@camstack/addon-provider-homeassistant 1.2.17 → 1.2.19

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("./dist-DIa87XAf.js");
+const require_dist = require("./dist-Bz5ENMVc.js");
 let node_crypto = require("node:crypto");
 let node_zlib = require("node:zlib");
 //#region src/ha-device-source.ts

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as temperatureSensorCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as EventCategory, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, G as powerMeterCapability, H as notificationOutputCapability, I as imageCapability, J as pressureSensorCapability, K as prepareNotification, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as tamperCapability, R as lockControlCapability, S as colorCapability, St as url, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as smokeCapability, Y as scriptRunnerCapability, Z as switchCapability, _ as brokerCapability, _t as object, a as EnumSensorDateTimeFormatSchema, at as weatherCapability, b as carbonMonoxideCapability, bt as union, c as addonRoutesCapability, ct as DeviceFeature, d as ambientLightSensorCapability, dt as createEvent, et as updateCapability, f as automationControlCapability, ft as _enum, g as brightnessCapability, gt as number, h as binaryCapability, ht as literal, it as waterHeaterCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceRole, m as bestLocationMatch, mt as discriminatedUnion, n as BaseDeviceProvider, nt as valveCapability, o as TargetSchema, ot as errMsg, p as batteryCapability, pt as array, q as presenceCapability, rt as vibrationCapability, s as accessoriesCapability, t as BaseDevice, tt as vacuumControlCapability, u as alarmPanelCapability, ut as DeviceType, v as buildAddonRouteProvider, vt as record, w as contactCapability, x as climateControlCapability, xt as unknown, y as buttonCapability, yt as string, z as mediaPlayerCapability } from "./dist-reK3lvnr.mjs";
+import { $ as tamperCapability, A as eventEmitterCapability, B as motionCapability, C as connectivityCapability, Ct as url, D as deviceAdoptionCapability, E as coverCapability, F as humiditySensorCapability, H as notificationOutputCapability, I as imageCapability, J as presenceCapability, K as powerMeterCapability, L as lawnMowerControlCapability, M as floodCapability, N as gasCapability, P as humidifierCapability, Q as switchCapability, R as lockControlCapability, S as colorCapability, St as unknown, T as controlCapability, U as notifierCapability, V as normalizeUnit, W as numericSensorCapability, X as scriptRunnerCapability, Y as pressureSensorCapability, Z as smokeCapability, _ as brokerCapability, _t as number, a as EnumSensorDateTimeFormatSchema, at as waterHeaterCapability, b as carbonMonoxideCapability, bt as string, c as addonRoutesCapability, d as ambientLightSensorCapability, dt as DeviceType, et as temperatureSensorCapability, f as automationControlCapability, ft as createEvent, g as brightnessCapability, gt as literal, h as binaryCapability, ht as discriminatedUnion, it as vibrationCapability, j as fanControlCapability, k as enumSensorCapability, l as airQualitySensorCapability, lt as DeviceFeature, m as bestLocationMatch, mt as array, n as BaseDeviceProvider, nt as vacuumControlCapability, o as TargetSchema, ot as weatherCapability, p as batteryCapability, pt as _enum, q as prepareNotification, rt as valveCapability, s as accessoriesCapability, st as errMsg, t as BaseDevice, tt as updateCapability, u as alarmPanelCapability, ut as DeviceRole, v as buildAddonRouteProvider, vt as object, w as contactCapability, wt as EventCategory, x as climateControlCapability, xt as union, y as buttonCapability, yt as record, z as mediaPlayerCapability } from "./dist-BSQpoIVg.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-device-source.ts

package/dist/{dist-reK3lvnr.mjs → dist-BSQpoIVg.mjs}

@@ -15317,6 +15317,76 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15347,9 +15417,38 @@ var OauthIntegrationDescriptorSchema = object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: string().optional()
+	hubUrl: string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -18484,11 +18583,29 @@ var SsoBridgeClaimsSchema = object({
 	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: union([number().int().positive(), literal("never")]).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
-	ttlSec: number().int().positive().optional()
+	/**
+	* Seconds, or `'never'` for a token minted with NO `exp` claim.
+	*
+	* `'never'` is a literal rather than `undefined`/`0` because omitting
+	* this field already means "the 5-minute SSO hand-off default", and
+	* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+	* went through the numeric path would fail at mint time and break
+	* linking rather than produce an eternal token.
+	*/
+	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -25769,7 +25886,12 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	hubUrl: string(),
 	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 	*  that carries one can ONLY be exchanged with the matching verifier. */
-	codeChallenge: string().optional()
+	codeChallenge: string().optional(),
+	/** The integration's declared refresh lifetime — seconds, or `'never'`.
+	*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+	*  code so the link carries its own lifetime; omit for the 30-day
+	*  default. */
+	refreshTtlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
@@ -33351,4 +33473,4 @@ function bestLocationMatch(externalName, existing, threshold = .8) {
 	return best;
 }
 //#endregion
-export { temperatureSensorCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, EventCategory as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, powerMeterCapability as G, notificationOutputCapability as H, imageCapability as I, pressureSensorCapability as J, prepareNotification as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, tamperCapability as Q, lockControlCapability as R, colorCapability as S, url as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, smokeCapability as X, scriptRunnerCapability as Y, switchCapability as Z, brokerCapability as _, object as _t, EnumSensorDateTimeFormatSchema as a, weatherCapability as at, carbonMonoxideCapability as b, union as bt, addonRoutesCapability as c, DeviceFeature as ct, ambientLightSensorCapability as d, createEvent as dt, updateCapability as et, automationControlCapability as f, _enum as ft, brightnessCapability as g, number as gt, binaryCapability as h, literal as ht, CameraSwitchIdSchema as i, waterHeaterCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceRole as lt, bestLocationMatch as m, discriminatedUnion as mt, BaseDeviceProvider as n, valveCapability as nt, TargetSchema as o, errMsg as ot, batteryCapability as p, array as pt, presenceCapability as q, COCO_TO_MACRO as r, vibrationCapability as rt, accessoriesCapability as s, BaseAddon as st, BaseDevice as t, vacuumControlCapability as tt, alarmPanelCapability as u, DeviceType as ut, buildAddonRouteProvider as v, record as vt, contactCapability as w, climateControlCapability as x, unknown as xt, buttonCapability as y, string as yt, mediaPlayerCapability as z };
+export { tamperCapability as $, eventEmitterCapability as A, motionCapability as B, connectivityCapability as C, url as Ct, deviceAdoptionCapability as D, coverCapability as E, humiditySensorCapability as F, oauthIntegrationCapability as G, notificationOutputCapability as H, imageCapability as I, presenceCapability as J, powerMeterCapability as K, lawnMowerControlCapability as L, floodCapability as M, gasCapability as N, deviceExportCapability as O, humidifierCapability as P, switchCapability as Q, lockControlCapability as R, colorCapability as S, unknown as St, controlCapability as T, notifierCapability as U, normalizeUnit as V, numericSensorCapability as W, scriptRunnerCapability as X, pressureSensorCapability as Y, smokeCapability as Z, brokerCapability as _, number as _t, EnumSensorDateTimeFormatSchema as a, waterHeaterCapability as at, carbonMonoxideCapability as b, string as bt, addonRoutesCapability as c, BaseAddon as ct, ambientLightSensorCapability as d, DeviceType as dt, temperatureSensorCapability as et, automationControlCapability as f, createEvent as ft, brightnessCapability as g, literal as gt, binaryCapability as h, discriminatedUnion as ht, CameraSwitchIdSchema as i, vibrationCapability as it, fanControlCapability as j, enumSensorCapability as k, airQualitySensorCapability as l, DeviceFeature as lt, bestLocationMatch as m, array as mt, BaseDeviceProvider as n, vacuumControlCapability as nt, TargetSchema as o, weatherCapability as ot, batteryCapability as p, _enum as pt, prepareNotification as q, COCO_TO_MACRO as r, valveCapability as rt, accessoriesCapability as s, errMsg as st, BaseDevice as t, updateCapability as tt, alarmPanelCapability as u, DeviceRole as ut, buildAddonRouteProvider as v, object as vt, contactCapability as w, EventCategory as wt, climateControlCapability as x, union as xt, buttonCapability as y, record as yt, mediaPlayerCapability as z };

package/dist/{dist-DIa87XAf.js → dist-Bz5ENMVc.js}

@@ -15317,6 +15317,76 @@ object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes. `requestedScopes` has exactly ONE meaning: what the integration
+* NEEDS to function.** Not a blast radius, not a conservative
+* under-declaration, not a description of some other path the addon happens to
+* have. Derive it from what the client actually calls **with this token** —
+* every tRPC path against `METHOD_ACCESS_MAP`, plus an `addon:` grant for every
+* addon HTTP route it posts to — and write the call that justifies each entry
+* next to it. Two integrations once used this field to mean two different
+* things; the operator ruled there is one meaning, and any third integration
+* inherits it (2026-08-09).
+*
+* This is not documentation, it is the ENFORCEMENT INPUT. Since
+* [D103](../../../../docs/decisions/adr-0103.md) the `/addon/:addonId/*` gate
+* checks an integration token's grant before letting it reach an
+* `access: 'authenticated'` route, so an **under-declaration is an integration
+* that stops working** — a missing `addon:` entry means `403 Token scope
+* mismatch` on every control the client tries to actuate. Widen the descriptor
+* honestly rather than weakening a check to make a route pass.
+*
+* Prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family; a category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* Calls the ADDON itself makes over `ctx.api` run as the addon and are not
+* scope-checked, so they are not what this field describes — but reaching the
+* addon's route in the first place IS, and that is the entry to declare.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -15347,9 +15417,38 @@ var OauthIntegrationDescriptorSchema = object({
 	*  present, /api/oauth2/authorize bakes THIS into the code instead of the
 	*  hub-global `publicHubUrl()`, so a forked exporter addon (which can't set
 	*  the hub's env) drives the claim that its cloud Lambda routes back on. */
-	hubUrl: string().optional()
+	hubUrl: string().optional(),
+	/**
+	* How long a REFRESH token issued for this integration lives — seconds, or
+	* `'never'` for a token minted with no `exp` claim at all. Omit to keep the
+	* 30-day default, which is what every link used before this field existed.
+	*
+	* Declared here for the same reason `requestedScopes` is: the integration
+	* knows what it needs. Amazon's account linking and a Home Assistant config
+	* entry are both meant to survive indefinitely, and re-linking is a manual
+	* user action, so a 30-day expiry silently unlinks a working integration.
+	*
+	* **The security posture, stated so it is owned deliberately.** A refresh
+	* token that never expires is permanent access if it leaks. What bounds it is
+	* revocation, not time: `oauthRefresh` re-reads the session on every use and
+	* returns `null` once `revokedAt` is set, as does `oauthVerifyAccessToken`.
+	* The one gap is the ACCESS token — it is a plain signed JWT that nothing
+	* re-checks against the session on the `/trpc` and `/addon/*` paths, so
+	* revoking a link takes effect there only after its remaining hour. That hour
+	* is why the access TTL is not configurable.
+	*
+	* The value is baked into the authorization code at `/authorize` and travels
+	* on the tokens, so editing this field changes FUTURE links only.
+	*/
+	refreshTokenTtlSec: union([number().int().positive(), literal("never")]).optional()
 });
-method(_void(), OauthIntegrationDescriptorSchema);
+var oauthIntegrationCapability = {
+	name: "oauth-integration",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { getDescriptor: method(_void(), OauthIntegrationDescriptorSchema) }
+};
 /**
 * pipeline-analytics — device-scoped wrapper cap. Refines raw
 * per-frame detections emitted by the pipeline runner into tracked
@@ -18484,11 +18583,29 @@ var SsoBridgeClaimsSchema = object({
 	codeChallenge: string().optional(),
 	/** OAuth session registry id — set on `oauth-access`/`oauth-refresh`
 	*  tokens so the verify path can check the session is not revoked. */
-	sessionId: string().optional()
+	sessionId: string().optional(),
+	/**
+	* The refresh lifetime this LINK was created with, in seconds, or `'never'`.
+	* Baked into the code at `/authorize` from the integration's descriptor and
+	* carried forward so `oauthRefresh` re-mints with the same lifetime. It rides
+	* on the token rather than being re-read from the descriptor on purpose:
+	* editing a descriptor must not retroactively extend or shorten a link the
+	* operator already consented to.
+	*/
+	refreshTtl: union([number().int().positive(), literal("never")]).optional()
 });
 method(object({
 	claims: SsoBridgeClaimsSchema,
-	ttlSec: number().int().positive().optional()
+	/**
+	* Seconds, or `'never'` for a token minted with NO `exp` claim.
+	*
+	* `'never'` is a literal rather than `undefined`/`0` because omitting
+	* this field already means "the 5-minute SSO hand-off default", and
+	* `jwt.sign` THROWS on `{ expiresIn: undefined }` — a "no expiry" that
+	* went through the numeric path would fail at mint time and break
+	* linking rather than produce an eternal token.
+	*/
+	ttlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ token: string() })), method(object({ token: string() }), SsoBridgeClaimsSchema.nullable());
 var ProviderListEntrySchema = discriminatedUnion("shouldSaveDiskSpace", [object({
 	providerId: string().min(1),
@@ -25769,7 +25886,12 @@ method(_void(), array(UserSummarySchema), { auth: "admin" }), method(CreateUserI
 	hubUrl: string(),
 	/** PKCE (RFC 7636) S256 challenge. Baked into the signed code; a code
 	*  that carries one can ONLY be exchanged with the matching verifier. */
-	codeChallenge: string().optional()
+	codeChallenge: string().optional(),
+	/** The integration's declared refresh lifetime — seconds, or `'never'`.
+	*  From `OauthIntegrationDescriptor.refreshTokenTtlSec`. Baked into the
+	*  code so the link carries its own lifetime; omit for the 30-day
+	*  default. */
+	refreshTtlSec: union([number().int().positive(), literal("never")]).optional()
 }), object({ code: string() }), {
 	kind: "mutation",
 	access: "create"
@@ -33687,6 +33809,12 @@ Object.defineProperty(exports, "numericSensorCapability", {
 		return numericSensorCapability;
 	}
 });
+Object.defineProperty(exports, "oauthIntegrationCapability", {
+	enumerable: true,
+	get: function() {
+		return oauthIntegrationCapability;
+	}
+});
 Object.defineProperty(exports, "object", {
 	enumerable: true,
 	get: function() {

package/dist/ha-export/ha-export.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 //#endregion
-const require_dist = require("../dist-DIa87XAf.js");
+const require_dist = require("../dist-Bz5ENMVc.js");
 let node_crypto = require("node:crypto");
 //#region src/ha-export/topics.ts
 /**
@@ -871,6 +871,112 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* The brokers the operator has switched ON, read from the RAW addon store.
+*
+* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
+* hub happens to know about — so it can never appear in the addon's
+* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
+* present in the defaults ("the store can contain extra keys … without
+* polluting the typed config"), so every `exportTo:*` key is dropped on the
+* way into `this.config` and reading one there yields `undefined` for ever.
+*
+* That is not theoretical. On 2026-08-09 the switch was on
+* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
+* settings FORM reads the store) and every reconcile still logged
+* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
+* its "Not configured" card, and no operator action could have changed
+* either. The store is the single authority — read it, do not mirror it into
+* a typed field that would then be a second one (D62).
+*
+* A broker that is no longer known is not enabled, whatever the store says:
+* a stale `exportTo:` key for a deleted instance must not resurrect it.
+*/
+function enabledBrokerIds(store, knownBrokerIds) {
+	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+}
+/**
+* What a linked Home Assistant NEEDS to function — one entry per thing it
+* actually calls with this token, each named. Not a blast radius, not a
+* conservative under-declaration: `requestedScopes` has exactly one meaning
+* across every integration, and since D103 it is also the ENFORCEMENT input, so
+* an under-declaration is an integration that stops working.
+*
+* `category:system [create]` was rejected and stays rejected: it would hand
+* `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		},
+		(
+		/**
+		* `deviceExport.listExposedDevices` — the membership read that decides WHICH
+		* devices the component imports. It is pinned to this addon so the unpinned
+		* aggregate (which merges Alexa's and HomeKit's exposed sets, D12) cannot
+		* leak another exporter's devices into Home Assistant.
+		*
+		* Missing until 2026-08-09, which broke setup outright: the component's very
+		* first authenticated call is this one, and the hub answered "rejected the
+		* token" — reported by Home Assistant as `Configurazione non riuscita:
+		* deviceExport.listExposedDevices: hub rejected the token`. The call was
+		* introduced with the export filter and the descriptor was never widened for
+		* it. `system` scope, so a capability grant is what it needs — the `addon:`
+		* grant below covers the HTTP command route and does NOT cover this.
+		*/
+		{
+			type: "capability",
+			target: "device-export",
+			access: ["view"]
+		}),
+		(
+		/**
+		* `POST /addon/homeassistant-export/command` — the ONLY path by which an
+		* actuated Home Assistant entity (a camera switch, a PTZ button, reboot,
+		* snooze) reaches CamStack. Added when D103 made the addon-route gate check
+		* the grant instead of accepting any valid hub JWT; without it every HA
+		* control entity answers `403 Token scope mismatch`. `view` is here for the
+		* same addon's future GET routes, so a read does not force a re-link.
+		*/
+		{
+			type: "addon",
+			target: "homeassistant-export",
+			access: ["view", "create"]
+		})
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true,
+	/**
+	* One year. A Home Assistant config entry is meant to survive indefinitely
+	* and re-linking is a manual trip through the UI, so the 30-day default
+	* silently unlinked a working integration a month after setup. Finite rather
+	* than `'never'` (which Alexa uses): an HA instance refreshes on a timer
+	* while it is running, so a year is far beyond any realistic downtime, and a
+	* bounded token is the better default where nothing is lost by it.
+	*/
+	refreshTokenTtlSec: 365 * 24 * 60 * 60
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1265,6 +1371,19 @@ function projectCameraSwitches(deviceKey, switches) {
 		value: bool(sw.enabled)
 	}));
 }
+/** The `BrokerInfo.kind` tag the Home Assistant provider stamps. */
+var HA_BROKER_KIND = "home-assistant";
+/**
+* Every Home Assistant broker currently registered, cluster-wide.
+*
+* Unpinned by design (see the module docblock) and filtered by `kind`, which is
+* the contract check that matters: whatever mix of providers answered the
+* union, only `home-assistant` brokers are ever exported to over Home
+* Assistant's transport.
+*/
+async function listHomeAssistantBrokers(query) {
+	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
+}
 //#endregion
 //#region src/ha-export/ha-export.addon.ts
 /**
@@ -1302,8 +1421,6 @@ function projectCameraSwitches(deviceKey, switches) {
 *     different sets of cameras, and the per-device Export panel shows
 *     one switch per broker over the single membership store.
 */
-/** The addon that owns the import direction — never export back to it. */
-var HA_PROVIDER_ADDON_ID = "provider-homeassistant";
 var ADDON_ID = "homeassistant-export";
 /** Where the custom component registers its push view inside HA. */
 var PUSH_PATH = "/api/camstack/push";
@@ -1374,12 +1491,10 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1387,33 +1502,40 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: require_dist.deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: require_dist.addonRoutesCapability,
-			provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: require_dist.deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: require_dist.addonRoutesCapability,
+				provider: require_dist.buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: require_dist.oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");
@@ -1660,7 +1782,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 				* exported back to it: HA would mirror its own entity across the
 				* bridge, and any automation touching it would round-trip.
 				*/
-				if (device.addonId === HA_PROVIDER_ADDON_ID) {
+				if (device.addonId === "provider-homeassistant") {
 					this.ctx.logger.warn("ha-export: refusing to export a device imported from Home Assistant", { tags: { deviceId: numericId } });
 					continue;
 				}
@@ -1880,13 +2002,14 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* ones the operator ticked.
 	*
 	* Credentials come through the `broker` cap — the sanctioned no-import
-	* path — and the owning `addonId` is sent with the read: `broker` is a
-	* COLLECTION cap, so an unpinned id-keyed call routes to the
-	* first-registered provider, which returns `null` for a broker it does
-	* not own.
+	* path — and EVERY call carries the owning `addonId`: `broker` is a
+	* COLLECTION cap, so an unpinned call is answered by the
+	* first-registered provider (Homematic, on the operator's hub), which
+	* knows nothing about `ha_*`. `broker-source.ts` holds the pin and the
+	* reasoning.
 	*/
 	async refreshBrokers() {
-		const haBrokers = (await this.ctx.api.broker.list.query({})).filter((broker) => broker.kind === "home-assistant");
+		const haBrokers = await listHomeAssistantBrokers((input) => this.ctx.api.broker.list.query(input));
 		const known = haBrokers.map((broker) => ({
 			id: broker.id,
 			name: broker.name
@@ -1896,6 +2019,7 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			knownBrokers: known,
 			membership: pruned
 		});
+		await this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -1967,8 +2091,23 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 			return null;
 		}
 	}
+	/**
+	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
+	*
+	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
+	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
+	* it is `undefined` there for ever — see `enabledBrokerIds` in
+	* `membership.ts` for what that cost. The store is the authority; this is a
+	* read-through cache of it, refreshed at the top of every reconcile pass and
+	* before the per-device panel renders, never written to.
+	*/
+	enabled = [];
+	async refreshEnabledBrokers(known) {
+		const store = await this.resolveGlobalStore();
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+	}
 	enabledBrokerIds() {
-		return this.config.knownBrokers.filter((broker) => this.config[`exportTo:${broker.id}`] === true).map((broker) => broker.id);
+		return this.enabled;
 	}
 	brokerName(brokerId) {
 		return this.config.knownBrokers.find((broker) => broker.id === brokerId)?.name ?? brokerId;
@@ -2307,7 +2446,8 @@ var HaExportAddon = class extends require_dist.BaseAddon {
 	* exporters' identically-named fields and the operator sees another
 	* exporter's value in this one's toggle.
 	*/
-	buildContribution(deviceId) {
+	async buildContribution(deviceId) {
+		await this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({

package/dist/ha-export/ha-export.addon.mjs

@@ -1,4 +1,4 @@
-import { Ct as EventCategory, O as deviceExportCapability, c as addonRoutesCapability, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, st as BaseAddon, v as buildAddonRouteProvider, yt as string } from "../dist-reK3lvnr.mjs";
+import { G as oauthIntegrationCapability, O as deviceExportCapability, bt as string, c as addonRoutesCapability, ct as BaseAddon, i as CameraSwitchIdSchema, r as COCO_TO_MACRO, v as buildAddonRouteProvider, wt as EventCategory } from "../dist-BSQpoIVg.mjs";
 import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/ha-export/topics.ts
 /**
@@ -866,6 +866,112 @@ function pruneBrokers(membership, knownBrokerIds) {
 	for (const brokerId of kept) next[brokerId] = membership[brokerId] ?? [];
 	return next;
 }
+/**
+* The brokers the operator has switched ON, read from the RAW addon store.
+*
+* `exportTo:<brokerId>` is a **dynamic** settings key — one per broker the
+* hub happens to know about — so it can never appear in the addon's
+* `DEFAULT_CONFIG`. `BaseAddon.resolveConfig` copies only keys that are
+* present in the defaults ("the store can contain extra keys … without
+* polluting the typed config"), so every `exportTo:*` key is dropped on the
+* way into `this.config` and reading one there yields `undefined` for ever.
+*
+* That is not theoretical. On 2026-08-09 the switch was on
+* (`getGlobalSettings` returned `exportTo:ha_001 → value: true`, because the
+* settings FORM reads the store) and every reconcile still logged
+* `brokers=0`: nothing was ever exported, the per-device Export tab rendered
+* its "Not configured" card, and no operator action could have changed
+* either. The store is the single authority — read it, do not mirror it into
+* a typed field that would then be a second one (D62).
+*
+* A broker that is no longer known is not enabled, whatever the store says:
+* a stale `exportTo:` key for a deleted instance must not resurrect it.
+*/
+function enabledBrokerIds(store, knownBrokerIds) {
+	return knownBrokerIds.filter((brokerId) => store[`exportTo:${brokerId}`] === true);
+}
+/**
+* What a linked Home Assistant NEEDS to function — one entry per thing it
+* actually calls with this token, each named. Not a blast radius, not a
+* conservative under-declaration: `requestedScopes` has exactly one meaning
+* across every integration, and since D103 it is also the ENFORCEMENT input, so
+* an under-declaration is an integration that stops working.
+*
+* `category:system [create]` was rejected and stays rejected: it would hand
+* `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		},
+		(
+		/**
+		* `deviceExport.listExposedDevices` — the membership read that decides WHICH
+		* devices the component imports. It is pinned to this addon so the unpinned
+		* aggregate (which merges Alexa's and HomeKit's exposed sets, D12) cannot
+		* leak another exporter's devices into Home Assistant.
+		*
+		* Missing until 2026-08-09, which broke setup outright: the component's very
+		* first authenticated call is this one, and the hub answered "rejected the
+		* token" — reported by Home Assistant as `Configurazione non riuscita:
+		* deviceExport.listExposedDevices: hub rejected the token`. The call was
+		* introduced with the export filter and the descriptor was never widened for
+		* it. `system` scope, so a capability grant is what it needs — the `addon:`
+		* grant below covers the HTTP command route and does NOT cover this.
+		*/
+		{
+			type: "capability",
+			target: "device-export",
+			access: ["view"]
+		}),
+		(
+		/**
+		* `POST /addon/homeassistant-export/command` — the ONLY path by which an
+		* actuated Home Assistant entity (a camera switch, a PTZ button, reboot,
+		* snooze) reaches CamStack. Added when D103 made the addon-route gate check
+		* the grant instead of accepting any valid hub JWT; without it every HA
+		* control entity answers `403 Token scope mismatch`. `view` is here for the
+		* same addon's future GET routes, so a read does not force a re-link.
+		*/
+		{
+			type: "addon",
+			target: "homeassistant-export",
+			access: ["view", "create"]
+		})
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true,
+	/**
+	* One year. A Home Assistant config entry is meant to survive indefinitely
+	* and re-linking is a manual trip through the UI, so the 30-day default
+	* silently unlinked a working integration a month after setup. Finite rather
+	* than `'never'` (which Alexa uses): an HA instance refreshes on a timer
+	* while it is running, so a year is far beyond any realistic downtime, and a
+	* bounded token is the better default where nothing is lost by it.
+	*/
+	refreshTokenTtlSec: 365 * 24 * 60 * 60
+};
 //#endregion
 //#region src/ha-export/push-client.ts
 /** How long state updates accumulate before one POST carries them all. */
@@ -1260,6 +1366,19 @@ function projectCameraSwitches(deviceKey, switches) {
 		value: bool(sw.enabled)
 	}));
 }
+/** The `BrokerInfo.kind` tag the Home Assistant provider stamps. */
+var HA_BROKER_KIND = "home-assistant";
+/**
+* Every Home Assistant broker currently registered, cluster-wide.
+*
+* Unpinned by design (see the module docblock) and filtered by `kind`, which is
+* the contract check that matters: whatever mix of providers answered the
+* union, only `home-assistant` brokers are ever exported to over Home
+* Assistant's transport.
+*/
+async function listHomeAssistantBrokers(query) {
+	return (await query({})).filter((broker) => broker.kind === HA_BROKER_KIND);
+}
 //#endregion
 //#region src/ha-export/ha-export.addon.ts
 /**
@@ -1297,8 +1416,6 @@ function projectCameraSwitches(deviceKey, switches) {
 *     different sets of cameras, and the per-device Export panel shows
 *     one switch per broker over the single membership store.
 */
-/** The addon that owns the import direction — never export back to it. */
-var HA_PROVIDER_ADDON_ID = "provider-homeassistant";
 var ADDON_ID = "homeassistant-export";
 /** Where the custom component registers its push view inside HA. */
 var PUSH_PATH = "/api/camstack/push";
@@ -1369,12 +1486,10 @@ var HaExportAddon = class extends BaseAddon {
 		} else this.mediaSecret = existing;
 		this.wireListeners();
 		await this.serveMediaPlane();
-		try {
-			await this.reconcile("boot");
-		} catch (err) {
+		this.reconcile("boot").catch((err) => {
 			this.lastError = errMsg(err);
 			this.ctx.logger.warn("ha-export: initial reconcile failed", { meta: { error: this.lastError } });
-		}
+		});
 		this.startTimer();
 		this.ctx.addDisposer(async () => {
 			this.stopTimer();
@@ -1382,33 +1497,40 @@ var HaExportAddon = class extends BaseAddon {
 			for (const link of this.links.values()) await link.client.dispose();
 			this.links.clear();
 		});
-		return [{
-			capability: deviceExportCapability,
-			provider: {
-				getStatus: async () => this.buildStatus(),
-				listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
-				listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
-					deviceId,
-					exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
-				})),
-				exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
-				unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
-				getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
-				getDeviceLiveContribution: async () => null,
-				applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
-			}
-		}, {
-			capability: addonRoutesCapability,
-			provider: buildAddonRouteProvider(ADDON_ID, [{
-				method: "POST",
-				path: "/command",
-				access: "authenticated",
-				description: "Home Assistant → CamStack command: {topic, value}",
-				handler: async (request, reply) => {
-					await this.handleCommandRoute(request.body, reply);
+		return [
+			{
+				capability: deviceExportCapability,
+				provider: {
+					getStatus: async () => this.buildStatus(),
+					listSupportedDeviceKinds: async () => [...SUPPORTED_DEVICE_KINDS],
+					listExposedDevices: async () => exposedDeviceIds(this.config.membership, this.enabledBrokerIds()).map((deviceId) => ({
+						deviceId,
+						exposedAs: brokersExposing(this.config.membership, deviceId).map((brokerId) => this.brokerName(brokerId)).join(", ")
+					})),
+					exposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, true),
+					unexposeDevice: async ({ deviceId }) => this.setMembershipEverywhere(deviceId, false),
+					getDeviceSettingsContribution: async ({ deviceId }) => this.buildContribution(deviceId),
+					getDeviceLiveContribution: async () => null,
+					applyDeviceSettingsPatch: async ({ deviceId, patch }) => this.applyDeviceSettingsPatch(deviceId, patch)
 				}
-			}])
-		}];
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider(ADDON_ID, [{
+					method: "POST",
+					path: "/command",
+					access: "authenticated",
+					description: "Home Assistant → CamStack command: {topic, value}",
+					handler: async (request, reply) => {
+						await this.handleCommandRoute(request.body, reply);
+					}
+				}])
+			},
+			{
+				capability: oauthIntegrationCapability,
+				provider: { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION }
+			}
+		];
 	}
 	async onConfigChanged() {
 		await this.reconcile("config-changed");
@@ -1655,7 +1777,7 @@ var HaExportAddon = class extends BaseAddon {
 				* exported back to it: HA would mirror its own entity across the
 				* bridge, and any automation touching it would round-trip.
 				*/
-				if (device.addonId === HA_PROVIDER_ADDON_ID) {
+				if (device.addonId === "provider-homeassistant") {
 					this.ctx.logger.warn("ha-export: refusing to export a device imported from Home Assistant", { tags: { deviceId: numericId } });
 					continue;
 				}
@@ -1875,13 +1997,14 @@ var HaExportAddon = class extends BaseAddon {
 	* ones the operator ticked.
 	*
 	* Credentials come through the `broker` cap — the sanctioned no-import
-	* path — and the owning `addonId` is sent with the read: `broker` is a
-	* COLLECTION cap, so an unpinned id-keyed call routes to the
-	* first-registered provider, which returns `null` for a broker it does
-	* not own.
+	* path — and EVERY call carries the owning `addonId`: `broker` is a
+	* COLLECTION cap, so an unpinned call is answered by the
+	* first-registered provider (Homematic, on the operator's hub), which
+	* knows nothing about `ha_*`. `broker-source.ts` holds the pin and the
+	* reasoning.
 	*/
 	async refreshBrokers() {
-		const haBrokers = (await this.ctx.api.broker.list.query({})).filter((broker) => broker.kind === "home-assistant");
+		const haBrokers = await listHomeAssistantBrokers((input) => this.ctx.api.broker.list.query(input));
 		const known = haBrokers.map((broker) => ({
 			id: broker.id,
 			name: broker.name
@@ -1891,6 +2014,7 @@ var HaExportAddon = class extends BaseAddon {
 			knownBrokers: known,
 			membership: pruned
 		});
+		await this.refreshEnabledBrokers(known);
 		const wanted = new Set(this.enabledBrokerIds());
 		for (const [brokerId, link] of this.links) {
 			if (wanted.has(brokerId)) continue;
@@ -1962,8 +2086,23 @@ var HaExportAddon = class extends BaseAddon {
 			return null;
 		}
 	}
+	/**
+	* The brokers switched on, as of the last {@link refreshEnabledBrokers}.
+	*
+	* NOT read from `this.config`: `exportTo:<brokerId>` is a dynamic key and
+	* `BaseAddon.resolveConfig` copies only keys present in `DEFAULT_CONFIG`, so
+	* it is `undefined` there for ever — see `enabledBrokerIds` in
+	* `membership.ts` for what that cost. The store is the authority; this is a
+	* read-through cache of it, refreshed at the top of every reconcile pass and
+	* before the per-device panel renders, never written to.
+	*/
+	enabled = [];
+	async refreshEnabledBrokers(known) {
+		const store = await this.resolveGlobalStore();
+		this.enabled = enabledBrokerIds(store, known.map((broker) => broker.id));
+	}
 	enabledBrokerIds() {
-		return this.config.knownBrokers.filter((broker) => this.config[`exportTo:${broker.id}`] === true).map((broker) => broker.id);
+		return this.enabled;
 	}
 	brokerName(brokerId) {
 		return this.config.knownBrokers.find((broker) => broker.id === brokerId)?.name ?? brokerId;
@@ -2302,7 +2441,8 @@ var HaExportAddon = class extends BaseAddon {
 	* exporters' identically-named fields and the operator sees another
 	* exporter's value in this one's toggle.
 	*/
-	buildContribution(deviceId) {
+	async buildContribution(deviceId) {
+		await this.refreshEnabledBrokers(this.config.knownBrokers);
 		const idStr = String(deviceId);
 		const enabled = this.enabledBrokerIds();
 		const fields = enabled.map((brokerId) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-provider-homeassistant",
-  "version": "1.2.17",
+  "version": "1.2.19",
   "description": "Home Assistant device provider addon for CamStack",
   "keywords": [
     "camstack",
@@ -46,8 +46,7 @@
         "brokerKind": "home-assistant",
         "supportsLocationImport": true,
         "execution": {
-          "placement": "hub-only",
-          "group": "notifiers"
+          "placement": "hub-only"
         },
         "capabilities": [
           {
@@ -106,6 +105,9 @@
           },
           {
             "name": "addon-routes"
+          },
+          {
+            "name": "oauth-integration"
           }
         ]
       }