@camstack/addon-provider-homeassistant 1.2.16 → 1.2.18

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("./dist-DQdO_V3C.js");
+const require_dist = require("./dist-DuKJzmrJ.js");
 let node_crypto = require("node:crypto");
 let node_zlib = require("node:zlib");
 //#region src/ha-device-source.ts
@@ -7824,11 +7824,39 @@ var HaProviderAddon = class HaProviderAddon extends require_dist.BaseDeviceProvi
 				const haDevices = await this.fetchHaDiscoveredDevices(brokerId);
 				const haDeviceMap = new Map(haDevices.map((d) => [d.haDeviceId, d]));
 				let knownLocations = importLocations === true ? await this.ctx.api.deviceManager.listLocations.query() : [];
+				const existingByStableId = /* @__PURE__ */ new Map();
+				for (const dev of await this.ctx.kernel.devices.getAll()) {
+					if (dev.parentDeviceId !== null) continue;
+					existingByStableId.set(dev.stableId, dev);
+				}
 				const adopted = [];
 				let failures = 0;
+				let reused = 0;
 				for (const haDeviceId of childNativeIds) try {
 					const haDevice = haDeviceMap.get(haDeviceId);
 					const deviceName = (perCandidate?.[haDeviceId])?.name ?? haDevice?.name ?? haDeviceId;
+					const existing = existingByStableId.get(`ha:${brokerId}:dev:${haDeviceId}`);
+					if (existing) {
+						const kids = await this.ctx.kernel.devices.getChildren(existing.id);
+						adopted.push({
+							childNativeId: haDeviceId,
+							parentDeviceId: existing.id,
+							accessoryDeviceIds: kids.map((c) => c.id)
+						});
+						reused += 1;
+						this.ctx.logger.info("ha-adoption: candidate already adopted — returning existing", {
+							tags: {
+								deviceId: existing.id,
+								integrationId
+							},
+							meta: {
+								brokerId,
+								haDeviceId,
+								accessories: kids.length
+							}
+						});
+						continue;
+					}
 					const containerConfig = {
 						system: "homeassistant",
 						brokerId,
@@ -7848,6 +7876,19 @@ var HaProviderAddon = class HaProviderAddon extends require_dist.BaseDeviceProvi
 						parentDeviceId: summary.id,
 						accessoryDeviceIds
 					});
+					this.ctx.logger.info("ha-adoption: candidate adopted", {
+						tags: {
+							deviceId: summary.id,
+							integrationId
+						},
+						meta: {
+							brokerId,
+							haDeviceId,
+							accessories: accessoryDeviceIds.length,
+							index: adopted.length,
+							of: childNativeIds.length
+						}
+					});
 				} catch (err) {
 					failures += 1;
 					this.ctx.logger.warn("ha-adoption: adopt failed for candidate (skipped)", {
@@ -7859,6 +7900,16 @@ var HaProviderAddon = class HaProviderAddon extends require_dist.BaseDeviceProvi
 						}
 					});
 				}
+				this.ctx.logger.info("ha-adoption: adopt batch finished", {
+					tags: { integrationId },
+					meta: {
+						brokerId,
+						requested: childNativeIds.length,
+						created: adopted.length - reused,
+						alreadyAdopted: reused,
+						failed: failures
+					}
+				});
 				if (failures > 0 && adopted.length === 0) throw new Error(`ha-adoption: all ${failures} adopt(s) failed for integration '${integrationId}'`);
 				return { adopted };
 			},

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as temperatureSensorCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as EventCategory, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, G as powerMeterCapability, H as notificationOutputCapability, I as imageCapability, J as pressureSensorCapability, K as prepareNotification, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as tamperCapability, R as lockControlCapability, S as colorCapability, St as url, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as smokeCapability, Y as scriptRunnerCapability, Z as switchCapability, _ as brokerCapability, _t as object, a as EnumSensorDateTimeFormatSchema, at as weatherCapability, b as carbonMonoxideCapability, bt as union, c as addonRoutesCapability, ct as DeviceFeature, d as ambientLightSensorCapability, dt as createEvent, et as updateCapability, f as automationControlCapability, ft as _enum, g as brightnessCapability, gt as number, h as binaryCapability, ht as literal, it as waterHeaterCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceRole, m as bestLocationMatch, mt as discriminatedUnion, n as BaseDeviceProvider, nt as valveCapability, o as TargetSchema, ot as errMsg, p as batteryCapability, pt as array, q as presenceCapability, rt as vibrationCapability, s as accessoriesCapability, t as BaseDevice, tt as vacuumControlCapability, u as alarmPanelCapability, ut as DeviceType, v as buildAddonRouteProvider, vt as record, w as contactCapability, x as climateControlCapability, xt as unknown, y as buttonCapability, yt as string, z as mediaPlayerCapability } from "./dist-B04tcTnS.mjs";
+import { $ as tamperCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as url, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, H as notificationOutputCapability, I as imageCapability, J as presenceCapability, K as powerMeterCapability, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as switchCapability, R as lockControlCapability, S as colorCapability, St as unknown, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as scriptRunnerCapability, Y as pressureSensorCapability, Z as smokeCapability, _ as brokerCapability, _t as number, a as EnumSensorDateTimeFormatSchema, at as waterHeaterCapability, b as carbonMonoxideCapability, bt as string, c as addonRoutesCapability, d as ambientLightSensorCapability, dt as DeviceType, et as temperatureSensorCapability, f as automationControlCapability, ft as createEvent, g as brightnessCapability, gt as literal, h as binaryCapability, ht as discriminatedUnion, it as vibrationCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceFeature, m as bestLocationMatch, mt as array, n as BaseDeviceProvider, nt as vacuumControlCapability, o as TargetSchema, ot as weatherCapability, p as batteryCapability, pt as _enum, q as prepareNotification, rt as valveCapability, s as accessoriesCapability, st as errMsg, t as BaseDevice, tt as updateCapability, u as alarmPanelCapability, ut as DeviceRole, v as buildAddonRouteProvider, vt as object, w as contactCapability, wt as EventCategory, x as climateControlCapability, xt as union, y as buttonCapability, yt as record, z as mediaPlayerCapability } from "./dist-UfT_fD3-.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-device-source.ts
@@ -7823,11 +7823,39 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				const haDevices = await this.fetchHaDiscoveredDevices(brokerId);
 				const haDeviceMap = new Map(haDevices.map((d) => [d.haDeviceId, d]));
 				let knownLocations = importLocations === true ? await this.ctx.api.deviceManager.listLocations.query() : [];
+				const existingByStableId = /* @__PURE__ */ new Map();
+				for (const dev of await this.ctx.kernel.devices.getAll()) {
+					if (dev.parentDeviceId !== null) continue;
+					existingByStableId.set(dev.stableId, dev);
+				}
 				const adopted = [];
 				let failures = 0;
+				let reused = 0;
 				for (const haDeviceId of childNativeIds) try {
 					const haDevice = haDeviceMap.get(haDeviceId);
 					const deviceName = (perCandidate?.[haDeviceId])?.name ?? haDevice?.name ?? haDeviceId;
+					const existing = existingByStableId.get(`ha:${brokerId}:dev:${haDeviceId}`);
+					if (existing) {
+						const kids = await this.ctx.kernel.devices.getChildren(existing.id);
+						adopted.push({
+							childNativeId: haDeviceId,
+							parentDeviceId: existing.id,
+							accessoryDeviceIds: kids.map((c) => c.id)
+						});
+						reused += 1;
+						this.ctx.logger.info("ha-adoption: candidate already adopted — returning existing", {
+							tags: {
+								deviceId: existing.id,
+								integrationId
+							},
+							meta: {
+								brokerId,
+								haDeviceId,
+								accessories: kids.length
+							}
+						});
+						continue;
+					}
 					const containerConfig = {
 						system: "homeassistant",
 						brokerId,
@@ -7847,6 +7875,19 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 						parentDeviceId: summary.id,
 						accessoryDeviceIds
 					});
+					this.ctx.logger.info("ha-adoption: candidate adopted", {
+						tags: {
+							deviceId: summary.id,
+							integrationId
+						},
+						meta: {
+							brokerId,
+							haDeviceId,
+							accessories: accessoryDeviceIds.length,
+							index: adopted.length,
+							of: childNativeIds.length
+						}
+					});
 				} catch (err) {
 					failures += 1;
 					this.ctx.logger.warn("ha-adoption: adopt failed for candidate (skipped)", {
@@ -7858,6 +7899,16 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 						}
 					});
 				}
+				this.ctx.logger.info("ha-adoption: adopt batch finished", {
+					tags: { integrationId },
+					meta: {
+						brokerId,
+						requested: childNativeIds.length,
+						created: adopted.length - reused,
+						alreadyAdopted: reused,
+						failed: failures
+					}
+				});
 				if (failures > 0 && adopted.length === 0) throw new Error(`ha-adoption: all ${failures} adopt(s) failed for integration '${integrationId}'`);
 				return { adopted };
 			},

package/dist/{dist-DQdO_V3C.js → dist-DuKJzmrJ.js}

@@ -7218,6 +7218,104 @@ object({
 	})
 });
 /**
+* Adoption job — the background form of `device-adoption.adopt`.
+*
+* ## Why this exists
+*
+* `adopt({childNativeIds: [...]})` materialises one CamStack device per
+* candidate PLUS every accessory child, and the whole array shares ONE UDS
+* request deadline (60s). Measured on the live hub against Home Assistant:
+* each device the kernel creates costs ~450 ms — `devices.create` pre-seeds
+* meta with up to eleven SEQUENTIAL round trips (`setName`, `setType`,
+* `setRole`, … `persistConfig`) before the class is constructed — and an
+* accessory child costs the same as its parent. So the real unit of work is
+* the CHILD, not the candidate:
+*
+* - 25 candidates averaging 6 children  → ~150 devices → **>60s, times out**
+* - ONE candidate with 217 children     → ~217 devices → **>60s, times out**
+*
+* That second line is why this is a job and not a smaller batch. No chunking,
+* no bounded concurrency over candidates and no per-call tuning can fix a
+* shape where **N=1 already exceeds the deadline** — the count that blows the
+* budget is the source system's accessory fan-out, which the operator does not
+* choose and cannot see. A design that only works below some N is the same bug
+* deferred.
+*
+* ## What the timeout did NOT do
+*
+* It did not stop the work. The UDS deadline ends the CALLER's wait; the
+* provider's loop runs to completion. Measured: a 25-candidate adopt that
+* "failed" at 60s had adopted 17 by 87s and all 25 by ~130s. The operator saw
+* an error and had no way to learn that. Every field below exists so that
+* question has an answer.
+*
+* ## Idempotency
+*
+* Jobs are in-RAM; a restart forgets them. That is safe here because adoption
+* is keyed by a stable id (`ha:<broker>:dev:<nativeId>` and equivalents), so
+* re-running a job re-adopts nothing: an already-adopted candidate is SKIPPED
+* by the engine before any provider call and lands in `alreadyAdopted`. It is
+* never a duplicate device, and never an error the operator has to interpret.
+*/
+var AdoptionJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+/**
+* Per-candidate result. Every candidate the job was asked to adopt ends in
+* exactly one of these buckets — there is no silent drop, and the operator can
+* always answer "which of my 25 landed?".
+*
+* - `adopted` — created now by this job.
+* - `already-adopted` — a device for this candidate existed before the job
+*   reached it (a re-run, or a retry after a timeout). Not an error.
+* - `failed` — the provider threw; `error` carries the message.
+* - `cancelled` — the operator cancelled before this candidate was reached.
+*/
+var AdoptionOutcomeSchema = _enum([
+	"adopted",
+	"already-adopted",
+	"failed",
+	"cancelled"
+]);
+var AdoptionCandidateResultSchema = object({
+	childNativeId: string(),
+	outcome: AdoptionOutcomeSchema,
+	/** The materialised parent device id — null for `failed` / `cancelled`. */
+	parentDeviceId: number().int().nonnegative().nullable(),
+	/** Accessory children created for this candidate. */
+	accessoryCount: number().int().nonnegative(),
+	/** Failure message; null unless `outcome === 'failed'`. */
+	error: string().nullable()
+});
+var AdoptionJobSchema = object({
+	jobId: string(),
+	/** The integration provider this job adopts through (the `addonId` pin). */
+	addonId: string(),
+	integrationId: string(),
+	state: AdoptionJobStateSchema,
+	/** Candidates the job was asked to adopt. Known up front, so never null. */
+	total: number().int().nonnegative(),
+	/** Candidates that have reached a terminal bucket. */
+	processed: number().int().nonnegative(),
+	adopted: number().int().nonnegative(),
+	alreadyAdopted: number().int().nonnegative(),
+	failed: number().int().nonnegative(),
+	/** Accessory child devices created across every candidate — the real unit
+	*  of work, surfaced so a slow job is legible rather than mysterious. */
+	accessoriesCreated: number().int().nonnegative(),
+	/** The candidate currently being adopted; null when idle or finished. */
+	currentChildNativeId: string().nullable(),
+	/** One entry per candidate, in the order they were processed. */
+	results: array(AdoptionCandidateResultSchema).readonly(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	/** Set only when the job itself broke (not a per-candidate failure). */
+	error: string().nullable()
+});
+/**
 * Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
 * pipeline functions an operator thinks in terms of.
 *
@@ -12289,6 +12387,15 @@ method(object({
 }), method(ReleaseInputSchema.extend({ addonId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(AdoptInputSchema.extend({ addonId: string() }), object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	integrationId: string().optional()
+}), array(AdoptionJobSchema).readonly(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(ResyncInputSchema, ResyncResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -15210,6 +15317,65 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15242,7 +15408,13 @@ var OauthIntegrationDescriptorSchema = object({
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
 	hubUrl: string().optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -20451,6 +20623,37 @@ onColorChanged: { data: object({
 	*/
 	runtimeState: ColorStatusSchema
 };
+var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
+	object({
+		outcome: literal("validated"),
+		/** Round-trip of the sign-in, when the provider measured it. */
+		latencyMs: number().nonnegative().optional(),
+		/** Optional human detail worth showing next to the tick
+		*  ("3 devices visible on this account"). */
+		detail: string().optional()
+	}).strict(),
+	object({
+		outcome: literal("rejected"),
+		error: string()
+	}).strict(),
+	object({
+		outcome: literal("inconclusive"),
+		error: string()
+	}).strict()
+]);
+var ConnectionTestInputSchema = object({ 
+/** Candidate integration settings, exactly as the create form collected them. */
+settings: record(string(), unknown()) });
+/**
+* What the provider's test actually DOES, so the UI can say it in words before
+* the operator presses the button ("Signs in to the Dreo cloud"). Purely
+* descriptive — it never changes routing.
+*/
+var ConnectionTestDescriptorSchema = object({ label: string() });
+method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 /**
 * Upstream-system connectivity sensor — distinct from `device-status`,
 * which is the kernel-managed online/offline flag for the device's
@@ -21812,15 +22015,57 @@ var AvailableIntegrationTypeSchema = object({
 	*  flow can import (e.g. HA areas). Drives the adopt modal's "import
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
+	/**
+	* True when this integration DECLARES a pre-creation test (the
+	* `connection-test` cap, or a broker whose settings it stores). Drives the
+	* Test button: an integration that cannot be tested must say so up front
+	* rather than offering a button that always answers the same nonsense.
+	*/
+	canTest: boolean(),
 	existingInstances: array(object({
 		id: string(),
 		name: string()
 	})),
 	canAdd: boolean()
 });
+/**
+* Why a test could not be answered as a plain boolean.
+*
+* `success` alone collapsed four different situations into one red box, and the
+* one that mattered most — "nobody ever asked the remote anything" — looked
+* exactly like "the remote said no". The status is the discriminator:
+*
+*   - `validated`    — a provider-declared test ran and the remote ACCEPTED.
+*   - `rejected`     — a provider-declared test ran and the remote REFUSED.
+*                      The only status that blocks `integrations.create`.
+*   - `inconclusive` — a test IS declared but could not complete (timeout,
+*                      DNS, 5xx). Nothing was observed; not a failure.
+*   - `unsupported`  — this integration declares NO test. Nothing was
+*                      observed either; not a failure, and not a pass.
+*
+* `unsupported` and `inconclusive` both carry `success: false` so an older
+* client can never read them as a green tick, and both carry an `error` string
+* that SAYS the test did not run rather than inventing a failure.
+*/
+var TestConnectionStatusEnum = _enum([
+	"validated",
+	"rejected",
+	"inconclusive",
+	"unsupported"
+]);
 var TestConnectionResultSchema$1 = object({
+	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
-	error: string().optional()
+	error: string().optional(),
+	/** Optional for wire back-compat with clients built before the tri-state;
+	*  the server always sets it. */
+	status: TestConnectionStatusEnum.optional(),
+	/** Addon id whose declared test answered — `null` when none did. Lets the UI
+	*  attribute a result instead of blaming "the integration". */
+	testedBy: string().nullable().optional(),
+	latencyMs: number().nonnegative().optional(),
+	/** Human detail from a `validated` result ("3 devices on this account"). */
+	detail: string().optional()
 });
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
@@ -28043,6 +28288,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"connectionTest.describeTest": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"connectionTest.testSettings": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"consumables.reset": {
 		capName: "consumables",
 		capScope: "device",
@@ -28433,6 +28690,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionCancelJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.adoptionListCandidateFilters": {
 		capName: "device-manager",
 		capScope: "system",
@@ -28445,6 +28708,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.adoptionListJobs": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.adoptionRefresh": {
 		capName: "device-manager",
 		capScope: "system",
@@ -28463,6 +28732,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionStartJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.allocateDeviceId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33477,6 +33752,12 @@ Object.defineProperty(exports, "numericSensorCapability", {
 		return numericSensorCapability;
 	}
 });
+Object.defineProperty(exports, "oauthIntegrationCapability", {
+	enumerable: true,
+	get: function() {
+		return oauthIntegrationCapability;
+	}
+});
 Object.defineProperty(exports, "object", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-B04tcTnS.mjs → dist-UfT_fD3-.mjs}

@@ -7218,6 +7218,104 @@ object({
 	})
 });
 /**
+* Adoption job — the background form of `device-adoption.adopt`.
+*
+* ## Why this exists
+*
+* `adopt({childNativeIds: [...]})` materialises one CamStack device per
+* candidate PLUS every accessory child, and the whole array shares ONE UDS
+* request deadline (60s). Measured on the live hub against Home Assistant:
+* each device the kernel creates costs ~450 ms — `devices.create` pre-seeds
+* meta with up to eleven SEQUENTIAL round trips (`setName`, `setType`,
+* `setRole`, … `persistConfig`) before the class is constructed — and an
+* accessory child costs the same as its parent. So the real unit of work is
+* the CHILD, not the candidate:
+*
+* - 25 candidates averaging 6 children  → ~150 devices → **>60s, times out**
+* - ONE candidate with 217 children     → ~217 devices → **>60s, times out**
+*
+* That second line is why this is a job and not a smaller batch. No chunking,
+* no bounded concurrency over candidates and no per-call tuning can fix a
+* shape where **N=1 already exceeds the deadline** — the count that blows the
+* budget is the source system's accessory fan-out, which the operator does not
+* choose and cannot see. A design that only works below some N is the same bug
+* deferred.
+*
+* ## What the timeout did NOT do
+*
+* It did not stop the work. The UDS deadline ends the CALLER's wait; the
+* provider's loop runs to completion. Measured: a 25-candidate adopt that
+* "failed" at 60s had adopted 17 by 87s and all 25 by ~130s. The operator saw
+* an error and had no way to learn that. Every field below exists so that
+* question has an answer.
+*
+* ## Idempotency
+*
+* Jobs are in-RAM; a restart forgets them. That is safe here because adoption
+* is keyed by a stable id (`ha:<broker>:dev:<nativeId>` and equivalents), so
+* re-running a job re-adopts nothing: an already-adopted candidate is SKIPPED
+* by the engine before any provider call and lands in `alreadyAdopted`. It is
+* never a duplicate device, and never an error the operator has to interpret.
+*/
+var AdoptionJobStateSchema = _enum([
+	"running",
+	"done",
+	"failed",
+	"cancelled"
+]);
+/**
+* Per-candidate result. Every candidate the job was asked to adopt ends in
+* exactly one of these buckets — there is no silent drop, and the operator can
+* always answer "which of my 25 landed?".
+*
+* - `adopted` — created now by this job.
+* - `already-adopted` — a device for this candidate existed before the job
+*   reached it (a re-run, or a retry after a timeout). Not an error.
+* - `failed` — the provider threw; `error` carries the message.
+* - `cancelled` — the operator cancelled before this candidate was reached.
+*/
+var AdoptionOutcomeSchema = _enum([
+	"adopted",
+	"already-adopted",
+	"failed",
+	"cancelled"
+]);
+var AdoptionCandidateResultSchema = object({
+	childNativeId: string(),
+	outcome: AdoptionOutcomeSchema,
+	/** The materialised parent device id — null for `failed` / `cancelled`. */
+	parentDeviceId: number().int().nonnegative().nullable(),
+	/** Accessory children created for this candidate. */
+	accessoryCount: number().int().nonnegative(),
+	/** Failure message; null unless `outcome === 'failed'`. */
+	error: string().nullable()
+});
+var AdoptionJobSchema = object({
+	jobId: string(),
+	/** The integration provider this job adopts through (the `addonId` pin). */
+	addonId: string(),
+	integrationId: string(),
+	state: AdoptionJobStateSchema,
+	/** Candidates the job was asked to adopt. Known up front, so never null. */
+	total: number().int().nonnegative(),
+	/** Candidates that have reached a terminal bucket. */
+	processed: number().int().nonnegative(),
+	adopted: number().int().nonnegative(),
+	alreadyAdopted: number().int().nonnegative(),
+	failed: number().int().nonnegative(),
+	/** Accessory child devices created across every candidate — the real unit
+	*  of work, surfaced so a slow job is legible rather than mysterious. */
+	accessoriesCreated: number().int().nonnegative(),
+	/** The candidate currently being adopted; null when idle or finished. */
+	currentChildNativeId: string().nullable(),
+	/** One entry per candidate, in the order they were processed. */
+	results: array(AdoptionCandidateResultSchema).readonly(),
+	startedAt: number(),
+	finishedAt: number().nullable(),
+	/** Set only when the job itself broke (not a per-candidate failure). */
+	error: string().nullable()
+});
+/**
 * Per-camera FUNCTION SWITCHES — the one coherent on/off surface over the
 * pipeline functions an operator thinks in terms of.
 *
@@ -12289,6 +12387,15 @@ method(object({
 }), method(ReleaseInputSchema.extend({ addonId: string() }), _void(), {
 	kind: "mutation",
 	auth: "admin"
+}), method(AdoptInputSchema.extend({ addonId: string() }), object({ jobId: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({
+	addonId: string(),
+	integrationId: string().optional()
+}), array(AdoptionJobSchema).readonly(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(ResyncInputSchema, ResyncResultSchema, {
 	kind: "mutation",
 	auth: "admin"
@@ -15210,6 +15317,65 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15242,7 +15408,13 @@ var OauthIntegrationDescriptorSchema = object({
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
 	hubUrl: string().optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -20451,6 +20623,37 @@ onColorChanged: { data: object({
 	*/
 	runtimeState: ColorStatusSchema
 };
+var ConnectionTestOutcomeSchema = discriminatedUnion("outcome", [
+	object({
+		outcome: literal("validated"),
+		/** Round-trip of the sign-in, when the provider measured it. */
+		latencyMs: number().nonnegative().optional(),
+		/** Optional human detail worth showing next to the tick
+		*  ("3 devices visible on this account"). */
+		detail: string().optional()
+	}).strict(),
+	object({
+		outcome: literal("rejected"),
+		error: string()
+	}).strict(),
+	object({
+		outcome: literal("inconclusive"),
+		error: string()
+	}).strict()
+]);
+var ConnectionTestInputSchema = object({ 
+/** Candidate integration settings, exactly as the create form collected them. */
+settings: record(string(), unknown()) });
+/**
+* What the provider's test actually DOES, so the UI can say it in words before
+* the operator presses the button ("Signs in to the Dreo cloud"). Purely
+* descriptive — it never changes routing.
+*/
+var ConnectionTestDescriptorSchema = object({ label: string() });
+method(ConnectionTestInputSchema, ConnectionTestOutcomeSchema, {
+	kind: "mutation",
+	auth: "admin"
+}), method(_void(), ConnectionTestDescriptorSchema, { auth: "admin" });
 /**
 * Upstream-system connectivity sensor — distinct from `device-status`,
 * which is the kernel-managed online/offline flag for the device's
@@ -21812,15 +22015,57 @@ var AvailableIntegrationTypeSchema = object({
 	*  flow can import (e.g. HA areas). Drives the adopt modal's "import
 	*  locations" checkbox. Provider-declared in the addon manifest. */
 	supportsLocationImport: boolean(),
+	/**
+	* True when this integration DECLARES a pre-creation test (the
+	* `connection-test` cap, or a broker whose settings it stores). Drives the
+	* Test button: an integration that cannot be tested must say so up front
+	* rather than offering a button that always answers the same nonsense.
+	*/
+	canTest: boolean(),
 	existingInstances: array(object({
 		id: string(),
 		name: string()
 	})),
 	canAdd: boolean()
 });
+/**
+* Why a test could not be answered as a plain boolean.
+*
+* `success` alone collapsed four different situations into one red box, and the
+* one that mattered most — "nobody ever asked the remote anything" — looked
+* exactly like "the remote said no". The status is the discriminator:
+*
+*   - `validated`    — a provider-declared test ran and the remote ACCEPTED.
+*   - `rejected`     — a provider-declared test ran and the remote REFUSED.
+*                      The only status that blocks `integrations.create`.
+*   - `inconclusive` — a test IS declared but could not complete (timeout,
+*                      DNS, 5xx). Nothing was observed; not a failure.
+*   - `unsupported`  — this integration declares NO test. Nothing was
+*                      observed either; not a failure, and not a pass.
+*
+* `unsupported` and `inconclusive` both carry `success: false` so an older
+* client can never read them as a green tick, and both carry an `error` string
+* that SAYS the test did not run rather than inventing a failure.
+*/
+var TestConnectionStatusEnum = _enum([
+	"validated",
+	"rejected",
+	"inconclusive",
+	"unsupported"
+]);
 var TestConnectionResultSchema$1 = object({
+	/** True ONLY for `validated`. Never true for a test that did not run. */
 	success: boolean(),
-	error: string().optional()
+	error: string().optional(),
+	/** Optional for wire back-compat with clients built before the tri-state;
+	*  the server always sets it. */
+	status: TestConnectionStatusEnum.optional(),
+	/** Addon id whose declared test answered — `null` when none did. Lets the UI
+	*  attribute a result instead of blaming "the integration". */
+	testedBy: string().nullable().optional(),
+	latencyMs: number().nonnegative().optional(),
+	/** Human detail from a `validated` result ("3 devices on this account"). */
+	detail: string().optional()
 });
 var CreateIntegrationInputSchema = object({
 	addonId: string(),
@@ -28043,6 +28288,18 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"connectionTest.describeTest": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"connectionTest.testSettings": {
+		capName: "connection-test",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"consumables.reset": {
 		capName: "consumables",
 		capScope: "device",
@@ -28433,6 +28690,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionCancelJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.adoptionListCandidateFilters": {
 		capName: "device-manager",
 		capScope: "system",
@@ -28445,6 +28708,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"deviceManager.adoptionListJobs": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"deviceManager.adoptionRefresh": {
 		capName: "device-manager",
 		capScope: "system",
@@ -28463,6 +28732,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"deviceManager.adoptionStartJob": {
+		capName: "device-manager",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"deviceManager.allocateDeviceId": {
 		capName: "device-manager",
 		capScope: "system",
@@ -33141,4 +33416,4 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 	return best;
 }
 //#endregion
-export { temperatureSensorCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, EventCategory as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, powerMeterCapability as G, notificationOutputCapability as H, imageCapability as I, pressureSensorCapability as J, prepareNotification as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, tamperCapability as Q, lockControlCapability as R, colorCapability as S, url as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, smokeCapability as X, scriptRunnerCapability as Y, switchCapability as Z, brokerCapability as _, object as _t, EnumSensorDateTimeFormatSchema as a, weatherCapability as at, carbonMonoxideCapability as b, union as bt, addonRoutesCapability as c, DeviceFeature as ct, ambientLightSensorCapability as d, createEvent as dt, updateCapability as et, automationControlCapability as f, _enum as ft, brightnessCapability as g, number as gt, binaryCapability as h, literal as ht, CameraSwitchIdSchema as i, waterHeaterCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceRole as lt, bestLocationMatch as m, discriminatedUnion as mt, BaseDeviceProvider as n, valveCapability as nt, TargetSchema as o, errMsg as ot, batteryCapability as p, array as pt, presenceCapability as q, COCO_TO_MACRO as r, vibrationCapability as rt, accessoriesCapability as s, BaseAddon as st, BaseDevice as t, vacuumControlCapability as tt, alarmPanelCapability as u, DeviceType as ut, buildAddonRouteProvider as v, record as vt, contactCapability as w, climateControlCapability as x, unknown as xt, buttonCapability as y, string as yt, mediaPlayerCapability as z };
+export { tamperCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, url as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, oauthIntegrationCapability as G, notificationOutputCapability as H, imageCapability as I, presenceCapability as J, powerMeterCapability as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, switchCapability as Q, lockControlCapability as R, colorCapability as S, unknown as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, scriptRunnerCapability as X, pressureSensorCapability as Y, smokeCapability as Z, brokerCapability as _, number as _t, EnumSensorDateTimeFormatSchema as a, waterHeaterCapability as at, carbonMonoxideCapability as b, string as bt, addonRoutesCapability as c, BaseAddon as ct, ambientLightSensorCapability as d, DeviceType as dt, temperatureSensorCapability as et, automationControlCapability as f, createEvent as ft, brightnessCapability as g, literal as gt, binaryCapability as h, discriminatedUnion as ht, CameraSwitchIdSchema as i, vibrationCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceFeature as lt, bestLocationMatch as m, array as mt, BaseDeviceProvider as n, vacuumControlCapability as nt, TargetSchema as o, weatherCapability as ot, batteryCapability as p, _enum as pt, prepareNotification as q, COCO_TO_MACRO as r, valveCapability as rt, accessoriesCapability as s, errMsg as st, BaseDevice as t, updateCapability as tt, alarmPanelCapability as u, DeviceRole as ut, buildAddonRouteProvider as v, object as vt, contactCapability as w, EventCategory as wt, climateControlCapability as x, union as xt, buttonCapability as y, record as yt, mediaPlayerCapability as z };

package/dist/ha-export/ha-export.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#endregion
-const require_dist = require("../dist-DQdO_V3C.js");
+const require_dist = require("../dist-DuKJzmrJ.js");
 let node_crypto = require("node:crypto");
 //#region src/ha-export/topics.ts
 /**
@@ -871,6 +871,40 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
+* component actually calls. `category:system [create]` was rejected: it would
+* hand `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		}
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1374,12 +1408,10 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1387,33 +1419,40 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: require_dist.deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: require_dist.addonRoutesCapability,
-			provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: require_dist.deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: require_dist.addonRoutesCapability,
+				provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: require_dist.oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as EventCategory, O as deviceExportCapability, c as addonRoutesCapability, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, st as BaseAddon, v as buildAddonRouteProvider, yt as string } from "../dist-B04tcTnS.mjs";
+import { G as oauthIntegrationCapability, O as deviceExportCapability, bt as string, c as addonRoutesCapability, ct as BaseAddon, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, v as buildAddonRouteProvider, wt as EventCategory } from "../dist-UfT_fD3-.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/ha-export/topics.ts
 /**
@@ -866,6 +866,40 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
+* component actually calls. `category:system [create]` was rejected: it would
+* hand `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		}
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1369,12 +1403,10 @@ var HaExportAddon = class extends BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1382,33 +1414,40 @@ var HaExportAddon = class extends BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: addonRoutesCapability,
-			provider: buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-homeassistant",
-  "version": "1.2.16",
+  "version": "1.2.18",
   "description": "Home Assistant device provider addon for CamStack",
   "keywords": [
     "camstack",
@@ -106,6 +106,9 @@
           },
           {
             "name": "addon-routes"
+          },
+          {
+            "name": "oauth-integration"
           }
         ]
       }