arrives holding HAP's default of 0 °C on every fresh
+        // thermostat, so pre-correcting is what keeps that off the log.
+        //
+        // Push only when the clamp actually moves the value. `updateValue` runs
+        // before the props below and is validated against the ones still in force,
+        // whose Heating Threshold ceiling is 25 °C, so re-sending an already-legal
+        // 30 °C would push it down to 25 instead of leaving it alone.
+        const cached = characteristic.value;
+        if (typeof cached === 'number') {
+            const clamped = (0, thermostat_write_1.clampSetpoint)(cached);
+            if (clamped !== cached) {
+                characteristic.updateValue(clamped);
+            }
         }
         characteristic.setProps({
             minValue: settings_1.MIN_SETPOINT_C,

package/dist/api/thermostat-write.d.ts

@@ -65,3 +65,12 @@ export declare function formatThermostatUpdateLog(write: ThermostatSetpointWrite
 export declare function encodeEcoModeBatchUpdate(resourceId: string, ecoOn: boolean): Buffer;
 /** Encode a NestMessage suitable for TraitBatchApi/BatchUpdateState. */
 export declare function encodeTargetTemperatureBatchUpdate(write: ThermostatSetpointWrite): Buffer;
+/**
+ * Confine a Celsius setpoint to the range Nest accepts.
+ *
+ * Exported because the accessory's publish path needs the same bounds: the
+ * range HomeKit is told about and the range a write is clamped to must come
+ * from one place, or a value the plugin publishes can be one it would refuse
+ * to send back.
+ */
+export declare function clampSetpoint(celsius: number): number;

package/dist/api/thermostat-write.js

@@ -20,6 +20,7 @@ exports.buildThermostatSetpointWrite = buildThermostatSetpointWrite;
 exports.formatThermostatUpdateLog = formatThermostatUpdateLog;
 exports.encodeEcoModeBatchUpdate = encodeEcoModeBatchUpdate;
 exports.encodeTargetTemperatureBatchUpdate = encodeTargetTemperatureBatchUpdate;
+exports.clampSetpoint = clampSetpoint;
 const node_crypto_1 = require("node:crypto");
 const settings_1 = require("../settings");
 const protobuf_1 = require("./protobuf");
@@ -223,6 +224,14 @@ function resolveStandbyMode(state, patchMode) {
     }
     return state.canCool && !state.canHeat ? 'cool' : 'heat';
 }
+/**
+ * Confine a Celsius setpoint to the range Nest accepts.
+ *
+ * Exported because the accessory's publish path needs the same bounds: the
+ * range HomeKit is told about and the range a write is clamped to must come
+ * from one place, or a value the plugin publishes can be one it would refuse
+ * to send back.
+ */
 function clampSetpoint(celsius) {
     return Math.min(settings_1.MAX_SETPOINT_C, Math.max(settings_1.MIN_SETPOINT_C, celsius));
 }

package/dist/diagnostics/format.js

@@ -18,10 +18,6 @@ function diagnosticLabel(msg) {
             return 'Diagnostics start';
         case 'diagnostics.stop':
             return 'Diagnostics stop';
-        case 'health.degraded':
-            return 'Health degraded';
-        case 'health.recovered':
-            return 'Health recovered';
         default:
             return msg;
     }

package/dist/platform.js

@@ -884,22 +884,20 @@ class MyNestPlatform {
         this.#diagnosticsTimer = setInterval(() => this.#diagnosticsHeartbeat(), interval);
         this.#diagnosticsTimer.unref?.();
     }
+    /**
+     * Emits one heartbeat. The line is a warning on the interval where health
+     * flips from healthy to degraded, and info otherwise. A reader failure stays
+     * inside the timer so it cannot crash Homebridge.
+     */
     #diagnosticsHeartbeat() {
         if (!this.#diagnostics) {
             return;
         }
         try {
             const report = this.#diagnostics.buildHeartbeat(this.#buildDiagnosticsReaders());
-            this.#emitDiagnostic('info', report);
             const health = report.lifecycle.health;
-            if (this.#lastDiagnosticsHealth !== null && health !== this.#lastDiagnosticsHealth) {
-                const isDegraded = health === 'degraded';
-                const transition = {
-                    ...report,
-                    msg: isDegraded ? 'health.degraded' : 'health.recovered',
-                };
-                this.#emitDiagnostic(isDegraded ? 'warn' : 'info', transition);
-            }
+            const becameDegraded = this.#lastDiagnosticsHealth === 'healthy' && health === 'degraded';
+            this.#emitDiagnostic(becameDegraded ? 'warn' : 'info', report);
             this.#lastDiagnosticsHealth = health;
         }
         catch (error) {

package/dist/settings.d.ts

@@ -336,7 +336,15 @@ export declare const MAX_DIAGNOSTICS_INTERVAL_SEC = 86400;
 export declare const PROTECT_OCCUPANCY_HOLD_OFF_SEC = 600;
 /** Floor on the thermostat setpoint HomeKit may request, in Celsius. */
 export declare const MIN_SETPOINT_C = 9;
-/** Ceiling on the thermostat setpoint HomeKit may request, in Celsius. */
+/**
+ * Ceiling on the thermostat setpoint HomeKit may request, in Celsius.
+ *
+ * Nest's own ceiling is 90 °F, or 32.222 °C, which does not sit on the
+ * {@link SETPOINT_STEP_C} grid. HAP quantizes a value onto that grid *before*
+ * range-checking it, so 32.222 arrives as 32.0 and needs no headroom above 32
+ * to publish cleanly. Raising this to 32.5 would only add a setpoint the Home
+ * app can offer and Nest cannot honour.
+ */
 export declare const MAX_SETPOINT_C = 32;
 /** Granularity of thermostat setpoints in Celsius, matching Nest's own UI. */
 export declare const SETPOINT_STEP_C = 0.5;

package/dist/settings.js

@@ -362,7 +362,15 @@ exports.MAX_DIAGNOSTICS_INTERVAL_SEC = 86_400;
 exports.PROTECT_OCCUPANCY_HOLD_OFF_SEC = 600;
 /** Floor on the thermostat setpoint HomeKit may request, in Celsius. */
 exports.MIN_SETPOINT_C = 9;
-/** Ceiling on the thermostat setpoint HomeKit may request, in Celsius. */
+/**
+ * Ceiling on the thermostat setpoint HomeKit may request, in Celsius.
+ *
+ * Nest's own ceiling is 90 °F, or 32.222 °C, which does not sit on the
+ * {@link SETPOINT_STEP_C} grid. HAP quantizes a value onto that grid *before*
+ * range-checking it, so 32.222 arrives as 32.0 and needs no headroom above 32
+ * to publish cleanly. Raising this to 32.5 would only add a setpoint the Home
+ * app can offer and Nest cannot honour.
+ */
 exports.MAX_SETPOINT_C = 32;
 /** Granularity of thermostat setpoints in Celsius, matching Nest's own UI. */
 exports.SETPOINT_STEP_C = 0.5;

package/docs/AUTH.md

@@ -0,0 +1,28 @@
+# Authentication
+
+Install and options: [README](../README.md). Full options and troubleshooting: [README-DETAILED.md](README-DETAILED.md).
+
+This plugin supports **Nest Account** access tokens only. Google account sign-in (browser cookies, `issueToken`, `ya29.` OAuth tokens, JWTs) is intentionally not implemented.
+
+Nest publishes no consumer API for this path. The plugin opens a session the same way the Nest web app does: `GET https://home.nest.com/session` with `Authorization: Basic <access_token>`, then uses the session `access_token`, `userid`, and `urls.transport_url` for REST and Observe.
+
+## Getting the token
+
+1. Sign in at [home.nest.com](https://home.nest.com) with a Nest Account (the pre-Google Nest login lineage).
+2. In the same browser, open [https://home.nest.com/session](https://home.nest.com/session).
+3. Copy the `access_token` field from the JSON response.
+4. Paste it into the plugin's **Nest access token** field (or into `NEST_ACCESS_TOKEN` for `npm run verify`).
+
+You want the Nest Account token from that session JSON — not a Google cookie, not a JWT (`eyJ…`), and not a `ya29.` OAuth token.
+
+## Treat it as a password
+
+Anyone with this token can control every thermostat and smoke alarm on the Nest Account. Homebridge stores it in plaintext in `config.json`.
+
+- Do not paste it into issues, logs, screenshots, or chat.
+- Prefer a Nest Account used only for Homebridge when that is practical.
+- If it leaks, revoke Nest sessions / rotate credentials from Nest's account settings, then capture a fresh token.
+
+When Nest rejects the token you will see an authentication error in the Homebridge log and the plugin will stop retrying until you fix the config and restart.
+
+The wire protocol around the session is in [PROTOCOL.md](PROTOCOL.md). The threat model is in [SECURITY.md](../SECURITY.md).

package/docs/PROTOCOL.md

@@ -0,0 +1,103 @@
+# Protocol notes
+
+User-facing options and troubleshooting: [README-DETAILED.md](README-DETAILED.md). Token capture: [AUTH.md](AUTH.md).
+
+Nest publishes no consumer API. Everything below was confirmed with a probe kit against a live Nest Account. Treat this as a working map of private backends, not a promise Nest will keep them stable.
+
+## Dual transport
+
+| Path | Role |
+| --- | --- |
+| REST `app_launch` + `/v5/subscribe` | Protect alarm state (`topaz`), structure/where, temperature sensors (`kryptonite`), older thermostat buckets when present |
+| Observe (HTTP/2 gRPC-web protobuf) | Source of truth for modern thermostats; complete Protect inventory; trait patches for HVAC |
+
+Neither transport is a superset of the other. On the account used to build this plugin, REST returned six Protects and zero thermostats while Observe returned seven Protects and five thermostats — and REST still claimed `num_thermostats: "5+"`. The plugin unions Observe ∪ REST and records which transport supplied each device.
+
+**Critical merge rule:** Observe is authoritative for thermostats and for the complete Protect list. One Protect (post-reset) can be Observe-only and missing from REST `topaz`/`swarm`; it must still appear in HomeKit.
+
+## Accessory removal
+
+HomeKit accessories are unregistered only when Nest has confirmed a device is gone — never because a transport errored, a breaker opened, or a boot raced REST ahead of Observe.
+
+| Signal | Behaviour |
+| --- | --- |
+| Failed REST / Observe request | Keep last inventory; no unregister |
+| REST `app_launch` empty or under half prior size | Treat as truncated; merge present keys; keep missing |
+| REST `app_launch` omits a key | Two consecutive complete omissions before drop |
+| Observe reconnect empty or under half prior devices | Treat as incomplete; keep prior Observe state |
+| Observe omits a `DEVICE_*` | Two consecutive complete snapshots before prune |
+| Observe never connected this session | Do not unregister (REST-only view cannot prove thermostats are gone) |
+| Device absent from the Observe ∪ REST inventory after the above | Unregister from HomeKit |
+| Expired / revoked access token (or both transports exhausted on HTTP 403) | Stop updates; **keep** accessories — Nest Account auth is a manually pasted session token, so unregistering would bounce rooms/automations until the user pastes a fresh one and restarts |
+
+Unusable plugin config at startup (missing/invalid token shape, etc.) **keeps** the cached accessories, for the same reason an expired token does. A typo, a half-edited `config.json`, or a truncated token would otherwise destroy every room assignment, scene membership, and automation target in the Home app — and fixing the config does not bring them back, because HomeKit treats the re-registered accessories as new devices. A config error cannot warrant a more destructive response than a revoked token. The plugin logs why and publishes nothing until it is restarted with a usable config.
+
+A transient failure at startup (DNS, TLS, a timeout, a 5xx) is **not** fatal: it is retried with backoff, because `didFinishLaunching` fires only once and a host that boots before its network is up would otherwise stay idle for the lifetime of the process.
+
+## Session
+
+1. Config holds Nest Account `access_token` from `https://home.nest.com/session`.
+2. Plugin calls `GET /session` with `Authorization: Basic <token>` and the web app's `cztoken` cookie.
+3. Response yields session `access_token`, `userid`, and `urls.transport_url`.
+4. REST calls use Basic auth with the session token; Observe uses the same token against `grpc-web.production.nest.com`.
+
+## REST
+
+- `POST /api/0.1/user/{userid}/app_launch` with bucket types including `topaz`, `structure`, `kryptonite`, `device`, `shared`, `where`, …
+- Long-poll: `POST {transport_url}/v5/subscribe` with `{ objects: [{ object_key, object_revision, object_timestamp }] }`, client timeout ~120s. An idle abort is normal, not a failure.
+
+## Observe
+
+- Host: `grpc-web.production.nest.com`, path from session endpoints (`GatewayService/Observe`).
+- Request body: opaque traits blob vendored from the probe kit (`assets/protobuf/ObserveTraits.protobuf`).
+- Framing: length-delimited `nest.rpc.StreamBody`. Decode the full framed buffer; do not strip a header and assume success.
+- Frame 0 is often a resource/trait catalog that fails NestMessage decode — ignore it.
+- Later frames are trait snapshots/patches. Nest sends deltas; merge patches into state.
+
+## Protect occupancy
+
+A Protect has a PIR sensor, but neither API exposes usable motion events in practice. A ~12.5-hour capture of both transports on an occupied house recorded zero REST `auto_away` flips and zero nonempty Observe `ambient_motion` deltas. Many false "MOTION" banners in naive parsers were reconnect baselines containing the schema string `AmbientMotionEvent`, not live PIR.
+
+What Nest does publish is `auto_away` on mains-powered Protects in REST `topaz`: roughly a ten-minute presence hold-off (`auto_away_decision_time_secs` is the window constant, not a timestamp). HomeKit occupancy is therefore:
+
+- Published only when REST `auto_away` exists **and** the unit is confirmed mains-powered (`line_power_present` / Observe `wall_power`).
+- Unavailable when power is unknown, for battery Protects, and for Observe-only Protects until a real event path is proven.
+- Documented as presence, not pathlight-speed motion.
+
+## Protect smoke / CO
+
+Alarm status is taken from REST `topaz` (`smoke_status` / `co_status`), and only while the REST feed can refresh it. Observe streams `safety_alarm_*` traits, but no public schema maps them and captured samples have all been all-clear. Inferring "no smoke" from an unverified enum is refused.
+
+An Observe-only Protect gets no smoke/CO HomeKit services until REST reports alarm state. If REST later becomes unavailable (circuit breaker open, HTTP 403 budget exhausted, or no successful subscribe/`app_launch` within the stale window), smoke/CO services stay published with last-known values but `StatusActive=false` and `StatusFault=GENERAL_FAULT` — leaving a frozen clear that still looks live would be dishonest, and tearing services down would break HomeKit rooms and automations on every Nest blip. Battery / online may still appear from Observe.
+
+## Thermostat writes
+
+HVAC state updates arrive over Observe (`target_temperature_settings` / `hvac_control` / `eco_mode_state`). Writes use the same protobuf gateway as the Nest web app:
+
+### Mode / setpoints
+
+1. Encode `nest.trait.hvac.TargetTemperatureSettingsTrait` (mode via `settings.hvacMode` + `active`; setpoints as `targetTemperatureHeat` / `targetTemperatureCool`).
+2. Wrap in `nest.rpc.NestMessage` `{ set: [{ object: { id: DEVICE_…, key: target_temperature_settings, uuid }, property: Any }] }`.
+3. `POST https://grpc-web.production.nest.com/nestlabs.gateway.v1.TraitBatchApi/BatchUpdateState` with `Content-Type: application/x-protobuf` and the session Basic token.
+
+`off` is `active=0` with a standby `HEAT`/`COOL` left in `hvacMode` — Nest does not store an OFF enum there. REST `/v5/put` cannot reach Observe-only thermostats.
+
+Plugin flag: `allowThermostatControl` (default **off**). Manual HomeKit setpoint/mode writes clear Nest Eco (`eco_mode_state` OFF) in the same batch when Eco was active.
+
+> The encode shape was confirmed against a live account with a maintainer-only probe kit (`nest-probe`), which is **not part of this repository** and is not something a user or contributor can run. Treat references to it as provenance for where these findings came from, not as a step to reproduce.
+
+### Eco Mode (on / off)
+
+HomeKit has no Eco thermostat mode, so the plugin exposes Eco as a Switch (per thermostat, plus optional house-wide `exposeGlobalEcoSwitch`). Writes are a separate BatchUpdateState body:
+
+1. Encode `nest.trait.hvac.EcoModeStateTrait` with `ecoEnabled` `ON` or `OFF` and `ecoModeChangeReason` `ECO_MODE_CHANGE_REASON_MANUAL`.
+2. Wrap in `nest.rpc.NestMessage` `{ set: [{ object: { id: DEVICE_…, key: eco_mode_state, uuid }, property: Any }] }` (`encodeEcoModeBatchUpdate`).
+3. Same `TraitBatchApi/BatchUpdateState` endpoint and auth as setpoint writes.
+
+Eco-only writes were never confirmed against a live account the way setpoints were; enable `allowThermostatControl` only if you are comfortable with live Nest writes on your account.
+
+The optional house-wide switch (`exposeGlobalEcoSwitch`) posts Eco to every live thermostat accessory. It reports success only when every write succeeds; HomeKit stays optimistic until Nest's all-Eco aggregate matches (or 45s elapses and Nest truth wins).
+
+## Homebridge 2 update path
+
+Never push live values with removed `Characteristic.getValue()`, and never call `updateValue(characteristic.value)` (that is the cached value). Store the getter next to the characteristic and call `updateValue(getFunc())` on Nest updates. See `src/utils/bound-characteristics.ts`.

package/docs/README-DETAILED.md

@@ -0,0 +1,135 @@
+# homebridge-mynest detailed documentation
+
+Install and a short options table live in the [README](../README.md). This page is the rest: every option, what HomeKit shows when Nest is quiet, and how to read a failure.
+
+## Table of Contents
+
+- [Full configuration reference](#full-configuration-reference)
+- [How devices appear](#how-devices-appear)
+- [Protect occupancy](#protect-occupancy)
+- [Smoke and CO honesty](#smoke-and-co-honesty)
+- [How it works](#how-it-works)
+- [Diagnostics](#diagnostics)
+- [Troubleshooting](#troubleshooting)
+- [Related docs](#related-docs)
+
+## Full configuration reference
+
+```json
+{
+  "platforms": [
+    {
+      "platform": "MyNest",
+      "name": "MyNest",
+      "accessToken": "paste-access_token-from-home.nest.com/session",
+      "allowThermostatControl": false,
+      "exposeGlobalEcoSwitch": false,
+      "exposeProtectOccupancy": true,
+      "exposeProtectTemperature": false,
+      "ignoredDeviceIds": [],
+      "fieldTest": false,
+      "diagnosticsInterval": 0,
+      "structuredLogs": false,
+      "debug": false
+    }
+  ]
+}
+```
+
+| Option | Default | Description |
+| --- | --- | --- |
+| `name` | `MyNest` | Required by Homebridge. Log prefix for this instance. |
+| `accessToken` | — | Required. Nest Account `access_token` from [AUTH.md](AUTH.md). Google JWT and `ya29.` shapes are rejected. |
+| `allowThermostatControl` | `false` | Opt in to send mode, setpoint, and Eco changes through Nest BatchUpdateState. With this off, HomeKit can still move the tile (Home needs that) but Nest ignores the write and the plugin reverts. |
+| `exposeGlobalEcoSwitch` | `false` | Publish a Nest Eco Mode switch that sets Eco on every thermostat. Writes still require `allowThermostatControl`. |
+| `exposeProtectOccupancy` | `true` | Occupancy from REST `auto_away` when Nest computes it on a mains-powered Protect. See [Protect occupancy](#protect-occupancy). |
+| `exposeProtectTemperature` | `false` | Temperature and humidity measured by each Protect. |
+| `ignoredDeviceIds` | `[]` | Device IDs or serials to leave out of HomeKit. |
+| `fieldTest` | `false` | Use Nest field-test hosts. |
+| `diagnosticsInterval` | `0` | Seconds between health heartbeats in the log. `0` is off. Otherwise `30`–`86400` (24h). |
+| `structuredLogs` | `false` | When diagnostics are on, also emit a machine-readable JSON line next to each human summary. |
+| `debug` | `false` | Verbose logging. Tokens are redacted. |
+
+`name` is required by Homebridge verified plugins. The plugin uses it as the log prefix.
+
+## How devices appear
+
+| Nest device | HomeKit accessory | Notes |
+| --- | --- | --- |
+| Thermostat | Thermostat + Eco Mode switch | Observe is source of truth. Modern thermostats may be missing from REST entirely. Mode, setpoints, and Eco are writable only when `allowThermostatControl` is on. Optional house-wide Eco switch via `exposeGlobalEcoSwitch`. |
+| Nest Protect | Smoke + CO (+ optional occupancy / temp) | Smoke and CO need REST `topaz`. Battery and online can come from REST and/or Observe. |
+| Temperature Sensor | Temperature Sensor | Battery + temperature (`kryptonite`). |
+
+Cameras, doorbells, Yale locks, Home/Away structure switches, and Google-account-only homes are out of scope. That list is also in [SECURITY.md](../SECURITY.md).
+
+A device leaves HomeKit only after Nest-confirmed drops (two-strike and truncation guards on Observe and REST). A cloud blip, a REST-only boot, or an expired access token stops updates but does not unregister thermostats, Protects, or temp sensors. Paste a fresh token and restart.
+
+## Protect occupancy
+
+Nest does not expose a reliable Protect motion event stream to third-party clients.
+
+What this plugin publishes (when REST `auto_away` exists on a mains-powered Protect) is Nest's own presence hold-off: on the order of **ten minutes** after the room empties, clearing when activity is seen again. Do not build automations that expect pathlight-speed motion.
+
+Occupancy is omitted, rather than shown as a stuck empty house, when:
+
+- the Protect is battery-powered
+- power is unknown
+- the Protect is Observe-only (no REST `auto_away`)
+- `exposeProtectOccupancy` is off
+
+If REST later goes stale, a last occupancy reading stays published but is marked inactive/faulted.
+
+## Smoke and CO honesty
+
+Observe-only Protects omit smoke and CO until REST reports alarm state. The accessory still appears, so rooms and automations keep their targets.
+
+If REST later goes down, those tiles stay in HomeKit but are marked inactive/faulted rather than freezing a live all-clear. Battery and online may remain from Observe.
+
+The plugin does not invent an all-clear from unverified Observe fields.
+
+## How it works
+
+Two transports, neither a superset of the other:
+
+| Path | Role |
+| --- | --- |
+| REST `app_launch` + `/v5/subscribe` | Protect alarm state (`topaz`), structure/where, temperature sensors, older thermostat buckets when present |
+| Observe (HTTP/2) | Source of truth for modern thermostats; complete Protect inventory |
+
+The plugin unions Observe ∪ REST and records which transport supplied each device. Independent circuit breakers fail fast when Nest's edge returns sustained 5xx or network failures, then probe again after a short cooldown. Auth and 403 paths keep their own handling.
+
+Architecture and the Homebridge 2 update path: [DEVELOPMENT.md](../DEVELOPMENT.md). Wire-level notes: [PROTOCOL.md](PROTOCOL.md).
+
+## Diagnostics
+
+Set `diagnosticsInterval` to `30`–`86400` to log periodic health heartbeats and boot/shutdown snapshots. The heartbeat where health flips from healthy to degraded is a warning; later degraded heartbeats stay at info until it recovers. `0` (default) leaves diagnostics off.
+
+`structuredLogs` adds a JSON line next to each human summary. Reports cover REST and Observe transport gauges, breaker state, device inventory, and API latency.
+
+Nothing from diagnostics is exposed in HomeKit.
+
+## Troubleshooting
+
+1. **Authentication error.** Token missing, truncated, Google JWT/`ya29.`, or revoked. Capture a fresh Nest Account token ([AUTH.md](AUTH.md)).
+2. **Thermostat missing.** Modern thermostats are Observe-only on some accounts. With default logging the plugin warns within about a minute if Observe produced no frames, and again every five minutes if a connected stream goes quiet. Set `debug: true` for stream detail. From a git checkout you can also run `npm run verify` against the live account. See [DEVELOPMENT.md](../DEVELOPMENT.md).
+3. **Thermostat in Settings but no room tile.** Remove and re-add the **MyNest** child bridge in the Home app (or whatever you set as **Name**), then assign rooms again. Same-UUID republish does not clear Apple Home's stuck presentation.
+4. **Eco / setpoint changes snap back.** Enable **Allow thermostat control**. With control off, HomeKit can still move the UI (required for tiles) but Nest ignores the write and the plugin reverts.
+5. **Protect without smoke/CO.** Likely Observe-only (missing from REST). The accessory still appears; alarm tiles wait for REST.
+6. **No occupancy.** Battery Protect, power unknown, Observe-only Protect, or `exposeProtectOccupancy` off. See [Protect occupancy](#protect-occupancy).
+
+Restart Homebridge after any `config.json` edit.
+
+## Related docs
+
+- [README](../README.md): install and short options table
+- [AUTH.md](AUTH.md): capturing the Nest Account token
+- [PROTOCOL.md](PROTOCOL.md): reverse-engineered Nest behaviour
+- [DEVELOPMENT.md](../DEVELOPMENT.md): architecture and local setup
+- [SECURITY.md](../SECURITY.md)
+- [CONTRIBUTING.md](../CONTRIBUTING.md)
+
+## License
+
+Copyright 2026 tbaur
+
+Licensed under the Apache License, Version 2.0. See [LICENSE](../LICENSE) file for details.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "homebridge-mynest",
   "displayName": "Homebridge My Nest",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "Homebridge plugin for Nest thermostats (with Eco Mode), Nest Protect, and Nest Temperature Sensors using a Nest Account access token",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,12 +30,16 @@
   },
   "homepage": "https://github.com/tbaur/homebridge-mynest#readme",
   "dependencies": {
-    "protobufjs": "7.6.5"
+    "protobufjs": "7.6.6"
+  },
+  "overrides": {
+    "js-yaml": "^3.15.2",
+    "@homebridge/hap-nodejs": "$@homebridge/hap-nodejs"
   },
   "devDependencies": {
     "@homebridge/hap-nodejs": "^2.0.4",
     "@types/jest": "^30.0.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "^26.2.0",
     "@typescript-eslint/eslint-plugin": "^8.51.0",
     "@typescript-eslint/parser": "^8.51.0",
     "eslint": "^10.7.0",
@@ -43,12 +47,12 @@
     "homebridge": "^2.1.0",
     "jest": "^30.4.2",
     "nock": "^14.0.16",
-    "ts-jest": "29.4.12",
+    "ts-jest": "29.4.14",
     "typescript": "6.0.3"
   },
   "engines": {
     "homebridge": "^2.0.0",
-    "node": "^22 || ^24"
+    "node": "^22 || ^24 || ^26"
   },
   "peerDependencies": {
     "homebridge": "^2.0.0"
@@ -80,6 +84,8 @@
     "assets/**/*",
     "config.schema.json",
     "CHANGELOG.md",
-    "SECURITY.md"
+    "SECURITY.md",
+    "README.md",
+    "docs/**/*"
   ]
 }