@camstack/system 1.2.69 → 1.2.70

package/dist/builtins/native-metrics/native-metrics.addon.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
-let node_util = require("node:util");
+const require_dist = require("../../dist-DCLoJf2T.js");
 let node_child_process = require("node:child_process");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/native-metrics/native-metrics-provider.ts
 var IS_DARWIN = node_os.platform() === "darwin";
 var IS_LINUX = node_os.platform() === "linux";
@@ -123,7 +123,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-DNNomR-i.js")).then((n) => n.resource_monitor_exports);
+		const { getPidStats } = await Promise.resolve().then(() => require("../../resource-monitor-CdnzxBLP.js")).then((n) => n.resource_monitor_exports);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({

package/dist/builtins/native-metrics/native-metrics.addon.mjs

@@ -1,8 +1,8 @@
-import { Et as createEvent, X as metricsProviderCapability, pt as BaseAddon, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
-import * as fs from "node:fs";
-import { promisify } from "node:util";
+import { Rt as EventCategory, Tt as createEvent, X as metricsProviderCapability, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
 import { execFile, execFileSync } from "node:child_process";
+import { promisify } from "node:util";
 import * as os from "node:os";
+import * as fs from "node:fs";
 //#region src/builtins/native-metrics/native-metrics-provider.ts
 var IS_DARWIN = os.platform() === "darwin";
 var IS_LINUX = os.platform() === "linux";
@@ -116,7 +116,7 @@ var NativeMetricsProvider = class {
 		return getCpuTemperatureInternal();
 	}
 	async getProcessStats(input) {
-		const { getPidStats } = await import("../../resource-monitor-BkP504Vq.mjs").then((n) => n.r);
+		const { getPidStats } = await import("../../resource-monitor-BWmQ5i-o.mjs").then((n) => n.r);
 		const raw = await getPidStats(input.pids);
 		const result = [];
 		for (const [pid, s] of raw) result.push({

package/dist/builtins/platform-probe/index.js

@@ -3,13 +3,13 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
-let node_util = require("node:util");
+const require_dist = require("../../dist-DCLoJf2T.js");
 let node_child_process = require("node:child_process");
+let node_util = require("node:util");
 let node_os = require("node:os");
 node_os = require_chunk.__toESM(node_os);
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/platform-probe/index.mjs

@@ -1,9 +1,9 @@
 import { o as __toESM } from "../../chunk-CNf5ZN-e.mjs";
-import { Ot as emitReadiness, P as enumerateInferenceDevices, ft as errMsg, pt as BaseAddon, rt as scoreRuntimes, tt as platformProbeCapability, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
-import * as fs from "node:fs";
-import { promisify } from "node:util";
+import { Dt as emitReadiness, P as enumerateInferenceDevices, Rt as EventCategory, dt as errMsg, et as platformProbeCapability, ft as BaseAddon, nt as scoreRuntimes } from "../../dist-CnQXXnK1.mjs";
 import { execFile } from "node:child_process";
+import { promisify } from "node:util";
 import * as os from "node:os";
+import * as fs from "node:fs";
 //#region src/builtins/platform-probe/coral-accelerators.ts
 /**
 * Coral USB Edge TPU USB identifiers.

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-DCLoJf2T.js");
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/remote-access-orchestrator/remote-access-orchestrator.addon.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, zt as EventCategory } from "../../dist-C-QzFJ8v.mjs";
+import { Rt as EventCategory, ft as BaseAddon } from "../../dist-CnQXXnK1.mjs";
 //#region src/builtins/remote-access-orchestrator/enabled-providers-reconcile.ts
 /**
 * Reconcile the durable `enabledProviders` set against authoritative

package/dist/builtins/snapshot/index.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let _camstack_types_node = require("@camstack/types/node");
+const require_dist = require("../../dist-DCLoJf2T.js");
 let zod = require("zod");
 let node_crypto = require("node:crypto");
+let _camstack_types_node = require("@camstack/types/node");
 let node_child_process = require("node:child_process");
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/snapshot/index.mjs

@@ -1,7 +1,7 @@
-import { C as bareAddonId, Mt as nodePin, _t as DeviceFeature, at as snapshotCapability, ct as streamQualityLabel, ft as errMsg, i as BatteryStatusSchema, pt as BaseAddon, yt as DeviceType } from "../../dist-C-QzFJ8v.mjs";
-import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";
+import { C as bareAddonId, dt as errMsg, ft as BaseAddon, gt as DeviceFeature, i as BatteryStatusSchema, it as snapshotCapability, jt as nodePin, st as streamQualityLabel, vt as DeviceType } from "../../dist-CnQXXnK1.mjs";
 import { z } from "zod";
 import { randomUUID } from "node:crypto";
+import { signExpiringUrl, verifyExpiringUrl } from "@camstack/types/node";
 import { execFile, spawn } from "node:child_process";
 //#region src/builtins/snapshot/snapshot-coalescing.ts
 /**

package/dist/builtins/sqlite-storage/filesystem-storage.addon.js

@@ -3,14 +3,14 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-DCLoJf2T.js");
 let node_crypto = require("node:crypto");
-let node_fs = require("node:fs");
-node_fs = require_chunk.__toESM(node_fs);
+let node_fs_promises = require("node:fs/promises");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);
 let node_os = require("node:os");
-let node_fs_promises = require("node:fs/promises");
+let node_fs = require("node:fs");
+node_fs = require_chunk.__toESM(node_fs);
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
 * Allowed-root containment guard for the filesystem-browse cap. Pure +

package/dist/builtins/sqlite-storage/filesystem-storage.addon.mjs

@@ -1,10 +1,10 @@
-import { R as filesystemBrowseCapability, pt as BaseAddon, st as storageProviderCapability } from "../../dist-C-QzFJ8v.mjs";
+import { R as filesystemBrowseCapability, ft as BaseAddon, ot as storageProviderCapability } from "../../dist-CnQXXnK1.mjs";
 import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
+import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
 import * as path$1 from "node:path";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { homedir } from "node:os";
-import { mkdir, readdir, realpath, statfs } from "node:fs/promises";
+import * as fs from "node:fs";
 //#region src/builtins/sqlite-storage/path-guard.ts
 /**
 * Allowed-root containment guard for the filesystem-browse cap. Pure +

package/dist/builtins/sqlite-storage/sqlite-settings.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-DCLoJf2T.js");
 let node_crypto = require("node:crypto");
 let node_fs = require("node:fs");
 let node_module = require("node:module");

package/dist/builtins/sqlite-storage/sqlite-settings.addon.mjs

@@ -1,4 +1,4 @@
-import { C as bareAddonId, Ct as asJsonObject, O as dataStoreProviderCapability, Pt as parseJsonUnknown, dt as vectorStoreCapability, f as RUNTIME_DEFAULTS, ft as errMsg, k as decodeVectorBase64, pt as BaseAddon, ut as vectorDimFromBase64 } from "../../dist-C-QzFJ8v.mjs";
+import { C as bareAddonId, Nt as parseJsonUnknown, O as dataStoreProviderCapability, St as asJsonObject, dt as errMsg, f as RUNTIME_DEFAULTS, ft as BaseAddon, k as decodeVectorBase64, lt as vectorDimFromBase64, ut as vectorStoreCapability } from "../../dist-CnQXXnK1.mjs";
 import { createRequire } from "node:module";
 import { randomUUID } from "node:crypto";
 import { statSync } from "node:fs";

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.js

@@ -3,11 +3,11 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
-let node_path = require("node:path");
-node_path = require_chunk.__toESM(node_path);
+const require_dist = require("../../dist-DCLoJf2T.js");
 let node_fs_promises = require("node:fs/promises");
 node_fs_promises = require_chunk.__toESM(node_fs_promises);
+let node_path = require("node:path");
+node_path = require_chunk.__toESM(node_path);
 let _camstack_system = require("@camstack/system");
 //#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
 var SESSION_VOCABULARY = {

package/dist/builtins/storage-orchestrator/storage-orchestrator.addon.mjs

@@ -1,6 +1,6 @@
-import { Nt as parseJsonObject, h as StorageLocationTypeSchema, it as settingsStoreCapability, ot as storageCapability, pt as BaseAddon } from "../../dist-C-QzFJ8v.mjs";
-import * as path$1 from "node:path";
+import { Mt as parseJsonObject, at as storageCapability, ft as BaseAddon, h as StorageLocationTypeSchema, rt as settingsStoreCapability } from "../../dist-CnQXXnK1.mjs";
 import * as fs from "node:fs/promises";
+import * as path$1 from "node:path";
 import { buildStorageLocationRegistry } from "@camstack/system";
 //#region src/builtins/storage-orchestrator/storage-orchestrator.service.ts
 var SESSION_VOCABULARY = {

package/dist/builtins/system-config/system-config.addon.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-DCLoJf2T.js");
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/system-config/system-config.addon.mjs

@@ -1,4 +1,4 @@
-import { At as hydrateSchema, ft as errMsg, pt as BaseAddon } from "../../dist-C-QzFJ8v.mjs";
+import { dt as errMsg, ft as BaseAddon, kt as hydrateSchema } from "../../dist-CnQXXnK1.mjs";
 //#region src/builtins/system-config/system-config.addon.ts
 /**
 * Built-in `system-config` addon — Phase 4 of the settings redesign.

package/dist/builtins/winston-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-D7wC-S4p.js");
+const require_dist = require("../../dist-DCLoJf2T.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 let node_path = require("node:path");
 node_path = require_chunk.__toESM(node_path);

package/dist/builtins/winston-logging/index.mjs

@@ -1,4 +1,4 @@
-import { pt as BaseAddon, q as logDestinationCapability } from "../../dist-C-QzFJ8v.mjs";
+import { ft as BaseAddon, q as logDestinationCapability } from "../../dist-CnQXXnK1.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 import * as path$1 from "node:path";
 import path from "node:path";

package/dist/{dist-C-QzFJ8v.mjs → dist-CnQXXnK1.mjs}

@@ -13022,6 +13022,65 @@ var ScopedTokenSchema = z.object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = z.object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -33179,4 +33238,4 @@ function enumerateInferenceDevices(hw) {
 	return out;
 }
 //#endregion
-export { objectInputDeclaresAddonId as $, deviceManagerCapability as A, hydrateSchema as At, isCollectionArrayMethod as B, bareAddonId as C, asJsonObject as Ct, coreBlocksCapability as D, emitDownForOwnedCaps as Dt, coreBlockIdFromAddonId as E, createEvent as Et, enumerateItemArrayFields as F, readinessKey as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, resolveCapMount as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, scopeKey as Lt, deviceStatusCapability as M, nodePin as Mt, doorbellCapability as N, parseJsonObject as Nt, dataStoreProviderCapability as O, emitReadiness as Ot, enumerateInferenceDevices as P, parseJsonUnknown as Pt, oauthIntegrationCapability as Q, filesystemBrowseCapability as R, sleep as Rt, backupCapability as S, WELL_KNOWN_TAB_MAP as St, coreBlockAddonId as T, asString as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceFeature as _t, CAP_NAMES_WITH_STATUS as a, snapshotCapability as at, alertsCapability as b, ReadinessRegistry as bt, CoreBlockSchema as c, streamQualityLabel as ct, METHOD_ACCESS_MAP as d, vectorStoreCapability as dt, parseStreamParamsFormPatch as et, RUNTIME_DEFAULTS as f, errMsg as ft, UserRecordSchema as g, DEVICE_STATUS_METHOD as gt, StorageLocationTypeSchema as h, DEVICE_SETTINGS_CONTRIBUTION_METHODS as ht, BatteryStatusSchema as i, settingsStoreCapability as it, deviceStateCapability as j, isDeviceConfigCap as jt, decodeVectorBase64 as k, expandCapMethods as kt, DeclaredDevices as l, userManagementCapability as lt, ScopedTokenSchema as m, DATAPLANE_SECRET_HEADER as mt, AlertSchema as n, procedureAuthKey as nt, CORE_BLOCKS_ADDON_ID as o, storageCapability as ot, STREAM_PROFILE_META as p, BaseAddon as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, scoreRuntimes as rt, CORE_BLOCK_ADDON_PREFIX as s, storageProviderCapability as st, ALL_CAPABILITY_DEFINITIONS as t, platformProbeCapability as tt, DeviceStatusSchema as u, vectorDimFromBase64 as ut, addonSettingsCapability as v, DeviceRole as vt, buildStreamParamsConfigSchema as w, asNumber as wt, authProviderCapability as x, ReadinessTimeoutError as xt, addonWidgetsCapability as y, DeviceType as yt, isArrayOutputSchema as z, EventCategory as zt };
+export { parseStreamParamsFormPatch as $, deviceManagerCapability as A, isDeviceConfigCap as At, isCollectionArrayMethod as B, bareAddonId as C, asNumber as Ct, coreBlocksCapability as D, emitReadiness as Dt, coreBlockIdFromAddonId as E, emitDownForOwnedCaps as Et, enumerateItemArrayFields as F, resolveCapMount as Ft, lifecycleJobSchema as G, isSameAddonId as H, enumerateSchemaFields as I, scopeKey as It, logLevelAtMost as J, localNetworkCapability as K, extractNestedAddonId as L, sleep as Lt, deviceStatusCapability as M, parseJsonObject as Mt, doorbellCapability as N, parseJsonUnknown as Nt, dataStoreProviderCapability as O, expandCapMethods as Ot, enumerateInferenceDevices as P, readinessKey as Pt, objectInputDeclaresAddonId as Q, filesystemBrowseCapability as R, EventCategory as Rt, backupCapability as S, asJsonObject as St, coreBlockAddonId as T, createEvent as Tt, isVoidInput as U, isObjectInput as V, kebabToCamel as W, metricsProviderCapability as X, looseSchema as Y, normalizeUnit as Z, addonPagesCapability as _, DeviceRole as _t, CAP_NAMES_WITH_STATUS as a, storageCapability as at, alertsCapability as b, ReadinessTimeoutError as bt, CoreBlockSchema as c, userManagementCapability as ct, METHOD_ACCESS_MAP as d, errMsg as dt, platformProbeCapability as et, RUNTIME_DEFAULTS as f, BaseAddon as ft, UserRecordSchema as g, DeviceFeature as gt, StorageLocationTypeSchema as h, DEVICE_STATUS_METHOD as ht, BatteryStatusSchema as i, snapshotCapability as it, deviceStateCapability as j, nodePin as jt, decodeVectorBase64 as k, hydrateSchema as kt, DeclaredDevices as l, vectorDimFromBase64 as lt, ScopedTokenSchema as m, DEVICE_SETTINGS_CONTRIBUTION_METHODS as mt, AlertSchema as n, scoreRuntimes as nt, CORE_BLOCKS_ADDON_ID as o, storageProviderCapability as ot, STREAM_PROFILE_META as p, DATAPLANE_SECRET_HEADER as pt, logDestinationCapability as q, ApiKeyRecordSchema as r, settingsStoreCapability as rt, CORE_BLOCK_ADDON_PREFIX as s, streamQualityLabel as st, ALL_CAPABILITY_DEFINITIONS as t, procedureAuthKey as tt, DeviceStatusSchema as u, vectorStoreCapability as ut, addonSettingsCapability as v, DeviceType as vt, buildStreamParamsConfigSchema as w, asString as wt, authProviderCapability as x, WELL_KNOWN_TAB_MAP as xt, addonWidgetsCapability as y, ReadinessRegistry as yt, isArrayOutputSchema as z };

package/dist/{dist-D7wC-S4p.js → dist-DCLoJf2T.js}

@@ -13022,6 +13022,65 @@ var ScopedTokenSchema = zod.z.object({
 * Each provider returns a static descriptor; the core enumerates them
 * to validate the `integration=` query param and resolve the consent
 * label + the scopes baked into the issued token.
+*
+* ## Declaring one
+*
+* An OAuth client is integration-specific knowledge — who the client is, what
+* it may ask for, where it may be sent — so it is declared by the ADDON that
+* owns the integration, never by the kernel and never as a branch inside
+* `oauth2-routes.ts` ([D101](../../../../docs/decisions/adr-0101.md)). Three
+* steps, no others:
+*
+* 1. Add `{ "name": "oauth-integration" }` to the addon's `camstack.addons[]`
+*    manifest entry. This is also what tells the hub, at addon-LOAD time, that
+*    a descriptor is owed — see "the boot window" below.
+* 2. Return a provider from `onInitialize()`:
+*
+*    ```ts
+*    const provider: IOauthIntegrationProvider = {
+*      getDescriptor: async () => ({
+*        integrationId: 'my-thing',      // the `integration=` query param
+*        displayName: 'My Thing',
+*        requestedScopes: [ … ],         // see below
+*        allowedRedirectPrefixes: ['https://callback.example/'],
+*      }),
+*    }
+*    return [{ capability: oauthIntegrationCapability, provider }]
+*    ```
+*
+*    The descriptor must be **static** — it is read on the authorize path, so
+*    never put an await on network or disk behind it, and never register it
+*    behind one either (a provider is registered only once `onInitialize`
+*    RETURNS, so anything awaited before the return delays linking).
+* 3. Nothing else. There is no allow-list to join, no id to register with the
+*    core, and no per-integration branch anywhere: `/api/oauth2/authorize` and
+*    `/api/oauth2/integrations` are built from this collection alone.
+*
+* **Scopes.** `requestedScopes` is baked into every token this integration is
+* ever issued and the operator consents to it once. Derive it from the tRPC
+* paths the client calls **with that token**, against `METHOD_ACCESS_MAP`, and
+* prefer a narrow `capability:` scope to a `category:` one unless the client
+* genuinely needs a whole family. A category scope grants every future member
+* of that category too. `category:system [create]` has been rejected once and
+* should stay rejected: it hands `addons.installPackage` to an integration.
+*
+* What it does NOT cover: calls the ADDON makes over `ctx.api`, which run as
+* the addon and are not scope-checked. Alexa's descriptor is narrower than
+* Home Assistant's for exactly that reason — its Lambda posts directives and
+* the addon does the work, while the Home Assistant component calls tRPC
+* directly with the token. So `requestedScopes` describes the blast radius of
+* the GRANT, not the reach of the integration; do not widen one to describe the
+* other.
+*
+* **The boot window.** An addon registers its provider after its runner forks
+* and initialises, so between hub start and that moment this collection is
+* incomplete and an `integrationId` can be legitimately absent. The core does
+* not wait, poll or cache around this ([D3](../../../../docs/decisions/adr-0003.md)):
+* it compares the manifest declarers against the registered providers and
+* answers `503 temporarily_unavailable` (with `Retry-After` and the pending
+* addon ids) instead of `400 unknown integration`, and reports
+* `complete: false` on `GET /api/oauth2/integrations`. A client should retry
+* while the list is incomplete rather than conclude the hub cannot do OAuth.
 */
 var OauthIntegrationDescriptorSchema = zod.z.object({
 	/** Stable id used as the `integration=` query param, e.g. 'export-alexa'. */
@@ -33617,12 +33676,6 @@ Object.defineProperty(exports, "normalizeUnit", {
 		return normalizeUnit;
 	}
 });
-Object.defineProperty(exports, "oauthIntegrationCapability", {
-	enumerable: true,
-	get: function() {
-		return oauthIntegrationCapability;
-	}
-});
 Object.defineProperty(exports, "objectInputDeclaresAddonId", {
 	enumerable: true,
 	get: function() {