@camstack/system 1.2.62 → 1.2.63

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,136 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { ct as userManagementCapability, d as ScopedTokenSchema, p as UserRecordSchema, pt as BaseAddon, r as ApiKeyRecordSchema, y as authProviderCapability } from "../../dist-DnKpFaP1.mjs";
-import * as crypto$1 from "node:crypto";
-import { randomUUID } from "node:crypto";
+import { X as oauthIntegrationCapability, dt as BaseAddon, f as ScopedTokenSchema, m as UserRecordSchema, r as ApiKeyRecordSchema, st as userManagementCapability, y as authProviderCapability } from "../../dist-BJ2w3uoN.mjs";
+import * as crypto$2 from "node:crypto";
+import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
+/**
+* Scopes granted to a linked Home Assistant, derived from the tRPC paths the
+* component actually calls. `category:system [create]` was rejected: it would
+* hand `addons.installPackage` to a home-automation bridge.
+*/
+var HOME_ASSISTANT_OAUTH_INTEGRATION = {
+	integrationId: "homeassistant",
+	displayName: "Home Assistant",
+	requestedScopes: [
+		{
+			type: "category",
+			target: "device",
+			access: ["view", "create"]
+		},
+		{
+			type: "capability",
+			target: "device-manager",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "device-state",
+			access: ["view"]
+		},
+		{
+			type: "capability",
+			target: "pipeline-orchestrator",
+			access: ["view", "create"]
+		}
+	],
+	allowedRedirectPrefixes: ["https://my.home-assistant.io/redirect/oauth"],
+	allowedPrivateHostPaths: ["/auth/external/callback"],
+	requiresPkce: true
+};
+//#endregion
+//#region src/auth/parse-record.ts
+function parseRecord(kind, schema, data) {
+	try {
+		return schema.parse(data);
+	} catch (err) {
+		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
+		const detail = err instanceof Error ? err.message : String(err);
+		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
+		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
+	}
+}
+//#endregion
+//#region src/auth/api-key-manager.ts
+var API_KEYS_COLLECTION$1 = "api_keys";
+function parseApiKey(data) {
+	return parseRecord("api-key", ApiKeyRecordSchema, data);
+}
+var ApiKeyManager = class {
+	storageAccess;
+	auth;
+	constructor(storageAccess, auth) {
+		this.storageAccess = storageAccess;
+		this.auth = auth;
+	}
+	get store() {
+		return this.storageAccess.getStore();
+	}
+	async create(input) {
+		const { token: rawToken, hash, prefix } = this.auth.generateApiKey();
+		const now = Date.now();
+		const record = {
+			id: crypto$2.randomUUID(),
+			label: input.label,
+			isAdmin: input.isAdmin ?? false,
+			allowedProviders: input.allowedProviders ?? "*",
+			allowedDevices: input.allowedDevices ?? {},
+			tokenHash: hash,
+			tokenPrefix: prefix,
+			createdAt: now
+		};
+		await this.store.insert.mutate({
+			collection: API_KEYS_COLLECTION$1,
+			record: {
+				id: record.id,
+				data: { ...record }
+			}
+		});
+		return {
+			record,
+			token: rawToken
+		};
+	}
+	async validateToken(token) {
+		const allKeys = await this.store.query.query({ collection: API_KEYS_COLLECTION$1 });
+		for (const entry of allKeys) {
+			const record = parseApiKey(entry.data);
+			if (this.auth.validateApiKey(token, record.tokenHash)) {
+				const updatedData = {
+					...record,
+					lastUsedAt: Date.now()
+				};
+				await this.store.update.mutate({
+					collection: API_KEYS_COLLECTION$1,
+					id: record.id,
+					data: { ...updatedData }
+				});
+				return updatedData;
+			}
+		}
+		return null;
+	}
+	async listAll() {
+		return (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => {
+			const { tokenHash: _th, ...rest } = parseApiKey(r.data);
+			return rest;
+		});
+	}
+	async revoke(id) {
+		await this.store.delete.mutate({
+			collection: API_KEYS_COLLECTION$1,
+			key: id
+		});
+	}
+	async findById(id) {
+		const results = await this.store.query.query({
+			collection: API_KEYS_COLLECTION$1,
+			filter: { where: { id } }
+		});
+		if (results.length === 0) return null;
+		return parseApiKey(results[0].data);
+	}
+};
+//#endregion
 //#region ../../node_modules/safe-buffer/index.js
 var require_safe_buffer = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	/*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
@@ -226,14 +354,14 @@ var require_buffer_equal_constant_time = /* @__PURE__ */ __commonJSMin(((exports
 //#region ../../node_modules/jwa/index.js
 var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var Buffer = require_safe_buffer().Buffer;
-	var crypto$2 = __require("crypto");
+	var crypto$1 = __require("crypto");
 	var formatEcdsa = require_ecdsa_sig_formatter();
 	var util$2 = __require("util");
 	var MSG_INVALID_ALGORITHM = "\"%s\" is not a valid algorithm.\n  Supported algorithms are:\n  \"HS256\", \"HS384\", \"HS512\", \"RS256\", \"RS384\", \"RS512\", \"PS256\", \"PS384\", \"PS512\", \"ES256\", \"ES384\", \"ES512\" and \"none\".";
 	var MSG_INVALID_SECRET = "secret must be a string or buffer";
 	var MSG_INVALID_VERIFIER_KEY = "key must be a string or a buffer";
 	var MSG_INVALID_SIGNER_KEY = "key must be a string, a buffer or an object";
-	var supportsKeyObjects = typeof crypto$2.createPublicKey === "function";
+	var supportsKeyObjects = typeof crypto$1.createPublicKey === "function";
 	if (supportsKeyObjects) {
 		MSG_INVALID_VERIFIER_KEY += " or a KeyObject";
 		MSG_INVALID_SECRET += "or a KeyObject";
@@ -286,14 +414,14 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, secret) {
 			checkIsSecretKey(secret);
 			thing = normalizeInput(thing);
-			var hmac = crypto$2.createHmac("sha" + bits, secret);
+			var hmac = crypto$1.createHmac("sha" + bits, secret);
 			return fromBase64((hmac.update(thing), hmac.digest("base64")));
 		};
 	}
 	var bufferEqual;
-	var timingSafeEqual = "timingSafeEqual" in crypto$2 ? function timingSafeEqual(a, b) {
+	var timingSafeEqual = "timingSafeEqual" in crypto$1 ? function timingSafeEqual(a, b) {
 		if (a.byteLength !== b.byteLength) return false;
-		return crypto$2.timingSafeEqual(a, b);
+		return crypto$1.timingSafeEqual(a, b);
 	} : function timingSafeEqual(a, b) {
 		if (!bufferEqual) bufferEqual = require_buffer_equal_constant_time();
 		return bufferEqual(a, b);
@@ -308,7 +436,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$2.createSign("RSA-SHA" + bits);
+			var signer = crypto$1.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign(privateKey, "base64")));
 		};
 	}
@@ -317,7 +445,7 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify(publicKey, signature, "base64");
 		};
@@ -326,11 +454,11 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return function sign(thing, privateKey) {
 			checkIsPrivateKey(privateKey);
 			thing = normalizeInput(thing);
-			var signer = crypto$2.createSign("RSA-SHA" + bits);
+			var signer = crypto$1.createSign("RSA-SHA" + bits);
 			return fromBase64((signer.update(thing), signer.sign({
 				key: privateKey,
-				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
 			}, "base64")));
 		};
 	}
@@ -339,12 +467,12 @@ var require_jwa = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			checkIsPublicKey(publicKey);
 			thing = normalizeInput(thing);
 			signature = toBase64(signature);
-			var verifier = crypto$2.createVerify("RSA-SHA" + bits);
+			var verifier = crypto$1.createVerify("RSA-SHA" + bits);
 			verifier.update(thing);
 			return verifier.verify({
 				key: publicKey,
-				padding: crypto$2.constants.RSA_PKCS1_PSS_PADDING,
-				saltLength: crypto$2.constants.RSA_PSS_SALTLEN_DIGEST
+				padding: crypto$1.constants.RSA_PKCS1_PSS_PADDING,
+				saltLength: crypto$1.constants.RSA_PSS_SALTLEN_DIGEST
 			}, signature, "base64");
 		};
 	}
@@ -5941,7 +6069,7 @@ var AuthManager = class {
 		const configured = this.config.get("auth.jwtSecret");
 		if (configured) this.jwtSecret = configured;
 		else {
-			const secret = crypto$1.randomBytes(32).toString("hex");
+			const secret = crypto$2.randomBytes(32).toString("hex");
 			this.config.update("auth", { jwtSecret: secret });
 			this.logger.info("Generated JWT secret and saved to config.yaml (auth.jwtSecret)");
 			this.jwtSecret = secret;
@@ -5962,15 +6090,15 @@ var AuthManager = class {
 		return compare(password, hash);
 	}
 	generateApiKey() {
-		const token = crypto$1.randomBytes(32).toString("hex");
+		const token = crypto$2.randomBytes(32).toString("hex");
 		return {
 			token,
-			hash: crypto$1.createHash("sha256").update(token).digest("hex"),
+			hash: crypto$2.createHash("sha256").update(token).digest("hex"),
 			prefix: token.slice(0, 8)
 		};
 	}
 	validateApiKey(token, storedHash) {
-		return crypto$1.createHash("sha256").update(token).digest("hex") === storedHash;
+		return crypto$2.createHash("sha256").update(token).digest("hex") === storedHash;
 	}
 	/**
 	* Create a service token for agent/worker authentication.
@@ -6112,316 +6240,103 @@ var AuthManager = class {
 	}
 };
 //#endregion
-//#region src/auth/parse-record.ts
-function parseRecord(kind, schema, data) {
-	try {
-		return schema.parse(data);
-	} catch (err) {
-		const topKeys = data && typeof data === "object" && !Array.isArray(data) ? Object.keys(data).join(", ") || "(empty)" : `(non-object: ${typeof data})`;
-		const detail = err instanceof Error ? err.message : String(err);
-		const hint = data && typeof data === "object" && !Array.isArray(data) && Object.keys(data).length === 1 && "data" in data ? " This shape is the legacy double-wrap from a stale settings-store query path. Restart the server with the latest @camstack/system build." : "";
-		throw new Error(`Failed to parse ${kind} from settings store. Top-level keys=[${topKeys}].${hint} Underlying: ${detail}`, { cause: err });
-	}
-}
-//#endregion
-//#region src/auth/user-manager.ts
-var USERS_COLLECTION$1 = "users";
-function parseUser(data) {
-	return parseRecord("user", UserRecordSchema, data);
+//#region src/auth/scoped-token-manager.ts
+var TOKENS_COLLECTION = "scoped_tokens";
+var TOKEN_PREFIX = "cst_";
+function parseToken(data) {
+	return parseRecord("scoped-token", ScopedTokenSchema, data);
 }
-var UserManager = class {
-	storageAccess;
-	auth;
-	config;
-	constructor(storageAccess, auth, config) {
-		this.storageAccess = storageAccess;
-		this.auth = auth;
-		this.config = config;
-	}
-	get store() {
-		return this.storageAccess.getStore();
+/**
+* Manages scoped API tokens with restricted addon/route/capability access.
+*/
+var ScopedTokenManager = class {
+	store;
+	constructor(store) {
+		this.store = store;
 	}
-	async create(input) {
-		if (await this.findByUsername(input.username)) throw new Error(`User with username "${input.username}" already exists`);
-		const passwordHash = await this.auth.hashPassword(input.password);
-		const now = Date.now();
+	async create(userId, name, scopes, expiresAt) {
+		const rawToken = `${TOKEN_PREFIX}${crypto$2.randomBytes(32).toString("hex")}`;
+		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
+		const tokenPrefix = rawToken.slice(0, 12);
 		const record = {
-			id: crypto$1.randomUUID(),
-			username: input.username,
-			passwordHash,
-			isAdmin: input.isAdmin ?? false,
-			allowedProviders: input.allowedProviders ?? "*",
-			allowedDevices: input.allowedDevices ?? {},
-			scopes: input.scopes ?? [],
-			createdAt: now,
-			updatedAt: now
+			id: crypto$2.randomUUID(),
+			userId,
+			name,
+			tokenHash,
+			tokenPrefix,
+			scopes: scopes.map((s) => ({ ...s })),
+			expiresAt,
+			lastUsedAt: void 0,
+			createdAt: Date.now()
 		};
 		await this.store.insert.mutate({
-			collection: USERS_COLLECTION$1,
+			collection: TOKENS_COLLECTION,
 			record: {
 				id: record.id,
 				data: { ...record }
 			}
 		});
-		return record;
-	}
-	async findByUsername(username) {
-		const results = await this.store.query.query({
-			collection: USERS_COLLECTION$1,
-			filter: { where: { username } }
-		});
-		if (results.length === 0) return null;
-		return parseUser(results[0].data);
+		return {
+			token: rawToken,
+			record
+		};
 	}
-	async findById(id) {
+	async validate(rawToken) {
+		if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
+		const tokenHash = crypto$2.createHash("sha256").update(rawToken).digest("hex");
 		const results = await this.store.query.query({
-			collection: USERS_COLLECTION$1,
-			filter: { where: { id } }
+			collection: TOKENS_COLLECTION,
+			filter: { where: { tokenHash } }
 		});
 		if (results.length === 0) return null;
-		return parseUser(results[0].data);
+		const record = parseToken(results[0].data);
+		if (record.expiresAt !== void 0 && record.expiresAt !== null && Date.now() > record.expiresAt) return null;
+		this.updateLastUsed(record.id).catch(() => {});
+		return record;
 	}
-	async validateCredentials(username, password) {
-		const user = await this.findByUsername(username);
-		if (!user) return null;
-		return await this.auth.comparePassword(password, user.passwordHash) ? user : null;
+	/**
+	* Coarse scope match — checks only `addonId` / `capability` (no
+	* `route-prefix` after the caps-only migration). Used by addon-route
+	* HTTP handlers that need a quick allow/deny before the per-method
+	* `access` check kicks in via `METHOD_ACCESS_MAP` in
+	* `protectedProcedure`.
+	*/
+	matchesScope(token, addonId, capability) {
+		for (const scope of token.scopes) switch (scope.type) {
+			case "addon":
+				if (addonId && scope.target === addonId) return true;
+				break;
+			case "capability":
+				if (capability && scope.target === capability) return true;
+				break;
+		}
+		return false;
 	}
-	async listAll() {
-		return (await this.store.query.query({ collection: USERS_COLLECTION$1 })).map((r) => {
-			const { passwordHash: _ph, ...rest } = parseUser(r.data);
-			return rest;
+	async revoke(tokenId) {
+		await this.store.delete.mutate({
+			collection: TOKENS_COLLECTION,
+			key: tokenId
 		});
 	}
-	async update(id, data) {
-		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
-		await this.store.update.mutate({
-			collection: USERS_COLLECTION$1,
-			id,
-			data: {
-				...existing,
-				...data,
-				updatedAt: Date.now()
-			}
-		});
+	async listForUser(userId) {
+		return (await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { userId } }
+		})).map((r) => parseToken(r.data));
 	}
-	async delete(id) {
-		await this.store.delete.mutate({
-			collection: USERS_COLLECTION$1,
-			key: id
+	async updateLastUsed(tokenId) {
+		const results = await this.store.query.query({
+			collection: TOKENS_COLLECTION,
+			filter: { where: { id: tokenId } }
 		});
-	}
-	async resetPassword(id, newPassword) {
-		const existing = await this.findById(id);
-		if (!existing) throw new Error(`User with id "${id}" not found`);
-		const passwordHash = await this.auth.hashPassword(newPassword);
+		if (results.length === 0) return;
+		const existing = parseToken(results[0].data);
 		await this.store.update.mutate({
-			collection: USERS_COLLECTION$1,
-			id,
+			collection: TOKENS_COLLECTION,
+			id: tokenId,
 			data: {
 				...existing,
-				passwordHash,
-				updatedAt: Date.now()
-			}
-		});
-	}
-	async ensureAdminExists() {
-		const adminUsername = this.config.get("auth.adminUsername");
-		const adminPassword = this.config.get("auth.adminPassword");
-		if (!adminUsername || !adminPassword) return;
-		const existing = await this.findByUsername(adminUsername);
-		if (existing) {
-			if (!await this.auth.comparePassword(adminPassword, existing.passwordHash)) await this.resetPassword(existing.id, adminPassword);
-			return;
-		}
-		await this.create({
-			username: adminUsername,
-			password: adminPassword,
-			isAdmin: true,
-			allowedProviders: "*",
-			allowedDevices: {}
-		});
-	}
-};
-//#endregion
-//#region src/auth/api-key-manager.ts
-var API_KEYS_COLLECTION$1 = "api_keys";
-function parseApiKey(data) {
-	return parseRecord("api-key", ApiKeyRecordSchema, data);
-}
-var ApiKeyManager = class {
-	storageAccess;
-	auth;
-	constructor(storageAccess, auth) {
-		this.storageAccess = storageAccess;
-		this.auth = auth;
-	}
-	get store() {
-		return this.storageAccess.getStore();
-	}
-	async create(input) {
-		const { token: rawToken, hash, prefix } = this.auth.generateApiKey();
-		const now = Date.now();
-		const record = {
-			id: crypto$1.randomUUID(),
-			label: input.label,
-			isAdmin: input.isAdmin ?? false,
-			allowedProviders: input.allowedProviders ?? "*",
-			allowedDevices: input.allowedDevices ?? {},
-			tokenHash: hash,
-			tokenPrefix: prefix,
-			createdAt: now
-		};
-		await this.store.insert.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			record: {
-				id: record.id,
-				data: { ...record }
-			}
-		});
-		return {
-			record,
-			token: rawToken
-		};
-	}
-	async validateToken(token) {
-		const allKeys = await this.store.query.query({ collection: API_KEYS_COLLECTION$1 });
-		for (const entry of allKeys) {
-			const record = parseApiKey(entry.data);
-			if (this.auth.validateApiKey(token, record.tokenHash)) {
-				const updatedData = {
-					...record,
-					lastUsedAt: Date.now()
-				};
-				await this.store.update.mutate({
-					collection: API_KEYS_COLLECTION$1,
-					id: record.id,
-					data: { ...updatedData }
-				});
-				return updatedData;
-			}
-		}
-		return null;
-	}
-	async listAll() {
-		return (await this.store.query.query({ collection: API_KEYS_COLLECTION$1 })).map((r) => {
-			const { tokenHash: _th, ...rest } = parseApiKey(r.data);
-			return rest;
-		});
-	}
-	async revoke(id) {
-		await this.store.delete.mutate({
-			collection: API_KEYS_COLLECTION$1,
-			key: id
-		});
-	}
-	async findById(id) {
-		const results = await this.store.query.query({
-			collection: API_KEYS_COLLECTION$1,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseApiKey(results[0].data);
-	}
-};
-//#endregion
-//#region src/auth/scoped-token-manager.ts
-var TOKENS_COLLECTION = "scoped_tokens";
-var TOKEN_PREFIX = "cst_";
-function parseToken(data) {
-	return parseRecord("scoped-token", ScopedTokenSchema, data);
-}
-/**
-* Manages scoped API tokens with restricted addon/route/capability access.
-*/
-var ScopedTokenManager = class {
-	store;
-	constructor(store) {
-		this.store = store;
-	}
-	async create(userId, name, scopes, expiresAt) {
-		const rawToken = `${TOKEN_PREFIX}${crypto$1.randomBytes(32).toString("hex")}`;
-		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
-		const tokenPrefix = rawToken.slice(0, 12);
-		const record = {
-			id: crypto$1.randomUUID(),
-			userId,
-			name,
-			tokenHash,
-			tokenPrefix,
-			scopes: scopes.map((s) => ({ ...s })),
-			expiresAt,
-			lastUsedAt: void 0,
-			createdAt: Date.now()
-		};
-		await this.store.insert.mutate({
-			collection: TOKENS_COLLECTION,
-			record: {
-				id: record.id,
-				data: { ...record }
-			}
-		});
-		return {
-			token: rawToken,
-			record
-		};
-	}
-	async validate(rawToken) {
-		if (!rawToken.startsWith(TOKEN_PREFIX)) return null;
-		const tokenHash = crypto$1.createHash("sha256").update(rawToken).digest("hex");
-		const results = await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { tokenHash } }
-		});
-		if (results.length === 0) return null;
-		const record = parseToken(results[0].data);
-		if (record.expiresAt !== void 0 && record.expiresAt !== null && Date.now() > record.expiresAt) return null;
-		this.updateLastUsed(record.id).catch(() => {});
-		return record;
-	}
-	/**
-	* Coarse scope match — checks only `addonId` / `capability` (no
-	* `route-prefix` after the caps-only migration). Used by addon-route
-	* HTTP handlers that need a quick allow/deny before the per-method
-	* `access` check kicks in via `METHOD_ACCESS_MAP` in
-	* `protectedProcedure`.
-	*/
-	matchesScope(token, addonId, capability) {
-		for (const scope of token.scopes) switch (scope.type) {
-			case "addon":
-				if (addonId && scope.target === addonId) return true;
-				break;
-			case "capability":
-				if (capability && scope.target === capability) return true;
-				break;
-		}
-		return false;
-	}
-	async revoke(tokenId) {
-		await this.store.delete.mutate({
-			collection: TOKENS_COLLECTION,
-			key: tokenId
-		});
-	}
-	async listForUser(userId) {
-		return (await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { userId } }
-		})).map((r) => parseToken(r.data));
-	}
-	async updateLastUsed(tokenId) {
-		const results = await this.store.query.query({
-			collection: TOKENS_COLLECTION,
-			filter: { where: { id: tokenId } }
-		});
-		if (results.length === 0) return;
-		const existing = parseToken(results[0].data);
-		await this.store.update.mutate({
-			collection: TOKENS_COLLECTION,
-			id: tokenId,
-			data: {
-				...existing,
-				lastUsedAt: Date.now()
+				lastUsedAt: Date.now()
 			}
 		});
 	}
@@ -6489,164 +6404,6 @@ var ScopedTokenManager = class {
 		}
 		return removed;
 	}
-};
-//#endregion
-//#region src/builtins/local-auth/oauth-session-manager.ts
-/**
-* Manages OAuth session records in the `oauth_sessions` collection.
-*
-* Each record represents one Alexa-style account link. Sessions can be
-* active (`revokedAt = null`) or revoked (`revokedAt = <unix-ms>`).
-* `list()` returns both — callers decide whether to filter.
-*
-* Mirrors the pattern of `ScopedTokenManager`: takes a `SettingsStoreClient`
-* in its constructor and performs all reads/writes via the store's
-* `insert`, `update`, `delete`, and `query` primitives.
-*/
-var SESSIONS_COLLECTION = "oauth_sessions";
-function parseSession(data) {
-	const id = data["id"];
-	const userId = data["userId"];
-	const username = data["username"];
-	const integrationId = data["integrationId"];
-	const scopes = data["scopes"];
-	const createdAt = data["createdAt"];
-	const lastUsedAt = data["lastUsedAt"];
-	const revokedAt = data["revokedAt"];
-	if (typeof id !== "string") throw new Error("oauth_sessions row: missing id");
-	if (typeof userId !== "string") throw new Error("oauth_sessions row: missing userId");
-	if (typeof username !== "string") throw new Error("oauth_sessions row: missing username");
-	if (typeof integrationId !== "string") throw new Error("oauth_sessions row: missing integrationId");
-	if (!Array.isArray(scopes)) throw new Error("oauth_sessions row: scopes must be an array");
-	if (typeof createdAt !== "number") throw new Error("oauth_sessions row: missing createdAt");
-	if (typeof lastUsedAt !== "number") throw new Error("oauth_sessions row: missing lastUsedAt");
-	return {
-		id,
-		userId,
-		username,
-		integrationId,
-		scopes,
-		createdAt,
-		lastUsedAt,
-		revokedAt: typeof revokedAt === "number" ? revokedAt : null
-	};
-}
-var OauthSessionManager = class {
-	store;
-	constructor(store) {
-		this.store = store;
-	}
-	/**
-	* Create a new OAuth session record. Generates a UUID as the session id,
-	* sets `createdAt` and `lastUsedAt` to now, `revokedAt` to null.
-	*/
-	async create(input) {
-		const now = Date.now();
-		const session = {
-			id: crypto$1.randomUUID(),
-			userId: input.userId,
-			username: input.username,
-			integrationId: input.integrationId,
-			scopes: input.scopes.map((s) => ({ ...s })),
-			createdAt: now,
-			lastUsedAt: now,
-			revokedAt: null
-		};
-		await this.store.insert.mutate({
-			collection: SESSIONS_COLLECTION,
-			record: {
-				id: session.id,
-				data: { ...session }
-			}
-		});
-		return session;
-	}
-	/**
-	* Return all sessions — both active and revoked. Callers decide
-	* whether to filter by `revokedAt`.
-	*/
-	async list() {
-		return (await this.store.query.query({
-			collection: SESSIONS_COLLECTION,
-			filter: {}
-		})).map((r) => parseSession(r.data));
-	}
-	/**
-	* Look up a session by its id. Returns null when not found.
-	*/
-	async getById(id) {
-		const results = await this.store.query.query({
-			collection: SESSIONS_COLLECTION,
-			filter: { where: { id } }
-		});
-		if (results.length === 0) return null;
-		return parseSession(results[0].data);
-	}
-	/**
-	* Mark a session as revoked by setting `revokedAt = now`.
-	*
-	* - Returns `true` on success (including idempotent re-revoke — the
-	*   existing `revokedAt` timestamp is preserved; it is NOT updated).
-	* - Returns `false` when the session id is not found.
-	*/
-	async markRevoked(id) {
-		const existing = await this.getById(id);
-		if (existing === null) return false;
-		if (existing.revokedAt !== null) return true;
-		const updated = {
-			...existing,
-			revokedAt: Date.now()
-		};
-		await this.store.update.mutate({
-			collection: SESSIONS_COLLECTION,
-			id,
-			data: { ...updated }
-		});
-		return true;
-	}
-	/**
-	* Delete sessions revoked longer ago than `horizonMs`.
-	*
-	* Safe because an ABSENT session already fails closed exactly like a revoked
-	* one: every consumer in `oauth-grants.ts` reads
-	* `if (!session || session.revokedAt != null) return null`. Deleting the row
-	* therefore cannot re-enable a link that was cut — it removes a record whose
-	* only remaining job was to say "no", which the absence says too.
-	*
-	* A retention window rather than an immediate delete: a revoked account link
-	* is the kind of thing an operator looks up AFTER the fact ("when did I
-	* unlink that?"), and the row is tiny. Active sessions are never touched —
-	* the filter matches only rows with a `revokedAt` timestamp in range, and
-	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
-	* matches.
-	*
-	* Returns how many rows went.
-	*/
-	async reapRevoked(horizonMs) {
-		const { deleted } = await this.store.deleteWhere.mutate({
-			collection: SESSIONS_COLLECTION,
-			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
-		});
-		return deleted;
-	}
-	/**
-	* Update `lastUsedAt` to now. No-op (does not throw) when the session
-	* id is not found — the caller (token-use hot path) should not fail
-	* for a missing session that may have been concurrently revoked.
-	*/
-	async touch(id) {
-		const existing = await this.getById(id);
-		if (existing === null) return;
-		const updated = {
-			...existing,
-			lastUsedAt: Date.now()
-		};
-		await this.store.update.mutate({
-			collection: SESSIONS_COLLECTION,
-			id,
-			data: { ...updated }
-		});
-	}
 }, i$2 = class extends Error {
 	constructor(e, t) {
 		super(e, t), this.name = "OTPError";
@@ -8903,53 +8660,173 @@ var TotpManager = class {
 		}
 		return true;
 	}
-	/**
-	* Remove enrollment. Idempotent — no error if the user had no row.
-	*/
-	async disable(userId) {
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
+	/**
+	* Remove enrollment. Idempotent — no error if the user had no row.
+	*/
+	async disable(userId) {
+		await this.store.delete.mutate({
+			collection: TOTP_COLLECTION,
+			key: userId
+		});
+	}
+	/**
+	* Verify a code against the confirmed secret. Returns `false` when:
+	*   - The user has no row (not set up).
+	*   - The row is pending (`confirmedAt === null`).
+	*   - The code doesn't match within the configured window.
+	*/
+	async verify(userId, code) {
+		const row = await this.find(userId);
+		if (!row) return false;
+		if (row.confirmedAt === null) return false;
+		return d({
+			token: code,
+			secret: row.secret,
+			epochTolerance: this.epochTolerance
+		}).valid;
+	}
+	/**
+	* Read the user's enrollment status. Pending half-enrollments are
+	* reported as `enabled: false` — only a confirmed row counts.
+	*/
+	async getStatus(userId) {
+		const row = await this.find(userId);
+		if (!row) return {
+			enabled: false,
+			confirmedAt: null
+		};
+		return {
+			enabled: row.confirmedAt !== null,
+			confirmedAt: row.confirmedAt
+		};
+	}
+	async find(userId) {
+		const results = await this.store.query.query({
+			collection: TOTP_COLLECTION,
+			filter: { where: { userId } }
+		});
+		if (results.length === 0) return null;
+		return parseRow(results[0].data);
+	}
+};
+//#endregion
+//#region src/auth/user-manager.ts
+var USERS_COLLECTION$1 = "users";
+function parseUser(data) {
+	return parseRecord("user", UserRecordSchema, data);
+}
+var UserManager = class {
+	storageAccess;
+	auth;
+	config;
+	constructor(storageAccess, auth, config) {
+		this.storageAccess = storageAccess;
+		this.auth = auth;
+		this.config = config;
+	}
+	get store() {
+		return this.storageAccess.getStore();
+	}
+	async create(input) {
+		if (await this.findByUsername(input.username)) throw new Error(`User with username "${input.username}" already exists`);
+		const passwordHash = await this.auth.hashPassword(input.password);
+		const now = Date.now();
+		const record = {
+			id: crypto$2.randomUUID(),
+			username: input.username,
+			passwordHash,
+			isAdmin: input.isAdmin ?? false,
+			allowedProviders: input.allowedProviders ?? "*",
+			allowedDevices: input.allowedDevices ?? {},
+			scopes: input.scopes ?? [],
+			createdAt: now,
+			updatedAt: now
+		};
+		await this.store.insert.mutate({
+			collection: USERS_COLLECTION$1,
+			record: {
+				id: record.id,
+				data: { ...record }
+			}
+		});
+		return record;
+	}
+	async findByUsername(username) {
+		const results = await this.store.query.query({
+			collection: USERS_COLLECTION$1,
+			filter: { where: { username } }
+		});
+		if (results.length === 0) return null;
+		return parseUser(results[0].data);
+	}
+	async findById(id) {
+		const results = await this.store.query.query({
+			collection: USERS_COLLECTION$1,
+			filter: { where: { id } }
+		});
+		if (results.length === 0) return null;
+		return parseUser(results[0].data);
+	}
+	async validateCredentials(username, password) {
+		const user = await this.findByUsername(username);
+		if (!user) return null;
+		return await this.auth.comparePassword(password, user.passwordHash) ? user : null;
+	}
+	async listAll() {
+		return (await this.store.query.query({ collection: USERS_COLLECTION$1 })).map((r) => {
+			const { passwordHash: _ph, ...rest } = parseUser(r.data);
+			return rest;
+		});
+	}
+	async update(id, data) {
+		const existing = await this.findById(id);
+		if (!existing) throw new Error(`User with id "${id}" not found`);
+		await this.store.update.mutate({
+			collection: USERS_COLLECTION$1,
+			id,
+			data: {
+				...existing,
+				...data,
+				updatedAt: Date.now()
+			}
 		});
 	}
-	/**
-	* Verify a code against the confirmed secret. Returns `false` when:
-	*   - The user has no row (not set up).
-	*   - The row is pending (`confirmedAt === null`).
-	*   - The code doesn't match within the configured window.
-	*/
-	async verify(userId, code) {
-		const row = await this.find(userId);
-		if (!row) return false;
-		if (row.confirmedAt === null) return false;
-		return d({
-			token: code,
-			secret: row.secret,
-			epochTolerance: this.epochTolerance
-		}).valid;
+	async delete(id) {
+		await this.store.delete.mutate({
+			collection: USERS_COLLECTION$1,
+			key: id
+		});
 	}
-	/**
-	* Read the user's enrollment status. Pending half-enrollments are
-	* reported as `enabled: false` — only a confirmed row counts.
-	*/
-	async getStatus(userId) {
-		const row = await this.find(userId);
-		if (!row) return {
-			enabled: false,
-			confirmedAt: null
-		};
-		return {
-			enabled: row.confirmedAt !== null,
-			confirmedAt: row.confirmedAt
-		};
+	async resetPassword(id, newPassword) {
+		const existing = await this.findById(id);
+		if (!existing) throw new Error(`User with id "${id}" not found`);
+		const passwordHash = await this.auth.hashPassword(newPassword);
+		await this.store.update.mutate({
+			collection: USERS_COLLECTION$1,
+			id,
+			data: {
+				...existing,
+				passwordHash,
+				updatedAt: Date.now()
+			}
+		});
 	}
-	async find(userId) {
-		const results = await this.store.query.query({
-			collection: TOTP_COLLECTION,
-			filter: { where: { userId } }
+	async ensureAdminExists() {
+		const adminUsername = this.config.get("auth.adminUsername");
+		const adminPassword = this.config.get("auth.adminPassword");
+		if (!adminUsername || !adminPassword) return;
+		const existing = await this.findByUsername(adminUsername);
+		if (existing) {
+			if (!await this.auth.comparePassword(adminPassword, existing.passwordHash)) await this.resetPassword(existing.id, adminPassword);
+			return;
+		}
+		await this.create({
+			username: adminUsername,
+			password: adminPassword,
+			isAdmin: true,
+			allowedProviders: "*",
+			allowedDevices: {}
 		});
-		if (results.length === 0) return null;
-		return parseRow(results[0].data);
 	}
 };
 //#endregion
@@ -9220,6 +9097,21 @@ var TTL = {
 	"oauth-access": 3600,
 	"oauth-refresh": 2592e3
 };
+/**
+* PKCE S256 check (RFC 7636 §4.6): `BASE64URL(SHA256(verifier)) === challenge`.
+*
+* Keyed off the CLAIM, never off the descriptor: a code minted with a challenge
+* stays unusable without the verifier even if the integration later stops
+* requiring PKCE. Constant-time compare so a wrong verifier cannot be walked
+* byte by byte inside the code's 60 s window.
+*/
+function verifyPkceS256(challenge, verifier) {
+	if (!verifier) return false;
+	const expected = Buffer.from(createHash("sha256").update(verifier).digest("base64url"));
+	const actual = Buffer.from(challenge);
+	if (expected.length !== actual.length) return false;
+	return timingSafeEqual(expected, actual);
+}
 /** OAuth account-linking grant logic. Pure over an injected sso-bridge
 *  signer so it is unit-testable without the capability registry.
 *
@@ -9270,7 +9162,8 @@ function createOauthGrants(ssoBridge, sessionManager) {
 					provider: "oauth-code",
 					redirectUri: input.redirectUri,
 					integrationId: input.integrationId,
-					jti
+					jti,
+					...input.codeChallenge ? { codeChallenge: input.codeChallenge } : {}
 				},
 				ttlSec: TTL["oauth-code"]
 			});
@@ -9280,6 +9173,10 @@ function createOauthGrants(ssoBridge, sessionManager) {
 			const claims = await ssoBridge.verifyBridgeToken({ token: input.code });
 			if (!claims || claims.provider !== "oauth-code") return null;
 			if (claims.redirectUri !== input.redirectUri) return null;
+			const codeChallenge = claims.codeChallenge;
+			if (typeof codeChallenge === "string" && codeChallenge !== "") {
+				if (!verifyPkceS256(codeChallenge, input.codeVerifier)) return null;
+			}
 			const jti = claims.jti;
 			if (!jti) return null;
 			const expiryMs = Date.now() + TTL["oauth-code"] * 1e3;
@@ -9324,6 +9221,164 @@ function createOauthGrants(ssoBridge, sessionManager) {
 	};
 }
 //#endregion
+//#region src/builtins/local-auth/oauth-session-manager.ts
+/**
+* Manages OAuth session records in the `oauth_sessions` collection.
+*
+* Each record represents one Alexa-style account link. Sessions can be
+* active (`revokedAt = null`) or revoked (`revokedAt = <unix-ms>`).
+* `list()` returns both — callers decide whether to filter.
+*
+* Mirrors the pattern of `ScopedTokenManager`: takes a `SettingsStoreClient`
+* in its constructor and performs all reads/writes via the store's
+* `insert`, `update`, `delete`, and `query` primitives.
+*/
+var SESSIONS_COLLECTION = "oauth_sessions";
+function parseSession(data) {
+	const id = data["id"];
+	const userId = data["userId"];
+	const username = data["username"];
+	const integrationId = data["integrationId"];
+	const scopes = data["scopes"];
+	const createdAt = data["createdAt"];
+	const lastUsedAt = data["lastUsedAt"];
+	const revokedAt = data["revokedAt"];
+	if (typeof id !== "string") throw new Error("oauth_sessions row: missing id");
+	if (typeof userId !== "string") throw new Error("oauth_sessions row: missing userId");
+	if (typeof username !== "string") throw new Error("oauth_sessions row: missing username");
+	if (typeof integrationId !== "string") throw new Error("oauth_sessions row: missing integrationId");
+	if (!Array.isArray(scopes)) throw new Error("oauth_sessions row: scopes must be an array");
+	if (typeof createdAt !== "number") throw new Error("oauth_sessions row: missing createdAt");
+	if (typeof lastUsedAt !== "number") throw new Error("oauth_sessions row: missing lastUsedAt");
+	return {
+		id,
+		userId,
+		username,
+		integrationId,
+		scopes,
+		createdAt,
+		lastUsedAt,
+		revokedAt: typeof revokedAt === "number" ? revokedAt : null
+	};
+}
+var OauthSessionManager = class {
+	store;
+	constructor(store) {
+		this.store = store;
+	}
+	/**
+	* Create a new OAuth session record. Generates a UUID as the session id,
+	* sets `createdAt` and `lastUsedAt` to now, `revokedAt` to null.
+	*/
+	async create(input) {
+		const now = Date.now();
+		const session = {
+			id: crypto$2.randomUUID(),
+			userId: input.userId,
+			username: input.username,
+			integrationId: input.integrationId,
+			scopes: input.scopes.map((s) => ({ ...s })),
+			createdAt: now,
+			lastUsedAt: now,
+			revokedAt: null
+		};
+		await this.store.insert.mutate({
+			collection: SESSIONS_COLLECTION,
+			record: {
+				id: session.id,
+				data: { ...session }
+			}
+		});
+		return session;
+	}
+	/**
+	* Return all sessions — both active and revoked. Callers decide
+	* whether to filter by `revokedAt`.
+	*/
+	async list() {
+		return (await this.store.query.query({
+			collection: SESSIONS_COLLECTION,
+			filter: {}
+		})).map((r) => parseSession(r.data));
+	}
+	/**
+	* Look up a session by its id. Returns null when not found.
+	*/
+	async getById(id) {
+		const results = await this.store.query.query({
+			collection: SESSIONS_COLLECTION,
+			filter: { where: { id } }
+		});
+		if (results.length === 0) return null;
+		return parseSession(results[0].data);
+	}
+	/**
+	* Mark a session as revoked by setting `revokedAt = now`.
+	*
+	* - Returns `true` on success (including idempotent re-revoke — the
+	*   existing `revokedAt` timestamp is preserved; it is NOT updated).
+	* - Returns `false` when the session id is not found.
+	*/
+	async markRevoked(id) {
+		const existing = await this.getById(id);
+		if (existing === null) return false;
+		if (existing.revokedAt !== null) return true;
+		const updated = {
+			...existing,
+			revokedAt: Date.now()
+		};
+		await this.store.update.mutate({
+			collection: SESSIONS_COLLECTION,
+			id,
+			data: { ...updated }
+		});
+		return true;
+	}
+	/**
+	* Delete sessions revoked longer ago than `horizonMs`.
+	*
+	* Safe because an ABSENT session already fails closed exactly like a revoked
+	* one: every consumer in `oauth-grants.ts` reads
+	* `if (!session || session.revokedAt != null) return null`. Deleting the row
+	* therefore cannot re-enable a link that was cut — it removes a record whose
+	* only remaining job was to say "no", which the absence says too.
+	*
+	* A retention window rather than an immediate delete: a revoked account link
+	* is the kind of thing an operator looks up AFTER the fact ("when did I
+	* unlink that?"), and the row is tiny. Active sessions are never touched —
+	* the filter matches only rows with a `revokedAt` timestamp in range, and
+	* `revokedAt` is NULL on every live session, which SQL's `BETWEEN` never
+	* matches.
+	*
+	* Returns how many rows went.
+	*/
+	async reapRevoked(horizonMs) {
+		const { deleted } = await this.store.deleteWhere.mutate({
+			collection: SESSIONS_COLLECTION,
+			filter: { whereBetween: { revokedAt: [1, horizonMs] } }
+		});
+		return deleted;
+	}
+	/**
+	* Update `lastUsedAt` to now. No-op (does not throw) when the session
+	* id is not found — the caller (token-use hot path) should not fail
+	* for a missing session that may have been concurrently revoked.
+	*/
+	async touch(id) {
+		const existing = await this.getById(id);
+		if (existing === null) return;
+		const updated = {
+			...existing,
+			lastUsedAt: Date.now()
+		};
+		await this.store.update.mutate({
+			collection: SESSIONS_COLLECTION,
+			id,
+			data: { ...updated }
+		});
+	}
+};
+//#endregion
 //#region src/builtins/local-auth/local-auth.addon.ts
 /** How often the auth tables are swept for dead rows. */
 var AUTH_REAP_INTERVAL_MS = 24 * 36e5;
@@ -9595,14 +9650,22 @@ var LocalAuthAddon = class extends BaseAddon {
 				return { valid: await this.totpManager.verify(input.userId, input.code) };
 			}
 		};
-		this.ctx.logger.info("registered auth-provider + user-management capabilities");
-		return [{
-			capability: authProviderCapability,
-			provider: authProvider
-		}, {
-			capability: userManagementCapability,
-			provider: userMgmt
-		}];
+		const homeAssistantOauth = { getDescriptor: async () => HOME_ASSISTANT_OAUTH_INTEGRATION };
+		this.ctx.logger.info("registered auth-provider + user-management + oauth-integration capabilities");
+		return [
+			{
+				capability: authProviderCapability,
+				provider: authProvider
+			},
+			{
+				capability: userManagementCapability,
+				provider: userMgmt
+			},
+			{
+				capability: oauthIntegrationCapability,
+				provider: homeAssistantOauth
+			}
+		];
 	}
 	/**
 	* Drop auth rows that are dead but were never removed: scoped tokens past
@@ -9639,4 +9702,4 @@ var LocalAuthAddon = class extends BaseAddon {
 	}
 };
 //#endregion
-export { LocalAuthAddon, LocalAuthAddon as default, require_ms as a, AuthManager as i, ApiKeyManager as n, require_safe_buffer as o, UserManager as r, ScopedTokenManager as t };
+export { LocalAuthAddon, LocalAuthAddon as default, require_safe_buffer as a, require_ms as i, ScopedTokenManager as n, ApiKeyManager as o, AuthManager as r, HOME_ASSISTANT_OAUTH_INTEGRATION as s, UserManager as t };