@camstack/addon-import-alexa 0.2.148 → 0.2.149

package/dist/addon.mjs

@@ -1,8 +1,15 @@
 import { createRequire } from "node:module";
 import { randomBytes } from "node:crypto";
-import { networkInterfaces } from "node:os";
-import { promises } from "node:fs";
-import path from "node:path";
+import * as os from "node:os";
+import { networkInterfaces, userInfo } from "node:os";
+import * as fs$1 from "node:fs";
+import { existsSync, promises } from "node:fs";
+import * as path$1 from "node:path";
+import path, { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as fs from "node:fs/promises";
+import { execFileSync, spawn } from "node:child_process";
+import "node:zlib";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -5614,7 +5621,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bykKrTgu.mjs
+//#region ../types/dist/sleep-0sD_LHLI.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8852,6 +8859,28 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
+/**
+* Identity — preserves literal types for downstream inference.
+*
+* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
+* TypeScript does not widen each entry's literal `kind`/`auth` fields to
+* the broader unions declared on `CustomActionSpec`'s default generics.
+* Shape validity is enforced separately by the `customAction(...)` helper
+* whose return type is already a `CustomActionSpec<...>`.
+*/
+function defineCustomActions(spec) {
+	return spec;
+}
+function customAction(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		scope: options?.scope ?? { kind: "system" },
+		...options?.caller ? { caller: "required" } : {}
+	};
+}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -9017,6 +9046,7 @@ var CAP_NAMES = Object.freeze([
 	"login-method",
 	"media-player",
 	"mesh-network",
+	"meter",
 	"metrics-provider",
 	"model-convert",
 	"model-distributor",
@@ -10074,6 +10104,10 @@ Object.freeze({
 			]
 		}
 	],
+	"meter": [{
+		"path": "value",
+		"valueType": "number"
+	}],
 	"motion": [
 		{
 			"path": "detected",
@@ -10817,7 +10851,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BXKzRBwg.mjs
+//#region ../types/dist/err-msg-DIorGYeC.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -10911,8 +10945,14 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["PetFeeder"] = "pet-feeder";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations. */
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
 	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -11170,7 +11210,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-OhpuespA.mjs
+//#region ../types/dist/composition-CpETZ4HL.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11926,6 +11966,97 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
+* One power reading becomes a washer, dryer or dishwasher (D944 helper).
+*
+* Standby of the control board is under 5 W; a motor or a heater is far
+* above that, so 5 W is the line. A door lock or a short pump spike is not
+* a cycle, so running starts only after 30 s above the line.
+*
+* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
+* bursts) lasts several minutes. Ending the cycle on the first dip would
+* report "finished" in the middle of the program, so the stop dwell is
+* 10 minutes on every type. The number is stored per type so one machine
+* can move later without moving the others.
+*/
+var APPLIANCE_TEMPLATE_ID = "appliance";
+var APPLIANCE_KINDS = [
+	"washer",
+	"dryer",
+	"dishwasher"
+];
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+/**
+* Statistics and integrals over a history read (D944).
+*
+* Pure: the same points always give the same answer, so a restart recomputes
+* rather than trusting a buffer. A gauge mean is time-weighted (value × ms),
+* never the mean of the samples. A hole with no held value is not integrated
+* as zero. A truncated read is not published.
+*/
+var STATISTIC_STATS = [
+	"min",
+	"max",
+	"mean",
+	"sum",
+	"count",
+	"change"
+];
+/**
+* The range a statistics or integral helper asks history for (D944).
+*
+* Calendar edges are the hub's timezone, never UTC midnight: a day is 23, 24
+* or 25 hours across a DST change. A tier is eligible only when its retention
+* is strictly longer than the longest that range can be. Forever qualifies.
+* Equal to a tier's retention is a refusal, not a short answer.
+*/
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+var ROLLING_SPANS = [
+	"1h",
+	"24h",
+	"2d",
+	"7d",
+	"30d",
+	"custom"
+];
+var CALENDAR_PERIODS = [
+	"today",
+	"yesterday",
+	"this-week",
+	"this-month"
+];
+var RESET_PERIODS = [
+	"never",
+	"daily",
+	"weekly",
+	"monthly"
+];
+5 * MINUTE_MS;
+24 * HOUR_MS, 2 * DAY_MS, 7 * DAY_MS, 30 * DAY_MS;
+7 * DAY_MS, 30 * DAY_MS, 365 * DAY_MS;
+var StatisticWindowSchema = discriminatedUnion("kind", [object({
+	kind: literal("rolling"),
+	span: _enum(ROLLING_SPANS),
+	customMinutes: number().int().min(5).optional()
+}).check((payload) => {
+	if (payload.value.span === "custom" && payload.value.customMinutes === void 0) payload.issues.push({
+		code: "custom",
+		message: "a custom range needs a duration in minutes",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+	if (payload.value.span !== "custom" && payload.value.customMinutes !== void 0) payload.issues.push({
+		code: "custom",
+		message: "only a custom range carries a duration",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+}), object({
+	kind: literal("calendar"),
+	period: _enum(CALENDAR_PERIODS)
+})]);
+/**
 * A composition source identity: `(addonId, stableId)`, never a numeric device
 * id. Split out so helper schemas can name it without a cycle through
 * `composition.ts` (D659).
@@ -11981,14 +12112,37 @@ var HelperMemberSchema = object({
 	cap: string().min(1),
 	fieldPath: string().min(1)
 });
-var HelperSpecSchema = discriminatedUnion("kind", [object({
-	kind: literal("group"),
-	templateId: GroupTemplateIdSchema,
-	aggregate: AggregateReducerSchema,
-	members: array(HelperMemberSchema).min(1).max(64),
-	/** Actuator groups only. Readings leave this unset. */
-	active: ActiveCriterionSchema.optional()
-})]);
+var HelperSpecSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("group"),
+		templateId: GroupTemplateIdSchema,
+		aggregate: AggregateReducerSchema,
+		members: array(HelperMemberSchema).min(1).max(64),
+		/** Actuator groups only. Readings leave this unset. */
+		active: ActiveCriterionSchema.optional()
+	}),
+	object({
+		kind: literal("appliance"),
+		templateId: literal(APPLIANCE_TEMPLATE_ID),
+		appliance: _enum(APPLIANCE_KINDS),
+		thresholdWatts: number().positive(),
+		startDwellMs: number().int().nonnegative(),
+		stopDwellMs: number().int().nonnegative(),
+		member: HelperMemberSchema
+	}),
+	object({
+		kind: literal("statistic"),
+		stat: _enum(STATISTIC_STATS),
+		window: StatisticWindowSchema,
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("integral"),
+		reset: _enum(RESET_PERIODS),
+		output: _enum(["energy", "meter"]),
+		source: HelperMemberSchema
+	})
+]);
 /** A composed device's stableId is this prefix plus the block id. */
 var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
 /** Longest snippet a `code` source may carry (slice 4). */
@@ -12062,6 +12216,26 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"omit",
 			"offline"
 		])
+	}),
+	object({
+		kind: literal("series"),
+		read: CompositionFieldReadSchema,
+		/** `value` is the statistic or the integral. The others are the gap counts. */
+		publish: _enum([
+			"value",
+			"included",
+			"excluded",
+			"total"
+		]),
+		/**
+		* What an unanswered `value` does. Counts ignore this. `offline` leaves the
+		* device unseeded until history answers, so a restart cannot publish 0.
+		*/
+		empty: _enum([
+			"null",
+			"omit",
+			"offline"
+		])
 	})
 ]);
 var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
@@ -15822,7 +15996,24 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
+};
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -18511,7 +18702,8 @@ var CompositionProblemSchema = object({
 		"native-capability-replace",
 		"mixed-quantity",
 		"helper-mismatch",
-		"member-constraint"
+		"member-constraint",
+		"retention"
 	]),
 	path: string(),
 	message: string()
@@ -18751,7 +18943,7 @@ Object.freeze({
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW = {
+var NOW$1 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -18797,7 +18989,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "humidity",
@@ -18808,7 +19000,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "pressure",
@@ -18819,7 +19011,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "illuminance",
@@ -18830,7 +19022,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "power",
@@ -18841,7 +19033,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "energy",
@@ -18852,7 +19044,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	numeric({
 		id: "battery",
@@ -18887,7 +19079,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$1]
 	}),
 	binary({
 		id: "motion",
@@ -19016,6 +19208,7 @@ function actuator(input) {
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
+DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * What a composition may BUILD on a device type (G2, D676): the caps a new
@@ -44581,57 +44774,79 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: string().optional()
+		}), array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(object({
+			kind: string(),
+			config: record(string(), unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: method(object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: method(object({ targetId: string() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 new Set([
 	{
 		id: "person",
@@ -61881,6 +62096,44 @@ var lockControlCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* A monotonic total between resets (D944). Energy uses `power-meter.kwhTotal`
+* so dashboards keep one series; every other instantaneous reading lands here.
+* `value` is the time integral in the source quantity's accumulated base
+* (base-unit seconds, or kWh on the power meter). `null` is a gap, never zero.
+*/
+var MeterStatusSchema = object({
+	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
+	lastFetchedAt: number()
+});
+var meterCapability = {
+	name: "meter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: MeterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: MeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the total is a cache of the
+	* history integral. A restart shows it only until the history pass
+	* recomputes the open period; it is not an in-memory buffer.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	history: { fields: { value: {
+		kind: "counter",
+		deadband: .001,
+		minIntervalMs: 6e4
+	} } },
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
 * Apple TV, Spotify, Roku, generic OTT receivers, …) on
 * `DeviceType.MediaPlayer`. Disjoint from the camera streaming
@@ -64407,7 +64660,12 @@ var powerMeterCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
+	deviceTypes: [
+		DeviceType.Sensor,
+		DeviceType.Washer,
+		DeviceType.Dryer,
+		DeviceType.Dishwasher
+	],
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -65145,6 +65403,8 @@ var runningCustomize = {
 			stateField: "running"
 		},
 		deviceTypes: [
+			DeviceType.Washer,
+			DeviceType.Dryer,
 			DeviceType.Dishwasher,
 			DeviceType.Vacuum,
 			DeviceType.LawnMower,
@@ -69848,7 +70108,7 @@ method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" })
 	auth: "admin"
 });
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Camera, DeviceType.Camera, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -70188,6 +70448,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	lawnMowerControl: lawnMowerControlCapability,
 	lockControl: lockControlCapability,
 	mediaPlayer: mediaPlayerCapability,
+	meter: meterCapability,
 	motion: motionCapability,
 	motionTrigger: motionTriggerCapability,
 	motionZones: motionZonesCapability,
@@ -71447,7 +71708,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -75636,6 +75897,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"meter.getStatus": {
+		capName: "meter",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"metricsProvider.collectSnapshot": {
 		capName: "metrics-provider",
 		capScope: "system",
@@ -83734,7 +84002,39 @@ var APPLIANCE_CAP_VOCABULARY = {
 				phrase: t("When {device} finishes", "Quando {device} finisce"),
 				icon: "square"
 			}
-		}
+		},
+		overrides: { byType: {
+			[DeviceType.Washer]: {
+				state: { running: {
+					whenTrue: t("When the washing machine starts", "Quando la lavatrice inizia"),
+					whenFalse: t("When the washing machine has finished", "Quando la lavatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the washing machine starts", "Quando la lavatrice inizia") },
+					onFinished: { phrase: t("When the washing machine has finished", "Quando la lavatrice ha finito") }
+				}
+			},
+			[DeviceType.Dryer]: {
+				state: { running: {
+					whenTrue: t("When the dryer starts", "Quando l'asciugatrice inizia"),
+					whenFalse: t("When the dryer has finished", "Quando l'asciugatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dryer starts", "Quando l'asciugatrice inizia") },
+					onFinished: { phrase: t("When the dryer has finished", "Quando l'asciugatrice ha finito") }
+				}
+			},
+			[DeviceType.Dishwasher]: {
+				state: { running: {
+					whenTrue: t("When the dishwasher starts", "Quando la lavastoviglie inizia"),
+					whenFalse: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dishwasher starts", "Quando la lavastoviglie inizia") },
+					onFinished: { phrase: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito") }
+				}
+			}
+		} }
 	},
 	update: {
 		scope: "device",
@@ -84562,6 +84862,17 @@ var SENSOR_CAP_VOCABULARY = {
 		}],
 		events: { onMotionChanged: { notOperatorFacing: "the `detected` state trigger phrases both edges, from the mirror that survives a dropped event (D49)" } }
 	},
+	meter: {
+		scope: "device",
+		noun: t("Meter", "Contatore"),
+		state: [{
+			kind: "numeric",
+			field: "value",
+			quantity: t("the total", "il totale"),
+			label: t("Total", "Totale"),
+			icon: "gauge"
+		}]
+	},
 	"numeric-sensor": {
 		scope: "device",
 		noun: t("Sensor", "Sensore"),
@@ -85034,8 +85345,47 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+var HA_AS = "a power sensor (device_class power). Home Assistant has no laundry domain. running-state stays unexported until a null reading can be published as unavailable.";
+var HOMEKIT_REASON = "HomeKit has no laundry-appliance service. The export tab would pair an accessory with nothing on it: running-state is withheld until a null reading can be unavailable, and power is not a HomeKit service this export honours.";
+var ALEXA_REASON = "Alexa has no laundry category in this export, and neither power nor running has an Alexa interface.";
+var GOOGLE_REASON = "Google WASHER, DRYER and DISHWASHER require RunCycle. A power threshold is not that trait, and this export does not publish RunCycle.";
+var MATTER_REASON = "No Matter export is built. The closest device types are Laundry Washer (0x0073) and Laundry Dryer (0x0074); a power threshold is not the Laundry Washer Mode cluster.";
+function withheld(reason) {
+	return {
+		[DeviceType.Washer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dryer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dishwasher]: {
+			exported: false,
+			reason
+		}
+	};
+}
+function offered(received) {
+	return {
+		[DeviceType.Washer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dryer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dishwasher]: {
+			exported: true,
+			as: received
+		}
+	};
+}
+offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -86212,6 +86562,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"meter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motion.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -87819,7 +88174,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-DeviceType.Camera;
 /**
 * A saved Customize assignment (D936). The schema is the type: callers use
 * `z.infer`, they do not restate the shape.
@@ -87965,6 +88319,213 @@ var NC_AUDIO_DEFAULTS = {
 	samplingSeconds: 10
 };
 new Set(["devices", "classes"]);
+/** Strip a small, safe subset of Markdown down to plain text. */
+function markdownToText(md) {
+	return md.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/(\*\*|__)(.*?)\1/g, "$2").replace(/(\*|_)(.*?)\1/g, "$2").replace(/`([^`]*)`/g, "$1").replace(/^\s{0,3}#{1,6}\s*/gm, "").replace(/^\s{0,3}>\s?/gm, "").replace(/^\s{0,3}[-*+]\s+/gm, "").replace(/^\s{0,3}\d+\.\s+/gm, "").trim();
+}
+var HTML_ENTITIES = [
+	[/&nbsp;/g, " "],
+	[/&amp;/g, "&"],
+	[/&lt;/g, "<"],
+	[/&gt;/g, ">"],
+	[/&quot;/g, "\""],
+	[/&#39;/g, "'"]
+];
+/** Strip HTML tags, decode a few entities, map block/br elements to newlines. */
+function htmlToText(html) {
+	let out = html.replace(/<\s*br\s*\/?\s*>/gi, "\n").replace(/<\s*\/\s*(p|div|li|h[1-6])\s*>/gi, "\n").replace(/<[^>]+>/g, "");
+	for (const [re, rep] of HTML_ENTITIES) out = out.replace(re, rep);
+	return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+var HTML_ESCAPES = [
+	[/&/g, "&amp;"],
+	[/</g, "&lt;"],
+	[/>/g, "&gt;"],
+	[/"/g, "&quot;"],
+	[/'/g, "&#39;"]
+];
+function escapeHtml(text) {
+	let out = text;
+	for (const [re, rep] of HTML_ESCAPES) out = out.replace(re, rep);
+	return out;
+}
+/** Plain text → HTML-lite (escape + newlines to <br>). */
+function textToHtml(text) {
+	return escapeHtml(text).replace(/\n/g, "<br>");
+}
+/** Markdown → HTML-lite (bold/italic/code/links; used e.g. for Pushover). */
+function markdownToHtmlLite(md) {
+	return escapeHtml(md).replace(/(\*\*|__)(.*?)\1/g, "<b>$2</b>").replace(/(\*|_)(.*?)\1/g, "<i>$2</i>").replace(/`([^`]*)`/g, "<code>$1</code>").replace(/\[([^\]]*)\]\(([^)]*)\)/g, "<a href=\"$2\">$1</a>").replace(/\n/g, "<br>");
+}
+/**
+* Preference order when the source format is NOT supported — first supported
+* entry wins. Encodes the Apprise-style "degrade DOWN, but preserve rendering
+* where a richer target exists" policy:
+*   - markdown → html (html-lite) before text (strip)
+*   - html     → text before markdown
+*   - text     → markdown before html (text is valid markdown)
+*/
+var DEGRADE_ORDER = {
+	text: [
+		"text",
+		"markdown",
+		"html"
+	],
+	markdown: [
+		"markdown",
+		"html",
+		"text"
+	],
+	html: [
+		"html",
+		"text",
+		"markdown"
+	]
+};
+/**
+* Pick the best target format the kind supports for a given source format.
+*
+* TOLERANT of a source outside the union. `NotificationSchema.format` carries
+* `.default('text')`, but that default only runs where the schema is PARSED —
+* the tRPC router. A cap call arriving from another addon (`ctx.api`) skips
+* that parse, so `format` reaches here `undefined`, and the bare
+* `DEGRADE_ORDER[source]` threw `is not iterable`. That broke the one promise
+* the degrade path makes ("never throws — degradation is reported, never
+* surfaced as an error") and dead-lettered every Notification-Center delivery
+* for a day (2026-07-30). An unknown source degrades like `text`.
+*/
+function resolveFormat(source, supported) {
+	for (const candidate of DEGRADE_ORDER[source] ?? DEGRADE_ORDER.text) if (supported.includes(candidate)) return candidate;
+	return supported[0] ?? "text";
+}
+/** Transcode a body between formats. */
+function transcodeBody(body, from, to) {
+	if (from === to) return body;
+	if (to === "text") {
+		if (from === "markdown") return markdownToText(body);
+		if (from === "html") return htmlToText(body);
+	}
+	if (to === "html") {
+		if (from === "text") return textToHtml(body);
+		if (from === "markdown") return markdownToHtmlLite(body);
+	}
+	if (to === "markdown") {
+		if (from === "text") return body;
+		if (from === "html") return htmlToText(body);
+	}
+	return body;
+}
+function toResolvedLevel(level) {
+	return {
+		id: level.id,
+		ordinal: level.ordinal,
+		...level.flags ? { flags: level.flags } : {},
+		...level.requires ? { requires: level.requires } : {}
+	};
+}
+function resolveLevel(levels, n) {
+	if (levels.length === 0) return null;
+	if (n.level !== void 0) {
+		const explicit = levels.find((l) => l.id === n.level);
+		if (explicit) return toResolvedLevel(explicit);
+	}
+	const withOrdinal = levels.filter((l) => l.ordinal !== null);
+	if (withOrdinal.length === 0) return toResolvedLevel(levels[0]);
+	const priority = n.priority;
+	return toResolvedLevel([...withOrdinal].sort((a, b) => {
+		const da = Math.abs((a.ordinal ?? 0) - priority);
+		const db = Math.abs((b.ordinal ?? 0) - priority);
+		if (da !== db) return da - db;
+		return (b.ordinal ?? 0) - (a.ordinal ?? 0);
+	})[0]);
+}
+function splitBody(body, maxLen) {
+	if (!Number.isFinite(maxLen) || maxLen <= 0 || body.length <= maxLen) return [body];
+	const parts = [];
+	for (let i = 0; i < body.length; i += maxLen) parts.push(body.slice(i, i + maxLen));
+	return parts;
+}
+/**
+* Prepare a canonical notification for one kind. Never throws — degradation is
+* always reported in `renderedAs`, never surfaced as an error.
+*/
+function prepareNotification(caps, n) {
+	const dropped = [];
+	const sourceFormat = n.format;
+	const format = resolveFormat(sourceFormat, caps.format);
+	if (format !== sourceFormat) dropped.push("format");
+	const transcoded = transcodeBody(n.body, sourceFormat, format);
+	const level = resolveLevel(caps.levels, n);
+	const inAttachments = n.attachments ?? [];
+	const attachments = [];
+	for (const att of inAttachments) {
+		if (!caps.attachments.mediaTypes.includes(att.mediaType)) {
+			dropped.push(`attachment:${att.mediaType}`);
+			continue;
+		}
+		if (caps.attachments.mode === "url" && att.url === void 0) {
+			dropped.push("attachment:noUrl");
+			continue;
+		}
+		if (att.bytes !== void 0 && caps.attachments.maxBytes !== void 0 && att.bytes.length > caps.attachments.maxBytes) {
+			dropped.push("attachment:maxBytes");
+			continue;
+		}
+		if (attachments.length >= caps.attachments.max) {
+			dropped.push("attachment:max");
+			continue;
+		}
+		const needsFetch = caps.attachments.mode === "bytes" && att.bytes === void 0 && att.url !== void 0;
+		attachments.push({
+			mediaType: att.mediaType,
+			...att.url !== void 0 ? { url: att.url } : {},
+			...att.bytes !== void 0 ? { bytes: att.bytes } : {},
+			...att.mime !== void 0 ? { mime: att.mime } : {},
+			...att.name !== void 0 ? { name: att.name } : {},
+			needsFetch
+		});
+	}
+	const inActions = n.actions ?? [];
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
+	let clickUrl = null;
+	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
+	else dropped.push("clickUrl");
+	let sound = null;
+	if (n.sound !== void 0) if (caps.sound) sound = n.sound;
+	else dropped.push("sound");
+	let ttl = null;
+	if (n.ttl !== void 0) if (caps.ttl) ttl = n.ttl;
+	else dropped.push("ttl");
+	const tag = n.tag ?? null;
+	const bodyParts = splitBody(transcoded, caps.bodyMaxLen);
+	const truncated = bodyParts.length > 1;
+	const renderedAs = {
+		level: level?.id ?? "",
+		format,
+		attachmentsSent: attachments.length,
+		actionsSent: actions.length,
+		truncated,
+		dropped
+	};
+	return {
+		body: bodyParts[0] ?? "",
+		...n.title !== void 0 ? { title: n.title } : {},
+		format,
+		level,
+		attachments,
+		actions,
+		clickUrl,
+		sound,
+		ttl,
+		tag,
+		bodyParts,
+		renderedAs
+	};
+}
 new Set(NC_LEGACY_SYSTEM_EVENT_KINDS);
 /**
 * Every filter, for the callers that must cover all of them (guards, tests).
@@ -89186,12 +89747,55 @@ var alexaProxyLoginSchema = object({
 	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = auto-detect)"),
 	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
 });
+/** Amazon account used to speak on Echo devices. The session blob is the cookie jar. */
+var alexaSpeakSettingsSchema = object({
+	email: string().default(""),
+	password: string().default("").describe("Amazon password").meta({ secret: true }),
+	region: _enum([
+		"NA",
+		"EU",
+		"FE"
+	]).default("EU"),
+	session: string().default("").describe("Alexa session blob").meta({ secret: true }),
+	targets: array(object({
+		id: string(),
+		name: string(),
+		enabled: boolean(),
+		echoId: string(),
+		mode: _enum(["speak", "announce"]),
+		volume: number(),
+		respectDnd: boolean()
+	})).default([])
+});
+function isRecord$2(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
+function readSpeakSettings(config) {
+	const raw = isRecord$2(config.speak) ? config.speak : {};
+	const region = raw["region"];
+	const targets = raw["targets"];
+	return alexaSpeakSettingsSchema.parse({
+		email: typeof raw["email"] === "string" ? raw["email"] : "",
+		password: typeof raw["password"] === "string" ? raw["password"] : "",
+		session: typeof raw["session"] === "string" ? raw["session"] : "",
+		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
+		...Array.isArray(targets) ? { targets } : {}
+	});
+}
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({
 		proxyHost: "",
 		proxyPort: 3456
+	}),
+	speak: alexaSpeakSettingsSchema.default({
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	})
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
@@ -112965,17 +113569,17 @@ var require_view = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @private
 	*/
 	var debug = require_src$2()("express:view");
-	var path$7 = __require("path");
-	var fs$3 = __require("fs");
+	var path$8 = __require("path");
+	var fs$5 = __require("fs");
 	/**
 	* Module variables.
 	* @private
 	*/
-	var dirname = path$7.dirname;
-	var basename = path$7.basename;
-	var extname = path$7.extname;
-	var join = path$7.join;
-	var resolve = path$7.resolve;
+	var dirname = path$8.dirname;
+	var basename = path$8.basename;
+	var extname = path$8.extname;
+	var join = path$8.join;
+	var resolve = path$8.resolve;
 	/**
 	* Module exports.
 	* @public
@@ -113072,7 +113676,7 @@ var require_view = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function tryStat(path) {
 		debug("stat \"%s\"", path);
 		try {
-			return fs$3.statSync(path);
+			return fs$5.statSync(path);
 		} catch (e) {
 			return;
 		}
@@ -115242,7 +115846,7 @@ var init_types = __esmMin((() => {
 //#region ../../node_modules/send/node_modules/mime/mime.js
 var require_mime = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	__require("path");
-	var fs$2 = __require("fs");
+	var fs$4 = __require("fs");
 	function Mime() {
 		this.types = Object.create(null);
 		this.extensions = Object.create(null);
@@ -115277,7 +115881,7 @@ var require_mime = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	Mime.prototype.load = function(file) {
 		this._loading = file;
 		var map = {};
-		fs$2.readFileSync(file, "ascii").split(/[\r\n]+/).forEach(function(line) {
+		fs$4.readFileSync(file, "ascii").split(/[\r\n]+/).forEach(function(line) {
 			var fields = line.replace(/\s*#.*|^\s*|\s*$/g, "").split(/\s+/);
 			map[fields.shift()] = fields;
 		});
@@ -115553,12 +116157,12 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var escapeHtml = require_escape_html();
 	var etag = require_etag();
 	var fresh = require_fresh();
-	var fs$1 = __require("fs");
+	var fs$3 = __require("fs");
 	var mime = require_mime();
 	var ms = require_ms();
 	var onFinished = require_on_finished();
 	var parseRange = require_range_parser();
-	var path$6 = __require("path");
+	var path$7 = __require("path");
 	var statuses = require_statuses();
 	var Stream = __require("stream");
 	var util$4 = __require("util");
@@ -115566,11 +116170,11 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Path function references.
 	* @private
 	*/
-	var extname = path$6.extname;
-	var join = path$6.join;
-	var normalize = path$6.normalize;
-	var resolve = path$6.resolve;
-	var sep = path$6.sep;
+	var extname = path$7.extname;
+	var join = path$7.join;
+	var normalize = path$7.normalize;
+	var resolve = path$7.resolve;
+	var sep = path$7.sep;
 	/**
 	* Regular expression for identifying a bytes Range header.
 	* @private
@@ -116018,7 +116622,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		var i = 0;
 		var self = this;
 		debug("stat \"%s\"", path);
-		fs$1.stat(path, function onstat(err, stat) {
+		fs$3.stat(path, function onstat(err, stat) {
 			if (err && err.code === "ENOENT" && !extname(path) && path[path.length - 1] !== sep) return next(err);
 			if (err) return self.onStatError(err);
 			if (stat.isDirectory()) return self.redirect(path);
@@ -116029,7 +116633,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (self._extensions.length <= i) return err ? self.onStatError(err) : self.error(404);
 			var p = path + "." + self._extensions[i++];
 			debug("stat \"%s\"", p);
-			fs$1.stat(p, function(err, stat) {
+			fs$3.stat(p, function(err, stat) {
 				if (err) return next(err);
 				if (stat.isDirectory()) return next();
 				self.emit("file", p, stat);
@@ -116053,7 +116657,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			}
 			var p = join(path, self._index[i]);
 			debug("stat \"%s\"", p);
-			fs$1.stat(p, function(err, stat) {
+			fs$3.stat(p, function(err, stat) {
 				if (err) return next(err);
 				if (stat.isDirectory()) return next();
 				self.emit("file", p, stat);
@@ -116072,7 +116676,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	SendStream.prototype.stream = function stream(path, options) {
 		var self = this;
 		var res = this.res;
-		var stream = fs$1.createReadStream(path, options);
+		var stream = fs$3.createReadStream(path, options);
 		this.emit("stream", stream);
 		stream.pipe(res);
 		function cleanup() {
@@ -117512,7 +118116,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var deprecate = require_depd()("express");
 	var flatten = require_array_flatten();
 	var merge = require_utils_merge();
-	var resolve$1 = __require("path").resolve;
+	var resolve$2 = __require("path").resolve;
 	var setPrototypeOf = require_setprototypeof();
 	/**
 	* Module variables.
@@ -117575,7 +118179,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		this.mountpath = "/";
 		this.locals.settings = this.settings;
 		this.set("view", View);
-		this.set("views", resolve$1("views"));
+		this.set("views", resolve$2("views"));
 		this.set("jsonp callback name", "callback");
 		if (env === "production") this.enable("view cache");
 		Object.defineProperty(this, "router", { get: function() {
@@ -119593,7 +120197,7 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var http$3 = __require("http");
 	var isAbsolute = require_utils$2().isAbsolute;
 	var onFinished = require_on_finished();
-	var path$5 = __require("path");
+	var path$6 = __require("path");
 	var statuses = require_statuses();
 	var merge = require_utils_merge();
 	var sign = require_cookie_signature().sign;
@@ -119602,9 +120206,9 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var setCharset = require_utils$2().setCharset;
 	var cookie = require_cookie();
 	var send = require_send();
-	var extname = path$5.extname;
+	var extname = path$6.extname;
 	var mime = send.mime;
-	var resolve = path$5.resolve;
+	var resolve = path$6.resolve;
 	var vary = require_vary();
 	/**
 	* Response prototype.
@@ -120436,7 +121040,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var encodeUrl = require_encodeurl();
 	var escapeHtml = require_escape_html();
 	var parseUrl = require_parseurl();
-	var resolve = __require("path").resolve;
+	var resolve$1 = __require("path").resolve;
 	var send = require_send();
 	var url$6 = __require("url");
 	/**
@@ -120460,7 +121064,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		var setHeaders = opts.setHeaders;
 		if (setHeaders && typeof setHeaders !== "function") throw new TypeError("option setHeaders must be function");
 		opts.maxage = opts.maxage || opts.maxAge || 0;
-		opts.root = resolve(root);
+		opts.root = resolve$1(root);
 		var onDirectory = redirect ? createRedirectDirectoryListener() : createNotFoundDirectoryListener();
 		return function serveStatic(req, res, next) {
 			if (req.method !== "GET" && req.method !== "HEAD") {
@@ -121586,7 +122190,7 @@ var require_has_flag = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/supports-color/index.js
 var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var tty$1 = __require("tty");
 	var hasFlag = require_has_flag();
 	var { env } = process;
@@ -121622,7 +122226,7 @@ var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 		const min = forceColor || 0;
 		if (env.TERM === "dumb") return min;
 		if (process.platform === "win32") {
-			const osRelease = os$2.release().split(".");
+			const osRelease = os$3.release().split(".");
 			if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 			return 1;
 		}
@@ -124129,7 +124733,7 @@ var require_braces = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$4 = __require("path");
+	var path$5 = __require("path");
 	var WIN_SLASH = "\\\\/";
 	var WIN_NO_SLASH = `[^${WIN_SLASH}]`;
 	var DEFAULT_MAX_EXTGLOB_RECURSION = 0;
@@ -124254,7 +124858,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		CHAR_UNDERSCORE: 95,
 		CHAR_VERTICAL_LINE: 124,
 		CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279,
-		SEP: path$4.sep,
+		SEP: path$5.sep,
 		/**
 		* Create EXTGLOB_CHARS
 		*/
@@ -124298,7 +124902,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/utils.js
 var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
-	var path$3 = __require("path");
+	var path$4 = __require("path");
 	var win32 = process.platform === "win32";
 	var { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants();
 	exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
@@ -124318,7 +124922,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
 	};
 	exports.isWindows = (options) => {
 		if (options && typeof options.windows === "boolean") return options.windows;
-		return win32 === true || path$3.sep === "\\";
+		return win32 === true || path$4.sep === "\\";
 	};
 	exports.escapeLast = (input, char, lastIdx) => {
 		const idx = input.lastIndexOf(char, lastIdx);
@@ -125688,7 +126292,7 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/picomatch.js
 var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$2 = __require("path");
+	var path$3 = __require("path");
 	var scan = require_scan();
 	var parse = require_parse();
 	var utils = require_utils();
@@ -125827,7 +126431,7 @@ var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
-		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$2.basename(input));
+		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$3.basename(input));
 	};
 	/**
 	* Returns true if **any** of the given glob `patterns` match the specified `string`.
@@ -126912,8 +127516,8 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var proxy = require_dist().createProxyMiddleware;
 	var querystring$2 = __require("querystring");
 	var cookieTools = require_cookie$1();
-	var fs = __require("fs");
-	var path$1 = __require("path");
+	var fs$2 = __require("fs");
+	var path$2 = __require("path");
 	var crypto$1 = __require("crypto");
 	var FORMERDATA_STORE_VERSION = 4;
 	function addCookies(Cookie, headers) {
@@ -126944,11 +127548,11 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function initAmazonProxy(_options, callbackCookie, callbackListening) {
 		const initialCookies = {};
-		const formerDataStorePath = _options.formerDataStorePath || path$1.join(__dirname, "formerDataStore.json");
+		const formerDataStorePath = _options.formerDataStorePath || path$2.join(__dirname, "formerDataStore.json");
 		let formerDataStoreValid = false;
 		if (!_options.formerRegistrationData) try {
-			if (fs.existsSync(formerDataStorePath)) {
-				const formerDataStore = JSON.parse(fs.readFileSync(path$1.join(__dirname, "formerDataStore.json"), "utf8"));
+			if (fs$2.existsSync(formerDataStorePath)) {
+				const formerDataStore = JSON.parse(fs$2.readFileSync(path$2.join(__dirname, "formerDataStore.json"), "utf8"));
 				if (typeof formerDataStore === "object" && formerDataStore.storeVersion === FORMERDATA_STORE_VERSION) {
 					_options.formerRegistrationData = _options.formerRegistrationData || {};
 					_options.formerRegistrationData.frc = _options.formerRegistrationData.frc || formerDataStore.frc;
@@ -126989,7 +127593,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				"map-md": initialCookies["map-md"],
 				"frc": initialCookies.frc
 			};
-			fs.writeFileSync(formerDataStorePath, JSON.stringify(formerDataStore), "utf8");
+			fs$2.writeFileSync(formerDataStorePath, JSON.stringify(formerDataStore), "utf8");
 		} catch (_err) {}
 		function base64URLEncode(str) {
 			return str.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -127199,7 +127803,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var https$1 = __require("https");
 	var querystring$1 = __require("querystring");
 	var url = __require("url");
-	var os$1 = __require("os");
+	var os$2 = __require("os");
 	var cookieTools = require_cookie$1();
 	var amazonProxy = require_proxy();
 	var defaultAmazonPage = "amazon.de";
@@ -127312,7 +127916,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				else if (amazonDomain !== "com") _options.baseAmazonPageHandle = "";
 				else _options.baseAmazonPageHandle = "";
 			}
-			if (!_options.userAgent) if (os$1.platform() === "win32") _options.userAgent = defaultUserAgent;
+			if (!_options.userAgent) if (os$2.platform() === "win32") _options.userAgent = defaultUserAgent;
 			else _options.userAgent = defaultUserAgentLinux;
 			_options.logger && _options.logger(`Alexa-Cookie: Use as User-Agent: ${_options.userAgent}`);
 			_options.acceptLanguage = _options.acceptLanguage || defaultAcceptLanguage;
@@ -127836,7 +128440,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var https = __require("https");
 	var querystring = __require("querystring");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var extend = require_extend();
 	var AlexaHttp2Push = require_alexa_http2push();
 	var { v1: uuidv1 } = require_cjs();
@@ -127981,7 +128585,7 @@ var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		init(cookie, callback) {
 			if (typeof cookie === "object") {
 				this._options = cookie;
-				if (!this._options.userAgent) if (os.platform() === "win32") this._options.userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
+				if (!this._options.userAgent) if (os$1.platform() === "win32") this._options.userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
 				else this._options.userAgent = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
 				if (this._options.apiUserAgentPostfix === void 0) this._options.apiUserAgentPostfix = `AlexaRemote/${__require(fsPath.join(__dirname, "package.json")).version}`;
 				this._options.amazonPage = this._options.amazonPage || "amazon.de";
@@ -132679,13 +133283,1365 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+var OTP_ALERT_ID = "import-alexa.speak-otp-required";
+var ALEXA_REGIONS = [
+	"NA",
+	"EU",
+	"FE"
+];
+//#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string()
+});
+var LoginStatusSchema = _enum([
+	"ok",
+	"otp_needed",
+	"captcha",
+	"failed"
+]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
+//#region src/speak/actions.ts
+var SpeakStatusSchema = object({
+	phase: _enum([
+		"sign-in",
+		"otp",
+		"captcha",
+		"devices"
+	]),
+	email: string(),
+	region: _enum(ALEXA_REGIONS),
+	devices: array(EchoDeviceSchema),
+	session: SessionStatusSchema
+});
+var LoginResultSchema = object({
+	status: LoginStatusSchema,
+	error: string().optional()
+});
+var alexaSpeakActions = defineCustomActions({
+	speakStatus: customAction(object({}), SpeakStatusSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	loginStart: customAction(object({
+		email: string().min(1),
+		password: string().min(1).meta({ secret: true }),
+		region: _enum(ALEXA_REGIONS)
+	}), LoginResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	loginOtp: customAction(object({ code: string().min(1).max(12) }), LoginResultSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	sendTest: customAction(object({
+		echoIds: array(string().min(1)).min(1),
+		mode: _enum(["speak", "announce"]),
+		volume: number().int().min(0).max(100),
+		text: string().min(1).max(450)
+	}), object({ outcomes: array(object({
+		echoId: string(),
+		ok: boolean(),
+		error: string().optional()
+	})) }), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
+//#endregion
+//#region src/speak/otp-alert.ts
+/**
+* A login that needs a new one-time code raises ONE operator alert.
+* Further failures in the same episode do not raise another.
+*/
+function buildOtpAlert(now, reason) {
+	const otp = reason === "otp";
+	return {
+		id: OTP_ALERT_ID,
+		category: EventCategory.AddonError,
+		severity: "error",
+		title: otp ? "Alexa needs a new sign-in code" : "Alexa sign-in needs a captcha",
+		message: otp ? "Amazon asked for a one-time code before Echo devices can speak. Open Alexa → Speak on Echo and enter the code." : "Amazon asked for a captcha. Wait a few minutes, then sign in again on Alexa → Speak on Echo.",
+		action: {
+			label: "Sign in",
+			href: "/addon/import-alexa",
+			navigation: "app"
+		},
+		status: "active",
+		read: false,
+		createdAt: now,
+		updatedAt: now,
+		source: {
+			type: "addon",
+			id: "import-alexa"
+		},
+		metadata: { episodeKey: reason }
+	};
+}
+var OtpAttention = class {
+	ports;
+	open = null;
+	constructor(ports) {
+		this.ports = ports;
+	}
+	/** First need in an episode emits the alert. A repeat does not. */
+	async needed(reason) {
+		if (this.open !== null) return "already-open";
+		this.open = reason;
+		await this.ports.emit(buildOtpAlert(this.ports.now(), reason));
+		return "raised";
+	}
+	async cleared() {
+		if (this.open === null) return;
+		this.open = null;
+		await this.ports.resolve(OTP_ALERT_ID);
+	}
+};
+//#endregion
+//#region src/speak/rate-limit.ts
+/**
+* Per-Echo admission. A burst is dropped here, not queued: a queue would be
+* minutes of speech long after the event.
+*/
+function emptySpeechLedger() {
+	return { byEcho: {} };
+}
+/**
+* Identical text inside the collapse window is one utterance.
+* A different text inside the gap is refused until the gap elapses.
+* Admitted calls replace that Echo's memory; refusals leave it as it was.
+*/
+function admitSpeech(ledger, echoId, text, now) {
+	const previous = ledger.byEcho[echoId];
+	if (previous !== void 0 && previous.lastText === text && now - previous.lastSpokenAt < 6e4) return {
+		decision: "collapsed",
+		ledger
+	};
+	if (previous !== void 0 && now - previous.lastSpokenAt < 2e4) return {
+		decision: "rate_limited",
+		ledger
+	};
+	return {
+		decision: "admit",
+		ledger: { byEcho: {
+			...ledger.byEcho,
+			[echoId]: {
+				lastSpokenAt: now,
+				lastText: text
+			}
+		} }
+	};
+}
+//#endregion
+//#region src/speak/speech-text.ts
+var ALEXA_SPEECH_CAPS = {
+	attachments: {
+		mediaTypes: [],
+		mode: "url",
+		max: 0
+	},
+	actions: 0,
+	actionIcons: false,
+	levels: [{
+		id: "default",
+		label: "Default",
+		ordinal: 3
+	}],
+	format: ["text"],
+	clickUrl: false,
+	sound: false,
+	ttl: false,
+	bodyMaxLen: 450
+};
+function collapseWhitespace(value) {
+	return value.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+}
+/** Markup that survived the degrade engine must not be read aloud. */
+function toPlainSpeech(value) {
+	return collapseWhitespace(htmlToText(markdownToText(value)));
+}
+/**
+* Title then body, as one sentence, never longer than {@link SPEECH_MAX_CHARS}.
+* An empty result is an empty string — the caller refuses to send it.
+*/
+function speechFromNotification(notification) {
+	const prepared = prepareNotification(ALEXA_SPEECH_CAPS, notification);
+	const title = prepared.title !== void 0 ? toPlainSpeech(prepared.title) : "";
+	const body = toPlainSpeech(prepared.body);
+	const joined = title.length > 0 && body.length > 0 ? `${title}. ${body}` : title || body;
+	const text = joined.length > 450 ? joined.slice(0, 450).trimEnd() : joined;
+	const truncated = prepared.renderedAs.truncated || text.length < joined.length;
+	return {
+		text,
+		renderedAs: {
+			...prepared.renderedAs,
+			truncated,
+			format: "text"
+		}
+	};
+}
+//#endregion
+//#region src/speak/provider.ts
+function quietLogger$1() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function readString(config, key) {
+	const value = config[key];
+	return typeof value === "string" ? value : "";
+}
+function readMode(config) {
+	return config["mode"] === "announce" ? "announce" : "speak";
+}
+function readVolume(config) {
+	const value = config["volume"];
+	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
+	return Math.max(0, Math.min(100, Math.round(value)));
+}
+function respectDnd(config) {
+	return config["respectDnd"] !== false;
+}
+function configSchema() {
+	return { sections: [{
+		id: "echo",
+		title: "Echo",
+		titleKey: "import-alexa:echoTarget.s_echo.title",
+		fields: [
+			{
+				type: "text",
+				key: "echoId",
+				label: "Echo id",
+				labelKey: "import-alexa:echoTarget.s_echo.echoId.label",
+				required: true
+			},
+			{
+				type: "select",
+				key: "mode",
+				label: "Mode",
+				labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+				default: "speak",
+				options: [{
+					value: "speak",
+					label: "Speak (quiet hours apply)"
+				}, {
+					value: "announce",
+					label: "Announce (chime, then speech)"
+				}]
+			},
+			{
+				type: "number",
+				key: "volume",
+				label: "Volume",
+				labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+				min: 0,
+				max: 100,
+				default: 40
+			},
+			{
+				type: "boolean",
+				key: "respectDnd",
+				label: "Respect Do Not Disturb",
+				labelKey: "import-alexa:echoTarget.s_echo.respectDnd.label",
+				default: true
+			}
+		]
+	}] };
+}
+function kindDescriptor() {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		label: "Alexa",
+		icon: "megaphone",
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		supportsDiscovery: true,
+		destinationKeys: ["echoId"],
+		configSchema: configSchema(),
+		caps: {
+			attachments: {
+				mediaTypes: [],
+				mode: "url",
+				max: 0
+			},
+			actions: 0,
+			actionIcons: false,
+			levels: [{
+				id: "default",
+				label: "Default",
+				ordinal: 3
+			}],
+			format: ["text"],
+			clickUrl: false,
+			sound: false,
+			ttl: false,
+			bodyMaxLen: 450
+		}
+	};
+}
+function discoveredFrom(device) {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		suggestedName: device.name.length > 0 ? device.name : device.id,
+		config: {
+			echoId: device.id,
+			mode: "speak",
+			volume: 40,
+			respectDnd: true,
+			family: device.family,
+			deviceKind: device.kind
+		}
+	};
+}
+function createAlexaNotificationProvider(ports) {
+	const logger = ports.logger ?? quietLogger$1();
+	let targets = ports.loadTargets();
+	let ledger = emptySpeechLedger();
+	let deliveries = [];
+	function record(row) {
+		deliveries = [...deliveries, row];
+	}
+	function deviceFor(echoId) {
+		return ports.devices().find((device) => device.id === echoId);
+	}
+	function persist(next) {
+		targets = next;
+		ports.saveTargets(next);
+	}
+	async function deliver(target, notification) {
+		const speech = speechFromNotification(notification);
+		const echoId = readString(target.config, "echoId");
+		const deviceId = notification.deviceId;
+		const tags = deviceId !== void 0 ? { tags: { deviceId } } : {};
+		if (echoId.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error: "target has no echo id"
+			});
+			logger.warn("alexa speak dropped: target has no echo id", {
+				...tags,
+				meta: { targetId: target.id }
+			});
+			return {
+				success: false,
+				error: "target has no echo id",
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (speech.text.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "empty",
+				at: ports.now()
+			});
+			logger.info("alexa speak dropped: empty text", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const device = deviceFor(echoId);
+		if (device !== void 0 && respectDnd(target.config) && device.dnd) {
+			record({
+				targetId: target.id,
+				outcome: "dnd",
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped: do not disturb", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (device !== void 0 && !device.online) {
+			record({
+				targetId: target.id,
+				outcome: "offline",
+				at: ports.now()
+			});
+			logger.info("alexa speak not delivered: echo offline", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: false,
+				error: "echo offline",
+				renderedAs: speech.renderedAs
+			};
+		}
+		const admitted = admitSpeech(ledger, echoId, speech.text, ports.now());
+		ledger = admitted.ledger;
+		if (admitted.decision !== "admit") {
+			record({
+				targetId: target.id,
+				outcome: admitted.decision,
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome: admitted.decision
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const mode = readMode(target.config);
+		try {
+			const outcomes = await ports.speak({
+				mode,
+				targets: [echoId],
+				text: speech.text,
+				volume: readVolume(target.config)
+			});
+			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
+			if (one === void 0 || !one.ok) {
+				const error = one?.error ?? "speak failed";
+				record({
+					targetId: target.id,
+					outcome: "failed",
+					at: ports.now(),
+					error
+				});
+				logger.warn("alexa speak failed", {
+					...tags,
+					meta: {
+						targetId: target.id,
+						echoId,
+						error
+					}
+				});
+				return {
+					success: false,
+					error,
+					renderedAs: speech.renderedAs
+				};
+			}
+			const outcome = mode === "announce" ? "announced" : "spoken";
+			record({
+				targetId: target.id,
+				outcome,
+				at: ports.now()
+			});
+			logger.info("alexa speak delivered", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		} catch (err) {
+			const error = err instanceof Error ? err.message : String(err);
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error
+			});
+			logger.warn("alexa speak failed", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					error
+				}
+			});
+			return {
+				success: false,
+				error,
+				renderedAs: speech.renderedAs
+			};
+		}
+	}
+	return {
+		get deliveries() {
+			return deliveries;
+		},
+		async listTargetKinds() {
+			return [kindDescriptor()];
+		},
+		async listTargets() {
+			return [...targets];
+		},
+		async getTarget(input) {
+			const found = targets.find((target) => target.id === input.targetId);
+			if (found === void 0) throw new Error(`target not found: ${input.targetId}`);
+			return found;
+		},
+		async discoverTargets() {
+			return ports.devices().map(discoveredFrom);
+		},
+		async probeTargetConfig() {
+			return ports.loggedIn() ? {
+				ok: true,
+				resolvedUrl: "alexa://session"
+			} : {
+				ok: false,
+				resolvedUrl: "alexa://session",
+				error: "not signed in"
+			};
+		},
+		async send(input) {
+			const target = targets.find((row) => row.id === input.targetId);
+			if (target === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!target.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(target, input.notification);
+		},
+		async testTarget(input) {
+			const found = targets.find((row) => row.id === input.targetId);
+			if (found === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!found.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(found, input.sample ?? {
+				body: "This is a CamStack test notification.",
+				title: "CamStack",
+				format: "text",
+				priority: 3
+			});
+		},
+		async upsertTarget(input) {
+			const target = {
+				...input.target,
+				addonId: ALEXA_SPEAK_ADDON_ID,
+				kind: ALEXA_SPEAK_KIND
+			};
+			persist([...targets.filter((row) => row.id !== target.id), target]);
+			return target;
+		},
+		async deleteTarget(input) {
+			persist(targets.filter((row) => row.id !== input.targetId));
+		},
+		async setTargetEnabled(input) {
+			persist(targets.map((row) => row.id === input.targetId ? {
+				...row,
+				enabled: input.enabled
+			} : row));
+		}
+	};
+}
+//#endregion
+//#region src/speak/python-paths.ts
+/** Locate bundled `python/alexa_worker.py` from dist/ or from src/ under test. */
+function resolveAlexaWorkerScript(fromModuleUrl = import.meta.url) {
+	const here = dirname(fileURLToPath(fromModuleUrl));
+	const candidates = [
+		join(here, "../python/alexa_worker.py"),
+		join(here, "../../python/alexa_worker.py"),
+		join(here, "../../../python/alexa_worker.py")
+	];
+	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+	throw new Error(`import-alexa: alexa_worker.py not found. Searched:\n${candidates.join("\n")}`);
+}
+process.platform, process.env["SystemRoot"];
+/**
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
+*/
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? userInfo().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
+	return {
+		platform: process.platform,
+		exec: (file, args) => {
+			execFileSync(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
+	};
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	fs$1.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	fs$1.chmodSync(target, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	fs$1.mkdirSync(path$1.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	fs$1.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		fs$1.writeFileSync(tmp, data);
+		fs$1.renameSync(tmp, target);
+	} catch (err) {
+		fs$1.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
+//#region src/speak/secret-file.ts
+/**
+* Hand a password or a saved Amazon session to the Python worker as an
+* owner-only file. The path travels on stdin. The bytes never travel on
+* argv or in the environment, and they are removed when the call settles.
+*/
+var REDACTED = "‹redacted›";
+function decodeSession(sessionB64) {
+	if (sessionB64.length === 0) return Buffer.alloc(0);
+	return Buffer.from(sessionB64, "base64");
+}
+async function readSessionB64(sessionPath) {
+	const bytes = await fs.readFile(sessionPath);
+	if (bytes.length === 0) return "";
+	return bytes.toString("base64");
+}
+/**
+* Create a 0700 directory, write the password and the session 0600, run
+* `body`, then delete the directory whether `body` succeeded or threw.
+* Returns the session file as base64 so the caller can store it in the keychain.
+*/
+async function withSpeakSecretFiles(input, body) {
+	const dir = await fs.mkdtemp(path$1.join(os.tmpdir(), "camstack-alexa-"));
+	const paths = {
+		dir,
+		passwordPath: path$1.join(dir, "password"),
+		sessionPath: path$1.join(dir, "session")
+	};
+	try {
+		restrictDirToOwnerSync(dir);
+		writeOwnerOnlyFileSync(paths.passwordPath, input.password);
+		writeOwnerOnlyFileSync(paths.sessionPath, decodeSession(input.sessionB64));
+		await body(paths);
+		return { sessionB64: await readSessionB64(paths.sessionPath) };
+	} finally {
+		await fs.rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Replace every occurrence of each non-empty secret. Used before a log line is emitted. */
+function scrubSecrets(text, secrets) {
+	let out = text;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		out = out.split(secret).join(REDACTED);
+	}
+	return out;
+}
+//#endregion
+//#region src/speak/setup-flow.ts
+/** Where the next screen is. A failed password stays on sign-in. A failed code stays on the code step. */
+function reduceSetup(phase, event) {
+	if (event.type === "reset") return "sign-in";
+	if (event.status === "ok") return "devices";
+	if (event.status === "otp_needed") return "otp";
+	if (event.status === "captcha") return "captcha";
+	return phase;
+}
+//#endregion
+//#region src/speak/worker-client.ts
+/**
+* One Python process for the life of the addon. Requests are one JSON line
+* on stdin; responses are one JSON line on stdout, matched by id.
+* A crash restarts the process until the same bound CrashSupervisor uses,
+* then requests fail instead of looping.
+*/
+/** Pure: a new timestamp list, never a mutated one. */
+function recordWorkerCrash(times, now, windowMs, maxCrashes) {
+	const cutoff = now - windowMs;
+	const recent = [...times.filter((t) => t >= cutoff), now];
+	if (recent.length >= maxCrashes) return {
+		action: "failed",
+		times: recent
+	};
+	return {
+		action: "respawn",
+		times: recent
+	};
+}
+function quietLogger() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function wrapChild(child) {
+	const stdin = child.stdin;
+	const stdout = child.stdout;
+	const stderr = child.stderr;
+	if (stdin === null || stdout === null || stderr === null) throw new Error("alexa worker spawn did not provide pipes");
+	return {
+		stdin: { write(chunk) {
+			stdin.write(chunk);
+		} },
+		stdout: { on(event, listener) {
+			stdout.on(event, listener);
+		} },
+		stderr: { on(event, listener) {
+			stderr.on(event, listener);
+		} },
+		on(event, listener) {
+			if (event === "close") child.on("close", listener);
+			else child.on("error", listener);
+		},
+		kill(signal) {
+			child.kill(signal);
+		}
+	};
+}
+function defaultSpawn(pythonPath, scriptPath, env) {
+	return wrapChild(spawn(pythonPath, [scriptPath], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		env
+	}));
+}
+function startAlexaWorker(deps) {
+	const logger = deps.logger ?? quietLogger();
+	const now = deps.now ?? (() => Date.now());
+	const schedule = deps.schedule ?? ((fn, delayMs) => {
+		setTimeout(fn, delayMs);
+	});
+	const spawnChild = deps.spawnChild ?? defaultSpawn;
+	const maxCrashes = deps.maxCrashes ?? 5;
+	const windowMs = deps.windowMs ?? 6e4;
+	const env = deps.env ?? process.env;
+	let child = null;
+	let buffer = "";
+	let nextId = 1;
+	let stopped = false;
+	let failed = false;
+	let crashTimes = [];
+	let secrets = [];
+	let pending = null;
+	const queue = [];
+	function scrub(text) {
+		return scrubSecrets(text, secrets);
+	}
+	function failPending(err) {
+		const current = pending;
+		pending = null;
+		current?.reject(err);
+	}
+	function attach(spawned) {
+		child = spawned;
+		buffer = "";
+		let settled = false;
+		const finish = (code) => {
+			if (settled || child !== spawned) return;
+			settled = true;
+			onExit(code);
+		};
+		spawned.stdout.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (line.trim().length === 0) continue;
+				acceptLine(line);
+			}
+		});
+		spawned.stderr.on("data", (chunk) => {
+			const text = scrub(chunk.toString("utf8")).trim();
+			if (text.length === 0) return;
+			logger.warn("alexa worker stderr", { meta: { text: text.slice(0, 500) } });
+		});
+		spawned.on("error", (err) => {
+			logger.warn("alexa worker spawn error", { meta: { error: scrub(err.message) } });
+			finish(null);
+		});
+		spawned.on("close", (code) => {
+			finish(code);
+		});
+	}
+	function acceptLine(line) {
+		let parsed;
+		try {
+			parsed = JSON.parse(line);
+		} catch (err) {
+			logger.warn("alexa worker non-JSON line", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return;
+		}
+		const checked = WorkerLineSchema.safeParse(parsed);
+		if (!checked.success) {
+			logger.warn("alexa worker line failed schema", { meta: { error: checked.error.message } });
+			return;
+		}
+		const message = checked.data;
+		if (pending === null || pending.id !== message.id) {
+			logger.warn("alexa worker line for an unknown request", { meta: { id: message.id } });
+			return;
+		}
+		const current = pending;
+		pending = null;
+		if (message.ok) current.resolve(message.result);
+		else current.reject(new Error(scrub(message.error)));
+		pump();
+	}
+	function onExit(code) {
+		child = null;
+		if (stopped) {
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			return;
+		}
+		failPending(/* @__PURE__ */ new Error(`alexa worker exited (${code ?? "null"})`));
+		const decision = recordWorkerCrash(crashTimes, now(), windowMs, maxCrashes);
+		crashTimes = decision.times;
+		if (decision.action === "failed") {
+			failed = true;
+			logger.error("alexa worker restart bound reached", { meta: { crashes: crashTimes.length } });
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+			return;
+		}
+		logger.warn("alexa worker exited; restarting", { meta: {
+			code,
+			crashes: crashTimes.length
+		} });
+		schedule(() => {
+			if (stopped || failed) return;
+			launch();
+			pump();
+		}, Math.min(3e4, 500 * 2 ** Math.min(6, crashTimes.length - 1)));
+	}
+	function launch() {
+		if (stopped || failed) return;
+		attach(spawnChild(deps.pythonPath, deps.scriptPath, env));
+	}
+	function pump() {
+		if (pending !== null || child === null || failed || stopped) return;
+		const next = queue.shift();
+		if (next === void 0) return;
+		pending = next.pending;
+		child.stdin.write(requestLine(next.pending.id, next.request));
+	}
+	function request(body) {
+		if (failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+		if (stopped) return Promise.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		const id = String(nextId);
+		nextId += 1;
+		return new Promise((resolve, reject) => {
+			queue.push({
+				request: body,
+				pending: {
+					id,
+					resolve,
+					reject
+				}
+			});
+			if (child === null) launch();
+			pump();
+		});
+	}
+	return {
+		request,
+		noteSecrets(next) {
+			secrets = [...next];
+		},
+		stop() {
+			stopped = true;
+			const current = child;
+			child = null;
+			current?.kill("SIGTERM");
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		},
+		get failed() {
+			return failed;
+		},
+		get crashesInWindow() {
+			return crashTimes.length;
+		}
+	};
+}
+//#endregion
+//#region src/speak/controller.ts
+/**
+* Owns the one Python worker, the keychain session, the Echo cache and the
+* notification provider. A login that needs a code raises one alert.
+*/
+function targetsFrom(settings) {
+	return settings.targets.map((row) => ({
+		id: row.id,
+		name: row.name,
+		kind: ALEXA_SPEAK_KIND,
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		enabled: row.enabled,
+		config: {
+			echoId: row.echoId,
+			mode: row.mode,
+			volume: row.volume,
+			respectDnd: row.respectDnd
+		}
+	}));
+}
+function withTargets(settings, targets) {
+	return {
+		...settings,
+		targets: targets.map((target) => ({
+			id: target.id,
+			name: target.name,
+			enabled: target.enabled,
+			echoId: typeof target.config["echoId"] === "string" ? target.config["echoId"] : "",
+			mode: target.config["mode"] === "announce" ? "announce" : "speak",
+			volume: typeof target.config["volume"] === "number" ? target.config["volume"] : 40,
+			respectDnd: target.config["respectDnd"] !== false
+		}))
+	};
+}
+function usablePassword(value) {
+	if (value.length === 0 || isSecretMarker(value)) return "";
+	return value;
+}
+var AlexaSpeakController = class {
+	host;
+	provider;
+	settings;
+	worker = null;
+	devices = [];
+	phase = "sign-in";
+	timer = null;
+	attention;
+	now;
+	constructor(host) {
+		this.host = host;
+		this.now = host.now ?? (() => Date.now());
+		this.settings = readSpeakSettings(host.readConfig());
+		this.phase = this.settings.session.length > 0 ? "devices" : "sign-in";
+		this.attention = new OtpAttention({
+			now: this.now,
+			emit: (alert) => host.emitAlert(alert),
+			resolve: (id) => host.resolveAlert(id)
+		});
+		this.provider = createAlexaNotificationProvider({
+			devices: () => this.devices,
+			loggedIn: () => this.phase === "devices",
+			now: this.now,
+			logger: host.logger,
+			loadTargets: () => targetsFrom(this.settings),
+			saveTargets: (targets) => {
+				this.settings = withTargets(this.settings, targets);
+				this.persist();
+			},
+			speak: (command) => this.utter(command.mode, command.targets, command.text, command.volume)
+		});
+	}
+	async start() {
+		const pythonPath = await this.host.ensurePython();
+		if (pythonPath === null) {
+			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
+			return;
+		}
+		this.worker = startAlexaWorker({
+			pythonPath,
+			scriptPath: resolveAlexaWorkerScript(),
+			logger: this.host.logger,
+			now: this.now
+		});
+		this.noteSecrets();
+		if (this.settings.session.length > 0) await this.loginWithFiles().catch((err) => {
+			this.host.logger.warn("alexa speak: stored session did not restore", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+		this.timer = setInterval(() => {
+			this.refreshDevices();
+		}, DEVICE_REFRESH_MS);
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+		this.worker?.stop();
+		this.worker = null;
+	}
+	handlers() {
+		return {
+			speakStatus: async () => this.status(),
+			loginStart: async (input) => {
+				this.settings = {
+					...this.settings,
+					email: input.email,
+					password: input.password,
+					region: input.region
+				};
+				await this.persist();
+				this.noteSecrets();
+				return this.loginWithFiles();
+			},
+			loginOtp: async (input) => this.otpWithFiles(input.code),
+			sendTest: async (input) => this.sendTest(input)
+		};
+	}
+	noteSecrets() {
+		const password = usablePassword(this.settings.password);
+		this.worker?.noteSecrets(password.length > 0 ? [password] : []);
+	}
+	async persist() {
+		try {
+			await this.host.writeSpeak(this.settings);
+		} catch (err) {
+			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	workerRequest(request) {
+		const worker = this.worker;
+		if (worker === null || worker.failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker is not running"));
+		return worker.request(request);
+	}
+	async loginWithFiles() {
+		let outcome = {
+			status: "failed",
+			error: "alexa worker is not running"
+		};
+		const held = await withSpeakSecretFiles({
+			password: usablePassword(this.settings.password),
+			sessionB64: this.settings.session
+		}, async (paths) => {
+			outcome = await this.applyLogin(await this.loginRequest(paths));
+		});
+		if (held.sessionB64 !== this.settings.session) {
+			this.settings = {
+				...this.settings,
+				session: held.sessionB64
+			};
+			await this.persist();
+		}
+		return outcome;
+	}
+	async otpWithFiles(code) {
+		let outcome = {
+			status: "failed",
+			error: "alexa worker is not running"
+		};
+		const held = await withSpeakSecretFiles({
+			password: "",
+			sessionB64: this.settings.session
+		}, async (paths) => {
+			outcome = await this.applyLogin(await this.workerRequest({
+				op: "login_otp",
+				code,
+				sessionPath: paths.sessionPath
+			}));
+		});
+		if (held.sessionB64 !== this.settings.session) {
+			this.settings = {
+				...this.settings,
+				session: held.sessionB64
+			};
+			await this.persist();
+		}
+		return outcome;
+	}
+	loginRequest(paths) {
+		return this.workerRequest({
+			op: "login_start",
+			email: this.settings.email,
+			passwordPath: paths.passwordPath,
+			sessionPath: paths.sessionPath,
+			region: this.settings.region
+		});
+	}
+	async applyLogin(raw) {
+		const outcome = parseLoginResult(raw);
+		this.phase = reduceSetup(this.phase, {
+			type: "login",
+			status: outcome.status
+		});
+		if (outcome.status === "otp_needed") await this.attention.needed("otp");
+		else if (outcome.status === "captcha") await this.attention.needed("captcha");
+		else if (outcome.status === "ok") {
+			await this.attention.cleared();
+			await this.refreshDevices();
+		}
+		return outcome;
+	}
+	async refreshDevices() {
+		if (this.worker === null || this.phase !== "devices") return;
+		try {
+			this.devices = [...parseDevices(await this.workerRequest({ op: "devices" }))];
+		} catch (err) {
+			this.host.logger.warn("alexa speak: device refresh failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	async utter(mode, targets, text, volume) {
+		const op = mode === "announce" ? "announce" : "speak";
+		return parseDeliveries(await this.workerRequest({
+			op,
+			targets,
+			text,
+			volume
+		}));
+	}
+	async session() {
+		if (this.worker === null) return {
+			loggedIn: false,
+			ageSec: 0,
+			lastSuccessAt: null
+		};
+		try {
+			return parseSessionStatus(await this.workerRequest({ op: "session_status" }));
+		} catch {
+			return {
+				loggedIn: this.phase === "devices",
+				ageSec: 0,
+				lastSuccessAt: null
+			};
+		}
+	}
+	async status() {
+		return {
+			phase: this.phase,
+			email: this.settings.email,
+			region: this.settings.region,
+			devices: [...this.devices],
+			session: await this.session()
+		};
+	}
+	async sendTest(input) {
+		const outcomes = await this.utter(input.mode, input.echoIds, input.text, input.volume);
+		const known = new Map(this.devices.map((device) => [device.id, device]));
+		const next = [...targetsFrom(this.settings)];
+		for (const echoId of input.echoIds) {
+			if (next.some((row) => row.config["echoId"] === echoId)) continue;
+			const device = known.get(echoId);
+			next.push({
+				id: `echo-${echoId}`,
+				name: device?.name ?? echoId,
+				kind: ALEXA_SPEAK_KIND,
+				addonId: ALEXA_SPEAK_ADDON_ID,
+				enabled: true,
+				config: {
+					echoId,
+					mode: input.mode,
+					volume: input.volume,
+					respectDnd: true
+				}
+			});
+		}
+		this.settings = withTargets(this.settings, next);
+		await this.persist();
+		return { outcomes: outcomes.map((row) => ({
+			echoId: row.targetId,
+			ok: row.ok,
+			...row.error !== void 0 ? { error: row.error } : {}
+		})) };
+	}
+};
+//#endregion
 //#region src/addon.ts
+var SPEAK_PAGE = {
+	id: "speak",
+	label: "Speak on Echo",
+	icon: "megaphone",
+	path: "/addon/import-alexa",
+	remoteName: "addon_import_alexa_page",
+	bundle: "remoteEntry.js",
+	section: "administration"
+};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: {
 		proxyHost: "",
 		proxyPort: 3456
+	},
+	speak: {
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	}
 };
 /** Device types an imported Alexa appliance can materialise as. */
@@ -132727,6 +134683,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	proxyLogin = null;
 	brokerStore = null;
 	activeBrokers = [];
+	speak = null;
+	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -132780,21 +134738,62 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			proxyLogin: this.proxyLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
 		});
-		return [
-			...regs,
-			{
-				capability: brokerCapability,
-				provider: this.buildBrokerProvider()
+		const speak = new AlexaSpeakController({
+			logger: this.ctx.logger.child("speak"),
+			readConfig: () => this.config,
+			writeSpeak: async (next) => {
+				await this.updateGlobalSettings({ speak: next });
 			},
-			{
-				capability: deviceAdoptionCapability,
-				provider: this.buildAdoptionProvider()
+			emitAlert: async (alert) => {
+				const emit = this.ctx.api.alerts?.emit;
+				if (emit === void 0) {
+					this.ctx.logger.warn("alexa speak: OTP alert skipped — alerts capability missing");
+					return;
+				}
+				await emit.mutate(alert);
 			},
-			{
-				capability: addonRoutesCapability,
-				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-			}
-		];
+			resolveAlert: async (alertId) => {
+				const dismiss = this.ctx.api.alerts?.dismiss;
+				if (dismiss === void 0) return;
+				await dismiss.mutate({ alertId });
+			},
+			ensurePython: () => this.ctx.deps.ensurePython()
+		});
+		this.speak = speak;
+		speak.start().catch((err) => {
+			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+		const pages = {
+			id: this.addonId,
+			listPages: () => [SPEAK_PAGE]
+		};
+		return {
+			providers: [
+				...regs,
+				{
+					capability: brokerCapability,
+					provider: this.buildBrokerProvider()
+				},
+				{
+					capability: deviceAdoptionCapability,
+					provider: this.buildAdoptionProvider()
+				},
+				{
+					capability: addonRoutesCapability,
+					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+				},
+				{
+					capability: notificationOutputCapability,
+					provider: speak.provider
+				},
+				{
+					capability: addonPagesSourceCapability,
+					provider: pages
+				}
+			],
+			customActions: alexaSpeakActions,
+			actionHandlers: speak.handlers()
+		};
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -132859,6 +134858,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		}
 	}
 	async onShutdown() {
+		this.speak?.stop();
+		this.speak = null;
 		alexaCommands.clear();
 		try {
 			await this.proxyLogin?.dispose();
@@ -133093,43 +135094,90 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 	}
 	globalSettingsSchema() {
-		return this.schema({ sections: [{
-			id: "alexa-account",
-			title: "Amazon Alexa account",
-			titleKey: "import-alexa:globalSettings.s_alexa-account.title",
-			description: "Alexa accounts are managed in the External systems → Brokers tab.",
-			descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
-			columns: 1,
-			fields: [{
-				type: "info",
-				key: "accountHelp",
-				label: "Accounts are managed separately",
-				labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
-				content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
-			}]
-		}, {
-			id: "alexa-proxy-login",
-			title: "Interactive login (proxy)",
-			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-			description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
-			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
-			columns: 2,
-			fields: [{
-				type: "text",
-				key: "proxyLogin.proxyHost",
-				label: "Login proxy host/IP (blank = auto-detect)",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
-				placeholder: "auto-detect"
-			}, {
-				type: "number",
-				key: "proxyLogin.proxyPort",
-				label: "Login proxy port",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
-				min: 1,
-				max: 65535,
-				default: 3456
-			}]
-		}] });
+		return this.schema({ sections: [
+			{
+				id: "alexa-account",
+				title: "Amazon Alexa account",
+				titleKey: "import-alexa:globalSettings.s_alexa-account.title",
+				description: "Alexa accounts are managed in the External systems → Brokers tab.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
+				columns: 1,
+				fields: [{
+					type: "info",
+					key: "accountHelp",
+					label: "Accounts are managed separately",
+					labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
+					content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
+				}]
+			},
+			{
+				id: "alexa-proxy-login",
+				title: "Interactive login (proxy)",
+				titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
+				description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
+				columns: 2,
+				fields: [{
+					type: "text",
+					key: "proxyLogin.proxyHost",
+					label: "Login proxy host/IP (blank = auto-detect)",
+					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
+					placeholder: "auto-detect"
+				}, {
+					type: "number",
+					key: "proxyLogin.proxyPort",
+					label: "Login proxy port",
+					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
+					min: 1,
+					max: 65535,
+					default: 3456
+				}]
+			},
+			{
+				id: "alexa-speak",
+				title: "Speak on Echo",
+				titleKey: "import-alexa:globalSettings.s_alexa-speak.title",
+				description: "Sign in on the Speak on Echo page, pick the devices, and use them as a notification target. The text is the rule template, read aloud.",
+				descriptionKey: "import-alexa:globalSettings.s_alexa-speak.description",
+				columns: 1,
+				fields: [
+					{
+						type: "text",
+						key: "speak.email",
+						label: "Amazon email",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_email.label",
+						inputType: "email"
+					},
+					{
+						type: "password",
+						key: "speak.password",
+						label: "Amazon password",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_password.label"
+					},
+					{
+						type: "select",
+						key: "speak.region",
+						label: "Region",
+						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_region.label",
+						default: "EU",
+						options: [
+							{
+								value: "NA",
+								label: "North America"
+							},
+							{
+								value: "EU",
+								label: "Europe"
+							},
+							{
+								value: "FE",
+								label: "Far East"
+							}
+						]
+					}
+				]
+			}
+		] });
 	}
 	async supportsManualCreation() {
 		return false;
@@ -133163,4 +135211,4 @@ function capsEqual(a, b) {
 	return true;
 }
 //#endregion
-export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };
+export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, alexaSpeakActions as customActions, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };