@camstack/addon-export-alexa 1.2.131 → 1.2.133

package/dist/export-alexa.addon.js

@@ -5406,7 +5406,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-C16NCZR2.mjs
+//#region ../types/dist/sleep-DAJ9Er57.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -24023,148 +24023,17 @@ method(_void(), array(PipelineEngineChoiceSchema)), method(_void(), PipelineEngi
 	settings: record(string(), unknown()).optional()
 }), AudioTestResultSchema, { kind: "mutation" }), method(_void(), ConfigUISchemaNullableBridge);
 /**
-* Wire shapes of the Load balancing surface (D748): the session placement
-* policy, the atomic share write, the observed placement statistics, the
-* hardware share suggestion and the stale device pins.
-*/
-/**
-* How a new detection session picks its node and device.
-*  - `least-loaded` — the historical rule: lowest `attached / weight`, a
-*    constant node order at a tie (D37). An idle node always ties at 0, so a
-*    weight only bites once a node already holds a session.
-*  - `share` — the share of PARALLEL sessions is held to the weights, and a
-*    full or drowning node yields to a free one (D748).
-*/
-var SessionPlacementPolicySchema = _enum(["least-loaded", "share"]);
-var LoadBalancingSharesInputSchema = object({
-	/** nodeId → share (> 0). A node left out keeps its weight. */
-	nodes: record(string(), number().positive()).default({}),
-	/** nodeId → deviceKey → share (> 0). A device left out keeps its weight. */
-	devices: record(string(), record(string(), number().positive())).default({})
-});
-var PlacementStatsInputSchema = object({ 
-/** Window the observed shares are averaged over (default 1 h, max 24 h). */
-windowMs: number().int().min(6e4).max(1440 * 60 * 1e3).default(3600 * 1e3) });
-var PlacementDeviceStatsSchema = object({
-	deviceKey: string(),
-	/** Sessions running on this device now. */
-	sessionsNow: number(),
-	/** Sessions started on this device inside the window. */
-	sessionsStarted: number(),
-	/** Time-weighted share of the node's parallel sessions over the window (0–1); null = no session ran. */
-	observedShare: number().nullable()
-});
-var PlacementNodeStatsSchema = object({
-	nodeId: string(),
-	sessionsNow: number(),
-	sessionsStarted: number(),
-	/** Time-weighted share of the cluster's parallel sessions over the window (0–1); null = none ran. */
-	observedShare: number().nullable(),
-	/** Most sessions this node ran at once inside the window. */
-	peakSessions: number(),
-	/** Sessions a share election handed elsewhere because this node was full or drowning. */
-	yieldsAway: number(),
-	devices: array(PlacementDeviceStatsSchema).readonly()
-});
-/** A camera's device pin that the session path cannot honour. */
-var StaleDevicePinSchema = object({
-	deviceId: number(),
-	deviceKey: string(),
-	/** `disabled` — the key exists on some node but is not enabled anywhere; `absent` — no node has it. */
-	reason: _enum(["disabled", "absent"])
-});
-var PlacementStatsSchema = object({
-	policy: SessionPlacementPolicySchema,
-	windowMs: number(),
-	/** How much of the window was actually observed (the hub keeps it in memory). */
-	observedForMs: number(),
-	sessionsNow: number(),
-	/** Most parallel sessions across the cluster inside the window. */
-	clusterPeakSessions: number(),
-	nodes: array(PlacementNodeStatsSchema).readonly(),
-	stalePins: array(StaleDevicePinSchema).readonly()
-});
-var SuggestSharesInputSchema = object({ headroom: number().min(.3).max(.5).default(.4) });
-var SuggestedDeviceShareSchema = object({
-	deviceKey: string(),
-	/** Share of the node (0–100, rounded). */
-	share: number(),
-	modelId: string().nullable(),
-	/** Inferences per second at that model, from the measured table. */
-	fps: number().nullable(),
-	measured: boolean(),
-	/** Advisory session cap: ⌊fps × (1 − headroom) / camera fps⌋. Never enforced. */
-	suggestedMaxSessions: number().nullable()
-});
-var SuggestedNodeShareSchema = object({
-	nodeId: string(),
-	/** Share of the cluster (0–100, rounded); null = node skipped (offline, unknown hardware). */
-	share: number().nullable(),
-	/** Parallel sessions the node sustains at the suggested models with the headroom kept free. */
-	capacitySessions: number(),
-	devices: array(SuggestedDeviceShareSchema).readonly(),
-	skippedReason: string().nullable()
-});
-var SuggestSharesResultSchema = object({
-	headroom: number(),
-	/** Camera detection rate the capacity is counted in (the fastest camera's fps). */
-	cameraFps: number(),
-	/** How many share → model → capacity rounds ran before the shares stopped moving (≤ 3). */
-	iterations: number(),
-	nodes: array(SuggestedNodeShareSchema).readonly()
-});
-/**
-* Where the node and device shares come from (D750).
-*  - `auto` — computed by the system from the cluster's measured capacity at
-*    the Auto tune models, and recomputed whenever a node or device joins,
-*    leaves, is switched on or off, or changes model.
-*  - `manual` — the operator's stored sliders. A node or device that cannot
-*    take sessions gives its share to the others in proportion; the stored
-*    values are never rewritten for that.
-*/
-var ShareSourceSchema = _enum(["auto", "manual"]);
-var SetShareSourceInputSchema = object({ source: ShareSourceSchema });
-object({
-	nodes: record(string(), number()),
-	devices: record(string(), record(string(), number()))
-});
-var EffectiveDeviceShareSchema = object({
-	deviceKey: string(),
-	/** Can take sessions now (enabled, available, can run the root). */
-	eligible: boolean(),
-	/** The share the source assigns, as a percentage of the node's devices. */
-	configuredPct: number(),
-	/** The share actually used, after an ineligible device's share went to the others. */
-	effectivePct: number()
-});
-var EffectiveNodeShareSchema = object({
-	nodeId: string(),
-	eligible: boolean(),
-	configuredPct: number(),
-	effectivePct: number(),
-	devices: array(EffectiveDeviceShareSchema).readonly()
-});
-var EffectiveSharesSchema = object({
-	source: ShareSourceSchema,
-	policy: SessionPlacementPolicySchema,
-	/** `auto` with no computed answer yet: the stored sliders are used meanwhile. */
-	autoPending: boolean(),
-	/** When the automatic shares were last computed (ms epoch); null = never. */
-	computedAt: number().nullable(),
-	/** What made the system recompute them last. */
-	trigger: string().nullable(),
-	nodes: array(EffectiveNodeShareSchema).readonly(),
-	/** The relative weights the election reads (before eligibility). */
-	nodeWeights: record(string(), number()),
-	deviceWeights: record(string(), record(string(), number()))
-});
-/**
 * The wire shapes of the Auto tune plan and apply (D745), used by the
 * `pipeline-orchestrator` cap. The recommender's own types
-* (`recommend.ts`, `demand.ts`) are the TS face of the same data; these
+* (`recommend.ts`) are the TS face of the same data; these
 * schemas are what crosses the cap boundary.
 */
 var ModelFormatSchema$1 = _enum(MODEL_FORMATS);
+/** The operator's range for it. */
+var MIN_SESSIONS_PER_DEVICE_RANGE = {
+	min: 1,
+	max: 8
+};
 var HardwareClassIdSchema = _enum([
 	"intel-core-ultra",
 	"intel-n-series",
@@ -24182,8 +24051,9 @@ var AcceleratorKindSchema = _enum([
 ]);
 var RecommendationReasonSchema = discriminatedUnion("kind", [
 	object({
-		kind: literal("fits"),
-		utilisation: number()
+		kind: literal("capacity"),
+		sessions: number(),
+		minSessions: number()
 	}),
 	object({
 		kind: literal("tie-faster"),
@@ -24198,16 +24068,13 @@ var RecommendationReasonSchema = discriminatedUnion("kind", [
 	}),
 	object({
 		kind: literal("no-fit-lightest"),
-		utilisation: number()
+		sessions: number(),
+		minSessions: number()
 	}),
 	object({
 		kind: literal("derived-latency"),
 		modelId: string()
 	}),
-	object({
-		kind: literal("estimated-load"),
-		observedForMs: number().nullable()
-	}),
 	object({ kind: literal("cpu-device") }),
 	object({ kind: literal("coral-untouched") }),
 	object({ kind: literal("device-disabled") }),
@@ -24223,28 +24090,13 @@ var RecommendationReasonSchema = discriminatedUnion("kind", [
 		format: ModelFormatSchema$1
 	})
 ]);
-var DeviceDemandSchema = object({
-	nodeId: string(),
-	deviceKey: string(),
-	demandFps: number(),
-	maxCameraFps: number(),
-	alwaysOnCameras: number(),
-	onMotionSessions: number(),
-	onMotionSource: _enum([
-		"observed-24h",
-		"estimate",
-		"none"
-	]),
-	observedForMs: number().nullable(),
-	/** How on-motion sessions were charged: per-device observation, or split by share (D748). */
-	placement: SessionPlacementPolicySchema
-});
 var DeviceModelChoiceSchema = object({
 	modelId: string(),
 	p50Ms: number(),
 	fps: number(),
 	measured: boolean(),
-	utilisation: number(),
+	/** Parallel sessions at the camera rate with the headroom kept free: ⌊fps × (1 − headroom) / camera fps⌋. */
+	capacitySessions: number(),
 	personRecall: number()
 });
 var DeviceRecommendationSchema = object({
@@ -24252,7 +24104,6 @@ var DeviceRecommendationSchema = object({
 	accelerator: AcceleratorKindSchema.nullable(),
 	enabled: boolean(),
 	available: boolean(),
-	demand: DeviceDemandSchema.nullable(),
 	chosen: DeviceModelChoiceSchema.nullable(),
 	reasons: array(RecommendationReasonSchema).readonly()
 });
@@ -24313,20 +24164,20 @@ var AutoTuneOptionsSchema = object({
 	/** Share of each accelerator's throughput kept free (0.3–0.5). */
 	headroom: number().min(.3).max(.5).default(.4),
 	/**
-	* What-if shares (D748): plan as if these node/device shares were stored
-	* and the policy were `share`. Absent = the stored shares under the stored
-	* policy. A what-if plan is for display; apply always re-plans from what
-	* is stored.
+	* The least number of parallel sessions every device must sustain at the
+	* camera rate with the headroom kept free (D755). The most accurate model
+	* that reaches it wins.
 	*/
-	shares: LoadBalancingSharesInputSchema.optional()
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
 });
 var AutoTunePlanSchema = object({
 	/** Hash of everything the apply will write — the apply refuses a different one. */
 	planHash: string(),
 	family: literal("yolov9"),
 	headroom: number(),
-	/** Planned under what-if shares (D748): for display — apply refuses it as stale. */
-	whatIf: boolean(),
+	minSessionsPerDevice: number(),
+	/** The detection rate a session is counted at (the fastest camera running the pipeline root). */
+	cameraFps: number(),
 	generatedAt: number(),
 	nodes: array(NodeRecommendationSchema).readonly(),
 	nodeChanges: array(NodeDeviceChangeSchema).readonly(),
@@ -24336,7 +24187,8 @@ var AutoTunePlanSchema = object({
 });
 var AutoTuneApplyInputSchema = object({
 	planHash: string(),
-	headroom: number().min(.3).max(.5).default(.4)
+	headroom: number().min(.3).max(.5).default(.4),
+	minSessionsPerDevice: number().int().min(MIN_SESSIONS_PER_DEVICE_RANGE.min).max(MIN_SESSIONS_PER_DEVICE_RANGE.max).default(2)
 });
 var AutoTunePhaseResultSchema = object({
 	phase: _enum([
@@ -24368,6 +24220,177 @@ var AutoTuneApplyResultSchema = discriminatedUnion("kind", [
 		reason: _enum(["apply-in-progress"])
 	})
 ]);
+/**
+* Wire shapes of the Load balancing surface (D748): the session placement
+* policy, the atomic share write, the observed placement statistics, the
+* hardware share suggestion and the stale device pins.
+*/
+/**
+* How a new detection session picks its node and device.
+*  - `least-loaded` — the historical rule: lowest `attached / weight`, a
+*    constant node order at a tie (D37). An idle node always ties at 0, so a
+*    weight only bites once a node already holds a session.
+*  - `share` — the share of PARALLEL sessions is held to the weights, and a
+*    full or drowning node yields to a free one (D748).
+*/
+var SessionPlacementPolicySchema = _enum(["least-loaded", "share"]);
+var LoadBalancingSharesInputSchema = object({
+	/** nodeId → share (> 0). A node left out keeps its weight. */
+	nodes: record(string(), number().positive()).default({}),
+	/** nodeId → deviceKey → share (> 0). A device left out keeps its weight. */
+	devices: record(string(), record(string(), number().positive())).default({})
+});
+var PlacementStatsInputSchema = object({ 
+/** Window the observed shares are averaged over (default 1 h, max 24 h). */
+windowMs: number().int().min(6e4).max(1440 * 60 * 1e3).default(3600 * 1e3) });
+var PlacementDeviceStatsSchema = object({
+	deviceKey: string(),
+	/** Sessions running on this device now. */
+	sessionsNow: number(),
+	/** Sessions started on this device inside the window. */
+	sessionsStarted: number(),
+	/** Time-weighted share of the node's parallel sessions over the window (0–1); null = no session ran. */
+	observedShare: number().nullable()
+});
+var PlacementNodeStatsSchema = object({
+	nodeId: string(),
+	sessionsNow: number(),
+	sessionsStarted: number(),
+	/** Time-weighted share of the cluster's parallel sessions over the window (0–1); null = none ran. */
+	observedShare: number().nullable(),
+	/** Most sessions this node ran at once inside the window. */
+	peakSessions: number(),
+	/** Sessions a share election handed elsewhere because this node was full or drowning. */
+	yieldsAway: number(),
+	devices: array(PlacementDeviceStatsSchema).readonly()
+});
+/** A camera's device pin that the session path cannot honour. */
+var StaleDevicePinSchema = object({
+	deviceId: number(),
+	deviceKey: string(),
+	/** `disabled` — the key exists on some node but is not enabled anywhere; `absent` — no node has it. */
+	reason: _enum(["disabled", "absent"])
+});
+var PlacementStatsSchema = object({
+	policy: SessionPlacementPolicySchema,
+	windowMs: number(),
+	/** How much of the window was actually observed (the hub keeps it in memory). */
+	observedForMs: number(),
+	sessionsNow: number(),
+	/** Most parallel sessions across the cluster inside the window. */
+	clusterPeakSessions: number(),
+	nodes: array(PlacementNodeStatsSchema).readonly(),
+	stalePins: array(StaleDevicePinSchema).readonly()
+});
+/**
+* Where an automatic share's capacity comes from (D755).
+*  - `hardware` — the static capacity of each device at its Auto tune model:
+*    the measured latency table for the node's hardware class.
+*  - `benchmark` — the node's own measured capacity (node benchmark results).
+*    A node with no results falls back to `hardware`, and says so.
+*/
+var CapacitySourceSchema = _enum(["hardware", "benchmark"]);
+/** Why a node under the `benchmark` source was sized from hardware instead. */
+var CapacityFallbackSchema = _enum(["no-benchmark-results", "partial-benchmark-results"]);
+var SuggestSharesInputSchema = object({
+	headroom: number().min(.3).max(.5).default(.4),
+	/** Default `hardware`. */
+	source: CapacitySourceSchema.default("hardware")
+});
+var SuggestedDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Share of the node (0–100, rounded). */
+	share: number(),
+	modelId: string().nullable(),
+	/** Inferences per second at that model, from the measured table; null when sized by a benchmark. */
+	fps: number().nullable(),
+	/** False for a table cell derived from another chip; true for a measured cell or a benchmark. */
+	measured: boolean(),
+	/**
+	* Advisory session cap: ⌊fps × (1 − headroom) / camera fps⌋ from the table,
+	* or the benchmark's measured max sessions. Never enforced.
+	*/
+	suggestedMaxSessions: number().nullable()
+});
+var SuggestedNodeShareSchema = object({
+	nodeId: string(),
+	/** Share of the cluster (0–100, rounded); null = node skipped (offline, unknown hardware). */
+	share: number().nullable(),
+	/** Parallel sessions the node sustains at the suggested models with the headroom kept free. */
+	capacitySessions: number(),
+	devices: array(SuggestedDeviceShareSchema).readonly(),
+	skippedReason: string().nullable(),
+	/** What this node's capacity was read from; null when the node is skipped. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Set when the `benchmark` source was asked for and this node used `hardware`. */
+	capacityFallback: CapacityFallbackSchema.nullable()
+});
+var SuggestSharesResultSchema = object({
+	headroom: number(),
+	/** The source asked for; each node says what it actually used. */
+	source: CapacitySourceSchema,
+	/** Camera detection rate the capacity is counted in (the fastest camera's fps). */
+	cameraFps: number(),
+	/** The Auto tune capacity floor the models were picked at. */
+	minSessionsPerDevice: number(),
+	nodes: array(SuggestedNodeShareSchema).readonly()
+});
+/**
+* Where the node and device shares come from (D750, D755).
+*  - `hardware` (default) — computed by the system from each node's static
+*    capacity (its accelerators at their Auto tune models, from the measured
+*    latency table), recomputed whenever a node or device joins, leaves, is
+*    switched on or off, or changes model. No load input.
+*  - `benchmark` — the same, from each node's measured capacity (node
+*    benchmark results); a node without results falls back to `hardware`.
+*  - `manual` — the operator's stored sliders.
+* Either way a node or device that cannot take sessions gives its share to
+* the others in proportion; the stored values are never rewritten for that.
+*/
+var ShareSourceSchema = _enum([
+	"hardware",
+	"benchmark",
+	"manual"
+]);
+var SetShareSourceInputSchema = object({ source: ShareSourceSchema });
+object({
+	nodes: record(string(), number()),
+	devices: record(string(), record(string(), number()))
+});
+var EffectiveDeviceShareSchema = object({
+	deviceKey: string(),
+	/** Can take sessions now (enabled, available, can run the root). */
+	eligible: boolean(),
+	/** The share the source assigns, as a percentage of the node's devices. */
+	configuredPct: number(),
+	/** The share actually used, after an ineligible device's share went to the others. */
+	effectivePct: number()
+});
+var EffectiveNodeShareSchema = object({
+	nodeId: string(),
+	eligible: boolean(),
+	configuredPct: number(),
+	effectivePct: number(),
+	/** Automatic sources: what this node's share was computed from; null under `manual` or before the first answer. */
+	capacitySource: CapacitySourceSchema.nullable(),
+	/** Automatic `benchmark`: why this node used `hardware` instead. */
+	capacityFallback: CapacityFallbackSchema.nullable(),
+	devices: array(EffectiveDeviceShareSchema).readonly()
+});
+var EffectiveSharesSchema = object({
+	source: ShareSourceSchema,
+	policy: SessionPlacementPolicySchema,
+	/** An automatic source with no computed answer yet: the stored sliders are used meanwhile. */
+	autoPending: boolean(),
+	/** When the automatic shares were last computed (ms epoch); null = never. */
+	computedAt: number().nullable(),
+	/** What made the system recompute them last. */
+	trigger: string().nullable(),
+	nodes: array(EffectiveNodeShareSchema).readonly(),
+	/** The relative weights the election reads (before eligibility). */
+	nodeWeights: record(string(), number()),
+	deviceWeights: record(string(), record(string(), number()))
+});
 object({
 	activeCameras: number(),
 	throttledCameras: number(),
@@ -25547,8 +25570,10 @@ var CameraStepOverridePatchSchema = object({
 	modelId: string().optional(),
 	settings: record(string(), unknown()).readonly().optional()
 });
+var CameraStepSettingsSchema = record(string(), record(string(), unknown()).readonly());
 var CameraPipelineSettingsSchema = object({
 	stepToggles: record(string(), boolean()).optional(),
+	stepSettings: CameraStepSettingsSchema.optional(),
 	stepOverridesByDevice: record(string(), record(string(), record(string(), CameraStepOverridePatchSchema))).optional(),
 	pipelineByAgent: record(string(), CameraPipelineForAgentSchema).optional()
 });
@@ -26112,6 +26137,13 @@ method(object({
 }), object({ success: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(object({
+	deviceId: number(),
+	addonId: string(),
+	settings: record(string(), unknown()).nullable()
+}), object({ success: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({
 	deviceId: number(),
 	agentNodeId: string(),
@@ -42187,6 +42219,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"pipelineOrchestrator.setCameraStepSettings": {
+		capName: "pipeline-orchestrator",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"pipelineOrchestrator.setCameraStepToggle": {
 		capName: "pipeline-orchestrator",
 		capScope: "system",
@@ -47635,6 +47673,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"pipelineOrchestrator.setCameraStepSettings": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"pipelineOrchestrator.setCameraStepToggle": [{
 		name: "deviceId",
 		form: "single",
@@ -49595,6 +49638,15 @@ var exportAlexaActions = defineCustomActions({
 	unlinkAlexaAccounts: customAction(object({}).optional(), object({
 		revokedSessions: number(),
 		removedAccounts: number()
+	}), { kind: "mutation" }),
+	/**
+	* Swap the per-link credential this hub presents to the skill Lambda's
+	* token broker (D753) for a fresh one; the old one dies at once. Rotation
+	* also happens implicitly on every re-link.
+	*/
+	rotateBrokerCredential: customAction(object({}).optional(), object({
+		rotated: number(),
+		failed: number()
 	}), { kind: "mutation" })
 });
 //#endregion
@@ -50186,6 +50238,110 @@ async function handleSessionDisconnected(header, endpointRaw, payloadRaw, deps,
 	} };
 }
 //#endregion
+//#region src/broker-client.ts
+/**
+* The hub's side of the skill's token broker (D753).
+*
+* The hub holds NO Login With Amazon client secret. To push a proactive event
+* it needs an LWA access token for the linked Amazon account, and it gets one
+* from the skill's Lambda (the broker) by presenting the per-link credential
+* the Lambda minted at link time (`csb1.<linkId>.<secret>`). The Lambda keeps
+* the refresh token and the client secret; the hub keeps a credential that
+* opens exactly one link and can be revoked or rotated.
+*
+* Every function here is a single HTTPS call with a timeout and a Zod-parsed
+* answer. Errors carry a `kind` so the gateway can tell "re-link needed" from
+* "try again later"; their messages never contain a token or a credential.
+*/
+var BROKER_TIMEOUT_MS = 8e3;
+/** Origin-only, HTTPS-only. Anything else is refused before a credential is sent. */
+function normaliseBrokerUrl(raw) {
+	if (typeof raw !== "string" || raw.length === 0 || raw.length > 512) return null;
+	try {
+		const u = new URL(raw);
+		if (u.protocol !== "https:" || u.username || u.password) return null;
+		return u.origin;
+	} catch {
+		return null;
+	}
+}
+var BrokerError = class extends Error {
+	kind;
+	status;
+	constructor(kind, message, status) {
+		super(message);
+		this.kind = kind;
+		this.status = status;
+		this.name = "BrokerError";
+	}
+};
+var AccessTokenSchema = object({
+	accessToken: string().min(1),
+	expiresAt: number().int().positive()
+});
+var MigrationSchema = AccessTokenSchema.extend({
+	brokerCredential: string().min(1),
+	brokerUrl: string().min(1)
+});
+var RotationSchema = object({ brokerCredential: string().min(1) });
+function kindForStatus(status) {
+	if (status === 401) return "unauthorized";
+	if (status === 410) return "revoked";
+	if (status === 400 || status === 403 || status === 404 || status === 405) return "rejected";
+	return "unavailable";
+}
+async function call(fetchImpl, brokerUrl, path, init, schema) {
+	const origin = normaliseBrokerUrl(brokerUrl);
+	if (!origin) throw new BrokerError("rejected", "broker URL is not an https origin");
+	let response;
+	try {
+		response = await fetchImpl(`${origin}${path}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...init.bearer ? { authorization: `Bearer ${init.bearer}` } : {}
+			},
+			body: JSON.stringify(init.body ?? {}),
+			signal: AbortSignal.timeout(BROKER_TIMEOUT_MS)
+		});
+	} catch (err) {
+		throw new BrokerError("unavailable", `broker ${path} unreachable: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const text = await response.text().catch(() => "");
+	let json = null;
+	try {
+		json = text ? JSON.parse(text) : null;
+	} catch {
+		json = null;
+	}
+	if (!response.ok) {
+		const code = json && typeof json === "object" && "error" in json && typeof json.error === "string" ? json.error : "error";
+		throw new BrokerError(kindForStatus(response.status), `broker ${path} ${response.status} ${code}`, response.status);
+	}
+	const parsed = schema.safeParse(json);
+	if (!parsed.success) throw new BrokerError("unavailable", `broker ${path} answered an unexpected shape`);
+	return parsed.data;
+}
+/** A fresh (or still-valid) Event Gateway access token for this link. */
+function fetchBrokerAccessToken(fetchImpl, brokerUrl, credential) {
+	return call(fetchImpl, brokerUrl, "/broker/token", { bearer: credential }, AccessTokenSchema);
+}
+/**
+* Hand a pre-D753 refresh token to the broker in exchange for a link. The
+* caller deletes its own copy of the refresh token on success.
+*/
+function migrateLegacyGrant(fetchImpl, brokerUrl, input) {
+	return call(fetchImpl, brokerUrl, "/broker/migrate", { body: input }, MigrationSchema);
+}
+/** Swap the credential's secret; the old one stops working at once. */
+async function rotateBrokerCredential(fetchImpl, brokerUrl, credential) {
+	return (await call(fetchImpl, brokerUrl, "/broker/rotate", { bearer: credential }, RotationSchema)).brokerCredential;
+}
+/** Delete the link at the broker (the refresh token goes with it). */
+async function revokeBrokerCredential(fetchImpl, brokerUrl, credential) {
+	await call(fetchImpl, brokerUrl, "/broker/revoke", { bearer: credential }, unknown());
+}
+//#endregion
 //#region src/handlers/security-panel-arm-state.ts
 /**
 * The panel modes behind each Alexa arm state, PRIMARY first — the mirror of
@@ -51795,8 +51951,12 @@ async function dispatchDirective(rawBody, deps, callerIdentity) {
 //#endregion
 //#region src/handlers/lwa-tokens-callback.ts
 /**
-* `POST /addon/export-alexa/oauth/lwa-tokens` — callback the Alexa
-* Lambda invokes after it completes the LWA grant exchange.
+* `POST /addon/export-alexa/oauth/lwa-tokens` — the LEGACY (pre-D753)
+* callback a Lambda without the token broker invokes after the LWA grant
+* exchange. It hands this hub the refresh token itself. Kept so an old Lambda
+* keeps linking during the cut-over; the hub cannot renew such a grant (it
+* holds no client secret) and migrates it to the broker instead. The D753
+* Lambda calls `/oauth/broker-link` (`broker-link-callback.ts`).
 *
 * Auth: Bearer `<granteeToken>` where the grantee token is the OAuth
 * access token (kind=`oauth-access`) issued by the hub's core OAuth
@@ -51849,7 +52009,7 @@ async function handleLwaTokensCallback(request, reply, deps) {
 		userId,
 		username
 	});
-	deps.logger.info("alexa lwa-tokens-callback: stored LWA tokens + recorded link", { meta: {
+	deps.logger.warn("alexa lwa-tokens-callback: linked through a Lambda WITHOUT the token broker — this hub holds no LWA secret, so the grant cannot be renewed here; update the skill Lambda (D753). It migrates automatically once the Lambda advertises its broker.", { meta: {
 		userId,
 		expiresInMs: body.expiresAt - Date.now()
 	} });
@@ -51886,6 +52046,78 @@ function pickHeader(headers, name) {
 	return null;
 }
 //#endregion
+//#region src/handlers/broker-link-callback.ts
+/**
+* `POST /addon/export-alexa/oauth/broker-link` — the skill Lambda tells this
+* hub that an Amazon account was linked (D753).
+*
+* The Lambda has already exchanged the AcceptGrant code with Amazon and kept
+* the refresh token. It gives this hub:
+*   - `brokerUrl`        where to ask for renewed access tokens,
+*   - `brokerCredential` this link's credential at the broker,
+*   - `lwaAccessToken` / `expiresAt` the first Event Gateway token.
+* No refresh token and no client secret reach the hub.
+*
+* Auth: identical to the legacy `/oauth/lwa-tokens` callback — Bearer
+* `<granteeToken>`, the hub's own `oauth-access` token Amazon presented with
+* the AcceptGrant, verified by `oauthVerifyAccessToken` (and the ingress-token
+* guard in `http-server.ts`). A Lambda that does not know this route gets 404
+* and falls back to the legacy callback, which is how the cut-over stays
+* zero-downtime in both directions.
+*
+* Errors: 400 `invalid_body` / `invalid_broker_url`, 401 `unauthorized`.
+*/
+var BrokerLinkBodySchema = object({
+	brokerUrl: string().min(1).max(512),
+	brokerCredential: string().min(1).max(512),
+	lwaAccessToken: string().min(1),
+	expiresAt: number().int().nonnegative()
+});
+async function handleBrokerLinkCallback(request, reply, deps) {
+	const parsed = BrokerLinkBodySchema.safeParse(request.body);
+	if (!parsed.success) {
+		reply.code(400).send({
+			error: "invalid_body",
+			message: parsed.error.message
+		});
+		return;
+	}
+	const body = parsed.data;
+	const brokerUrl = normaliseBrokerUrl(body.brokerUrl);
+	if (!brokerUrl) {
+		reply.code(400).send({
+			error: "invalid_broker_url",
+			message: "brokerUrl must be an https origin"
+		});
+		return;
+	}
+	const caller = await resolveCaller(request, deps);
+	if (!caller) {
+		deps.logger.warn("alexa broker-link: unauthorized", { meta: { hasBearer: pickHeader(request.headers, "authorization") !== null } });
+		reply.code(401).send({
+			error: "unauthorized",
+			message: "callback requires Bearer <granteeToken> (oauth-access token)"
+		});
+		return;
+	}
+	await deps.upsertToken({
+		userId: caller.userId,
+		accessToken: body.lwaAccessToken,
+		expiresAt: body.expiresAt,
+		brokerUrl,
+		brokerCredential: body.brokerCredential
+	});
+	await deps.recordLinkedAccount({
+		userId: caller.userId,
+		username: caller.username
+	});
+	deps.logger.info("alexa broker-link: linked — push grant held by the skill broker", { meta: {
+		userId: caller.userId,
+		expiresInMs: body.expiresAt - Date.now()
+	} });
+	reply.code(200).send({ ok: true });
+}
+//#endregion
 //#region src/ingress-token.ts
 /**
 * Ingress token — a rotatable shared secret that the user-owned Alexa Lambda
@@ -51943,7 +52175,8 @@ function readIngressHeader(headers) {
 *
 * Public URLs (assuming the hub is reachable as `https://<hub>`):
 *   POST /addon/export-alexa/directive
-*   POST /addon/export-alexa/oauth/lwa-tokens (Lambda → hub callback)
+*   POST /addon/export-alexa/oauth/broker-link (Lambda → hub, D753 broker link)
+*   POST /addon/export-alexa/oauth/lwa-tokens (Lambda → hub, legacy pre-D753)
 *
 * OAuth account-linking is handled by the core `/oauth2/*` server
 * (integration=export-alexa). This addon registers an `oauth-integration`
@@ -51954,6 +52187,8 @@ var OauthVerifiedResultSchema = object({
 	username: string(),
 	scopes: array(TokenScopeSchema)
 }).nullable();
+/** Header the D753 Lambda sends its broker origin on. */
+var BROKER_HEADER = "x-camstack-broker";
 function buildRoutes(deps) {
 	return [
 		{
@@ -51963,6 +52198,16 @@ function buildRoutes(deps) {
 			description: "Alexa Smart Home directive ingress (forwarded by the user-owned Lambda)",
 			handler: (req, reply) => handleDirective(req, reply, deps)
 		},
+		{
+			method: "POST",
+			path: "/oauth/broker-link",
+			access: "public",
+			description: "Lambda → hub broker link (D753): broker URL + per-link credential + first access token; bearer-authenticated via oauth-access token",
+			handler: async (req, reply) => {
+				if (ingressRejected(req, reply, deps, "alexa broker-link")) return;
+				await handleBrokerLinkCallback(req, reply, deps.lwaTokensCallbackDeps);
+			}
+		},
 		{
 			method: "POST",
 			path: "/oauth/lwa-tokens",
@@ -52073,6 +52318,8 @@ async function handleDirective(request, reply, deps) {
 		reply.code(200).send(preParseErrorEnvelope("INVALID_AUTHORIZATION_CREDENTIAL", "token does not grant access to device capabilities"));
 		return;
 	}
+	const advertised = readHeader(request.headers, BROKER_HEADER);
+	if (advertised && deps.onBrokerAdvertised) deps.onBrokerAdvertised(advertised);
 	const callerIdentity = {
 		userId: verified.userId,
 		username: verified.username,
@@ -52081,6 +52328,19 @@ async function handleDirective(request, reply, deps) {
 	const result = await dispatchDirective(request.body, deps.directiveDeps, callerIdentity);
 	reply.code(result.status).send(result.body);
 }
+function readHeader(headers, name) {
+	for (const [key, value] of Object.entries(headers)) if (key.toLowerCase() === name) return value;
+}
+//#endregion
+//#region src/types.ts
+var DEFAULT_DEVICE_SETTINGS = {
+	streamPreference: "auto",
+	sourceProfile: "high"
+};
+/** A grant the hub can renew through the broker. */
+function isBrokerGrant(t) {
+	return typeof t.brokerUrl === "string" && typeof t.brokerCredential === "string";
+}
 /** `listOauthSessions` returns every session for every integration. */
 var OauthSessionListSchema = array(object({
 	id: string(),
@@ -52129,15 +52389,15 @@ function buildLinkStatusContent(input) {
 		lines.push(`• ${acc.username} — linked ${stamp(acc.linkedAt)}`);
 		lines.push(`   ${describeGrant(acc, input)}`);
 	}
-	if (!input.hasLwaCredentials) lines.push("Proactive push is DISABLED — no LWA client id/secret is configured, so motion, doorbell and discovery reports are all skipped regardless of the grants above.");
 	return lines.join("\n");
 }
 function describeGrant(acc, input) {
 	const token = input.tokens.find((t) => t.userId === acc.userId);
 	if (!token) return "Amazon push grant: MISSING — proactive events (motion, doorbell, discovery) cannot be delivered for this account. Re-link the skill in the Alexa app to re-issue it.";
 	const renewedAgo = minutes(input.now - token.receivedAt);
-	if (token.expiresAt <= input.now) return `Amazon push grant: EXPIRED ${minutes(input.now - token.expiresAt)} min ago (last renewed ${renewedAgo} min ago). The gateway renews ${minutes(RENEWAL_LEAD_MS)} min before expiry, so renewal is failing and proactive events are NOT reaching Alexa — check the addon log for "LWA refresh non-OK".`;
-	return `Amazon push grant: held, valid for another ${minutes(token.expiresAt - input.now)} min (last renewed ${renewedAgo} min ago).`;
+	if (!isBrokerGrant(token)) return `Amazon push grant: LEGACY — delivered by a skill Lambda without the token broker, and this hub holds no LWA secret to renew it (D753); ${token.expiresAt <= input.now ? `its token EXPIRED ${minutes(input.now - token.expiresAt)} min ago, so proactive events are NOT reaching Alexa` : `its token is valid for another ${minutes(token.expiresAt - input.now)} min`}. It moves to the skill's broker automatically on the next Alexa request; if it does not, update the skill Lambda or re-link.`;
+	if (token.expiresAt <= input.now) return `Amazon push grant: EXPIRED ${minutes(input.now - token.expiresAt)} min ago (last renewed ${renewedAgo} min ago). The gateway renews ${minutes(RENEWAL_LEAD_MS)} min before expiry through the skill's token broker, so renewal is failing and proactive events are NOT reaching Alexa — check the addon log for "broker renewal failed".`;
+	return `Amazon push grant: held via the skill's token broker, valid for another ${minutes(token.expiresAt - input.now)} min (last renewed ${renewedAgo} min ago).`;
 }
 //#endregion
 //#region src/motion-clear-hold.ts
@@ -52238,15 +52498,16 @@ var MotionClearHold = class {
 *      exposed.
 *   3. For each linked Alexa account, POST a `DoorbellEventSource/
 *      DoorbellPress` payload to `api.amazonalexa.com/v3/events`.
-*   4. On 401, refresh the LWA token via
-*      `https://api.amazon.com/auth/o2/token` and retry once.
+*   4. On 401, ask the skill's token broker for a fresh access token and
+*      retry once.
 *
-* The actual LWA grant exchange (Lambda → Amazon → access+refresh) is
-* owned by the operator-side Lambda, which POSTs the resulting tokens to
-* this addon's `/oauth/lwa-tokens` callback. This client assumes
-* `this.config.tokens[userId]` is already populated with valid
-* `accessToken` / `refreshToken` values. When tokens are absent we
-* log + skip without erroring.
+* This hub holds NO Login With Amazon client secret (D753). The skill's
+* Lambda exchanges the AcceptGrant code, keeps the refresh token and the
+* secret, and hands this hub short-lived access tokens against a per-link
+* credential (`broker-client.ts`). A grant delivered by a pre-D753 Lambda
+* (with a refresh token) cannot be renewed here; it is migrated to the broker
+* as soon as the broker's URL is known, and the refresh token is deleted.
+* When no grant is stored we log + skip without erroring.
 *
 * Throttling: Alexa requires at most one DoorbellPress per endpoint
 * every 30s. We enforce this per (userId, endpointId) tuple in-memory.
@@ -52256,10 +52517,11 @@ var EVENT_GATEWAY_URLS = {
 	EU: "https://api.eu.amazonalexa.com/v3/events",
 	FE: "https://api.fe.amazonalexa.com/v3/events"
 };
-var LWA_TOKEN_URL = "https://api.amazon.com/auth/o2/token";
 var THROTTLE_WINDOW_MS = 3e4;
 var REFRESH_PROACTIVE_WINDOW_MS = 300 * 1e3;
 var REFRESH_SCAN_INTERVAL_MS = 60 * 1e3;
+/** After a failed legacy-grant migration, wait this long before trying again. */
+var MIGRATION_RETRY_MS = 300 * 1e3;
 /** The interface an endpoint must advertise for a `DoorbellPress` to survive
 *  the Alexa cloud. */
 var DOORBELL_INTERFACE = "Alexa.DoorbellEventSource";
@@ -52309,9 +52571,13 @@ var LwaEventGateway = class {
 	*  Alexa Smart Home rate-limits ChangeReports per property; dedupe
 	*  so only level *changes* (or step-grain ones) hit the gateway. */
 	lastBatteryLevel = /* @__PURE__ */ new Map();
-	/** Latches the "no LWA credentials" warning so it's logged ONCE, not on
-	*  every doorbell/motion event when proactive push is unconfigured. */
-	warnedNoLwaCreds = false;
+	/** Latches the "no grant at all" warning so it's logged ONCE, not on every
+	*  doorbell/motion event while no account has a push grant. */
+	warnedNoGrant = false;
+	/** Users whose legacy grant is waiting for the broker URL (warned once). */
+	warnedLegacyWaiting = /* @__PURE__ */ new Set();
+	/** Per-user earliest next migration attempt after a failure. */
+	migrationRetryAt = /* @__PURE__ */ new Map();
 	/** Users we have already reported as having no stored Amazon push grant.
 	*  Cleared for a user the moment a grant is found again, so a re-link
 	*  re-arms the warning instead of muting it for the process's lifetime. */
@@ -52356,6 +52622,8 @@ var LwaEventGateway = class {
 		this.smartVisionDropped.clear();
 		this.lastBatteryLevel.clear();
 		this.warnedNoToken.clear();
+		this.warnedLegacyWaiting.clear();
+		this.migrationRetryAt.clear();
 	}
 	async onDoorbellPress(data) {
 		const childDevice = await this.deps.ctx.api.deviceManager.getDevice.query({ deviceId: data.deviceId }).catch(() => null);
@@ -52667,12 +52935,15 @@ var LwaEventGateway = class {
 		} });
 		return true;
 	}
+	get fetchImpl() {
+		return this.deps.fetchImpl ?? ((url, init) => fetch(url, init));
+	}
 	async refreshExpiringTokens() {
 		if (!this.hasProactiveCredentials()) return;
 		const tokens = this.deps.listTokens();
 		const now = Date.now();
 		for (const token of tokens) {
-			if (token.expiresAt - now > REFRESH_PROACTIVE_WINDOW_MS) continue;
+			if (!(!isBrokerGrant(token) || token.expiresAt - now <= REFRESH_PROACTIVE_WINDOW_MS)) continue;
 			await this.refreshAccessToken(token.userId).catch((err) => {
 				this.deps.logger.warn("alexa lwa-gateway: proactive refresh failed", { meta: {
 					userId: token.userId,
@@ -52681,61 +52952,106 @@ var LwaEventGateway = class {
 			});
 		}
 	}
+	/** A fresh access token for `userId`, or null. Never throws for broker errors. */
 	async refreshAccessToken(userId) {
-		const creds = this.deps.getLwaCredentials();
-		if (!creds) {
-			this.deps.logger.warn("alexa lwa-gateway: LWA client credentials not configured", { meta: { userId } });
-			return null;
-		}
 		const existing = this.findToken(userId);
 		if (!existing) return null;
-		const params = new URLSearchParams();
-		params.set("grant_type", "refresh_token");
-		params.set("refresh_token", existing.refreshToken);
-		params.set("client_id", creds.clientId);
-		params.set("client_secret", creds.clientSecret);
-		const response = await fetch(LWA_TOKEN_URL, {
-			method: "POST",
-			headers: { "Content-Type": "application/x-www-form-urlencoded" },
-			body: params.toString()
-		});
-		if (!response.ok) {
-			const text = await response.text().catch(() => "");
-			this.deps.logger.warn("alexa lwa-gateway: LWA refresh non-OK", { meta: {
+		if (!isBrokerGrant(existing)) return this.migrateLegacyGrant(existing);
+		try {
+			const fresh = await fetchBrokerAccessToken(this.fetchImpl, existing.brokerUrl, existing.brokerCredential);
+			await this.deps.upsertToken({
 				userId,
-				status: response.status,
-				body: text.slice(0, 500)
+				accessToken: fresh.accessToken,
+				expiresAt: fresh.expiresAt,
+				brokerUrl: existing.brokerUrl,
+				brokerCredential: existing.brokerCredential
+			});
+			return fresh.accessToken;
+		} catch (err) {
+			if (err instanceof BrokerError && (err.kind === "unauthorized" || err.kind === "revoked")) {
+				this.deps.logger.warn("alexa lwa-gateway: the skill broker no longer recognises this link — proactive events stop; re-link the skill in the Alexa app", { meta: {
+					userId,
+					kind: err.kind
+				} });
+				await this.deps.removeLinkedAccount(userId).catch(() => {});
+				return null;
+			}
+			this.deps.logger.warn("alexa lwa-gateway: broker renewal failed — will retry", { meta: {
+				userId,
+				error: err instanceof Error ? err.message : String(err)
 			} });
 			return null;
 		}
-		const parsed = await response.json();
-		if (typeof parsed.access_token !== "string" || typeof parsed.expires_in !== "number") {
-			this.deps.logger.warn("alexa lwa-gateway: malformed LWA refresh response", { meta: { userId } });
+	}
+	/**
+	* Hand a pre-D753 refresh token to the skill's broker and keep the link it
+	* returns instead. Zero-touch: the broker URL arrives on the next verified
+	* directive. On success the refresh token is gone from this hub.
+	*/
+	async migrateLegacyGrant(entry) {
+		const userId = entry.userId;
+		if (!entry.refreshToken) return null;
+		const brokerUrl = this.deps.getAdvertisedBrokerUrl();
+		if (!brokerUrl) {
+			if (!this.warnedLegacyWaiting.has(userId)) {
+				this.warnedLegacyWaiting.add(userId);
+				this.deps.logger.warn("alexa lwa-gateway: this Amazon push grant predates the skill broker and this hub holds no LWA secret to renew it; it migrates automatically once the skill Lambda advertises its broker (next Alexa directive). Until then events stop when the current token expires.", { meta: {
+					userId,
+					expiresInMs: entry.expiresAt - Date.now()
+				} });
+			}
+			return null;
+		}
+		const retryAt = this.migrationRetryAt.get(userId) ?? 0;
+		if (Date.now() < retryAt) return null;
+		try {
+			const migrated = await migrateLegacyGrant(this.fetchImpl, brokerUrl, {
+				refreshToken: entry.refreshToken,
+				...this.deps.getPublicHubUrl ? { hubUrl: this.deps.getPublicHubUrl() } : {}
+			});
+			await this.deps.upsertToken({
+				userId,
+				accessToken: migrated.accessToken,
+				expiresAt: migrated.expiresAt,
+				brokerUrl: normaliseBrokerUrl(migrated.brokerUrl) ?? brokerUrl,
+				brokerCredential: migrated.brokerCredential
+			});
+			this.migrationRetryAt.delete(userId);
+			this.warnedLegacyWaiting.delete(userId);
+			this.deps.logger.info("alexa lwa-gateway: migrated the Amazon push grant to the skill broker; the refresh token was deleted from this hub", { meta: { userId } });
+			return migrated.accessToken;
+		} catch (err) {
+			this.migrationRetryAt.set(userId, Date.now() + MIGRATION_RETRY_MS);
+			const kind = err instanceof BrokerError ? err.kind : "unavailable";
+			const status = err instanceof BrokerError ? err.status : void 0;
+			if (kind === "rejected" && status === 400) {
+				this.deps.logger.warn("alexa lwa-gateway: Amazon no longer honours this push grant — re-link the skill in the Alexa app", { meta: { userId } });
+				await this.deps.removeLinkedAccount(userId).catch(() => {});
+				return null;
+			}
+			this.deps.logger.warn("alexa lwa-gateway: migrating the push grant to the broker failed", { meta: {
+				userId,
+				error: err instanceof Error ? err.message : String(err)
+			} });
 			return null;
 		}
-		const refreshTokenNext = typeof parsed.refresh_token === "string" ? parsed.refresh_token : existing.refreshToken;
-		await this.deps.upsertToken({
-			userId,
-			accessToken: parsed.access_token,
-			refreshToken: refreshTokenNext,
-			expiresAt: Date.now() + parsed.expires_in * 1e3
-		});
-		return parsed.access_token;
 	}
 	findToken(userId) {
 		return this.deps.listTokens().find((t) => t.userId === userId) ?? null;
 	}
 	/**
-	* Proactive push (doorbell/motion) needs the skill's LWA "Send Alexa Events"
-	* credentials to mint/refresh Event-Gateway tokens. When they're not
-	* configured, pushing is futile (Amazon returns INVALID_ACCESS_TOKEN and we
-	* cannot refresh) — skip it and warn ONCE instead of once per event.
+	* Proactive push needs a stored grant for at least one account. With none,
+	* pushing is futile — skip it and warn ONCE instead of once per event.
+	* (Per-account absence is reported in `postEventBody`.)
 	*/
 	hasProactiveCredentials() {
-		if (this.deps.getLwaCredentials() !== null) return true;
-		if (!this.warnedNoLwaCreds) {
-			this.warnedNoLwaCreds = true;
-			this.deps.logger.warn("alexa lwa-gateway: proactive events (doorbell/motion) disabled — set the LWA client id/secret in the Alexa addon settings (from the skill Permissions → \"Send Alexa Events\" panel)");
+		if (this.deps.listTokens().length > 0) {
+			this.warnedNoGrant = false;
+			return true;
+		}
+		if (!this.warnedNoGrant) {
+			this.warnedNoGrant = true;
+			this.deps.logger.warn("alexa lwa-gateway: proactive events (doorbell/motion/discovery) skipped — no Amazon push grant is stored; link the skill in the Alexa app");
 		}
 		return false;
 	}
@@ -52984,23 +53300,21 @@ function buildAlexaOauthIntegration(publicHubUrl) {
 //#endregion
 //#region src/public-skill.ts
 /**
-* Built-in "public" Alexa skill credentials.
+* The built-in "public" CamStack Alexa skill.
 *
-* These identify the single published CamStack Alexa skill that every hub
-* shares in `skillMode: 'public'`. They are intentionally committed to source:
-* a published Smart Home skill has ONE set of "Send Alexa Events" credentials,
-* and each self-hosted hub pushes proactive events DIRECTLY to the Alexa Event
-* Gateway using them. The real per-account gate is the OAuth access/refresh
-* token minted during account-linking — the client secret alone cannot push
-* events to an account without that account's grant. This is the standard
-* published-skill model for self-hosted servers.
+* Only its skill id lives here — an identifier, not a credential. Until D753
+* this file also carried the skill's Login With Amazon "Send Alexa Events"
+* client id and SECRET, on the theory that a per-account refresh token was the
+* real gate. The package is public on npm, so that secret was published with
+* every version and has to be rotated. Since D753 the secret lives only in the
+* skill's Lambda (AWS Secrets Manager); the hub gets short-lived Event Gateway
+* tokens from the Lambda's broker (`broker-client.ts`) with a per-link
+* credential. `scripts/check-no-client-secrets.ts` keeps it that way.
 *
-* Operators who run their OWN skill switch to `skillMode: 'custom'` and supply
-* their own values via settings; these constants are then unused.
+* Operators who run their OWN skill switch to `skillMode: 'custom'` and deploy
+* the same Lambda (`lambda-template/`) with their own secrets.
 */
 var PUBLIC_SKILL_ID = "amzn1.ask.skill.aa85d6df-1600-4f13-bda9-babcfdc849e6";
-var PUBLIC_LWA_CLIENT_ID = "amzn1.application-oa2-client.0033e4a5b8614b11a609f5eae7cbda82";
-var PUBLIC_LWA_CLIENT_SECRET = "amzn1.oa2-cs.v1.82f852bc5d4a7fb906d670d36f936abd3011ac8c229d066b22a57a9f38488f1e";
 //#endregion
 //#region src/endpoint-signature.ts
 /** One capability's identity as Alexa distinguishes it. */
@@ -53247,12 +53561,6 @@ var SyncEngine = class {
 	}
 };
 //#endregion
-//#region src/types.ts
-var DEFAULT_DEVICE_SETTINGS = {
-	streamPreference: "auto",
-	sourceProfile: "high"
-};
-//#endregion
 //#region src/export-alexa.addon.ts
 /**
 * Alexa Smart Home Skill export addon — hub-side.
@@ -53321,6 +53629,7 @@ var DEFAULT_CONFIG = {
 	expectedAudience: "",
 	lwaClientId: "",
 	lwaClientSecret: "",
+	advertisedBrokerUrl: "",
 	region: "NA",
 	exposed: [],
 	linkedAccounts: [],
@@ -53350,6 +53659,10 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 	async onInitialize() {
 		if (!this.config.ingressToken) await this.updateGlobalSettings({ ingressToken: generateIngressToken() });
+		if (this.config.lwaClientSecret) {
+			await this.updateGlobalSettings({ lwaClientSecret: "" });
+			this.ctx.logger.warn("export-alexa: removed a stored LWA client secret — the hub no longer uses one; your skill Lambda holds it (D753)");
+		}
 		await this.backfillLinkedAccounts();
 		this.autoDetectPublicHubUrl().catch((err) => {
 			this.ctx.logger.warn("export-alexa: public hub URL auto-detect failed", { meta: { error: errMsg(err) } });
@@ -53420,7 +53733,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 				upsertToken: (input) => this.upsertToken(input),
 				recordLinkedAccount: (input) => this.recordLinkedAccount(input)
 			},
-			redetectPublicHubUrl: () => this.redetectPublicHubUrl()
+			redetectPublicHubUrl: () => this.redetectPublicHubUrl(),
+			onBrokerAdvertised: (raw) => this.rememberAdvertisedBroker(raw)
 		}));
 		const oauthIntegrationProvider = { getDescriptor: async () => buildAlexaOauthIntegration(this.config.publicHubUrl) };
 		this.lwaGateway = new LwaEventGateway({
@@ -53431,7 +53745,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 			listTokens: () => this.config.tokens,
 			upsertToken: (input) => this.upsertToken(input),
 			removeLinkedAccount: (userId) => this.removeLinkedAccount(userId),
-			getLwaCredentials: () => this.lwaCredentials(),
+			getAdvertisedBrokerUrl: () => this.config.advertisedBrokerUrl || null,
+			getPublicHubUrl: () => this.config.publicHubUrl,
 			getRegion: () => this.config.region,
 			getExportedSignature: (deviceId) => this.config.exportedSignatures[deviceId] ?? null
 		});
@@ -53440,7 +53755,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 			logger: this.ctx.logger,
 			listExposed: () => this.config.exposed,
 			listLinkedAccounts: () => this.config.linkedAccounts,
-			hasProactiveCredentials: () => this.lwaCredentials() !== null,
+			hasProactiveCredentials: () => this.config.tokens.length > 0,
 			buildEndpoints: (deviceId) => this.buildEndpointsForOneDevice(deviceId),
 			postAddOrUpdate: (userId, endpoints) => this.requireGateway().postReport(userId, (accessToken) => buildAddOrUpdateReportPayload(userId, endpoints, accessToken), `add/update (${endpoints.length})`),
 			postDelete: (userId, ids) => this.requireGateway().postReport(userId, (accessToken) => buildDeleteReportPayload(userId, ids, accessToken), `delete (${ids.length})`),
@@ -53475,7 +53790,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 			exposedCount: this.config.exposed.length,
 			skillMode: this.config.skillMode,
 			skillIdSet: this.effectiveSettings().expectedAudience.length > 0,
-			lwaConfigured: this.lwaCredentials() !== null
+			pushGrants: this.config.tokens.length,
+			brokerGrants: this.config.tokens.filter(isBrokerGrant).length
 		} });
 		return {
 			providers: [
@@ -53498,7 +53814,8 @@ var ExportAlexaAddon = class extends BaseAddon {
 				regenerateIngressToken: async () => this.regenerateIngressToken(),
 				resyncDiscovery: async () => this.resyncDiscovery(),
 				purgeStaleEndpoints: async () => this.purgeStaleEndpoints(),
-				unlinkAlexaAccounts: async () => this.unlinkAlexaAccounts()
+				unlinkAlexaAccounts: async () => this.unlinkAlexaAccounts(),
+				rotateBrokerCredential: async () => this.rotateBrokerCredentials()
 			}
 		};
 	}
@@ -53720,6 +54037,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 			}
 			this.ctx.logger.warn("export-alexa: revokeOauthSession reported failure — the session may already be gone", { meta: { sessionId: id } });
 		}
+		await this.revokeAtBroker(this.config.tokens);
 		const removedAccounts = this.config.linkedAccounts.length;
 		await this.updateGlobalSettings({
 			linkedAccounts: [],
@@ -53741,9 +54059,11 @@ var ExportAlexaAddon = class extends BaseAddon {
 		const entry = {
 			userId: input.userId,
 			accessToken: input.accessToken,
-			refreshToken: input.refreshToken,
 			expiresAt: input.expiresAt,
-			receivedAt: Date.now()
+			receivedAt: Date.now(),
+			...input.refreshToken ? { refreshToken: input.refreshToken } : {},
+			...input.brokerUrl ? { brokerUrl: input.brokerUrl } : {},
+			...input.brokerCredential ? { brokerCredential: input.brokerCredential } : {}
 		};
 		const next = this.config.tokens.filter((t) => t.userId !== input.userId);
 		next.push(entry);
@@ -53789,26 +54109,79 @@ var ExportAlexaAddon = class extends BaseAddon {
 	}
 	/**
 	* Settings as the runtime should read them. In `skillMode: 'public'` the
-	* skill id + LWA credentials are swapped for the built-in CamStack values;
-	* the operator's own `expectedAudience`/`lwaClient*` stay untouched in the
-	* persisted config so switching back to `custom` restores them. Everything
-	* else (hub URL, ingress token, region, exposed list, …) passes through.
+	* skill id is swapped for the built-in CamStack skill's; the operator's own
+	* `expectedAudience` stays untouched in the persisted config so switching
+	* back to `custom` restores it. Everything else passes through. There is no
+	* credential to overlay any more (D753).
 	*/
 	effectiveSettings() {
 		if (this.config.skillMode !== "public") return this.config;
 		return {
 			...this.config,
-			expectedAudience: PUBLIC_SKILL_ID,
-			lwaClientId: PUBLIC_LWA_CLIENT_ID,
-			lwaClientSecret: PUBLIC_LWA_CLIENT_SECRET
+			expectedAudience: PUBLIC_SKILL_ID
 		};
 	}
-	lwaCredentials() {
-		const s = this.effectiveSettings();
-		if (!s.lwaClientId || !s.lwaClientSecret) return null;
+	/** Persist the broker origin the Lambda advertised on a verified directive. */
+	rememberAdvertisedBroker(raw) {
+		const url = normaliseBrokerUrl(raw);
+		if (!url) {
+			this.ctx.logger.warn("export-alexa: ignored a broker advertisement that is not an https origin");
+			return;
+		}
+		if (url === this.config.advertisedBrokerUrl) return;
+		this.updateGlobalSettings({ advertisedBrokerUrl: url }).then(() => {
+			this.ctx.logger.info("export-alexa: the skill Lambda advertised its token broker", { meta: { brokerUrl: url } });
+		}).catch((err) => {
+			this.ctx.logger.warn("export-alexa: could not store the advertised broker URL", { meta: { error: errMsg(err) } });
+		});
+	}
+	async revokeAtBroker(tokens) {
+		for (const t of tokens) {
+			if (!isBrokerGrant(t)) continue;
+			await revokeBrokerCredential(fetch, t.brokerUrl, t.brokerCredential).catch((err) => {
+				this.ctx.logger.warn("export-alexa: could not delete the link at the skill broker — it expires there on its own", { meta: {
+					userId: t.userId,
+					error: errMsg(err)
+				} });
+			});
+		}
+	}
+	/**
+	* Swap every broker credential this hub holds for a fresh one. The old
+	* credential stops working at the broker immediately. A credential the
+	* broker no longer recognises is reported, not retried — re-link instead.
+	*/
+	async rotateBrokerCredentials() {
+		let rotated = 0;
+		let failed = 0;
+		for (const t of this.config.tokens) {
+			if (!isBrokerGrant(t)) continue;
+			try {
+				const next = await rotateBrokerCredential(fetch, t.brokerUrl, t.brokerCredential);
+				await this.upsertToken({
+					userId: t.userId,
+					accessToken: t.accessToken,
+					expiresAt: t.expiresAt,
+					brokerUrl: t.brokerUrl,
+					brokerCredential: next
+				});
+				rotated += 1;
+			} catch (err) {
+				failed += 1;
+				this.ctx.logger.warn("export-alexa: broker credential rotation failed", { meta: {
+					userId: t.userId,
+					kind: err instanceof BrokerError ? err.kind : "unavailable",
+					error: errMsg(err)
+				} });
+			}
+		}
+		this.ctx.logger.info("export-alexa: broker credentials rotated", { meta: {
+			rotated,
+			failed
+		} });
 		return {
-			clientId: s.lwaClientId,
-			clientSecret: s.lwaClientSecret
+			rotated,
+			failed
 		};
 	}
 	/**
@@ -53963,8 +54336,9 @@ var ExportAlexaAddon = class extends BaseAddon {
 					label: "Setup overview",
 					variant: "info",
 					content: [
-						"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account — the skill id and Send-Alexa-Events credentials are built in, so no Amazon developer setup is needed. A single published skill + hosted Lambda route to this hub using its public HTTPS URL (baked into every JWT).",
-						"Custom skill: switch \"Alexa skill\" below to Custom and supply your own skill id + LWA credentials (from your skill's Permissions → \"Send Alexa Events\" panel).",
+						"Public skill (default): enable the \"CamStack\" skill in the Alexa app and link your account — no Amazon developer setup is needed. A single published skill + hosted Lambda route to this hub using its public HTTPS URL (baked into every JWT).",
+						"The skill's Lambda keeps the Amazon credentials: this hub never holds an LWA client secret. It receives short-lived event tokens from the Lambda's token broker with a credential that is unique to this link.",
+						"Custom skill: switch \"Alexa skill\" below to Custom, enter your skill id, and deploy the skill Lambda from this addon's lambda-template in your own AWS account (your LWA credentials go into AWS Secrets Manager there, not here).",
 						"Either way this hub must be reachable from the public internet (Cloudflare Tunnel, Tailscale Funnel, …). The \"External address\" picker selects which detected endpoint the Lambda calls back on — press \"Refresh external addresses\" after setting up a new tunnel."
 					].join("\n")
 				},
@@ -53989,7 +54363,7 @@ var ExportAlexaAddon = class extends BaseAddon {
 					type: "select",
 					key: "skillMode",
 					label: "Alexa skill",
-					description: "Public: use the built-in CamStack skill — zero Amazon developer setup. Custom: bring your own skill and LWA credentials.",
+					description: "Public: use the built-in CamStack skill — zero Amazon developer setup. Custom: bring your own skill and your own copy of the skill Lambda.",
 					options: [{
 						value: "public",
 						label: "Public (built-in CamStack skill)"
@@ -54020,35 +54394,24 @@ var ExportAlexaAddon = class extends BaseAddon {
 					],
 					default: DEFAULT_CONFIG.region
 				}),
-				...this.config.skillMode === "custom" ? [
-					this.field({
-						type: "text",
-						key: "expectedAudience",
-						label: "Alexa skill id",
-						description: "Your skill's id, format amzn1.ask.skill.xxxx. Found on the Alexa developer console; used to gate directives the next dispatch will start signing.",
-						default: DEFAULT_CONFIG.expectedAudience
-					}),
-					this.field({
-						type: "text",
-						key: "lwaClientId",
-						label: "LWA client id (proactive events)",
-						description: "From the skill's Permissions → \"Send Alexa Events\" panel. Required for everything the hub pushes to Alexa: doorbell presses, motion, battery level and device-list updates.",
-						default: DEFAULT_CONFIG.lwaClientId
-					}),
-					this.field({
-						type: "password",
-						key: "lwaClientSecret",
-						label: "LWA client secret (proactive events)",
-						description: "Paired with LWA client id. Treat as sensitive.",
-						showToggle: true,
-						default: DEFAULT_CONFIG.lwaClientSecret
-					})
-				] : [{
+				...this.config.skillMode === "custom" ? [this.field({
+					type: "text",
+					key: "expectedAudience",
+					label: "Alexa skill id",
+					description: "Your skill's id, format amzn1.ask.skill.xxxx. Found on the Alexa developer console; used to gate directives the next dispatch will start signing.",
+					default: DEFAULT_CONFIG.expectedAudience
+				}), {
+					type: "info",
+					key: "__custom-skill-info",
+					label: "Your skill Lambda",
+					variant: "info",
+					content: "Proactive events (doorbell, motion, battery, device-list updates) are authorised by YOUR skill Lambda: it keeps the \"Send Alexa Events\" LWA client id/secret in AWS Secrets Manager and hands this hub short-lived tokens. Nothing to paste here — see the custom-skill setup guide."
+				}] : [{
 					type: "info",
 					key: "__public-skill-info",
 					label: "Built-in skill",
 					variant: "info",
-					content: "Using the built-in CamStack public skill — skill id and Send-Alexa-Events credentials are managed automatically. Pick your region above, then just enable \"CamStack\" in the Alexa app and link your account. Switch to \"Custom skill\" above to use your own."
+					content: "Using the built-in CamStack public skill — its Amazon credentials stay in the skill's Lambda, never on this hub. Pick your region above, then just enable \"CamStack\" in the Alexa app and link your account. Switch to \"Custom skill\" above to use your own."
 				}],
 				{
 					type: "info",
@@ -54058,7 +54421,6 @@ var ExportAlexaAddon = class extends BaseAddon {
 					content: buildLinkStatusContent({
 						linkedAccounts: this.config.linkedAccounts,
 						tokens: this.config.tokens,
-						hasLwaCredentials: this.lwaCredentials() !== null,
 						now: Date.now()
 					})
 				},
@@ -54072,6 +54434,15 @@ var ExportAlexaAddon = class extends BaseAddon {
 					variant: "danger",
 					confirmMessage: "Unlink the Amazon account? Alexa loses access to your cameras immediately and you must re-link from the Alexa app to restore it."
 				},
+				{
+					type: "button",
+					key: "__rotate-broker-credential",
+					label: "Skill broker credential",
+					description: "Replace the credential this hub uses at the skill's token broker with a fresh one. The old one stops working immediately. Use it if a backup of this hub's settings may have leaked. Re-linking from the Alexa app also issues a fresh one.",
+					buttonLabel: "Rotate credential",
+					action: "rotateBrokerCredential",
+					variant: "default"
+				},
 				{
 					type: "button",
 					key: "__resync-discovery",