@camstack/addon-import-alexa 0.2.157 → 0.2.159

package/dist/addon.mjs

@@ -989,7 +989,7 @@ var propertyKeyTypes = /* @__PURE__*/ new Set([
 	"number",
 	"symbol"
 ]);
-function escapeRegex(str) {
+function escapeRegex$1(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -1719,7 +1719,7 @@ var $ZodCheckUpperCase = /*@__PURE__*/ $constructor("$ZodCheckUpperCase", (inst,
 });
 var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const escapedRegex = escapeRegex(def.includes);
+	const escapedRegex = escapeRegex$1(def.includes);
 	const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
 	def.pattern = pattern;
 	inst._zod.onattach.push((inst) => {
@@ -1742,7 +1742,7 @@ var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, d
 });
 var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+	const pattern = new RegExp(`^${escapeRegex$1(def.prefix)}.*`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -1764,7 +1764,7 @@ var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (ins
 });
 var $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+	const pattern = new RegExp(`.*${escapeRegex$1(def.suffix)}$`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -3000,7 +3000,7 @@ var $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	const values = getEnumValues(def.entries);
 	const valuesSet = new Set(values);
 	inst._zod.values = valuesSet;
-	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex$1(o) : o.toString()).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (valuesSet.has(input)) return payload;
@@ -3018,7 +3018,7 @@ var $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
 	if (def.values.length === 0) throw new Error("Cannot create literal schema with no valid values");
 	const values = new Set(def.values);
 	inst._zod.values = values;
-	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex$1(o) : o ? escapeRegex$1(o.toString()) : String(o)).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (values.has(input)) return payload;
@@ -90636,6 +90636,448 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* Where an OAuth round-trip ends: the admin-ui completion route
+* (`/sso-complete`, the page every popup sign-in already lands on), with the
+* OUTCOME in the URL fragment.
+*
+* The outcome is a status plus a reason CODE from a closed list. It never
+* carries a token, a code, a client secret or a free-form error message: the
+* page words each code itself, and an unknown code reads as `unknown` rather
+* than being echoed. Fragment only, so nothing here reaches a server log.
+*
+* Pure and browser-safe.
+*/
+/** The admin-ui route the hub's OAuth completions land on (relative to its mount). */
+var OAUTH_LANDING_PATH = "/sso-complete";
+/**
+* The landing URL for `outcome`. `origin` is the hub address the flow already
+* runs on (from the `local-network` palette role, never a literal); `null`
+* gives a hub-relative URL.
+*/
+function oauthLandingUrl(origin, outcome) {
+	const params = new URLSearchParams({
+		return: "oauth",
+		status: outcome.status
+	});
+	if (outcome.addonId !== void 0) params.set("addon", outcome.addonId);
+	if (outcome.brokerId !== void 0) params.set("broker", outcome.brokerId);
+	if (outcome.integration !== void 0) params.set("integration", outcome.integration);
+	if (outcome.status === "error") params.set("reason", outcome.reason ?? "unknown");
+	if (outcome.action === "disconnect") params.set("action", "disconnect");
+	return `${origin === null ? "" : origin.replace(/\/+$/, "")}${OAUTH_LANDING_PATH}#${params.toString()}`;
+}
+var LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+function hostWithoutPort(host) {
+	if (host.startsWith("[")) return host.slice(0, host.indexOf("]") + 1);
+	const colon = host.indexOf(":");
+	return colon === -1 ? host : host.slice(0, colon);
+}
+function isLoopbackHost(host) {
+	return LOOPBACK_HOSTS.has(hostWithoutPort(host.toLowerCase()));
+}
+/** An allow-list entry is valid when it is a bare host[:port] and `http` only targets loopback. */
+function isValidUpstream(upstream) {
+	if (upstream.host.length === 0 || !/^[a-z0-9.[\]:-]+$/.test(upstream.host)) return false;
+	return upstream.scheme === "https" || isLoopbackHost(upstream.host);
+}
+function findUpstream(route, host) {
+	const wanted = host.toLowerCase();
+	return route.upstreams.find((upstream) => upstream.host === wanted);
+}
+/** `<basePath>/<host><pathname><search>` — what the browser is sent to. */
+function proxyPathFor(route, host, pathname, search = "") {
+	return `${route.basePath}/${host}${pathname.startsWith("/") ? pathname : `/${pathname}`}${search}`;
+}
+/** Split `/<attemptId>/<host>/<rest…>[?query]` (the data-plane view of a request). */
+function parseProxyPath(rawUrl) {
+	const queryAt = rawUrl.indexOf("?");
+	const path = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+	const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+	const match = /^\/([A-Za-z0-9_-]{8,128})\/([^/]+)(\/.*)?$/.exec(path);
+	if (match === null) return null;
+	const attemptId = match[1];
+	const host = match[2];
+	if (attemptId === void 0 || host === void 0) return null;
+	return {
+		attemptId,
+		host: host.toLowerCase(),
+		pathname: match[3] ?? "/",
+		search
+	};
+}
+/** The vendor URL a proxied request targets, or null when the host would not stay `host`. */
+function upstreamUrlFor(upstream, parsed) {
+	try {
+		const url = new URL(`${upstream.scheme}://${upstream.host}${parsed.pathname}${parsed.search}`);
+		return url.host.toLowerCase() === upstream.host ? url : null;
+	} catch {
+		return null;
+	}
+}
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** A Location (or any URL value) to a vendor host becomes a proxy path; anything else is unchanged. */
+function rewriteLocation(location, currentUpstream, route) {
+	let resolved;
+	try {
+		resolved = new URL(location, `${currentUpstream.scheme}://${currentUpstream.host}/`);
+	} catch {
+		return location;
+	}
+	if (resolved.protocol !== "https:" && resolved.protocol !== "http:") return location;
+	const target = findUpstream(route, resolved.host);
+	if (target === void 0) return location;
+	return `${proxyPathFor(route, target.host, resolved.pathname, resolved.search)}${resolved.hash}`;
+}
+/** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
+var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
+/**
+* Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
+* (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
+* HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
+* escape the proxy mount and land on the hub.
+*/
+function rewriteBody(body, kind, currentUpstream, route) {
+	let out = body;
+	for (const upstream of route.upstreams) {
+		const host = escapeRegex(upstream.host);
+		const plain = new RegExp(`${VALUE_START}(?:https?:)?//${host}(?=[/"'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(plain, `${route.basePath}/${upstream.host}`);
+		const escapedBase = `${route.basePath}/${upstream.host}`.replace(/\//g, "\\/");
+		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(escaped, escapedBase);
+	}
+	const current = `${route.basePath}/${currentUpstream.host}/`;
+	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
+	if (kind === "html") {
+		const attribute = String.raw`(\b(?:href|src|action|formaction|poster|data-href|data-src)\s*=\s*["'])/`;
+		out = out.replace(new RegExp(`${attribute}${notMounted}`, "gi"), `$1${current}`);
+	}
+	if (kind === "html" || kind === "css") {
+		const cssUrl = String.raw`(url\(\s*["']?)/`;
+		out = out.replace(new RegExp(`${cssUrl}${notMounted}`, "gi"), `$1${current}`);
+	}
+	return out;
+}
+/**
+* A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
+* origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+*/
+function rewriteSetCookie(cookie, route) {
+	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+		if (index === 0) return true;
+		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
+		return name !== "domain" && name !== "path";
+	});
+	kept.push(`Path=${route.basePath}/`);
+	return kept.join("; ");
+}
+/**
+* A browser `Referer` that points into this proxy, turned back into the vendor URL it
+* stands for. A Referer that is not ours is dropped (null): it names the hub.
+*/
+function rewriteReferer(referer, route) {
+	let url;
+	try {
+		url = new URL(referer, "http://hub.invalid");
+	} catch {
+		return null;
+	}
+	if (!url.pathname.startsWith(`${route.basePath}/`)) return null;
+	const rest = /^\/([^/]+)(\/.*)?$/.exec(url.pathname.slice(route.basePath.length));
+	const host = rest?.[1]?.toLowerCase();
+	if (host === void 0) return null;
+	const upstream = findUpstream(route, host);
+	if (upstream === void 0) return null;
+	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
+}
+/** Cookies the browser holds for the hub itself must never reach a vendor. */
+function filterForwardedCookies(cookieHeader) {
+	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
+}
+var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
+/** Request headers that are never forwarded to the vendor. */
+var DROP_REQUEST_HEADERS = new Set([
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"accept-encoding",
+	"authorization",
+	"cookie",
+	"origin",
+	"referer",
+	"x-camstack-dataplane-secret",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-forwarded-prefix",
+	"x-real-ip",
+	"forwarded"
+]);
+/**
+* Response headers dropped: framing/CSP/HSTS that break a page under another origin, and
+* the ones that no longer describe the (decoded, possibly rewritten) body.
+*/
+var DROP_RESPONSE_HEADERS = new Set([
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"x-frame-options",
+	"strict-transport-security",
+	"public-key-pins",
+	"report-to",
+	"nel",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive",
+	"set-cookie",
+	"location"
+]);
+function bodyKindOf(contentType) {
+	const type = contentType.toLowerCase();
+	if (type.includes("text/html") || type.includes("application/xhtml")) return "html";
+	if (type.includes("text/css")) return "css";
+	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
+	return null;
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readRequestBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+		size += buf.length;
+		if (size > MAX_REQUEST_BODY_BYTES) return "too-large";
+		chunks.push(buf);
+	}
+	return Buffer.concat(chunks);
+}
+function sendPlain(res, status, text) {
+	res.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(text);
+}
+var VendorLoginProxy = class {
+	#addonId;
+	#prefix;
+	#logger;
+	#now;
+	#fetch;
+	#attempts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#addonId = options.addonId;
+		this.#prefix = options.prefix;
+		this.#logger = options.logger;
+		this.#now = options.now ?? (() => Date.now());
+		this.#fetch = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+	}
+	/** The `DataPlaneHandler` to pass to `ctx.dataPlane.serve({ prefix, access: 'admin', … })`. */
+	handler = (req, res) => this.#handle(req, res);
+	/** Register an attempt. A one-shot capability: refused hosts are rejected up front. */
+	open(spec) {
+		for (const upstream of spec.upstreams) if (!isValidUpstream(upstream)) throw new Error(`vendor login proxy: upstream ${upstream.host} is not allowed`);
+		this.#attempts.set(spec.attemptId, {
+			expiresAtMs: spec.expiresAtMs,
+			upstreams: spec.upstreams,
+			evaluate: async (view) => {
+				const verdict = await spec.terminal(view);
+				if (verdict.kind === "continue") return verdict;
+				return {
+					kind: "done",
+					landing: await spec.onDone(verdict.payload)
+				};
+			}
+		});
+	}
+	close(attemptId) {
+		this.#attempts.delete(attemptId);
+	}
+	isOpen(attemptId) {
+		const attempt = this.#attempts.get(attemptId);
+		return attempt !== void 0 && this.#now() <= attempt.expiresAtMs;
+	}
+	/**
+	* The hub-relative path that opens `vendorUrl` through the proxy for this attempt:
+	* the URL the browser is sent to. Null when the host is not in the attempt's list.
+	*/
+	entryPath(attemptId, vendorUrl) {
+		const attempt = this.#attempts.get(attemptId);
+		if (attempt === void 0) return null;
+		const url = new URL(vendorUrl);
+		if (findUpstream({
+			basePath: "",
+			upstreams: attempt.upstreams
+		}, url.host) === void 0) return null;
+		return `/addon/${this.#addonId}/${this.#prefix}/${attemptId}/${url.host}${url.pathname}${url.search}`;
+	}
+	#routeFor(attemptId, attempt, forwardedPrefix) {
+		return {
+			basePath: `${forwardedPrefix}/addon/${this.#addonId}/${this.#prefix}/${attemptId}`,
+			upstreams: attempt.upstreams
+		};
+	}
+	async #handle(req, res) {
+		try {
+			await this.#serve(req, res);
+		} catch (err) {
+			this.#logger.warn("vendor login proxy: request failed", { meta: {
+				addonId: this.#addonId,
+				error: err instanceof Error ? err.name : "unknown"
+			} });
+			if (!res.headersSent) sendPlain(res, 502, "The sign-in page could not be reached.");
+			else res.end();
+		}
+	}
+	async #serve(req, res) {
+		const parsed = parseProxyPath(req.url ?? "/");
+		if (parsed === null) {
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
+		const attempt = this.#attempts.get(parsed.attemptId);
+		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
+			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: attempt refused", { meta: {
+				addonId: this.#addonId,
+				reason: attempt === void 0 ? "missing" : "expired"
+			} });
+			this.#redirect(res, forwardedPrefix, {
+				status: "error",
+				addonId: this.#addonId,
+				reason: "invalid_state"
+			});
+			return;
+		}
+		const route = this.#routeFor(parsed.attemptId, attempt, forwardedPrefix);
+		const upstream = findUpstream(route, parsed.host);
+		const target = upstream === void 0 ? null : upstreamUrlFor(upstream, parsed);
+		if (upstream === void 0 || target === null) {
+			this.#logger.warn("vendor login proxy: host refused", { meta: {
+				addonId: this.#addonId,
+				host: parsed.host
+			} });
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		let body;
+		if (method !== "GET" && method !== "HEAD") {
+			const read = await readRequestBody(req);
+			if (read === "too-large") {
+				sendPlain(res, 413, "Request too large");
+				return;
+			}
+			body = read;
+		}
+		const headers = this.#requestHeaders(req, route, upstream);
+		const upstreamRes = await this.#fetch(target, {
+			method,
+			headers,
+			redirect: "manual",
+			...body !== void 0 && body.length > 0 ? { body: new Uint8Array(body) } : {}
+		});
+		const location = upstreamRes.headers.get("location");
+		const setCookies = upstreamRes.headers.getSetCookie();
+		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
+		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
+		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
+		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+			addonId: this.#addonId,
+			host: upstream.host,
+			status: upstreamRes.status,
+			method
+		} });
+		const settled = await attempt.evaluate({
+			status: upstreamRes.status,
+			url: target.toString(),
+			location,
+			setCookies,
+			bodyText: text
+		});
+		if (settled.kind === "done") {
+			this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
+				addonId: this.#addonId,
+				status: settled.landing.status
+			} });
+			this.#redirect(res, forwardedPrefix, settled.landing);
+			return;
+		}
+		const out = {};
+		upstreamRes.headers.forEach((value, name) => {
+			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
+		});
+		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
+		out["cache-control"] = "no-store";
+		if (text !== null && kind !== null) {
+			const rewritten = rewriteBody(text, kind, upstream, route);
+			res.writeHead(upstreamRes.status, out);
+			res.end(rewritten);
+			return;
+		}
+		res.writeHead(upstreamRes.status, out);
+		await this.#pipeBody(upstreamRes, res);
+	}
+	#requestHeaders(req, route, upstream) {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			const lower = name.toLowerCase();
+			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
+			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
+		}
+		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
+		if (cookie.length > 0) headers["cookie"] = cookie;
+		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
+		const referer = firstHeader(req.headers["referer"]);
+		if (referer !== void 0) {
+			const back = rewriteReferer(referer, route);
+			if (back !== null) headers["referer"] = back;
+		}
+		return headers;
+	}
+	async #pipeBody(upstreamRes, res) {
+		if (upstreamRes.body === null) {
+			res.end();
+			return;
+		}
+		for await (const chunk of upstreamRes.body) {
+			if (!res.write(chunk)) await new Promise((resolve) => {
+				res.once("drain", resolve);
+				res.once("close", resolve);
+			});
+			if (res.destroyed) return;
+		}
+		res.end();
+	}
+	#redirect(res, forwardedPrefix, outcome) {
+		res.writeHead(302, {
+			location: `${forwardedPrefix}${oauthLandingUrl(null, outcome)}`,
+			"cache-control": "no-store"
+		});
+		res.end();
+	}
+};
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
@@ -90687,18 +91129,12 @@ var AlexaBrokerEntrySchema = object({
 });
 /**
 * Interactive proxy-login settings (addon-global, not per-broker). alexa-remote2
-* spins a local reverse-proxy to Amazon's login page on `proxyHost:proxyPort`;
-* the operator opens that URL and logs in. `proxyHost` MUST be the host:port the
-* operator's browser uses (alexa-cookie2 rewrites Amazon URLs to absolute
-* `http://<proxyHost>:<proxyPort>/...`), so it is a directly-reachable host —
-* the hub's LAN IP/hostname — NOT behind the hub's HTTPS data-plane mount.
-* Empty `proxyHost` ⇒ the first LAN address of the hub's `appConnections`
-* role (local-network palette) at login-start time.
+* spins a local reverse-proxy to Amazon's login page on `127.0.0.1:proxyPort`; the
+* operator never reaches it directly — the hub's login proxy (D955) opens it at
+* `/addon/import-alexa/login/…` under the hub's own HTTPS origin. The port only has to
+* be free on the hub's loopback.
 */
-var alexaProxyLoginSchema = object({
-	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = the hub LAN address)"),
-	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
-});
+var alexaProxyLoginSchema = object({ proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Loopback port the local Amazon-login proxy listens on (never exposed)") });
 /**
 * Echo speech settings. Speech signs in as an import broker, so the targets
 * are what lives here. `email`, `password`, `region` and `session` are the OLD
@@ -90745,10 +91181,7 @@ function readSpeakSettings(config) {
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
-	proxyLogin: alexaProxyLoginSchema.default({
-		proxyHost: "",
-		proxyPort: 3456
-	}),
+	proxyLogin: alexaProxyLoginSchema.default({ proxyPort: 3456 }),
 	speak: alexaSpeakSettingsSchema.default({
 		email: "",
 		password: "",
@@ -128425,7 +128858,7 @@ var require_fix_request_body = /* @__PURE__ */ __commonJSMin(((exports) => {
 	* Fix proxied body if bodyParser is involved.
 	*/
 	function fixRequestBody(proxyReq, req) {
-		if (req.readableLength !== 0) return;
+		if (!req.readableEnded) return;
 		const requestBody = req.body;
 		if (!requestBody) return;
 		const contentType = proxyReq.getHeader("Content-Type");
@@ -128520,6 +128953,12 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var path$2 = __require("path");
 	var crypto$1 = __require("crypto");
 	var FORMERDATA_STORE_VERSION = 4;
+	var ALEXA_APP_VERSION = "2.2.651540.0";
+	var EXTRA_AMAZON_PROXY_HOSTS = [
+		"amazon.com",
+		"www.amazon.com",
+		"alexa.amazon.com"
+	];
 	function addCookies(Cookie, headers) {
 		if (!headers || !headers["set-cookie"]) return Cookie;
 		const cookies = cookieTools.parse(Cookie);
@@ -128535,6 +128974,15 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		Cookie = Cookie.replace(/[; ]*$/, "");
 		return Cookie;
 	}
+	function isAmazonCookieName(name) {
+		return /^(session-id|session-id-time|session-token|ubid-.+|lc-.+|x-.+|at-.+|sess-at-.+|frc|map-md|csrf|sid|csm-hit|i18n-prefs|sp-cdn|skin)$/.test(name);
+	}
+	function sanitizeAmazonCookie(cookie) {
+		const cookies = cookieTools.parse(cookie || "");
+		let sanitizedCookie = "";
+		for (const name of Object.keys(cookies)) if (isAmazonCookieName(name)) sanitizedCookie += `${name}=${cookies[name]}; `;
+		return sanitizedCookie.replace(/[; ]*$/, "");
+	}
 	function customStringify(v, func, intent) {
 		const cache = /* @__PURE__ */ new Map();
 		return JSON.stringify(v, function(key, value) {
@@ -128548,6 +128996,29 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	}
 	function initAmazonProxy(_options, callbackCookie, callbackListening) {
 		const initialCookies = {};
+		const proxyBase = () => `http://${_options.proxyOwnIp}:${_options.proxyPort}/`;
+		const defaultAmazonHost = `www.${_options.baseAmazonPage}`;
+		const amazonProxyHosts = [];
+		function escapeRegex(data) {
+			return data.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+		}
+		function addAmazonProxyHost(host) {
+			if (host && !amazonProxyHosts.includes(host)) amazonProxyHosts.push(host);
+		}
+		addAmazonProxyHost(defaultAmazonHost);
+		addAmazonProxyHost(`alexa.${_options.baseAmazonPage}`);
+		addAmazonProxyHost(_options.baseAmazonPage);
+		EXTRA_AMAZON_PROXY_HOSTS.forEach(addAmazonProxyHost);
+		function amazonHostFromProxyPath(url) {
+			const match = (url || "").match(/^\/([^/?#]+)(?:[/?#]|$)/);
+			if (match && amazonProxyHosts.includes(match[1])) return match[1];
+			return null;
+		}
+		function amazonHostFromProxyUrl(url) {
+			if (!url) return null;
+			for (const host of amazonProxyHosts) if (url === `${proxyBase()}${host}` || url.startsWith(`${proxyBase()}${host}/`)) return host;
+			return null;
+		}
 		const formerDataStorePath = _options.formerDataStorePath || path$2.join(__dirname, "formerDataStore.json");
 		let formerDataStoreValid = false;
 		if (!_options.formerRegistrationData) try {
@@ -128571,7 +129042,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.logger && _options.logger("Proxy Init: reuse frc from former data");
 			initialCookies.frc = _options.formerRegistrationData.frc;
 		}
-		if (!_options.formerRegistrationData || !_options.formerRegistrationData["map-md"]) initialCookies["map-md"] = Buffer.from("{\"device_user_dictionary\":[],\"device_registration_data\":{\"software_version\":\"1\"},\"app_identifier\":{\"app_version\":\"2.2.485407\",\"bundle_id\":\"com.amazon.echo\"}}").toString("base64");
+		if (!_options.formerRegistrationData || !_options.formerRegistrationData["map-md"]) initialCookies["map-md"] = Buffer.from(`{"device_user_dictionary":[],"device_registration_data":{"software_version":"1"},"app_identifier":{"app_version":"${ALEXA_APP_VERSION}","bundle_id":"com.amazon.echo"}}`).toString("base64");
 		else {
 			_options.logger && _options.logger("Proxy Init: reuse map-md from former data");
 			initialCookies["map-md"] = _options.formerRegistrationData["map-md"];
@@ -128604,11 +129075,49 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const code_verifier = base64URLEncode(crypto$1.randomBytes(32));
 		const code_challenge = base64URLEncode(sha256(code_verifier));
 		let proxyCookies = "";
+		let returnedInitUrl;
+		function buildInitialUrl() {
+			return `https://www.${_options.baseAmazonPage}/ap/signin?openid.return_to=https%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fmaplanding&openid.assoc_handle=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&accountStatusPolicy=P1&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.oa2=http%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fext%2Foauth%2F2&openid.oa2.client_id=device%3A${deviceId}&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.oa2.response_type=code&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.pape.max_auth_age=0&openid.oa2.scope=device_auth_access&openid.oa2.code_challenge_method=S256&openid.oa2.code_challenge=${code_challenge}&language=${_options.amazonPageProxyLanguage}`;
+		}
+		function fixEmbeddedProxyUrls(pathAndQuery) {
+			const qIndex = pathAndQuery.indexOf("?");
+			if (qIndex === -1) return pathAndQuery;
+			const p = pathAndQuery.slice(0, qIndex);
+			const qs = pathAndQuery.slice(qIndex + 1);
+			let params;
+			try {
+				params = new URLSearchParams(qs);
+			} catch (_e) {
+				return pathAndQuery;
+			}
+			let changed = false;
+			for (const key of params.keys()) {
+				const value = params.get(key);
+				const fixed = replaceHostsBack(value);
+				if (fixed !== value) {
+					params.set(key, fixed);
+					changed = true;
+				}
+			}
+			if (changed) _options.logger && _options.logger(`Alexa-Cookie: Fixed embedded proxy URL(s) in outgoing request query`);
+			return changed ? `${p}?${params.toString()}` : pathAndQuery;
+		}
+		function rewriteProxyPath(url, req) {
+			let result;
+			const urlHost = amazonHostFromProxyPath(url);
+			if (urlHost) result = url.replace(new RegExp(`^/${escapeRegex(urlHost)}`), "") || "/";
+			else if (req && req.headers && req.headers.host === `${_options.proxyOwnIp}:${_options.proxyPort}` && url === "/") {
+				const initialUrl = returnedInitUrl || buildInitialUrl();
+				const parsed = new URL(initialUrl);
+				result = `${parsed.pathname}${parsed.search}`;
+			} else result = url;
+			return fixEmbeddedProxyUrls(result);
+		}
 		const optionsAlexa = {
 			target: `https://alexa.${_options.baseAmazonPage}`,
 			changeOrigin: true,
 			ws: false,
-			pathRewrite: {},
+			pathRewrite: rewriteProxyPath,
 			router,
 			hostRewrite: true,
 			followRedirects: false,
@@ -128616,17 +129125,10 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			onError,
 			onProxyRes,
 			onProxyReq,
-			headers: {
-				"user-agent": "AppleWebKit PitanguiBridge/2.2.485407.0-[HARDWARE=iPhone10_4][SOFTWARE=15.5][DEVICE=iPhone]",
-				"accept-language": _options.acceptLanguage,
-				"authority": `www.${_options.baseAmazonPage}`
-			},
-			cookieDomainRewrite: { "*": "" }
+			headers: { "accept-language": _options.acceptLanguage },
+			cookieDomainRewrite: { "*": "" },
+			cookiePathRewrite: { "*": "/" }
 		};
-		optionsAlexa.pathRewrite[`^/www.${_options.baseAmazonPage}`] = "";
-		optionsAlexa.pathRewrite[`^/alexa.${_options.baseAmazonPage}`] = "";
-		optionsAlexa.cookieDomainRewrite[`.${_options.baseAmazonPage}`] = _options.proxyOwnIp;
-		optionsAlexa.cookieDomainRewrite[_options.baseAmazonPage] = _options.proxyOwnIp;
 		if (_options.logger) optionsAlexa.logProvider = function logProvider() {
 			return {
 				log: _options.logger.log || _options.logger,
@@ -128636,22 +129138,20 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				error: _options.logger.error || _options.logger
 			};
 		};
-		let returnedInitUrl;
 		function router(req) {
 			const url = req.originalUrl || req.url;
 			_options.logger && _options.logger(`Router: ${url} / ${req.method} / ${JSON.stringify(req.headers)}`);
 			if (req.headers.host === `${_options.proxyOwnIp}:${_options.proxyPort}`) {
-				if (url.startsWith(`/www.${_options.baseAmazonPage}/`)) return `https://www.${_options.baseAmazonPage}`;
-				else if (url.startsWith(`/alexa.${_options.baseAmazonPage}/`)) return `https://alexa.${_options.baseAmazonPage}`;
-				else if (req.headers.referer) {
-					if (req.headers.referer.startsWith(`http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`)) return `https://www.${_options.baseAmazonPage}`;
-					else if (req.headers.referer.startsWith(`http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`)) return `https://alexa.${_options.baseAmazonPage}`;
-				}
+				const urlHost = amazonHostFromProxyPath(url);
+				if (urlHost) return `https://${urlHost}`;
+				const refererHost = amazonHostFromProxyUrl(req.headers.referer);
+				if (refererHost) return `https://${refererHost}`;
 				if (url === "/") {
-					returnedInitUrl = `https://www.${_options.baseAmazonPage}/ap/signin?openid.return_to=https%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fmaplanding&openid.assoc_handle=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=amzn_dp_project_dee_ios${_options.baseAmazonPageHandle}&accountStatusPolicy=P1&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns.oa2=http%3A%2F%2Fwww.${_options.baseAmazonPage}%2Fap%2Fext%2Foauth%2F2&openid.oa2.client_id=device%3A${deviceId}&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.oa2.response_type=code&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.pape.max_auth_age=0&openid.oa2.scope=device_auth_access&openid.oa2.code_challenge_method=S256&openid.oa2.code_challenge=${code_challenge}&language=${_options.amazonPageProxyLanguage}`;
+					returnedInitUrl = buildInitialUrl();
 					_options.logger && _options.logger(`Alexa-Cookie: Initial Page Request: ${returnedInitUrl}`);
-					return returnedInitUrl;
-				} else return `https://www.${_options.baseAmazonPage}`;
+					const parsedInitUrl = new URL(returnedInitUrl);
+					return `${parsedInitUrl.protocol}//${parsedInitUrl.host}`;
+				} else return `https://${defaultAmazonHost}`;
 			}
 			return `https://alexa.${_options.baseAmazonPage}`;
 		}
@@ -128663,21 +129163,34 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			} catch (err) {}
 		}
 		function replaceHosts(data) {
-			const amazonRegex = new RegExp(`https?://www.${_options.baseAmazonPage}:?[0-9]*/`.replace(/\./g, "\\."), "g");
-			const alexaRegex = new RegExp(`https?://alexa.${_options.baseAmazonPage}:?[0-9]*/`.replace(/\./g, "\\."), "g");
 			data = data.replace(/&#x2F;/g, "/");
-			data = data.replace(amazonRegex, `http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`);
-			data = data.replace(alexaRegex, `http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`);
+			for (const host of amazonProxyHosts) {
+				const hostRegex = new RegExp(`https?://${escapeRegex(host)}:?[0-9]*/`, "g");
+				data = data.replace(hostRegex, `${proxyBase()}${host}/`);
+			}
 			return data;
 		}
 		function replaceHostsBack(data) {
-			const amazonRegex = new RegExp(`http://${_options.proxyOwnIp}:${_options.proxyPort}/www.${_options.baseAmazonPage}/`.replace(/\./g, "\\."), "g");
-			const alexaRegex = new RegExp(`http://${_options.proxyOwnIp}:${_options.proxyPort}/alexa.${_options.baseAmazonPage}/`.replace(/\./g, "\\."), "g");
-			data = data.replace(amazonRegex, `https://www.${_options.baseAmazonPage}/`);
-			data = data.replace(alexaRegex, `https://alexa.${_options.baseAmazonPage}/`);
-			if (data === `http://${_options.proxyOwnIp}:${_options.proxyPort}/`) data = returnedInitUrl;
+			const base = proxyBase();
+			for (const host of amazonProxyHosts) {
+				const hostRegex = new RegExp(`${escapeRegex(base)}${escapeRegex(host)}/`, "g");
+				data = data.replace(hostRegex, `https://${host}/`);
+			}
+			if (data === base) data = returnedInitUrl;
+			else if (data.startsWith(base)) data = `https://${defaultAmazonHost}/${data.slice(base.length)}`;
 			return data;
 		}
+		function parseQueryParams(data) {
+			const paramStart = data && data.indexOf("?");
+			if (paramStart === -1 || paramStart === void 0) return {};
+			return querystring$2.parse(data.substr(paramStart + 1));
+		}
+		function isProxySuccessUrl(data) {
+			if (!data) return false;
+			if (data.includes("/spa/index.html")) return true;
+			if (!data.includes("/ap/maplanding?")) return false;
+			return !!parseQueryParams(data)["openid.oa2.authorization_code"];
+		}
 		function onProxyReq(proxyReq, req) {
 			const url = req.originalUrl || req.url;
 			if (url.endsWith(".ico") || url.endsWith(".js") || url.endsWith(".ttf") || url.endsWith(".svg") || url.endsWith(".png") || url.endsWith(".appcache")) return;
@@ -128704,14 +129217,26 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					}
 				}
 				if (typeof proxyReq.getHeader === "function" && proxyReq.getHeader("origin") !== `https://${proxyReq.getHeader("host")}`) {
-					proxyReq.setHeader("origin", `https://www.${_options.baseAmazonPage}`);
-					_options.logger && _options.logger("Alexa-Cookie: Modify headers: Delete Origin");
+					proxyReq.setHeader("origin", `https://${proxyReq.getHeader("host") || defaultAmazonHost}`);
+					_options.logger && _options.logger("Alexa-Cookie: Modify headers: Changed Origin");
 					modified = true;
 				}
-				let postBody = "";
-				req.on("data", (chunk) => {
-					postBody += chunk.toString();
-				});
+				if (req.body && typeof req.body === "object") {
+					let bodyChanged = false;
+					for (const key of Object.keys(req.body)) {
+						const value = req.body[key];
+						if (typeof value !== "string") continue;
+						const fixed = replaceHostsBack(value);
+						if (fixed !== value) {
+							req.body[key] = fixed;
+							bodyChanged = true;
+						}
+					}
+					if (bodyChanged) _options.logger && _options.logger("Alexa-Cookie: Fixed embedded proxy URL(s) in outgoing POST body");
+					const bodyData = querystring$2.stringify(req.body);
+					proxyReq.setHeader("Content-Length", Buffer.byteLength(bodyData));
+					proxyReq.write(bodyData);
+				}
 			}
 			_options.proxyLogLevel === "debug" && _options.logger && _options.logger(`Alexa-Cookie: Proxy-Request: (modified:${modified})${customStringify(proxyReq, null, 2)}`);
 		}
@@ -128729,17 +129254,22 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				proxyCookies = addCookies(proxyCookies, proxyRes.headers);
 			}
 			_options.logger && _options.logger(`Alexa-Cookie: Cookies handled: ${JSON.stringify(proxyCookies)}`);
-			if (proxyRes.socket && proxyRes.socket._host === `www.${_options.baseAmazonPage}` && proxyRes.socket.parser.outgoing && proxyRes.socket.parser.outgoing.method === "GET" && proxyRes.socket.parser.outgoing.path.startsWith("/ap/maplanding") || proxyRes.socket && proxyRes.socket.parser.outgoing && proxyRes.socket.parser.outgoing.getHeader("location") && proxyRes.socket.parser.outgoing.getHeader("location").includes("/ap/maplanding?") || proxyRes.headers.location && (proxyRes.headers.location.includes("/ap/maplanding?") || proxyRes.headers.location.includes("/spa/index.html"))) {
+			const outgoing = proxyRes.socket && proxyRes.socket.parser && proxyRes.socket.parser.outgoing;
+			const successUrl = [
+				proxyRes.headers.location,
+				outgoing && outgoing.method === "GET" && outgoing.path,
+				outgoing && outgoing.getHeader && outgoing.getHeader("location")
+			].find(isProxySuccessUrl);
+			if (successUrl) {
 				_options.logger && _options.logger("Alexa-Cookie: Proxy detected SUCCESS!!");
-				const paramStart = proxyRes.headers.location.indexOf("?");
-				const queryParams = querystring$2.parse(proxyRes.headers.location.substr(paramStart + 1));
+				const queryParams = parseQueryParams(successUrl);
 				proxyRes.statusCode = 302;
 				proxyRes.headers.location = `http://${_options.proxyOwnIp}:${_options.proxyPort}/cookie-success`;
 				delete proxyRes.headers.referer;
 				_options.logger && _options.logger(`Alexa-Cookie: Proxy catched cookie: ${proxyCookies}`);
 				_options.logger && _options.logger(`Alexa-Cookie: Proxy catched parameters: ${JSON.stringify(queryParams)}`);
 				callbackCookie && callbackCookie(null, {
-					"loginCookie": proxyCookies,
+					"loginCookie": sanitizeAmazonCookie(proxyCookies),
 					"authorization_code": queryParams["openid.oa2.authorization_code"],
 					"frc": initialCookies.frc,
 					"map-md": initialCookies["map-md"],
@@ -128751,7 +129281,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (proxyRes.headers.location) {
 				_options.logger && _options.logger(`Redirect: Original Location ----> ${proxyRes.headers.location}`);
 				proxyRes.headers.location = replaceHosts(proxyRes.headers.location);
-				if (reqestHost && proxyRes.headers.location.startsWith("/")) proxyRes.headers.location = `http://${_options.proxyOwnIp}:${_options.proxyPort}/${reqestHost}${proxyRes.headers.location}`;
+				if (reqestHost && amazonProxyHosts.includes(reqestHost) && proxyRes.headers.location.startsWith("/")) proxyRes.headers.location = `http://${_options.proxyOwnIp}:${_options.proxyPort}/${reqestHost}${proxyRes.headers.location}`;
 				_options.logger && _options.logger(`Redirect: Final Location ----> ${proxyRes.headers.location}`);
 				return;
 			}
@@ -128769,8 +129299,21 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				return body;
 			});
 		}
+		function bufferUrlencodedBody(req, res, next) {
+			const contentType = req.headers["content-type"] || "";
+			if (req.method !== "POST" || contentType.indexOf("application/x-www-form-urlencoded") === -1) return next();
+			let raw = "";
+			req.on("data", (chunk) => {
+				raw += chunk;
+			});
+			req.on("end", () => {
+				req.body = querystring$2.parse(raw);
+				next();
+			});
+		}
 		const myProxy = proxy("!/cookie-success", optionsAlexa);
 		const app = express();
+		app.use(bufferUrlencodedBody);
 		app.use(myProxy);
 		app.get("/cookie-success", function(req, res) {
 			res.send(_options.proxyCloseWindowHTML);
@@ -128780,7 +129323,8 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.proxyPort = void 0;
 		}
 		const server = app.listen(_options.proxyPort, _options.proxyListenBind, function() {
-			_options.logger && _options.logger(`Alexa-Cookie: Proxy-Server listening on port ${server.address().port}`);
+			_options.proxyPort = this.address().port;
+			_options.logger && _options.logger(`Alexa-Cookie: Proxy-Server listening on port ${_options.proxyPort}`);
 			callbackListening && callbackListening(server);
 			callbackListening = null;
 		}).on("error", (err) => {
@@ -128826,6 +129370,13 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		let proxyServer;
 		let _options;
 		let Cookie = "";
+		const isAmazonCookieName = (name) => /^(session-id|session-id-time|session-token|ubid-.+|lc-.+|x-.+|at-.+|sess-at-.+|frc|map-md|csrf|sid|csm-hit|i18n-prefs|sp-cdn|skin)$/.test(name);
+		const sanitizeAmazonCookie = (cookie) => {
+			const cookies = cookieTools.parse(cookie || "");
+			let sanitizedCookie = "";
+			for (const name of Object.keys(cookies)) if (isAmazonCookieName(name)) sanitizedCookie += `${name}=${cookies[name]}; `;
+			return sanitizedCookie.replace(/[; ]*$/, "");
+		};
 		const addCookies = (Cookie, headers) => {
 			if (!headers || !headers["set-cookie"]) return Cookie;
 			const cookies = cookieTools.parse(Cookie || "");
@@ -128913,7 +129464,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (!_options.baseAmazonPageHandle && _options.baseAmazonPageHandle !== "") {
 				const amazonDomain = _options.baseAmazonPage.substr(_options.baseAmazonPage.lastIndexOf(".") + 1);
 				if (amazonDomain === "jp") _options.baseAmazonPageHandle = `_${amazonDomain}`;
-				else if (amazonDomain !== "com") _options.baseAmazonPageHandle = "";
+				else if (amazonDomain !== "com") _options.baseAmazonPageHandle = `_${amazonDomain}`;
 				else _options.baseAmazonPageHandle = "";
 			}
 			if (!_options.userAgent) if (os$2.platform() === "win32") _options.userAgent = defaultUserAgent;
@@ -128940,7 +129491,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (_options.formerRegistrationData) _options.proxyOnly = true;
 		};
 		const getCSRFFromCookies = (cookie, _options, callback) => {
-			const csrfUrls = csrfOptions;
+			const csrfUrls = [...csrfOptions];
 			function csrfTry() {
 				const path = csrfUrls.shift();
 				const options = {
@@ -129103,6 +129654,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const handleTokenRegistration = (_options, loginData, callback) => {
 			_options.logger && _options.logger(`Handle token registration Start: ${JSON.stringify(loginData)}`);
 			loginData.deviceAppName = _options.deviceAppName;
+			loginData.loginCookie = sanitizeAmazonCookie(loginData.loginCookie);
 			let deviceSerial;
 			if (!_options.formerRegistrationData || !_options.formerRegistrationData.deviceSerial) {
 				const deviceSerialBuffer = Buffer.alloc(16);
@@ -129190,6 +129742,7 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				Cookie = addCookies(Cookie, response.headers);
 				loginData.refreshToken = body.response.success.tokens.bearer.refresh_token;
 				const accessToken = body.response.success.tokens.bearer.access_token;
+				loginData.accessToken = accessToken;
 				loginData.tokenDate = Date.now();
 				loginData.macDms = body.response.success.tokens.mac_dms;
 				if (body.response.success.tokens.website_cookies && Array.isArray(body.response.success.tokens.website_cookies)) {
@@ -129216,29 +129769,43 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					_options.logger && _options.logger("Alexa-Cookie: Get User data");
 					_options.logger && _options.logger(JSON.stringify(options));
 					request(options, (error, response, body) => {
-						if (!error) {
+						if (!error) if (!response || response.statusCode < 200 || response.statusCode >= 300 || !body) {
+							_options.logger && _options.logger(`Get User data Response: status=${response && response.statusCode}, body=${JSON.stringify(body)}`);
+							if (!_options.amazonPage) {
+								callback && callback(/* @__PURE__ */ new Error(`Could not get user data from Amazon: HTTP ${response && response.statusCode}`), null);
+								return;
+							}
+							loginData.amazonPage = _options.amazonPage;
+						} else {
 							try {
 								if (typeof body !== "object") body = JSON.parse(body);
 							} catch (err) {
 								_options.logger && _options.logger(`Get User data Response: ${JSON.stringify(body)}`);
-								callback && callback(err, null);
-								return;
+								if (!_options.amazonPage) {
+									callback && callback(err, null);
+									return;
+								}
+								loginData.amazonPage = _options.amazonPage;
 							}
 							_options.logger && _options.logger(`Get User data Response: ${JSON.stringify(body)}`);
 							Cookie = addCookies(Cookie, response.headers);
-							if (body.marketPlaceDomainName) {
+							if (body && body.marketPlaceDomainName) {
 								const pos = body.marketPlaceDomainName.indexOf(".");
 								if (pos !== -1) _options.amazonPage = body.marketPlaceDomainName.substr(pos + 1);
 							}
 							loginData.amazonPage = _options.amazonPage;
-						} else if (error && (!_options || !_options.amazonPage)) {
+						}
+						else if (error && (!_options || !_options.amazonPage)) {
 							callback && callback(error, null);
 							return;
 						} else if (error && (!_options.formerRegistrationData || !_options.formerRegistrationData.amazonPage) && _options.amazonPage) _options.logger && _options.logger(`Continue with externally set amazonPage: ${_options.amazonPage}`);
 						else if (error) _options.logger && _options.logger("Ignore error while getting user data and amazonPage because previously set amazonPage is available");
 						loginData.loginCookie = Cookie;
 						getLocalCookies(loginData.amazonPage, loginData.refreshToken, (err, localCookie) => {
-							if (err) callback && callback(err, null);
+							if (err) {
+								callback && callback(err, null);
+								return;
+							}
 							loginData.localCookie = localCookie;
 							getCSRFFromCookies(loginData.localCookie, _options, (err, resData) => {
 								if (err) {
@@ -129247,7 +129814,6 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 								}
 								loginData.localCookie = resData.cookie;
 								loginData.csrf = resData.csrf;
-								delete loginData.accessToken;
 								delete loginData.authorization_code;
 								delete loginData.verifier;
 								loginData.dataVersion = 2;
@@ -129350,6 +129916,39 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				callback && callback(null, localCookie);
 			});
 		};
+		const finishCookieRefresh = (loginData, callback) => {
+			_options.logger && _options.logger("Alexa-Cookie: Skip App registration during refresh and update local cookies");
+			const updateLocalCookies = () => {
+				const amazonPage = loginData.amazonPage || _options.amazonPage;
+				getLocalCookies(amazonPage, loginData.refreshToken, (err, localCookie) => {
+					if (err) {
+						callback && callback(err, null);
+						return;
+					}
+					loginData.localCookie = localCookie;
+					getCSRFFromCookies(loginData.localCookie, _options, (err, resData) => {
+						if (err) {
+							callback && callback(/* @__PURE__ */ new Error(`Error getting csrf for ${amazonPage}`), null);
+							return;
+						}
+						loginData.localCookie = resData.cookie;
+						loginData.csrf = resData.csrf;
+						loginData.amazonPage = amazonPage;
+						loginData.tokenDate = Date.now();
+						delete loginData.authorization_code;
+						delete loginData.verifier;
+						loginData.dataVersion = 2;
+						_options.logger && _options.logger("Alexa-Cookie: Refresh finished with updated cookies and csrf");
+						callback && callback(null, loginData);
+					});
+				});
+			};
+			if (loginData.accessToken) {
+				registerTokenCapabilities(loginData.accessToken, updateLocalCookies);
+				return;
+			}
+			updateLocalCookies();
+		};
 		this.refreshAlexaCookie = (__options, callback) => {
 			if (!__options || !__options.formerRegistrationData || !__options.formerRegistrationData.loginCookie || !__options.formerRegistrationData.refreshToken) {
 				callback && callback(/* @__PURE__ */ new Error("No former registration data provided for Cookie Refresh"), null);
@@ -129416,13 +130015,16 @@ var require_alexa_cookie = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				_options.formerRegistrationData.loginCookie = addCookies(Cookie, response.headers);
 				_options.formerRegistrationData.accessToken = body.access_token;
 				getLocalCookies(_options.baseAmazonPage, _options.formerRegistrationData.refreshToken, (err, comCookie) => {
-					if (err) callback && callback(err, null);
+					if (err) {
+						callback && callback(err, null);
+						return;
+					}
 					const initCookies = cookieTools.parse(_options.formerRegistrationData.loginCookie);
 					let newCookie = `frc=${initCookies.frc}; `;
 					newCookie += `map-md=${initCookies["map-md"]}; `;
 					newCookie += comCookie;
-					_options.formerRegistrationData.loginCookie = newCookie;
-					handleTokenRegistration(_options, _options.formerRegistrationData, callback);
+					_options.formerRegistrationData.loginCookie = sanitizeAmazonCookie(newCookie);
+					finishCookieRefresh(_options.formerRegistrationData, callback);
 				});
 			});
 		};
@@ -130017,10 +130619,20 @@ var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 							listItemId: payload.listItemId
 						});
 						return;
+					case "NotifyNowPlayingUpdated":
+						const nowPlaying = payload?.update?.update?.nowPlayingData ?? null;
+						this.emit("ws-now-playing-updated", {
+							customerId: payload?.customerId ?? null,
+							taskSessionId: payload?.update?.taskSessionId ?? null,
+							cause: payload?.update?.update?.cause ?? null,
+							mediaId: nowPlaying?.mediaId ?? null,
+							playerState: nowPlaying?.playerState ?? null,
+							nowPlayingData: nowPlaying
+						});
+						return;
 					case "PUSH_MICROPHONE_STATE":
 					case "PUSH_DELETE_DOPPLER_ACTIVITIES":
 					case "PUSH_DEVICE_SETUP_STATE_CHANGE":
-					case "NotifyNowPlayingUpdated":
 					case "NotifyMediaSessionsUpdated": return;
 				}
 				this.emit("ws-unknown-command", command, payload);
@@ -132067,7 +132679,7 @@ var import_alexa_remote = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin
 */
 var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 	name: "alexa-remote2",
-	version: "8.0.4",
+	version: "8.1.1",
 	description: "Remote Control for amazon echo devices",
 	author: {
 		"name": "Apollon77",
@@ -132096,16 +132708,16 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 		"layla.amazon.de"
 	],
 	dependencies: {
-		"alexa-cookie2": "^5.0.3",
+		"alexa-cookie2": "^5.0.6",
 		"https": "^1.0.0",
 		"querystring": "^0.2.1",
-		"ws": "^8.18.3",
+		"ws": "^8.21.0",
 		"extend": "^3.0.2",
-		"uuid": "^11.1.0"
+		"uuid": "^11.1.1"
 	},
 	devDependencies: {
-		"@alcalzone/release-script": "^5.0.0",
-		"@alcalzone/release-script-plugin-license": "^4.0.0",
+		"@alcalzone/release-script": "^5.2.1",
+		"@alcalzone/release-script-plugin-license": "^5.2.0",
 		"eslint": "^8.57.1"
 	},
 	scripts: {
@@ -132125,6 +132737,31 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 //#endregion
 //#region src/alexa-proxy-login.ts
 /**
+* INTERACTIVE Amazon login via `alexa-remote2`'s built-in proxy auth mode, behind the
+* hub's vendor login proxy (D955).
+*
+* alexa-remote2 (through `alexa-cookie2`) spins a local Express reverse-proxy to
+* Amazon's real login page and captures the resulting cookie + the richer
+* `cookieData` registration blob (it embeds the refresh token, so the session can
+* auto-refresh forever). That listener is bound to LOOPBACK only
+* (`proxyOwnIp` = `proxyListenBind` = 127.0.0.1): nothing outside this process's host can
+* reach it. The operator's browser reaches it through the hub's data plane instead
+* (`VendorLoginProxy`, `/addon/<id>/login/<attempt>/127.0.0.1:<port>/…`), which is
+* HTTPS under the same origin as the admin page. alexa-cookie2 keeps doing the Amazon
+* specific work (login cookies, device registration, the `/ax/claim` and CSRF steps)
+* and the hub proxy only rewrites the loopback-origin URLs it emits into the mount.
+*
+* Why not the second proxy replacing alexa-cookie2's: the capture needs the PKCE
+* verifier, the device id, the initial cookies and the app registration alexa-cookie2
+* already performs; re-implementing them would add JS-built-URL failure modes.
+*
+* The captured `cookieData` is handed to {@link AlexaProxyLoginSessionOptions.onCookie}
+* — the addon persists it on the broker entry, exactly where a pasted cookie
+* goes, so the rest of the addon (broker / poll / adoption) is unchanged.
+*/
+/** The only address the alexa-cookie2 listener binds and advertises. */
+var ALEXA_PROXY_LOOPBACK_HOST = "127.0.0.1";
+/**
 * A single interactive proxy-login attempt. One instance = one Amazon login.
 * Construct → {@link start} → poll {@link getStatus} → on `captured` the
 * `onCookie` callback has fired with the blob → {@link dispose}.
@@ -132138,13 +132775,37 @@ var AlexaProxyLoginSession = class {
 	#startedAt = Date.now();
 	#capturedAt = null;
 	#captured = false;
+	#waiters = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.#opts = opts;
 		this.#logger = opts.logger;
 	}
-	/** `http://<proxyOwnIp>:<proxyPort>/` — what the operator opens. */
+	/** What the operator opens: the hub-relative entry of the login proxy. */
 	get loginUrl() {
-		return `http://${this.#opts.proxyOwnIp}:${this.#opts.proxyPort}/`;
+		return this.#opts.loginUrl;
+	}
+	/** `host:port` of the loopback listener — the one upstream the hub proxy may reach. */
+	get upstreamHost() {
+		return `${ALEXA_PROXY_LOOPBACK_HOST}:${this.#opts.proxyPort}`;
+	}
+	/**
+	* Resolves true once the cookie material is in hand, false after `timeoutMs`.
+	* The Amazon page ends on `/cookie-success` BEFORE alexa-cookie2 finished registering
+	* the app, so the hub waits here before it sends the browser to the result page.
+	*/
+	whenCaptured(timeoutMs) {
+		if (this.#captured) return Promise.resolve(true);
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				this.#waiters.delete(settle);
+				resolve(false);
+			}, timeoutMs);
+			const settle = () => {
+				clearTimeout(timer);
+				resolve(true);
+			};
+			this.#waiters.add(settle);
+		});
 	}
 	getStatus() {
 		return {
@@ -132176,7 +132837,8 @@ var AlexaProxyLoginSession = class {
 		remote.on("cookie", () => this.#onCookieEvent(remote));
 		remote.init({
 			proxyOnly: true,
-			proxyOwnIp: this.#opts.proxyOwnIp,
+			proxyOwnIp: ALEXA_PROXY_LOOPBACK_HOST,
+			proxyListenBind: ALEXA_PROXY_LOOPBACK_HOST,
 			proxyPort: this.#opts.proxyPort,
 			proxyLogLevel: "warn",
 			amazonPage,
@@ -132222,6 +132884,8 @@ var AlexaProxyLoginSession = class {
 		this.#captured = true;
 		this.#capturedAt = Date.now();
 		this.#phase = "captured";
+		for (const settle of this.#waiters) settle();
+		this.#waiters.clear();
 		this.#logger.info("alexa proxy-login: cookie captured", { meta: { sessionId: this.#opts.sessionId } });
 		try {
 			this.#opts.onCookie(this.#opts.sessionId, {
@@ -132242,10 +132906,7 @@ var AlexaProxyLoginSession = class {
 		if (isProxyReadyError(err)) {
 			if (this.#phase === "starting") {
 				this.#phase = "awaiting-login";
-				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: {
-					sessionId: this.#opts.sessionId,
-					loginUrl: this.loginUrl
-				} });
+				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: { sessionId: this.#opts.sessionId } });
 			}
 			return;
 		}
@@ -132303,62 +132964,44 @@ function isStringOrObject(value) {
 	return typeof value === "string" || typeof value === "object" && value !== null;
 }
 //#endregion
-//#region src/alexa-proxy-host.ts
-/** Typed refusal: names WHY no proxy host could be chosen. */
-var AlexaProxyHostError = class extends Error {
-	reason;
-	constructor(reason, message, options) {
-		super(message, options);
-		this.name = "AlexaProxyHostError";
-		this.reason = reason;
-	}
-};
-var PRIVATE_IPV4 = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/;
-var IPV4_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
-/** A host a browser on the hub's network reaches directly: private IPv4, `.local`, or a bare name. */
-function isLanHost(host) {
-	if (host.length === 0) return false;
-	if (IPV4_LITERAL.test(host)) return PRIVATE_IPV4.test(host);
-	if (host.includes(":")) return false;
-	return host.endsWith(".local") || !host.includes(".");
-}
-function lanHostOf(address) {
+//#region src/alexa-proxy-login-manager.ts
+/** The data-plane prefix the hub login proxy is served on. */
+var ALEXA_LOGIN_PROXY_PREFIX = "login";
+/** The addon id the result page names to return to. */
+var ADDON_ID = "import-alexa";
+/** An attempt lives as long as a sign-in attempt does elsewhere (10 min). */
+var ATTEMPT_TTL_MS = 600 * 1e3;
+/** How long the browser waits on the Amazon page for alexa-cookie2 to finish registering. */
+var CAPTURE_WAIT_MS = 6e4;
+/**
+* Terminal condition: alexa-cookie2 turns Amazon's final redirect into a 302 to its own
+* `/cookie-success` page once it holds the login cookie. Matching on the path of the raw
+* `Location` keeps this independent of the page's HTML.
+*/
+function cookieSuccessTerminal(view) {
+	if (view.location === null) return { kind: "continue" };
 	try {
-		const host = new URL(address).hostname;
-		return isLanHost(host) && host !== "localhost" ? host : null;
+		return new URL(view.location, `http://127.0.0.1`).pathname === "/cookie-success" ? {
+			kind: "done",
+			payload: true
+		} : { kind: "continue" };
 	} catch {
-		return null;
+		return { kind: "continue" };
 	}
 }
-async function resolveProxyHost(input) {
-	const override = input.override.trim();
-	if (override.length > 0) return override;
-	let addresses;
-	try {
-		addresses = await input.readAppConnections();
-	} catch (err) {
-		input.logger.warn("alexa proxy-login: hub addresses unavailable from local-network", { meta: { error: errMsg(err) } });
-		throw new AlexaProxyHostError("palette-unavailable", "alexa proxy-login: the hub address list is unavailable — set proxyHost in settings", { cause: err });
-	}
-	for (const address of addresses) {
-		const host = lanHostOf(address);
-		if (host !== null) return host;
-	}
-	input.logger.warn("alexa proxy-login: no LAN address among the hub appConnections", { meta: { addresses: [...addresses] } });
-	throw new AlexaProxyHostError("no-lan-address", "alexa proxy-login: the hub has no LAN address the browser can open directly — set proxyHost in settings");
-}
-//#endregion
-//#region src/alexa-proxy-login-manager.ts
 var AlexaProxyLoginManager = class {
 	#logger;
 	#getProxyConfig;
-	#getAppConnectionAddresses;
+	#getLoginProxy;
+	#captureWaitMs;
 	#session = null;
 	#captured = /* @__PURE__ */ new Map();
+	#attemptCloser = null;
 	constructor(deps) {
 		this.#logger = deps.logger;
 		this.#getProxyConfig = deps.getProxyConfig;
-		this.#getAppConnectionAddresses = deps.getAppConnectionAddresses;
+		this.#getLoginProxy = deps.getLoginProxy;
+		this.#captureWaitMs = deps.captureWaitMs ?? CAPTURE_WAIT_MS;
 	}
 	/**
 	* Start a fresh proxy-login. Cancels any in-flight session first (single
@@ -132366,18 +133009,41 @@ var AlexaProxyLoginManager = class {
 	*/
 	async start(amazonDomain) {
 		await this.cancelActive();
-		const { proxyHost, proxyPort } = this.#getProxyConfig();
-		const host = await resolveProxyHost({
-			override: proxyHost,
-			readAppConnections: this.#getAppConnectionAddresses,
-			logger: this.#logger
-		});
+		const loginProxy = this.#getLoginProxy();
+		if (loginProxy === null) throw new Error("alexa proxy-login: the hub login proxy is not available on this hub");
+		const { proxyPort } = this.#getProxyConfig();
+		const upstreamHost = `${ALEXA_PROXY_LOOPBACK_HOST}:${proxyPort}`;
 		const sessionId = randomBytes(9).toString("base64url");
+		loginProxy.open({
+			attemptId: sessionId,
+			expiresAtMs: Date.now() + ATTEMPT_TTL_MS,
+			upstreams: [{
+				host: upstreamHost,
+				scheme: "http"
+			}],
+			terminal: cookieSuccessTerminal,
+			onDone: async () => {
+				return await this.#session?.whenCaptured(this.#captureWaitMs) === true ? {
+					status: "success",
+					addonId: ADDON_ID
+				} : {
+					status: "error",
+					addonId: ADDON_ID,
+					reason: "exchange_failed"
+				};
+			}
+		});
+		const loginUrl = loginProxy.entryPath(sessionId, `http://${upstreamHost}/`);
+		if (loginUrl === null) {
+			loginProxy.close(sessionId);
+			throw new Error("alexa proxy-login: the hub login proxy refused the login address");
+		}
+		this.#attemptCloser = () => loginProxy.close(sessionId);
 		const session = new AlexaProxyLoginSession({
 			sessionId,
 			amazonDomain,
-			proxyOwnIp: host,
 			proxyPort,
+			loginUrl,
 			logger: this.#logger,
 			onCookie: (id, captured) => {
 				this.#captured.set(id, captured);
@@ -132388,6 +133054,7 @@ var AlexaProxyLoginManager = class {
 			await session.start();
 		} catch (err) {
 			this.#session = null;
+			this.#closeAttempt();
 			await session.dispose();
 			throw new Error(`alexa proxy-login: failed to start proxy — ${errMsg(err)}`, { cause: err });
 		}
@@ -132421,10 +133088,16 @@ var AlexaProxyLoginManager = class {
 		await this.cancelActive();
 		this.#captured.delete(sessionId);
 	}
+	#closeAttempt() {
+		const close = this.#attemptCloser;
+		this.#attemptCloser = null;
+		close?.();
+	}
 	/** Cancel + dispose whatever session is currently active. */
 	async cancelActive() {
 		const session = this.#session;
 		this.#session = null;
+		this.#closeAttempt();
 		if (session === null) return;
 		try {
 			await session.cancel();
@@ -136039,10 +136712,7 @@ var SPEAK_PAGE = {
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
-	proxyLogin: {
-		proxyHost: "",
-		proxyPort: 3456
-	},
+	proxyLogin: { proxyPort: 3456 },
 	speak: {
 		email: "",
 		password: "",
@@ -136088,6 +136758,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	deviceClasses = Object.fromEntries(ALEXA_DEVICE_TYPES.map((t) => [t, AlexaDevice]));
 	registry = null;
 	proxyLogin = null;
+	loginPlane = null;
+	loginProxy = null;
 	brokerStore = null;
 	activeBrokers = [];
 	speak = null;
@@ -136127,16 +136799,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 		alexaCommands.setDispatcher((brokerId, command) => this.requireRegistry().sendCommand(brokerId, command));
 		await this.registry.restore(this.activeBrokers);
+		await this.serveLoginProxy();
 		this.proxyLogin = new AlexaProxyLoginManager({
 			logger: this.ctx.logger,
 			getProxyConfig: () => {
-				const cfg = alexaProxyLoginSchema.parse(this.config.proxyLogin ?? {});
-				return {
-					proxyHost: cfg.proxyHost,
-					proxyPort: cfg.proxyPort
-				};
+				return { proxyPort: alexaProxyLoginSchema.parse(this.config.proxyLogin ?? {}).proxyPort };
 			},
-			getAppConnectionAddresses: async () => (await this.ctx.api.localNetwork.getAddresses.query()).roles.appConnections.resolved
+			getLoginProxy: () => this.loginProxy
 		});
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
 		await this.reconcileIntegrationsToBrokers();
@@ -136268,6 +136937,24 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		}
 		this.speak?.brokersChanged();
 	}
+	/** The hub's HTTPS face for the Amazon login (D955): admin session only. */
+	async serveLoginProxy() {
+		const proxy = new VendorLoginProxy({
+			addonId: this.ctx.id,
+			prefix: ALEXA_LOGIN_PROXY_PREFIX,
+			logger: this.ctx.logger
+		});
+		try {
+			this.loginPlane = await this.ctx.dataPlane?.serve({
+				prefix: "login",
+				access: "admin",
+				handler: proxy.handler
+			}) ?? null;
+			if (this.loginPlane !== null) this.loginProxy = proxy;
+		} catch (err) {
+			this.ctx.logger.warn("Alexa: login proxy failed to serve — interactive sign-in is unavailable", { meta: { error: errMsg(err) } });
+		}
+	}
 	async onShutdown() {
 		this.speak?.stop();
 		this.speak = null;
@@ -136278,6 +136965,9 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			this.ctx.logger.warn("Alexa: proxy-login dispose error", { meta: { error: errMsg(err) } });
 		}
 		this.proxyLogin = null;
+		await this.loginPlane?.dispose().catch(() => void 0);
+		this.loginPlane = null;
+		this.loginProxy = null;
 		try {
 			await this.registry?.shutdown();
 		} catch (err) {
@@ -136523,19 +137213,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			id: "alexa-proxy-login",
 			title: "Interactive login (proxy)",
 			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-			description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
+			description: "The \"Sign in\" button in onboarding opens the real Amazon login page through this hub (same address and HTTPS as this page) and captures the cookie after you complete it (incl. 2FA). The port below is only used on the hub itself and is never exposed.",
 			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
 			columns: 2,
 			fields: [{
-				type: "text",
-				key: "proxyLogin.proxyHost",
-				label: "Login proxy host/IP (blank = auto-detect)",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
-				placeholder: "auto-detect"
-			}, {
 				type: "number",
 				key: "proxyLogin.proxyPort",
-				label: "Login proxy port",
+				label: "Internal login port (loopback)",
 				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
 				min: 1,
 				max: 65535,