@camstack/addon-import-alexa 0.2.148 → 0.2.150

package/dist/addon.mjs

@@ -1,8 +1,15 @@
 import { createRequire } from "node:module";
 import { randomBytes } from "node:crypto";
-import { networkInterfaces } from "node:os";
-import { promises } from "node:fs";
-import path from "node:path";
+import * as os from "node:os";
+import { networkInterfaces, userInfo } from "node:os";
+import * as fs from "node:fs";
+import { existsSync, promises } from "node:fs";
+import * as path$1 from "node:path";
+import path, { dirname, join } from "node:path";
+import * as fs$1 from "node:fs/promises";
+import { execFileSync, spawn } from "node:child_process";
+import "node:zlib";
+import { fileURLToPath } from "node:url";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -5614,7 +5621,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-bykKrTgu.mjs
+//#region ../types/dist/sleep--jXS9hWo.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -8852,6 +8859,28 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
+/**
+* Identity — preserves literal types for downstream inference.
+*
+* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
+* TypeScript does not widen each entry's literal `kind`/`auth` fields to
+* the broader unions declared on `CustomActionSpec`'s default generics.
+* Shape validity is enforced separately by the `customAction(...)` helper
+* whose return type is already a `CustomActionSpec<...>`.
+*/
+function defineCustomActions(spec) {
+	return spec;
+}
+function customAction(input, output, options) {
+	return {
+		input,
+		output,
+		kind: options?.kind ?? "query",
+		auth: options?.auth ?? "protected",
+		scope: options?.scope ?? { kind: "system" },
+		...options?.caller ? { caller: "required" } : {}
+	};
+}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -8995,6 +9024,7 @@ var CAP_NAMES = Object.freeze([
 	"filesystem-browse",
 	"flood",
 	"gas",
+	"group-active",
 	"group-commands",
 	"group-status",
 	"heating-valve",
@@ -9017,6 +9047,7 @@ var CAP_NAMES = Object.freeze([
 	"login-method",
 	"media-player",
 	"mesh-network",
+	"meter",
 	"metrics-provider",
 	"model-convert",
 	"model-distributor",
@@ -9815,6 +9846,10 @@ Object.freeze({
 		"path": "detected",
 		"valueType": "boolean"
 	}],
+	"group-active": [{
+		"path": "active",
+		"valueType": "boolean"
+	}],
 	"group-status": [
 		{
 			"path": "included",
@@ -10074,6 +10109,10 @@ Object.freeze({
 			]
 		}
 	],
+	"meter": [{
+		"path": "value",
+		"valueType": "number"
+	}],
 	"motion": [
 		{
 			"path": "detected",
@@ -10817,7 +10856,7 @@ object({
 	params: record(string(), union([string(), number()])).optional()
 });
 //#endregion
-//#region ../types/dist/err-msg-BXKzRBwg.mjs
+//#region ../types/dist/err-msg-DIorGYeC.mjs
 var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["Camera"] = "camera";
 	DeviceType["Hub"] = "hub";
@@ -10911,8 +10950,14 @@ var DeviceType = /* @__PURE__ */ function(DeviceType) {
 	DeviceType["PetFeeder"] = "pet-feeder";
 	/** Built-in dishwasher — program lifecycle, door / remote-start gates,
 	*  salt and rinse-aid levels. Installed with the `dishwasher` cap.
-	*  Sources: native Bosch Home Connect, reusable by similar integrations. */
+	*  Sources: native Bosch Home Connect, reusable by similar integrations.
+	*  A plug-built dishwasher carries running-state and power instead. */
 	DeviceType["Dishwasher"] = "dishwasher";
+	/** Washing machine. A plug-built one is running while its power stays
+	*  above a threshold. No program cap — that surface is the dishwasher's. */
+	DeviceType["Washer"] = "washer";
+	/** Tumble dryer. Same plug-built running surface as {@link Washer}. */
+	DeviceType["Dryer"] = "dryer";
 	return DeviceType;
 }({});
 var DeviceFeature = /* @__PURE__ */ function(DeviceFeature) {
@@ -11170,7 +11215,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-OhpuespA.mjs
+//#region ../types/dist/composition-Bb8iwHEJ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11485,6 +11530,13 @@ var table = {
 		apply: () => {
 			throw new ExpressionEvalError("latchedAt: stateful evaluation context is required");
 		}
+	},
+	schmitt: {
+		minArgs: 3,
+		maxArgs: 5,
+		apply: () => {
+			throw new ExpressionEvalError("schmitt: stateful evaluation context is required");
+		}
 	}
 };
 Object.freeze(Object.assign(Object.create(null), table));
@@ -11926,6 +11978,99 @@ function validateExpressionSource(src) {
 	return null;
 }
 /**
+* One power reading becomes a washer, dryer or dishwasher (D944 helper).
+*
+* Standby of the control board is under 5 W; a motor or a heater is far
+* above that, so 5 W is the line. A door lock or a short pump spike is not
+* a cycle, so running starts only after 30 s above the line.
+*
+* A wash, dry or dishwasher pause (soak, heat-wait, heater off between
+* bursts) lasts several minutes. Ending the cycle on the first dip would
+* report "finished" in the middle of the program, so the stop dwell is
+* 10 minutes on every type. The number is stored per type so one machine
+* can move later without moving the others.
+*/
+var APPLIANCE_TEMPLATE_ID = "appliance";
+var APPLIANCE_KINDS = [
+	"washer",
+	"dryer",
+	"dishwasher"
+];
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+/**
+* Statistics and integrals over a history read (D944).
+*
+* Pure: the same points always give the same answer, so a restart recomputes
+* rather than trusting a buffer. A gauge mean is time-weighted (value × ms),
+* never the mean of the samples. A hole with no held value is not integrated
+* as zero. A truncated read is not published.
+*/
+var STATISTIC_STATS = [
+	"min",
+	"max",
+	"mean",
+	"sum",
+	"count",
+	"change"
+];
+/**
+* The range a statistics or integral helper asks history for (D944).
+*
+* Calendar edges are the hub's timezone, never UTC midnight: a day is 23, 24
+* or 25 hours across a DST change. A tier is eligible only when its retention
+* is strictly longer than the longest that range can be. Forever qualifies.
+* Equal to a tier's retention is a refusal, not a short answer.
+*/
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+var ROLLING_SPANS = [
+	"1h",
+	"24h",
+	"2d",
+	"7d",
+	"30d",
+	"custom"
+];
+var CALENDAR_PERIODS = [
+	"today",
+	"yesterday",
+	"this-week",
+	"this-month"
+];
+var RESET_PERIODS = [
+	"never",
+	"daily",
+	"weekly",
+	"monthly"
+];
+5 * MINUTE_MS;
+24 * HOUR_MS, 2 * DAY_MS, 7 * DAY_MS, 30 * DAY_MS;
+7 * DAY_MS, 30 * DAY_MS, 365 * DAY_MS;
+var rollingWindowObject = object({
+	kind: literal("rolling"),
+	span: _enum(ROLLING_SPANS),
+	customMinutes: number().int().min(5).optional()
+}).check((payload) => {
+	if (payload.value.span === "custom" && payload.value.customMinutes === void 0) payload.issues.push({
+		code: "custom",
+		message: "a custom range needs a duration in minutes",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+	if (payload.value.span !== "custom" && payload.value.customMinutes !== void 0) payload.issues.push({
+		code: "custom",
+		message: "only a custom range carries a duration",
+		path: ["customMinutes"],
+		input: payload.value
+	});
+});
+var RollingWindowSchema = rollingWindowObject;
+var StatisticWindowSchema = discriminatedUnion("kind", [rollingWindowObject, object({
+	kind: literal("calendar"),
+	period: _enum(CALENDAR_PERIODS)
+})]);
+/**
 * A composition source identity: `(addonId, stableId)`, never a numeric device
 * id. Split out so helper schemas can name it without a cycle through
 * `composition.ts` (D659).
@@ -11951,7 +12096,13 @@ var GROUP_TEMPLATE_IDS = [
 	"occupancy",
 	"binary",
 	"switch",
-	"light"
+	"light",
+	"fan",
+	"cover",
+	"valve",
+	"lock",
+	"media-player",
+	"climate"
 ];
 var NUMERIC_AGGREGATES = [
 	"mean",
@@ -11981,14 +12132,73 @@ var HelperMemberSchema = object({
 	cap: string().min(1),
 	fieldPath: string().min(1)
 });
-var HelperSpecSchema = discriminatedUnion("kind", [object({
-	kind: literal("group"),
-	templateId: GroupTemplateIdSchema,
-	aggregate: AggregateReducerSchema,
-	members: array(HelperMemberSchema).min(1).max(64),
-	/** Actuator groups only. Readings leave this unset. */
-	active: ActiveCriterionSchema.optional()
-})]);
+var HelperSpecSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("group"),
+		templateId: GroupTemplateIdSchema,
+		aggregate: AggregateReducerSchema,
+		members: array(HelperMemberSchema).min(1).max(64),
+		/** Actuator groups only. Readings leave this unset. */
+		active: ActiveCriterionSchema.optional()
+	}),
+	object({
+		kind: literal("appliance"),
+		templateId: literal(APPLIANCE_TEMPLATE_ID),
+		appliance: _enum(APPLIANCE_KINDS),
+		thresholdWatts: number().positive(),
+		startDwellMs: number().int().nonnegative(),
+		stopDwellMs: number().int().nonnegative(),
+		member: HelperMemberSchema
+	}),
+	object({
+		kind: literal("statistic"),
+		stat: _enum(STATISTIC_STATS),
+		window: StatisticWindowSchema,
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("integral"),
+		reset: _enum(RESET_PERIODS),
+		output: _enum(["energy", "meter"]),
+		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("threshold"),
+		source: HelperMemberSchema,
+		high: number(),
+		low: number(),
+		onForMs: number().int().nonnegative(),
+		offForMs: number().int().nonnegative()
+	}),
+	object({
+		kind: literal("arithmetic"),
+		op: _enum([
+			"sum",
+			"difference",
+			"ratio"
+		]),
+		inputs: array(HelperMemberSchema).min(2).max(64)
+	}),
+	object({
+		kind: literal("expression"),
+		expr: string().min(1),
+		inputs: array(object({
+			name: string().min(1),
+			member: HelperMemberSchema
+		})).min(1).max(64),
+		output: _enum(["number", "boolean"])
+	}),
+	object({
+		kind: literal("derivative"),
+		window: RollingWindowSchema,
+		per: _enum([
+			"second",
+			"minute",
+			"hour"
+		]),
+		source: HelperMemberSchema
+	})
+]);
 /** A composed device's stableId is this prefix plus the block id. */
 var COMPOSED_DEVICE_STABLE_ID_PREFIX = "composed-";
 /** Longest snippet a `code` source may carry (slice 4). */
@@ -12049,6 +12259,12 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"all"
 		]),
 		reads: array(CompositionFieldReadSchema).min(1).max(64),
+		/**
+		* Set when the reads are an enum state, not a yes/no: the listed states
+		* count as active (a cover is `open`). A state outside the list is inactive;
+		* a read that is not a state at all is left out. Only `any` / `all` use it.
+		*/
+		activeWhen: array(string().min(1)).min(1).optional(),
 		/** `value` is the reading; the others are the member counts. */
 		publish: _enum([
 			"value",
@@ -12062,6 +12278,26 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"omit",
 			"offline"
 		])
+	}),
+	object({
+		kind: literal("series"),
+		read: CompositionFieldReadSchema,
+		/** `value` is the statistic or the integral. The others are the gap counts. */
+		publish: _enum([
+			"value",
+			"included",
+			"excluded",
+			"total"
+		]),
+		/**
+		* What an unanswered `value` does. Counts ignore this. `offline` leaves the
+		* device unseeded until history answers, so a restart cannot publish 0.
+		*/
+		empty: _enum([
+			"null",
+			"omit",
+			"offline"
+		])
 	})
 ]);
 var CompositionCommandTargetSchema = discriminatedUnion("kind", [object({
@@ -15822,7 +16058,24 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
+var addonPagesSourceCapability = {
+	name: "addon-pages-source",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	methods: { 
+	/**
+	* `internal: true` did not gate the mount (see the 2026-08-26 note on
+	* `data-store-provider`) — this was reachable on the AppRouter by ANY
+	* authenticated session at the default `auth: 'protected'`. The only
+	* consumer, the `addon-pages-aggregator` builtin, reads it via
+	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
+	* only, never tRPC (per `ctx.capabilities` seeing only the local
+	* process). The public, enriched listing admin-ui actually consumes is
+	* the separate `addon-pages` cap, unaffected by this change.
+	*/
+listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
+};
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -18511,7 +18764,8 @@ var CompositionProblemSchema = object({
 		"native-capability-replace",
 		"mixed-quantity",
 		"helper-mismatch",
-		"member-constraint"
+		"member-constraint",
+		"retention"
 	]),
 	path: string(),
 	message: string()
@@ -18745,13 +18999,17 @@ Object.freeze({
 	latchedAt: {
 		kind: "fixed",
 		result: ["number", "null"]
+	},
+	schmitt: {
+		kind: "fixed",
+		result: ["boolean", "null"]
 	}
 });
 /**
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW = {
+var NOW$2 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -18765,6 +19023,8 @@ function numeric(input) {
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
 		aggregates: NUMERIC_AGGREGATES,
@@ -18780,6 +19040,8 @@ function binary(input) {
 		family: "binary",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		quantity: "none",
 		baseUnit: void 0,
@@ -18797,7 +19059,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "humidity",
@@ -18808,7 +19070,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "pressure",
@@ -18819,7 +19081,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "illuminance",
@@ -18830,7 +19092,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "power",
@@ -18841,7 +19103,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "energy",
@@ -18852,7 +19114,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "battery",
@@ -18887,7 +19149,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW]
+		companions: [NOW$2]
 	}),
 	binary({
 		id: "motion",
@@ -18981,6 +19243,11 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one switch is on, or when all of them are. Offline and unknown members are left out of that decision, never read as off, and still receive the command.",
 		deviceType: DeviceType.Switch,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: ["switch"]
 	}),
 	actuator({
@@ -18988,34 +19255,136 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one light is on, or when all of them are. Brightness and colour are offered only when every member has them. A command is not sent to a member that lacks it.",
 		deviceType: DeviceType.Light,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: [
 			"switch",
 			"brightness",
 			"color"
 		]
+	}),
+	actuator({
+		id: "fan",
+		summary: "On when at least one fan is on, or when all of them are. Speed, preset, direction and oscillation are offered only when every fan has them. A command is not sent to a fan that lacks it.",
+		deviceType: DeviceType.Fan,
+		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
+		commandCaps: ["switch", "fan-control"]
+	}),
+	actuator({
+		id: "cover",
+		summary: "Open when at least one cover is open or part-open, or only when all of them are. Position and tilt are offered only when every cover has them. A cover that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Cover,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "cover",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["cover"]
+	}),
+	actuator({
+		id: "valve",
+		summary: "Open when at least one valve is open or part-open, or only when all of them are. Position is offered only when every valve has it. A valve that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Valve,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "valve",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["valve"]
+	}),
+	actuator({
+		id: "lock",
+		summary: "Locked when at least one lock is locked, or only when all of them are. A jammed or moving lock is not locked. Locking is one tap; unlocking the group needs a confirmation every time, and nothing is sent without it.",
+		deviceType: DeviceType.Lock,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "lock-control",
+			fieldPath: "state"
+		},
+		activeWhen: ["locked"],
+		commandCaps: ["lock-control"]
+	}),
+	actuator({
+		id: "media-player",
+		summary: "Playing when at least one player is playing, or only when all of them are. Volume is offered only when every player has it. A player that reports nothing is left out, never read as stopped.",
+		deviceType: DeviceType.MediaPlayer,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "media-player",
+			fieldPath: "state"
+		},
+		activeWhen: ["playing", "buffering"],
+		commandCaps: ["media-player"]
+	}),
+	actuator({
+		id: "climate",
+		summary: "Running when at least one thermostat or air conditioner is not off, or only when all of them are. Target temperature and fan are offered only when every device has them. A device that reports nothing is left out, never read as off.",
+		deviceType: DeviceType.Thermostat,
+		memberDeviceTypes: [DeviceType.Thermostat, DeviceType.Climate],
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "climate-control",
+			fieldPath: "mode"
+		},
+		activeWhen: [
+			"heat",
+			"cool",
+			"auto",
+			"heat_cool",
+			"fan_only",
+			"dry"
+		],
+		commandCaps: ["climate-control"]
 	})
 ];
 function actuator(input) {
 	return {
-		...input,
+		id: input.id,
+		summary: input.summary,
+		deviceType: input.deviceType,
+		outputCap: input.outputCap,
+		outputField: input.outputField,
+		commandCaps: input.commandCaps,
 		family: "actuator",
 		role: void 0,
 		memberDeviceType: input.deviceType,
-		outputField: "on",
+		memberDeviceTypes: input.memberDeviceTypes ?? [input.deviceType],
+		activeWhen: input.activeWhen,
 		quantity: "none",
 		baseUnit: void 0,
 		aggregates: BINARY_AGGREGATES,
 		defaultAggregate: "any",
 		empty: "offline",
-		accept: [{
-			cap: "switch",
-			fieldPath: "on"
-		}],
+		accept: [input.member],
 		companions: [CHANGED]
 	};
 }
 new Map(GROUP_TEMPLATES.map((template) => [template.id, template]));
 DeviceFeature.LightColorRgb, DeviceFeature.LightColorHsv, DeviceFeature.LightColorMired;
+DeviceType.Camera;
 `${COMPOSED_DEVICE_STABLE_ID_PREFIX}`;
 /**
 * What a composition may BUILD on a device type (G2, D676): the caps a new
@@ -44581,57 +44950,79 @@ var ProbeTargetConfigResultSchema = object({
 	stateInstance: string().optional(),
 	error: string().optional()
 });
-method(object({}), array(TargetKindSchema)), method(object({}), array(TargetSchema), { auth: "admin" }), method(object({ targetId: string() }), TargetSchema, { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()).optional(),
-	/**
-	* When editing / duplicating, the blank password field never round-trips
-	* the stored token. Pass the source target id so the provider can restore
-	* secrets server-side before dialling (same merge as upsert).
-	*/
-	targetId: string().optional()
-}), array(DiscoveredTargetSchema), { auth: "admin" }), method(object({
-	kind: string(),
-	config: record(string(), unknown()),
-	/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
-	targetId: string().optional()
-}), ProbeTargetConfigResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	notification: NotificationSchema
-}), SendResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	sample: NotificationSchema.optional()
-}), TestResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	target: TargetSchema,
-	/**
-	* Duplicate flow: create a NEW target id while copying secrets from an
-	* existing row. The UI never holds the stored token; blank / redacted
-	* password fields are restored from this source (D634 still applies if
-	* destinations diverge without a re-typed secret).
-	*/
-	cloneSecretsFrom: string().optional()
-}), TargetSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({ targetId: string() }), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(object({
-	targetId: string(),
-	enabled: boolean()
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-});
+var notificationOutputCapability = {
+	name: "notification-output",
+	scope: "system",
+	mode: "collection",
+	methods: {
+		listTargetKinds: method(object({}), array(TargetKindSchema)),
+		listTargets: method(object({}), array(TargetSchema), { auth: "admin" }),
+		/**
+		* One target WITH secrets — admin edit / duplicate hydration only.
+		* `listTargets` stays redacted; the editor loads this so password fields
+		* are filled (masked in the input) and a save can round-trip the token
+		* when a destination changes (Duplicate with a new chatId, etc.).
+		*/
+		getTarget: method(object({ targetId: string() }), TargetSchema, { auth: "admin" }),
+		discoverTargets: method(object({
+			kind: string(),
+			config: record(string(), unknown()).optional(),
+			/**
+			* When editing / duplicating, the blank password field never round-trips
+			* the stored token. Pass the source target id so the provider can restore
+			* secrets server-side before dialling (same merge as upsert).
+			*/
+			targetId: string().optional()
+		}), array(DiscoveredTargetSchema), { auth: "admin" }),
+		probeTargetConfig: method(object({
+			kind: string(),
+			config: record(string(), unknown()),
+			/** See `discoverTargets.targetId` — restore stored secrets for a blank password. */
+			targetId: string().optional()
+		}), ProbeTargetConfigResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		send: method(object({
+			targetId: string(),
+			notification: NotificationSchema
+		}), SendResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testTarget: method(object({
+			targetId: string(),
+			sample: NotificationSchema.optional()
+		}), TestResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		upsertTarget: method(object({
+			target: TargetSchema,
+			/**
+			* Duplicate flow: create a NEW target id while copying secrets from an
+			* existing row. The UI never holds the stored token; blank / redacted
+			* password fields are restored from this source (D634 still applies if
+			* destinations diverge without a re-typed secret).
+			*/
+			cloneSecretsFrom: string().optional()
+		}), TargetSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		deleteTarget: method(object({ targetId: string() }), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		setTargetEnabled: method(object({
+			targetId: string(),
+			enabled: boolean()
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		})
+	}
+};
 new Set([
 	{
 		id: "person",
@@ -46926,7 +47317,20 @@ var NcRuleInputSchema = object({
 	* save by the hub's grouping guard). `.optional()`, never `.default()`: the addon cap
 	* path does not run Zod defaults.
 	*/
-	groupingSec: number().int().min(5).max(60).optional()
+	groupingSec: number().int().min(5).max(60).optional(),
+	/**
+	* ASK ME TO CONFIRM DETECTIONS (#243): a DETECTION notification of this rule
+	* carries "Correct" / "Wrong" buttons (and, where the channel has room, a
+	* "Wrong, it is a <class>" choice). A tap marks the track for retraining, the
+	* same mark the Library writes, and records whose notification it was and
+	* when. A channel with no buttons gets the same two choices as links.
+	*
+	* `.optional()`, never `.default()` (a Zod default does not run on the addon
+	* cap path): absent and `false` both mean off, which is what every rule
+	* authored before this field meant. An editor turns it off by writing
+	* `false`, so it needs no `clear` key.
+	*/
+	askVerdict: boolean().optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -60523,7 +60927,17 @@ var groupCommandsCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Switch, DeviceType.Light],
+	deviceTypes: [
+		DeviceType.Switch,
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
+	],
 	methods: {},
 	status: {
 		schema: GroupCommandsSchema,
@@ -60541,6 +60955,49 @@ var groupCommandsCapability = {
 	history: "none"
 };
 /**
+* Whether a helper actuator group counts as active (D944): at least one
+* included member is, or every included member is. What "active" means is the
+* type's: a cover is open, a lock is locked, a media player is playing, a
+* climate device is not off. A group of lights, switches and fans reports
+* `switch.on` instead; this cap is for the types whose own state is not a
+* yes/no. Unknown members are left out (`group-status` counts them) and an
+* empty included set takes the device offline, never `active: false`.
+*/
+var GroupActiveSchema = object({
+	active: boolean().meta({ label: "Active" }),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+var groupActiveCapability = {
+	name: "group-active",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Climate,
+		DeviceType.Thermostat
+	],
+	methods: {},
+	status: {
+		schema: GroupActiveSchema,
+		kind: "push"
+	},
+	runtimeState: GroupActiveSchema,
+	/**
+	* Runtime-state durability: **session** — recomputed from the members on the
+	* next source event; a restored value would outlive the members it named.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
+/**
 * How many members of a helper group answered (D944). Counts are integers,
 * not measurements: zero included is a real count, never a stand-in reading.
 * The reading itself stays on the output capability. History is none — the
@@ -60571,7 +61028,14 @@ var groupStatusCapability = {
 	deviceTypes: [
 		DeviceType.Sensor,
 		DeviceType.Switch,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
 	],
 	methods: {},
 	status: {
@@ -61844,7 +62308,14 @@ var lockControlCapability = {
 		}),
 		unlock: method(object({
 			deviceId: number().int().nonnegative(),
-			code: string().min(1).optional()
+			code: string().min(1).optional(),
+			/**
+			* Honoured by a helper lock GROUP only (D944): unlocking several doors
+			* with one call is refused unless the caller says it was confirmed. A
+			* single lock ignores it. The refusal lives in the callee, so no
+			* automation or API caller reaches the doors by skipping a dialog.
+			*/
+			confirm: boolean().optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
@@ -61881,6 +62352,44 @@ var lockControlCapability = {
 	volatileStateFields: ["lastChangedAt"]
 };
 /**
+* A monotonic total between resets (D944). Energy uses `power-meter.kwhTotal`
+* so dashboards keep one series; every other instantaneous reading lands here.
+* `value` is the time integral in the source quantity's accumulated base
+* (base-unit seconds, or kWh on the power meter). `null` is a gap, never zero.
+*/
+var MeterStatusSchema = object({
+	value: number().nullable().meta(readingMeta("device", { label: "Total" })),
+	lastFetchedAt: number()
+});
+var meterCapability = {
+	name: "meter",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [DeviceType.Sensor],
+	methods: {},
+	status: {
+		schema: MeterStatusSchema,
+		kind: "push"
+	},
+	runtimeState: MeterStatusSchema,
+	/**
+	* Runtime-state durability: **restored** — the total is a cache of the
+	* history integral. A restart shows it only until the history pass
+	* recomputes the open period; it is not an in-memory buffer.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "restored",
+	history: { fields: { value: {
+		kind: "counter",
+		deadband: .001,
+		minIntervalMs: 6e4
+	} } },
+	volatileStateFields: ["lastFetchedAt"]
+};
+/**
 * Media-player cap. Models HA `media_player.*` (Sonos, Chromecast,
 * Apple TV, Spotify, Roku, generic OTT receivers, …) on
 * `DeviceType.MediaPlayer`. Disjoint from the camera streaming
@@ -64407,7 +64916,12 @@ var powerMeterCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Sensor],
+	deviceTypes: [
+		DeviceType.Sensor,
+		DeviceType.Washer,
+		DeviceType.Dryer,
+		DeviceType.Dishwasher
+	],
 	methods: {},
 	status: {
 		schema: PowerMeterStatusSchema,
@@ -65145,6 +65659,8 @@ var runningCustomize = {
 			stateField: "running"
 		},
 		deviceTypes: [
+			DeviceType.Washer,
+			DeviceType.Dryer,
 			DeviceType.Dishwasher,
 			DeviceType.Vacuum,
 			DeviceType.LawnMower,
@@ -67634,7 +68150,8 @@ var switchCapability = {
 	deviceTypes: [
 		DeviceType.Switch,
 		DeviceType.Siren,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan
 	],
 	methods: { setState: method(object({
 		deviceId: number(),
@@ -69847,8 +70364,9 @@ method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" })
 	kind: "mutation",
 	auth: "admin"
 });
+DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
-DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Camera, DeviceType.Camera, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
+DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
 DeviceRole.BinarySensor, DeviceRole.MotionSensor;
 new Set(CAP_NAMES);
@@ -70177,6 +70695,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	featureProbe: featureProbeCapability,
 	flood: floodCapability,
 	gas: gasCapability,
+	groupActive: groupActiveCapability,
 	groupCommands: groupCommandsCapability,
 	groupStatus: groupStatusCapability,
 	heatingValve: heatingValveCapability,
@@ -70188,6 +70707,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	lawnMowerControl: lawnMowerControlCapability,
 	lockControl: lockControlCapability,
 	mediaPlayer: mediaPlayerCapability,
+	meter: meterCapability,
 	motion: motionCapability,
 	motionTrigger: motionTriggerCapability,
 	motionZones: motionZonesCapability,
@@ -71447,7 +71967,7 @@ var BaseDeviceProvider = class extends BaseAddon {
 		return toDeviceSummary(device, this.addonId);
 	}
 };
-DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Camera, DeviceType.Hub, DeviceType.Switch, DeviceType.Siren, DeviceType.Light, DeviceType.Fan, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 new Set(Object.values(DeviceType));
 Object.freeze({
 	"accessories.getStatus": {
@@ -74670,6 +75190,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"groupActive.getStatus": {
+		capName: "group-active",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"groupCommands.getStatus": {
 		capName: "group-commands",
 		capScope: "device",
@@ -75636,6 +76163,13 @@ Object.freeze({
 		access: "create",
 		role: "admin"
 	},
+	"meter.getStatus": {
+		capName: "meter",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"metricsProvider.collectSnapshot": {
 		capName: "metrics-provider",
 		capScope: "system",
@@ -83734,7 +84268,39 @@ var APPLIANCE_CAP_VOCABULARY = {
 				phrase: t("When {device} finishes", "Quando {device} finisce"),
 				icon: "square"
 			}
-		}
+		},
+		overrides: { byType: {
+			[DeviceType.Washer]: {
+				state: { running: {
+					whenTrue: t("When the washing machine starts", "Quando la lavatrice inizia"),
+					whenFalse: t("When the washing machine has finished", "Quando la lavatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the washing machine starts", "Quando la lavatrice inizia") },
+					onFinished: { phrase: t("When the washing machine has finished", "Quando la lavatrice ha finito") }
+				}
+			},
+			[DeviceType.Dryer]: {
+				state: { running: {
+					whenTrue: t("When the dryer starts", "Quando l'asciugatrice inizia"),
+					whenFalse: t("When the dryer has finished", "Quando l'asciugatrice ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dryer starts", "Quando l'asciugatrice inizia") },
+					onFinished: { phrase: t("When the dryer has finished", "Quando l'asciugatrice ha finito") }
+				}
+			},
+			[DeviceType.Dishwasher]: {
+				state: { running: {
+					whenTrue: t("When the dishwasher starts", "Quando la lavastoviglie inizia"),
+					whenFalse: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito")
+				} },
+				events: {
+					onStarted: { phrase: t("When the dishwasher starts", "Quando la lavastoviglie inizia") },
+					onFinished: { phrase: t("When the dishwasher has finished", "Quando la lavastoviglie ha finito") }
+				}
+			}
+		} }
 	},
 	update: {
 		scope: "device",
@@ -84506,6 +85072,10 @@ var SENSOR_CAP_VOCABULARY = {
 			icon: "flame"
 		}]
 	},
+	"group-active": {
+		scope: "device",
+		noun: t("Group state", "Stato del gruppo")
+	},
 	"group-commands": {
 		scope: "device",
 		noun: t("Group command", "Comando di gruppo")
@@ -84562,6 +85132,17 @@ var SENSOR_CAP_VOCABULARY = {
 		}],
 		events: { onMotionChanged: { notOperatorFacing: "the `detected` state trigger phrases both edges, from the mirror that survives a dropped event (D49)" } }
 	},
+	meter: {
+		scope: "device",
+		noun: t("Meter", "Contatore"),
+		state: [{
+			kind: "numeric",
+			field: "value",
+			quantity: t("the total", "il totale"),
+			label: t("Total", "Totale"),
+			icon: "gauge"
+		}]
+	},
 	"numeric-sensor": {
 		scope: "device",
 		noun: t("Sensor", "Sensore"),
@@ -85034,8 +85615,47 @@ function projectAction(cap, action) {
 	};
 }
 Object.entries(CAP_VOCABULARY_BY_NAME).flatMap(([cap, entry]) => entry.scope === "device" ? (entry.actions ?? []).map((a) => projectAction(cap, a)) : []);
-DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher;
+DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer;
 DeviceFeature.BatteryOperated;
+DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher;
+var HA_AS = "a power sensor (device_class power). Home Assistant has no laundry domain. running-state stays unexported until a null reading can be published as unavailable.";
+var HOMEKIT_REASON = "HomeKit has no laundry-appliance service. The export tab would pair an accessory with nothing on it: running-state is withheld until a null reading can be unavailable, and power is not a HomeKit service this export honours.";
+var ALEXA_REASON = "Alexa has no laundry category in this export, and neither power nor running has an Alexa interface.";
+var GOOGLE_REASON = "Google WASHER, DRYER and DISHWASHER require RunCycle. A power threshold is not that trait, and this export does not publish RunCycle.";
+var MATTER_REASON = "No Matter export is built. The closest device types are Laundry Washer (0x0073) and Laundry Dryer (0x0074); a power threshold is not the Laundry Washer Mode cluster.";
+function withheld(reason) {
+	return {
+		[DeviceType.Washer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dryer]: {
+			exported: false,
+			reason
+		},
+		[DeviceType.Dishwasher]: {
+			exported: false,
+			reason
+		}
+	};
+}
+function offered(received) {
+	return {
+		[DeviceType.Washer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dryer]: {
+			exported: true,
+			as: received
+		},
+		[DeviceType.Dishwasher]: {
+			exported: true,
+			as: received
+		}
+	};
+}
+offered(HA_AS), withheld(HOMEKIT_REASON), withheld(ALEXA_REASON), withheld(GOOGLE_REASON), withheld(MATTER_REASON);
 Object.freeze({
 	"accessories.getStatus": [{
 		name: "deviceId",
@@ -86002,6 +86622,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"groupActive.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"groupCommands.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -86212,6 +86837,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"meter.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"motion.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -87819,7 +88449,6 @@ Object.freeze({
 	"network-access": "ingress",
 	"smtp-provider": "email"
 });
-DeviceType.Camera;
 /**
 * A saved Customize assignment (D936). The schema is the type: callers use
 * `z.infer`, they do not restate the shape.
@@ -87965,6 +88594,213 @@ var NC_AUDIO_DEFAULTS = {
 	samplingSeconds: 10
 };
 new Set(["devices", "classes"]);
+/** Strip a small, safe subset of Markdown down to plain text. */
+function markdownToText(md) {
+	return md.replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/(\*\*|__)(.*?)\1/g, "$2").replace(/(\*|_)(.*?)\1/g, "$2").replace(/`([^`]*)`/g, "$1").replace(/^\s{0,3}#{1,6}\s*/gm, "").replace(/^\s{0,3}>\s?/gm, "").replace(/^\s{0,3}[-*+]\s+/gm, "").replace(/^\s{0,3}\d+\.\s+/gm, "").trim();
+}
+var HTML_ENTITIES = [
+	[/&nbsp;/g, " "],
+	[/&amp;/g, "&"],
+	[/&lt;/g, "<"],
+	[/&gt;/g, ">"],
+	[/&quot;/g, "\""],
+	[/&#39;/g, "'"]
+];
+/** Strip HTML tags, decode a few entities, map block/br elements to newlines. */
+function htmlToText(html) {
+	let out = html.replace(/<\s*br\s*\/?\s*>/gi, "\n").replace(/<\s*\/\s*(p|div|li|h[1-6])\s*>/gi, "\n").replace(/<[^>]+>/g, "");
+	for (const [re, rep] of HTML_ENTITIES) out = out.replace(re, rep);
+	return out.replace(/\n{3,}/g, "\n\n").trim();
+}
+var HTML_ESCAPES = [
+	[/&/g, "&amp;"],
+	[/</g, "&lt;"],
+	[/>/g, "&gt;"],
+	[/"/g, "&quot;"],
+	[/'/g, "&#39;"]
+];
+function escapeHtml(text) {
+	let out = text;
+	for (const [re, rep] of HTML_ESCAPES) out = out.replace(re, rep);
+	return out;
+}
+/** Plain text → HTML-lite (escape + newlines to <br>). */
+function textToHtml(text) {
+	return escapeHtml(text).replace(/\n/g, "<br>");
+}
+/** Markdown → HTML-lite (bold/italic/code/links; used e.g. for Pushover). */
+function markdownToHtmlLite(md) {
+	return escapeHtml(md).replace(/(\*\*|__)(.*?)\1/g, "<b>$2</b>").replace(/(\*|_)(.*?)\1/g, "<i>$2</i>").replace(/`([^`]*)`/g, "<code>$1</code>").replace(/\[([^\]]*)\]\(([^)]*)\)/g, "<a href=\"$2\">$1</a>").replace(/\n/g, "<br>");
+}
+/**
+* Preference order when the source format is NOT supported — first supported
+* entry wins. Encodes the Apprise-style "degrade DOWN, but preserve rendering
+* where a richer target exists" policy:
+*   - markdown → html (html-lite) before text (strip)
+*   - html     → text before markdown
+*   - text     → markdown before html (text is valid markdown)
+*/
+var DEGRADE_ORDER = {
+	text: [
+		"text",
+		"markdown",
+		"html"
+	],
+	markdown: [
+		"markdown",
+		"html",
+		"text"
+	],
+	html: [
+		"html",
+		"text",
+		"markdown"
+	]
+};
+/**
+* Pick the best target format the kind supports for a given source format.
+*
+* TOLERANT of a source outside the union. `NotificationSchema.format` carries
+* `.default('text')`, but that default only runs where the schema is PARSED —
+* the tRPC router. A cap call arriving from another addon (`ctx.api`) skips
+* that parse, so `format` reaches here `undefined`, and the bare
+* `DEGRADE_ORDER[source]` threw `is not iterable`. That broke the one promise
+* the degrade path makes ("never throws — degradation is reported, never
+* surfaced as an error") and dead-lettered every Notification-Center delivery
+* for a day (2026-07-30). An unknown source degrades like `text`.
+*/
+function resolveFormat(source, supported) {
+	for (const candidate of DEGRADE_ORDER[source] ?? DEGRADE_ORDER.text) if (supported.includes(candidate)) return candidate;
+	return supported[0] ?? "text";
+}
+/** Transcode a body between formats. */
+function transcodeBody(body, from, to) {
+	if (from === to) return body;
+	if (to === "text") {
+		if (from === "markdown") return markdownToText(body);
+		if (from === "html") return htmlToText(body);
+	}
+	if (to === "html") {
+		if (from === "text") return textToHtml(body);
+		if (from === "markdown") return markdownToHtmlLite(body);
+	}
+	if (to === "markdown") {
+		if (from === "text") return body;
+		if (from === "html") return htmlToText(body);
+	}
+	return body;
+}
+function toResolvedLevel(level) {
+	return {
+		id: level.id,
+		ordinal: level.ordinal,
+		...level.flags ? { flags: level.flags } : {},
+		...level.requires ? { requires: level.requires } : {}
+	};
+}
+function resolveLevel(levels, n) {
+	if (levels.length === 0) return null;
+	if (n.level !== void 0) {
+		const explicit = levels.find((l) => l.id === n.level);
+		if (explicit) return toResolvedLevel(explicit);
+	}
+	const withOrdinal = levels.filter((l) => l.ordinal !== null);
+	if (withOrdinal.length === 0) return toResolvedLevel(levels[0]);
+	const priority = n.priority;
+	return toResolvedLevel([...withOrdinal].sort((a, b) => {
+		const da = Math.abs((a.ordinal ?? 0) - priority);
+		const db = Math.abs((b.ordinal ?? 0) - priority);
+		if (da !== db) return da - db;
+		return (b.ordinal ?? 0) - (a.ordinal ?? 0);
+	})[0]);
+}
+function splitBody(body, maxLen) {
+	if (!Number.isFinite(maxLen) || maxLen <= 0 || body.length <= maxLen) return [body];
+	const parts = [];
+	for (let i = 0; i < body.length; i += maxLen) parts.push(body.slice(i, i + maxLen));
+	return parts;
+}
+/**
+* Prepare a canonical notification for one kind. Never throws — degradation is
+* always reported in `renderedAs`, never surfaced as an error.
+*/
+function prepareNotification(caps, n) {
+	const dropped = [];
+	const sourceFormat = n.format;
+	const format = resolveFormat(sourceFormat, caps.format);
+	if (format !== sourceFormat) dropped.push("format");
+	const transcoded = transcodeBody(n.body, sourceFormat, format);
+	const level = resolveLevel(caps.levels, n);
+	const inAttachments = n.attachments ?? [];
+	const attachments = [];
+	for (const att of inAttachments) {
+		if (!caps.attachments.mediaTypes.includes(att.mediaType)) {
+			dropped.push(`attachment:${att.mediaType}`);
+			continue;
+		}
+		if (caps.attachments.mode === "url" && att.url === void 0) {
+			dropped.push("attachment:noUrl");
+			continue;
+		}
+		if (att.bytes !== void 0 && caps.attachments.maxBytes !== void 0 && att.bytes.length > caps.attachments.maxBytes) {
+			dropped.push("attachment:maxBytes");
+			continue;
+		}
+		if (attachments.length >= caps.attachments.max) {
+			dropped.push("attachment:max");
+			continue;
+		}
+		const needsFetch = caps.attachments.mode === "bytes" && att.bytes === void 0 && att.url !== void 0;
+		attachments.push({
+			mediaType: att.mediaType,
+			...att.url !== void 0 ? { url: att.url } : {},
+			...att.bytes !== void 0 ? { bytes: att.bytes } : {},
+			...att.mime !== void 0 ? { mime: att.mime } : {},
+			...att.name !== void 0 ? { name: att.name } : {},
+			needsFetch
+		});
+	}
+	const inActions = n.actions ?? [];
+	const kept = inActions.slice(0, Math.max(0, caps.actions));
+	if (inActions.length > kept.length) dropped.push("actions");
+	const iconsSupported = caps.actionIcons === true;
+	if (!iconsSupported && kept.some((a) => a.icon !== void 0)) dropped.push("actionIcons");
+	const actions = iconsSupported ? kept : kept.map(({ icon: _icon, ...rest }) => rest);
+	let clickUrl = null;
+	if (n.clickUrl !== void 0) if (caps.clickUrl) clickUrl = n.clickUrl;
+	else dropped.push("clickUrl");
+	let sound = null;
+	if (n.sound !== void 0) if (caps.sound) sound = n.sound;
+	else dropped.push("sound");
+	let ttl = null;
+	if (n.ttl !== void 0) if (caps.ttl) ttl = n.ttl;
+	else dropped.push("ttl");
+	const tag = n.tag ?? null;
+	const bodyParts = splitBody(transcoded, caps.bodyMaxLen);
+	const truncated = bodyParts.length > 1;
+	const renderedAs = {
+		level: level?.id ?? "",
+		format,
+		attachmentsSent: attachments.length,
+		actionsSent: actions.length,
+		truncated,
+		dropped
+	};
+	return {
+		body: bodyParts[0] ?? "",
+		...n.title !== void 0 ? { title: n.title } : {},
+		format,
+		level,
+		attachments,
+		actions,
+		clickUrl,
+		sound,
+		ttl,
+		tag,
+		bodyParts,
+		renderedAs
+	};
+}
 new Set(NC_LEGACY_SYSTEM_EVENT_KINDS);
 /**
 * Every filter, for the callers that must cover all of them (guards, tests).
@@ -89186,12 +90022,62 @@ var alexaProxyLoginSchema = object({
 	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = auto-detect)"),
 	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
 });
+/**
+* Echo speech settings. Speech signs in as an import broker, so the targets
+* are what lives here. `email`, `password`, `region` and `session` are the OLD
+* standalone login: they are read once to migrate it onto the single broker
+* (see `speak/migration.ts`) and written back empty.
+*/
+var alexaSpeakSettingsSchema = object({
+	email: string().default(""),
+	password: string().default("").describe("Legacy Amazon password").meta({ secret: true }),
+	region: _enum([
+		"NA",
+		"EU",
+		"FE"
+	]).default("EU"),
+	session: string().default("").describe("Legacy Alexa session blob").meta({ secret: true }),
+	targets: array(object({
+		id: string(),
+		name: string(),
+		enabled: boolean(),
+		/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
+		brokerId: string().default(""),
+		echoId: string(),
+		mode: _enum(["speak", "announce"]),
+		volume: number(),
+		respectDnd: boolean()
+	})).default([])
+});
+function isRecord$3(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
+function readSpeakSettings(config) {
+	const raw = isRecord$3(config.speak) ? config.speak : {};
+	const region = raw["region"];
+	const targets = raw["targets"];
+	return alexaSpeakSettingsSchema.parse({
+		email: typeof raw["email"] === "string" ? raw["email"] : "",
+		password: typeof raw["password"] === "string" ? raw["password"] : "",
+		session: typeof raw["session"] === "string" ? raw["session"] : "",
+		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
+		...Array.isArray(targets) ? { targets } : {}
+	});
+}
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({
 		proxyHost: "",
 		proxyPort: 3456
+	}),
+	speak: alexaSpeakSettingsSchema.default({
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	})
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
@@ -112965,17 +113851,17 @@ var require_view = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @private
 	*/
 	var debug = require_src$2()("express:view");
-	var path$7 = __require("path");
-	var fs$3 = __require("fs");
+	var path$8 = __require("path");
+	var fs$5 = __require("fs");
 	/**
 	* Module variables.
 	* @private
 	*/
-	var dirname = path$7.dirname;
-	var basename = path$7.basename;
-	var extname = path$7.extname;
-	var join = path$7.join;
-	var resolve = path$7.resolve;
+	var dirname = path$8.dirname;
+	var basename = path$8.basename;
+	var extname = path$8.extname;
+	var join = path$8.join;
+	var resolve = path$8.resolve;
 	/**
 	* Module exports.
 	* @public
@@ -113072,7 +113958,7 @@ var require_view = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function tryStat(path) {
 		debug("stat \"%s\"", path);
 		try {
-			return fs$3.statSync(path);
+			return fs$5.statSync(path);
 		} catch (e) {
 			return;
 		}
@@ -115242,7 +116128,7 @@ var init_types = __esmMin((() => {
 //#region ../../node_modules/send/node_modules/mime/mime.js
 var require_mime = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	__require("path");
-	var fs$2 = __require("fs");
+	var fs$4 = __require("fs");
 	function Mime() {
 		this.types = Object.create(null);
 		this.extensions = Object.create(null);
@@ -115277,7 +116163,7 @@ var require_mime = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	Mime.prototype.load = function(file) {
 		this._loading = file;
 		var map = {};
-		fs$2.readFileSync(file, "ascii").split(/[\r\n]+/).forEach(function(line) {
+		fs$4.readFileSync(file, "ascii").split(/[\r\n]+/).forEach(function(line) {
 			var fields = line.replace(/\s*#.*|^\s*|\s*$/g, "").split(/\s+/);
 			map[fields.shift()] = fields;
 		});
@@ -115553,12 +116439,12 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var escapeHtml = require_escape_html();
 	var etag = require_etag();
 	var fresh = require_fresh();
-	var fs$1 = __require("fs");
+	var fs$3 = __require("fs");
 	var mime = require_mime();
 	var ms = require_ms();
 	var onFinished = require_on_finished();
 	var parseRange = require_range_parser();
-	var path$6 = __require("path");
+	var path$7 = __require("path");
 	var statuses = require_statuses();
 	var Stream = __require("stream");
 	var util$4 = __require("util");
@@ -115566,11 +116452,11 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* Path function references.
 	* @private
 	*/
-	var extname = path$6.extname;
-	var join = path$6.join;
-	var normalize = path$6.normalize;
-	var resolve = path$6.resolve;
-	var sep = path$6.sep;
+	var extname = path$7.extname;
+	var join = path$7.join;
+	var normalize = path$7.normalize;
+	var resolve = path$7.resolve;
+	var sep = path$7.sep;
 	/**
 	* Regular expression for identifying a bytes Range header.
 	* @private
@@ -116018,7 +116904,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		var i = 0;
 		var self = this;
 		debug("stat \"%s\"", path);
-		fs$1.stat(path, function onstat(err, stat) {
+		fs$3.stat(path, function onstat(err, stat) {
 			if (err && err.code === "ENOENT" && !extname(path) && path[path.length - 1] !== sep) return next(err);
 			if (err) return self.onStatError(err);
 			if (stat.isDirectory()) return self.redirect(path);
@@ -116029,7 +116915,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (self._extensions.length <= i) return err ? self.onStatError(err) : self.error(404);
 			var p = path + "." + self._extensions[i++];
 			debug("stat \"%s\"", p);
-			fs$1.stat(p, function(err, stat) {
+			fs$3.stat(p, function(err, stat) {
 				if (err) return next(err);
 				if (stat.isDirectory()) return next();
 				self.emit("file", p, stat);
@@ -116053,7 +116939,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			}
 			var p = join(path, self._index[i]);
 			debug("stat \"%s\"", p);
-			fs$1.stat(p, function(err, stat) {
+			fs$3.stat(p, function(err, stat) {
 				if (err) return next(err);
 				if (stat.isDirectory()) return next();
 				self.emit("file", p, stat);
@@ -116072,7 +116958,7 @@ var require_send = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	SendStream.prototype.stream = function stream(path, options) {
 		var self = this;
 		var res = this.res;
-		var stream = fs$1.createReadStream(path, options);
+		var stream = fs$3.createReadStream(path, options);
 		this.emit("stream", stream);
 		stream.pipe(res);
 		function cleanup() {
@@ -117512,7 +118398,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var deprecate = require_depd()("express");
 	var flatten = require_array_flatten();
 	var merge = require_utils_merge();
-	var resolve$1 = __require("path").resolve;
+	var resolve$2 = __require("path").resolve;
 	var setPrototypeOf = require_setprototypeof();
 	/**
 	* Module variables.
@@ -117575,7 +118461,7 @@ var require_application = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		this.mountpath = "/";
 		this.locals.settings = this.settings;
 		this.set("view", View);
-		this.set("views", resolve$1("views"));
+		this.set("views", resolve$2("views"));
 		this.set("jsonp callback name", "callback");
 		if (env === "production") this.enable("view cache");
 		Object.defineProperty(this, "router", { get: function() {
@@ -119593,7 +120479,7 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var http$3 = __require("http");
 	var isAbsolute = require_utils$2().isAbsolute;
 	var onFinished = require_on_finished();
-	var path$5 = __require("path");
+	var path$6 = __require("path");
 	var statuses = require_statuses();
 	var merge = require_utils_merge();
 	var sign = require_cookie_signature().sign;
@@ -119602,9 +120488,9 @@ var require_response = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var setCharset = require_utils$2().setCharset;
 	var cookie = require_cookie();
 	var send = require_send();
-	var extname = path$5.extname;
+	var extname = path$6.extname;
 	var mime = send.mime;
-	var resolve = path$5.resolve;
+	var resolve = path$6.resolve;
 	var vary = require_vary();
 	/**
 	* Response prototype.
@@ -120436,7 +121322,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var encodeUrl = require_encodeurl();
 	var escapeHtml = require_escape_html();
 	var parseUrl = require_parseurl();
-	var resolve = __require("path").resolve;
+	var resolve$1 = __require("path").resolve;
 	var send = require_send();
 	var url$6 = __require("url");
 	/**
@@ -120460,7 +121346,7 @@ var require_serve_static = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		var setHeaders = opts.setHeaders;
 		if (setHeaders && typeof setHeaders !== "function") throw new TypeError("option setHeaders must be function");
 		opts.maxage = opts.maxage || opts.maxAge || 0;
-		opts.root = resolve(root);
+		opts.root = resolve$1(root);
 		var onDirectory = redirect ? createRedirectDirectoryListener() : createNotFoundDirectoryListener();
 		return function serveStatic(req, res, next) {
 			if (req.method !== "GET" && req.method !== "HEAD") {
@@ -121586,7 +122472,7 @@ var require_has_flag = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/supports-color/index.js
 var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var tty$1 = __require("tty");
 	var hasFlag = require_has_flag();
 	var { env } = process;
@@ -121622,7 +122508,7 @@ var require_supports_color = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 		const min = forceColor || 0;
 		if (env.TERM === "dumb") return min;
 		if (process.platform === "win32") {
-			const osRelease = os$2.release().split(".");
+			const osRelease = os$3.release().split(".");
 			if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 			return 1;
 		}
@@ -124129,7 +125015,7 @@ var require_braces = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/constants.js
 var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$4 = __require("path");
+	var path$5 = __require("path");
 	var WIN_SLASH = "\\\\/";
 	var WIN_NO_SLASH = `[^${WIN_SLASH}]`;
 	var DEFAULT_MAX_EXTGLOB_RECURSION = 0;
@@ -124254,7 +125140,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		CHAR_UNDERSCORE: 95,
 		CHAR_VERTICAL_LINE: 124,
 		CHAR_ZERO_WIDTH_NOBREAK_SPACE: 65279,
-		SEP: path$4.sep,
+		SEP: path$5.sep,
 		/**
 		* Create EXTGLOB_CHARS
 		*/
@@ -124298,7 +125184,7 @@ var require_constants = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/utils.js
 var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
-	var path$3 = __require("path");
+	var path$4 = __require("path");
 	var win32 = process.platform === "win32";
 	var { REGEX_BACKSLASH, REGEX_REMOVE_BACKSLASH, REGEX_SPECIAL_CHARS, REGEX_SPECIAL_CHARS_GLOBAL } = require_constants();
 	exports.isObject = (val) => val !== null && typeof val === "object" && !Array.isArray(val);
@@ -124318,7 +125204,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports) => {
 	};
 	exports.isWindows = (options) => {
 		if (options && typeof options.windows === "boolean") return options.windows;
-		return win32 === true || path$3.sep === "\\";
+		return win32 === true || path$4.sep === "\\";
 	};
 	exports.escapeLast = (input, char, lastIdx) => {
 		const idx = input.lastIndexOf(char, lastIdx);
@@ -125688,7 +126574,7 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/micromatch/node_modules/picomatch/lib/picomatch.js
 var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$2 = __require("path");
+	var path$3 = __require("path");
 	var scan = require_scan();
 	var parse = require_parse();
 	var utils = require_utils();
@@ -125827,7 +126713,7 @@ var require_picomatch$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @api public
 	*/
 	picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
-		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$2.basename(input));
+		return (glob instanceof RegExp ? glob : picomatch.makeRe(glob, options)).test(path$3.basename(input));
 	};
 	/**
 	* Returns true if **any** of the given glob `patterns` match the specified `string`.
@@ -126912,8 +127798,8 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var proxy = require_dist().createProxyMiddleware;
 	var querystring$2 = __require("querystring");
 	var cookieTools = require_cookie$1();
-	var fs = __require("fs");
-	var path$1 = __require("path");
+	var fs$2 = __require("fs");
+	var path$2 = __require("path");
 	var crypto$1 = __require("crypto");
 	var FORMERDATA_STORE_VERSION = 4;
 	function addCookies(Cookie, headers) {
@@ -126944,11 +127830,11 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function initAmazonProxy(_options, callbackCookie, callbackListening) {
 		const initialCookies = {};
-		const formerDataStorePath = _options.formerDataStorePath || path$1.join(__dirname, "formerDataStore.json");
+		const formerDataStorePath = _options.formerDataStorePath || path$2.join(__dirname, "formerDataStore.json");
 		let formerDataStoreValid = false;
 		if (!_options.formerRegistrationData) try {
-			if (fs.existsSync(formerDataStorePath)) {
-				const formerDataStore = JSON.parse(fs.readFileSync(path$1.join(__dirname, "formerDataStore.json"), "utf8"));
+			if (fs$2.existsSync(formerDataStorePath)) {
+				const formerDataStore = JSON.parse(fs$2.readFileSync(path$2.join(__dirname, "formerDataStore.json"), "utf8"));
 				if (typeof formerDataStore === "object" && formerDataStore.storeVersion === FORMERDATA_STORE_VERSION) {
 					_options.formerRegistrationData = _options.formerRegistrationData || {};
 					_options.formerRegistrationData.frc = _options.formerRegistrationData.frc || formerDataStore.frc;
@@ -126989,7 +127875,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				"map-md": initialCookies["map-md"],
 				"frc": initialCookies.frc
 			};
-			fs.writeFileSync(formerDataStorePath, JSON.stringify(formerDataStore), "utf8");
+			fs$2.writeFileSync(formerDataStorePath, JSON.stringify(formerDataStore), "utf8");
 		} catch (_err) {}
 		function base64URLEncode(str) {
 			return str.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -127199,7 +128085,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var https$1 = __require("https");
 	var querystring$1 = __require("querystring");
 	var url = __require("url");
-	var os$1 = __require("os");
+	var os$2 = __require("os");
 	var cookieTools = require_cookie$1();
 	var amazonProxy = require_proxy();
 	var defaultAmazonPage = "amazon.de";
@@ -127312,7 +128198,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				else if (amazonDomain !== "com") _options.baseAmazonPageHandle = "";
 				else _options.baseAmazonPageHandle = "";
 			}
-			if (!_options.userAgent) if (os$1.platform() === "win32") _options.userAgent = defaultUserAgent;
+			if (!_options.userAgent) if (os$2.platform() === "win32") _options.userAgent = defaultUserAgent;
 			else _options.userAgent = defaultUserAgentLinux;
 			_options.logger && _options.logger(`Alexa-Cookie: Use as User-Agent: ${_options.userAgent}`);
 			_options.acceptLanguage = _options.acceptLanguage || defaultAcceptLanguage;
@@ -127836,7 +128722,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var https = __require("https");
 	var querystring = __require("querystring");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var extend = require_extend();
 	var AlexaHttp2Push = require_alexa_http2push();
 	var { v1: uuidv1 } = require_cjs();
@@ -127981,7 +128867,7 @@ var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 		init(cookie, callback) {
 			if (typeof cookie === "object") {
 				this._options = cookie;
-				if (!this._options.userAgent) if (os.platform() === "win32") this._options.userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
+				if (!this._options.userAgent) if (os$1.platform() === "win32") this._options.userAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
 				else this._options.userAgent = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36";
 				if (this._options.apiUserAgentPostfix === void 0) this._options.apiUserAgentPostfix = `AlexaRemote/${__require(fsPath.join(__dirname, "package.json")).version}`;
 				this._options.amazonPage = this._options.amazonPage || "amazon.de";
@@ -131284,15 +132170,15 @@ function parseCookieMaterial(raw) {
 	}
 }
 /** True when `value` is a non-null, non-array plain object (cast-free guard). */
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Narrow a loaded JSON file to its `cookieData` (string | object), or null. */
 function readCookieData(json) {
-	if (!isRecord$1(json)) return null;
+	if (!isRecord$2(json)) return null;
 	const value = json["cookieData"];
 	if (typeof value === "string") return value;
-	if (isRecord$1(value)) return value;
+	if (isRecord$2(value)) return value;
 	return null;
 }
 //#endregion
@@ -132267,7 +133153,7 @@ function mergeAlexaMotionStatus(cached, live, nowMs) {
 	};
 }
 /** True when `v` is a non-null, non-array object (cast-free guard). */
-function isRecord(v) {
+function isRecord$1(v) {
 	return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 /**
@@ -132276,7 +133162,7 @@ function isRecord(v) {
 */
 function decodeTemperatureCelsius(value) {
 	if (typeof value === "number") return Number.isFinite(value) ? value : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	const raw = value["value"];
 	const n = typeof raw === "number" ? raw : Number(raw);
 	if (!Number.isFinite(n)) return null;
@@ -132287,7 +133173,7 @@ function decodeTemperatureCelsius(value) {
 function decodeHumidityPercent(value) {
 	const direct = decodePercentage(value);
 	if (direct !== null) return direct;
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	return decodePercentage(value["value"]);
 }
 //#endregion
@@ -132623,6 +133509,11 @@ var alexaBrokersEntryKind = defineEntryKind("brokers", {
 	}),
 	writeTrigger: "an operator links or removes an Alexa account broker"
 });
+var alexaSpeakSessionsEntryKind = defineEntryKind("speak-sessions", {
+	title: "Alexa Echo speech sessions",
+	schema: entryBody({ session: string().default("").meta({ secret: true }) }),
+	writeTrigger: "an Echo worker signs in as an Alexa account broker"
+});
 //#endregion
 //#region src/alexa-broker-store.ts
 function rowToEntry(id, data) {
@@ -132679,13 +133570,1627 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
+//#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string(),
+	/** The room the account files the device under, when Amazon names one. */
+	room: string().optional()
+});
+var LoginStatusSchema = _enum(["ok", "failed"]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
+//#region src/speak/actions.ts
+var BrokerEchoStateSchema = _enum([
+	"starting",
+	"ready",
+	"broker-not-signed-in",
+	"failed"
+]);
+var SpeakStatusSchema = object({
+	brokers: array(object({
+		id: string(),
+		name: string(),
+		state: BrokerEchoStateSchema,
+		error: string().optional(),
+		devices: array(EchoDeviceSchema),
+		session: SessionStatusSchema
+	})),
+	/** Targets that name no Amazon account yet (they cannot speak until one is chosen). */
+	unassignedTargets: number().int().nonnegative(),
+	/** What the old standalone login left behind, named; '' when nothing is pending. */
+	notice: _enum([
+		"",
+		"no-broker",
+		"choose-broker"
+	])
+});
+var alexaSpeakActions = defineCustomActions({
+	speakStatus: customAction(object({}), SpeakStatusSchema, {
+		kind: "mutation",
+		auth: "admin"
+	}),
+	sendTest: customAction(object({
+		brokerId: string().min(1),
+		echoIds: array(string().min(1)).min(1),
+		mode: _enum(["speak", "announce"]),
+		volume: number().int().min(0).max(100),
+		text: string().min(1).max(450)
+	}), object({ outcomes: array(object({
+		echoId: string(),
+		ok: boolean(),
+		error: string().optional()
+	})) }), {
+		kind: "mutation",
+		auth: "admin"
+	})
+});
+//#endregion
+//#region src/speak/broker-seed.ts
+/**
+* What the Echo worker needs from an import broker to act as the same Amazon
+* account: the refresh token of the broker's own device registration. The
+* broker keeps that registration fresh (it persists `cookieData` after every
+* refresh), so the freshest copy is the persisted session file, then the
+* stored cookie blob, then a bare refresh token. A raw cookie string carries
+* no refresh token and gives no seed.
+*/
+/** The registration name alexapy sends when the broker did not record one. */
+var DEFAULT_DEVICE_APP_NAME = "Alexa Media Player";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The registration blob alexa-remote2 hands back, from an object or its JSON text. */
+function asRegistration(value) {
+	if (isRecord(value)) return value;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("{")) return null;
+	try {
+		const parsed = JSON.parse(trimmed);
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function seedFromRegistration(value) {
+	const registration = asRegistration(value);
+	if (registration === null) return null;
+	const token = registration["refreshToken"];
+	if (typeof token !== "string" || token.length === 0) return null;
+	const name = registration["deviceAppName"];
+	return {
+		refreshToken: token,
+		deviceAppName: typeof name === "string" && name.length > 0 ? name : DEFAULT_DEVICE_APP_NAME
+	};
+}
+async function readPersistedRegistration(dataDir, brokerId) {
+	if (dataDir === void 0) return null;
+	try {
+		const raw = await fs$1.readFile(path$1.join(dataDir, `${brokerId}.${SESSION_FILE}`), "utf8");
+		const json = JSON.parse(raw);
+		return isRecord(json) ? json["cookieData"] : null;
+	} catch {
+		return null;
+	}
+}
+async function readBrokerSeed(dataDir, entry) {
+	const persisted = seedFromRegistration(await readPersistedRegistration(dataDir, entry.id));
+	if (persisted !== null) return persisted;
+	const stored = seedFromRegistration(entry.connection.cookie);
+	if (stored !== null) return stored;
+	const bare = entry.connection.refreshToken;
+	if (bare.length > 0) return {
+		refreshToken: bare,
+		deviceAppName: DEFAULT_DEVICE_APP_NAME
+	};
+	return null;
+}
+/** Amazon domain to the region the worker uses for the spoken-sequence locale. */
+function regionOfDomain(domain) {
+	const tail = domain.toLowerCase().replace(/^(www|alexa)\./, "");
+	if (tail === "amazon.com") return "NA";
+	if (tail === "amazon.co.jp" || tail === "amazon.com.au" || tail === "amazon.in") return "FE";
+	return "EU";
+}
+process.platform, process.env["SystemRoot"];
+/**
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
+*/
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? userInfo().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
+	return {
+		platform: process.platform,
+		exec: (file, args) => {
+			execFileSync(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
+	};
+}
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	fs.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	fs.chmodSync(target, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	fs.mkdirSync(path$1.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	fs.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		fs.writeFileSync(tmp, data);
+		fs.renameSync(tmp, target);
+	} catch (err) {
+		fs.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
+//#region src/speak/secret-file.ts
+/**
+* Hand a refresh token or a saved Amazon session to the Python worker as an
+* owner-only file. The path travels on stdin. The bytes never travel on
+* argv or in the environment, and they are removed when the call settles.
+*/
+var REDACTED = "‹redacted›";
+function decodeSession(sessionB64) {
+	if (sessionB64.length === 0) return Buffer.alloc(0);
+	return Buffer.from(sessionB64, "base64");
+}
+async function readSessionB64(sessionPath) {
+	const bytes = await fs$1.readFile(sessionPath);
+	if (bytes.length === 0) return "";
+	return bytes.toString("base64");
+}
+/**
+* Create a 0700 directory, write the refresh token and the session 0600, run
+* `body`, then delete the directory whether `body` succeeded or threw.
+* Returns the session file as base64 so the caller can store it in the keychain.
+*/
+async function withSpeakSecretFiles(input, body) {
+	const dir = await fs$1.mkdtemp(path$1.join(os.tmpdir(), "camstack-alexa-"));
+	const paths = {
+		dir,
+		refreshTokenPath: path$1.join(dir, "refresh-token"),
+		sessionPath: path$1.join(dir, "session")
+	};
+	try {
+		restrictDirToOwnerSync(dir);
+		writeOwnerOnlyFileSync(paths.refreshTokenPath, input.refreshToken);
+		writeOwnerOnlyFileSync(paths.sessionPath, decodeSession(input.sessionB64));
+		await body(paths);
+		return { sessionB64: await readSessionB64(paths.sessionPath) };
+	} finally {
+		await fs$1.rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Replace every occurrence of each non-empty secret. Used before a log line is emitted. */
+function scrubSecrets(text, secrets) {
+	let out = text;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		out = out.split(secret).join(REDACTED);
+	}
+	return out;
+}
+//#endregion
+//#region src/speak/broker-echo.ts
+var BrokerEcho = class {
+	deps;
+	currentState = "starting";
+	currentError = null;
+	currentDevices = [];
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get id() {
+		return this.deps.brokerId;
+	}
+	get name() {
+		return this.deps.brokerName;
+	}
+	get state() {
+		return this.currentState;
+	}
+	get error() {
+		return this.currentError;
+	}
+	get devices() {
+		return this.currentDevices;
+	}
+	stop() {
+		this.deps.worker.stop();
+	}
+	/** Sign the worker in as the broker's account. Never throws; the outcome is `state`. */
+	async signIn() {
+		const { brokerId, worker, sessions, logger } = this.deps;
+		const tags = { tags: { brokerId } };
+		let secrets = [];
+		try {
+			const seed = await this.deps.readSeed();
+			const stored = await sessions.get(brokerId);
+			if (seed === null && stored.length === 0) {
+				this.currentState = "broker-not-signed-in";
+				this.currentError = null;
+				logger.warn("alexa speak: the broker has no sign-in to share yet", tags);
+				return;
+			}
+			secrets = seed === null ? [] : [seed.refreshToken];
+			worker.noteSecrets(secrets);
+			let outcome = parseLoginResult({
+				status: "failed",
+				error: "worker gave no answer"
+			});
+			const held = await withSpeakSecretFiles({
+				refreshToken: seed?.refreshToken ?? "",
+				sessionB64: stored
+			}, async (paths) => {
+				outcome = parseLoginResult(await worker.request({
+					op: "login_broker",
+					label: brokerId,
+					refreshTokenPath: seed === null ? "" : paths.refreshTokenPath,
+					deviceAppName: seed?.deviceAppName ?? "",
+					domain: this.deps.domain,
+					sessionPath: paths.sessionPath,
+					region: regionOfDomain(this.deps.domain)
+				}));
+			});
+			if (held.sessionB64.length > 0 && held.sessionB64 !== stored) await sessions.put(brokerId, held.sessionB64);
+			this.currentError = outcome.status === "ok" ? null : outcome.error ?? "sign-in failed";
+			this.currentState = outcome.status === "ok" ? "ready" : "failed";
+			if (outcome.status !== "ok") {
+				logger.warn("alexa speak: sign-in as the broker failed", {
+					...tags,
+					meta: { error: this.currentError }
+				});
+				return;
+			}
+			await this.refreshDevices();
+		} catch (err) {
+			this.currentState = "failed";
+			this.currentError = scrubSecrets(err instanceof Error ? err.message : String(err), secrets);
+			logger.warn("alexa speak: sign-in as the broker failed", {
+				...tags,
+				meta: { error: this.currentError }
+			});
+		}
+	}
+	/** A session that is not ready tries to sign in again before it gives up. */
+	async ensureReady() {
+		if (this.currentState !== "ready") await this.signIn();
+		return this.currentState === "ready";
+	}
+	async refreshDevices() {
+		if (this.currentState !== "ready") return;
+		try {
+			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
+		} catch (err) {
+			this.deps.logger.warn("alexa speak: device refresh failed", {
+				tags: { brokerId: this.deps.brokerId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
+	async utter(op, targets, text, volume) {
+		if (!await this.ensureReady()) throw new Error(this.notReadyReason());
+		return parseDeliveries(await this.deps.worker.request({
+			op,
+			targets,
+			text,
+			volume
+		}));
+	}
+	async session() {
+		if (this.deps.worker.failed) return {
+			loggedIn: false,
+			ageSec: 0,
+			lastSuccessAt: null
+		};
+		try {
+			return parseSessionStatus(await this.deps.worker.request({ op: "session_status" }));
+		} catch {
+			return {
+				loggedIn: this.currentState === "ready",
+				ageSec: 0,
+				lastSuccessAt: null
+			};
+		}
+	}
+	notReadyReason() {
+		if (this.currentState === "broker-not-signed-in") return `account '${this.deps.brokerName}' is not signed in on its broker`;
+		return this.currentError ?? "alexa session is not ready";
+	}
+};
+//#endregion
+//#region src/speak/migration.ts
+function legacyLoginOf(settings) {
+	return {
+		email: settings.email,
+		password: settings.password,
+		session: settings.session
+	};
+}
+function planLegacyMigration(legacy, brokerIds, targets) {
+	const present = legacy.email.length > 0 || legacy.password.length > 0 || legacy.session.length > 0;
+	const only = brokerIds.length === 1 ? brokerIds[0] ?? null : null;
+	if (!present || only === null) return {
+		present,
+		attachTo: null,
+		targets
+	};
+	return {
+		present,
+		attachTo: legacy.session.length > 0 ? only : null,
+		targets: targets.map((row) => row.brokerId.length > 0 ? row : {
+			...row,
+			brokerId: only
+		})
+	};
+}
+/** What the page must tell the operator about targets that name no account. */
+function noticeFor(targets, brokerIds) {
+	if (!targets.some((row) => row.brokerId.length === 0)) return "";
+	if (brokerIds.length === 0) return "no-broker";
+	return brokerIds.length > 1 ? "choose-broker" : "";
+}
+function unassignedCount(targets) {
+	return targets.filter((row) => row.brokerId.length === 0).length;
+}
+//#endregion
+//#region src/speak/rate-limit.ts
+/**
+* Per-Echo admission. A burst is dropped here, not queued: a queue would be
+* minutes of speech long after the event.
+*/
+function emptySpeechLedger() {
+	return { byEcho: {} };
+}
+/**
+* Identical text inside the collapse window is one utterance.
+* A different text inside the gap is refused until the gap elapses.
+* Admitted calls replace that Echo's memory; refusals leave it as it was.
+*/
+function admitSpeech(ledger, echoId, text, now) {
+	const previous = ledger.byEcho[echoId];
+	if (previous !== void 0 && previous.lastText === text && now - previous.lastSpokenAt < 6e4) return {
+		decision: "collapsed",
+		ledger
+	};
+	if (previous !== void 0 && now - previous.lastSpokenAt < 2e4) return {
+		decision: "rate_limited",
+		ledger
+	};
+	return {
+		decision: "admit",
+		ledger: { byEcho: {
+			...ledger.byEcho,
+			[echoId]: {
+				lastSpokenAt: now,
+				lastText: text
+			}
+		} }
+	};
+}
+//#endregion
+//#region src/speak/speech-text.ts
+var ALEXA_SPEECH_CAPS = {
+	attachments: {
+		mediaTypes: [],
+		mode: "url",
+		max: 0
+	},
+	actions: 0,
+	actionIcons: false,
+	levels: [{
+		id: "default",
+		label: "Default",
+		ordinal: 3
+	}],
+	format: ["text"],
+	clickUrl: false,
+	sound: false,
+	ttl: false,
+	bodyMaxLen: 450
+};
+function collapseWhitespace(value) {
+	return value.replace(/[ \t]+\n/g, "\n").replace(/\n{3,}/g, "\n\n").replace(/[ \t]{2,}/g, " ").trim();
+}
+/** Markup that survived the degrade engine must not be read aloud. */
+function toPlainSpeech(value) {
+	return collapseWhitespace(htmlToText(markdownToText(value)));
+}
+/**
+* Title then body, as one sentence, never longer than {@link SPEECH_MAX_CHARS}.
+* An empty result is an empty string — the caller refuses to send it.
+*/
+function speechFromNotification(notification) {
+	const prepared = prepareNotification(ALEXA_SPEECH_CAPS, notification);
+	const title = prepared.title !== void 0 ? toPlainSpeech(prepared.title) : "";
+	const body = toPlainSpeech(prepared.body);
+	const joined = title.length > 0 && body.length > 0 ? `${title}. ${body}` : title || body;
+	const text = joined.length > 450 ? joined.slice(0, 450).trimEnd() : joined;
+	const truncated = prepared.renderedAs.truncated || text.length < joined.length;
+	return {
+		text,
+		renderedAs: {
+			...prepared.renderedAs,
+			truncated,
+			format: "text"
+		}
+	};
+}
+//#endregion
+//#region src/speak/provider.ts
+function quietLogger$1() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function readString(config, key) {
+	const value = config[key];
+	return typeof value === "string" ? value : "";
+}
+function readMode(config) {
+	return config["mode"] === "announce" ? "announce" : "speak";
+}
+function readVolume(config) {
+	const value = config["volume"];
+	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
+	return Math.max(0, Math.min(100, Math.round(value)));
+}
+function respectDnd(config) {
+	return config["respectDnd"] !== false;
+}
+/** "Kitchen · Living room · ECHO" — the name first, then what tells two Echoes apart. */
+function echoOptionLabel(device) {
+	const kind = device.kind === "group" ? "Group" : device.family;
+	const parts = [device.name.length > 0 ? device.name : device.id];
+	if (device.room !== void 0 && device.room.length > 0) parts.push(device.room);
+	if (kind.length > 0) parts.push(kind);
+	return parts.join(" · ");
+}
+function echoField(devices, showWhen) {
+	return {
+		type: "select",
+		key: "echoId",
+		label: "Echo",
+		labelKey: "import-alexa:echoTarget.s_echo.echoId.label",
+		description: devices.length === 0 ? "No Echo found yet. Sign the Amazon account in on Integrations, Alexa." : void 0,
+		descriptionKey: devices.length === 0 ? "import-alexa:echoTarget.s_echo.echoId.empty" : void 0,
+		options: devices.map((device) => ({
+			value: device.id,
+			label: echoOptionLabel(device)
+		})),
+		...showWhen === void 0 ? {} : { showWhen }
+	};
+}
+/**
+* The two pickers are not `required`: a required select shows its first option
+* while the form still holds no value, so a save would drop the choice. Left
+* optional they open on "Select", and `upsertTarget` refuses an empty pick.
+*
+* The Echo picker is built from the accounts' own device lists on every call,
+* so a new Echo shows up without a deploy. With one account there is no account
+* field; with several, each account's Echoes appear when that account is chosen.
+*/
+function configSchema(brokers) {
+	const first = brokers[0];
+	return { sections: [{
+		id: "echo",
+		title: "Echo",
+		titleKey: "import-alexa:echoTarget.s_echo.title",
+		fields: [
+			...brokers.length > 1 ? [{
+				type: "select",
+				key: "brokerId",
+				label: "Amazon account",
+				labelKey: "import-alexa:echoTarget.s_echo.brokerId.label",
+				options: brokers.map((broker) => ({
+					value: broker.id,
+					label: broker.name
+				}))
+			}, ...brokers.map((broker) => echoField(broker.devices, {
+				field: "brokerId",
+				equals: broker.id
+			}))] : [echoField(first?.devices ?? [])],
+			{
+				type: "select",
+				key: "mode",
+				label: "Mode",
+				labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+				default: "speak",
+				options: [{
+					value: "speak",
+					label: "Speak (quiet hours apply)"
+				}, {
+					value: "announce",
+					label: "Announce (chime, then speech)"
+				}]
+			},
+			{
+				type: "number",
+				key: "volume",
+				label: "Volume",
+				labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+				min: 0,
+				max: 100,
+				default: 40
+			},
+			{
+				type: "boolean",
+				key: "respectDnd",
+				label: "Respect Do Not Disturb",
+				labelKey: "import-alexa:echoTarget.s_echo.respectDnd.label",
+				default: true
+			}
+		]
+	}] };
+}
+/** The Alexa target kind as the Add target form sees it, for the accounts as they are now. */
+function alexaTargetKind(brokers) {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		label: "Alexa",
+		icon: "megaphone",
+		iconUrl: ALEXA_SPEAK_ICON_URL,
+		iconMediaType: "image/svg+xml",
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		supportsDiscovery: true,
+		destinationKeys: ["brokerId", "echoId"],
+		configSchema: configSchema(brokers),
+		caps: {
+			attachments: {
+				mediaTypes: [],
+				mode: "url",
+				max: 0
+			},
+			actions: 0,
+			actionIcons: false,
+			levels: [{
+				id: "default",
+				label: "Default",
+				ordinal: 3
+			}],
+			format: ["text"],
+			clickUrl: false,
+			sound: false,
+			ttl: false,
+			bodyMaxLen: 450
+		}
+	};
+}
+function discoveredFrom(broker, device) {
+	return {
+		kind: ALEXA_SPEAK_KIND,
+		suggestedName: device.name.length > 0 ? device.name : device.id,
+		config: {
+			brokerId: broker.id,
+			echoId: device.id,
+			mode: "speak",
+			volume: 40,
+			respectDnd: true,
+			family: device.family,
+			deviceKind: device.kind
+		}
+	};
+}
+function createAlexaNotificationProvider(ports) {
+	const logger = ports.logger ?? quietLogger$1();
+	let targets = ports.loadTargets();
+	let ledger = emptySpeechLedger();
+	let deliveries = [];
+	function record(row) {
+		deliveries = [...deliveries, row];
+	}
+	/**
+	* The account a target speaks through: the one it names; else the only one
+	* there is; else the one whose Echoes include the target's Echo.
+	*/
+	function brokerFor(config) {
+		const all = ports.brokers();
+		const named = readString(config, "brokerId");
+		if (named.length > 0) return all.find((broker) => broker.id === named);
+		if (all.length === 1) return all[0];
+		const echoId = readString(config, "echoId");
+		const owners = all.filter((broker) => broker.devices.some((device) => device.id === echoId));
+		return owners.length === 1 ? owners[0] : void 0;
+	}
+	function persist(next) {
+		targets = next;
+		ports.saveTargets(next);
+	}
+	async function deliver(target, notification) {
+		const speech = speechFromNotification(notification);
+		const echoId = readString(target.config, "echoId");
+		const deviceId = notification.deviceId;
+		const tags = deviceId !== void 0 ? { tags: { deviceId } } : {};
+		if (echoId.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error: "target has no echo id"
+			});
+			logger.warn("alexa speak dropped: target has no echo id", {
+				...tags,
+				meta: { targetId: target.id }
+			});
+			return {
+				success: false,
+				error: "target has no echo id",
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (speech.text.length === 0) {
+			record({
+				targetId: target.id,
+				outcome: "empty",
+				at: ports.now()
+			});
+			logger.info("alexa speak dropped: empty text", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const broker = brokerFor(target.config);
+		if (broker === void 0) {
+			const error = "target has no Amazon account";
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error
+			});
+			logger.warn("alexa speak dropped: target names no Amazon account", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: false,
+				error,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const device = broker.devices.find((row) => row.id === echoId);
+		if (device !== void 0 && respectDnd(target.config) && device.dnd) {
+			record({
+				targetId: target.id,
+				outcome: "dnd",
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped: do not disturb", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		if (device !== void 0 && !device.online) {
+			record({
+				targetId: target.id,
+				outcome: "offline",
+				at: ports.now()
+			});
+			logger.info("alexa speak not delivered: echo offline", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: false,
+				error: "echo offline",
+				renderedAs: speech.renderedAs
+			};
+		}
+		const admitted = admitSpeech(ledger, echoId, speech.text, ports.now());
+		ledger = admitted.ledger;
+		if (admitted.decision !== "admit") {
+			record({
+				targetId: target.id,
+				outcome: admitted.decision,
+				at: ports.now()
+			});
+			logger.info("alexa speak skipped", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome: admitted.decision
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const mode = readMode(target.config);
+		try {
+			const outcomes = await ports.speak({
+				brokerId: broker.id,
+				mode,
+				targets: [echoId],
+				text: speech.text,
+				volume: readVolume(target.config)
+			});
+			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
+			if (one === void 0 || !one.ok) {
+				const error = one?.error ?? "speak failed";
+				record({
+					targetId: target.id,
+					outcome: "failed",
+					at: ports.now(),
+					error
+				});
+				logger.warn("alexa speak failed", {
+					...tags,
+					meta: {
+						targetId: target.id,
+						echoId,
+						error
+					}
+				});
+				return {
+					success: false,
+					error,
+					renderedAs: speech.renderedAs
+				};
+			}
+			const outcome = mode === "announce" ? "announced" : "spoken";
+			record({
+				targetId: target.id,
+				outcome,
+				at: ports.now()
+			});
+			logger.info("alexa speak delivered", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					outcome
+				}
+			});
+			return {
+				success: true,
+				renderedAs: speech.renderedAs
+			};
+		} catch (err) {
+			const error = err instanceof Error ? err.message : String(err);
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error
+			});
+			logger.warn("alexa speak failed", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId,
+					error
+				}
+			});
+			return {
+				success: false,
+				error,
+				renderedAs: speech.renderedAs
+			};
+		}
+	}
+	return {
+		get deliveries() {
+			return deliveries;
+		},
+		async listTargetKinds() {
+			return [alexaTargetKind(ports.brokers())];
+		},
+		async listTargets() {
+			return [...targets];
+		},
+		async getTarget(input) {
+			const found = targets.find((target) => target.id === input.targetId);
+			if (found === void 0) throw new Error(`target not found: ${input.targetId}`);
+			return found;
+		},
+		async discoverTargets() {
+			const taken = new Set(targets.flatMap((row) => {
+				const owner = brokerFor(row.config);
+				return owner === void 0 ? [] : [`${owner.id}/${readString(row.config, "echoId")}`];
+			}));
+			return ports.brokers().flatMap((broker) => broker.devices.filter((device) => !taken.has(`${broker.id}/${device.id}`)).map((device) => discoveredFrom(broker, device)));
+		},
+		async probeTargetConfig(input) {
+			const broker = brokerFor(input.config);
+			return broker !== void 0 && broker.ready ? {
+				ok: true,
+				resolvedUrl: "alexa://session"
+			} : {
+				ok: false,
+				resolvedUrl: "alexa://session",
+				error: "the Amazon account is not signed in on its broker"
+			};
+		},
+		async send(input) {
+			const target = targets.find((row) => row.id === input.targetId);
+			if (target === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!target.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(target, input.notification);
+		},
+		async testTarget(input) {
+			const found = targets.find((row) => row.id === input.targetId);
+			if (found === void 0) return {
+				success: false,
+				error: `target not found: ${input.targetId}`
+			};
+			if (!found.enabled) return {
+				success: false,
+				error: "target disabled"
+			};
+			return deliver(found, input.sample ?? {
+				body: "This is a CamStack test notification.",
+				title: "CamStack",
+				format: "text",
+				priority: 3
+			});
+		},
+		async upsertTarget(input) {
+			const owner = brokerFor(input.target.config);
+			if (readString(input.target.config, "echoId").length === 0) throw new Error("Pick the Echo that should speak");
+			if (owner === void 0) throw new Error("Pick the Amazon account this Echo belongs to");
+			const pinned = readString(input.target.config, "brokerId").length === 0 ? {
+				...input.target.config,
+				brokerId: owner.id
+			} : input.target.config;
+			const target = {
+				...input.target,
+				config: pinned,
+				addonId: ALEXA_SPEAK_ADDON_ID,
+				kind: ALEXA_SPEAK_KIND
+			};
+			persist([...targets.filter((row) => row.id !== target.id), target]);
+			return target;
+		},
+		async deleteTarget(input) {
+			persist(targets.filter((row) => row.id !== input.targetId));
+		},
+		async setTargetEnabled(input) {
+			persist(targets.map((row) => row.id === input.targetId ? {
+				...row,
+				enabled: input.enabled
+			} : row));
+		}
+	};
+}
+//#endregion
+//#region src/speak/python-paths.ts
+/** Locate bundled `python/alexa_worker.py` from dist/ or from src/ under test. */
+function resolveAlexaWorkerScript(fromModuleUrl = import.meta.url) {
+	const here = dirname(fileURLToPath(fromModuleUrl));
+	const candidates = [
+		join(here, "../python/alexa_worker.py"),
+		join(here, "../../python/alexa_worker.py"),
+		join(here, "../../../python/alexa_worker.py")
+	];
+	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
+	throw new Error(`import-alexa: alexa_worker.py not found. Searched:\n${candidates.join("\n")}`);
+}
+//#endregion
+//#region src/speak/worker-client.ts
+/**
+* One Python process per broker, for the life of the addon. Requests are one JSON line
+* on stdin; responses are one JSON line on stdout, matched by id.
+* A crash restarts the process until the same bound CrashSupervisor uses,
+* then requests fail instead of looping.
+*/
+/** Pure: a new timestamp list, never a mutated one. */
+function recordWorkerCrash(times, now, windowMs, maxCrashes) {
+	const cutoff = now - windowMs;
+	const recent = [...times.filter((t) => t >= cutoff), now];
+	if (recent.length >= maxCrashes) return {
+		action: "failed",
+		times: recent
+	};
+	return {
+		action: "respawn",
+		times: recent
+	};
+}
+function quietLogger() {
+	const logger = {
+		debug() {},
+		info() {},
+		warn() {},
+		error() {},
+		child() {
+			return logger;
+		},
+		withTags() {
+			return logger;
+		}
+	};
+	return logger;
+}
+function wrapChild(child) {
+	const stdin = child.stdin;
+	const stdout = child.stdout;
+	const stderr = child.stderr;
+	if (stdin === null || stdout === null || stderr === null) throw new Error("alexa worker spawn did not provide pipes");
+	return {
+		stdin: { write(chunk) {
+			stdin.write(chunk);
+		} },
+		stdout: { on(event, listener) {
+			stdout.on(event, listener);
+		} },
+		stderr: { on(event, listener) {
+			stderr.on(event, listener);
+		} },
+		on(event, listener) {
+			if (event === "close") child.on("close", listener);
+			else child.on("error", listener);
+		},
+		kill(signal) {
+			child.kill(signal);
+		}
+	};
+}
+function defaultSpawn(pythonPath, scriptPath, env) {
+	return wrapChild(spawn(pythonPath, [scriptPath], {
+		stdio: [
+			"pipe",
+			"pipe",
+			"pipe"
+		],
+		env
+	}));
+}
+function startAlexaWorker(deps) {
+	const logger = deps.logger ?? quietLogger();
+	const now = deps.now ?? (() => Date.now());
+	const schedule = deps.schedule ?? ((fn, delayMs) => {
+		setTimeout(fn, delayMs);
+	});
+	const spawnChild = deps.spawnChild ?? defaultSpawn;
+	const maxCrashes = deps.maxCrashes ?? 5;
+	const windowMs = deps.windowMs ?? 6e4;
+	const env = deps.env ?? process.env;
+	let child = null;
+	let buffer = "";
+	let nextId = 1;
+	let stopped = false;
+	let failed = false;
+	let crashTimes = [];
+	let secrets = [];
+	let pending = null;
+	const queue = [];
+	function scrub(text) {
+		return scrubSecrets(text, secrets);
+	}
+	function failPending(err) {
+		const current = pending;
+		pending = null;
+		current?.reject(err);
+	}
+	function attach(spawned) {
+		child = spawned;
+		buffer = "";
+		let settled = false;
+		const finish = (code) => {
+			if (settled || child !== spawned) return;
+			settled = true;
+			onExit(code);
+		};
+		spawned.stdout.on("data", (chunk) => {
+			buffer += chunk.toString("utf8");
+			const lines = buffer.split("\n");
+			buffer = lines.pop() ?? "";
+			for (const line of lines) {
+				if (line.trim().length === 0) continue;
+				acceptLine(line);
+			}
+		});
+		spawned.stderr.on("data", (chunk) => {
+			const text = scrub(chunk.toString("utf8")).trim();
+			if (text.length === 0) return;
+			logger.warn("alexa worker stderr", { meta: { text: text.slice(0, 500) } });
+		});
+		spawned.on("error", (err) => {
+			logger.warn("alexa worker spawn error", { meta: { error: scrub(err.message) } });
+			finish(null);
+		});
+		spawned.on("close", (code) => {
+			finish(code);
+		});
+	}
+	function acceptLine(line) {
+		let parsed;
+		try {
+			parsed = JSON.parse(line);
+		} catch (err) {
+			logger.warn("alexa worker non-JSON line", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			return;
+		}
+		const checked = WorkerLineSchema.safeParse(parsed);
+		if (!checked.success) {
+			logger.warn("alexa worker line failed schema", { meta: { error: checked.error.message } });
+			return;
+		}
+		const message = checked.data;
+		if (pending === null || pending.id !== message.id) {
+			logger.warn("alexa worker line for an unknown request", { meta: { id: message.id } });
+			return;
+		}
+		const current = pending;
+		pending = null;
+		if (message.ok) current.resolve(message.result);
+		else current.reject(new Error(scrub(message.error)));
+		pump();
+	}
+	function onExit(code) {
+		child = null;
+		if (stopped) {
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			return;
+		}
+		failPending(/* @__PURE__ */ new Error(`alexa worker exited (${code ?? "null"})`));
+		const decision = recordWorkerCrash(crashTimes, now(), windowMs, maxCrashes);
+		crashTimes = decision.times;
+		if (decision.action === "failed") {
+			failed = true;
+			logger.error("alexa worker restart bound reached", { meta: { crashes: crashTimes.length } });
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+			return;
+		}
+		logger.warn("alexa worker exited; restarting", { meta: {
+			code,
+			crashes: crashTimes.length
+		} });
+		schedule(() => {
+			if (stopped || failed) return;
+			launch();
+			pump();
+		}, Math.min(3e4, 500 * 2 ** Math.min(6, crashTimes.length - 1)));
+	}
+	function launch() {
+		if (stopped || failed) return;
+		attach(spawnChild(deps.pythonPath, deps.scriptPath, env));
+	}
+	function pump() {
+		if (pending !== null || child === null || failed || stopped) return;
+		const next = queue.shift();
+		if (next === void 0) return;
+		pending = next.pending;
+		child.stdin.write(requestLine(next.pending.id, next.request));
+	}
+	function request(body) {
+		if (failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker restart bound reached"));
+		if (stopped) return Promise.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		const id = String(nextId);
+		nextId += 1;
+		return new Promise((resolve, reject) => {
+			queue.push({
+				request: body,
+				pending: {
+					id,
+					resolve,
+					reject
+				}
+			});
+			if (child === null) launch();
+			pump();
+		});
+	}
+	return {
+		request,
+		noteSecrets(next) {
+			secrets = [...next];
+		},
+		stop() {
+			stopped = true;
+			const current = child;
+			child = null;
+			current?.kill("SIGTERM");
+			failPending(/* @__PURE__ */ new Error("alexa worker stopped"));
+			const waiting = queue.splice(0, queue.length);
+			for (const item of waiting) item.pending.reject(/* @__PURE__ */ new Error("alexa worker stopped"));
+		},
+		get failed() {
+			return failed;
+		},
+		get crashesInWindow() {
+			return crashTimes.length;
+		}
+	};
+}
+//#endregion
+//#region src/speak/controller.ts
+function targetsFrom(settings) {
+	return settings.targets.map((row) => ({
+		id: row.id,
+		name: row.name,
+		kind: ALEXA_SPEAK_KIND,
+		addonId: ALEXA_SPEAK_ADDON_ID,
+		enabled: row.enabled,
+		config: {
+			...row.brokerId.length > 0 ? { brokerId: row.brokerId } : {},
+			echoId: row.echoId,
+			mode: row.mode,
+			volume: row.volume,
+			respectDnd: row.respectDnd
+		}
+	}));
+}
+function rowsFrom(targets) {
+	return targets.map((target) => ({
+		id: target.id,
+		name: target.name,
+		enabled: target.enabled,
+		brokerId: typeof target.config["brokerId"] === "string" ? target.config["brokerId"] : "",
+		echoId: typeof target.config["echoId"] === "string" ? target.config["echoId"] : "",
+		mode: target.config["mode"] === "announce" ? "announce" : "speak",
+		volume: typeof target.config["volume"] === "number" ? target.config["volume"] : 40,
+		respectDnd: target.config["respectDnd"] !== false
+	}));
+}
+var AlexaSpeakController = class {
+	host;
+	provider;
+	settings;
+	pythonPath = null;
+	echoes = /* @__PURE__ */ new Map();
+	timer = null;
+	queue = Promise.resolve();
+	now;
+	constructor(host) {
+		this.host = host;
+		this.now = host.now ?? (() => Date.now());
+		this.settings = readSpeakSettings(host.readConfig());
+		this.provider = createAlexaNotificationProvider({
+			brokers: () => this.brokerViews(),
+			now: this.now,
+			logger: host.logger,
+			loadTargets: () => targetsFrom(this.settings),
+			saveTargets: (targets) => {
+				this.settings = {
+					...this.settings,
+					targets: [...rowsFrom(targets)]
+				};
+				this.persist();
+			},
+			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text, command.volume)
+		});
+	}
+	async start() {
+		this.pythonPath = await this.host.ensurePython();
+		if (this.pythonPath === null) {
+			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
+			return;
+		}
+		await this.migrateLegacyLogin();
+		await this.brokersChanged();
+		this.timer = setInterval(() => {
+			this.refreshAll();
+		}, DEVICE_REFRESH_MS);
+	}
+	stop() {
+		if (this.timer !== null) clearInterval(this.timer);
+		this.timer = null;
+		for (const echo of this.echoes.values()) echo.stop();
+		this.echoes.clear();
+	}
+	/** The addon calls this whenever its list of brokers may have changed. */
+	brokersChanged() {
+		this.queue = this.queue.then(() => this.reconcile()).catch(() => void 0);
+		return this.queue;
+	}
+	handlers() {
+		return {
+			speakStatus: async () => this.status(),
+			sendTest: async (input) => this.sendTest(input)
+		};
+	}
+	brokerViews() {
+		return this.host.listBrokers().map((ref) => {
+			const echo = this.echoes.get(ref.id);
+			return {
+				id: ref.id,
+				name: ref.name,
+				ready: echo?.state === "ready",
+				devices: echo?.devices ?? []
+			};
+		});
+	}
+	async persist() {
+		try {
+			await this.host.writeSpeak(this.settings);
+		} catch (err) {
+			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		}
+	}
+	/**
+	* Drain the old standalone login once. With exactly one broker its jar and
+	* its targets move onto that broker; otherwise the jar is dropped and the
+	* targets wait for the operator to choose (the status names that state).
+	*/
+	async migrateLegacyLogin() {
+		const brokers = this.host.listBrokers();
+		const plan = planLegacyMigration(legacyLoginOf(this.settings), brokers.map((ref) => ref.id), this.settings.targets);
+		if (!plan.present) return;
+		if (plan.attachTo !== null) await this.host.sessions.put(plan.attachTo, this.settings.session);
+		this.settings = {
+			...this.settings,
+			email: "",
+			password: "",
+			session: "",
+			targets: [...plan.targets]
+		};
+		await this.persist();
+		await this.host.clearLegacySecrets();
+		this.host.logger.info("alexa speak: the old standalone login was retired", { meta: {
+			attachedTo: plan.attachTo ?? "none",
+			brokers: brokers.length,
+			targets: plan.targets.length
+		} });
+	}
+	makeWorker(brokerId, pythonPath) {
+		if (this.host.startWorker !== void 0) return this.host.startWorker(brokerId, pythonPath);
+		return startAlexaWorker({
+			pythonPath,
+			scriptPath: resolveAlexaWorkerScript(),
+			logger: this.host.logger.withTags({ brokerId }),
+			now: this.now
+		});
+	}
+	async reconcile() {
+		const pythonPath = this.pythonPath;
+		if (pythonPath === null) return;
+		const refs = this.host.listBrokers();
+		const live = new Set(refs.map((ref) => ref.id));
+		for (const [id, echo] of this.echoes) {
+			if (live.has(id)) continue;
+			echo.stop();
+			this.echoes.delete(id);
+			await this.host.sessions.delete(id).catch((err) => {
+				this.host.logger.warn("alexa speak: could not drop the session of a removed account", {
+					tags: { brokerId: id },
+					meta: { error: err instanceof Error ? err.message : String(err) }
+				});
+			});
+		}
+		const fresh = refs.filter((ref) => !this.echoes.has(ref.id));
+		for (const ref of fresh) this.echoes.set(ref.id, new BrokerEcho({
+			brokerId: ref.id,
+			brokerName: ref.name,
+			domain: ref.amazonDomain,
+			worker: this.makeWorker(ref.id, pythonPath),
+			readSeed: () => this.host.readSeed(ref.id),
+			sessions: this.host.sessions,
+			logger: this.host.logger
+		}));
+		await Promise.all(refs.map(async (ref) => {
+			const echo = this.echoes.get(ref.id);
+			if (echo !== void 0 && (fresh.includes(ref) || echo.state !== "ready")) await echo.signIn();
+		}));
+	}
+	async refreshAll() {
+		for (const echo of this.echoes.values()) if (echo.state === "ready") await echo.refreshDevices();
+		else await echo.signIn();
+	}
+	async utter(brokerId, mode, targets, text, volume) {
+		const echo = this.echoes.get(brokerId);
+		if (echo === void 0) throw new Error("no Echo session for this Amazon account");
+		return echo.utter(mode === "announce" ? "announce" : "speak", targets, text, volume);
+	}
+	async status() {
+		const brokers = this.host.listBrokers();
+		const rows = await Promise.all(brokers.map(async (ref) => {
+			const echo = this.echoes.get(ref.id);
+			return {
+				id: ref.id,
+				name: ref.name,
+				state: echo?.state ?? "failed",
+				...echo === void 0 ? { error: "embedded Python unavailable" } : echo.error === null ? {} : { error: echo.error },
+				devices: [...echo?.devices ?? []],
+				session: echo === void 0 ? {
+					loggedIn: false,
+					ageSec: 0,
+					lastSuccessAt: null
+				} : await echo.session()
+			};
+		}));
+		const targets = this.settings.targets;
+		const ids = brokers.map((ref) => ref.id);
+		return {
+			brokers: rows,
+			unassignedTargets: unassignedCount(targets),
+			notice: noticeFor(targets, ids)
+		};
+	}
+	async sendTest(input) {
+		const outcomes = await this.utter(input.brokerId, input.mode, input.echoIds, input.text, input.volume);
+		const known = new Map((this.echoes.get(input.brokerId)?.devices ?? []).map((device) => [device.id, device]));
+		const next = [...this.settings.targets];
+		for (const echoId of input.echoIds) {
+			if (next.some((row) => row.echoId === echoId && row.brokerId === input.brokerId)) continue;
+			next.push({
+				id: `echo-${input.brokerId}-${echoId}`,
+				name: known.get(echoId)?.name ?? echoId,
+				enabled: true,
+				brokerId: input.brokerId,
+				echoId,
+				mode: input.mode,
+				volume: input.volume,
+				respectDnd: true
+			});
+		}
+		this.settings = {
+			...this.settings,
+			targets: next
+		};
+		await this.persist();
+		return { outcomes: outcomes.map((row) => ({
+			echoId: row.targetId,
+			ok: row.ok,
+			...row.error !== void 0 ? { error: row.error } : {}
+		})) };
+	}
+};
+//#endregion
+//#region src/speak/icon-routes.ts
+var ALEXA_ICON_SVG = "<svg role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\" fill=\"#00CAFF\"><title>Amazon Alexa</title><path d=\"M12 0C5.37 0 0 5.37 0 12C0 18.09 4.53 23.11 10.4 23.9V21.5A1.59 1.59 0 0 0 9.32 19.97A8.41 8.41 0 0 1 3.6 11.8A8.37 8.37 0 0 1 12.09 3.6A8.4 8.4 0 0 1 20.4 12.31L20.39 12.38A8.68 8.68 0 0 1 20.36 12.76C20.36 12.83 20.35 12.9 20.34 12.96C20.34 13.04 20.33 13.12 20.32 13.19L20.3 13.29C19.27 20.07 10.45 23.87 10.4 23.9C10.92 23.97 11.46 24 12 24C18.63 24 24 18.63 24 12S18.63 0 12 0Z\"/></svg>";
+/** One day; the mark is immutable per addon version. */
+var CACHE_CONTROL = "public, max-age=86400, immutable";
+function speakIconRoutes() {
+	return [{
+		method: "GET",
+		path: `/icons/${ALEXA_SPEAK_KIND}`,
+		access: "public",
+		description: "Alexa brand mark (image/svg+xml) for the Alexa notification target.",
+		handler: async (_request, reply) => {
+			reply.code(200).type("image/svg+xml").header("cache-control", CACHE_CONTROL).send(ALEXA_ICON_SVG);
+		}
+	}];
+}
+//#endregion
+//#region src/speak/session-store.ts
+/** The Echo worker's cookie jar per broker, in the records store (secret field, keychain-backed). */
+var RecordsSpeakSessionStore = class RecordsSpeakSessionStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
+	}
+	static of(records) {
+		return new RecordsSpeakSessionStore(records.kind(alexaSpeakSessionsEntryKind));
+	}
+	async get(brokerId) {
+		try {
+			const resolved = await this.kind.getResolved(brokerId);
+			return resolved === null ? "" : resolved.data.session;
+		} catch (err) {
+			if (err instanceof RecordSecretUnavailableError) return "";
+			throw err;
+		}
+	}
+	async put(brokerId, sessionB64) {
+		await this.kind.put({
+			id: brokerId,
+			data: {
+				name: brokerId,
+				session: sessionB64
+			}
+		});
+	}
+	async delete(brokerId) {
+		await this.kind.delete(brokerId);
+	}
+};
+//#endregion
 //#region src/addon.ts
+var SPEAK_PAGE = {
+	id: "speak",
+	label: "Speak on Echo",
+	icon: "megaphone",
+	path: "/addon/import-alexa",
+	remoteName: "addon_import_alexa_page",
+	bundle: "remoteEntry.js",
+	section: "administration"
+};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: {
 		proxyHost: "",
 		proxyPort: 3456
+	},
+	speak: {
+		email: "",
+		password: "",
+		region: "EU",
+		session: "",
+		targets: []
 	}
 };
 /** Device types an imported Alexa appliance can materialise as. */
@@ -132727,6 +135232,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	proxyLogin = null;
 	brokerStore = null;
 	activeBrokers = [];
+	speak = null;
+	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -132734,7 +135241,10 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("import-alexa: ctx.records is required (hub-only addon)");
-		await records.declare({ brokers: alexaBrokersEntryKind });
+		await records.declare({
+			brokers: alexaBrokersEntryKind,
+			speakSessions: alexaSpeakSessionsEntryKind
+		});
 		this.brokerStore = AlexaBrokerStore.of(records);
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new AlexaBrokerRegistry(this.ctx.logger, {
@@ -132775,26 +135285,71 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
 		await this.reconcileIntegrationsToBrokers();
 		this.subscribeIntegrationLifecycle();
-		const loginRoutes = buildAlexaLoginRoutes({
+		const loginRoutes = [...buildAlexaLoginRoutes({
 			logger: this.ctx.logger,
 			proxyLogin: this.proxyLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
-		});
-		return [
-			...regs,
-			{
-				capability: brokerCapability,
-				provider: this.buildBrokerProvider()
+		}), ...speakIconRoutes()];
+		const speak = new AlexaSpeakController({
+			logger: this.ctx.logger.child("speak"),
+			readConfig: () => this.config,
+			writeSpeak: async (next) => {
+				await this.updateGlobalSettings({ speak: next });
 			},
-			{
-				capability: deviceAdoptionCapability,
-				provider: this.buildAdoptionProvider()
+			listBrokers: () => this.activeBrokers.map((entry) => ({
+				id: entry.id,
+				name: entry.name,
+				amazonDomain: entry.connection.amazonDomain
+			})),
+			readSeed: async (brokerId) => {
+				const entry = this.activeBrokers.find((row) => row.id === brokerId);
+				return entry === void 0 ? null : readBrokerSeed(this.ctx.dataDir, entry);
 			},
-			{
-				capability: addonRoutesCapability,
-				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-			}
-		];
+			sessions: RecordsSpeakSessionStore.of(records),
+			clearLegacySecrets: async () => {
+				await this.updateGlobalSettingsAsOperator({ speak: {
+					...this.config.speak,
+					password: SECRET_CLEAR,
+					session: SECRET_CLEAR
+				} });
+			},
+			ensurePython: () => this.ctx.deps.ensurePython()
+		});
+		this.speak = speak;
+		speak.start().catch((err) => {
+			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
+		});
+		const pages = {
+			id: this.addonId,
+			listPages: () => [SPEAK_PAGE]
+		};
+		return {
+			providers: [
+				...regs,
+				{
+					capability: brokerCapability,
+					provider: this.buildBrokerProvider()
+				},
+				{
+					capability: deviceAdoptionCapability,
+					provider: this.buildAdoptionProvider()
+				},
+				{
+					capability: addonRoutesCapability,
+					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+				},
+				{
+					capability: notificationOutputCapability,
+					provider: speak.provider
+				},
+				{
+					capability: addonPagesSourceCapability,
+					provider: pages
+				}
+			],
+			customActions: alexaSpeakActions,
+			actionHandlers: speak.handlers()
+		};
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -132807,11 +135362,9 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	async persistBrokerEntries(entries) {
 		this.activeBrokers = [...entries];
 		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: [...entries] });
+		if (store !== null) await store.replaceAll(entries);
+		else await this.updateGlobalSettings({ brokers: [...entries] });
+		this.speak?.brokersChanged();
 	}
 	async onConfigChanged() {
 		const reg = this.registry;
@@ -132857,8 +135410,11 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				} });
 			}
 		}
+		this.speak?.brokersChanged();
 	}
 	async onShutdown() {
+		this.speak?.stop();
+		this.speak = null;
 		alexaCommands.clear();
 		try {
 			await this.proxyLogin?.dispose();
@@ -133163,4 +135719,4 @@ function capsEqual(a, b) {
 	return true;
 }
 //#endregion
-export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };
+export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, alexaSpeakActions as customActions, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };