@camstack/addon-export-alexa 1.2.146 → 1.2.148

package/lambda-template/README.md

@@ -13,7 +13,7 @@ The same code runs the built-in CamStack skill and any operator's own
 
 | Invocation | Action |
 | --- | --- |
-| `GET  <FUNCTION_URL>/authorize` | HTML form asking for the hub URL, then redirects to the hub's OAuth `/authorize`. |
+| `GET  <FUNCTION_URL>/authorize` | The hub-address step of account linking (below): a form in the CamStack page style (en/it), then — after checking the hub — a redirect to the hub's OAuth `/authorize`. |
 | `POST <FUNCTION_URL>/token` | Checks the account-linking client id/secret, decodes the `hubUrl` claim, proxies the token request to the hub. |
 | Smart Home directive | Forwards to `${hubUrl}/addon/export-alexa/directive`, adding `X-CamStack-Broker: <broker origin>` when the broker is on. |
 | `Alexa.Authorization/AcceptGrant` | Exchanges the grant code at `api.amazon.com` **here**, stores the grant in DynamoDB, gives the hub a per-link broker credential (`POST /addon/export-alexa/oauth/broker-link`). |
@@ -30,6 +30,32 @@ reached (network error, or a tunnel's 502–504 / 52x page) is
 `ACCEPT_GRANT_FAILED`. The `/authorize` page accepts only an `https://` hub URL
 and shows its error on the page.
 
+### The hub-address step (`/authorize`, `authorize-page.js`)
+
+Alexa opens this URL in the user's browser; the Lambda cannot know the hub, so
+the operator types its public HTTPS address (CamStack shows it under
+Connectivity → Alexa → "Hub address to enter in the Alexa app"). The page is the
+CamStack page family — `page-style.js` is generated from the hub's page shell
+(`npx tsx scripts/gen-alexa-lambda-page-style.ts`; a spec fails when it drifts) —
+and runs no script. The address is **checked before the browser leaves**:
+
+| Reason code shown on the page | Meaning |
+| --- | --- |
+| `invalid_url` / `not_https` | not a web address / not `https://` |
+| `local_address` | `localhost`, a private or tailnet IP, `.local` … — the Lambda runs in the cloud |
+| `unreachable` | no answer to `GET /api/oauth2/integrations` (6 s) |
+| `tls_error` | answered, but the certificate is not trusted by the Lambda's CA store |
+| `not_camstack` | answered, but not with a CamStack discovery document |
+| `integration_missing` / `hub_starting` | the hub does not serve `export-alexa` / is still registering it |
+
+A good hub gets a 302 to `<hub>/api/oauth2/authorize?…&integration=export-alexa`.
+From there the hub answers: consent on its own page; a refused request lands on
+the hub's `/sso-complete` page with a reason code. **Changing the destination
+hub** is the same step again: unlink on the old hub (Alexa export → Account link
+→ Unlink now), disable/enable the skill in the Alexa app, and enter the new
+address when asked. Tokens carry their `hubUrl` claim, so an existing link keeps
+its old hub until it is re-linked.
+
 ### The two credential pairs
 
 | Pair | SSM parameter (SecureString) | Authenticates | Who else holds it |
@@ -63,7 +89,7 @@ re-link, and lapses after 180 days without a refresh (DynamoDB TTL).
 runtime. Build:
 
 ```bash
-cd lambda-template && rm -f ../camstack-alexa-lambda.zip && zip -j ../camstack-alexa-lambda.zip *.js
+cd lambda-template && rm -f ../camstack-alexa-lambda.zip && zip -j ../camstack-alexa-lambda.zip *.js   # includes authorize-page.js and the generated page-style.js
 ```
 
 ## Deployment

package/lambda-template/authorize-page.js

@@ -0,0 +1,278 @@
+/**
+ * `GET /authorize` — the step of Alexa account linking where the operator says
+ * WHICH hub the skill talks to. Alexa sends the user's browser here (it is the
+ * skill's "authorization URI"); the hub is not known yet, so it has to be asked.
+ *
+ * Two parts, no script:
+ *
+ *   1. No `hubUrl` yet: the form. It is the CamStack page family — the hub's own
+ *      stylesheet and brand mark (`page-style.js`, generated from the hub's page
+ *      shell), en/it — not a hand-written page.
+ *   2. `hubUrl` given: the address is CHECKED before the browser is sent there.
+ *      Syntax and `https` first, then not a local address (this runs in the
+ *      cloud and cannot reach one), then one unauthenticated discovery request
+ *      (`GET /api/oauth2/integrations`) that proves it is a CamStack hub, that
+ *      this Lambda's TLS trust accepts its certificate, and that it serves
+ *      Alexa linking. Any failure re-renders the form with a plain sentence and a
+ *      reason CODE; success is a 302 to the hub's own consent page.
+ *
+ * The hub's address is always TYPED here: a cloud function cannot read the hub's
+ * `local-network` roles. The hub shows the value to enter (its public endpoint)
+ * in the Alexa export settings.
+ *
+ * Nothing sensitive passes through: the account-linking parameters are the
+ * ones Amazon sent, escaped into hidden fields and forwarded untouched.
+ */
+'use strict'
+
+const crypto = require('node:crypto')
+
+const { STYLE, LOGO_DARK, LOGO_LIGHT } = require('./page-style.js')
+
+const INTEGRATION_ID = 'export-alexa'
+
+/** Why a hub address was refused — the codes the page and the logs share. */
+const REASONS = [
+  'invalid_url',
+  'not_https',
+  'local_address',
+  'unreachable',
+  'tls_error',
+  'not_camstack',
+  'integration_missing',
+  'hub_starting',
+]
+
+const STRINGS = {
+  en: {
+    title: 'CamStack · Link your hub',
+    heading: 'Link CamStack to Alexa',
+    intro:
+      'Enter the public HTTPS address of your CamStack hub. Alexa will then ask that hub to authorise this Echo.',
+    label: 'Hub address',
+    placeholder: 'https://camstack.example.com',
+    hint: 'The address shown in CamStack under Connectivity → Alexa. It must be reachable from the internet (a tunnel, a reverse proxy or a public address).',
+    submit: 'Continue',
+    code: 'Code: ',
+    reasons: {
+      invalid_url:
+        'That is not a web address. Enter it in full, for example https://camstack.example.com.',
+      not_https: 'The address must start with https://. Alexa only talks to hubs over HTTPS.',
+      local_address:
+        'That address is only reachable inside your network. Alexa connects from the internet, so use the hub’s public address.',
+      unreachable:
+        'Could not reach that address from the internet. Check the address, and that the hub is running and published.',
+      tls_error:
+        'The hub answered, but its HTTPS certificate is not trusted. Use an address with a certificate from a public authority.',
+      not_camstack: 'That address answers, but it is not a CamStack hub (or the hub is too old).',
+      integration_missing:
+        'This hub does not offer Alexa linking. Install and enable the Alexa export on it, then try again.',
+      hub_starting: 'The hub is still starting up. Wait a moment and try again.',
+    },
+  },
+  it: {
+    title: 'CamStack · Collega il tuo hub',
+    heading: 'Collega CamStack ad Alexa',
+    intro:
+      'Inserisci l’indirizzo HTTPS pubblico del tuo hub CamStack. Alexa chiederà poi a quell’hub di autorizzare questo Echo.',
+    label: 'Indirizzo dell’hub',
+    placeholder: 'https://camstack.example.com',
+    hint: 'L’indirizzo mostrato in CamStack sotto Connettività → Alexa. Deve essere raggiungibile da internet (un tunnel, un reverse proxy o un indirizzo pubblico).',
+    submit: 'Continua',
+    code: 'Codice: ',
+    reasons: {
+      invalid_url:
+        'Non è un indirizzo web. Inseriscilo per intero, ad esempio https://camstack.example.com.',
+      not_https: 'L’indirizzo deve iniziare con https://. Alexa parla con gli hub solo via HTTPS.',
+      local_address:
+        'Quell’indirizzo è raggiungibile solo dentro la tua rete. Alexa si collega da internet: usa l’indirizzo pubblico dell’hub.',
+      unreachable:
+        'Impossibile raggiungere quell’indirizzo da internet. Controlla l’indirizzo e che l’hub sia acceso e pubblicato.',
+      tls_error:
+        'L’hub ha risposto, ma il suo certificato HTTPS non è attendibile. Usa un indirizzo con un certificato di un’autorità pubblica.',
+      not_camstack:
+        'Quell’indirizzo risponde, ma non è un hub CamStack (oppure l’hub è troppo vecchio).',
+      integration_missing:
+        'Questo hub non offre il collegamento ad Alexa. Installa e abilita l’export Alexa, poi riprova.',
+      hub_starting: 'L’hub si sta ancora avviando. Attendi un momento e riprova.',
+    },
+  },
+}
+
+function pickLang(params, headers) {
+  const asked = (params.get('lang') || '').slice(0, 2).toLowerCase()
+  if (asked === 'it' || asked === 'en') return asked
+  const accept = String(
+    (headers && (headers['accept-language'] || headers['Accept-Language'])) || '',
+  )
+  for (const part of accept.split(',')) {
+    const tag = part.trim().slice(0, 2).toLowerCase()
+    if (tag === 'it' || tag === 'en') return tag
+  }
+  return 'en'
+}
+
+/** Escapes text for an HTML text node or a double-quoted attribute (as the hub's page shell does). */
+function escapeHtml(text) {
+  return String(text).replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`)
+}
+
+function sha256Source(text) {
+  return `'sha256-${crypto.createHash('sha256').update(text).digest('base64')}'`
+}
+
+/** The CSP of the page: the one inline style pinned by hash, no script, no framing. */
+function pageCsp() {
+  return [
+    "default-src 'none'",
+    `style-src ${sha256Source(STYLE)}`,
+    "base-uri 'none'",
+    // The form submits to this Lambda, which answers with a redirect to the
+    // operator's hub: browsers apply form-action to that redirect too.
+    "form-action 'self' https:",
+    "frame-ancestors 'none'",
+  ].join('; ')
+}
+
+const IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/
+
+function isLocalHost(hostname) {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, '')
+  if (host === 'localhost' || host.endsWith('.localhost')) return true
+  if (host.endsWith('.local') || host.endsWith('.internal') || host.endsWith('.lan')) return true
+  if (host === '::1' || host === '::' || host.startsWith('fe80:')) return true
+  if (/^f[cd][0-9a-f]{2}:/.test(host)) return true
+  const m = IPV4.exec(host)
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])]
+    return (
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168) ||
+      (a === 100 && b >= 64 && b <= 127)
+    )
+  }
+  return false
+}
+
+/** `{ ok: true, base }` (origin + path, no trailing slash) or `{ ok: false, reason }`. */
+function parseHubAddress(raw) {
+  let url
+  try {
+    url = new URL(String(raw).trim())
+  } catch {
+    return { ok: false, reason: 'invalid_url' }
+  }
+  if (url.protocol === 'http:') return { ok: false, reason: 'not_https' }
+  if (url.protocol !== 'https:' || !url.hostname) return { ok: false, reason: 'invalid_url' }
+  if (isLocalHost(url.hostname)) return { ok: false, reason: 'local_address' }
+  return { ok: true, base: url.origin + url.pathname.replace(/\/+$/, '') }
+}
+
+const TLS_CODES = new Set([
+  'DEPTH_ZERO_SELF_SIGNED_CERT',
+  'SELF_SIGNED_CERT_IN_CHAIN',
+  'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+  'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+  'CERT_HAS_EXPIRED',
+  'CERT_NOT_YET_VALID',
+  'ERR_TLS_CERT_ALTNAME_INVALID',
+  'HOSTNAME_MISMATCH',
+])
+
+function classifyNetworkError(err) {
+  const code = (err && (err.code || (err.cause && err.cause.code))) || ''
+  if (TLS_CODES.has(code) || /certificate/i.test(String((err && err.message) || ''))) {
+    return 'tls_error'
+  }
+  return 'unreachable'
+}
+
+/** Prove `base` is a CamStack hub that serves Alexa linking, as THIS Lambda sees it. */
+async function probeHub(base, deps) {
+  let res
+  try {
+    res = await deps.fetch(`${base}/api/oauth2/integrations`, {
+      method: 'GET',
+      headers: { accept: 'application/json' },
+    })
+  } catch (err) {
+    return { ok: false, reason: classifyNetworkError(err) }
+  }
+  if (!res || !res.ok) return { ok: false, reason: 'not_camstack' }
+  let body
+  try {
+    body = JSON.parse(await res.text())
+  } catch {
+    return { ok: false, reason: 'not_camstack' }
+  }
+  if (!body || !Array.isArray(body.integrations)) return { ok: false, reason: 'not_camstack' }
+  const serves = body.integrations.some((i) => i && i.integrationId === INTEGRATION_ID)
+  if (serves) return { ok: true }
+  return { ok: false, reason: body.complete === false ? 'hub_starting' : 'integration_missing' }
+}
+
+function renderForm(lang, forwarded, hubUrl, reason) {
+  const t = STRINGS[lang]
+  const hidden = forwarded
+    .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`)
+    .join('')
+  const error = reason
+    ? `<p class="error" role="alert" data-reason="${escapeHtml(reason)}">${escapeHtml(t.reasons[reason])}</p><p class="hint">${escapeHtml(t.code)}<code>${escapeHtml(reason)}</code></p>`
+    : ''
+  const body =
+    `<p>${escapeHtml(t.intro)}</p>` +
+    `<form method="get" action="/authorize">${hidden}` +
+    `<div class="field"><label for="hubUrl">${escapeHtml(t.label)}</label>` +
+    `<input id="hubUrl" name="hubUrl" type="url" inputmode="url" autocomplete="url" spellcheck="false" autocapitalize="off" required placeholder="${escapeHtml(t.placeholder)}" value="${escapeHtml(hubUrl)}"></div>` +
+    `<p class="hint">${escapeHtml(t.hint)}</p>${error}` +
+    `<button class="btn" type="submit">${escapeHtml(t.submit)}</button></form>`
+  const html = `<!doctype html><html lang="${lang}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover"><meta name="color-scheme" content="light dark"><meta name="referrer" content="no-referrer"><title>${escapeHtml(t.title)}</title><style>${STYLE}</style></head><body><main><div class="brand">${LOGO_DARK}${LOGO_LIGHT}</div><div class="card"><h1>${escapeHtml(t.heading)}</h1>${body}</div></main></body></html>`
+  return {
+    statusCode: 200,
+    headers: {
+      'content-type': 'text/html; charset=utf-8',
+      'cache-control': 'no-store',
+      'content-security-policy': pageCsp(),
+      'referrer-policy': 'no-referrer',
+      'x-content-type-options': 'nosniff',
+    },
+    body: html,
+  }
+}
+
+async function handleAuthorizePage(event, deps) {
+  const params = new URLSearchParams(event.rawQueryString || '')
+  const lang = pickLang(params, event.headers)
+  const hubUrl = params.get('hubUrl') || ''
+  // What Amazon sent, forwarded to the hub's own authorize untouched.
+  const forwarded = [...params.entries()].filter(([k]) => k !== 'hubUrl' && k !== 'integration')
+
+  if (hubUrl === '') return renderForm(lang, forwarded, '', null)
+
+  const parsed = parseHubAddress(hubUrl)
+  if (!parsed.ok) return renderForm(lang, forwarded, hubUrl, parsed.reason)
+  const probe = await probeHub(parsed.base, deps)
+  if (!probe.ok) {
+    deps.log.warn('authorize hub check refused', {
+      reason: probe.reason,
+      host: new URL(parsed.base).host,
+    })
+    return renderForm(lang, forwarded, hubUrl, probe.reason)
+  }
+  const query = new URLSearchParams(forwarded)
+  query.set('integration', INTEGRATION_ID)
+  return {
+    statusCode: 302,
+    headers: {
+      location: `${parsed.base}/api/oauth2/authorize?${query.toString()}`,
+      'cache-control': 'no-store',
+    },
+    body: '',
+  }
+}
+
+module.exports = { handleAuthorizePage, parseHubAddress, REASONS, STRINGS }

package/lambda-template/index.js

@@ -55,6 +55,7 @@ const {
   isBrokerPath,
   shortId,
 } = require('./broker.js')
+const { handleAuthorizePage } = require('./authorize-page.js')
 const { traceDirective } = require('./debug-trace.js')
 const { timedFetch } = require('./http.js')
 const { createSecretSource } = require('./secrets.js')
@@ -150,86 +151,12 @@ function createHandler(overrides) {
 
 async function handleLambdaUrl(event, deps) {
   const path = event.rawPath || '/'
-  if (path === '/authorize') return handleAuthorizePage(event)
+  if (path === '/authorize') return handleAuthorizePage(event, deps)
   if (path === '/token') return handleTokenProxy(event, deps)
   if (isBrokerPath(path)) return handleBrokerRoute(event, deps)
   return { statusCode: 404, headers: { 'content-type': 'text/plain' }, body: 'Not found' }
 }
 
-/**
- * Render the "Enter your CamStack hub URL" form. Submitting the form
- * forwards the original Alexa query params (response_type, client_id,
- * redirect_uri, state, scope) — plus `integration=export-alexa` — to
- * `${hubUrl}/api/oauth2/authorize`. From there the browser stays on the hub's
- * origin until the OAuth code round-trips back to Alexa.
- */
-function handleAuthorizePage(event) {
-  const qs = event.rawQueryString || ''
-  const html = `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <title>CamStack · Link your hub</title>
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <style>
-    body { font-family: system-ui, -apple-system, sans-serif; max-width: 480px; margin: 4rem auto; padding: 0 1rem; color: #1f2937; background: #f9fafb; }
-    .card { background: #fff; border: 1px solid #e5e7eb; border-radius: 0.75rem; padding: 2rem; box-shadow: 0 1px 2px rgba(0,0,0,0.04); }
-    h1 { font-size: 1.25rem; margin: 0 0 0.5rem; }
-    p { font-size: 0.9rem; color: #4b5563; margin: 0 0 1.5rem; }
-    label { display: block; font-size: 0.85rem; font-weight: 500; margin-bottom: 0.5rem; }
-    input { width: 100%; padding: 0.6rem 0.75rem; font-size: 0.95rem; border: 1px solid #d1d5db; border-radius: 0.375rem; box-sizing: border-box; font-family: ui-monospace, Menlo, monospace; }
-    input:focus { outline: 2px solid #2563eb; outline-offset: 1px; border-color: #2563eb; }
-    button { margin-top: 1rem; width: 100%; padding: 0.7rem; font-size: 0.95rem; font-weight: 500; background: #2563eb; color: white; border: none; border-radius: 0.375rem; cursor: pointer; }
-    button:hover { background: #1d4ed8; }
-    .hint { font-size: 0.8rem; color: #6b7280; margin-top: 0.5rem; }
-    .err { font-size: 0.85rem; color: #b91c1c; margin: 0.75rem 0 0; }
-  </style>
-</head>
-<body>
-  <div class="card">
-    <h1>Link CamStack to Alexa</h1>
-    <p>Enter the public HTTPS URL of your CamStack hub. Alexa will then ask the hub to authorize this Echo.</p>
-    <form id="f" novalidate>
-      <label for="hubUrl">Hub URL</label>
-      <input id="hubUrl" name="hubUrl" type="url" placeholder="https://camstack.example.com" required autofocus>
-      <p class="hint">Must be reachable from the public internet (Cloudflare Tunnel, Tailscale Funnel, etc.).</p>
-      <p id="err" class="err" role="alert" hidden></p>
-      <button type="submit">Continue</button>
-    </form>
-  </div>
-  <script>
-    document.getElementById('f').addEventListener('submit', function (ev) {
-      ev.preventDefault()
-      var err = document.getElementById('err')
-      var hubUrl = document.getElementById('hubUrl').value.trim().replace(/\\/+$/, '')
-      var parsed = null
-      try { parsed = new URL(hubUrl) } catch (e) { parsed = null }
-      if (!parsed || parsed.protocol !== 'https:' || !parsed.hostname) {
-        err.textContent = 'Enter the full address of your hub, starting with https:// (for example https://camstack.example.com).'
-        err.hidden = false
-        return
-      }
-      err.hidden = true
-      hubUrl = parsed.origin + parsed.pathname.replace(/\\/+$/, '')
-      var qs = ${jsonForScript(qs)}
-      var url = hubUrl + '/api/oauth2/authorize' + '?' + (qs ? qs + '&' : '') + 'integration=export-alexa'
-      window.location.href = url
-    })
-  </script>
-</body>
-</html>`
-  return {
-    statusCode: 200,
-    headers: { 'content-type': 'text/html; charset=utf-8' },
-    body: html,
-  }
-}
-
-/** JSON for an inline <script>: `<` escaped so the value cannot close the tag. */
-function jsonForScript(value) {
-  return JSON.stringify(value).replace(/</g, '\\u003c')
-}
-
 /** Constant-time string equality that does not leak length via timing. */
 function safeEqual(a, b) {
   const ab = Buffer.from(String(a), 'utf8')

package/lambda-template/page-style.js

@@ -0,0 +1,14 @@
+// biome-ignore-all format: generated file
+// biome-ignore-all lint: generated file
+/**
+ * GENERATED by scripts/gen-alexa-lambda-page-style.ts from the hub's page shell
+ * (server/backend/src/auth/app-page-shell.ts). Do not edit: change the shell and
+ * regenerate. The Lambda ships plain files, so the stylesheet travels as a constant.
+ */
+'use strict'
+
+const STYLE = ":root{color-scheme:light dark;--spacing-xs:2px;--spacing-sm:4px;--spacing-md:8px;--spacing-lg:12px;--spacing-xl:16px;--spacing-2xl:24px;--spacing-3xl:32px;--radius-sm:4px;--radius-md:6px;--radius-lg:8px;--radius-xl:12px;--font-family:-apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif;--color-primary:#e67e22;--color-primary-foreground:#ffffff;--color-background:#fafaf9;--color-background-elevated:#ffffff;--color-surface:#f5f5f4;--color-surface-hover:#e7e5e4;--color-border:#d6d3d1;--color-border-subtle:#e7e5e4;--color-foreground:#1c1917;--color-foreground-muted:#57534e;--color-foreground-subtle:#78716c;--color-foreground-disabled:#a8a29e;--color-success:#16a34a;--color-warning:#d97706;--color-danger:#dc2626;--color-info:#2563eb;--color-success-fill:#15803d;--color-success-on:#ffffff;--color-warning-fill:#b45309;--color-warning-on:#ffffff;--color-danger-fill:#dc2626;--color-danger-on:#ffffff;--color-info-fill:#2563eb;--color-info-on:#ffffff;--color-primary-fill:#c2410c;--color-primary-on:#ffffff;--color-neutral-fill:#57534e;--color-neutral-on:#ffffff}@media (prefers-color-scheme:dark){:root{--color-primary:#f59e42;--color-primary-foreground:#0c0a09;--color-background:#0c0a09;--color-background-elevated:#1c1917;--color-surface:#1c1917;--color-surface-hover:#292524;--color-border:#292524;--color-border-subtle:#1c1917;--color-foreground:#fafaf9;--color-foreground-muted:#a8a29e;--color-foreground-subtle:#78716c;--color-foreground-disabled:#57534e;--color-success:#4ade80;--color-warning:#fbbf24;--color-danger:#f87171;--color-info:#60a5fa;--color-success-fill:#4ade80;--color-success-on:#0c0a09;--color-warning-fill:#fbbf24;--color-warning-on:#0c0a09;--color-danger-fill:#f87171;--color-danger-on:#0c0a09;--color-info-fill:#60a5fa;--color-info-on:#0c0a09;--color-primary-fill:#f59e42;--color-primary-on:#0c0a09;--color-neutral-fill:#44403c;--color-neutral-on:#fafaf9}}*,*::before,*::after{box-sizing:border-box}html{background:var(--color-background)}body{margin:0;min-height:100vh;min-height:100dvh;display:flex;align-items:center;justify-content:center;padding:max(var(--spacing-xl),env(safe-area-inset-top)) max(var(--spacing-xl),env(safe-area-inset-right)) max(var(--spacing-xl),env(safe-area-inset-bottom)) max(var(--spacing-xl),env(safe-area-inset-left));background:var(--color-background);color:var(--color-foreground);font-family:var(--font-family);font-size:14px;line-height:20px;-webkit-text-size-adjust:100%}main{width:100%;max-width:24rem}.brand{display:flex;justify-content:center;margin-bottom:var(--spacing-3xl)}.logo{height:3rem;width:auto}.logo-dark{display:none}@media (prefers-color-scheme:dark){.logo-dark{display:block}.logo-light{display:none}}.card{display:flex;flex-direction:column;gap:var(--spacing-xl);padding:var(--spacing-2xl);border:1px solid var(--color-border);border-radius:var(--radius-xl);background:var(--color-surface);box-shadow:0 20px 25px -5px rgb(0 0 0/.1),0 8px 10px -6px rgb(0 0 0/.1)}.card h1{margin:0;font-size:16px;line-height:22px;font-weight:600;text-align:center;color:var(--color-foreground)}.card p{margin:0;color:var(--color-foreground-muted)}.card strong{color:var(--color-foreground);font-weight:600;overflow-wrap:anywhere}.card .hint{font-size:12px;line-height:16px;color:var(--color-foreground-subtle)}.btn{display:flex;align-items:center;justify-content:center;width:100%;min-height:44px;padding:10px 16px;border:1px solid transparent;border-radius:var(--radius-lg);background:var(--color-primary);color:var(--color-primary-foreground);font:inherit;font-weight:600;text-decoration:none;cursor:pointer;box-shadow:0 4px 6px -1px color-mix(in srgb,var(--color-primary) 20%,transparent)}.btn:hover{background:color-mix(in srgb,var(--color-primary) 90%,transparent)}.btn:disabled{opacity:.5;cursor:not-allowed;box-shadow:none}.btn.secondary{background:var(--color-background);color:var(--color-foreground);border-color:var(--color-border);box-shadow:none}.btn.secondary:hover{background:var(--color-surface-hover)}.link{display:block;text-align:center;padding:var(--spacing-md);font-size:12px;line-height:16px;color:var(--color-foreground-subtle);text-decoration:none}.link:hover{color:var(--color-foreground)}.error{padding:8px 12px;border:1px solid color-mix(in srgb,var(--color-danger) 20%,transparent);border-radius:var(--radius-md);background:color-mix(in srgb,var(--color-danger) 10%,transparent);color:var(--color-danger);font-size:12px;line-height:16px}.card p.error{color:var(--color-danger)}.error:empty{display:none}.btn:focus-visible,.link:focus-visible{outline:2px solid var(--color-primary);outline-offset:2px}code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:12px;overflow-wrap:anywhere}.field{display:flex;flex-direction:column;gap:var(--spacing-md)}.field label{font-size:12px;line-height:16px;font-weight:500;color:var(--color-foreground-muted)}input[type=url],input[type=text]{width:100%;min-height:44px;padding:10px 12px;border:1px solid var(--color-border);border-radius:var(--radius-lg);background:var(--color-background);color:var(--color-foreground);font:inherit}input[type=url]:focus-visible,input[type=text]:focus-visible{outline:2px solid var(--color-primary);outline-offset:2px}form{display:contents}.actions{display:flex;flex-direction:column;gap:var(--spacing-md)}"
+const LOGO_DARK = "<svg class=\"logo logo-dark\" role=\"img\" aria-label=\"CamStack\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 200 48\" fill=\"none\"><g transform=\"translate(4, 2) scale(0.68)\"><rect x=\"8\" y=\"28\" width=\"48\" height=\"28\" rx=\"6\" fill=\"#292524\"/><rect x=\"12\" y=\"16\" width=\"40\" height=\"28\" rx=\"6\" fill=\"#44403c\"/><rect x=\"16\" y=\"4\" width=\"32\" height=\"28\" rx=\"6\" fill=\"#f59e42\"/><circle cx=\"32\" cy=\"18\" r=\"8\" fill=\"#0c0a09\" opacity=\"0.3\"/><circle cx=\"32\" cy=\"18\" r=\"5\" fill=\"#0c0a09\" opacity=\"0.2\"/><circle cx=\"32\" cy=\"18\" r=\"2.5\" fill=\"#fafaf9\" opacity=\"0.8\"/></g><text x=\"52\" y=\"31\" font-family=\"system-ui, -apple-system, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"-0.5\" fill=\"#fafaf9\">Cam<tspan fill=\"#f59e42\">Stack</tspan></text></svg>"
+const LOGO_LIGHT = "<svg class=\"logo logo-light\" role=\"img\" aria-label=\"CamStack\" xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 200 48\" fill=\"none\"><g transform=\"translate(4, 2) scale(0.68)\"><rect x=\"8\" y=\"28\" width=\"48\" height=\"28\" rx=\"6\" fill=\"#d6d3d1\"/><rect x=\"12\" y=\"16\" width=\"40\" height=\"28\" rx=\"6\" fill=\"#a8a29e\"/><rect x=\"16\" y=\"4\" width=\"32\" height=\"28\" rx=\"6\" fill=\"#e67e22\"/><circle cx=\"32\" cy=\"18\" r=\"8\" fill=\"#fafaf9\" opacity=\"0.3\"/><circle cx=\"32\" cy=\"18\" r=\"5\" fill=\"#fafaf9\" opacity=\"0.2\"/><circle cx=\"32\" cy=\"18\" r=\"2.5\" fill=\"#1c1917\" opacity=\"0.7\"/></g><text x=\"52\" y=\"31\" font-family=\"system-ui, -apple-system, sans-serif\" font-size=\"26\" font-weight=\"700\" letter-spacing=\"-0.5\" fill=\"#1c1917\">Cam<tspan fill=\"#e67e22\">Stack</tspan></text></svg>"
+
+module.exports = { STYLE, LOGO_DARK, LOGO_LIGHT }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-export-alexa",
-  "version": "1.2.146",
+  "version": "1.2.148",
   "description": "Alexa Smart Home Skill export — hub-side OAuth provider + directive handler. The companion AWS Lambda forwards Alexa directives to this addon's /addon/export-alexa/directive endpoint.",
   "keywords": [
     "camstack",