@camstack/addon-import-alexa 0.2.149 → 0.2.151

package/dist/addon.mjs

@@ -2,14 +2,14 @@ import { createRequire } from "node:module";
 import { randomBytes } from "node:crypto";
 import * as os from "node:os";
 import { networkInterfaces, userInfo } from "node:os";
-import * as fs$1 from "node:fs";
+import * as fs from "node:fs";
 import { existsSync, promises } from "node:fs";
 import * as path$1 from "node:path";
 import path, { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import * as fs from "node:fs/promises";
+import * as fs$1 from "node:fs/promises";
 import { execFileSync, spawn } from "node:child_process";
 import "node:zlib";
+import { fileURLToPath } from "node:url";
 //#region \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -5621,7 +5621,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-0sD_LHLI.mjs
+//#region ../types/dist/sleep--jXS9hWo.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9024,6 +9024,7 @@ var CAP_NAMES = Object.freeze([
 	"filesystem-browse",
 	"flood",
 	"gas",
+	"group-active",
 	"group-commands",
 	"group-status",
 	"heating-valve",
@@ -9845,6 +9846,10 @@ Object.freeze({
 		"path": "detected",
 		"valueType": "boolean"
 	}],
+	"group-active": [{
+		"path": "active",
+		"valueType": "boolean"
+	}],
 	"group-status": [
 		{
 			"path": "included",
@@ -11210,7 +11215,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-CpETZ4HL.mjs
+//#region ../types/dist/composition-Bb8iwHEJ.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -11525,6 +11530,13 @@ var table = {
 		apply: () => {
 			throw new ExpressionEvalError("latchedAt: stateful evaluation context is required");
 		}
+	},
+	schmitt: {
+		minArgs: 3,
+		maxArgs: 5,
+		apply: () => {
+			throw new ExpressionEvalError("schmitt: stateful evaluation context is required");
+		}
 	}
 };
 Object.freeze(Object.assign(Object.create(null), table));
@@ -12035,7 +12047,7 @@ var RESET_PERIODS = [
 5 * MINUTE_MS;
 24 * HOUR_MS, 2 * DAY_MS, 7 * DAY_MS, 30 * DAY_MS;
 7 * DAY_MS, 30 * DAY_MS, 365 * DAY_MS;
-var StatisticWindowSchema = discriminatedUnion("kind", [object({
+var rollingWindowObject = object({
 	kind: literal("rolling"),
 	span: _enum(ROLLING_SPANS),
 	customMinutes: number().int().min(5).optional()
@@ -12052,7 +12064,9 @@ var StatisticWindowSchema = discriminatedUnion("kind", [object({
 		path: ["customMinutes"],
 		input: payload.value
 	});
-}), object({
+});
+var RollingWindowSchema = rollingWindowObject;
+var StatisticWindowSchema = discriminatedUnion("kind", [rollingWindowObject, object({
 	kind: literal("calendar"),
 	period: _enum(CALENDAR_PERIODS)
 })]);
@@ -12082,7 +12096,13 @@ var GROUP_TEMPLATE_IDS = [
 	"occupancy",
 	"binary",
 	"switch",
-	"light"
+	"light",
+	"fan",
+	"cover",
+	"valve",
+	"lock",
+	"media-player",
+	"climate"
 ];
 var NUMERIC_AGGREGATES = [
 	"mean",
@@ -12141,6 +12161,42 @@ var HelperSpecSchema = discriminatedUnion("kind", [
 		reset: _enum(RESET_PERIODS),
 		output: _enum(["energy", "meter"]),
 		source: HelperMemberSchema
+	}),
+	object({
+		kind: literal("threshold"),
+		source: HelperMemberSchema,
+		high: number(),
+		low: number(),
+		onForMs: number().int().nonnegative(),
+		offForMs: number().int().nonnegative()
+	}),
+	object({
+		kind: literal("arithmetic"),
+		op: _enum([
+			"sum",
+			"difference",
+			"ratio"
+		]),
+		inputs: array(HelperMemberSchema).min(2).max(64)
+	}),
+	object({
+		kind: literal("expression"),
+		expr: string().min(1),
+		inputs: array(object({
+			name: string().min(1),
+			member: HelperMemberSchema
+		})).min(1).max(64),
+		output: _enum(["number", "boolean"])
+	}),
+	object({
+		kind: literal("derivative"),
+		window: RollingWindowSchema,
+		per: _enum([
+			"second",
+			"minute",
+			"hour"
+		]),
+		source: HelperMemberSchema
 	})
 ]);
 /** A composed device's stableId is this prefix plus the block id. */
@@ -12203,6 +12259,12 @@ var CompositionFieldSourceSchema = discriminatedUnion("kind", [
 			"all"
 		]),
 		reads: array(CompositionFieldReadSchema).min(1).max(64),
+		/**
+		* Set when the reads are an enum state, not a yes/no: the listed states
+		* count as active (a cover is `open`). A state outside the list is inactive;
+		* a read that is not a state at all is left out. Only `any` / `all` use it.
+		*/
+		activeWhen: array(string().min(1)).min(1).optional(),
 		/** `value` is the reading; the others are the member counts. */
 		publish: _enum([
 			"value",
@@ -18937,13 +18999,17 @@ Object.freeze({
 	latchedAt: {
 		kind: "fixed",
 		result: ["number", "null"]
+	},
+	schmitt: {
+		kind: "fixed",
+		result: ["boolean", "null"]
 	}
 });
 /**
 * One catalog row per base reading a group helper can build (D944 §3).
 * Data, not a form default written into the block.
 */
-var NOW$1 = {
+var NOW$2 = {
 	fieldPath: "lastFetchedAt",
 	expr: "now"
 };
@@ -18957,6 +19023,8 @@ function numeric(input) {
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
 		aggregates: NUMERIC_AGGREGATES,
@@ -18972,6 +19040,8 @@ function binary(input) {
 		family: "binary",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
+		memberDeviceTypes: [DeviceType.Sensor],
+		activeWhen: void 0,
 		commandCaps: [],
 		quantity: "none",
 		baseUnit: void 0,
@@ -18989,7 +19059,7 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "humidity",
@@ -19000,7 +19070,7 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "pressure",
@@ -19011,7 +19081,7 @@ var GROUP_TEMPLATES = [
 		quantity: "pressure",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "illuminance",
@@ -19022,7 +19092,7 @@ var GROUP_TEMPLATES = [
 		quantity: "illuminance",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "power",
@@ -19033,7 +19103,7 @@ var GROUP_TEMPLATES = [
 		quantity: "power",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "energy",
@@ -19044,7 +19114,7 @@ var GROUP_TEMPLATES = [
 		quantity: "energy",
 		defaultAggregate: "sum",
 		empty: "omit",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	numeric({
 		id: "battery",
@@ -19079,7 +19149,7 @@ var GROUP_TEMPLATES = [
 		quantity: "device",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$1]
+		companions: [NOW$2]
 	}),
 	binary({
 		id: "motion",
@@ -19173,6 +19243,11 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one switch is on, or when all of them are. Offline and unknown members are left out of that decision, never read as off, and still receive the command.",
 		deviceType: DeviceType.Switch,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: ["switch"]
 	}),
 	actuator({
@@ -19180,29 +19255,130 @@ var GROUP_TEMPLATES = [
 		summary: "On when at least one light is on, or when all of them are. Brightness and colour are offered only when every member has them. A command is not sent to a member that lacks it.",
 		deviceType: DeviceType.Light,
 		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
 		commandCaps: [
 			"switch",
 			"brightness",
 			"color"
 		]
+	}),
+	actuator({
+		id: "fan",
+		summary: "On when at least one fan is on, or when all of them are. Speed, preset, direction and oscillation are offered only when every fan has them. A command is not sent to a fan that lacks it.",
+		deviceType: DeviceType.Fan,
+		outputCap: "switch",
+		outputField: "on",
+		member: {
+			cap: "switch",
+			fieldPath: "on"
+		},
+		commandCaps: ["switch", "fan-control"]
+	}),
+	actuator({
+		id: "cover",
+		summary: "Open when at least one cover is open or part-open, or only when all of them are. Position and tilt are offered only when every cover has them. A cover that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Cover,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "cover",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["cover"]
+	}),
+	actuator({
+		id: "valve",
+		summary: "Open when at least one valve is open or part-open, or only when all of them are. Position is offered only when every valve has it. A valve that reports nothing is left out, never read as closed.",
+		deviceType: DeviceType.Valve,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "valve",
+			fieldPath: "state"
+		},
+		activeWhen: [
+			"open",
+			"opening",
+			"stopped"
+		],
+		commandCaps: ["valve"]
+	}),
+	actuator({
+		id: "lock",
+		summary: "Locked when at least one lock is locked, or only when all of them are. A jammed or moving lock is not locked. Locking is one tap; unlocking the group needs a confirmation every time, and nothing is sent without it.",
+		deviceType: DeviceType.Lock,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "lock-control",
+			fieldPath: "state"
+		},
+		activeWhen: ["locked"],
+		commandCaps: ["lock-control"]
+	}),
+	actuator({
+		id: "media-player",
+		summary: "Playing when at least one player is playing, or only when all of them are. Volume is offered only when every player has it. A player that reports nothing is left out, never read as stopped.",
+		deviceType: DeviceType.MediaPlayer,
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "media-player",
+			fieldPath: "state"
+		},
+		activeWhen: ["playing", "buffering"],
+		commandCaps: ["media-player"]
+	}),
+	actuator({
+		id: "climate",
+		summary: "Running when at least one thermostat or air conditioner is not off, or only when all of them are. Target temperature and fan are offered only when every device has them. A device that reports nothing is left out, never read as off.",
+		deviceType: DeviceType.Thermostat,
+		memberDeviceTypes: [DeviceType.Thermostat, DeviceType.Climate],
+		outputCap: "group-active",
+		outputField: "active",
+		member: {
+			cap: "climate-control",
+			fieldPath: "mode"
+		},
+		activeWhen: [
+			"heat",
+			"cool",
+			"auto",
+			"heat_cool",
+			"fan_only",
+			"dry"
+		],
+		commandCaps: ["climate-control"]
 	})
 ];
 function actuator(input) {
 	return {
-		...input,
+		id: input.id,
+		summary: input.summary,
+		deviceType: input.deviceType,
+		outputCap: input.outputCap,
+		outputField: input.outputField,
+		commandCaps: input.commandCaps,
 		family: "actuator",
 		role: void 0,
 		memberDeviceType: input.deviceType,
-		outputField: "on",
+		memberDeviceTypes: input.memberDeviceTypes ?? [input.deviceType],
+		activeWhen: input.activeWhen,
 		quantity: "none",
 		baseUnit: void 0,
 		aggregates: BINARY_AGGREGATES,
 		defaultAggregate: "any",
 		empty: "offline",
-		accept: [{
-			cap: "switch",
-			fieldPath: "on"
-		}],
+		accept: [input.member],
 		companions: [CHANGED]
 	};
 }
@@ -47141,7 +47317,20 @@ var NcRuleInputSchema = object({
 	* save by the hub's grouping guard). `.optional()`, never `.default()`: the addon cap
 	* path does not run Zod defaults.
 	*/
-	groupingSec: number().int().min(5).max(60).optional()
+	groupingSec: number().int().min(5).max(60).optional(),
+	/**
+	* ASK ME TO CONFIRM DETECTIONS (#243): a DETECTION notification of this rule
+	* carries "Correct" / "Wrong" buttons (and, where the channel has room, a
+	* "Wrong, it is a <class>" choice). A tap marks the track for retraining, the
+	* same mark the Library writes, and records whose notification it was and
+	* when. A channel with no buttons gets the same two choices as links.
+	*
+	* `.optional()`, never `.default()` (a Zod default does not run on the addon
+	* cap path): absent and `false` both mean off, which is what every rule
+	* authored before this field meant. An editor turns it off by writing
+	* `false`, so it needs no `clear` key.
+	*/
+	askVerdict: boolean().optional()
 });
 /**
 * Partial patch for `updateRule` — any subset of the input fields, plus the
@@ -60738,7 +60927,17 @@ var groupCommandsCapability = {
 	scope: "device",
 	deviceNative: true,
 	mode: "singleton",
-	deviceTypes: [DeviceType.Switch, DeviceType.Light],
+	deviceTypes: [
+		DeviceType.Switch,
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
+	],
 	methods: {},
 	status: {
 		schema: GroupCommandsSchema,
@@ -60756,6 +60955,49 @@ var groupCommandsCapability = {
 	history: "none"
 };
 /**
+* Whether a helper actuator group counts as active (D944): at least one
+* included member is, or every included member is. What "active" means is the
+* type's: a cover is open, a lock is locked, a media player is playing, a
+* climate device is not off. A group of lights, switches and fans reports
+* `switch.on` instead; this cap is for the types whose own state is not a
+* yes/no. Unknown members are left out (`group-status` counts them) and an
+* empty included set takes the device offline, never `active: false`.
+*/
+var GroupActiveSchema = object({
+	active: boolean().meta({ label: "Active" }),
+	/** Ms epoch when the slice was last updated. */
+	lastChangedAt: number()
+});
+var groupActiveCapability = {
+	name: "group-active",
+	scope: "device",
+	deviceNative: true,
+	mode: "singleton",
+	deviceTypes: [
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Climate,
+		DeviceType.Thermostat
+	],
+	methods: {},
+	status: {
+		schema: GroupActiveSchema,
+		kind: "push"
+	},
+	runtimeState: GroupActiveSchema,
+	/**
+	* Runtime-state durability: **session** — recomputed from the members on the
+	* next source event; a restored value would outlive the members it named.
+	*
+	* See `RuntimeStateDurability`. Enforced by
+	* `scripts/check-runtime-state-durability.ts`.
+	*/
+	durability: "session",
+	history: "none"
+};
+/**
 * How many members of a helper group answered (D944). Counts are integers,
 * not measurements: zero included is a real count, never a stand-in reading.
 * The reading itself stays on the output capability. History is none — the
@@ -60786,7 +61028,14 @@ var groupStatusCapability = {
 	deviceTypes: [
 		DeviceType.Sensor,
 		DeviceType.Switch,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan,
+		DeviceType.Cover,
+		DeviceType.Valve,
+		DeviceType.Lock,
+		DeviceType.MediaPlayer,
+		DeviceType.Thermostat,
+		DeviceType.Climate
 	],
 	methods: {},
 	status: {
@@ -62059,7 +62308,14 @@ var lockControlCapability = {
 		}),
 		unlock: method(object({
 			deviceId: number().int().nonnegative(),
-			code: string().min(1).optional()
+			code: string().min(1).optional(),
+			/**
+			* Honoured by a helper lock GROUP only (D944): unlocking several doors
+			* with one call is refused unless the caller says it was confirmed. A
+			* single lock ignores it. The refusal lives in the callee, so no
+			* automation or API caller reaches the doors by skipping a dialog.
+			*/
+			confirm: boolean().optional()
 		}), _void(), {
 			kind: "mutation",
 			auth: "protected"
@@ -67894,7 +68150,8 @@ var switchCapability = {
 	deviceTypes: [
 		DeviceType.Switch,
 		DeviceType.Siren,
-		DeviceType.Light
+		DeviceType.Light,
+		DeviceType.Fan
 	],
 	methods: { setState: method(object({
 		deviceId: number(),
@@ -70107,6 +70364,7 @@ method(object({}), array(TrainingBaseModelSchema).readonly(), { auth: "admin" })
 	kind: "mutation",
 	auth: "admin"
 });
+DeviceFeature.FanSpeed, DeviceFeature.FanPreset, DeviceFeature.FanDirection, DeviceFeature.FanOscillating, DeviceFeature.CoverPositionable, DeviceFeature.CoverTilt, DeviceFeature.ValvePositionable, DeviceFeature.MediaPlayerVolume, DeviceFeature.ClimateFanMode;
 SOURCE_CAPS.filter((cap) => cap !== "switch" && cap !== "motion");
 DeviceType.Camera, DeviceType.Sensor, DeviceType.Button, DeviceType.Switch, DeviceType.PetFeeder, DeviceType.Container, DeviceType.Thermostat, DeviceType.Camera, DeviceType.Hub, DeviceType.Light, DeviceType.Siren, DeviceType.Switch, DeviceType.Sensor, DeviceType.Thermostat, DeviceType.Climate, DeviceType.Button, DeviceType.EventEmitter, DeviceType.Update, DeviceType.Generic, DeviceType.Notifier, DeviceType.Script, DeviceType.Automation, DeviceType.Lock, DeviceType.Cover, DeviceType.Valve, DeviceType.Humidifier, DeviceType.WaterHeater, DeviceType.Fan, DeviceType.MediaPlayer, DeviceType.AlarmPanel, DeviceType.Control, DeviceType.Presence, DeviceType.Weather, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.Container, DeviceType.Image, DeviceType.PetFeeder, DeviceType.Dishwasher, DeviceType.Washer, DeviceType.Dryer, DeviceType.Camera, DeviceType.Camera, DeviceType.Washer, DeviceType.Dryer, DeviceType.Dishwasher, DeviceType.Vacuum, DeviceType.LawnMower, DeviceType.MediaPlayer, DeviceType.WaterHeater, DeviceType.Humidifier, DeviceType.Fan, DeviceType.Climate, DeviceType.Thermostat, DeviceType.PetFeeder;
 String.raw`rose\(active(\d+), changed(\d+), (\d+(?:\.\d+)?)\)`;
@@ -70437,6 +70695,7 @@ var DEVICE_LOCAL_STATE_CAPS = {
 	featureProbe: featureProbeCapability,
 	flood: floodCapability,
 	gas: gasCapability,
+	groupActive: groupActiveCapability,
 	groupCommands: groupCommandsCapability,
 	groupStatus: groupStatusCapability,
 	heatingValve: heatingValveCapability,
@@ -74931,6 +75190,13 @@ Object.freeze({
 		access: "view",
 		role: "viewer"
 	},
+	"groupActive.getStatus": {
+		capName: "group-active",
+		capScope: "device",
+		addonId: null,
+		access: "view",
+		role: "viewer"
+	},
 	"groupCommands.getStatus": {
 		capName: "group-commands",
 		capScope: "device",
@@ -84806,6 +85072,10 @@ var SENSOR_CAP_VOCABULARY = {
 			icon: "flame"
 		}]
 	},
+	"group-active": {
+		scope: "device",
+		noun: t("Group state", "Stato del gruppo")
+	},
 	"group-commands": {
 		scope: "device",
 		noun: t("Group command", "Comando di gruppo")
@@ -86352,6 +86622,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"groupActive.getStatus": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"groupCommands.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -89747,32 +90022,39 @@ var alexaProxyLoginSchema = object({
 	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = auto-detect)"),
 	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
 });
-/** Amazon account used to speak on Echo devices. The session blob is the cookie jar. */
+/**
+* Echo speech settings. Speech signs in as an import broker, so the targets
+* are what lives here. `email`, `password`, `region` and `session` are the OLD
+* standalone login: they are read once to migrate it onto the single broker
+* (see `speak/migration.ts`) and written back empty.
+*/
 var alexaSpeakSettingsSchema = object({
 	email: string().default(""),
-	password: string().default("").describe("Amazon password").meta({ secret: true }),
+	password: string().default("").describe("Legacy Amazon password").meta({ secret: true }),
 	region: _enum([
 		"NA",
 		"EU",
 		"FE"
 	]).default("EU"),
-	session: string().default("").describe("Alexa session blob").meta({ secret: true }),
+	session: string().default("").describe("Legacy Alexa session blob").meta({ secret: true }),
 	targets: array(object({
 		id: string(),
 		name: string(),
 		enabled: boolean(),
+		/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
+		brokerId: string().default(""),
 		echoId: string(),
 		mode: _enum(["speak", "announce"]),
 		volume: number(),
 		respectDnd: boolean()
 	})).default([])
 });
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
 function readSpeakSettings(config) {
-	const raw = isRecord$2(config.speak) ? config.speak : {};
+	const raw = isRecord$3(config.speak) ? config.speak : {};
 	const region = raw["region"];
 	const targets = raw["targets"];
 	return alexaSpeakSettingsSchema.parse({
@@ -131888,15 +132170,15 @@ function parseCookieMaterial(raw) {
 	}
 }
 /** True when `value` is a non-null, non-array plain object (cast-free guard). */
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Narrow a loaded JSON file to its `cookieData` (string | object), or null. */
 function readCookieData(json) {
-	if (!isRecord$1(json)) return null;
+	if (!isRecord$2(json)) return null;
 	const value = json["cookieData"];
 	if (typeof value === "string") return value;
-	if (isRecord$1(value)) return value;
+	if (isRecord$2(value)) return value;
 	return null;
 }
 //#endregion
@@ -132871,7 +133153,7 @@ function mergeAlexaMotionStatus(cached, live, nowMs) {
 	};
 }
 /** True when `v` is a non-null, non-array object (cast-free guard). */
-function isRecord(v) {
+function isRecord$1(v) {
 	return typeof v === "object" && v !== null && !Array.isArray(v);
 }
 /**
@@ -132880,7 +133162,7 @@ function isRecord(v) {
 */
 function decodeTemperatureCelsius(value) {
 	if (typeof value === "number") return Number.isFinite(value) ? value : null;
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	const raw = value["value"];
 	const n = typeof raw === "number" ? raw : Number(raw);
 	if (!Number.isFinite(n)) return null;
@@ -132891,7 +133173,7 @@ function decodeTemperatureCelsius(value) {
 function decodeHumidityPercent(value) {
 	const direct = decodePercentage(value);
 	if (direct !== null) return direct;
-	if (!isRecord(value)) return null;
+	if (!isRecord$1(value)) return null;
 	return decodePercentage(value["value"]);
 }
 //#endregion
@@ -133227,6 +133509,16 @@ var alexaBrokersEntryKind = defineEntryKind("brokers", {
 	}),
 	writeTrigger: "an operator links or removes an Alexa account broker"
 });
+var alexaSpeakSessionsEntryKind = defineEntryKind("speak-sessions", {
+	title: "Alexa Echo speech sessions",
+	schema: entryBody({ session: string().default("").meta({ secret: true }) }),
+	writeTrigger: "an Echo worker signs in as an Alexa account broker"
+});
+/** Every kind this addon declares, keyed by its name: `records.declare` refuses any other key. */
+var alexaRecordKinds = {
+	brokers: alexaBrokersEntryKind,
+	"speak-sessions": alexaSpeakSessionsEntryKind
+};
 //#endregion
 //#region src/alexa-broker-store.ts
 function rowToEntry(id, data) {
@@ -133288,12 +133580,8 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 var ALEXA_SPEAK_ADDON_ID = "import-alexa";
 var ALEXA_SPEAK_KIND = "alexa-echo";
 var DEVICE_REFRESH_MS = 5 * 6e4;
-var OTP_ALERT_ID = "import-alexa.speak-otp-required";
-var ALEXA_REGIONS = [
-	"NA",
-	"EU",
-	"FE"
-];
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
 //#endregion
 //#region src/speak/worker-protocol.ts
 /** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
@@ -133304,14 +133592,11 @@ var EchoDeviceSchema = object({
 	online: boolean(),
 	kind: _enum(["device", "group"]),
 	dnd: boolean(),
-	deviceType: string()
+	deviceType: string(),
+	/** The room the account files the device under, when Amazon names one. */
+	room: string().optional()
 });
-var LoginStatusSchema = _enum([
-	"ok",
-	"otp_needed",
-	"captcha",
-	"failed"
-]);
+var LoginStatusSchema = _enum(["ok", "failed"]);
 var SessionStatusSchema = object({
 	loggedIn: boolean(),
 	ageSec: number().int().nonnegative(),
@@ -133365,40 +133650,37 @@ function parseSessionStatus(result) {
 }
 //#endregion
 //#region src/speak/actions.ts
+var BrokerEchoStateSchema = _enum([
+	"starting",
+	"ready",
+	"broker-not-signed-in",
+	"failed"
+]);
 var SpeakStatusSchema = object({
-	phase: _enum([
-		"sign-in",
-		"otp",
-		"captcha",
-		"devices"
-	]),
-	email: string(),
-	region: _enum(ALEXA_REGIONS),
-	devices: array(EchoDeviceSchema),
-	session: SessionStatusSchema
-});
-var LoginResultSchema = object({
-	status: LoginStatusSchema,
-	error: string().optional()
+	brokers: array(object({
+		id: string(),
+		name: string(),
+		state: BrokerEchoStateSchema,
+		error: string().optional(),
+		devices: array(EchoDeviceSchema),
+		session: SessionStatusSchema
+	})),
+	/** Targets that name no Amazon account yet (they cannot speak until one is chosen). */
+	unassignedTargets: number().int().nonnegative(),
+	/** What the old standalone login left behind, named; '' when nothing is pending. */
+	notice: _enum([
+		"",
+		"no-broker",
+		"choose-broker"
+	])
 });
 var alexaSpeakActions = defineCustomActions({
 	speakStatus: customAction(object({}), SpeakStatusSchema, {
 		kind: "mutation",
 		auth: "admin"
 	}),
-	loginStart: customAction(object({
-		email: string().min(1),
-		password: string().min(1).meta({ secret: true }),
-		region: _enum(ALEXA_REGIONS)
-	}), LoginResultSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	loginOtp: customAction(object({ code: string().min(1).max(12) }), LoginResultSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
 	sendTest: customAction(object({
+		brokerId: string().min(1),
 		echoIds: array(string().min(1)).min(1),
 		mode: _enum(["speak", "announce"]),
 		volume: number().int().min(0).max(100),
@@ -133413,55 +133695,403 @@ var alexaSpeakActions = defineCustomActions({
 	})
 });
 //#endregion
-//#region src/speak/otp-alert.ts
+//#region src/speak/broker-seed.ts
+/**
+* What the Echo worker needs from an import broker to act as the same Amazon
+* account: the refresh token of the broker's own device registration. The
+* broker keeps that registration fresh (it persists `cookieData` after every
+* refresh), so the freshest copy is the persisted session file, then the
+* stored cookie blob, then a bare refresh token. A raw cookie string carries
+* no refresh token and gives no seed.
+*/
+/** The registration name alexapy sends when the broker did not record one. */
+var DEFAULT_DEVICE_APP_NAME = "Alexa Media Player";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The registration blob alexa-remote2 hands back, from an object or its JSON text. */
+function asRegistration(value) {
+	if (isRecord(value)) return value;
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed.startsWith("{")) return null;
+	try {
+		const parsed = JSON.parse(trimmed);
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function seedFromRegistration(value) {
+	const registration = asRegistration(value);
+	if (registration === null) return null;
+	const token = registration["refreshToken"];
+	if (typeof token !== "string" || token.length === 0) return null;
+	const name = registration["deviceAppName"];
+	return {
+		refreshToken: token,
+		deviceAppName: typeof name === "string" && name.length > 0 ? name : DEFAULT_DEVICE_APP_NAME
+	};
+}
+async function readPersistedRegistration(dataDir, brokerId) {
+	if (dataDir === void 0) return null;
+	try {
+		const raw = await fs$1.readFile(path$1.join(dataDir, `${brokerId}.${SESSION_FILE}`), "utf8");
+		const json = JSON.parse(raw);
+		return isRecord(json) ? json["cookieData"] : null;
+	} catch {
+		return null;
+	}
+}
+async function readBrokerSeed(dataDir, entry) {
+	const persisted = seedFromRegistration(await readPersistedRegistration(dataDir, entry.id));
+	if (persisted !== null) return persisted;
+	const stored = seedFromRegistration(entry.connection.cookie);
+	if (stored !== null) return stored;
+	const bare = entry.connection.refreshToken;
+	if (bare.length > 0) return {
+		refreshToken: bare,
+		deviceAppName: DEFAULT_DEVICE_APP_NAME
+	};
+	return null;
+}
+/** Amazon domain to the region the worker uses for the spoken-sequence locale. */
+function regionOfDomain(domain) {
+	const tail = domain.toLowerCase().replace(/^(www|alexa)\./, "");
+	if (tail === "amazon.com") return "NA";
+	if (tail === "amazon.co.jp" || tail === "amazon.com.au" || tail === "amazon.in") return "FE";
+	return "EU";
+}
+process.platform, process.env["SystemRoot"];
 /**
-* A login that needs a new one-time code raises ONE operator alert.
-* Further failures in the same episode do not raise another.
+* Files only their owner may read: the one place a secret-bearing file is
+* restricted, on every OS.
+*
+* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
+* attribute and nothing else, and `chmod` is a no-op for permissions, so a
+* "0600" `agent.json` (the mesh private key) would have
+* been readable by every local user. Windows has its own tool for this:
+* `icacls`. This module removes the inherited ACL entries and grants access to
+* the current user and SYSTEM only — the Windows reading of "0600".
+*
+* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
+* this single file (see `packages/desktop/tsup.config.ts`) instead of the
+* whole `@camstack/types` barrel.
+*
+* Failure is NOT swallowed. A secret file that could not be restricted is a
+* secret file the caller must know about, so `OwnerOnlyError` propagates; the
+* write order below makes sure nothing sensitive is in the file yet when that
+* happens (the temp file is empty until it has been restricted).
+*
+* Out of scope on purpose: files that are only tidy, not secret (the job
+* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
+* write would be a process spawn on a hot path.
 */
-function buildOtpAlert(now, reason) {
-	const otp = reason === "otp";
+/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
+var WINDOWS_SYSTEM_SID = "*S-1-5-18";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var OwnerOnlyError = class extends Error {
+	target;
+	constructor(target, detail) {
+		super(`could not restrict ${target} to its owner: ${detail}`);
+		this.target = target;
+		this.name = "OwnerOnlyError";
+	}
+};
+function currentPrincipal() {
+	const user = process.env["USERNAME"] ?? userInfo().username;
+	const domain = process.env["USERDOMAIN"];
+	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
+}
+/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
+function resolveDeps(overrides) {
 	return {
-		id: OTP_ALERT_ID,
-		category: EventCategory.AddonError,
-		severity: "error",
-		title: otp ? "Alexa needs a new sign-in code" : "Alexa sign-in needs a captcha",
-		message: otp ? "Amazon asked for a one-time code before Echo devices can speak. Open Alexa → Speak on Echo and enter the code." : "Amazon asked for a captcha. Wait a few minutes, then sign in again on Alexa → Speak on Echo.",
-		action: {
-			label: "Sign in",
-			href: "/addon/import-alexa",
-			navigation: "app"
-		},
-		status: "active",
-		read: false,
-		createdAt: now,
-		updatedAt: now,
-		source: {
-			type: "addon",
-			id: "import-alexa"
-		},
-		metadata: { episodeKey: reason }
+		platform: process.platform,
+		exec: (file, args) => {
+			execFileSync(file, [...args], {
+				stdio: "pipe",
+				windowsHide: true
+			});
+		},
+		principal: currentPrincipal,
+		systemRoot: process.env["SystemRoot"],
+		...overrides
 	};
 }
-var OtpAttention = class {
-	ports;
-	open = null;
-	constructor(ports) {
-		this.ports = ports;
-	}
-	/** First need in an episode emits the alert. A repeat does not. */
-	async needed(reason) {
-		if (this.open !== null) return "already-open";
-		this.open = reason;
-		await this.ports.emit(buildOtpAlert(this.ports.now(), reason));
-		return "raised";
-	}
-	async cleared() {
-		if (this.open === null) return;
-		this.open = null;
-		await this.ports.resolve(OTP_ALERT_ID);
+/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
+function icaclsArgs(target, principal, isDirectory) {
+	const inherit = isDirectory ? "(OI)(CI)" : "";
+	return [
+		target,
+		"/inheritance:r",
+		"/grant:r",
+		`${principal}:${inherit}F`,
+		"/grant:r",
+		`${WINDOWS_SYSTEM_SID}:${inherit}F`
+	];
+}
+function restrictWindows(target, isDirectory, deps) {
+	const icacls = path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
+	try {
+		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
+	} catch (err) {
+		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
+	}
+}
+/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
+function restrictFileToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, false, deps);
+		return;
+	}
+	fs.chmodSync(target, FILE_MODE);
+}
+/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
+function restrictDirToOwnerSync(target, overrides = {}) {
+	const deps = resolveDeps(overrides);
+	if (deps.platform === "win32") {
+		restrictWindows(target, true, deps);
+		return;
+	}
+	fs.chmodSync(target, DIR_MODE);
+}
+/**
+* Atomically write a secret-bearing file that only its owner can read.
+*
+* Order matters: the temp file is created EMPTY, restricted, and only then
+* given its content, so there is no moment at which the secret exists under a
+* permissive ACL. The rename carries the (already restricted) ACL with it.
+*/
+function writeOwnerOnlyFileSync(target, data, overrides = {}) {
+	fs.mkdirSync(path$1.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp.${process.pid}`;
+	fs.writeFileSync(tmp, "", { mode: FILE_MODE });
+	try {
+		restrictFileToOwnerSync(tmp, overrides);
+		fs.writeFileSync(tmp, data);
+		fs.renameSync(tmp, target);
+	} catch (err) {
+		fs.rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+//#endregion
+//#region src/speak/secret-file.ts
+/**
+* Hand a refresh token or a saved Amazon session to the Python worker as an
+* owner-only file. The path travels on stdin. The bytes never travel on
+* argv or in the environment, and they are removed when the call settles.
+*/
+var REDACTED = "‹redacted›";
+function decodeSession(sessionB64) {
+	if (sessionB64.length === 0) return Buffer.alloc(0);
+	return Buffer.from(sessionB64, "base64");
+}
+async function readSessionB64(sessionPath) {
+	const bytes = await fs$1.readFile(sessionPath);
+	if (bytes.length === 0) return "";
+	return bytes.toString("base64");
+}
+/**
+* Create a 0700 directory, write the refresh token and the session 0600, run
+* `body`, then delete the directory whether `body` succeeded or threw.
+* Returns the session file as base64 so the caller can store it in the keychain.
+*/
+async function withSpeakSecretFiles(input, body) {
+	const dir = await fs$1.mkdtemp(path$1.join(os.tmpdir(), "camstack-alexa-"));
+	const paths = {
+		dir,
+		refreshTokenPath: path$1.join(dir, "refresh-token"),
+		sessionPath: path$1.join(dir, "session")
+	};
+	try {
+		restrictDirToOwnerSync(dir);
+		writeOwnerOnlyFileSync(paths.refreshTokenPath, input.refreshToken);
+		writeOwnerOnlyFileSync(paths.sessionPath, decodeSession(input.sessionB64));
+		await body(paths);
+		return { sessionB64: await readSessionB64(paths.sessionPath) };
+	} finally {
+		await fs$1.rm(dir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Replace every occurrence of each non-empty secret. Used before a log line is emitted. */
+function scrubSecrets(text, secrets) {
+	let out = text;
+	for (const secret of secrets) {
+		if (secret.length === 0) continue;
+		out = out.split(secret).join(REDACTED);
+	}
+	return out;
+}
+//#endregion
+//#region src/speak/broker-echo.ts
+var BrokerEcho = class {
+	deps;
+	currentState = "starting";
+	currentError = null;
+	currentDevices = [];
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get id() {
+		return this.deps.brokerId;
+	}
+	get name() {
+		return this.deps.brokerName;
+	}
+	get state() {
+		return this.currentState;
+	}
+	get error() {
+		return this.currentError;
+	}
+	get devices() {
+		return this.currentDevices;
+	}
+	stop() {
+		this.deps.worker.stop();
+	}
+	/** Sign the worker in as the broker's account. Never throws; the outcome is `state`. */
+	async signIn() {
+		const { brokerId, worker, sessions, logger } = this.deps;
+		const tags = { tags: { brokerId } };
+		let secrets = [];
+		try {
+			const seed = await this.deps.readSeed();
+			const stored = await sessions.get(brokerId);
+			if (seed === null && stored.length === 0) {
+				this.currentState = "broker-not-signed-in";
+				this.currentError = null;
+				logger.warn("alexa speak: the broker has no sign-in to share yet", tags);
+				return;
+			}
+			secrets = seed === null ? [] : [seed.refreshToken];
+			worker.noteSecrets(secrets);
+			let outcome = parseLoginResult({
+				status: "failed",
+				error: "worker gave no answer"
+			});
+			const held = await withSpeakSecretFiles({
+				refreshToken: seed?.refreshToken ?? "",
+				sessionB64: stored
+			}, async (paths) => {
+				outcome = parseLoginResult(await worker.request({
+					op: "login_broker",
+					label: brokerId,
+					refreshTokenPath: seed === null ? "" : paths.refreshTokenPath,
+					deviceAppName: seed?.deviceAppName ?? "",
+					domain: this.deps.domain,
+					sessionPath: paths.sessionPath,
+					region: regionOfDomain(this.deps.domain)
+				}));
+			});
+			if (held.sessionB64.length > 0 && held.sessionB64 !== stored) await sessions.put(brokerId, held.sessionB64);
+			this.currentError = outcome.status === "ok" ? null : outcome.error ?? "sign-in failed";
+			this.currentState = outcome.status === "ok" ? "ready" : "failed";
+			if (outcome.status !== "ok") {
+				logger.warn("alexa speak: sign-in as the broker failed", {
+					...tags,
+					meta: { error: this.currentError }
+				});
+				return;
+			}
+			await this.refreshDevices();
+		} catch (err) {
+			this.currentState = "failed";
+			this.currentError = scrubSecrets(err instanceof Error ? err.message : String(err), secrets);
+			logger.warn("alexa speak: sign-in as the broker failed", {
+				...tags,
+				meta: { error: this.currentError }
+			});
+		}
+	}
+	/** A session that is not ready tries to sign in again before it gives up. */
+	async ensureReady() {
+		if (this.currentState !== "ready") await this.signIn();
+		return this.currentState === "ready";
+	}
+	async refreshDevices() {
+		if (this.currentState !== "ready") return;
+		try {
+			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
+		} catch (err) {
+			this.deps.logger.warn("alexa speak: device refresh failed", {
+				tags: { brokerId: this.deps.brokerId },
+				meta: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+	}
+	async utter(op, targets, text, volume) {
+		if (!await this.ensureReady()) throw new Error(this.notReadyReason());
+		return parseDeliveries(await this.deps.worker.request({
+			op,
+			targets,
+			text,
+			volume
+		}));
+	}
+	async session() {
+		if (this.deps.worker.failed) return {
+			loggedIn: false,
+			ageSec: 0,
+			lastSuccessAt: null
+		};
+		try {
+			return parseSessionStatus(await this.deps.worker.request({ op: "session_status" }));
+		} catch {
+			return {
+				loggedIn: this.currentState === "ready",
+				ageSec: 0,
+				lastSuccessAt: null
+			};
+		}
+	}
+	notReadyReason() {
+		if (this.currentState === "broker-not-signed-in") return `account '${this.deps.brokerName}' is not signed in on its broker`;
+		return this.currentError ?? "alexa session is not ready";
 	}
 };
 //#endregion
+//#region src/speak/migration.ts
+function legacyLoginOf(settings) {
+	return {
+		email: settings.email,
+		password: settings.password,
+		session: settings.session
+	};
+}
+function planLegacyMigration(legacy, brokerIds, targets) {
+	const present = legacy.email.length > 0 || legacy.password.length > 0 || legacy.session.length > 0;
+	const only = brokerIds.length === 1 ? brokerIds[0] ?? null : null;
+	if (!present || only === null) return {
+		present,
+		attachTo: null,
+		targets
+	};
+	return {
+		present,
+		attachTo: legacy.session.length > 0 ? only : null,
+		targets: targets.map((row) => row.brokerId.length > 0 ? row : {
+			...row,
+			brokerId: only
+		})
+	};
+}
+/** What the page must tell the operator about targets that name no account. */
+function noticeFor(targets, brokerIds) {
+	if (!targets.some((row) => row.brokerId.length === 0)) return "";
+	if (brokerIds.length === 0) return "no-broker";
+	return brokerIds.length > 1 ? "choose-broker" : "";
+}
+function unassignedCount(targets) {
+	return targets.filter((row) => row.brokerId.length === 0).length;
+}
+//#endregion
 //#region src/speak/rate-limit.ts
 /**
 * Per-Echo admission. A burst is dropped here, not queued: a queue would be
@@ -133576,19 +134206,58 @@ function readVolume(config) {
 function respectDnd(config) {
 	return config["respectDnd"] !== false;
 }
-function configSchema() {
+/** "Kitchen · Living room · ECHO" — the name first, then what tells two Echoes apart. */
+function echoOptionLabel(device) {
+	const kind = device.kind === "group" ? "Group" : device.family;
+	const parts = [device.name.length > 0 ? device.name : device.id];
+	if (device.room !== void 0 && device.room.length > 0) parts.push(device.room);
+	if (kind.length > 0) parts.push(kind);
+	return parts.join(" · ");
+}
+function echoField(devices, showWhen) {
+	return {
+		type: "select",
+		key: "echoId",
+		label: "Echo",
+		labelKey: "import-alexa:echoTarget.s_echo.echoId.label",
+		description: devices.length === 0 ? "No Echo found yet. Sign the Amazon account in on Integrations, Alexa." : void 0,
+		descriptionKey: devices.length === 0 ? "import-alexa:echoTarget.s_echo.echoId.empty" : void 0,
+		options: devices.map((device) => ({
+			value: device.id,
+			label: echoOptionLabel(device)
+		})),
+		...showWhen === void 0 ? {} : { showWhen }
+	};
+}
+/**
+* The two pickers are not `required`: a required select shows its first option
+* while the form still holds no value, so a save would drop the choice. Left
+* optional they open on "Select", and `upsertTarget` refuses an empty pick.
+*
+* The Echo picker is built from the accounts' own device lists on every call,
+* so a new Echo shows up without a deploy. With one account there is no account
+* field; with several, each account's Echoes appear when that account is chosen.
+*/
+function configSchema(brokers) {
+	const first = brokers[0];
 	return { sections: [{
 		id: "echo",
 		title: "Echo",
 		titleKey: "import-alexa:echoTarget.s_echo.title",
 		fields: [
-			{
-				type: "text",
-				key: "echoId",
-				label: "Echo id",
-				labelKey: "import-alexa:echoTarget.s_echo.echoId.label",
-				required: true
-			},
+			...brokers.length > 1 ? [{
+				type: "select",
+				key: "brokerId",
+				label: "Amazon account",
+				labelKey: "import-alexa:echoTarget.s_echo.brokerId.label",
+				options: brokers.map((broker) => ({
+					value: broker.id,
+					label: broker.name
+				}))
+			}, ...brokers.map((broker) => echoField(broker.devices, {
+				field: "brokerId",
+				equals: broker.id
+			}))] : [echoField(first?.devices ?? [])],
 			{
 				type: "select",
 				key: "mode",
@@ -133622,15 +134291,18 @@ function configSchema() {
 		]
 	}] };
 }
-function kindDescriptor() {
+/** The Alexa target kind as the Add target form sees it, for the accounts as they are now. */
+function alexaTargetKind(brokers) {
 	return {
 		kind: ALEXA_SPEAK_KIND,
 		label: "Alexa",
 		icon: "megaphone",
+		iconUrl: ALEXA_SPEAK_ICON_URL,
+		iconMediaType: "image/svg+xml",
 		addonId: ALEXA_SPEAK_ADDON_ID,
 		supportsDiscovery: true,
-		destinationKeys: ["echoId"],
-		configSchema: configSchema(),
+		destinationKeys: ["brokerId", "echoId"],
+		configSchema: configSchema(brokers),
 		caps: {
 			attachments: {
 				mediaTypes: [],
@@ -133652,11 +134324,12 @@ function kindDescriptor() {
 		}
 	};
 }
-function discoveredFrom(device) {
+function discoveredFrom(broker, device) {
 	return {
 		kind: ALEXA_SPEAK_KIND,
 		suggestedName: device.name.length > 0 ? device.name : device.id,
 		config: {
+			brokerId: broker.id,
 			echoId: device.id,
 			mode: "speak",
 			volume: 40,
@@ -133674,8 +134347,18 @@ function createAlexaNotificationProvider(ports) {
 	function record(row) {
 		deliveries = [...deliveries, row];
 	}
-	function deviceFor(echoId) {
-		return ports.devices().find((device) => device.id === echoId);
+	/**
+	* The account a target speaks through: the one it names; else the only one
+	* there is; else the one whose Echoes include the target's Echo.
+	*/
+	function brokerFor(config) {
+		const all = ports.brokers();
+		const named = readString(config, "brokerId");
+		if (named.length > 0) return all.find((broker) => broker.id === named);
+		if (all.length === 1) return all[0];
+		const echoId = readString(config, "echoId");
+		const owners = all.filter((broker) => broker.devices.some((device) => device.id === echoId));
+		return owners.length === 1 ? owners[0] : void 0;
 	}
 	function persist(next) {
 		targets = next;
@@ -133721,7 +134404,29 @@ function createAlexaNotificationProvider(ports) {
 				renderedAs: speech.renderedAs
 			};
 		}
-		const device = deviceFor(echoId);
+		const broker = brokerFor(target.config);
+		if (broker === void 0) {
+			const error = "target has no Amazon account";
+			record({
+				targetId: target.id,
+				outcome: "failed",
+				at: ports.now(),
+				error
+			});
+			logger.warn("alexa speak dropped: target names no Amazon account", {
+				...tags,
+				meta: {
+					targetId: target.id,
+					echoId
+				}
+			});
+			return {
+				success: false,
+				error,
+				renderedAs: speech.renderedAs
+			};
+		}
+		const device = broker.devices.find((row) => row.id === echoId);
 		if (device !== void 0 && respectDnd(target.config) && device.dnd) {
 			record({
 				targetId: target.id,
@@ -133783,6 +134488,7 @@ function createAlexaNotificationProvider(ports) {
 		const mode = readMode(target.config);
 		try {
 			const outcomes = await ports.speak({
+				brokerId: broker.id,
 				mode,
 				targets: [echoId],
 				text: speech.text,
@@ -133857,7 +134563,7 @@ function createAlexaNotificationProvider(ports) {
 			return deliveries;
 		},
 		async listTargetKinds() {
-			return [kindDescriptor()];
+			return [alexaTargetKind(ports.brokers())];
 		},
 		async listTargets() {
 			return [...targets];
@@ -133868,16 +134574,21 @@ function createAlexaNotificationProvider(ports) {
 			return found;
 		},
 		async discoverTargets() {
-			return ports.devices().map(discoveredFrom);
+			const taken = new Set(targets.flatMap((row) => {
+				const owner = brokerFor(row.config);
+				return owner === void 0 ? [] : [`${owner.id}/${readString(row.config, "echoId")}`];
+			}));
+			return ports.brokers().flatMap((broker) => broker.devices.filter((device) => !taken.has(`${broker.id}/${device.id}`)).map((device) => discoveredFrom(broker, device)));
 		},
-		async probeTargetConfig() {
-			return ports.loggedIn() ? {
+		async probeTargetConfig(input) {
+			const broker = brokerFor(input.config);
+			return broker !== void 0 && broker.ready ? {
 				ok: true,
 				resolvedUrl: "alexa://session"
 			} : {
 				ok: false,
 				resolvedUrl: "alexa://session",
-				error: "not signed in"
+				error: "the Amazon account is not signed in on its broker"
 			};
 		},
 		async send(input) {
@@ -133910,8 +134621,16 @@ function createAlexaNotificationProvider(ports) {
 			});
 		},
 		async upsertTarget(input) {
+			const owner = brokerFor(input.target.config);
+			if (readString(input.target.config, "echoId").length === 0) throw new Error("Pick the Echo that should speak");
+			if (owner === void 0) throw new Error("Pick the Amazon account this Echo belongs to");
+			const pinned = readString(input.target.config, "brokerId").length === 0 ? {
+				...input.target.config,
+				brokerId: owner.id
+			} : input.target.config;
 			const target = {
 				...input.target,
+				config: pinned,
 				addonId: ALEXA_SPEAK_ADDON_ID,
 				kind: ALEXA_SPEAK_KIND
 			};
@@ -133942,186 +134661,10 @@ function resolveAlexaWorkerScript(fromModuleUrl = import.meta.url) {
 	for (const candidate of candidates) if (existsSync(candidate)) return candidate;
 	throw new Error(`import-alexa: alexa_worker.py not found. Searched:\n${candidates.join("\n")}`);
 }
-process.platform, process.env["SystemRoot"];
-/**
-* Files only their owner may read: the one place a secret-bearing file is
-* restricted, on every OS.
-*
-* `mode: 0o600` is a POSIX idea. On Windows Node maps it to the read-only
-* attribute and nothing else, and `chmod` is a no-op for permissions, so a
-* "0600" `agent.json` (the mesh private key) would have
-* been readable by every local user. Windows has its own tool for this:
-* `icacls`. This module removes the inherited ACL entries and grants access to
-* the current user and SYSTEM only — the Windows reading of "0600".
-*
-* ZERO imports beyond Node built-ins, on purpose: the Electron shell bundles
-* this single file (see `packages/desktop/tsup.config.ts`) instead of the
-* whole `@camstack/types` barrel.
-*
-* Failure is NOT swallowed. A secret file that could not be restricted is a
-* secret file the caller must know about, so `OwnerOnlyError` propagates; the
-* write order below makes sure nothing sensitive is in the file yet when that
-* happens (the temp file is empty until it has been restricted).
-*
-* Out of scope on purpose: files that are only tidy, not secret (the job
-* journal, the addon manifest) keep a plain `mode`, since one `icacls` per
-* write would be a process spawn on a hot path.
-*/
-/** `*S-1-5-18` is SYSTEM in every locale — a name like "SYSTEM" is not. */
-var WINDOWS_SYSTEM_SID = "*S-1-5-18";
-var FILE_MODE = 384;
-var DIR_MODE = 448;
-var OwnerOnlyError = class extends Error {
-	target;
-	constructor(target, detail) {
-		super(`could not restrict ${target} to its owner: ${detail}`);
-		this.target = target;
-		this.name = "OwnerOnlyError";
-	}
-};
-function currentPrincipal() {
-	const user = process.env["USERNAME"] ?? userInfo().username;
-	const domain = process.env["USERDOMAIN"];
-	return domain !== void 0 && domain.length > 0 ? `${domain}\\${user}` : user;
-}
-/** Resolved per call, not at import: a platform stubbed by a test must be seen. */
-function resolveDeps(overrides) {
-	return {
-		platform: process.platform,
-		exec: (file, args) => {
-			execFileSync(file, [...args], {
-				stdio: "pipe",
-				windowsHide: true
-			});
-		},
-		principal: currentPrincipal,
-		systemRoot: process.env["SystemRoot"],
-		...overrides
-	};
-}
-/** The icacls argv for one path: no inheritance, owner + SYSTEM only. */
-function icaclsArgs(target, principal, isDirectory) {
-	const inherit = isDirectory ? "(OI)(CI)" : "";
-	return [
-		target,
-		"/inheritance:r",
-		"/grant:r",
-		`${principal}:${inherit}F`,
-		"/grant:r",
-		`${WINDOWS_SYSTEM_SID}:${inherit}F`
-	];
-}
-function restrictWindows(target, isDirectory, deps) {
-	const icacls = path$1.win32.join(deps.systemRoot ?? "C:\\Windows", "System32", "icacls.exe");
-	try {
-		deps.exec(icacls, icaclsArgs(target, deps.principal(), isDirectory));
-	} catch (err) {
-		throw new OwnerOnlyError(target, err instanceof Error ? err.message : String(err));
-	}
-}
-/** Restrict an existing file to its owner (chmod 0600 / owner+SYSTEM ACL). */
-function restrictFileToOwnerSync(target, overrides = {}) {
-	const deps = resolveDeps(overrides);
-	if (deps.platform === "win32") {
-		restrictWindows(target, false, deps);
-		return;
-	}
-	fs$1.chmodSync(target, FILE_MODE);
-}
-/** Restrict an existing directory to its owner (chmod 0700 / owner+SYSTEM, inherited). */
-function restrictDirToOwnerSync(target, overrides = {}) {
-	const deps = resolveDeps(overrides);
-	if (deps.platform === "win32") {
-		restrictWindows(target, true, deps);
-		return;
-	}
-	fs$1.chmodSync(target, DIR_MODE);
-}
-/**
-* Atomically write a secret-bearing file that only its owner can read.
-*
-* Order matters: the temp file is created EMPTY, restricted, and only then
-* given its content, so there is no moment at which the secret exists under a
-* permissive ACL. The rename carries the (already restricted) ACL with it.
-*/
-function writeOwnerOnlyFileSync(target, data, overrides = {}) {
-	fs$1.mkdirSync(path$1.dirname(target), { recursive: true });
-	const tmp = `${target}.tmp.${process.pid}`;
-	fs$1.writeFileSync(tmp, "", { mode: FILE_MODE });
-	try {
-		restrictFileToOwnerSync(tmp, overrides);
-		fs$1.writeFileSync(tmp, data);
-		fs$1.renameSync(tmp, target);
-	} catch (err) {
-		fs$1.rmSync(tmp, { force: true });
-		throw err;
-	}
-}
-//#endregion
-//#region src/speak/secret-file.ts
-/**
-* Hand a password or a saved Amazon session to the Python worker as an
-* owner-only file. The path travels on stdin. The bytes never travel on
-* argv or in the environment, and they are removed when the call settles.
-*/
-var REDACTED = "‹redacted›";
-function decodeSession(sessionB64) {
-	if (sessionB64.length === 0) return Buffer.alloc(0);
-	return Buffer.from(sessionB64, "base64");
-}
-async function readSessionB64(sessionPath) {
-	const bytes = await fs.readFile(sessionPath);
-	if (bytes.length === 0) return "";
-	return bytes.toString("base64");
-}
-/**
-* Create a 0700 directory, write the password and the session 0600, run
-* `body`, then delete the directory whether `body` succeeded or threw.
-* Returns the session file as base64 so the caller can store it in the keychain.
-*/
-async function withSpeakSecretFiles(input, body) {
-	const dir = await fs.mkdtemp(path$1.join(os.tmpdir(), "camstack-alexa-"));
-	const paths = {
-		dir,
-		passwordPath: path$1.join(dir, "password"),
-		sessionPath: path$1.join(dir, "session")
-	};
-	try {
-		restrictDirToOwnerSync(dir);
-		writeOwnerOnlyFileSync(paths.passwordPath, input.password);
-		writeOwnerOnlyFileSync(paths.sessionPath, decodeSession(input.sessionB64));
-		await body(paths);
-		return { sessionB64: await readSessionB64(paths.sessionPath) };
-	} finally {
-		await fs.rm(dir, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-/** Replace every occurrence of each non-empty secret. Used before a log line is emitted. */
-function scrubSecrets(text, secrets) {
-	let out = text;
-	for (const secret of secrets) {
-		if (secret.length === 0) continue;
-		out = out.split(secret).join(REDACTED);
-	}
-	return out;
-}
-//#endregion
-//#region src/speak/setup-flow.ts
-/** Where the next screen is. A failed password stays on sign-in. A failed code stays on the code step. */
-function reduceSetup(phase, event) {
-	if (event.type === "reset") return "sign-in";
-	if (event.status === "ok") return "devices";
-	if (event.status === "otp_needed") return "otp";
-	if (event.status === "captcha") return "captcha";
-	return phase;
-}
 //#endregion
 //#region src/speak/worker-client.ts
 /**
-* One Python process for the life of the addon. Requests are one JSON line
+* One Python process per broker, for the life of the addon. Requests are one JSON line
 * on stdin; responses are one JSON line on stdout, matched by id.
 * A crash restarts the process until the same bound CrashSupervisor uses,
 * then requests fail instead of looping.
@@ -134349,10 +134892,6 @@ function startAlexaWorker(deps) {
 }
 //#endregion
 //#region src/speak/controller.ts
-/**
-* Owns the one Python worker, the keychain session, the Echo cache and the
-* notification provider. A login that needs a code raises one alert.
-*/
 function targetsFrom(settings) {
 	return settings.targets.map((row) => ({
 		id: row.id,
@@ -134361,6 +134900,7 @@ function targetsFrom(settings) {
 		addonId: ALEXA_SPEAK_ADDON_ID,
 		enabled: row.enabled,
 		config: {
+			...row.brokerId.length > 0 ? { brokerId: row.brokerId } : {},
 			echoId: row.echoId,
 			mode: row.mode,
 			volume: row.volume,
@@ -134368,104 +134908,85 @@ function targetsFrom(settings) {
 		}
 	}));
 }
-function withTargets(settings, targets) {
-	return {
-		...settings,
-		targets: targets.map((target) => ({
-			id: target.id,
-			name: target.name,
-			enabled: target.enabled,
-			echoId: typeof target.config["echoId"] === "string" ? target.config["echoId"] : "",
-			mode: target.config["mode"] === "announce" ? "announce" : "speak",
-			volume: typeof target.config["volume"] === "number" ? target.config["volume"] : 40,
-			respectDnd: target.config["respectDnd"] !== false
-		}))
-	};
-}
-function usablePassword(value) {
-	if (value.length === 0 || isSecretMarker(value)) return "";
-	return value;
+function rowsFrom(targets) {
+	return targets.map((target) => ({
+		id: target.id,
+		name: target.name,
+		enabled: target.enabled,
+		brokerId: typeof target.config["brokerId"] === "string" ? target.config["brokerId"] : "",
+		echoId: typeof target.config["echoId"] === "string" ? target.config["echoId"] : "",
+		mode: target.config["mode"] === "announce" ? "announce" : "speak",
+		volume: typeof target.config["volume"] === "number" ? target.config["volume"] : 40,
+		respectDnd: target.config["respectDnd"] !== false
+	}));
 }
 var AlexaSpeakController = class {
 	host;
 	provider;
 	settings;
-	worker = null;
-	devices = [];
-	phase = "sign-in";
+	pythonPath = null;
+	echoes = /* @__PURE__ */ new Map();
 	timer = null;
-	attention;
+	queue = Promise.resolve();
 	now;
 	constructor(host) {
 		this.host = host;
 		this.now = host.now ?? (() => Date.now());
 		this.settings = readSpeakSettings(host.readConfig());
-		this.phase = this.settings.session.length > 0 ? "devices" : "sign-in";
-		this.attention = new OtpAttention({
-			now: this.now,
-			emit: (alert) => host.emitAlert(alert),
-			resolve: (id) => host.resolveAlert(id)
-		});
 		this.provider = createAlexaNotificationProvider({
-			devices: () => this.devices,
-			loggedIn: () => this.phase === "devices",
+			brokers: () => this.brokerViews(),
 			now: this.now,
 			logger: host.logger,
 			loadTargets: () => targetsFrom(this.settings),
 			saveTargets: (targets) => {
-				this.settings = withTargets(this.settings, targets);
+				this.settings = {
+					...this.settings,
+					targets: [...rowsFrom(targets)]
+				};
 				this.persist();
 			},
-			speak: (command) => this.utter(command.mode, command.targets, command.text, command.volume)
+			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text, command.volume)
 		});
 	}
 	async start() {
-		const pythonPath = await this.host.ensurePython();
-		if (pythonPath === null) {
+		this.pythonPath = await this.host.ensurePython();
+		if (this.pythonPath === null) {
 			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
 			return;
 		}
-		this.worker = startAlexaWorker({
-			pythonPath,
-			scriptPath: resolveAlexaWorkerScript(),
-			logger: this.host.logger,
-			now: this.now
-		});
-		this.noteSecrets();
-		if (this.settings.session.length > 0) await this.loginWithFiles().catch((err) => {
-			this.host.logger.warn("alexa speak: stored session did not restore", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		});
+		await this.migrateLegacyLogin();
+		await this.brokersChanged();
 		this.timer = setInterval(() => {
-			this.refreshDevices();
+			this.refreshAll();
 		}, DEVICE_REFRESH_MS);
 	}
 	stop() {
 		if (this.timer !== null) clearInterval(this.timer);
 		this.timer = null;
-		this.worker?.stop();
-		this.worker = null;
+		for (const echo of this.echoes.values()) echo.stop();
+		this.echoes.clear();
+	}
+	/** The addon calls this whenever its list of brokers may have changed. */
+	brokersChanged() {
+		this.queue = this.queue.then(() => this.reconcile()).catch(() => void 0);
+		return this.queue;
 	}
 	handlers() {
 		return {
 			speakStatus: async () => this.status(),
-			loginStart: async (input) => {
-				this.settings = {
-					...this.settings,
-					email: input.email,
-					password: input.password,
-					region: input.region
-				};
-				await this.persist();
-				this.noteSecrets();
-				return this.loginWithFiles();
-			},
-			loginOtp: async (input) => this.otpWithFiles(input.code),
 			sendTest: async (input) => this.sendTest(input)
 		};
 	}
-	noteSecrets() {
-		const password = usablePassword(this.settings.password);
-		this.worker?.noteSecrets(password.length > 0 ? [password] : []);
+	brokerViews() {
+		return this.host.listBrokers().map((ref) => {
+			const echo = this.echoes.get(ref.id);
+			return {
+				id: ref.id,
+				name: ref.name,
+				ready: echo?.state === "ready",
+				devices: echo?.devices ?? []
+			};
+		});
 	}
 	async persist() {
 		try {
@@ -134474,142 +134995,126 @@ var AlexaSpeakController = class {
 			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	workerRequest(request) {
-		const worker = this.worker;
-		if (worker === null || worker.failed) return Promise.reject(/* @__PURE__ */ new Error("alexa worker is not running"));
-		return worker.request(request);
-	}
-	async loginWithFiles() {
-		let outcome = {
-			status: "failed",
-			error: "alexa worker is not running"
-		};
-		const held = await withSpeakSecretFiles({
-			password: usablePassword(this.settings.password),
-			sessionB64: this.settings.session
-		}, async (paths) => {
-			outcome = await this.applyLogin(await this.loginRequest(paths));
-		});
-		if (held.sessionB64 !== this.settings.session) {
-			this.settings = {
-				...this.settings,
-				session: held.sessionB64
-			};
-			await this.persist();
-		}
-		return outcome;
-	}
-	async otpWithFiles(code) {
-		let outcome = {
-			status: "failed",
-			error: "alexa worker is not running"
-		};
-		const held = await withSpeakSecretFiles({
+	/**
+	* Drain the old standalone login once. With exactly one broker its jar and
+	* its targets move onto that broker; otherwise the jar is dropped and the
+	* targets wait for the operator to choose (the status names that state).
+	*/
+	async migrateLegacyLogin() {
+		const brokers = this.host.listBrokers();
+		const plan = planLegacyMigration(legacyLoginOf(this.settings), brokers.map((ref) => ref.id), this.settings.targets);
+		if (!plan.present) return;
+		if (plan.attachTo !== null) await this.host.sessions.put(plan.attachTo, this.settings.session);
+		this.settings = {
+			...this.settings,
+			email: "",
 			password: "",
-			sessionB64: this.settings.session
-		}, async (paths) => {
-			outcome = await this.applyLogin(await this.workerRequest({
-				op: "login_otp",
-				code,
-				sessionPath: paths.sessionPath
-			}));
-		});
-		if (held.sessionB64 !== this.settings.session) {
-			this.settings = {
-				...this.settings,
-				session: held.sessionB64
-			};
-			await this.persist();
-		}
-		return outcome;
+			session: "",
+			targets: [...plan.targets]
+		};
+		await this.persist();
+		await this.host.clearLegacySecrets();
+		this.host.logger.info("alexa speak: the old standalone login was retired", { meta: {
+			attachedTo: plan.attachTo ?? "none",
+			brokers: brokers.length,
+			targets: plan.targets.length
+		} });
 	}
-	loginRequest(paths) {
-		return this.workerRequest({
-			op: "login_start",
-			email: this.settings.email,
-			passwordPath: paths.passwordPath,
-			sessionPath: paths.sessionPath,
-			region: this.settings.region
+	makeWorker(brokerId, pythonPath) {
+		if (this.host.startWorker !== void 0) return this.host.startWorker(brokerId, pythonPath);
+		return startAlexaWorker({
+			pythonPath,
+			scriptPath: resolveAlexaWorkerScript(),
+			logger: this.host.logger.withTags({ brokerId }),
+			now: this.now
 		});
 	}
-	async applyLogin(raw) {
-		const outcome = parseLoginResult(raw);
-		this.phase = reduceSetup(this.phase, {
-			type: "login",
-			status: outcome.status
-		});
-		if (outcome.status === "otp_needed") await this.attention.needed("otp");
-		else if (outcome.status === "captcha") await this.attention.needed("captcha");
-		else if (outcome.status === "ok") {
-			await this.attention.cleared();
-			await this.refreshDevices();
+	async reconcile() {
+		const pythonPath = this.pythonPath;
+		if (pythonPath === null) return;
+		const refs = this.host.listBrokers();
+		const live = new Set(refs.map((ref) => ref.id));
+		for (const [id, echo] of this.echoes) {
+			if (live.has(id)) continue;
+			echo.stop();
+			this.echoes.delete(id);
+			await this.host.sessions.delete(id).catch((err) => {
+				this.host.logger.warn("alexa speak: could not drop the session of a removed account", {
+					tags: { brokerId: id },
+					meta: { error: err instanceof Error ? err.message : String(err) }
+				});
+			});
 		}
-		return outcome;
+		const fresh = refs.filter((ref) => !this.echoes.has(ref.id));
+		for (const ref of fresh) this.echoes.set(ref.id, new BrokerEcho({
+			brokerId: ref.id,
+			brokerName: ref.name,
+			domain: ref.amazonDomain,
+			worker: this.makeWorker(ref.id, pythonPath),
+			readSeed: () => this.host.readSeed(ref.id),
+			sessions: this.host.sessions,
+			logger: this.host.logger
+		}));
+		await Promise.all(refs.map(async (ref) => {
+			const echo = this.echoes.get(ref.id);
+			if (echo !== void 0 && (fresh.includes(ref) || echo.state !== "ready")) await echo.signIn();
+		}));
 	}
-	async refreshDevices() {
-		if (this.worker === null || this.phase !== "devices") return;
-		try {
-			this.devices = [...parseDevices(await this.workerRequest({ op: "devices" }))];
-		} catch (err) {
-			this.host.logger.warn("alexa speak: device refresh failed", { meta: { error: err instanceof Error ? err.message : String(err) } });
-		}
+	async refreshAll() {
+		for (const echo of this.echoes.values()) if (echo.state === "ready") await echo.refreshDevices();
+		else await echo.signIn();
 	}
-	async utter(mode, targets, text, volume) {
-		const op = mode === "announce" ? "announce" : "speak";
-		return parseDeliveries(await this.workerRequest({
-			op,
-			targets,
-			text,
-			volume
-		}));
+	async utter(brokerId, mode, targets, text, volume) {
+		const echo = this.echoes.get(brokerId);
+		if (echo === void 0) throw new Error("no Echo session for this Amazon account");
+		return echo.utter(mode === "announce" ? "announce" : "speak", targets, text, volume);
 	}
-	async session() {
-		if (this.worker === null) return {
-			loggedIn: false,
-			ageSec: 0,
-			lastSuccessAt: null
-		};
-		try {
-			return parseSessionStatus(await this.workerRequest({ op: "session_status" }));
-		} catch {
+	async status() {
+		const brokers = this.host.listBrokers();
+		const rows = await Promise.all(brokers.map(async (ref) => {
+			const echo = this.echoes.get(ref.id);
 			return {
-				loggedIn: this.phase === "devices",
-				ageSec: 0,
-				lastSuccessAt: null
+				id: ref.id,
+				name: ref.name,
+				state: echo?.state ?? "failed",
+				...echo === void 0 ? { error: "embedded Python unavailable" } : echo.error === null ? {} : { error: echo.error },
+				devices: [...echo?.devices ?? []],
+				session: echo === void 0 ? {
+					loggedIn: false,
+					ageSec: 0,
+					lastSuccessAt: null
+				} : await echo.session()
 			};
-		}
-	}
-	async status() {
+		}));
+		const targets = this.settings.targets;
+		const ids = brokers.map((ref) => ref.id);
 		return {
-			phase: this.phase,
-			email: this.settings.email,
-			region: this.settings.region,
-			devices: [...this.devices],
-			session: await this.session()
+			brokers: rows,
+			unassignedTargets: unassignedCount(targets),
+			notice: noticeFor(targets, ids)
 		};
 	}
 	async sendTest(input) {
-		const outcomes = await this.utter(input.mode, input.echoIds, input.text, input.volume);
-		const known = new Map(this.devices.map((device) => [device.id, device]));
-		const next = [...targetsFrom(this.settings)];
+		const outcomes = await this.utter(input.brokerId, input.mode, input.echoIds, input.text, input.volume);
+		const known = new Map((this.echoes.get(input.brokerId)?.devices ?? []).map((device) => [device.id, device]));
+		const next = [...this.settings.targets];
 		for (const echoId of input.echoIds) {
-			if (next.some((row) => row.config["echoId"] === echoId)) continue;
-			const device = known.get(echoId);
+			if (next.some((row) => row.echoId === echoId && row.brokerId === input.brokerId)) continue;
 			next.push({
-				id: `echo-${echoId}`,
-				name: device?.name ?? echoId,
-				kind: ALEXA_SPEAK_KIND,
-				addonId: ALEXA_SPEAK_ADDON_ID,
+				id: `echo-${input.brokerId}-${echoId}`,
+				name: known.get(echoId)?.name ?? echoId,
 				enabled: true,
-				config: {
-					echoId,
-					mode: input.mode,
-					volume: input.volume,
-					respectDnd: true
-				}
+				brokerId: input.brokerId,
+				echoId,
+				mode: input.mode,
+				volume: input.volume,
+				respectDnd: true
 			});
 		}
-		this.settings = withTargets(this.settings, next);
+		this.settings = {
+			...this.settings,
+			targets: next
+		};
 		await this.persist();
 		return { outcomes: outcomes.map((row) => ({
 			echoId: row.targetId,
@@ -134619,6 +135124,55 @@ var AlexaSpeakController = class {
 	}
 };
 //#endregion
+//#region src/speak/icon-routes.ts
+var ALEXA_ICON_SVG = "<svg role=\"img\" viewBox=\"0 0 24 24\" xmlns=\"http://www.w3.org/2000/svg\" fill=\"#00CAFF\"><title>Amazon Alexa</title><path d=\"M12 0C5.37 0 0 5.37 0 12C0 18.09 4.53 23.11 10.4 23.9V21.5A1.59 1.59 0 0 0 9.32 19.97A8.41 8.41 0 0 1 3.6 11.8A8.37 8.37 0 0 1 12.09 3.6A8.4 8.4 0 0 1 20.4 12.31L20.39 12.38A8.68 8.68 0 0 1 20.36 12.76C20.36 12.83 20.35 12.9 20.34 12.96C20.34 13.04 20.33 13.12 20.32 13.19L20.3 13.29C19.27 20.07 10.45 23.87 10.4 23.9C10.92 23.97 11.46 24 12 24C18.63 24 24 18.63 24 12S18.63 0 12 0Z\"/></svg>";
+/** One day; the mark is immutable per addon version. */
+var CACHE_CONTROL = "public, max-age=86400, immutable";
+function speakIconRoutes() {
+	return [{
+		method: "GET",
+		path: `/icons/${ALEXA_SPEAK_KIND}`,
+		access: "public",
+		description: "Alexa brand mark (image/svg+xml) for the Alexa notification target.",
+		handler: async (_request, reply) => {
+			reply.code(200).type("image/svg+xml").header("cache-control", CACHE_CONTROL).send(ALEXA_ICON_SVG);
+		}
+	}];
+}
+//#endregion
+//#region src/speak/session-store.ts
+/** The Echo worker's cookie jar per broker, in the records store (secret field, keychain-backed). */
+var RecordsSpeakSessionStore = class RecordsSpeakSessionStore {
+	kind;
+	constructor(kind) {
+		this.kind = kind;
+	}
+	static of(records) {
+		return new RecordsSpeakSessionStore(records.kind(alexaSpeakSessionsEntryKind));
+	}
+	async get(brokerId) {
+		try {
+			const resolved = await this.kind.getResolved(brokerId);
+			return resolved === null ? "" : resolved.data.session;
+		} catch (err) {
+			if (err instanceof RecordSecretUnavailableError) return "";
+			throw err;
+		}
+	}
+	async put(brokerId, sessionB64) {
+		await this.kind.put({
+			id: brokerId,
+			data: {
+				name: brokerId,
+				session: sessionB64
+			}
+		});
+	}
+	async delete(brokerId) {
+		await this.kind.delete(brokerId);
+	}
+};
+//#endregion
 //#region src/addon.ts
 var SPEAK_PAGE = {
 	id: "speak",
@@ -134692,7 +135246,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const regs = this.providerRegistrationsFromSuper(await super.onInitialize());
 		const records = this.ctx.records;
 		if (records === void 0) throw new Error("import-alexa: ctx.records is required (hub-only addon)");
-		await records.declare({ brokers: alexaBrokersEntryKind });
+		await records.declare(alexaRecordKinds);
 		this.brokerStore = AlexaBrokerStore.of(records);
 		this.activeBrokers = await this.loadPersistedBrokers();
 		this.registry = new AlexaBrokerRegistry(this.ctx.logger, {
@@ -134733,29 +135287,33 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
 		await this.reconcileIntegrationsToBrokers();
 		this.subscribeIntegrationLifecycle();
-		const loginRoutes = buildAlexaLoginRoutes({
+		const loginRoutes = [...buildAlexaLoginRoutes({
 			logger: this.ctx.logger,
 			proxyLogin: this.proxyLogin,
 			commitCookie: (input) => this.commitCapturedCookie(input)
-		});
+		}), ...speakIconRoutes()];
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,
 			writeSpeak: async (next) => {
 				await this.updateGlobalSettings({ speak: next });
 			},
-			emitAlert: async (alert) => {
-				const emit = this.ctx.api.alerts?.emit;
-				if (emit === void 0) {
-					this.ctx.logger.warn("alexa speak: OTP alert skipped — alerts capability missing");
-					return;
-				}
-				await emit.mutate(alert);
+			listBrokers: () => this.activeBrokers.map((entry) => ({
+				id: entry.id,
+				name: entry.name,
+				amazonDomain: entry.connection.amazonDomain
+			})),
+			readSeed: async (brokerId) => {
+				const entry = this.activeBrokers.find((row) => row.id === brokerId);
+				return entry === void 0 ? null : readBrokerSeed(this.ctx.dataDir, entry);
 			},
-			resolveAlert: async (alertId) => {
-				const dismiss = this.ctx.api.alerts?.dismiss;
-				if (dismiss === void 0) return;
-				await dismiss.mutate({ alertId });
+			sessions: RecordsSpeakSessionStore.of(records),
+			clearLegacySecrets: async () => {
+				await this.updateGlobalSettingsAsOperator({ speak: {
+					...this.config.speak,
+					password: SECRET_CLEAR,
+					session: SECRET_CLEAR
+				} });
 			},
 			ensurePython: () => this.ctx.deps.ensurePython()
 		});
@@ -134806,11 +135364,9 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	async persistBrokerEntries(entries) {
 		this.activeBrokers = [...entries];
 		const store = this.brokerStore;
-		if (store !== null) {
-			await store.replaceAll(entries);
-			return;
-		}
-		await this.updateGlobalSettings({ brokers: [...entries] });
+		if (store !== null) await store.replaceAll(entries);
+		else await this.updateGlobalSettings({ brokers: [...entries] });
+		this.speak?.brokersChanged();
 	}
 	async onConfigChanged() {
 		const reg = this.registry;
@@ -134856,6 +135412,7 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				} });
 			}
 		}
+		this.speak?.brokersChanged();
 	}
 	async onShutdown() {
 		this.speak?.stop();
@@ -135094,90 +135651,43 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 	}
 	globalSettingsSchema() {
-		return this.schema({ sections: [
-			{
-				id: "alexa-account",
-				title: "Amazon Alexa account",
-				titleKey: "import-alexa:globalSettings.s_alexa-account.title",
-				description: "Alexa accounts are managed in the External systems → Brokers tab.",
-				descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
-				columns: 1,
-				fields: [{
-					type: "info",
-					key: "accountHelp",
-					label: "Accounts are managed separately",
-					labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
-					content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
-				}]
-			},
-			{
-				id: "alexa-proxy-login",
-				title: "Interactive login (proxy)",
-				titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-				description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
-				descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
-				columns: 2,
-				fields: [{
-					type: "text",
-					key: "proxyLogin.proxyHost",
-					label: "Login proxy host/IP (blank = auto-detect)",
-					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
-					placeholder: "auto-detect"
-				}, {
-					type: "number",
-					key: "proxyLogin.proxyPort",
-					label: "Login proxy port",
-					labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
-					min: 1,
-					max: 65535,
-					default: 3456
-				}]
-			},
-			{
-				id: "alexa-speak",
-				title: "Speak on Echo",
-				titleKey: "import-alexa:globalSettings.s_alexa-speak.title",
-				description: "Sign in on the Speak on Echo page, pick the devices, and use them as a notification target. The text is the rule template, read aloud.",
-				descriptionKey: "import-alexa:globalSettings.s_alexa-speak.description",
-				columns: 1,
-				fields: [
-					{
-						type: "text",
-						key: "speak.email",
-						label: "Amazon email",
-						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_email.label",
-						inputType: "email"
-					},
-					{
-						type: "password",
-						key: "speak.password",
-						label: "Amazon password",
-						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_password.label"
-					},
-					{
-						type: "select",
-						key: "speak.region",
-						label: "Region",
-						labelKey: "import-alexa:globalSettings.s_alexa-speak.speak_region.label",
-						default: "EU",
-						options: [
-							{
-								value: "NA",
-								label: "North America"
-							},
-							{
-								value: "EU",
-								label: "Europe"
-							},
-							{
-								value: "FE",
-								label: "Far East"
-							}
-						]
-					}
-				]
-			}
-		] });
+		return this.schema({ sections: [{
+			id: "alexa-account",
+			title: "Amazon Alexa account",
+			titleKey: "import-alexa:globalSettings.s_alexa-account.title",
+			description: "Alexa accounts are managed in the External systems → Brokers tab.",
+			descriptionKey: "import-alexa:globalSettings.s_alexa-account.description",
+			columns: 1,
+			fields: [{
+				type: "info",
+				key: "accountHelp",
+				label: "Accounts are managed separately",
+				labelKey: "import-alexa:globalSettings.s_alexa-account.accountHelp.label",
+				content: "This integration links to an Amazon Alexa account broker. Add, edit, or remove accounts from External systems → Brokers, then adopt the imported devices. The integration only stores a reference to its broker. NOTE: this is an unofficial integration that Amazon can change or break without notice."
+			}]
+		}, {
+			id: "alexa-proxy-login",
+			title: "Interactive login (proxy)",
+			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
+			description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
+			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
+			columns: 2,
+			fields: [{
+				type: "text",
+				key: "proxyLogin.proxyHost",
+				label: "Login proxy host/IP (blank = auto-detect)",
+				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
+				placeholder: "auto-detect"
+			}, {
+				type: "number",
+				key: "proxyLogin.proxyPort",
+				label: "Login proxy port",
+				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
+				min: 1,
+				max: 65535,
+				default: 3456
+			}]
+		}] });
 	}
 	async supportsManualCreation() {
 		return false;