@camstack/addon-provider-homeassistant 1.2.651 → 1.2.653

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.653] - 2026-11-02
+
+### Changed
+
+- Rebuilt against updated dependencies.
+
+## [1.2.652] - 2026-11-02
+
+### Changed
+
+- Home Assistant can hand an ESPHome board's encryption key from its ESPHome Builder add-on to CamStack, over the existing access token (administrator only).
+- pump-cycle is classified as not exported to Home Assistant
+
 ## [1.2.651] - 2026-11-02
 
 ### Changed

package/dist/addon.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_ha_broker_source = require("./ha-broker-source-D4_TtF2V.js");
+const require_ha_broker_source = require("./ha-broker-source-DnSL-mbs.js");
 let node_crypto = require("node:crypto");
 let node_zlib = require("node:zlib");
 //#region src/ha-admin-link.ts
@@ -5500,6 +5500,10 @@ var HaIntegrationManager = class HaIntegrationManager {
 		this.connection = null;
 		this.setStatus("disconnected");
 	}
+	/** The address HA answers on; `null` for a supervisor-token broker, which has none of its own. */
+	getBaseUrl() {
+		return this.opts.auth.kind === "long-lived" ? this.opts.auth.baseUrl : null;
+	}
 	getInfo() {
 		return {
 			id: this.opts.id,
@@ -7773,6 +7777,179 @@ var HaBrokerStore = class HaBrokerStore {
 	}
 };
 //#endregion
+//#region src/ha-board-key-source.ts
+/**
+* `board-key-source` for Home Assistant: reads an ESPHome board's API
+* encryption key from the ESPHome Builder add-on that runs inside HA.
+*
+* The path reuses what the broker already holds, the long-lived token on the
+* WebSocket, and opens no port and asks for no second credential:
+*
+*   1. `supervisor/api GET /discovery`   -> the add-on that announced `esphome`
+*   2. `supervisor/api GET /addons/<slug>/info` -> its `ingress_url`
+*   3. `supervisor/api POST /ingress/session` (admin only) -> a session
+*   4. `GET <ha><ingress_url>devices`, cookie `ingress_session` -> the boards
+*   5. `GET <ha><ingress_url>json-config?configuration=<x>.yaml` -> the key
+*
+* **What crosses.** The builder's `json-config` body carries EVERY value the
+* YAML secrets file resolves, the Wi-Fi passphrase included. It is parsed in
+* memory straight into a schema that names only `api.encryption.key`; Zod
+* drops every other field at the parse, so the rest never reaches a variable,
+* a return value or a log line. No body is ever logged, only a reason.
+*/
+var INGRESS_PREFIX = "/api/hassio_ingress/";
+var ESPHOME_SERVICE = "esphome";
+var DiscoverySchema = require_ha_broker_source.object({ discovery: require_ha_broker_source.array(require_ha_broker_source.object({
+	addon: require_ha_broker_source.string(),
+	service: require_ha_broker_source.string()
+})) });
+var AddonInfoSchema = require_ha_broker_source.object({ ingress_url: require_ha_broker_source.string().nullable().optional() });
+var SessionSchema = require_ha_broker_source.object({ session: require_ha_broker_source.string().min(1) });
+var DevicesSchema = require_ha_broker_source.object({ configured: require_ha_broker_source.array(require_ha_broker_source.object({
+	name: require_ha_broker_source.string(),
+	configuration: require_ha_broker_source.string(),
+	address: require_ha_broker_source.string().nullable().optional()
+})) });
+/** The ONLY part of `json-config` that is read; every other field is dropped by the parse. */
+var KeyConfigSchema = require_ha_broker_source.object({ api: require_ha_broker_source.object({ encryption: require_ha_broker_source.object({ key: require_ha_broker_source.string().min(1) }).optional() }).optional() });
+var ADMIN_CODES = new Set([
+	"unauthorized",
+	"forbidden",
+	"not_admin"
+]);
+var SourceFailure = class extends Error {
+	reason;
+	detail;
+	constructor(reason, detail) {
+		super(reason);
+		this.reason = reason;
+		this.detail = detail;
+	}
+};
+function errorCode(err) {
+	if (typeof err !== "object" || err === null) return null;
+	const code = Reflect.get(err, "code");
+	return typeof code === "string" ? code : null;
+}
+var HaBoardKeySource = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	listSources() {
+		return this.deps.brokers.list().map((b) => ({
+			sourceId: b.id,
+			name: b.name
+		}));
+	}
+	async listBoards(sourceId) {
+		try {
+			const access = await this.openIngress(sourceId);
+			const raw = await this.getJson(access, "devices");
+			const parsed = DevicesSchema.safeParse(raw);
+			if (!parsed.success) throw new SourceFailure("unreadable-config", "unexpected devices reply");
+			return {
+				ok: true,
+				boards: parsed.data.configured.map((d) => ({
+					configuration: d.configuration,
+					name: d.name,
+					address: d.address ?? null
+				}))
+			};
+		} catch (err) {
+			return this.fail(sourceId, "listBoards", err);
+		}
+	}
+	async getBoardKey(sourceId, configuration) {
+		try {
+			const access = await this.openIngress(sourceId);
+			const raw = await this.getJson(access, `json-config?configuration=${encodeURIComponent(configuration)}`, configuration);
+			const parsed = KeyConfigSchema.safeParse(raw);
+			if (!parsed.success) throw new SourceFailure("unreadable-config");
+			const key = parsed.data.api?.encryption?.key;
+			if (key === void 0) throw new SourceFailure("no-encryption-key");
+			return {
+				ok: true,
+				key
+			};
+		} catch (err) {
+			return this.fail(sourceId, "getBoardKey", err);
+		}
+	}
+	fail(sourceId, op, err) {
+		const failure = err instanceof SourceFailure ? err : new SourceFailure("unreachable", require_ha_broker_source.errMsg(err));
+		this.deps.logger.warn(`board-key-source ${op} refused`, { meta: {
+			sourceId,
+			reason: failure.reason
+		} });
+		return failure.detail === void 0 ? {
+			ok: false,
+			reason: failure.reason
+		} : {
+			ok: false,
+			reason: failure.reason,
+			detail: failure.detail
+		};
+	}
+	async supervisor(broker, endpoint, method) {
+		try {
+			return await broker.send({
+				type: "supervisor/api",
+				endpoint,
+				method
+			});
+		} catch (err) {
+			const code = errorCode(err);
+			if (code !== null && ADMIN_CODES.has(code)) throw new SourceFailure("not-admin", "the Home Assistant token is not an administrator");
+			throw new SourceFailure("unreachable", require_ha_broker_source.errMsg(err));
+		}
+	}
+	async openIngress(sourceId) {
+		const broker = this.deps.brokers.list().find((b) => b.id === sourceId);
+		if (broker === void 0) throw new SourceFailure("unknown-source");
+		if (broker.baseUrl === null) throw new SourceFailure("no-ingress-url", "this broker has no address of its own");
+		const discovery = DiscoverySchema.safeParse(await this.supervisor(broker, "/discovery", "get"));
+		const slug = discovery.success ? discovery.data.discovery.find((d) => d.service === ESPHOME_SERVICE)?.addon : void 0;
+		if (slug === void 0) throw new SourceFailure("no-builder");
+		const info = AddonInfoSchema.safeParse(await this.supervisor(broker, `/addons/${encodeURIComponent(slug)}/info`, "get"));
+		const ingressUrl = info.success ? info.data.ingress_url : void 0;
+		if (typeof ingressUrl !== "string" || !ingressUrl.startsWith(INGRESS_PREFIX)) throw new SourceFailure("no-ingress-url");
+		const session = SessionSchema.safeParse(await this.supervisor(broker, "/ingress/session", "post"));
+		if (!session.success) throw new SourceFailure("not-admin", "no ingress session was granted");
+		return {
+			root: `${broker.baseUrl.replace(/\/+$/, "")}${ingressUrl.endsWith("/") ? ingressUrl : `${ingressUrl}/`}`,
+			cookie: `ingress_session=${session.data.session}`
+		};
+	}
+	async getJson(access, relative, configuration) {
+		let response;
+		try {
+			response = await this.deps.http(`${access.root}${relative}`, { headers: {
+				Cookie: access.cookie,
+				Accept: "application/json"
+			} });
+		} catch (err) {
+			throw new SourceFailure("unreachable", require_ha_broker_source.errMsg(err));
+		}
+		if (response.status === 404 && configuration !== void 0) throw new SourceFailure("unknown-board", configuration);
+		if (response.status === 401 || response.status === 403) throw new SourceFailure("not-admin", `the builder answered ${response.status}`);
+		if (!response.ok) throw new SourceFailure("unreachable", `the builder answered ${response.status}`);
+		try {
+			return await response.json();
+		} catch {
+			throw new SourceFailure("unreadable-config");
+		}
+	}
+};
+/** The cap provider over a {@link HaBoardKeySource}. */
+function createHaBoardKeyProvider(source) {
+	return {
+		listSources: async () => source.listSources(),
+		listBoards: (input) => source.listBoards(input.sourceId),
+		getBoardKey: (input) => source.getBoardKey(input.sourceId, input.configuration)
+	};
+}
+//#endregion
 //#region src/ha-calendar-source.ts
 function isCalendarEntity(entityId) {
 	return entityId.startsWith("calendar.");
@@ -8488,6 +8665,10 @@ var HaProviderAddon = class HaProviderAddon extends require_ha_broker_source.Bas
 				capability: require_ha_broker_source.addonRoutesCapability,
 				provider: createHaIconRouteProvider()
 			},
+			{
+				capability: require_ha_broker_source.boardKeySourceCapability,
+				provider: this.buildBoardKeyProvider()
+			},
 			{
 				capability: require_ha_broker_source.calendarSourceCapability,
 				provider: createHaCalendarSource({
@@ -8498,6 +8679,23 @@ var HaProviderAddon = class HaProviderAddon extends require_ha_broker_source.Bas
 			}
 		];
 	}
+	/** `board-key-source`: reads an ESPHome board's key from the builder beside HA, over each broker's own token. */
+	buildBoardKeyProvider() {
+		const registry = this.requireRegistry();
+		return createHaBoardKeyProvider(new HaBoardKeySource({
+			brokers: { list: () => registry.listManagers().map(({ brokerId, manager }) => ({
+				id: brokerId,
+				name: manager.getInfo().name,
+				baseUrl: manager.getBaseUrl(),
+				send: (message) => manager.sendMessage(message)
+			})) },
+			http: (url, init) => fetch(url, {
+				headers: init.headers,
+				signal: AbortSignal.timeout(15e3)
+			}),
+			logger: this.ctx.logger.child("board-key-source")
+		}));
+	}
 	async buildNotificationOutputProvider() {
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("ha notification-output: ctx.records is required (hub-only addon)");

package/dist/addon.mjs

@@ -1,4 +1,4 @@
-import { $ as humiditySensorCapability, $t as discriminatedUnion, A as brokerCapability, At as tamperCapability, C as alarmPanelCapability, Ct as runningFromMediaPlayer, D as bestLocationMatch, E as batteryCapability, Et as scriptRunnerCapability, F as carbonMonoxideCapability, Ft as vacuumControlCapability, G as deviceAdoptionCapability, Gt as defineEntryKind, H as controlCapability, Ht as baseUnitOf, I as climateControlCapability, It as valveCapability, J as eventEmitterCapability, Kt as defineRecordKinds, L as colorCapability, Lt as vibrationCapability, M as buildDeviceAdminUrl, Mt as tryConvertDelta, N as buttonCapability, Nt as tryConvertUnit, O as binaryCapability, Ot as smokeCapability, P as calendarSourceCapability, Pt as updateCapability, Q as humidifierCapability, Qt as boolean, R as connectivityCapability, Rt as waterHeaterCapability, S as airQualitySensorCapability, St as runningFromLawnMower, T as automationControlCapability, Tt as runningStateCapability, U as coverCapability, Ut as createEvent, V as contactCapability, Vt as RecordSecretUnavailableError, W as deviceAdminLinkCapability, X as floodCapability, Xt as _enum, Y as fanControlCapability, Z as gasCapability, Zt as array, a as BaseDevice, an as union, at as motionCapability, b as accessoriesCapability, bt as resolveAttachmentUrls, cn as DeviceFeature, ct as notifierCapability, dn as errMsg, dt as parseAdminBase, en as literal, et as imageCapability, fn as EventCategory, ft as powerMeterCapability, gt as pressureSensorCapability, ht as presenceCapability, in as string, it as mediaPlayerCapability, j as buildAddonRouteProvider, jt as temperatureSensorCapability, k as brightnessCapability, kt as switchCapability, ln as DeviceRole, lt as numericSensorCapability, mt as prepareNotification, nn as object, nt as lawnMowerControlCapability, o as BaseDeviceProvider, on as unknown, ot as normalizeUnit, p as EnumSensorDateTimeFormatSchema, q as enumSensorCapability, qt as entryBody, rn as record, rt as lockControlCapability, sn as url, st as notificationOutputCapability, t as HA_BROKER_KIND, tn as number, tt as ingestReading, un as DeviceType, v as RUNNING_STATE_COLD, vt as publicEndpointReaderFrom, w as ambientLightSensorCapability, wt as runningFromVacuumState, x as addonRoutesCapability, y as TargetSchema, yt as quantityFromUnit, zt as weatherCapability } from "./ha-broker-source-CCmZ9I6P.mjs";
+import { $ as humidifierCapability, $t as boolean, A as brightnessCapability, At as switchCapability, Bt as weatherCapability, C as alarmPanelCapability, Ct as runningFromLawnMower, D as bestLocationMatch, Dt as scriptRunnerCapability, E as batteryCapability, Et as runningStateCapability, F as calendarSourceCapability, Ft as updateCapability, G as deviceAdminLinkCapability, H as contactCapability, Ht as RecordSecretUnavailableError, I as carbonMonoxideCapability, It as vacuumControlCapability, J as enumSensorCapability, Jt as entryBody, K as deviceAdoptionCapability, Kt as defineEntryKind, L as climateControlCapability, Lt as valveCapability, M as buildAddonRouteProvider, Mt as temperatureSensorCapability, N as buildDeviceAdminUrl, Nt as tryConvertDelta, O as binaryCapability, P as buttonCapability, Pt as tryConvertUnit, Q as gasCapability, Qt as array, R as colorCapability, Rt as vibrationCapability, S as airQualitySensorCapability, T as automationControlCapability, Tt as runningFromVacuumState, U as controlCapability, Ut as baseUnitOf, W as coverCapability, Wt as createEvent, X as fanControlCapability, Y as eventEmitterCapability, Z as floodCapability, Zt as _enum, _t as pressureSensorCapability, a as BaseDevice, an as string, at as mediaPlayerCapability, b as accessoriesCapability, bt as quantityFromUnit, cn as url, ct as notificationOutputCapability, dn as DeviceType, en as discriminatedUnion, et as humiditySensorCapability, fn as errMsg, ft as parseAdminBase, gt as presenceCapability, ht as prepareNotification, in as record, it as lockControlCapability, j as brokerCapability, jt as tamperCapability, k as boardKeySourceCapability, kt as smokeCapability, ln as DeviceFeature, lt as notifierCapability, nn as number, nt as ingestReading, o as BaseDeviceProvider, on as union, ot as motionCapability, p as EnumSensorDateTimeFormatSchema, pn as EventCategory, pt as powerMeterCapability, qt as defineRecordKinds, rn as object, rt as lawnMowerControlCapability, sn as unknown, st as normalizeUnit, t as HA_BROKER_KIND, tn as literal, tt as imageCapability, un as DeviceRole, ut as numericSensorCapability, v as RUNNING_STATE_COLD, w as ambientLightSensorCapability, wt as runningFromMediaPlayer, x as addonRoutesCapability, xt as resolveAttachmentUrls, y as TargetSchema, yt as publicEndpointReaderFrom, z as connectivityCapability, zt as waterHeaterCapability } from "./ha-broker-source-CKdH9XHn.mjs";
 import { randomUUID } from "node:crypto";
 import { brotliCompressSync, deflateSync, gzipSync } from "node:zlib";
 //#region src/ha-admin-link.ts
@@ -5499,6 +5499,10 @@ var HaIntegrationManager = class HaIntegrationManager {
 		this.connection = null;
 		this.setStatus("disconnected");
 	}
+	/** The address HA answers on; `null` for a supervisor-token broker, which has none of its own. */
+	getBaseUrl() {
+		return this.opts.auth.kind === "long-lived" ? this.opts.auth.baseUrl : null;
+	}
 	getInfo() {
 		return {
 			id: this.opts.id,
@@ -7755,6 +7759,179 @@ var HaBrokerStore = class HaBrokerStore {
 	}
 };
 //#endregion
+//#region src/ha-board-key-source.ts
+/**
+* `board-key-source` for Home Assistant: reads an ESPHome board's API
+* encryption key from the ESPHome Builder add-on that runs inside HA.
+*
+* The path reuses what the broker already holds, the long-lived token on the
+* WebSocket, and opens no port and asks for no second credential:
+*
+*   1. `supervisor/api GET /discovery`   -> the add-on that announced `esphome`
+*   2. `supervisor/api GET /addons/<slug>/info` -> its `ingress_url`
+*   3. `supervisor/api POST /ingress/session` (admin only) -> a session
+*   4. `GET <ha><ingress_url>devices`, cookie `ingress_session` -> the boards
+*   5. `GET <ha><ingress_url>json-config?configuration=<x>.yaml` -> the key
+*
+* **What crosses.** The builder's `json-config` body carries EVERY value the
+* YAML secrets file resolves, the Wi-Fi passphrase included. It is parsed in
+* memory straight into a schema that names only `api.encryption.key`; Zod
+* drops every other field at the parse, so the rest never reaches a variable,
+* a return value or a log line. No body is ever logged, only a reason.
+*/
+var INGRESS_PREFIX = "/api/hassio_ingress/";
+var ESPHOME_SERVICE = "esphome";
+var DiscoverySchema = object({ discovery: array(object({
+	addon: string(),
+	service: string()
+})) });
+var AddonInfoSchema = object({ ingress_url: string().nullable().optional() });
+var SessionSchema = object({ session: string().min(1) });
+var DevicesSchema = object({ configured: array(object({
+	name: string(),
+	configuration: string(),
+	address: string().nullable().optional()
+})) });
+/** The ONLY part of `json-config` that is read; every other field is dropped by the parse. */
+var KeyConfigSchema = object({ api: object({ encryption: object({ key: string().min(1) }).optional() }).optional() });
+var ADMIN_CODES = new Set([
+	"unauthorized",
+	"forbidden",
+	"not_admin"
+]);
+var SourceFailure = class extends Error {
+	reason;
+	detail;
+	constructor(reason, detail) {
+		super(reason);
+		this.reason = reason;
+		this.detail = detail;
+	}
+};
+function errorCode(err) {
+	if (typeof err !== "object" || err === null) return null;
+	const code = Reflect.get(err, "code");
+	return typeof code === "string" ? code : null;
+}
+var HaBoardKeySource = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	listSources() {
+		return this.deps.brokers.list().map((b) => ({
+			sourceId: b.id,
+			name: b.name
+		}));
+	}
+	async listBoards(sourceId) {
+		try {
+			const access = await this.openIngress(sourceId);
+			const raw = await this.getJson(access, "devices");
+			const parsed = DevicesSchema.safeParse(raw);
+			if (!parsed.success) throw new SourceFailure("unreadable-config", "unexpected devices reply");
+			return {
+				ok: true,
+				boards: parsed.data.configured.map((d) => ({
+					configuration: d.configuration,
+					name: d.name,
+					address: d.address ?? null
+				}))
+			};
+		} catch (err) {
+			return this.fail(sourceId, "listBoards", err);
+		}
+	}
+	async getBoardKey(sourceId, configuration) {
+		try {
+			const access = await this.openIngress(sourceId);
+			const raw = await this.getJson(access, `json-config?configuration=${encodeURIComponent(configuration)}`, configuration);
+			const parsed = KeyConfigSchema.safeParse(raw);
+			if (!parsed.success) throw new SourceFailure("unreadable-config");
+			const key = parsed.data.api?.encryption?.key;
+			if (key === void 0) throw new SourceFailure("no-encryption-key");
+			return {
+				ok: true,
+				key
+			};
+		} catch (err) {
+			return this.fail(sourceId, "getBoardKey", err);
+		}
+	}
+	fail(sourceId, op, err) {
+		const failure = err instanceof SourceFailure ? err : new SourceFailure("unreachable", errMsg(err));
+		this.deps.logger.warn(`board-key-source ${op} refused`, { meta: {
+			sourceId,
+			reason: failure.reason
+		} });
+		return failure.detail === void 0 ? {
+			ok: false,
+			reason: failure.reason
+		} : {
+			ok: false,
+			reason: failure.reason,
+			detail: failure.detail
+		};
+	}
+	async supervisor(broker, endpoint, method) {
+		try {
+			return await broker.send({
+				type: "supervisor/api",
+				endpoint,
+				method
+			});
+		} catch (err) {
+			const code = errorCode(err);
+			if (code !== null && ADMIN_CODES.has(code)) throw new SourceFailure("not-admin", "the Home Assistant token is not an administrator");
+			throw new SourceFailure("unreachable", errMsg(err));
+		}
+	}
+	async openIngress(sourceId) {
+		const broker = this.deps.brokers.list().find((b) => b.id === sourceId);
+		if (broker === void 0) throw new SourceFailure("unknown-source");
+		if (broker.baseUrl === null) throw new SourceFailure("no-ingress-url", "this broker has no address of its own");
+		const discovery = DiscoverySchema.safeParse(await this.supervisor(broker, "/discovery", "get"));
+		const slug = discovery.success ? discovery.data.discovery.find((d) => d.service === ESPHOME_SERVICE)?.addon : void 0;
+		if (slug === void 0) throw new SourceFailure("no-builder");
+		const info = AddonInfoSchema.safeParse(await this.supervisor(broker, `/addons/${encodeURIComponent(slug)}/info`, "get"));
+		const ingressUrl = info.success ? info.data.ingress_url : void 0;
+		if (typeof ingressUrl !== "string" || !ingressUrl.startsWith(INGRESS_PREFIX)) throw new SourceFailure("no-ingress-url");
+		const session = SessionSchema.safeParse(await this.supervisor(broker, "/ingress/session", "post"));
+		if (!session.success) throw new SourceFailure("not-admin", "no ingress session was granted");
+		return {
+			root: `${broker.baseUrl.replace(/\/+$/, "")}${ingressUrl.endsWith("/") ? ingressUrl : `${ingressUrl}/`}`,
+			cookie: `ingress_session=${session.data.session}`
+		};
+	}
+	async getJson(access, relative, configuration) {
+		let response;
+		try {
+			response = await this.deps.http(`${access.root}${relative}`, { headers: {
+				Cookie: access.cookie,
+				Accept: "application/json"
+			} });
+		} catch (err) {
+			throw new SourceFailure("unreachable", errMsg(err));
+		}
+		if (response.status === 404 && configuration !== void 0) throw new SourceFailure("unknown-board", configuration);
+		if (response.status === 401 || response.status === 403) throw new SourceFailure("not-admin", `the builder answered ${response.status}`);
+		if (!response.ok) throw new SourceFailure("unreachable", `the builder answered ${response.status}`);
+		try {
+			return await response.json();
+		} catch {
+			throw new SourceFailure("unreadable-config");
+		}
+	}
+};
+/** The cap provider over a {@link HaBoardKeySource}. */
+function createHaBoardKeyProvider(source) {
+	return {
+		listSources: async () => source.listSources(),
+		listBoards: (input) => source.listBoards(input.sourceId),
+		getBoardKey: (input) => source.getBoardKey(input.sourceId, input.configuration)
+	};
+}
+//#endregion
 //#region src/ha-calendar-source.ts
 function isCalendarEntity(entityId) {
 	return entityId.startsWith("calendar.");
@@ -8470,6 +8647,10 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 				capability: addonRoutesCapability,
 				provider: createHaIconRouteProvider()
 			},
+			{
+				capability: boardKeySourceCapability,
+				provider: this.buildBoardKeyProvider()
+			},
 			{
 				capability: calendarSourceCapability,
 				provider: createHaCalendarSource({
@@ -8480,6 +8661,23 @@ var HaProviderAddon = class HaProviderAddon extends BaseDeviceProvider {
 			}
 		];
 	}
+	/** `board-key-source`: reads an ESPHome board's key from the builder beside HA, over each broker's own token. */
+	buildBoardKeyProvider() {
+		const registry = this.requireRegistry();
+		return createHaBoardKeyProvider(new HaBoardKeySource({
+			brokers: { list: () => registry.listManagers().map(({ brokerId, manager }) => ({
+				id: brokerId,
+				name: manager.getInfo().name,
+				baseUrl: manager.getBaseUrl(),
+				send: (message) => manager.sendMessage(message)
+			})) },
+			http: (url, init) => fetch(url, {
+				headers: init.headers,
+				signal: AbortSignal.timeout(15e3)
+			}),
+			logger: this.ctx.logger.child("board-key-source")
+		}));
+	}
 	async buildNotificationOutputProvider() {
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("ha notification-output: ctx.records is required (hub-only addon)");