@camstack/addon-provider-homeassistant 1.2.17 → 1.2.18

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("./dist-DIa87XAf.js");
+const require_dist = require("./dist-DuKJzmrJ.js");
 let node_crypto = require("node:crypto");
 let node_zlib = require("node:zlib");
 //#region src/ha-device-source.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as temperatureSensorCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as EventCategory, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, G as powerMeterCapability, H as notificationOutputCapability, I as imageCapability, J as pressureSensorCapability, K as prepareNotification, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as tamperCapability, R as lockControlCapability, S as colorCapability, St as url, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as smokeCapability, Y as scriptRunnerCapability, Z as switchCapability, _ as brokerCapability, _t as object, a as EnumSensorDateTimeFormatSchema, at as weatherCapability, b as carbonMonoxideCapability, bt as union, c as addonRoutesCapability, ct as DeviceFeature, d as ambientLightSensorCapability, dt as createEvent, et as updateCapability, f as automationControlCapability, ft as _enum, g as brightnessCapability, gt as number, h as binaryCapability, ht as literal, it as waterHeaterCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceRole, m as bestLocationMatch, mt as discriminatedUnion, n as BaseDeviceProvider, nt as valveCapability, o as TargetSchema, ot as errMsg, p as batteryCapability, pt as array, q as presenceCapability, rt as vibrationCapability, s as accessoriesCapability, t as BaseDevice, tt as vacuumControlCapability, u as alarmPanelCapability, ut as DeviceType, v as buildAddonRouteProvider, vt as record, w as contactCapability, x as climateControlCapability, xt as unknown, y as buttonCapability, yt as string, z as mediaPlayerCapability } from "./dist-reK3lvnr.mjs";
+import { $ as tamperCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as url, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, H as notificationOutputCapability, I as imageCapability, J as presenceCapability, K as powerMeterCapability, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as switchCapability, R as lockControlCapability, S as colorCapability, St as unknown, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as scriptRunnerCapability, Y as pressureSensorCapability, Z as smokeCapability, _ as brokerCapability, _t as number, a as EnumSensorDateTimeFormatSchema, at as waterHeaterCapability, b as carbonMonoxideCapability, bt as string, c as addonRoutesCapability, d as ambientLightSensorCapability, dt as DeviceType, et as temperatureSensorCapability, f as automationControlCapability, ft as createEvent, g as brightnessCapability, gt as literal, h as binaryCapability, ht as discriminatedUnion, it as vibrationCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceFeature, m as bestLocationMatch, mt as array, n as BaseDeviceProvider, nt as vacuumControlCapability, o as TargetSchema, ot as weatherCapability, p as batteryCapability, pt as _enum, q as prepareNotification, rt as valveCapability, s as accessoriesCapability, st as errMsg, t as BaseDevice, tt as updateCapability, u as alarmPanelCapability, ut as DeviceRole, v as buildAddonRouteProvider, vt as object, w as contactCapability, wt as EventCategory, x as climateControlCapability, xt as union, y as buttonCapability, yt as record, z as mediaPlayerCapability } from "./dist-UfT_fD3-.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-device-source.ts

package/dist/{dist-DIa87XAf.js → dist-DuKJzmrJ.js}

@@ -15317,6 +15317,65 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15349,7 +15408,13 @@ var OauthIntegrationDescriptorSchema = object({
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
 	hubUrl: string().optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -33687,6 +33752,12 @@ Object.defineProperty(exports, "numericSensorCapability", {
 		return numericSensorCapability;
 	}
 });
+Object.defineProperty(exports, "oauthIntegrationCapability", {
+	enumerable: true,
+	get: function() {
+		return oauthIntegrationCapability;
+	}
+});
 Object.defineProperty(exports, "object", {
 	enumerable: true,
 	get: function() {

package/dist/{dist-reK3lvnr.mjs → dist-UfT_fD3-.mjs}

@@ -15317,6 +15317,65 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15349,7 +15408,13 @@ var OauthIntegrationDescriptorSchema = object({
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
 	hubUrl: string().optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -33351,4 +33416,4 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 	return best;
 }
 //#endregion
-export { temperatureSensorCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, EventCategory as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, powerMeterCapability as G, notificationOutputCapability as H, imageCapability as I, pressureSensorCapability as J, prepareNotification as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, tamperCapability as Q, lockControlCapability as R, colorCapability as S, url as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, smokeCapability as X, scriptRunnerCapability as Y, switchCapability as Z, brokerCapability as _, object as _t, EnumSensorDateTimeFormatSchema as a, weatherCapability as at, carbonMonoxideCapability as b, union as bt, addonRoutesCapability as c, DeviceFeature as ct, ambientLightSensorCapability as d, createEvent as dt, updateCapability as et, automationControlCapability as f, _enum as ft, brightnessCapability as g, number as gt, binaryCapability as h, literal as ht, CameraSwitchIdSchema as i, waterHeaterCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceRole as lt, bestLocationMatch as m, discriminatedUnion as mt, BaseDeviceProvider as n, valveCapability as nt, TargetSchema as o, errMsg as ot, batteryCapability as p, array as pt, presenceCapability as q, COCO_TO_MACRO as r, vibrationCapability as rt, accessoriesCapability as s, BaseAddon as st, BaseDevice as t, vacuumControlCapability as tt, alarmPanelCapability as u, DeviceType as ut, buildAddonRouteProvider as v, record as vt, contactCapability as w, climateControlCapability as x, unknown as xt, buttonCapability as y, string as yt, mediaPlayerCapability as z };
+export { tamperCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, url as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, oauthIntegrationCapability as G, notificationOutputCapability as H, imageCapability as I, presenceCapability as J, powerMeterCapability as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, switchCapability as Q, lockControlCapability as R, colorCapability as S, unknown as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, scriptRunnerCapability as X, pressureSensorCapability as Y, smokeCapability as Z, brokerCapability as _, number as _t, EnumSensorDateTimeFormatSchema as a, waterHeaterCapability as at, carbonMonoxideCapability as b, string as bt, addonRoutesCapability as c, BaseAddon as ct, ambientLightSensorCapability as d, DeviceType as dt, temperatureSensorCapability as et, automationControlCapability as f, createEvent as ft, brightnessCapability as g, literal as gt, binaryCapability as h, discriminatedUnion as ht, CameraSwitchIdSchema as i, vibrationCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceFeature as lt, bestLocationMatch as m, array as mt, BaseDeviceProvider as n, vacuumControlCapability as nt, TargetSchema as o, weatherCapability as ot, batteryCapability as p, _enum as pt, prepareNotification as q, COCO_TO_MACRO as r, valveCapability as rt, accessoriesCapability as s, errMsg as st, BaseDevice as t, updateCapability as tt, alarmPanelCapability as u, DeviceRole as ut, buildAddonRouteProvider as v, object as vt, contactCapability as w, EventCategory as wt, climateControlCapability as x, union as xt, buttonCapability as y, record as yt, mediaPlayerCapability as z };

package/dist/ha-export/ha-export.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#endregion
-const require_dist = require("../dist-DIa87XAf.js");
+const require_dist = require("../dist-DuKJzmrJ.js");
 let node_crypto = require("node:crypto");
 //#region src/ha-export/topics.ts
 /**
@@ -871,6 +871,40 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
+* component actually calls. `category:system [create]` was rejected: it would
+* hand `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		}
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1374,12 +1408,10 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1387,33 +1419,40 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: require_dist.deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: require_dist.addonRoutesCapability,
-			provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: require_dist.deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: require_dist.addonRoutesCapability,
+				provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: require_dist.oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as EventCategory, O as deviceExportCapability, c as addonRoutesCapability, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, st as BaseAddon, v as buildAddonRouteProvider, yt as string } from "../dist-reK3lvnr.mjs";
+import { G as oauthIntegrationCapability, O as deviceExportCapability, bt as string, c as addonRoutesCapability, ct as BaseAddon, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, v as buildAddonRouteProvider, wt as EventCategory } from "../dist-UfT_fD3-.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/ha-export/topics.ts
 /**
@@ -866,6 +866,40 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
+* component actually calls. `category:system [create]` was rejected: it would
+* hand `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		}
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1369,12 +1403,10 @@ var HaExportAddon = class extends BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1382,33 +1414,40 @@ var HaExportAddon = class extends BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: addonRoutesCapability,
-			provider: buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-homeassistant",
-  "version": "1.2.17",
+  "version": "1.2.18",
   "description": "Home Assistant device provider addon for CamStack",
   "keywords": [
     "camstack",
@@ -106,6 +106,9 @@
           },
           {
             "name": "addon-routes"
+          },
+          {
+            "name": "oauth-integration"
           }
         ]
       }