@camstack/addon-provider-bosch 0.1.29 → 0.1.31

package/dist/home-connect/addon.mjs

@@ -1,5 +1,5 @@
-import { A as isSecretMarker, B as unknown, D as createEvent, E as errMsg, I as object, L as record, M as _enum, N as array, O as customAction, P as literal, R as string, T as DeviceType, V as EventCategory, _ as powerMeterCapability, b as runningStateCapability, c as connectionTestCapability, d as dishwasherCapability, f as enumSensorCapability, g as numericSensorCapability, h as ingestReading, i as RUNNING_STATE_COLD, j as isSecretMarkerLike, k as defineCustomActions, l as consumablesCapability, n as BaseDeviceProvider, o as binaryCapability, p as eventEmitterCapability, r as DishwasherOperationStateSchema, t as BaseDevice, u as deviceAdoptionCapability, v as quantityFromUnit, w as DeviceRole, y as runningFromDishwasherOperation, z as union } from "../dist-DzSesBKb.mjs";
-import { a as parseOAuthCallback, i as loginFailureForAttempt, n as cascadeRemoveDevicesForIntegration, r as createSignInAttemptStore, t as setIntegrationDevicesOnline } from "../account-integration-offline-C-XbrgLs.mjs";
+import { A as customAction, B as record, D as DeviceType, E as DeviceRole, F as array, H as union, I as boolean, L as literal, M as isSecretMarker, N as isSecretMarkerLike, O as errMsg, P as _enum, S as runningStateCapability, U as unknown, V as string, W as EventCategory, _ as ingestReading, b as quantityFromUnit, c as binaryCapability, d as consumablesCapability, f as deviceAdoptionCapability, h as eventEmitterCapability, i as RUNNING_STATE_COLD, j as defineCustomActions, k as createEvent, m as enumSensorCapability, n as BaseDeviceProvider, o as VendorLoginProxy, p as dishwasherCapability, r as DishwasherOperationStateSchema, t as BaseDevice, u as connectionTestCapability, v as numericSensorCapability, x as runningFromDishwasherOperation, y as powerMeterCapability, z as object } from "../dist-DxO4cucS.mjs";
+import { a as createSignInAttemptStore, i as openSignInProxy, n as cascadeRemoveDevicesForIntegration, o as loginFailureForAttempt, r as createSignInClaims, s as parseOAuthCallback, t as setIntegrationDevicesOnline } from "../account-integration-offline-Cfcp8s5x.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { connect } from "node:tls";
 import { inflateRawSync } from "node:zlib";
@@ -30,6 +30,23 @@ var homeConnectActions = defineCustomActions({
 		kind: "mutation",
 		auth: "admin"
 	}),
+	/**
+	* The form asks while the proxied login page is open: `pending` until the hub captured the
+	* app-scheme redirect and finished the exchange, then the same fields `finishSignIn` returns.
+	* Claimed once. A failed exchange answers with its operator-facing message as an error.
+	*/
+	claimSignIn: customAction(object({ attemptId: string().min(1) }), object({
+		pending: boolean(),
+		token: string().optional().meta({ secret: true }),
+		refresh: string().optional().meta({ secret: true }),
+		accountLabel: string().optional(),
+		appliances: string().optional(),
+		applianceSecrets: string().optional().meta({ secret: true }),
+		summary: string().optional()
+	}), {
+		kind: "mutation",
+		auth: "admin"
+	}),
 	signOut: customAction(object({}), object({
 		signedOut: literal(true),
 		summary: string()
@@ -986,192 +1003,6 @@ async function finishHomeConnectSignIn(input, store, fetchImpl = homeConnectLogi
 	}, fetchImpl);
 }
 var homeConnectSignInAttempts = createSignInAttemptStore();
-//#endregion
-//#region src/home-connect/home-connect-discovery.ts
-/** Dishwasher accessory label: `Dishwasher` plus the appliance name. */
-function homeConnectDishwasherEntityName(containerName) {
-	const base = containerName.trim();
-	return base.length > 0 ? `Dishwasher ${base}` : "Dishwasher";
-}
-function deviceTypeForApplianceType(type) {
-	if (type.toLowerCase().includes("dishwasher")) return DeviceType.Container;
-	return null;
-}
-/**
-* The container candidate for one appliance. Its sensor children are not listed here:
-* they are the entities the appliance's own description declares, known once it is
-* connected, and they are attached to the container as that description is read.
-*/
-function dishwasherContainerCandidate(app, adoptedId) {
-	const name = app.name.length > 0 ? app.name : app.haId;
-	const children = [{
-		childNativeId: `${app.haId}#dishwasher`,
-		name: homeConnectDishwasherEntityName(name),
-		type: DeviceType.Dishwasher,
-		status: "online",
-		metadata: {
-			serialNumber: app.haId,
-			model: app.type
-		},
-		alreadyAdopted: false,
-		adoptedDeviceId: null,
-		capabilities: ["dishwasher"]
-	}];
-	return {
-		childNativeId: app.haId,
-		name,
-		type: DeviceType.Container,
-		status: "online",
-		metadata: {
-			serialNumber: app.haId,
-			model: app.type
-		},
-		alreadyAdopted: adoptedId !== null,
-		adoptedDeviceId: adoptedId,
-		capabilities: [],
-		children
-	};
-}
-function buildHomeConnectCandidates(input) {
-	const out = [];
-	for (const app of input.appliances) {
-		if (deviceTypeForApplianceType(app.type) === null) continue;
-		const adoptedId = input.adopted.get(app.haId) ?? null;
-		out.push(dishwasherContainerCandidate(app, adoptedId));
-	}
-	return out;
-}
-//#endregion
-//#region src/home-connect/home-connect-adoption-provider.ts
-var DEVICES_FILTER = {
-	id: "devices",
-	label: "Devices",
-	isDefault: true
-};
-async function adoptedMapForIntegration(integrationId, listAdopted) {
-	const all = await listAdopted();
-	const map = /* @__PURE__ */ new Map();
-	for (const device of all) if (device.config["system"] === "home-connect" && device.config["brokerId"] === integrationId) {
-		const haId = device.config["haId"];
-		if (typeof haId === "string") map.set(haId, device.id);
-	}
-	return map;
-}
-function buildHomeConnectAdoptionProvider(deps) {
-	const { registry, hasIntegration, listIntegrations, listAdopted, adoptDevice, removeDevice, findDeviceConfig, logger } = deps;
-	async function allCandidatesForIntegration(integrationId) {
-		return buildHomeConnectCandidates({
-			appliances: registry.appliances(integrationId),
-			adopted: await adoptedMapForIntegration(integrationId, listAdopted)
-		});
-	}
-	return {
-		listCandidateFilters: async () => ({ filters: [DEVICES_FILTER] }),
-		listCandidates: async ({ integrationId, page, pageSize }) => {
-			const cands = await allCandidatesForIntegration(integrationId);
-			const start = (page - 1) * pageSize;
-			return {
-				candidates: cands.slice(start, start + pageSize),
-				totalCount: cands.length,
-				page,
-				pageSize
-			};
-		},
-		getCandidate: async ({ integrationId, childNativeId }) => {
-			return (await allCandidatesForIntegration(integrationId)).find((c) => c.childNativeId === childNativeId) ?? null;
-		},
-		getStatus: async () => {
-			try {
-				let candidateCount = 0;
-				for (const integrationId of listIntegrations()) candidateCount += (await allCandidatesForIntegration(integrationId)).length;
-				const adoptedCount = (await listAdopted()).filter((d) => d.config["system"] === "home-connect").length;
-				return {
-					lastDiscoveryAt: Date.now(),
-					candidateCount,
-					adoptedCount,
-					lastError: null
-				};
-			} catch (err) {
-				return {
-					lastDiscoveryAt: null,
-					candidateCount: 0,
-					adoptedCount: 0,
-					lastError: errMsg(err)
-				};
-			}
-		},
-		refresh: async ({ integrationId }) => {
-			const candidateCount = (await allCandidatesForIntegration(integrationId)).length;
-			const adoptedCount = (await adoptedMapForIntegration(integrationId, listAdopted)).size;
-			return {
-				lastDiscoveryAt: Date.now(),
-				candidateCount,
-				adoptedCount,
-				lastError: null
-			};
-		},
-		adopt: async ({ integrationId, childNativeIds, perCandidate }) => {
-			if (!registry.has(integrationId)) throw new Error(`home-connect adopt: integration ${integrationId} not connected`);
-			const appliances = registry.appliances(integrationId);
-			const adopted = [];
-			let failures = 0;
-			for (const haId of childNativeIds) try {
-				const app = appliances.find((a) => a.haId === haId);
-				if (!app) {
-					failures++;
-					continue;
-				}
-				const candidate = buildHomeConnectCandidates({
-					appliances: [app],
-					adopted: /* @__PURE__ */ new Map()
-				})[0];
-				if (!candidate) {
-					failures++;
-					continue;
-				}
-				const name = perCandidate?.[haId]?.name ?? app.name;
-				const { deviceId } = await adoptDevice({
-					haId,
-					integrationId,
-					type: candidate.type,
-					name,
-					applianceType: app.type
-				});
-				adopted.push({
-					childNativeId: haId,
-					parentDeviceId: deviceId
-				});
-			} catch (err) {
-				logger.warn("home-connect adopt failed", { meta: {
-					haId,
-					integrationId,
-					error: errMsg(err)
-				} });
-				failures++;
-			}
-			if (adopted.length === 0 && failures > 0) throw new Error(`home-connect adopt: all ${failures} adopt(s) failed`);
-			return { adopted: adopted.map((a) => ({
-				...a,
-				accessoryDeviceIds: []
-			})) };
-		},
-		release: async ({ camDeviceId }) => {
-			await removeDevice(camDeviceId);
-		},
-		resync: async ({ camDeviceId }) => {
-			const cfg = await findDeviceConfig(camDeviceId);
-			if (!cfg || cfg["system"] !== "home-connect") throw new Error(`home-connect resync: device ${camDeviceId} not found`);
-			const integrationId = String(cfg["brokerId"]);
-			const haId = String(cfg["haId"]);
-			if (!hasIntegration(integrationId)) throw new Error(`home-connect resync: integration ${integrationId} not connected`);
-			if (!registry.appliances(integrationId).some((a) => a.haId === haId)) throw new Error(`home-connect resync: appliance ${haId} no longer present`);
-			return {
-				changed: false,
-				rebuiltChildren: 0
-			};
-		}
-	};
-}
 var HomeConnectModeSchema = _enum(["AES", "TLS"]);
 function isPlainObject$1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -1439,7 +1270,7 @@ function buildHomeConnectFormSchema() {
 		id: "gateway",
 		title: "Home Connect",
 		titleKey: "provider-bosch:home-connect.s_gateway.title",
-		description: "Sign in with your Home Connect account. Paste the address the browser stops on (hcauth://auth/prod?code=…).",
+		description: "Sign in with your Home Connect account. A new tab opens the sign-in page through this hub and finishes on its own.",
 		descriptionKey: "provider-bosch:home-connect.s_gateway.description",
 		columns: 1,
 		fields: [
@@ -1452,6 +1283,7 @@ function buildHomeConnectFormSchema() {
 				providerLabel: "Home Connect",
 				beginAction: "beginSignIn",
 				completeAction: "finishSignIn",
+				claimAction: "claimSignIn",
 				signOutAction: "signOut",
 				accountKey: "accountLabel",
 				countFromKey: "appliances",
@@ -1536,6 +1368,294 @@ function mergeAppliancesForPersist(storedAppliances, fromConnection) {
 	return out;
 }
 //#endregion
+//#region src/home-connect/home-connect-stored-appliance.ts
+function stubDeviceDescriptionObject(row) {
+	return { info: {
+		deviceID: row.haId,
+		deviceType: row.type,
+		model: row.name
+	} };
+}
+function stubDeviceDescription(row) {
+	return JSON.stringify(stubDeviceDescriptionObject(row));
+}
+function serializedDeviceDescription(row) {
+	if (row.deviceDescription === void 0) return stubDeviceDescription(row);
+	if (typeof row.deviceDescription === "string") return row.deviceDescription;
+	return JSON.stringify(row.deviceDescription);
+}
+function isDescriptionRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseLoginDeviceDescription(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return {};
+	try {
+		const parsed = JSON.parse(trimmed);
+		if (isDescriptionRecord(parsed)) return { deviceDescription: parsed };
+	} catch {
+		return {};
+	}
+	return {};
+}
+function listedApplianceFromStored(row) {
+	return {
+		haId: row.haId,
+		name: row.name,
+		type: row.type,
+		connection: {
+			host: row.host,
+			psk: row.psk,
+			mode: row.mode,
+			iv64: row.iv64 ?? "",
+			deviceDescription: serializedDeviceDescription(row)
+		}
+	};
+}
+//#endregion
+//#region src/home-connect/home-connect-sign-in-result.ts
+function homeConnectFinishResult(account) {
+	const { rows, secrets } = splitApplianceSecrets(account.appliances.map((app) => ({
+		haId: app.haId,
+		name: app.name,
+		type: app.type,
+		host: app.connection.host,
+		psk: app.connection.psk,
+		mode: app.connection.mode,
+		...app.connection.iv64.length > 0 ? { iv64: app.connection.iv64 } : {},
+		...parseLoginDeviceDescription(app.connection.deviceDescription)
+	})));
+	return {
+		token: account.token,
+		...account.refresh.length > 0 ? { refresh: account.refresh } : {},
+		accountLabel: account.accountId,
+		appliances: JSON.stringify(rows),
+		applianceSecrets: JSON.stringify(secrets),
+		summary: account.summary
+	};
+}
+//#endregion
+//#region src/home-connect/home-connect-sign-in-proxy.ts
+/**
+* Home Connect signs in through its own identity pages, which end on `hcauth://auth/prod?...`
+* — an address no browser can open. These are the hosts those pages are served from; the
+* proxy reaches nothing else. (Not verified against the live pages: no vendor credentials.)
+*/
+var HOME_CONNECT_LOGIN_HOSTS = ["api.home-connect.com", "singlekey-id.com"];
+var HOME_CONNECT_APP_SCHEME = HOME_CONNECT_REDIRECT_URI.slice(0, HOME_CONNECT_REDIRECT_URI.indexOf("://") + 3);
+var homeConnectSignInClaims = createSignInClaims();
+/** Start an attempt whose `authorizeUrl` is the hub-relative proxied login page. */
+function beginHomeConnectProxiedSignIn(deps) {
+	const nowMs = deps.nowMs ?? (() => Date.now());
+	const published = publishHomeConnectSignIn(homeConnectSignInAttempts, nowMs());
+	if (deps.proxy === null) return published;
+	const entry = openSignInProxy({
+		proxy: deps.proxy,
+		claims: homeConnectSignInClaims,
+		addonId: deps.addonId,
+		attemptId: published.attemptId,
+		authorizeUrl: published.authorizeUrl,
+		hosts: HOME_CONNECT_LOGIN_HOSTS,
+		appScheme: HOME_CONNECT_APP_SCHEME,
+		finish: async (callback) => homeConnectFinishResult(await finishHomeConnectSignIn({
+			attemptId: published.attemptId,
+			callback,
+			nowMs: nowMs()
+		}, homeConnectSignInAttempts, deps.fetchImpl)),
+		nowMs
+	});
+	return {
+		attemptId: published.attemptId,
+		authorizeUrl: entry
+	};
+}
+//#endregion
+//#region src/home-connect/home-connect-discovery.ts
+/** Dishwasher accessory label: `Dishwasher` plus the appliance name. */
+function homeConnectDishwasherEntityName(containerName) {
+	const base = containerName.trim();
+	return base.length > 0 ? `Dishwasher ${base}` : "Dishwasher";
+}
+function deviceTypeForApplianceType(type) {
+	if (type.toLowerCase().includes("dishwasher")) return DeviceType.Container;
+	return null;
+}
+/**
+* The container candidate for one appliance. Its sensor children are not listed here:
+* they are the entities the appliance's own description declares, known once it is
+* connected, and they are attached to the container as that description is read.
+*/
+function dishwasherContainerCandidate(app, adoptedId) {
+	const name = app.name.length > 0 ? app.name : app.haId;
+	const children = [{
+		childNativeId: `${app.haId}#dishwasher`,
+		name: homeConnectDishwasherEntityName(name),
+		type: DeviceType.Dishwasher,
+		status: "online",
+		metadata: {
+			serialNumber: app.haId,
+			model: app.type
+		},
+		alreadyAdopted: false,
+		adoptedDeviceId: null,
+		capabilities: ["dishwasher"]
+	}];
+	return {
+		childNativeId: app.haId,
+		name,
+		type: DeviceType.Container,
+		status: "online",
+		metadata: {
+			serialNumber: app.haId,
+			model: app.type
+		},
+		alreadyAdopted: adoptedId !== null,
+		adoptedDeviceId: adoptedId,
+		capabilities: [],
+		children
+	};
+}
+function buildHomeConnectCandidates(input) {
+	const out = [];
+	for (const app of input.appliances) {
+		if (deviceTypeForApplianceType(app.type) === null) continue;
+		const adoptedId = input.adopted.get(app.haId) ?? null;
+		out.push(dishwasherContainerCandidate(app, adoptedId));
+	}
+	return out;
+}
+//#endregion
+//#region src/home-connect/home-connect-adoption-provider.ts
+var DEVICES_FILTER = {
+	id: "devices",
+	label: "Devices",
+	isDefault: true
+};
+async function adoptedMapForIntegration(integrationId, listAdopted) {
+	const all = await listAdopted();
+	const map = /* @__PURE__ */ new Map();
+	for (const device of all) if (device.config["system"] === "home-connect" && device.config["brokerId"] === integrationId) {
+		const haId = device.config["haId"];
+		if (typeof haId === "string") map.set(haId, device.id);
+	}
+	return map;
+}
+function buildHomeConnectAdoptionProvider(deps) {
+	const { registry, hasIntegration, listIntegrations, listAdopted, adoptDevice, removeDevice, findDeviceConfig, logger } = deps;
+	async function allCandidatesForIntegration(integrationId) {
+		return buildHomeConnectCandidates({
+			appliances: registry.appliances(integrationId),
+			adopted: await adoptedMapForIntegration(integrationId, listAdopted)
+		});
+	}
+	return {
+		listCandidateFilters: async () => ({ filters: [DEVICES_FILTER] }),
+		listCandidates: async ({ integrationId, page, pageSize }) => {
+			const cands = await allCandidatesForIntegration(integrationId);
+			const start = (page - 1) * pageSize;
+			return {
+				candidates: cands.slice(start, start + pageSize),
+				totalCount: cands.length,
+				page,
+				pageSize
+			};
+		},
+		getCandidate: async ({ integrationId, childNativeId }) => {
+			return (await allCandidatesForIntegration(integrationId)).find((c) => c.childNativeId === childNativeId) ?? null;
+		},
+		getStatus: async () => {
+			try {
+				let candidateCount = 0;
+				for (const integrationId of listIntegrations()) candidateCount += (await allCandidatesForIntegration(integrationId)).length;
+				const adoptedCount = (await listAdopted()).filter((d) => d.config["system"] === "home-connect").length;
+				return {
+					lastDiscoveryAt: Date.now(),
+					candidateCount,
+					adoptedCount,
+					lastError: null
+				};
+			} catch (err) {
+				return {
+					lastDiscoveryAt: null,
+					candidateCount: 0,
+					adoptedCount: 0,
+					lastError: errMsg(err)
+				};
+			}
+		},
+		refresh: async ({ integrationId }) => {
+			const candidateCount = (await allCandidatesForIntegration(integrationId)).length;
+			const adoptedCount = (await adoptedMapForIntegration(integrationId, listAdopted)).size;
+			return {
+				lastDiscoveryAt: Date.now(),
+				candidateCount,
+				adoptedCount,
+				lastError: null
+			};
+		},
+		adopt: async ({ integrationId, childNativeIds, perCandidate }) => {
+			if (!registry.has(integrationId)) throw new Error(`home-connect adopt: integration ${integrationId} not connected`);
+			const appliances = registry.appliances(integrationId);
+			const adopted = [];
+			let failures = 0;
+			for (const haId of childNativeIds) try {
+				const app = appliances.find((a) => a.haId === haId);
+				if (!app) {
+					failures++;
+					continue;
+				}
+				const candidate = buildHomeConnectCandidates({
+					appliances: [app],
+					adopted: /* @__PURE__ */ new Map()
+				})[0];
+				if (!candidate) {
+					failures++;
+					continue;
+				}
+				const name = perCandidate?.[haId]?.name ?? app.name;
+				const { deviceId } = await adoptDevice({
+					haId,
+					integrationId,
+					type: candidate.type,
+					name,
+					applianceType: app.type
+				});
+				adopted.push({
+					childNativeId: haId,
+					parentDeviceId: deviceId
+				});
+			} catch (err) {
+				logger.warn("home-connect adopt failed", { meta: {
+					haId,
+					integrationId,
+					error: errMsg(err)
+				} });
+				failures++;
+			}
+			if (adopted.length === 0 && failures > 0) throw new Error(`home-connect adopt: all ${failures} adopt(s) failed`);
+			return { adopted: adopted.map((a) => ({
+				...a,
+				accessoryDeviceIds: []
+			})) };
+		},
+		release: async ({ camDeviceId }) => {
+			await removeDevice(camDeviceId);
+		},
+		resync: async ({ camDeviceId }) => {
+			const cfg = await findDeviceConfig(camDeviceId);
+			if (!cfg || cfg["system"] !== "home-connect") throw new Error(`home-connect resync: device ${camDeviceId} not found`);
+			const integrationId = String(cfg["brokerId"]);
+			const haId = String(cfg["haId"]);
+			if (!hasIntegration(integrationId)) throw new Error(`home-connect resync: integration ${integrationId} not connected`);
+			if (!registry.appliances(integrationId).some((a) => a.haId === haId)) throw new Error(`home-connect resync: appliance ${haId} no longer present`);
+			return {
+				changed: false,
+				rebuiltChildren: 0
+			};
+		}
+	};
+}
+//#endregion
 //#region src/home-connect/home-connect-gateway.ts
 /**
 * Where devices find the client of their integration. A device that started before
@@ -3118,51 +3238,6 @@ function unmapped(appliances) {
 	return appliances.filter((a) => a.mode === "TLS" && entityCountInStoredDescription(a.deviceDescription) === 0).map((a) => a.haId);
 }
 //#endregion
-//#region src/home-connect/home-connect-stored-appliance.ts
-function stubDeviceDescriptionObject(row) {
-	return { info: {
-		deviceID: row.haId,
-		deviceType: row.type,
-		model: row.name
-	} };
-}
-function stubDeviceDescription(row) {
-	return JSON.stringify(stubDeviceDescriptionObject(row));
-}
-function serializedDeviceDescription(row) {
-	if (row.deviceDescription === void 0) return stubDeviceDescription(row);
-	if (typeof row.deviceDescription === "string") return row.deviceDescription;
-	return JSON.stringify(row.deviceDescription);
-}
-function isDescriptionRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function parseLoginDeviceDescription(raw) {
-	const trimmed = raw.trim();
-	if (trimmed.length === 0) return {};
-	try {
-		const parsed = JSON.parse(trimmed);
-		if (isDescriptionRecord(parsed)) return { deviceDescription: parsed };
-	} catch {
-		return {};
-	}
-	return {};
-}
-function listedApplianceFromStored(row) {
-	return {
-		haId: row.haId,
-		name: row.name,
-		type: row.type,
-		connection: {
-			host: row.host,
-			psk: row.psk,
-			mode: row.mode,
-			iv64: row.iv64 ?? "",
-			deviceDescription: serializedDeviceDescription(row)
-		}
-	};
-}
-//#endregion
 //#region src/home-connect/home-connect-integration-manager.ts
 /** Delays between IDDF fetch retries for an appliance that has no entity map; the last repeats. */
 var HOME_CONNECT_IDDF_RETRY_MS = [
@@ -5242,11 +5317,14 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 	};
 	clients = null;
 	reconciler = null;
+	loginProxy = null;
+	loginPlane = null;
 	constructor() {
 		super({});
 	}
 	async onInitialize() {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
+		await this.serveLoginProxy();
 		this.clients = new HomeConnectClientRegistry(this.ctx.logger, { onConnectionUpdated: (integrationId, connection) => {
 			this.persistIntegrationAppliances(integrationId, connection);
 		} });
@@ -5276,32 +5354,22 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 			customActions: homeConnectActions,
 			actionHandlers: {
 				beginSignIn: async () => ({
-					...publishHomeConnectSignIn(homeConnectSignInAttempts, Date.now()),
-					summary: "Open the link in the browser and sign in."
+					...beginHomeConnectProxiedSignIn({
+						proxy: this.loginProxy,
+						addonId: this.ctx.id
+					}),
+					summary: "Open the sign-in page and sign in."
 				}),
-				finishSignIn: async (input) => {
-					const account = await finishHomeConnectSignIn({
-						attemptId: input.attemptId,
-						callback: input.callback,
-						nowMs: Date.now()
-					}, homeConnectSignInAttempts);
-					const { rows, secrets } = splitApplianceSecrets(account.appliances.map((app) => ({
-						haId: app.haId,
-						name: app.name,
-						type: app.type,
-						host: app.connection.host,
-						psk: app.connection.psk,
-						mode: app.connection.mode,
-						...app.connection.iv64.length > 0 ? { iv64: app.connection.iv64 } : {},
-						...parseLoginDeviceDescription(app.connection.deviceDescription)
-					})));
-					return {
-						token: account.token,
-						...account.refresh.length > 0 ? { refresh: account.refresh } : {},
-						accountLabel: account.accountId,
-						appliances: JSON.stringify(rows),
-						applianceSecrets: JSON.stringify(secrets),
-						summary: account.summary
+				finishSignIn: async (input) => homeConnectFinishResult(await finishHomeConnectSignIn({
+					attemptId: input.attemptId,
+					callback: input.callback,
+					nowMs: Date.now()
+				}, homeConnectSignInAttempts)),
+				claimSignIn: async (input) => {
+					const claim = homeConnectSignInClaims.claim(input.attemptId, Date.now());
+					return claim.state === "pending" ? { pending: true } : {
+						pending: false,
+						...claim.result
 					};
 				},
 				signOut: async () => ({
@@ -5311,7 +5379,27 @@ var BoschHomeConnectProviderAddon = class extends BaseDeviceProvider {
 			}
 		};
 	}
+	/** The hub's HTTPS face for the vendor's login pages (D955): admin session only. */
+	async serveLoginProxy() {
+		const proxy = new VendorLoginProxy({
+			addonId: this.ctx.id,
+			logger: this.ctx.logger
+		});
+		try {
+			this.loginPlane = await this.ctx.dataPlane?.serve({
+				prefix: "vendor-login",
+				access: "admin",
+				handler: proxy.handler
+			}) ?? null;
+			if (this.loginPlane !== null) this.loginProxy = proxy;
+		} catch (err) {
+			this.ctx.logger.warn("Home Connect login proxy failed to serve — sign-in falls back to paste", { meta: { error: errMsg(err) } });
+		}
+	}
 	async onShutdown() {
+		await this.loginPlane?.dispose().catch(() => void 0);
+		this.loginPlane = null;
+		this.loginProxy = null;
 		this.reconciler?.stop();
 		this.reconciler = null;
 		try {