@camstack/addon-import-alexa 0.2.148 → 0.2.149

package/dist/addon.js

@@ -35,9 +35,17 @@ var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["modu
 //#endregion
 let node_crypto = require("node:crypto");
 let node_os = require("node:os");
+node_os = __toESM(node_os, 1);
 let node_fs = require("node:fs");
+node_fs = __toESM(node_fs, 1);
 let node_path = require("node:path");
+let node_path$1 = __toESM(node_path, 1);
 node_path = __toESM(node_path);
+let node_url = require("node:url");
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = __toESM(node_fs_promises, 1);
+let node_child_process = require("node:child_process");
+require("node:zlib");
 //#region ../types/dist/event-category-CT-hz5Rb.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
@@ -5614,7 +5622,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bykKrTgu.mjs
+//#region ../types/dist/sleep-0sD_LHLI.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8852,6 +8860,28 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
+/**
+* Identity — preserves literal types for downstream inference.
+*
+* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
+* TypeScript does not widen each entry's literal `kind`/`auth` fields to
+* the broader unions declared on `CustomActionSpec`'s default generics.
+* Shape validity is enforced separately by the `customAction(...)` helper
+* whose return type is already a `CustomActionSpec<...>`.
+*/
+function defineCustomActions(spec) {
+	return spec;
+}
+function customAction(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		scope: options?.scope ?? { kind: "system" },
+		...options?.caller ? { caller: "required" } : {}
+	};
+}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -9017,6 +9047,7 @@ var CAP_NAMES = Object.freeze([
 	"login-method",
 	"media-player",
 	"mesh-network",
+	"meter",
 	"metrics-provider",
 	"model-convert",
 	"model-distributor",
@@ -10074,6 +10105,10 @@ Object.freeze({
 			]
 		}
 	],
+	"meter": [{
+		"path": "value",
+		"valueType": "number"
+	}],
 	"motion": [
 		{
 			"path": "detected",
@@ -10817,7 +10852,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BXKzRBwg.mjs
+//#region ../types/dist/err-msg-DIorGYeC.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -10911,8 +10946,14 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["PetFeeder"] = "pet-feeder";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations. */
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
 	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -11170,7 +11211,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-OhpuespA.mjs
+//#region ../types/dist/composition-CpETZ4HL.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11926,6 +11967,97 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
+* One power reading becomes a washer, dryer or dishwasher (D944 helper).
+*
+* Standby of the control board is under 5 W; a motor or a heater is far
+* above that, so 5 W is the line. A door lock or a short pump spike is not
+* a cycle, so running starts only after 30 s above the line.
+*
+* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
+* bursts) lasts several minutes. Ending the cycle on the first dip would
+* report "finished" in the middle of the program, so the stop dwell is
+* 10 minutes on every type. The number is stored per type so one machine
+* can move later without moving the others.
+*/
+var APPLIANCE_TEMPLATE_ID = "appliance";
+var APPLIANCE_KINDS = [
+	"washer",
+	"dryer",
+	"dishwasher"
+];
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+/**
+* Statistics and integrals over a history read (D944).
+*
+* Pure: the same points always give the same answer, so a restart recomputes
+* rather than trusting a buffer. A gauge mean is time-weighted (value × ms),
+* never the mean of the samples. A hole with no held value is not integrated
+* as zero. A truncated read is not published.
+*/
+var STATISTIC_STATS = [
+	"min",
+	"max",
+	"mean",
+	"sum",
+	"count",
+	"change"
+];
+/**
+* The range a statistics or integral helper asks history for (D944).
+*
+* Calendar edges are the hub's timezone, never UTC midnight: a day is 23, 24
+* or 25 hours across a DST change. A tier is eligible only when its retention
+* is strictly longer than the longest that range can be. Forever qualifies.
+* Equal to a tier's retention is a refusal, not a short answer.
+*/
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+var ROLLING_SPANS = [
+	"1h",
+	"24h",
+	"2d",
+	"7d",
+	"30d",
+	"custom"
+];
+var CALENDAR_PERIODS = [
+	"today",
+	"yesterday",
+	"this-week",
+	"this-month"
+];
+var RESET_PERIODS = [
+	"never",
+	"daily",
+	"weekly",
+	"monthly"
+];
+5 * MINUTE_MS;
+24 * HOUR_MS, 2 * DAY_MS, 7 * DAY_MS, 30 * DAY_MS;
+7 * DAY_MS, 30 * DAY_MS, 365 * DAY_MS;
+var StatisticWindowSchema = discriminatedUnion("kind", [object({
+	kind: literal("rolling"),
+	span: _enum(ROLLING_SPANS),
+	customMinutes: number().int().min(5).optional()
+}).check((payload) => {
+	if (payload.value.span === "custom" && payload.value.customMinutes === void 0) payload.issues.push({
+		code: "custom",
+		message: "a custom range needs a duration in minutes",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+	if (payload.value.span !== "custom" && payload.value.customMinutes !== void 0) payload.issues.push({
+		code: "custom",
+		message: "only a custom range carries a duration",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+}), object({
+	kind: literal("calendar"),
+	period: _enum(CALENDAR_PERIODS)
+})]);
+/**
 * A composition source identity: `(addonId, stableId)`, never a numeric device
 * id. Split out so helper schemas can name it without a cycle through
 * `composition.ts` (D659).
@@ -11981,14 +12113,37 @@ var HelperMemberSchema = object({
 	cap: string().min(1),
 	fieldPath: string().min(1)
 });
-var HelperSpecSchema = discriminatedUnion("kind", [object({
-	kind: literal("group"),
-	templateId: GroupTemplateIdSchema,
-	aggregate: AggregateReducerSchema,
-	members: array(HelperMemberSchema).min(1).max(64),
-	/** Actuator groups only. Readings leave this unset. */
-	active: ActiveCriterionSchema.optional()
-})]);
+var HelperSpecSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("group"),
+		templateId: GroupTemplateIdSchema,
+		aggregate: AggregateReducerSchema,
+		members: array(HelperMemberSchema).min(1).max(64),
+		/** Actuator groups only. Readings leave this unset. */
+		active: ActiveCriterionSchema.optional()
+	}),
+	object({
+		kind: literal("appliance"),
+		templateId: literal(APPLIANCE_TEMPLATE_ID),
+		appliance: _enum(APPLIANCE_KINDS),
+		thresholdWatts: number().positive(),
+		startDwellMs: number().int().nonnegative(),
+		stopDwellMs: number().int().nonnegative(),
+		member: HelperMemberSchema
+	}),
+	object({
+		kind: literal("statistic"),
+		stat: _enum(STATISTIC_STATS),
+		window: StatisticWindowSchema,
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("integral"),
+		reset: _enum(RESET_PERIODS),
+		output: _enum(["energy", "meter"]),
+		source: HelperMemberSchema
+	})
+]);
 /** A composed device's stableId is this prefix plus the block id. */
 var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
 /** Longest snippet a `code` source may carry (slice 4). */
@@ -12062,6 +12217,26 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"omit",
 			"offline"
 		])
+	}),
+	object({
+		kind: literal("series"),
+		read: CompositionFieldReadSchema,
+		/** `value` is the statistic or the integral. The others are the gap counts. */
+		publish: _enum([
+			"value",
+			"included",
+			"excluded",
+			"total"
+		]),
+		/**
+		* What an unanswered `value` does. Counts ignore this. `offline` leaves the
+		* device unseeded until history answers, so a restart cannot publish 0.
+		*/
+		empty: _enum([
+			"null",
+			"omit",
+			"offline"
+		])
 	})
 ]);
 var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
@@ -15822,7 +15997,24 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
+};
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -18511,7 +18703,8 @@ var CompositionProblemSchema = object({
 		"native-capability-replace",
 		"mixed-quantity",
 		"helper-mismatch",
-		"member-constraint"
+		"member-constraint",
+		"retention"
 	]),
 	path: string(),
 	message: string()
@@ -18751,7 +18944,7 @@ Object.freeze({
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW = {
+var NOW$1 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -18797,7 +18990,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "humidity",
@@ -18808,7 +19001,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "pressure",
@@ -18819,7 +19012,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "illuminance",
@@ -18830,7 +19023,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "power",
@@ -18841,7 +19034,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "energy",
@@ -18852,7 +19045,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "battery",
@@ -18887,7 +19080,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	binary({
 		id: "motion",
@@ -19016,6 +19209,7 @@ function actuator(input) {
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
+DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * What a composition may BUILD on a device type (G2, D676): the caps a new
@@ -44581,57 +44775,79 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: string().optional()
+		}), array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(object({
+			kind: string(),
+			config: record(string(), unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: method(object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: method(object({ targetId: string() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 new Set([
 	{
 		id: "person",
@@ -61881,6 +62097,44 @@ var lockControlCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* A monotonic total between resets (D944). Energy uses `power-meter.kwhTotal`
+* so dashboards keep one series; every other instantaneous reading lands here.
+* `value` is the time integral in the source quantity's accumulated base
+* (base-unit seconds, or kWh on the power meter). `null` is a gap, never zero.
+*/
+var MeterStatusSchema = object({
+	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
+	lastFetchedAt: number()
+});
+var meterCapability = {
+	name: "meter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: MeterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: MeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the total is a cache of the
+	* history integral. A restart shows it only until the history pass
+	* recomputes the open period; it is not an in-memory buffer.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	history: { fields: { value: {
+		kind: "counter",
+		deadband: .001,
+		minIntervalMs: 6e4
+	} } },
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
 * Apple TV, Spotify, Roku, generic OTT receivers, …) on
 * `DeviceType.MediaPlayer`. Disjoint from the camera streaming
@@ -64407,7 +64661,12 @@ var powerMeterCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
+	deviceTypes: [
+		DeviceType.Sensor,
+		DeviceType.Washer,
+		DeviceType.Dryer,
+		DeviceType.Dishwasher
+	],
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -65145,6 +65404,8 @@ var runningCustomize = {
 			stateField: "running"
 		},
 		deviceTypes: [
+			DeviceType.Washer,
+			DeviceType.Dryer,
 			DeviceType.Dishwasher,
 			DeviceType.Vacuum,
 			DeviceType.LawnMower,
@@ -69848,7 +70109,7 @@ method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" })
 	auth: "admin"
 });
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Camera, DeviceType.Camera, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -70188,6 +70449,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	lawnMowerControl: lawnMowerControlCapability,
 	lockControl: lockControlCapability,
 	mediaPlayer: mediaPlayerCapability,
+	meter: meterCapability,
 	motion: motionCapability,
 	motionTrigger: motionTriggerCapability,
 	motionZones: motionZonesCapability,
@@ -71447,7 +71709,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -75636,6 +75898,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"meter.getStatus": {
+		capName: "meter",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"metricsProvider.collectSnapshot": {
 		capName: "metrics-provider",
 		capScope: "system",
@@ -83734,7 +84003,39 @@ var APPLIANCE_CAP_VOCABULARY = {
 				phrase: t("When {device} finishes", "Quando {device} finisce"),
 				icon: "square"
 			}
-		}
+		},
+		overrides: { byType: {
+			[DeviceType.Washer]: {
+				state: { running: {
+					whenTrue: t("When the washing machine starts", "Quando la lavatrice inizia"),
+					whenFalse: t("When the washing machine has finished", "Quando la lavatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the washing machine starts", "Quando la lavatrice inizia") },
+					onFinished: { phrase: t("When the washing machine has finished", "Quando la lavatrice ha finito") }
+				}
+			},
+			[DeviceType.Dryer]: {
+				state: { running: {
+					whenTrue: t("When the dryer starts", "Quando l'asciugatrice inizia"),
+					whenFalse: t("When the dryer has finished", "Quando l'asciugatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dryer starts", "Quando l'asciugatrice inizia") },
+					onFinished: { phrase: t("When the dryer has finished", "Quando l'asciugatrice ha finito") }
+				}
+			},
+			[DeviceType.Dishwasher]: {
+				state: { running: {
+					whenTrue: t("When the dishwasher starts", "Quando la lavastoviglie inizia"),
+					whenFalse: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dishwasher starts", "Quando la lavastoviglie inizia") },
+					onFinished: { phrase: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito") }
+				}
+			}
+		} }
 	},
 	update: {
 		scope: "device",
@@ -84562,6 +84863,17 @@ var SENSOR_CAP_VOCABULARY = {
 		}],
 		events: { onMotionChanged: { notOperatorFacing: "the `detected` state trigger phrases both edges, from the mirror that survives a dropped event (D49)" } }
 	},
+	meter: {
+		scope: "device",
+		noun: t("Meter", "Contatore"),
+		state: [{
+			kind: "numeric",
+			field: "value",
+			quantity: t("the total", "il totale"),
+			label: t("Total", "Totale"),
+			icon: "gauge"
+		}]
+	},
 	"numeric-sensor": {
 		scope: "device",
 		noun: t("Sensor", "Sensore"),
@@ -85034,8 +85346,47 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+var HA_AS = "a power sensor (device_class power). Home Assistant has no laundry domain. running-state stays unexported until a null reading can be published as unavailable.";
+var HOMEKIT_REASON = "HomeKit has no laundry-appliance service. The export tab would pair an accessory with nothing on it: running-state is withheld until a null reading can be unavailable, and power is not a HomeKit service this export honours.";
+var ALEXA_REASON = "Alexa has no laundry category in this export, and neither power nor running has an Alexa interface.";
+var GOOGLE_REASON = "Google WASHER, DRYER and DISHWASHER require RunCycle. A power threshold is not that trait, and this export does not publish RunCycle.";
+var MATTER_REASON = "No Matter export is built. The closest device types are Laundry Washer (0x0073) and Laundry Dryer (0x0074); a power threshold is not the Laundry Washer Mode cluster.";
+function withheld(reason) {
+	return {
+		[DeviceType.Washer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dryer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dishwasher]: {
+			exported: false,
+			reason
+		}
+	};
+}
+function offered(received) {
+	return {
+		[DeviceType.Washer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dryer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dishwasher]: {
+			exported: true,
+			as: received
+		}
+	};
+}
+offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -86212,6 +86563,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"meter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motion.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -87819,7 +88175,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-DeviceType.Camera;
 /**
 * A saved Customize assignment (D936). The schema is the type: callers use
 * `z.infer`, they do not restate the shape.
@@ -87965,6 +88320,213 @@ var NC_AUDIO_DEFAULTS = {
 	samplingSeconds: 10
 };
 new Set(["devices", "classes"]);
+/** Strip a small, safe subset of Markdown down to plain text. */
+function markdownToText(md) {
+	return md.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/(\*\*|__)(.*?)\1/g, "$2").replace(/(\*|_)(.*?)\1/g, "$2").replace(/`([^`]*)`/g, "$1").replace(/^\s{0,3}#{1,6}\s*/gm, "").replace(/^\s{0,3}>\s?/gm, "").replace(/^\s{0,3}[-*+]\s+/gm, "").replace(/^\s{0,3}\d+\.\s+/gm, "").trim();
+}
+var HTML_ENTITIES = [
+	[/&nbsp;/g, " "],
+	[/&amp;/g, "&"],
+	[/&lt;/g, "<"],
+	[/&gt;/g, ">"],
+	[/&quot;/g, "\""],
+	[/&#39;/g, "'"]
+];
+/** Strip HTML tags, decode a few entities, map block/br elements to newlines. */
+function htmlToText(html) {
+	let out = html.replace(/<\s*br\s*\/?\s*>/gi, "\n").replace(/<\s*\/\s*(p|div|li|h[1-6])\s*>/gi, "\n").replace(/<[^>]+>/g, "");
+	for (const [re, rep] of HTML_ENTITIES) out = out.replace(re, rep);
+	return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+var HTML_ESCAPES = [
+	[/&/g, "&amp;"],
+	[/</g, "&lt;"],
+	[/>/g, "&gt;"],
+	[/"/g, "&quot;"],
+	[/'/g, "&#39;"]
+];
+function escapeHtml(text) {
+	let out = text;
+	for (const [re, rep] of HTML_ESCAPES) out = out.replace(re, rep);
+	return out;
+}
+/** Plain text → HTML-lite (escape + newlines to <br>). */
+function textToHtml(text) {
+	return escapeHtml(text).replace(/\n/g, "<br>");
+}
+/** Markdown → HTML-lite (bold/italic/code/links; used e.g. for Pushover). */
+function markdownToHtmlLite(md) {
+	return escapeHtml(md).replace(/(\*\*|__)(.*?)\1/g, "<b>$2</b>").replace(/(\*|_)(.*?)\1/g, "<i>$2</i>").replace(/`([^`]*)`/g, "<code>$1</code>").replace(/\[([^\]]*)\]\(([^)]*)\)/g, "<a href=\"$2\">$1</a>").replace(/\n/g, "<br>");
+}
+/**
+* Preference order when the source format is NOT supported — first supported
+* entry wins. Encodes the Apprise-style "degrade DOWN, but preserve rendering
+* where a richer target exists" policy:
+*   - markdown → html (html-lite) before text (strip)
+*   - html     → text before markdown
+*   - text     → markdown before html (text is valid markdown)
+*/
+var DEGRADE_ORDER = {
+	text: [
+		"text",
+		"markdown",
+		"html"
+	],
+	markdown: [
+		"markdown",
+		"html",
+		"text"
+	],
+	html: [
+		"html",
+		"text",
+		"markdown"
+	]
+};
+/**
+* Pick the best target format the kind supports for a given source format.
+*
+* TOLERANT of a source outside the union. `NotificationSchema.format` carries
+* `.default('text')`, but that default only runs where the schema is PARSED —
+* the tRPC router. A cap call arriving from another addon (`ctx.api`) skips
+* that parse, so `format` reaches here `undefined`, and the bare
+* `DEGRADE_ORDER[source]` threw `is not iterable`. That broke the one promise
+* the degrade path makes ("never throws — degradation is reported, never
+* surfaced as an error") and dead-lettered every Notification-Center delivery
+* for a day (2026-07-30). An unknown source degrades like `text`.
+*/
+function resolveFormat(source, supported) {
+	for (const candidate of DEGRADE_ORDER[source] ?? DEGRADE_ORDER.text) if (supported.includes(candidate)) return candidate;
+	return supported[0] ?? "text";
+}
+/** Transcode a body between formats. */
+function transcodeBody(body, from, to) {
+	if (from === to) return body;
+	if (to === "text") {
+		if (from === "markdown") return markdownToText(body);
+		if (from === "html") return htmlToText(body);
+	}
+	if (to === "html") {
+		if (from === "text") return textToHtml(body);
+		if (from === "markdown") return markdownToHtmlLite(body);
+	}
+	if (to === "markdown") {
+		if (from === "text") return body;
+		if (from === "html") return htmlToText(body);
+	}
+	return body;
+}
+function toResolvedLevel(level) {
+	return {
+		id: level.id,
+		ordinal: level.ordinal,
+		...level.flags ? { flags: level.flags } : {},
+		...level.requires ? { requires: level.requires } : {}
+	};
+}
+function resolveLevel(levels, n) {
+	if (levels.length === 0) return null;
+	if (n.level !== void 0) {
+		const explicit = levels.find((l) => l.id === n.level);
+		if (explicit) return toResolvedLevel(explicit);
+	}
+	const withOrdinal = levels.filter((l) => l.ordinal !== null);
+	if (withOrdinal.length === 0) return toResolvedLevel(levels[0]);
+	const priority = n.priority;
+	return toResolvedLevel([...withOrdinal].sort((a, b) => {
+		const da = Math.abs((a.ordinal ?? 0) - priority);
+		const db = Math.abs((b.ordinal ?? 0) - priority);
+		if (da !== db) return da - db;
+		return (b.ordinal ?? 0) - (a.ordinal ?? 0);
+	})[0]);
+}
+function splitBody(body, maxLen) {
+	if (!Number.isFinite(maxLen) || maxLen <= 0 || body.length <= maxLen) return [body];
+	const parts = [];
+	for (let i = 0; i < body.length; i += maxLen) parts.push(body.slice(i, i + maxLen));
+	return parts;
+}
+/**
+* Prepare a canonical notification for one kind. Never throws — degradation is
+* always reported in `renderedAs`, never surfaced as an error.
+*/
+function prepareNotification(caps, n) {
+	const dropped = [];
+	const sourceFormat = n.format;
+	const format = resolveFormat(sourceFormat, caps.format);
+	if (format !== sourceFormat) dropped.push("format");
+	const transcoded = transcodeBody(n.body, sourceFormat, format);
+	const level = resolveLevel(caps.levels, n);
+	const inAttachments = n.attachments ?? [];
+	const attachments = [];
+	for (const att of inAttachments) {
+		if (!caps.attachments.mediaTypes.includes(att.mediaType)) {
+			dropped.push(`attachment:${att.mediaType}`);
+			continue;
+		}
+		if (caps.attachments.mode === "url" && att.url === void 0) {
+			dropped.push("attachment:noUrl");
+			continue;
+		}
+		if (att.bytes !== void 0 && caps.attachments.maxBytes !== void 0 && att.bytes.length > caps.attachments.maxBytes) {
+			dropped.push("attachment:maxBytes");
+			continue;
+		}
+		if (attachments.length >= caps.attachments.max) {
+			dropped.push("attachment:max");
+			continue;
+		}
+		const needsFetch = caps.attachments.mode === "bytes" && att.bytes === void 0 && att.url !== void 0;
+		attachments.push({
+			mediaType: att.mediaType,
+			...att.url !== void 0 ? { url: att.url } : {},
+			...att.bytes !== void 0 ? { bytes: att.bytes } : {},
+			...att.mime !== void 0 ? { mime: att.mime } : {},
+			...att.name !== void 0 ? { name: att.name } : {},
+			needsFetch
+		});
+	}
+	const inActions = n.actions ?? [];
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
+	let clickUrl = null;
+	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
+	else dropped.push("clickUrl");
+	let sound = null;
+	if (n.sound !== void 0) if (caps.sound) sound = n.sound;
+	else dropped.push("sound");
+	let ttl = null;
+	if (n.ttl !== void 0) if (caps.ttl) ttl = n.ttl;
+	else dropped.push("ttl");
+	const tag = n.tag ?? null;
+	const bodyParts = splitBody(transcoded, caps.bodyMaxLen);
+	const truncated = bodyParts.length > 1;
+	const renderedAs = {
+		level: level?.id ?? "",
+		format,
+		attachmentsSent: attachments.length,
+		actionsSent: actions.length,
+		truncated,
+		dropped
+	};
+	return {
+		body: bodyParts[0] ?? "",
+		...n.title !== void 0 ? { title: n.title } : {},
+		format,
+		level,
+		attachments,
+		actions,
+		clickUrl,
+		sound,
+		ttl,
+		tag,
+		bodyParts,
+		renderedAs
+	};
+}
 new Set(NC_LEGACY_SYSTEM_EVENT_KINDS);
 /**
 * Every filter, for the callers that must cover all of them (guards, tests).
@@ -89186,12 +89748,55 @@ var alexaProxyLoginSchema = object({
 	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = auto-detect)"),
 	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
 });
+/** Amazon account used to speak on Echo devices. The session blob is the cookie jar. */
+var alexaSpeakSettingsSchema = object({
+	email: string().default(""),
+	password: string().default("").describe("Amazon password").meta({ secret: true }),
+	region: _enum([
+		"NA",
+		"EU",
+		"FE"
+	]).default("EU"),
+	session: string().default("").describe("Alexa session blob").meta({ secret: true }),
+	targets: array(object({
+		id: string(),
+		name: string(),
+		enabled: boolean(),
+		echoId: string(),
+		mode: _enum(["speak", "announce"]),
+		volume: number(),
+		respectDnd: boolean()
+	})).default([])
+});
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
+function readSpeakSettings(config) {
+	const raw = isRecord$2(config.speak) ? config.speak : {};
+	const region = raw["region"];
+	const targets = raw["targets"];
+	return alexaSpeakSettingsSchema.parse({
+		email: typeof raw["email"] === "string" ? raw["email"] : "",
+		password: typeof raw["password"] === "string" ? raw["password"] : "",
+		session: typeof raw["session"] === "string" ? raw["session"] : "",
+		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
+		...Array.isArray(targets) ? { targets } : {}
+	});
+}
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({
 		proxyHost: "",
 		proxyPort: 3456
+	}),
+	speak: alexaSpeakSettingsSchema.default({
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	})
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
@@ -112965,17 +113570,17 @@ var require_view = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @private
 	*/
 	var debug = require_src$2()("express:view");
-	var path$7 = require("path");
+	var path$8 = require("path");
 	var fs$4 = require("fs");
 	/**
 	* Module variables.
 	* @private
 	*/
-	var dirname = path$7.dirname;
-	var basename = path$7.basename;
-	var extname = path$7.extname;
-	var join = path$7.join;
-	var resolve = path$7.resolve;
+	var dirname = path$8.dirname;
+	var basename = path$8.basename;
+	var extname = path$8.extname;
+	var join = path$8.join;
+	var resolve = path$8.resolve;
 	/**
 	* Module exports.
 	* @public
@@ -113136,7 +113741,7 @@ var require_content_disposition = /* @__PURE__ */ __commonJSMin(((exports, modul
 	* Module dependencies.
 	* @private
 	*/
-	var basename = require("path").basename;
+	var basename$1 = require("path").basename;
 	var Buffer = require_safe_buffer().Buffer;
 	/**
 	* RegExp to match non attr-char, *after* encodeURIComponent (i.e. not including "%")
@@ -113259,9 +113864,9 @@ var require_content_disposition = /* @__PURE__ */ __commonJSMin(((exports, modul
 		if (fallback === void 0) fallback = true;
 		if (typeof fallback !== "string" && typeof fallback !== "boolean") throw new TypeError("fallback must be a string or boolean");
 		if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) throw new TypeError("fallback must be ISO-8859-1 string");
-		var name = basename(filename);
+		var name = basename$1(filename);
 		var isQuotedString = TEXT_REGEXP.test(name);
-		var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename(fallback);
+		var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename$1(fallback);
 		var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
 		if (hasFallback || !isQuotedString || HEX_ESCAPE_REGEXP.test(name)) params["filename*"] = name;
 		if (isQuotedString || hasFallback) params.filename = hasFallback ? fallbackName : name;
@@ -115558,7 +116163,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var ms = require_ms();
 	var onFinished = require_on_finished();
 	var parseRange = require_range_parser();
-	var path$6 = require("path");
+	var path$7 = require("path");
 	var statuses = require_statuses();
 	var Stream = require("stream");
 	var util$4 = require("util");
@@ -115566,11 +116171,11 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Path function references.
 	* @private
 	*/
-	var extname = path$6.extname;
-	var join = path$6.join;
-	var normalize = path$6.normalize;
-	var resolve = path$6.resolve;
-	var sep = path$6.sep;
+	var extname = path$7.extname;
+	var join = path$7.join;
+	var normalize = path$7.normalize;
+	var resolve = path$7.resolve;
+	var sep = path$7.sep;
 	/**
 	* Regular expression for identifying a bytes Range header.
 	* @private
@@ -117512,7 +118117,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var deprecate = require_depd()("express");
 	var flatten = require_array_flatten();
 	var merge = require_utils_merge();
-	var resolve$1 = require("path").resolve;
+	var resolve$2 = require("path").resolve;
 	var setPrototypeOf = require_setprototypeof();
 	/**
 	* Module variables.
@@ -117575,7 +118180,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		this.mountpath = "/";
 		this.locals.settings = this.settings;
 		this.set("view", View);
-		this.set("views", resolve$1("views"));
+		this.set("views", resolve$2("views"));
 		this.set("jsonp callback name", "callback");
 		if (env === "production") this.enable("view cache");
 		Object.defineProperty(this, "router", { get: function() {
@@ -119593,7 +120198,7 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var http$3 = require("http");
 	var isAbsolute = require_utils$2().isAbsolute;
 	var onFinished = require_on_finished();
-	var path$5 = require("path");
+	var path$6 = require("path");
 	var statuses = require_statuses();
 	var merge = require_utils_merge();
 	var sign = require_cookie_signature().sign;
@@ -119602,9 +120207,9 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var setCharset = require_utils$2().setCharset;
 	var cookie = require_cookie();
 	var send = require_send();
-	var extname = path$5.extname;
+	var extname = path$6.extname;
 	var mime = send.mime;
-	var resolve = path$5.resolve;
+	var resolve = path$6.resolve;
 	var vary = require_vary();
 	/**
 	* Response prototype.
@@ -120436,7 +121041,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var encodeUrl = require_encodeurl();
 	var escapeHtml = require_escape_html();
 	var parseUrl = require_parseurl();
-	var resolve = require("path").resolve;
+	var resolve$1 = require("path").resolve;
 	var send = require_send();
 	var url$6 = require("url");
 	/**
@@ -120460,7 +121065,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		var setHeaders = opts.setHeaders;
 		if (setHeaders && typeof setHeaders !== "function") throw new TypeError("option setHeaders must be function");
 		opts.maxage = opts.maxage || opts.maxAge || 0;
-		opts.root = resolve(root);
+		opts.root = resolve$1(root);
 		var onDirectory = redirect ? createRedirectDirectoryListener() : createNotFoundDirectoryListener();
 		return function serveStatic(req, res, next) {
 			if (req.method !== "GET" && req.method !== "HEAD") {
@@ -124129,7 +124734,7 @@ var require_braces = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$4 = require("path");
+	var path$5 = require("path");
 	var WIN_SLASH = "\\\\/";
 	var WIN_NO_SLASH = `[^${WIN_SLASH}]`;
 	var DEFAULT_MAX_EXTGLOB_RECURSION = 0;
@@ -124254,7 +124859,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		CHAR_UNDERSCORE: 95,
 		CHAR_VERTICAL_LINE: 124,
 		CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279,
-		SEP: path$4.sep,
+		SEP: path$5.sep,
 		/**
 		* Create EXTGLOB_CHARS
 		*/
@@ -124298,7 +124903,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/utils.js
 var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
-	var path$3 = require("path");
+	var path$4 = require("path");
 	var win32 = process.platform === "win32";
 	var { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants();
 	exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
@@ -124318,7 +124923,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
 	};
 	exports.isWindows = (options) => {
 		if (options && typeof options.windows === "boolean") return options.windows;
-		return win32 === true || path$3.sep === "\\";
+		return win32 === true || path$4.sep === "\\";
 	};
 	exports.escapeLast = (input, char, lastIdx) => {
 		const idx = input.lastIndexOf(char, lastIdx);
@@ -125688,7 +126293,7 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/picomatch.js
 var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$2 = require("path");
+	var path$3 = require("path");
 	var scan = require_scan();
 	var parse = require_parse();
 	var utils = require_utils();
@@ -125827,7 +126432,7 @@ var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
-		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$2.basename(input));
+		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$3.basename(input));
 	};
 	/**
 	* Returns true if **any** of the given glob `patterns` match the specified `string`.
@@ -126913,7 +127518,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var querystring$2 = require("querystring");
 	var cookieTools = require_cookie$1();
 	var fs$1 = require("fs");
-	var path$1 = require("path");
+	var path$2 = require("path");
 	var crypto$1 = require("crypto");
 	var FORMERDATA_STORE_VERSION = 4;
 	function addCookies(Cookie, headers) {
@@ -126944,11 +127549,11 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function initAmazonProxy(_options, callbackCookie, callbackListening) {
 		const initialCookies = {};
-		const formerDataStorePath = _options.formerDataStorePath || path$1.join(__dirname, "formerDataStore.json");
+		const formerDataStorePath = _options.formerDataStorePath || path$2.join(__dirname, "formerDataStore.json");
 		let formerDataStoreValid = false;
 		if (!_options.formerRegistrationData) try {
 			if (fs$1.existsSync(formerDataStorePath)) {
-				const formerDataStore = JSON.parse(fs$1.readFileSync(path$1.join(__dirname, "formerDataStore.json"), "utf8"));
+				const formerDataStore = JSON.parse(fs$1.readFileSync(path$2.join(__dirname, "formerDataStore.json"), "utf8"));
 				if (typeof formerDataStore === "object" && formerDataStore.storeVersion === FORMERDATA_STORE_VERSION) {
 					_options.formerRegistrationData = _options.formerRegistrationData || {};
 					_options.formerRegistrationData.frc = _options.formerRegistrationData.frc || formerDataStore.frc;
@@ -132679,13 +133284,1365 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+var OTP_ALERT_ID = "import-alexa.speak-otp-required";
+var ALEXA_REGIONS = [
+	"NA",
+	"EU",
+	"FE"
+];
+//#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string()
+});
+var LoginStatusSchema = _enum([
+	"ok",
+	"otp_needed",
+	"captcha",
+	"failed"
+]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
+//#region src/speak/actions.ts
+var SpeakStatusSchema = object({
+	phase: _enum([
+		"sign-in",
+		"otp",
+		"captcha",
+		"devices"
+	]),
+	email: string(),
+	region: _enum(ALEXA_REGIONS),
+	devices: array(EchoDeviceSchema),
+	session: SessionStatusSchema
+});
+var LoginResultSchema = object({
+	status: LoginStatusSchema,
+	error: string().optional()
+});
+var alexaSpeakActions = defineCustomActions({
+	speakStatus: customAction(object({}), SpeakStatusSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	loginStart: customAction(object({
+		email: string().min(1),
+		password: string().min(1).meta({ secret: true }),
+		region: _enum(ALEXA_REGIONS)
+	}), LoginResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	loginOtp: customAction(object({ code: string().min(1).max(12) }), LoginResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	sendTest: customAction(object({
+		echoIds: array(string().min(1)).min(1),
+		mode: _enum(["speak", "announce"]),
+		volume: number().int().min(0).max(100),
+		text: string().min(1).max(450)
+	}), object({ outcomes: array(object({
+		echoId: string(),
+		ok: boolean(),
+		error: string().optional()
+	})) }), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
+//#endregion
+//#region src/speak/otp-alert.ts
+/**
+* A login that needs a new one-time code raises ONE operator alert.
+* Further failures in the same episode do not raise another.
+*/
+function buildOtpAlert(now, reason) {
+	const otp = reason === "otp";
+	return {
+		id: OTP_ALERT_ID,
+		category: EventCategory.AddonError,
+		severity: "error",
+		title: otp ? "Alexa needs a new sign-in code" : "Alexa sign-in needs a captcha",
+		message: otp ? "Amazon asked for a one-time code before Echo devices can speak. Open Alexa → Speak on Echo and enter the code." : "Amazon asked for a captcha. Wait a few minutes, then sign in again on Alexa → Speak on Echo.",
+		action: {
+			label: "Sign in",
+			href: "/addon/import-alexa",
+			navigation: "app"
+		},
+		status: "active",
+		read: false,
+		createdAt: now,
+		updatedAt: now,
+		source: {
+			type: "addon",
+			id: "import-alexa"
+		},
+		metadata: { episodeKey: reason }
+	};
+}
+var OtpAttention = class {
+	ports;
+	open = null;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/** First need in an episode emits the alert. A repeat does not. */
+	async needed(reason) {
+		if (this.open !== null) return "already-open";
+		this.open = reason;
+		await this.ports.emit(buildOtpAlert(this.ports.now(), reason));
+		return "raised";
+	}
+	async cleared() {
+		if (this.open === null) return;
+		this.open = null;
+		await this.ports.resolve(OTP_ALERT_ID);
+	}
+};
+//#endregion
+//#region src/speak/rate-limit.ts
+/**
+* Per-Echo admission. A burst is dropped here, not queued: a queue would be
+* minutes of speech long after the event.
+*/
+function emptySpeechLedger() {
+	return { byEcho: {} };
+}
+/**
+* Identical text inside the collapse window is one utterance.
+* A different text inside the gap is refused until the gap elapses.
+* Admitted calls replace that Echo's memory; refusals leave it as it was.
+*/
+function admitSpeech(ledger, echoId, text, now) {
+	const previous = ledger.byEcho[echoId];
+	if (previous !== void 0 && previous.lastText === text && now - previous.lastSpokenAt < 6e4) return {
+		decision: "collapsed",
+		ledger
+	};
+	if (previous !== void 0 && now - previous.lastSpokenAt < 2e4) return {
+		decision: "rate_limited",
+		ledger
+	};
+	return {
+		decision: "admit",
+		ledger: { byEcho: {
+			...ledger.byEcho,
+			[echoId]: {
+				lastSpokenAt: now,
+				lastText: text
+			}
+		} }
+	};
+}
+//#endregion
+//#region src/speak/speech-text.ts
+var ALEXA_SPEECH_CAPS = {
+	attachments: {
+		mediaTypes: [],
+		mode: "url",
+		max: 0
+	},
+	actions: 0,
+	actionIcons: false,
+	levels: [{
+		id: "default",
+		label: "Default",
+		ordinal: 3
+	}],
+	format: ["text"],
+	clickUrl: false,
+	sound: false,
+	ttl: false,
+	bodyMaxLen: 450
+};
+function collapseWhitespace(value) {
+	return value.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+}
+/** Markup that survived the degrade engine must not be read aloud. */
+function toPlainSpeech(value) {
+	return collapseWhitespace(htmlToText(markdownToText(value)));
+}
+/**
+* Title then body, as one sentence, never longer than {@link SPEECH_MAX_CHARS}.
+* An empty result is an empty string — the caller refuses to send it.
+*/
+function speechFromNotification(notification) {
+	const prepared = prepareNotification(ALEXA_SPEECH_CAPS, notification);
+	const title = prepared.title !== void 0 ? toPlainSpeech(prepared.title) : "";
+	const body = toPlainSpeech(prepared.body);
+	const joined = title.length > 0 && body.length > 0 ? `${title}. ${body}` : title || body;
+	const text = joined.length > 450 ? joined.slice(0, 450).trimEnd() : joined;
+	const truncated = prepared.renderedAs.truncated || text.length < joined.length;
+	return {
+		text,
+		renderedAs: {
+			...prepared.renderedAs,
+			truncated,
+			format: "text"
+		}
+	};
+}
+//#endregion
+//#region src/speak/provider.ts
+function quietLogger$1() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function readString(config, key) {
+	const value = config[key];
+	return typeof value === "string" ? value : "";
+}
+function readMode(config) {
+	return config["mode"] === "announce" ? "announce" : "speak";
+}
+function readVolume(config) {
+	const value = config["volume"];
+	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
+	return Math.max(0, Math.min(100, Math.round(value)));
+}
+function respectDnd(config) {
+	return config["respectDnd"] !== false;
+}
+function configSchema() {
+	return { sections: [{
+		id: "echo",
+		title: "Echo",
+		titleKey: "import-alexa:echoTarget.s_echo.title",
+		fields: [
+			{
+				type: "text",
+				key: "echoId",
+				label: "Echo id",
+				labelKey: "import-alexa:echoTarget.s_echo.echoId.label",
+				required: true
+			},
+			{
+				type: "select",
+				key: "mode",
+				label: "Mode",
+				labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+				default: "speak",
+				options: [{
+					value: "speak",
+					label: "Speak (quiet hours apply)"
+				}, {
+					value: "announce",
+					label: "Announce (chime, then speech)"
+				}]
+			},
+			{
+				type: "number",
+				key: "volume",
+				label: "Volume",
+				labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+				min: 0,
+				max: 100,
+				default: 40
+			},
+			{
+				type: "boolean",
+				key: "respectDnd",
+				label: "Respect Do Not Disturb",
+				labelKey: "import-alexa:echoTarget.s_echo.respectDnd.label",
+				default: true
+			}
+		]
+	}] };
+}
+function kindDescriptor() {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		label: "Alexa",
+		icon: "megaphone",
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		supportsDiscovery: true,
+		destinationKeys: ["echoId"],
+		configSchema: configSchema(),
+		caps: {
+			attachments: {
+				mediaTypes: [],
+				mode: "url",
+				max: 0
+			},
+			actions: 0,
+			actionIcons: false,
+			levels: [{
+				id: "default",
+				label: "Default",
+				ordinal: 3
+			}],
+			format: ["text"],
+			clickUrl: false,
+			sound: false,
+			ttl: false,
+			bodyMaxLen: 450
+		}
+	};
+}
+function discoveredFrom(device) {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		suggestedName: device.name.length > 0 ? device.name : device.id,
+		config: {
+			echoId: device.id,
+			mode: "speak",
+			volume: 40,
+			respectDnd: true,
+			family: device.family,
+			deviceKind: device.kind
+		}
+	};
+}
+function createAlexaNotificationProvider(ports) {
+	const logger = ports.logger ?? quietLogger$1();
+	let targets = ports.loadTargets();
+	let ledger = emptySpeechLedger();
+	let deliveries = [];
+	function record(row) {
+		deliveries = [...deliveries, row];
+	}
+	function deviceFor(echoId) {
+		return ports.devices().find((device) => device.id === echoId);
+	}
+	function persist(next) {
+		targets = next;
+		ports.saveTargets(next);
+	}
+	async function deliver(target, notification) {
+		const speech = speechFromNotification(notification);
+		const echoId = readString(target.config, "echoId");
+		const deviceId = notification.deviceId;
+		const tags = deviceId !== void 0 ? { tags: { deviceId } } : {};
+		if (echoId.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error: "target has no echo id"
+			});
+			logger.warn("alexa speak dropped: target has no echo id", {
+				...tags,
+				meta: { targetId: target.id }
+			});
+			return {
+				success: false,
+				error: "target has no echo id",
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (speech.text.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "empty",
+				at: ports.now()
+			});
+			logger.info("alexa speak dropped: empty text", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const device = deviceFor(echoId);
+		if (device !== void 0 && respectDnd(target.config) && device.dnd) {
+			record({
+				targetId: target.id,
+				outcome: "dnd",
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped: do not disturb", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (device !== void 0 && !device.online) {
+			record({
+				targetId: target.id,
+				outcome: "offline",
+				at: ports.now()
+			});
+			logger.info("alexa speak not delivered: echo offline", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: false,
+				error: "echo offline",
+				renderedAs: speech.renderedAs
+			};
+		}
+		const admitted = admitSpeech(ledger, echoId, speech.text, ports.now());
+		ledger = admitted.ledger;
+		if (admitted.decision !== "admit") {
+			record({
+				targetId: target.id,
+				outcome: admitted.decision,
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome: admitted.decision
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const mode = readMode(target.config);
+		try {
+			const outcomes = await ports.speak({
+				mode,
+				targets: [echoId],
+				text: speech.text,
+				volume: readVolume(target.config)
+			});
+			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
+			if (one === void 0 || !one.ok) {
+				const error = one?.error ?? "speak failed";
+				record({
+					targetId: target.id,
+					outcome: "failed",
+					at: ports.now(),
+					error
+				});
+				logger.warn("alexa speak failed", {
+					...tags,
+					meta: {
+						targetId: target.id,
+						echoId,
+						error
+					}
+				});
+				return {
+					success: false,
+					error,
+					renderedAs: speech.renderedAs
+				};
+			}
+			const outcome = mode === "announce" ? "announced" : "spoken";
+			record({
+				targetId: target.id,
+				outcome,
+				at: ports.now()
+			});
+			logger.info("alexa speak delivered", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		} catch (err) {
+			const error = err instanceof Error ? err.message : String(err);
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error
+			});
+			logger.warn("alexa speak failed", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					error
+				}
+			});
+			return {
+				success: false,
+				error,
+				renderedAs: speech.renderedAs
+			};
+		}
+	}
+	return {
+		get deliveries() {
+			return deliveries;
+		},
+		async listTargetKinds() {
+			return [kindDescriptor()];
+		},
+		async listTargets() {
+			return [...targets];
+		},
+		async getTarget(input) {
+			const found = targets.find((target) => target.id === input.targetId);
+			if (found === void 0) throw new Error(`target not found: ${input.targetId}`);
+			return found;
+		},
+		async discoverTargets() {
+			return ports.devices().map(discoveredFrom);
+		},
+		async probeTargetConfig() {
+			return ports.loggedIn() ? {
+				ok: true,
+				resolvedUrl: "alexa://session"
+			} : {
+				ok: false,
+				resolvedUrl: "alexa://session",
+				error: "not signed in"
+			};
+		},
+		async send(input) {
+			const target = targets.find((row) => row.id === input.targetId);
+			if (target === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!target.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(target, input.notification);
+		},
+		async testTarget(input) {
+			const found = targets.find((row) => row.id === input.targetId);
+			if (found === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!found.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(found, input.sample ?? {
+				body: "This is a CamStack test notification.",
+				title: "CamStack",
+				format: "text",
+				priority: 3
+			});
+		},
+		async upsertTarget(input) {
+			const target = {
+				...input.target,
+				addonId: ALEXA_SPEAK_ADDON_ID,
+				kind: ALEXA_SPEAK_KIND
+			};
+			persist([...targets.filter((row) => row.id !== target.id), target]);
+			return target;
+		},
+		async deleteTarget(input) {
+			persist(targets.filter((row) => row.id !== input.targetId));
+		},
+		async setTargetEnabled(input) {
+			persist(targets.map((row) => row.id === input.targetId ? {
+				...row,
+				enabled: input.enabled
+			} : row));
+		}
+	};
+}
+//#endregion
+//#region src/speak/python-paths.ts
+/** Locate bundled `python/alexa_worker.py` from dist/ or from src/ under test. */
+function resolveAlexaWorkerScript(fromModuleUrl = require("url").pathToFileURL(__filename).href) {
+	const here = (0, node_path.dirname)((0, node_url.fileURLToPath)(fromModuleUrl));
+	const candidates = [
+		(0, node_path.join)(here, "../python/alexa_worker.py"),
+		(0, node_path.join)(here, "../../python/alexa_worker.py"),
+		(0, node_path.join)(here, "../../../python/alexa_worker.py")
+	];
+	for (const candidate of candidates) if ((0, node_fs.existsSync)(candidate)) return candidate;
+	throw new Error(`import-alexa: alexa_worker.py not found. Searched:\n${candidates.join("\n")}`);
+}
+process.platform, process.env["SystemRoot"];
+/**
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
+*/
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? (0, node_os.userInfo)().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
+	return {
+		platform: process.platform,
+		exec: (file, args) => {
+			(0, node_child_process.execFileSync)(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
+	};
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = node_path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	node_fs.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	node_fs.chmodSync(target, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	node_fs.mkdirSync(node_path$1.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	node_fs.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		node_fs.writeFileSync(tmp, data);
+		node_fs.renameSync(tmp, target);
+	} catch (err) {
+		node_fs.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
+//#region src/speak/secret-file.ts
+/**
+* Hand a password or a saved Amazon session to the Python worker as an
+* owner-only file. The path travels on stdin. The bytes never travel on
+* argv or in the environment, and they are removed when the call settles.
+*/
+var REDACTED = "‹redacted›";
+function decodeSession(sessionB64) {
+	if (sessionB64.length === 0) return Buffer.alloc(0);
+	return Buffer.from(sessionB64, "base64");
+}
+async function readSessionB64(sessionPath) {
+	const bytes = await node_fs_promises.readFile(sessionPath);
+	if (bytes.length === 0) return "";
+	return bytes.toString("base64");
+}
+/**
+* Create a 0700 directory, write the password and the session 0600, run
+* `body`, then delete the directory whether `body` succeeded or threw.
+* Returns the session file as base64 so the caller can store it in the keychain.
+*/
+async function withSpeakSecretFiles(input, body) {
+	const dir = await node_fs_promises.mkdtemp(node_path.join(node_os.tmpdir(), "camstack-alexa-"));
+	const paths = {
+		dir,
+		passwordPath: node_path.join(dir, "password"),
+		sessionPath: node_path.join(dir, "session")
+	};
+	try {
+		restrictDirToOwnerSync(dir);
+		writeOwnerOnlyFileSync(paths.passwordPath, input.password);
+		writeOwnerOnlyFileSync(paths.sessionPath, decodeSession(input.sessionB64));
+		await body(paths);
+		return { sessionB64: await readSessionB64(paths.sessionPath) };
+	} finally {
+		await node_fs_promises.rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Replace every occurrence of each non-empty secret. Used before a log line is emitted. */
+function scrubSecrets(text, secrets) {
+	let out = text;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		out = out.split(secret).join(REDACTED);
+	}
+	return out;
+}
+//#endregion
+//#region src/speak/setup-flow.ts
+/** Where the next screen is. A failed password stays on sign-in. A failed code stays on the code step. */
+function reduceSetup(phase, event) {
+	if (event.type === "reset") return "sign-in";
+	if (event.status === "ok") return "devices";
+	if (event.status === "otp_needed") return "otp";
+	if (event.status === "captcha") return "captcha";
+	return phase;
+}
+//#endregion
+//#region src/speak/worker-client.ts
+/**
+* One Python process for the life of the addon. Requests are one JSON line
+* on stdin; responses are one JSON line on stdout, matched by id.
+* A crash restarts the process until the same bound CrashSupervisor uses,
+* then requests fail instead of looping.
+*/
+/** Pure: a new timestamp list, never a mutated one. */
+function recordWorkerCrash(times, now, windowMs, maxCrashes) {
+	const cutoff = now - windowMs;
+	const recent = [...times.filter((t) => t >= cutoff), now];
+	if (recent.length >= maxCrashes) return {
+		action: "failed",
+		times: recent
+	};
+	return {
+		action: "respawn",
+		times: recent
+	};
+}
+function quietLogger() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function wrapChild(child) {
+	const stdin = child.stdin;
+	const stdout = child.stdout;
+	const stderr = child.stderr;
+	if (stdin === null || stdout === null || stderr === null) throw new Error("alexa worker spawn did not provide pipes");
+	return {
+		stdin: { write(chunk) {
+			stdin.write(chunk);
+		} },
+		stdout: { on(event, listener) {
+			stdout.on(event, listener);
+		} },
+		stderr: { on(event, listener) {
+			stderr.on(event, listener);
+		} },
+		on(event, listener) {
+			if (event === "close") child.on("close", listener);
+			else child.on("error", listener);
+		},
+		kill(signal) {
+			child.kill(signal);
+		}
+	};
+}
+function defaultSpawn(pythonPath, scriptPath, env) {
+	return wrapChild((0, node_child_process.spawn)(pythonPath, [scriptPath], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		env
+	}));
+}
+function startAlexaWorker(deps) {
+	const logger = deps.logger ?? quietLogger();
+	const now = deps.now ?? (() => Date.now());
+	const schedule = deps.schedule ?? ((fn, delayMs) => {
+		setTimeout(fn, delayMs);
+	});
+	const spawnChild = deps.spawnChild ?? defaultSpawn;
+	const maxCrashes = deps.maxCrashes ?? 5;
+	const windowMs = deps.windowMs ?? 6e4;
+	const env = deps.env ?? process.env;
+	let child = null;
+	let buffer = "";
+	let nextId = 1;
+	let stopped = false;
+	let failed = false;
+	let crashTimes = [];
+	let secrets = [];
+	let pending = null;
+	const queue = [];
+	function scrub(text) {
+		return scrubSecrets(text, secrets);
+	}
+	function failPending(err) {
+		const current = pending;
+		pending = null;
+		current?.reject(err);
+	}
+	function attach(spawned) {
+		child = spawned;
+		buffer = "";
+		let settled = false;
+		const finish = (code) => {
+			if (settled || child !== spawned) return;
+			settled = true;
+			onExit(code);
+		};
+		spawned.stdout.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (line.trim().length === 0) continue;
+				acceptLine(line);
+			}
+		});
+		spawned.stderr.on("data", (chunk) => {
+			const text = scrub(chunk.toString("utf8")).trim();
+			if (text.length === 0) return;
+			logger.warn("alexa worker stderr", { meta: { text: text.slice(0, 500) } });
+		});
+		spawned.on("error", (err) => {
+			logger.warn("alexa worker spawn error", { meta: { error: scrub(err.message) } });
+			finish(null);
+		});
+		spawned.on("close", (code) => {
+			finish(code);
+		});
+	}
+	function acceptLine(line) {
+		let parsed;
+		try {
+			parsed = JSON.parse(line);
+		} catch (err) {
+			logger.warn("alexa worker non-JSON line", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return;
+		}
+		const checked = WorkerLineSchema.safeParse(parsed);
+		if (!checked.success) {
+			logger.warn("alexa worker line failed schema", { meta: { error: checked.error.message } });
+			return;
+		}
+		const message = checked.data;
+		if (pending === null || pending.id !== message.id) {
+			logger.warn("alexa worker line for an unknown request", { meta: { id: message.id } });
+			return;
+		}
+		const current = pending;
+		pending = null;
+		if (message.ok) current.resolve(message.result);
+		else current.reject(new Error(scrub(message.error)));
+		pump();
+	}
+	function onExit(code) {
+		child = null;
+		if (stopped) {
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			return;
+		}
+		failPending(/* @__PURE__ */ new Error(`alexa worker exited (${code ?? "null"})`));
+		const decision = recordWorkerCrash(crashTimes, now(), windowMs, maxCrashes);
+		crashTimes = decision.times;
+		if (decision.action === "failed") {
+			failed = true;
+			logger.error("alexa worker restart bound reached", { meta: { crashes: crashTimes.length } });
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+			return;
+		}
+		logger.warn("alexa worker exited; restarting", { meta: {
+			code,
+			crashes: crashTimes.length
+		} });
+		schedule(() => {
+			if (stopped || failed) return;
+			launch();
+			pump();
+		}, Math.min(3e4, 500 * 2 ** Math.min(6, crashTimes.length - 1)));
+	}
+	function launch() {
+		if (stopped || failed) return;
+		attach(spawnChild(deps.pythonPath, deps.scriptPath, env));
+	}
+	function pump() {
+		if (pending !== null || child === null || failed || stopped) return;
+		const next = queue.shift();
+		if (next === void 0) return;
+		pending = next.pending;
+		child.stdin.write(requestLine(next.pending.id, next.request));
+	}
+	function request(body) {
+		if (failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+		if (stopped) return Promise.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		const id = String(nextId);
+		nextId += 1;
+		return new Promise((resolve, reject) => {
+			queue.push({
+				request: body,
+				pending: {
+					id,
+					resolve,
+					reject
+				}
+			});
+			if (child === null) launch();
+			pump();
+		});
+	}
+	return {
+		request,
+		noteSecrets(next) {
+			secrets = [...next];
+		},
+		stop() {
+			stopped = true;
+			const current = child;
+			child = null;
+			current?.kill("SIGTERM");
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		},
+		get failed() {
+			return failed;
+		},
+		get crashesInWindow() {
+			return crashTimes.length;
+		}
+	};
+}
+//#endregion
+//#region src/speak/controller.ts
+/**
+* Owns the one Python worker, the keychain session, the Echo cache and the
+* notification provider. A login that needs a code raises one alert.
+*/
+function targetsFrom(settings) {
+	return settings.targets.map((row) => ({
+		id: row.id,
+		name: row.name,
+		kind: ALEXA_SPEAK_KIND,
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		enabled: row.enabled,
+		config: {
+			echoId: row.echoId,
+			mode: row.mode,
+			volume: row.volume,
+			respectDnd: row.respectDnd
+		}
+	}));
+}
+function withTargets(settings, targets) {
+	return {
+		...settings,
+		targets: targets.map((target) => ({
+			id: target.id,
+			name: target.name,
+			enabled: target.enabled,
+			echoId: typeof target.config["echoId"] === "string" ? target.config["echoId"] : "",
+			mode: target.config["mode"] === "announce" ? "announce" : "speak",
+			volume: typeof target.config["volume"] === "number" ? target.config["volume"] : 40,
+			respectDnd: target.config["respectDnd"] !== false
+		}))
+	};
+}
+function usablePassword(value) {
+	if (value.length === 0 || isSecretMarker(value)) return "";
+	return value;
+}
+var AlexaSpeakController = class {
+	host;
+	provider;
+	settings;
+	worker = null;
+	devices = [];
+	phase = "sign-in";
+	timer = null;
+	attention;
+	now;
+	constructor(host) {
+		this.host = host;
+		this.now = host.now ?? (() => Date.now());
+		this.settings = readSpeakSettings(host.readConfig());
+		this.phase = this.settings.session.length > 0 ? "devices" : "sign-in";
+		this.attention = new OtpAttention({
+			now: this.now,
+			emit: (alert) => host.emitAlert(alert),
+			resolve: (id) => host.resolveAlert(id)
+		});
+		this.provider = createAlexaNotificationProvider({
+			devices: () => this.devices,
+			loggedIn: () => this.phase === "devices",
+			now: this.now,
+			logger: host.logger,
+			loadTargets: () => targetsFrom(this.settings),
+			saveTargets: (targets) => {
+				this.settings = withTargets(this.settings, targets);
+				this.persist();
+			},
+			speak: (command) => this.utter(command.mode, command.targets, command.text, command.volume)
+		});
+	}
+	async start() {
+		const pythonPath = await this.host.ensurePython();
+		if (pythonPath === null) {
+			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
+			return;
+		}
+		this.worker = startAlexaWorker({
+			pythonPath,
+			scriptPath: resolveAlexaWorkerScript(),
+			logger: this.host.logger,
+			now: this.now
+		});
+		this.noteSecrets();
+		if (this.settings.session.length > 0) await this.loginWithFiles().catch((err) => {
+			this.host.logger.warn("alexa speak: stored session did not restore", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+		this.timer = setInterval(() => {
+			this.refreshDevices();
+		}, DEVICE_REFRESH_MS);
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+		this.worker?.stop();
+		this.worker = null;
+	}
+	handlers() {
+		return {
+			speakStatus: async () => this.status(),
+			loginStart: async (input) => {
+				this.settings = {
+					...this.settings,
+					email: input.email,
+					password: input.password,
+					region: input.region
+				};
+				await this.persist();
+				this.noteSecrets();
+				return this.loginWithFiles();
+			},
+			loginOtp: async (input) => this.otpWithFiles(input.code),
+			sendTest: async (input) => this.sendTest(input)
+		};
+	}
+	noteSecrets() {
+		const password = usablePassword(this.settings.password);
+		this.worker?.noteSecrets(password.length > 0 ? [password] : []);
+	}
+	async persist() {
+		try {
+			await this.host.writeSpeak(this.settings);
+		} catch (err) {
+			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	workerRequest(request) {
+		const worker = this.worker;
+		if (worker === null || worker.failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker is not running"));
+		return worker.request(request);
+	}
+	async loginWithFiles() {
+		let outcome = {
+			status: "failed",
+			error: "alexa worker is not running"
+		};
+		const held = await withSpeakSecretFiles({
+			password: usablePassword(this.settings.password),
+			sessionB64: this.settings.session
+		}, async (paths) => {
+			outcome = await this.applyLogin(await this.loginRequest(paths));
+		});
+		if (held.sessionB64 !== this.settings.session) {
+			this.settings = {
+				...this.settings,
+				session: held.sessionB64
+			};
+			await this.persist();
+		}
+		return outcome;
+	}
+	async otpWithFiles(code) {
+		let outcome = {
+			status: "failed",
+			error: "alexa worker is not running"
+		};
+		const held = await withSpeakSecretFiles({
+			password: "",
+			sessionB64: this.settings.session
+		}, async (paths) => {
+			outcome = await this.applyLogin(await this.workerRequest({
+				op: "login_otp",
+				code,
+				sessionPath: paths.sessionPath
+			}));
+		});
+		if (held.sessionB64 !== this.settings.session) {
+			this.settings = {
+				...this.settings,
+				session: held.sessionB64
+			};
+			await this.persist();
+		}
+		return outcome;
+	}
+	loginRequest(paths) {
+		return this.workerRequest({
+			op: "login_start",
+			email: this.settings.email,
+			passwordPath: paths.passwordPath,
+			sessionPath: paths.sessionPath,
+			region: this.settings.region
+		});
+	}
+	async applyLogin(raw) {
+		const outcome = parseLoginResult(raw);
+		this.phase = reduceSetup(this.phase, {
+			type: "login",
+			status: outcome.status
+		});
+		if (outcome.status === "otp_needed") await this.attention.needed("otp");
+		else if (outcome.status === "captcha") await this.attention.needed("captcha");
+		else if (outcome.status === "ok") {
+			await this.attention.cleared();
+			await this.refreshDevices();
+		}
+		return outcome;
+	}
+	async refreshDevices() {
+		if (this.worker === null || this.phase !== "devices") return;
+		try {
+			this.devices = [...parseDevices(await this.workerRequest({ op: "devices" }))];
+		} catch (err) {
+			this.host.logger.warn("alexa speak: device refresh failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async utter(mode, targets, text, volume) {
+		const op = mode === "announce" ? "announce" : "speak";
+		return parseDeliveries(await this.workerRequest({
+			op,
+			targets,
+			text,
+			volume
+		}));
+	}
+	async session() {
+		if (this.worker === null) return {
+			loggedIn: false,
+			ageSec: 0,
+			lastSuccessAt: null
+		};
+		try {
+			return parseSessionStatus(await this.workerRequest({ op: "session_status" }));
+		} catch {
+			return {
+				loggedIn: this.phase === "devices",
+				ageSec: 0,
+				lastSuccessAt: null
+			};
+		}
+	}
+	async status() {
+		return {
+			phase: this.phase,
+			email: this.settings.email,
+			region: this.settings.region,
+			devices: [...this.devices],
+			session: await this.session()
+		};
+	}
+	async sendTest(input) {
+		const outcomes = await this.utter(input.mode, input.echoIds, input.text, input.volume);
+		const known = new Map(this.devices.map((device) => [device.id, device]));
+		const next = [...targetsFrom(this.settings)];
+		for (const echoId of input.echoIds) {
+			if (next.some((row) => row.config["echoId"] === echoId)) continue;
+			const device = known.get(echoId);
+			next.push({
+				id: `echo-${echoId}`,
+				name: device?.name ?? echoId,
+				kind: ALEXA_SPEAK_KIND,
+				addonId: ALEXA_SPEAK_ADDON_ID,
+				enabled: true,
+				config: {
+					echoId,
+					mode: input.mode,
+					volume: input.volume,
+					respectDnd: true
+				}
+			});
+		}
+		this.settings = withTargets(this.settings, next);
+		await this.persist();
+		return { outcomes: outcomes.map((row) => ({
+			echoId: row.targetId,
+			ok: row.ok,
+			...row.error !== void 0 ? { error: row.error } : {}
+		})) };
+	}
+};
+//#endregion
 //#region src/addon.ts
+var SPEAK_PAGE = {
+	id: "speak",
+	label: "Speak on Echo",
+	icon: "megaphone",
+	path: "/addon/import-alexa",
+	remoteName: "addon_import_alexa_page",
+	bundle: "remoteEntry.js",
+	section: "administration"
+};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: {
 		proxyHost: "",
 		proxyPort: 3456
+	},
+	speak: {
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	}
 };
 /** Device types an imported Alexa appliance can materialise as. */
@@ -132727,6 +134684,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	proxyLogin = null;
 	brokerStore = null;
 	activeBrokers = [];
+	speak = null;
+	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -132780,21 +134739,62 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			proxyLogin: this.proxyLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
 		});
-		return [
-			...regs,
-			{
-				capability: brokerCapability,
-				provider: this.buildBrokerProvider()
+		const speak = new AlexaSpeakController({
+			logger: this.ctx.logger.child("speak"),
+			readConfig: () => this.config,
+			writeSpeak: async (next) => {
+				await this.updateGlobalSettings({ speak: next });
 			},
-			{
-				capability: deviceAdoptionCapability,
-				provider: this.buildAdoptionProvider()
+			emitAlert: async (alert) => {
+				const emit = this.ctx.api.alerts?.emit;
+				if (emit === void 0) {
+					this.ctx.logger.warn("alexa speak: OTP alert skipped — alerts capability missing");
+					return;
+				}
+				await emit.mutate(alert);
 			},
-			{
-				capability: addonRoutesCapability,
-				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-			}
-		];
+			resolveAlert: async (alertId) => {
+				const dismiss = this.ctx.api.alerts?.dismiss;
+				if (dismiss === void 0) return;
+				await dismiss.mutate({ alertId });
+			},
+			ensurePython: () => this.ctx.deps.ensurePython()
+		});
+		this.speak = speak;
+		speak.start().catch((err) => {
+			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+		const pages = {
+			id: this.addonId,
+			listPages: () => [SPEAK_PAGE]
+		};
+		return {
+			providers: [
+				...regs,
+				{
+					capability: brokerCapability,
+					provider: this.buildBrokerProvider()
+				},
+				{
+					capability: deviceAdoptionCapability,
+					provider: this.buildAdoptionProvider()
+				},
+				{
+					capability: addonRoutesCapability,
+					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+				},
+				{
+					capability: notificationOutputCapability,
+					provider: speak.provider
+				},
+				{
+					capability: addonPagesSourceCapability,
+					provider: pages
+				}
+			],
+			customActions: alexaSpeakActions,
+			actionHandlers: speak.handlers()
+		};
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -132859,6 +134859,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		}
 	}
 	async onShutdown() {
+		this.speak?.stop();
+		this.speak = null;
 		alexaCommands.clear();
 		try {
 			await this.proxyLogin?.dispose();
@@ -133093,43 +135095,90 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 	}
 	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "alexa-account",
-			title: "Amazon Alexa account",
-			titleKey: "import-alexa:globalSettings.s_alexa-account.title",
-			description: "Alexa accounts are managed in the External systems → Brokers tab.",
-			descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
-			columns: 1,
-			fields: [{
-				type: "info",
-				key: "accountHelp",
-				label: "Accounts are managed separately",
-				labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
-				content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
-			}]
-		}, {
-			id: "alexa-proxy-login",
-			title: "Interactive login (proxy)",
-			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-			description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
-			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
-			columns: 2,
-			fields: [{
-				type: "text",
-				key: "proxyLogin.proxyHost",
-				label: "Login proxy host/IP (blank = auto-detect)",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
-				placeholder: "auto-detect"
-			}, {
-				type: "number",
-				key: "proxyLogin.proxyPort",
-				label: "Login proxy port",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
-				min: 1,
-				max: 65535,
-				default: 3456
-			}]
-		}] });
+		return this.schema({ sections: [
+			{
+				id: "alexa-account",
+				title: "Amazon Alexa account",
+				titleKey: "import-alexa:globalSettings.s_alexa-account.title",
+				description: "Alexa accounts are managed in the External systems → Brokers tab.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
+				columns: 1,
+				fields: [{
+					type: "info",
+					key: "accountHelp",
+					label: "Accounts are managed separately",
+					labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
+					content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
+				}]
+			},
+			{
+				id: "alexa-proxy-login",
+				title: "Interactive login (proxy)",
+				titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
+				description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
+				columns: 2,
+				fields: [{
+					type: "text",
+					key: "proxyLogin.proxyHost",
+					label: "Login proxy host/IP (blank = auto-detect)",
+					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
+					placeholder: "auto-detect"
+				}, {
+					type: "number",
+					key: "proxyLogin.proxyPort",
+					label: "Login proxy port",
+					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
+					min: 1,
+					max: 65535,
+					default: 3456
+				}]
+			},
+			{
+				id: "alexa-speak",
+				title: "Speak on Echo",
+				titleKey: "import-alexa:globalSettings.s_alexa-speak.title",
+				description: "Sign in on the Speak on Echo page, pick the devices, and use them as a notification target. The text is the rule template, read aloud.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-speak.description",
+				columns: 1,
+				fields: [
+					{
+						type: "text",
+						key: "speak.email",
+						label: "Amazon email",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_email.label",
+						inputType: "email"
+					},
+					{
+						type: "password",
+						key: "speak.password",
+						label: "Amazon password",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_password.label"
+					},
+					{
+						type: "select",
+						key: "speak.region",
+						label: "Region",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_region.label",
+						default: "EU",
+						options: [
+							{
+								value: "NA",
+								label: "North America"
+							},
+							{
+								value: "EU",
+								label: "Europe"
+							},
+							{
+								value: "FE",
+								label: "Far East"
+							}
+						]
+					}
+				]
+			}
+		] });
 	}
 	async supportsManualCreation() {
 		return false;
@@ -133170,10 +135219,12 @@ exports.StubAlexaClient = StubAlexaClient;
 exports.__toCommonJS = __toCommonJS;
 exports.alexaAddonConfigSchema = alexaAddonConfigSchema;
 exports.alexaConnectionSchema = alexaConnectionSchema;
+exports.alexaSpeakActions = alexaSpeakActions;
 exports.buildAlexaApplianceCandidate = buildAlexaApplianceCandidate;
 exports.buildConnectionFormSchema = buildConnectionFormSchema;
 exports.connectionToCredentials = connectionToCredentials;
 exports.createAlexaClient = createAlexaClient;
+exports.customActions = alexaSpeakActions;
 exports.mapAlexaCapabilitiesToCamStack = mapAlexaCapabilitiesToCamStack;
 exports.mappableAppliance = mappableAppliance;
 exports.settingsToAlexaConnection = settingsToAlexaConnection;