@camstack/addon-export-alexa 1.2.134 → 1.2.136

package/lambda-template/README.md

@@ -32,18 +32,19 @@ and shows its error on the page.
 
 ### The two credential pairs
 
-| Pair | Secrets Manager id | Authenticates | Who else holds it |
+| Pair | SSM parameter (SecureString) | Authenticates | Who else holds it |
 | --- | --- | --- | --- |
-| **LWA "Send Alexa Events"** client (skill console → Permissions → Alexa Skill Messaging) | `camstack/alexa/lwa` | this Lambda → `api.amazon.com` (code exchange, refresh) | nobody |
-| **Account-linking** client (skill console → Account Linking) | `camstack/alexa/skill` | Amazon → this Lambda's `/token` | Amazon |
+| **LWA "Send Alexa Events"** client (skill console → Permissions → Alexa Skill Messaging) | `/camstack/alexa/lwa` | this Lambda → `api.amazon.com` (code exchange, refresh) | nobody |
+| **Account-linking** client (skill console → Account Linking) | `/camstack/alexa/skill` | Amazon → this Lambda's `/token` | Amazon |
 
-Each secret is a JSON string:
+Each parameter is a **SecureString** (standard tier, AWS-managed key
+`alias/aws/ssm`) whose value is a JSON string:
 
 ```json
 { "clientId": "…", "clientSecret": "…" }
 ```
 
-`camstack/alexa/skill` may also carry `"previousClientSecret"` — accepted on
+`/camstack/alexa/skill` may also carry `"previousClientSecret"` — accepted on
 `/token` while you rotate it (change the value in the skill console, then remove
 the previous one).
 
@@ -77,10 +78,18 @@ your skill's locale: NA → `us-east-1`, EU/IN → `eu-west-1`, FE/AU → `us-we
    call it). Note the URL.
 3. **Trigger**: **Alexa** → **Alexa Smart Home**, with your skill id
    (`amzn1.ask.skill.…`). Create the skill first to get it.
-4. **Secrets Manager**: create `camstack/alexa/lwa` and `camstack/alexa/skill`
-   (JSON above) in the Lambda's region. Enter the values in the console, or
-   with `--secret-string file://…` from a file you delete afterwards — never as
-   a command-line argument.
+4. **SSM Parameter Store** (free standard tier): in the Lambda's region,
+   Systems Manager → Parameter Store → **Create parameter**, twice:
+   - Name `/camstack/alexa/lwa`, then `/camstack/alexa/skill`
+   - Tier **Standard**, Type **SecureString**
+   - KMS key source **My current account**, KMS key ID `alias/aws/ssm`
+   - Value: the JSON above.
+
+   Enter the values in the console, or with `aws ssm put-parameter --type
+   SecureString --value file://…` from a file you delete afterwards — never as
+   a literal command-line argument. The Lambda reads them with `GetParameter`
+   and `WithDecryption: true`, caches them for 5 minutes, and re-reads the LWA
+   pair at once when LWA answers `invalid_client`.
 5. **DynamoDB**:
 
    ```bash
@@ -102,10 +111,22 @@ your skill's locale: NA → `us-east-1`, EU/IN → `eu-west-1`, FE/AU → `us-we
      "Version": "2012-10-17",
      "Statement": [
        {
-         "Sid": "ReadSkillSecrets",
+         "Sid": "ReadSkillParameters",
          "Effect": "Allow",
-         "Action": "secretsmanager:GetSecretValue",
-         "Resource": "arn:aws:secretsmanager:REGION:ACCOUNT:secret:camstack/alexa/*"
+         "Action": "ssm:GetParameter",
+         "Resource": "arn:aws:ssm:REGION:ACCOUNT:parameter/camstack/alexa/*"
+       },
+       {
+         "Sid": "DecryptSkillParametersViaSsm",
+         "Effect": "Allow",
+         "Action": "kms:Decrypt",
+         "Resource": "arn:aws:kms:REGION:ACCOUNT:key/AWS_SSM_KEY_ID",
+         "Condition": {
+           "StringEquals": { "kms:ViaService": "ssm.REGION.amazonaws.com" },
+           "StringLike": {
+             "kms:EncryptionContext:PARAMETER_ARN": "arn:aws:ssm:REGION:ACCOUNT:parameter/camstack/alexa/*"
+           }
+         }
        },
        {
          "Sid": "BrokerLinks",
@@ -117,25 +138,32 @@ your skill's locale: NA → `us-east-1`, EU/IN → `eu-west-1`, FE/AU → `us-we
    }
    ```
 
-   The default `aws/secretsmanager` and `aws/dynamodb` keys need no extra KMS
-   permission. A customer-managed key would need `kms:Decrypt` on it.
+   `AWS_SSM_KEY_ID` is the id of the AWS-managed `alias/aws/ssm` key (KMS
+   console → AWS managed keys, or `aws kms describe-key --key-id
+   alias/aws/ssm`). AWS's guidance on whether the AWS-managed key needs a
+   `kms:Decrypt` grant is inconsistent — its key policy already lets account
+   principals decrypt through SSM — so the statement is included, and scoped so
+   it can only decrypt these two parameters, and only through SSM. A
+   customer-managed key would need the same statement on that key instead. The
+   default `aws/dynamodb` key needs no extra permission.
 
 7. **Environment variables** (none is a secret):
 
 | Name | Value |
 | --- | --- |
-| `LWA_SECRET_ID` | `camstack/alexa/lwa` |
-| `SKILL_SECRET_ID` | `camstack/alexa/skill` |
+| `LWA_PARAM` | `/camstack/alexa/lwa` |
+| `SKILL_PARAM` | `/camstack/alexa/skill` |
 | `TOKENS_TABLE` | `camstack-alexa-tokens`. Unset = broker off: AcceptGrant hands the tokens to the hub as before D753. |
 | `LAMBDA_REDIRECT_URI` | Function URL + `/token`. AcceptGrant's `redirect_uri`; its origin is the broker URL advertised to hubs. |
 | `BROKER_PUBLIC_URL` | Optional override of that origin (https only). |
 | `LEGACY_HUB_FALLBACK` | `0` = a hub without `/oauth/broker-link` (pre-D753 addon) fails AcceptGrant instead of receiving the refresh token. Default on, for the cut-over. |
+| `DEBUG_DIRECTIVES` | `1` = one `directive_trace` log line per Smart Home directive: namespace / name / endpointId / payloadVersion / payload keys asked, and the answered event (ErrorResponse type and message, StateReport property names and value shapes). Never the bearer token or SDP bodies. Diagnostic; default off. |
 | `ALLOW_MIGRATION` | `0` = refuse `/broker/migrate`. Default on until every hub has migrated. |
 | `HUB_INGRESS_TOKEN` | Optional defense-in-depth header (`X-CamStack-Ingress`), copied from the addon's **Ingress token** setting. |
 
-Legacy, read only when the matching `*_SECRET_ID` is unset: `LWA_CLIENT_ID`,
+Legacy, read only when the matching `*_PARAM` is unset: `LWA_CLIENT_ID`,
 `LWA_CLIENT_SECRET`, `SKILL_CLIENT_ID`, `SKILL_CLIENT_SECRET`. Remove them once
-the secrets are in Secrets Manager.
+the parameters exist and `*_PARAM` is set.
 
 ## Skill manifest
 
@@ -145,10 +173,10 @@ the secrets are in Secrets Manager.
 | Account Linking | Authorization grant type | Auth Code Grant |
 | | Authorization URI | `<FUNCTION_URL>/authorize` |
 | | Access Token URI | `<FUNCTION_URL>/token` |
-| | Client ID / Secret | the `camstack/alexa/skill` values |
+| | Client ID / Secret | the `/camstack/alexa/skill` values |
 | | Authentication scheme | Credentials in request body (**not** HTTP Basic — the Lambda reads them from the body) |
 | | Scope, Domain list | empty |
-| Permissions | Send Alexa Events | on; its Alexa Client Id/Secret go into `camstack/alexa/lwa` |
+| Permissions | Send Alexa Events | on; its Alexa Client Id/Secret go into `/camstack/alexa/lwa` |
 
 ## Cut-over and compatibility
 
@@ -175,5 +203,5 @@ log line carries a token, code, credential or secret.
 ## Tests
 
 `packages/addon-export-alexa/src/__tests__/lambda-broker.spec.ts` — the whole
-Lambda against fake LWA, hub, Secrets Manager and DynamoDB (`npx vitest run`
+Lambda against fake LWA, hub, SSM Parameter Store and DynamoDB (`npx vitest run`
 in the addon).

package/lambda-template/aws.js

@@ -1,37 +1,53 @@
 /**
- * Default AWS wiring. The Lambda Node.js 22 runtime ships AWS SDK v3, so the
- * deployment stays a zip of plain files with no node_modules. Required lazily:
- * tests inject fakes and never load the SDK.
+ * Default AWS wiring. The Lambda Node.js 22 runtime ships AWS SDK v3
+ * (`@aws-sdk/client-ssm`, `@aws-sdk/client-dynamodb`), so the deployment stays
+ * a zip of plain files with no node_modules. Required lazily: tests inject a
+ * fake `loadSdk` and never load the SDK.
  *
  * Execution-role permissions this needs (see README → IAM):
- *   secretsmanager:GetSecretValue   on the two camstack/alexa/* secrets
- *   dynamodb:GetItem/PutItem/DeleteItem on the tokens table
+ *   ssm:GetParameter                     on parameter/camstack/alexa/*
+ *   kms:Decrypt                          on the `aws/ssm` key, only via SSM and
+ *                                        only for those parameters (D761)
+ *   dynamodb:GetItem/PutItem/DeleteItem  on the tokens table
  */
 'use strict'
 
-function createAwsClients() {
+/**
+ * @param {object} [opts]
+ * @param {(name: string) => any} [opts.loadSdk]  module loader (tests inject a fake)
+ */
+function createAwsClients(opts) {
+  const loadSdk = (opts && opts.loadSdk) || require
   let ddbClient = null
-  let smClient = null
+  let ssmClient = null
+  let ssmSdk = null
 
   async function send(commandName, input) {
-    const ddb = require('@aws-sdk/client-dynamodb')
+    const ddb = loadSdk('@aws-sdk/client-dynamodb')
     if (!ddbClient) ddbClient = new ddb.DynamoDBClient({})
     const Command = ddb[`${commandName}Command`]
     if (typeof Command !== 'function') throw new Error(`unknown DynamoDB command ${commandName}`)
     return ddbClient.send(new Command(input))
   }
 
-  async function fetchSecretString(secretId) {
-    const sm = require('@aws-sdk/client-secrets-manager')
-    if (!smClient) smClient = new sm.SecretsManagerClient({})
-    const res = await smClient.send(new sm.GetSecretValueCommand({ SecretId: secretId }))
-    if (typeof res.SecretString !== 'string') {
-      throw new Error(`secret ${secretId} has no SecretString`)
+  /**
+   * The decrypted value of one SecureString parameter. Errors name the
+   * parameter, never a value.
+   */
+  async function readParameter(name) {
+    if (!ssmSdk) ssmSdk = loadSdk('@aws-sdk/client-ssm')
+    if (!ssmClient) ssmClient = new ssmSdk.SSMClient({})
+    const res = await ssmClient.send(
+      new ssmSdk.GetParameterCommand({ Name: name, WithDecryption: true }),
+    )
+    const value = res && res.Parameter ? res.Parameter.Value : undefined
+    if (typeof value !== 'string' || value.length === 0) {
+      throw new Error(`parameter ${name} has no value`)
     }
-    return res.SecretString
+    return value
   }
 
-  return { send, fetchSecretString }
+  return { send, readParameter }
 }
 
 module.exports = { createAwsClients }

package/lambda-template/broker.js

@@ -4,7 +4,7 @@
  * The skill's LWA client secret authenticates every grant exchange and every
  * refresh at api.amazon.com. Before D753 a copy of it lived in every hub — in
  * public source and in a public npm package. Now it lives ONLY here (read from
- * Secrets Manager), together with each user's LWA refresh token, and a hub
+ * an SSM SecureString parameter), together with each user's LWA refresh token, and a hub
  * gets exactly what it needs to push events: a short-lived access token.
  *
  * A hub authenticates to the broker with a PER-LINK credential
@@ -119,7 +119,7 @@ function lwaErrorCode(res) {
 
 /**
  * One call to the LWA token endpoint with the skill's credentials. On
- * `invalid_client` with a Secrets-Manager-sourced secret, drops the cache and
+ * `invalid_client` with a Parameter-Store-sourced secret, drops the cache and
  * retries once with a freshly read value — so a rotation takes effect on the
  * very next call instead of after the cache TTL.
  */
@@ -129,7 +129,7 @@ async function lwaTokenCall(deps, params) {
     throw new BrokerError(500, 'unconfigured', 'LWA client credentials are not configured')
   }
   let res = await postLwa(deps, params, creds)
-  if (lwaErrorCode(res) === 'invalid_client' && creds.source === 'secrets-manager') {
+  if (lwaErrorCode(res) === 'invalid_client' && creds.source === 'ssm') {
     deps.secrets.invalidate('lwa')
     const fresh = await deps.secrets.lwa()
     if (fresh && fresh.clientSecret !== creds.clientSecret) {

package/lambda-template/debug-trace.js

@@ -0,0 +1,100 @@
+'use strict'
+
+/**
+ * TEMPORARY diagnostic, on only with `DEBUG_DIRECTIVES=1`: one `directive_trace`
+ * line per Smart Home directive — what Alexa asked and what the skill answered.
+ *
+ * Built from an allow-list of fields, never by dumping the event: the
+ * directive's `scope.token` (the account's bearer) and the SDP bodies never
+ * reach the log. StateReport property values are summarised (a short scalar,
+ * or the object's keys and scalar values) — they are device states, not
+ * credentials.
+ */
+
+const MAX_VALUE_CHARS = 60
+
+function isEnabled(env) {
+  return Boolean(env) && env.DEBUG_DIRECTIVES === '1'
+}
+
+function str(value) {
+  return typeof value === 'string' ? value : undefined
+}
+
+function summariseValue(value) {
+  if (value === null || value === undefined) return String(value)
+  if (typeof value !== 'object') return String(value).slice(0, MAX_VALUE_CHARS)
+  if (Array.isArray(value)) return `[array:${value.length}]`
+  const parts = Object.keys(value).map((k) => {
+    const v = value[k]
+    return v !== null && typeof v === 'object' ? `${k}:{…}` : `${k}:${String(v)}`
+  })
+  return `{${parts.join(',')}}`.slice(0, MAX_VALUE_CHARS)
+}
+
+function payloadShape(payload) {
+  if (!payload || typeof payload !== 'object') return undefined
+  return Object.keys(payload)
+    .filter((k) => k !== 'scope')
+    .map((k) => {
+      const v = payload[k]
+      if (v && typeof v === 'object' && typeof v.value === 'string') {
+        // RTC offers/answers: { format, value: <SDP> } — length only.
+        return `${k}(${str(v.format) || 'object'},${v.value.length}b)`
+      }
+      return k
+    })
+}
+
+function summariseDirective(event) {
+  const d = (event && event.directive) || {}
+  const h = d.header || {}
+  const ep = d.endpoint || {}
+  return {
+    namespace: str(h.namespace),
+    name: str(h.name),
+    endpointId: str(ep.endpointId),
+    payloadVersion: str(h.payloadVersion),
+    payloadKeys: payloadShape(d.payload),
+  }
+}
+
+function summariseResponse(body) {
+  const ev = body && body.event
+  if (!ev || !ev.header) return { kind: 'non-event' }
+  const out = {
+    namespace: str(ev.header.namespace),
+    name: str(ev.header.name),
+    endpointId: str(ev.endpoint && ev.endpoint.endpointId),
+  }
+  const payload = ev.payload || {}
+  if (out.name === 'ErrorResponse') {
+    out.errorType = str(payload.type)
+    out.errorMessage = str(payload.message)
+  } else {
+    out.payloadKeys = payloadShape(payload)
+  }
+  const props = body.context && Array.isArray(body.context.properties) ? body.context.properties : null
+  if (props) {
+    out.properties = props.map(
+      (p) => `${str(p && p.namespace)}.${str(p && p.name)}=${summariseValue(p && p.value)}`,
+    )
+  }
+  return out
+}
+
+/** Log one trace line; never throws into the directive path. */
+function traceDirective(deps, event, response, startedAt) {
+  if (!isEnabled(deps.env)) return
+  try {
+    deps.log.info('directive_trace', {
+      directive: summariseDirective(event),
+      response: summariseResponse(response),
+      ms: deps.now() - startedAt,
+    })
+  } catch {
+    // diagnostics only
+  }
+}
+
+module.exports = { traceDirective, summariseDirective, summariseResponse }

package/lambda-template/index.js

@@ -19,10 +19,13 @@
  *      - everything else                 → forward to the hub
  *
  * Configuration (env — none of these is a secret once D753 is deployed):
- *   LWA_SECRET_ID        Secrets Manager id of {"clientId","clientSecret"} for
- *                        the skill's "Send Alexa Events" LWA client.
- *   SKILL_SECRET_ID      Secrets Manager id of {"clientId","clientSecret"
- *                        [,"previousClientSecret"]} for account linking.
+ *   LWA_PARAM            SSM SecureString parameter name (e.g.
+ *                        /camstack/alexa/lwa) holding {"clientId","clientSecret"}
+ *                        for the skill's "Send Alexa Events" LWA client.
+ *   SKILL_PARAM          SSM SecureString parameter name (e.g.
+ *                        /camstack/alexa/skill) holding {"clientId",
+ *                        "clientSecret"[,"previousClientSecret"]} for account
+ *                        linking.
  *   TOKENS_TABLE         DynamoDB table of broker links. Unset = broker off
  *                        (pre-D753 behaviour: tokens are handed to the hub).
  *   LAMBDA_REDIRECT_URI  Function URL + "/token"; the AcceptGrant redirect_uri.
@@ -31,7 +34,9 @@
  *                        instead of receiving the refresh token. Default on.
  *   ALLOW_MIGRATION      "0" = refuse /broker/migrate. Default on.
  *   HUB_INGRESS_TOKEN    Optional defense-in-depth header for hub calls.
- * Legacy (read only when the *_SECRET_ID is unset): LWA_CLIENT_ID,
+ *   DEBUG_DIRECTIVES     "1" = log one `directive_trace` line per directive
+ *                        (debug-trace.js; never the bearer). Default off.
+ * Legacy (read only when the *_PARAM is unset): LWA_CLIENT_ID,
  * LWA_CLIENT_SECRET, SKILL_CLIENT_ID, SKILL_CLIENT_SECRET.
  *
  * Ships as plain files — no node_modules, no transpile (`zip` the folder's
@@ -50,6 +55,7 @@ const {
   isBrokerPath,
   shortId,
 } = require('./broker.js')
+const { traceDirective } = require('./debug-trace.js')
 const { timedFetch } = require('./http.js')
 const { createSecretSource } = require('./secrets.js')
 const { createDynamoTokenStore } = require('./token-store.js')
@@ -101,7 +107,7 @@ function resolveDeps(overrides) {
       o.secrets ||
       createSecretSource({
         env,
-        fetchSecretString: (id) => awsClients().fetchSecretString(id),
+        readParameter: (name) => awsClients().readParameter(name),
       }),
     store,
     publicUrl: resolveBrokerPublicUrl(env),
@@ -112,23 +118,28 @@ function createHandler(overrides) {
   let deps = null
   return async (event) => {
     if (!deps) deps = resolveDeps(overrides)
+    const startedAt = deps.now()
     try {
       if (event && event.requestContext && event.requestContext.http) {
         return await handleLambdaUrl(event, deps)
       }
       if (event && event.directive && event.directive.header) {
-        return await handleDirective(event, deps)
+        const res = await handleDirective(event, deps)
+        traceDirective(deps, event, res, startedAt)
+        return res
       }
       return jsonResponse(400, { error: 'unknown_event' })
     } catch (err) {
       deps.log.error('camstack-alexa: unhandled error', describe(err))
       if (event && event.directive && event.directive.header) {
-        return errorEnvelope(
+        const res = errorEnvelope(
           event.directive.header,
           'INTERNAL_ERROR',
           describe(err),
           event.directive.endpoint,
         )
+        traceDirective(deps, event, res, startedAt)
+        return res
       }
       return jsonResponse(500, { error: 'internal_error', message: describe(err) })
     }

package/lambda-template/secrets.js

@@ -1,5 +1,6 @@
 /**
- * Skill credentials, read where they live: AWS Secrets Manager (D753).
+ * Skill credentials, read where they live: SSM Parameter Store SecureString
+ * parameters, decrypted with the AWS-managed `aws/ssm` key (D753, D761).
  *
  * Two credential pairs exist, and they authenticate DIFFERENT parties:
  *
@@ -11,30 +12,32 @@
  *          Account Linking page. Authenticates AMAZON to this Lambda's
  *          `/token` route. Amazon holds a copy; nothing else needs one.
  *
- * Each secret is a JSON string `{"clientId": "...", "clientSecret": "..."}`.
+ * Each parameter's value is a JSON string
+ * `{"clientId": "...", "clientSecret": "..."}`.
  * `skill` may also carry `previousClientSecret`, accepted on `/token` while a
  * rotation is in flight (change Amazon's copy, then drop the previous one).
  *
  * Resolution, per pair:
- *   1. `<KIND>_SECRET_ID` set   → Secrets Manager, cached for `ttlMs`.
- *   2. otherwise                → the legacy plain env vars
- *                                 (`LWA_CLIENT_ID`/`LWA_CLIENT_SECRET`,
- *                                 `SKILL_CLIENT_ID`/`SKILL_CLIENT_SECRET`), so
- *                                 this code can be deployed before the secrets
- *                                 exist and the cut-over has no downtime.
+ *   1. `<KIND>_PARAM` set   → that SSM parameter (read with decryption),
+ *                             cached for `ttlMs`.
+ *   2. otherwise            → the legacy plain env vars
+ *                             (`LWA_CLIENT_ID`/`LWA_CLIENT_SECRET`,
+ *                             `SKILL_CLIENT_ID`/`SKILL_CLIENT_SECRET`), so this
+ *                             code can be deployed before the parameters exist
+ *                             and the cut-over has no downtime.
  *
  * The cache is what makes a rotation cheap: a new value is picked up within
  * `ttlMs`, and immediately when LWA answers `invalid_client` (the caller calls
- * `invalidate`). Error messages name the secret id, never a value.
+ * `invalidate`). Error messages name the parameter, never a value.
  */
 'use strict'
 
 const DEFAULT_SECRET_TTL_MS = 5 * 60 * 1000
 
 const KINDS = {
-  lwa: { secretIdVar: 'LWA_SECRET_ID', idVar: 'LWA_CLIENT_ID', secretVar: 'LWA_CLIENT_SECRET' },
+  lwa: { paramVar: 'LWA_PARAM', idVar: 'LWA_CLIENT_ID', secretVar: 'LWA_CLIENT_SECRET' },
   skill: {
-    secretIdVar: 'SKILL_SECRET_ID',
+    paramVar: 'SKILL_PARAM',
     idVar: 'SKILL_CLIENT_ID',
     secretVar: 'SKILL_CLIENT_SECRET',
   },
@@ -43,7 +46,7 @@ const KINDS = {
 /**
  * @param {object} opts
  * @param {Record<string, string|undefined>} opts.env
- * @param {(secretId: string) => Promise<string>} opts.fetchSecretString
+ * @param {(name: string) => Promise<string>} opts.readParameter  decrypted value
  * @param {() => number} [opts.now]
  * @param {number} [opts.ttlMs]
  */
@@ -55,12 +58,12 @@ function createSecretSource(opts) {
 
   async function load(kind) {
     const spec = KINDS[kind]
-    const secretId = env[spec.secretIdVar]
-    if (secretId) {
+    const paramName = env[spec.paramVar]
+    if (paramName) {
       const hit = cache.get(kind)
       if (hit && now() - hit.at < ttlMs) return hit.value
-      const raw = await opts.fetchSecretString(secretId)
-      const value = parseCredentialSecret(raw, secretId)
+      const raw = await opts.readParameter(paramName)
+      const value = parseCredentialParameter(raw, paramName)
       cache.set(kind, { value, at: now() })
       return value
     }
@@ -79,12 +82,12 @@ function createSecretSource(opts) {
   }
 }
 
-function parseCredentialSecret(raw, secretId) {
+function parseCredentialParameter(raw, paramName) {
   let obj
   try {
     obj = JSON.parse(raw)
   } catch {
-    throw new Error(`secret ${secretId} is not a JSON object`)
+    throw new Error(`parameter ${paramName} is not a JSON object`)
   }
   if (
     !obj ||
@@ -93,13 +96,13 @@ function parseCredentialSecret(raw, secretId) {
     typeof obj.clientSecret !== 'string' ||
     obj.clientSecret.length === 0
   ) {
-    throw new Error(`secret ${secretId} must be {"clientId": "...", "clientSecret": "..."}`)
+    throw new Error(`parameter ${paramName} must be {"clientId": "...", "clientSecret": "..."}`)
   }
-  const out = { clientId: obj.clientId, clientSecret: obj.clientSecret, source: 'secrets-manager' }
+  const out = { clientId: obj.clientId, clientSecret: obj.clientSecret, source: 'ssm' }
   if (typeof obj.previousClientSecret === 'string' && obj.previousClientSecret.length > 0) {
     out.previousClientSecret = obj.previousClientSecret
   }
   return out
 }
 
-module.exports = { createSecretSource, parseCredentialSecret, DEFAULT_SECRET_TTL_MS }
+module.exports = { createSecretSource, parseCredentialParameter, DEFAULT_SECRET_TTL_MS }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-export-alexa",
-  "version": "1.2.134",
+  "version": "1.2.136",
   "description": "Alexa Smart Home Skill export — hub-side OAuth provider + directive handler. The companion AWS Lambda forwards Alexa directives to this addon's /addon/export-alexa/directive endpoint.",
   "keywords": [
     "camstack",