@camstack/addon-import-alexa 0.2.158 → 0.2.160

package/dist/addon.mjs

@@ -989,7 +989,7 @@ var propertyKeyTypes = /* @__PURE__*/ new Set([
 	"number",
 	"symbol"
 ]);
-function escapeRegex(str) {
+function escapeRegex$1(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -1719,7 +1719,7 @@ var $ZodCheckUpperCase = /*@__PURE__*/ $constructor("$ZodCheckUpperCase", (inst,
 });
 var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const escapedRegex = escapeRegex(def.includes);
+	const escapedRegex = escapeRegex$1(def.includes);
 	const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
 	def.pattern = pattern;
 	inst._zod.onattach.push((inst) => {
@@ -1742,7 +1742,7 @@ var $ZodCheckIncludes = /*@__PURE__*/ $constructor("$ZodCheckIncludes", (inst, d
 });
 var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+	const pattern = new RegExp(`^${escapeRegex$1(def.prefix)}.*`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -1764,7 +1764,7 @@ var $ZodCheckStartsWith = /*@__PURE__*/ $constructor("$ZodCheckStartsWith", (ins
 });
 var $ZodCheckEndsWith = /*@__PURE__*/ $constructor("$ZodCheckEndsWith", (inst, def) => {
 	$ZodCheck.init(inst, def);
-	const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+	const pattern = new RegExp(`.*${escapeRegex$1(def.suffix)}$`);
 	def.pattern ?? (def.pattern = pattern);
 	inst._zod.onattach.push((inst) => {
 		const bag = inst._zod.bag;
@@ -3000,7 +3000,7 @@ var $ZodEnum = /*@__PURE__*/ $constructor("$ZodEnum", (inst, def) => {
 	const values = getEnumValues(def.entries);
 	const valuesSet = new Set(values);
 	inst._zod.values = valuesSet;
-	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex$1(o) : o.toString()).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (valuesSet.has(input)) return payload;
@@ -3018,7 +3018,7 @@ var $ZodLiteral = /*@__PURE__*/ $constructor("$ZodLiteral", (inst, def) => {
 	if (def.values.length === 0) throw new Error("Cannot create literal schema with no valid values");
 	const values = new Set(def.values);
 	inst._zod.values = values;
-	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+	inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex$1(o) : o ? escapeRegex$1(o.toString()) : String(o)).join("|")})$`);
 	inst._zod.parse = (payload, _ctx) => {
 		const input = payload.value;
 		if (values.has(input)) return payload;
@@ -90636,6 +90636,457 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* The data-plane prefix every `VendorLoginProxy` is served under
+* (`/addon/<addonId>/vendor-login/<attemptId>/<vendorHost>/…`).
+*
+* The hub consults an addon's data-plane prefixes BEFORE its HTTP routes, so a
+* prefix equal to the first segment of a route the addon serves swallows that
+* route. A sign-in addon serves `/login/start|status|commit|cancel`; the proxy
+* therefore lives on a segment no addon route uses. One constant, so the entry
+* path, the mount and the docs cannot drift apart.
+*/
+var VENDOR_LOGIN_PROXY_PREFIX = "vendor-login";
+/**
+* Where an OAuth round-trip ends: the admin-ui completion route
+* (`/sso-complete`, the page every popup sign-in already lands on), with the
+* OUTCOME in the URL fragment.
+*
+* The outcome is a status plus a reason CODE from a closed list. It never
+* carries a token, a code, a client secret or a free-form error message: the
+* page words each code itself, and an unknown code reads as `unknown` rather
+* than being echoed. Fragment only, so nothing here reaches a server log.
+*
+* Pure and browser-safe.
+*/
+/** The admin-ui route the hub's OAuth completions land on (relative to its mount). */
+var OAUTH_LANDING_PATH = "/sso-complete";
+/**
+* The landing URL for `outcome`. `origin` is the hub address the flow already
+* runs on (from the `local-network` palette role, never a literal); `null`
+* gives a hub-relative URL.
+*/
+function oauthLandingUrl(origin, outcome) {
+	const params = new URLSearchParams({
+		return: "oauth",
+		status: outcome.status
+	});
+	if (outcome.addonId !== void 0) params.set("addon", outcome.addonId);
+	if (outcome.brokerId !== void 0) params.set("broker", outcome.brokerId);
+	if (outcome.integration !== void 0) params.set("integration", outcome.integration);
+	if (outcome.status === "error") params.set("reason", outcome.reason ?? "unknown");
+	if (outcome.action === "disconnect") params.set("action", "disconnect");
+	return `${origin === null ? "" : origin.replace(/\/+$/, "")}${OAUTH_LANDING_PATH}#${params.toString()}`;
+}
+var LOOPBACK_HOSTS = new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+function hostWithoutPort(host) {
+	if (host.startsWith("[")) return host.slice(0, host.indexOf("]") + 1);
+	const colon = host.indexOf(":");
+	return colon === -1 ? host : host.slice(0, colon);
+}
+function isLoopbackHost(host) {
+	return LOOPBACK_HOSTS.has(hostWithoutPort(host.toLowerCase()));
+}
+/** An allow-list entry is valid when it is a bare host[:port] and `http` only targets loopback. */
+function isValidUpstream(upstream) {
+	if (upstream.host.length === 0 || !/^[a-z0-9.[\]:-]+$/.test(upstream.host)) return false;
+	return upstream.scheme === "https" || isLoopbackHost(upstream.host);
+}
+function findUpstream(route, host) {
+	const wanted = host.toLowerCase();
+	return route.upstreams.find((upstream) => upstream.host === wanted);
+}
+/** `<basePath>/<host><pathname><search>` — what the browser is sent to. */
+function proxyPathFor(route, host, pathname, search = "") {
+	return `${route.basePath}/${host}${pathname.startsWith("/") ? pathname : `/${pathname}`}${search}`;
+}
+/** Split `/<attemptId>/<host>/<rest…>[?query]` (the data-plane view of a request). */
+function parseProxyPath(rawUrl) {
+	const queryAt = rawUrl.indexOf("?");
+	const path = queryAt === -1 ? rawUrl : rawUrl.slice(0, queryAt);
+	const search = queryAt === -1 ? "" : rawUrl.slice(queryAt);
+	const match = /^\/([A-Za-z0-9_-]{8,128})\/([^/]+)(\/.*)?$/.exec(path);
+	if (match === null) return null;
+	const attemptId = match[1];
+	const host = match[2];
+	if (attemptId === void 0 || host === void 0) return null;
+	return {
+		attemptId,
+		host: host.toLowerCase(),
+		pathname: match[3] ?? "/",
+		search
+	};
+}
+/** The vendor URL a proxied request targets, or null when the host would not stay `host`. */
+function upstreamUrlFor(upstream, parsed) {
+	try {
+		const url = new URL(`${upstream.scheme}://${upstream.host}${parsed.pathname}${parsed.search}`);
+		return url.host.toLowerCase() === upstream.host ? url : null;
+	} catch {
+		return null;
+	}
+}
+function escapeRegex(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** A Location (or any URL value) to a vendor host becomes a proxy path; anything else is unchanged. */
+function rewriteLocation(location, currentUpstream, route) {
+	let resolved;
+	try {
+		resolved = new URL(location, `${currentUpstream.scheme}://${currentUpstream.host}/`);
+	} catch {
+		return location;
+	}
+	if (resolved.protocol !== "https:" && resolved.protocol !== "http:") return location;
+	const target = findUpstream(route, resolved.host);
+	if (target === void 0) return location;
+	return `${proxyPathFor(route, target.host, resolved.pathname, resolved.search)}${resolved.hash}`;
+}
+/** Characters that may precede a URL that STARTS a value (never `=`, `?`, `&`, `%3D`). */
+var VALUE_START = String.raw`(?<=^|["'(\s>,\[{])`;
+/**
+* Rewrite vendor URLs in a text body: absolute (`https://host/…`), protocol-relative
+* (`//host/…`) and JSON-escaped (`https:\/\/host\/…`) when they start a value; and, in
+* HTML/CSS, root-relative references (`href="/x"`, `url(/x)`) which would otherwise
+* escape the proxy mount and land on the hub.
+*/
+function rewriteBody(body, kind, currentUpstream, route) {
+	let out = body;
+	for (const upstream of route.upstreams) {
+		const host = escapeRegex(upstream.host);
+		const plain = new RegExp(`${VALUE_START}(?:https?:)?//${host}(?=[/"'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(plain, `${route.basePath}/${upstream.host}`);
+		const escapedBase = `${route.basePath}/${upstream.host}`.replace(/\//g, "\\/");
+		const escaped = new RegExp(`${VALUE_START}(?:https?:)?\\\\/\\\\/${host}(?=\\\\/|["'?#\\s)\\]},<]|$)`, "g");
+		out = out.replace(escaped, escapedBase);
+	}
+	const current = `${route.basePath}/${currentUpstream.host}/`;
+	const notMounted = `(?!/)(?!${escapeRegex(route.basePath.slice(1))}/)`;
+	if (kind === "html") {
+		const attribute = String.raw`(\b(?:href|src|action|formaction|poster|data-href|data-src)\s*=\s*["'])/`;
+		out = out.replace(new RegExp(`${attribute}${notMounted}`, "gi"), `$1${current}`);
+	}
+	if (kind === "html" || kind === "css") {
+		const cssUrl = String.raw`(url\(\s*["']?)/`;
+		out = out.replace(new RegExp(`${cssUrl}${notMounted}`, "gi"), `$1${current}`);
+	}
+	return out;
+}
+/**
+* A vendor `Set-Cookie` for the browser: no `Domain` (the cookie belongs to the hub
+* origin), `Path` narrowed to this attempt's prefix, `Secure` kept (the hub is HTTPS).
+*/
+function rewriteSetCookie(cookie, route) {
+	const kept = cookie.split(";").map((part) => part.trim()).filter((part, index) => {
+		if (index === 0) return true;
+		const name = part.split("=")[0]?.trim().toLowerCase() ?? "";
+		return name !== "domain" && name !== "path";
+	});
+	kept.push(`Path=${route.basePath}/`);
+	return kept.join("; ");
+}
+/**
+* A browser `Referer` that points into this proxy, turned back into the vendor URL it
+* stands for. A Referer that is not ours is dropped (null): it names the hub.
+*/
+function rewriteReferer(referer, route) {
+	let url;
+	try {
+		url = new URL(referer, "http://hub.invalid");
+	} catch {
+		return null;
+	}
+	if (!url.pathname.startsWith(`${route.basePath}/`)) return null;
+	const rest = /^\/([^/]+)(\/.*)?$/.exec(url.pathname.slice(route.basePath.length));
+	const host = rest?.[1]?.toLowerCase();
+	if (host === void 0) return null;
+	const upstream = findUpstream(route, host);
+	if (upstream === void 0) return null;
+	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
+}
+/** Cookies the browser holds for the hub itself must never reach a vendor. */
+function filterForwardedCookies(cookieHeader) {
+	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
+}
+var MAX_REQUEST_BODY_BYTES = 2 * 1024 * 1024;
+var MAX_TEXT_BODY_BYTES = 4 * 1024 * 1024;
+/** Request headers that are never forwarded to the vendor. */
+var DROP_REQUEST_HEADERS = new Set([
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"content-length",
+	"accept-encoding",
+	"authorization",
+	"cookie",
+	"origin",
+	"referer",
+	"x-camstack-dataplane-secret",
+	"x-forwarded-for",
+	"x-forwarded-host",
+	"x-forwarded-proto",
+	"x-forwarded-prefix",
+	"x-real-ip",
+	"forwarded"
+]);
+/**
+* Response headers dropped: framing/CSP/HSTS that break a page under another origin, and
+* the ones that no longer describe the (decoded, possibly rewritten) body.
+*/
+var DROP_RESPONSE_HEADERS = new Set([
+	"content-security-policy",
+	"content-security-policy-report-only",
+	"x-frame-options",
+	"strict-transport-security",
+	"public-key-pins",
+	"report-to",
+	"nel",
+	"content-encoding",
+	"content-length",
+	"transfer-encoding",
+	"connection",
+	"keep-alive",
+	"set-cookie",
+	"location"
+]);
+function bodyKindOf(contentType) {
+	const type = contentType.toLowerCase();
+	if (type.includes("text/html") || type.includes("application/xhtml")) return "html";
+	if (type.includes("text/css")) return "css";
+	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
+	return null;
+}
+function firstHeader(value) {
+	return Array.isArray(value) ? value[0] : value;
+}
+async function readRequestBody(req) {
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req) {
+		const buf = typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk);
+		size += buf.length;
+		if (size > MAX_REQUEST_BODY_BYTES) return "too-large";
+		chunks.push(buf);
+	}
+	return Buffer.concat(chunks);
+}
+function sendPlain(res, status, text) {
+	res.writeHead(status, {
+		"content-type": "text/plain; charset=utf-8",
+		"cache-control": "no-store"
+	});
+	res.end(text);
+}
+var VendorLoginProxy = class {
+	#addonId;
+	#logger;
+	#now;
+	#fetch;
+	#attempts = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.#addonId = options.addonId;
+		this.#logger = options.logger;
+		this.#now = options.now ?? (() => Date.now());
+		this.#fetch = options.fetchFn ?? globalThis.fetch.bind(globalThis);
+	}
+	/** The `DataPlaneHandler` to pass to `ctx.dataPlane.serve({ prefix: VENDOR_LOGIN_PROXY_PREFIX, access: 'admin', … })`. */
+	handler = (req, res) => this.#handle(req, res);
+	/** Register an attempt. A one-shot capability: refused hosts are rejected up front. */
+	open(spec) {
+		for (const upstream of spec.upstreams) if (!isValidUpstream(upstream)) throw new Error(`vendor login proxy: upstream ${upstream.host} is not allowed`);
+		this.#attempts.set(spec.attemptId, {
+			expiresAtMs: spec.expiresAtMs,
+			upstreams: spec.upstreams,
+			evaluate: async (view) => {
+				const verdict = await spec.terminal(view);
+				if (verdict.kind === "continue") return verdict;
+				return {
+					kind: "done",
+					landing: await spec.onDone(verdict.payload)
+				};
+			}
+		});
+	}
+	close(attemptId) {
+		this.#attempts.delete(attemptId);
+	}
+	isOpen(attemptId) {
+		const attempt = this.#attempts.get(attemptId);
+		return attempt !== void 0 && this.#now() <= attempt.expiresAtMs;
+	}
+	/**
+	* The hub-relative path that opens `vendorUrl` through the proxy for this attempt:
+	* the URL the browser is sent to. Null when the host is not in the attempt's list.
+	*/
+	entryPath(attemptId, vendorUrl) {
+		const attempt = this.#attempts.get(attemptId);
+		if (attempt === void 0) return null;
+		const url = new URL(vendorUrl);
+		if (findUpstream({
+			basePath: "",
+			upstreams: attempt.upstreams
+		}, url.host) === void 0) return null;
+		return `/addon/${this.#addonId}/${VENDOR_LOGIN_PROXY_PREFIX}/${attemptId}/${url.host}${url.pathname}${url.search}`;
+	}
+	#routeFor(attemptId, attempt, forwardedPrefix) {
+		return {
+			basePath: `${forwardedPrefix}/addon/${this.#addonId}/${VENDOR_LOGIN_PROXY_PREFIX}/${attemptId}`,
+			upstreams: attempt.upstreams
+		};
+	}
+	async #handle(req, res) {
+		try {
+			await this.#serve(req, res);
+		} catch (err) {
+			this.#logger.warn("vendor login proxy: request failed", { meta: {
+				addonId: this.#addonId,
+				error: err instanceof Error ? err.name : "unknown"
+			} });
+			if (!res.headersSent) sendPlain(res, 502, "The sign-in page could not be reached.");
+			else res.end();
+		}
+	}
+	async #serve(req, res) {
+		const parsed = parseProxyPath(req.url ?? "/");
+		if (parsed === null) {
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const forwardedPrefix = (firstHeader(req.headers["x-forwarded-prefix"]) ?? "").replace(/\/+$/, "");
+		const attempt = this.#attempts.get(parsed.attemptId);
+		if (attempt === void 0 || this.#now() > attempt.expiresAtMs) {
+			if (attempt !== void 0) this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: attempt refused", { meta: {
+				addonId: this.#addonId,
+				reason: attempt === void 0 ? "missing" : "expired"
+			} });
+			this.#redirect(res, forwardedPrefix, {
+				status: "error",
+				addonId: this.#addonId,
+				reason: "invalid_state"
+			});
+			return;
+		}
+		const route = this.#routeFor(parsed.attemptId, attempt, forwardedPrefix);
+		const upstream = findUpstream(route, parsed.host);
+		const target = upstream === void 0 ? null : upstreamUrlFor(upstream, parsed);
+		if (upstream === void 0 || target === null) {
+			this.#logger.warn("vendor login proxy: host refused", { meta: {
+				addonId: this.#addonId,
+				host: parsed.host
+			} });
+			sendPlain(res, 404, "Not found");
+			return;
+		}
+		const method = (req.method ?? "GET").toUpperCase();
+		let body;
+		if (method !== "GET" && method !== "HEAD") {
+			const read = await readRequestBody(req);
+			if (read === "too-large") {
+				sendPlain(res, 413, "Request too large");
+				return;
+			}
+			body = read;
+		}
+		const headers = this.#requestHeaders(req, route, upstream);
+		const upstreamRes = await this.#fetch(target, {
+			method,
+			headers,
+			redirect: "manual",
+			...body !== void 0 && body.length > 0 ? { body: new Uint8Array(body) } : {}
+		});
+		const location = upstreamRes.headers.get("location");
+		const setCookies = upstreamRes.headers.getSetCookie();
+		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
+		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
+		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
+		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+			addonId: this.#addonId,
+			host: upstream.host,
+			status: upstreamRes.status,
+			method
+		} });
+		const settled = await attempt.evaluate({
+			status: upstreamRes.status,
+			url: target.toString(),
+			location,
+			setCookies,
+			bodyText: text
+		});
+		if (settled.kind === "done") {
+			this.#attempts.delete(parsed.attemptId);
+			this.#logger.info("vendor login proxy: sign-in finished", { meta: {
+				addonId: this.#addonId,
+				status: settled.landing.status
+			} });
+			this.#redirect(res, forwardedPrefix, settled.landing);
+			return;
+		}
+		const out = {};
+		upstreamRes.headers.forEach((value, name) => {
+			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
+		});
+		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
+		out["cache-control"] = "no-store";
+		if (text !== null && kind !== null) {
+			const rewritten = rewriteBody(text, kind, upstream, route);
+			res.writeHead(upstreamRes.status, out);
+			res.end(rewritten);
+			return;
+		}
+		res.writeHead(upstreamRes.status, out);
+		await this.#pipeBody(upstreamRes, res);
+	}
+	#requestHeaders(req, route, upstream) {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			const lower = name.toLowerCase();
+			if (DROP_REQUEST_HEADERS.has(lower) || value === void 0) continue;
+			headers[lower] = Array.isArray(value) ? value.join(", ") : value;
+		}
+		const cookie = filterForwardedCookies(firstHeader(req.headers["cookie"]) ?? "");
+		if (cookie.length > 0) headers["cookie"] = cookie;
+		if (req.headers["origin"] !== void 0) headers["origin"] = `${upstream.scheme}://${upstream.host}`;
+		const referer = firstHeader(req.headers["referer"]);
+		if (referer !== void 0) {
+			const back = rewriteReferer(referer, route);
+			if (back !== null) headers["referer"] = back;
+		}
+		return headers;
+	}
+	async #pipeBody(upstreamRes, res) {
+		if (upstreamRes.body === null) {
+			res.end();
+			return;
+		}
+		for await (const chunk of upstreamRes.body) {
+			if (!res.write(chunk)) await new Promise((resolve) => {
+				res.once("drain", resolve);
+				res.once("close", resolve);
+			});
+			if (res.destroyed) return;
+		}
+		res.end();
+	}
+	#redirect(res, forwardedPrefix, outcome) {
+		res.writeHead(302, {
+			location: `${forwardedPrefix}${oauthLandingUrl(null, outcome)}`,
+			"cache-control": "no-store"
+		});
+		res.end();
+	}
+};
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
@@ -90687,18 +91138,12 @@ var AlexaBrokerEntrySchema = object({
 });
 /**
 * Interactive proxy-login settings (addon-global, not per-broker). alexa-remote2
-* spins a local reverse-proxy to Amazon's login page on `proxyHost:proxyPort`;
-* the operator opens that URL and logs in. `proxyHost` MUST be the host:port the
-* operator's browser uses (alexa-cookie2 rewrites Amazon URLs to absolute
-* `http://<proxyHost>:<proxyPort>/...`), so it is a directly-reachable host —
-* the hub's LAN IP/hostname — NOT behind the hub's HTTPS data-plane mount.
-* Empty `proxyHost` ⇒ the first LAN address of the hub's `appConnections`
-* role (local-network palette) at login-start time.
+* spins a local reverse-proxy to Amazon's login page on `127.0.0.1:proxyPort`; the
+* operator never reaches it directly — the hub's login proxy (D955) opens it at
+* `/addon/import-alexa/vendor-login/…` under the hub's own HTTPS origin. The port only has to
+* be free on the hub's loopback.
 */
-var alexaProxyLoginSchema = object({
-	proxyHost: string().default("").describe("Host/IP the browser uses to reach the login proxy (blank = the hub LAN address)"),
-	proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Port the local Amazon-login proxy listens on (must be reachable)")
-});
+var alexaProxyLoginSchema = object({ proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Loopback port the local Amazon-login proxy listens on (never exposed)") });
 /**
 * Echo speech settings. Speech signs in as an import broker, so the targets
 * are what lives here. `email`, `password`, `region` and `session` are the OLD
@@ -90745,10 +91190,7 @@ function readSpeakSettings(config) {
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
-	proxyLogin: alexaProxyLoginSchema.default({
-		proxyHost: "",
-		proxyPort: 3456
-	}),
+	proxyLogin: alexaProxyLoginSchema.default({ proxyPort: 3456 }),
 	speak: alexaSpeakSettingsSchema.default({
 		email: "",
 		password: "",
@@ -132304,6 +132746,31 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 //#endregion
 //#region src/alexa-proxy-login.ts
 /**
+* INTERACTIVE Amazon login via `alexa-remote2`'s built-in proxy auth mode, behind the
+* hub's vendor login proxy (D955).
+*
+* alexa-remote2 (through `alexa-cookie2`) spins a local Express reverse-proxy to
+* Amazon's real login page and captures the resulting cookie + the richer
+* `cookieData` registration blob (it embeds the refresh token, so the session can
+* auto-refresh forever). That listener is bound to LOOPBACK only
+* (`proxyOwnIp` = `proxyListenBind` = 127.0.0.1): nothing outside this process's host can
+* reach it. The operator's browser reaches it through the hub's data plane instead
+* (`VendorLoginProxy`, `/addon/<id>/vendor-login/<attempt>/127.0.0.1:<port>/…`), which is
+* HTTPS under the same origin as the admin page. alexa-cookie2 keeps doing the Amazon
+* specific work (login cookies, device registration, the `/ax/claim` and CSRF steps)
+* and the hub proxy only rewrites the loopback-origin URLs it emits into the mount.
+*
+* Why not the second proxy replacing alexa-cookie2's: the capture needs the PKCE
+* verifier, the device id, the initial cookies and the app registration alexa-cookie2
+* already performs; re-implementing them would add JS-built-URL failure modes.
+*
+* The captured `cookieData` is handed to {@link AlexaProxyLoginSessionOptions.onCookie}
+* — the addon persists it on the broker entry, exactly where a pasted cookie
+* goes, so the rest of the addon (broker / poll / adoption) is unchanged.
+*/
+/** The only address the alexa-cookie2 listener binds and advertises. */
+var ALEXA_PROXY_LOOPBACK_HOST = "127.0.0.1";
+/**
 * A single interactive proxy-login attempt. One instance = one Amazon login.
 * Construct → {@link start} → poll {@link getStatus} → on `captured` the
 * `onCookie` callback has fired with the blob → {@link dispose}.
@@ -132317,13 +132784,37 @@ var AlexaProxyLoginSession = class {
 	#startedAt = Date.now();
 	#capturedAt = null;
 	#captured = false;
+	#waiters = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.#opts = opts;
 		this.#logger = opts.logger;
 	}
-	/** `http://<proxyOwnIp>:<proxyPort>/` — what the operator opens. */
+	/** What the operator opens: the hub-relative entry of the login proxy. */
 	get loginUrl() {
-		return `http://${this.#opts.proxyOwnIp}:${this.#opts.proxyPort}/`;
+		return this.#opts.loginUrl;
+	}
+	/** `host:port` of the loopback listener — the one upstream the hub proxy may reach. */
+	get upstreamHost() {
+		return `${ALEXA_PROXY_LOOPBACK_HOST}:${this.#opts.proxyPort}`;
+	}
+	/**
+	* Resolves true once the cookie material is in hand, false after `timeoutMs`.
+	* The Amazon page ends on `/cookie-success` BEFORE alexa-cookie2 finished registering
+	* the app, so the hub waits here before it sends the browser to the result page.
+	*/
+	whenCaptured(timeoutMs) {
+		if (this.#captured) return Promise.resolve(true);
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				this.#waiters.delete(settle);
+				resolve(false);
+			}, timeoutMs);
+			const settle = () => {
+				clearTimeout(timer);
+				resolve(true);
+			};
+			this.#waiters.add(settle);
+		});
 	}
 	getStatus() {
 		return {
@@ -132355,7 +132846,8 @@ var AlexaProxyLoginSession = class {
 		remote.on("cookie", () => this.#onCookieEvent(remote));
 		remote.init({
 			proxyOnly: true,
-			proxyOwnIp: this.#opts.proxyOwnIp,
+			proxyOwnIp: ALEXA_PROXY_LOOPBACK_HOST,
+			proxyListenBind: ALEXA_PROXY_LOOPBACK_HOST,
 			proxyPort: this.#opts.proxyPort,
 			proxyLogLevel: "warn",
 			amazonPage,
@@ -132401,6 +132893,8 @@ var AlexaProxyLoginSession = class {
 		this.#captured = true;
 		this.#capturedAt = Date.now();
 		this.#phase = "captured";
+		for (const settle of this.#waiters) settle();
+		this.#waiters.clear();
 		this.#logger.info("alexa proxy-login: cookie captured", { meta: { sessionId: this.#opts.sessionId } });
 		try {
 			this.#opts.onCookie(this.#opts.sessionId, {
@@ -132421,10 +132915,7 @@ var AlexaProxyLoginSession = class {
 		if (isProxyReadyError(err)) {
 			if (this.#phase === "starting") {
 				this.#phase = "awaiting-login";
-				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: {
-					sessionId: this.#opts.sessionId,
-					loginUrl: this.loginUrl
-				} });
+				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: { sessionId: this.#opts.sessionId } });
 			}
 			return;
 		}
@@ -132482,62 +132973,42 @@ function isStringOrObject(value) {
 	return typeof value === "string" || typeof value === "object" && value !== null;
 }
 //#endregion
-//#region src/alexa-proxy-host.ts
-/** Typed refusal: names WHY no proxy host could be chosen. */
-var AlexaProxyHostError = class extends Error {
-	reason;
-	constructor(reason, message, options) {
-		super(message, options);
-		this.name = "AlexaProxyHostError";
-		this.reason = reason;
-	}
-};
-var PRIVATE_IPV4 = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)/;
-var IPV4_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
-/** A host a browser on the hub's network reaches directly: private IPv4, `.local`, or a bare name. */
-function isLanHost(host) {
-	if (host.length === 0) return false;
-	if (IPV4_LITERAL.test(host)) return PRIVATE_IPV4.test(host);
-	if (host.includes(":")) return false;
-	return host.endsWith(".local") || !host.includes(".");
-}
-function lanHostOf(address) {
+//#region src/alexa-proxy-login-manager.ts
+/** The addon id the result page names to return to. */
+var ADDON_ID = "import-alexa";
+/** An attempt lives as long as a sign-in attempt does elsewhere (10 min). */
+var ATTEMPT_TTL_MS = 600 * 1e3;
+/** How long the browser waits on the Amazon page for alexa-cookie2 to finish registering. */
+var CAPTURE_WAIT_MS = 6e4;
+/**
+* Terminal condition: alexa-cookie2 turns Amazon's final redirect into a 302 to its own
+* `/cookie-success` page once it holds the login cookie. Matching on the path of the raw
+* `Location` keeps this independent of the page's HTML.
+*/
+function cookieSuccessTerminal(view) {
+	if (view.location === null) return { kind: "continue" };
 	try {
-		const host = new URL(address).hostname;
-		return isLanHost(host) && host !== "localhost" ? host : null;
+		return new URL(view.location, `http://127.0.0.1`).pathname === "/cookie-success" ? {
+			kind: "done",
+			payload: true
+		} : { kind: "continue" };
 	} catch {
-		return null;
-	}
-}
-async function resolveProxyHost(input) {
-	const override = input.override.trim();
-	if (override.length > 0) return override;
-	let addresses;
-	try {
-		addresses = await input.readAppConnections();
-	} catch (err) {
-		input.logger.warn("alexa proxy-login: hub addresses unavailable from local-network", { meta: { error: errMsg(err) } });
-		throw new AlexaProxyHostError("palette-unavailable", "alexa proxy-login: the hub address list is unavailable — set proxyHost in settings", { cause: err });
+		return { kind: "continue" };
 	}
-	for (const address of addresses) {
-		const host = lanHostOf(address);
-		if (host !== null) return host;
-	}
-	input.logger.warn("alexa proxy-login: no LAN address among the hub appConnections", { meta: { addresses: [...addresses] } });
-	throw new AlexaProxyHostError("no-lan-address", "alexa proxy-login: the hub has no LAN address the browser can open directly — set proxyHost in settings");
 }
-//#endregion
-//#region src/alexa-proxy-login-manager.ts
 var AlexaProxyLoginManager = class {
 	#logger;
 	#getProxyConfig;
-	#getAppConnectionAddresses;
+	#getLoginProxy;
+	#captureWaitMs;
 	#session = null;
 	#captured = /* @__PURE__ */ new Map();
+	#attemptCloser = null;
 	constructor(deps) {
 		this.#logger = deps.logger;
 		this.#getProxyConfig = deps.getProxyConfig;
-		this.#getAppConnectionAddresses = deps.getAppConnectionAddresses;
+		this.#getLoginProxy = deps.getLoginProxy;
+		this.#captureWaitMs = deps.captureWaitMs ?? CAPTURE_WAIT_MS;
 	}
 	/**
 	* Start a fresh proxy-login. Cancels any in-flight session first (single
@@ -132545,18 +133016,41 @@ var AlexaProxyLoginManager = class {
 	*/
 	async start(amazonDomain) {
 		await this.cancelActive();
-		const { proxyHost, proxyPort } = this.#getProxyConfig();
-		const host = await resolveProxyHost({
-			override: proxyHost,
-			readAppConnections: this.#getAppConnectionAddresses,
-			logger: this.#logger
-		});
+		const loginProxy = this.#getLoginProxy();
+		if (loginProxy === null) throw new Error("alexa proxy-login: the hub login proxy is not available on this hub");
+		const { proxyPort } = this.#getProxyConfig();
+		const upstreamHost = `${ALEXA_PROXY_LOOPBACK_HOST}:${proxyPort}`;
 		const sessionId = randomBytes(9).toString("base64url");
+		loginProxy.open({
+			attemptId: sessionId,
+			expiresAtMs: Date.now() + ATTEMPT_TTL_MS,
+			upstreams: [{
+				host: upstreamHost,
+				scheme: "http"
+			}],
+			terminal: cookieSuccessTerminal,
+			onDone: async () => {
+				return await this.#session?.whenCaptured(this.#captureWaitMs) === true ? {
+					status: "success",
+					addonId: ADDON_ID
+				} : {
+					status: "error",
+					addonId: ADDON_ID,
+					reason: "exchange_failed"
+				};
+			}
+		});
+		const loginUrl = loginProxy.entryPath(sessionId, `http://${upstreamHost}/`);
+		if (loginUrl === null) {
+			loginProxy.close(sessionId);
+			throw new Error("alexa proxy-login: the hub login proxy refused the login address");
+		}
+		this.#attemptCloser = () => loginProxy.close(sessionId);
 		const session = new AlexaProxyLoginSession({
 			sessionId,
 			amazonDomain,
-			proxyOwnIp: host,
 			proxyPort,
+			loginUrl,
 			logger: this.#logger,
 			onCookie: (id, captured) => {
 				this.#captured.set(id, captured);
@@ -132567,6 +133061,7 @@ var AlexaProxyLoginManager = class {
 			await session.start();
 		} catch (err) {
 			this.#session = null;
+			this.#closeAttempt();
 			await session.dispose();
 			throw new Error(`alexa proxy-login: failed to start proxy — ${errMsg(err)}`, { cause: err });
 		}
@@ -132600,10 +133095,16 @@ var AlexaProxyLoginManager = class {
 		await this.cancelActive();
 		this.#captured.delete(sessionId);
 	}
+	#closeAttempt() {
+		const close = this.#attemptCloser;
+		this.#attemptCloser = null;
+		close?.();
+	}
 	/** Cancel + dispose whatever session is currently active. */
 	async cancelActive() {
 		const session = this.#session;
 		this.#session = null;
+		this.#closeAttempt();
 		if (session === null) return;
 		try {
 			await session.cancel();
@@ -136218,10 +136719,7 @@ var SPEAK_PAGE = {
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
-	proxyLogin: {
-		proxyHost: "",
-		proxyPort: 3456
-	},
+	proxyLogin: { proxyPort: 3456 },
 	speak: {
 		email: "",
 		password: "",
@@ -136267,6 +136765,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	deviceClasses = Object.fromEntries(ALEXA_DEVICE_TYPES.map((t) => [t, AlexaDevice]));
 	registry = null;
 	proxyLogin = null;
+	loginPlane = null;
+	loginProxy = null;
 	brokerStore = null;
 	activeBrokers = [];
 	speak = null;
@@ -136306,16 +136806,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		});
 		alexaCommands.setDispatcher((brokerId, command) => this.requireRegistry().sendCommand(brokerId, command));
 		await this.registry.restore(this.activeBrokers);
+		await this.serveLoginProxy();
 		this.proxyLogin = new AlexaProxyLoginManager({
 			logger: this.ctx.logger,
 			getProxyConfig: () => {
-				const cfg = alexaProxyLoginSchema.parse(this.config.proxyLogin ?? {});
-				return {
-					proxyHost: cfg.proxyHost,
-					proxyPort: cfg.proxyPort
-				};
+				return { proxyPort: alexaProxyLoginSchema.parse(this.config.proxyLogin ?? {}).proxyPort };
 			},
-			getAppConnectionAddresses: async () => (await this.ctx.api.localNetwork.getAddresses.query()).roles.appConnections.resolved
+			getLoginProxy: () => this.loginProxy
 		});
 		this.ctx.logger.info("Alexa: import addon initialised", { meta: { brokerCount: this.activeBrokers.length } });
 		await this.reconcileIntegrationsToBrokers();
@@ -136447,6 +136944,23 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		}
 		this.speak?.brokersChanged();
 	}
+	/** The hub's HTTPS face for the Amazon login (D955): admin session only. */
+	async serveLoginProxy() {
+		const proxy = new VendorLoginProxy({
+			addonId: this.ctx.id,
+			logger: this.ctx.logger
+		});
+		try {
+			this.loginPlane = await this.ctx.dataPlane?.serve({
+				prefix: "vendor-login",
+				access: "admin",
+				handler: proxy.handler
+			}) ?? null;
+			if (this.loginPlane !== null) this.loginProxy = proxy;
+		} catch (err) {
+			this.ctx.logger.warn("Alexa: login proxy failed to serve — interactive sign-in is unavailable", { meta: { error: errMsg(err) } });
+		}
+	}
 	async onShutdown() {
 		this.speak?.stop();
 		this.speak = null;
@@ -136457,6 +136971,9 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			this.ctx.logger.warn("Alexa: proxy-login dispose error", { meta: { error: errMsg(err) } });
 		}
 		this.proxyLogin = null;
+		await this.loginPlane?.dispose().catch(() => void 0);
+		this.loginPlane = null;
+		this.loginProxy = null;
 		try {
 			await this.registry?.shutdown();
 		} catch (err) {
@@ -136702,19 +137219,13 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 			id: "alexa-proxy-login",
 			title: "Interactive login (proxy)",
 			titleKey: "import-alexa:globalSettings.s_alexa-proxy-login.title",
-			description: "The \"Login to Amazon\" button in onboarding opens a local proxy that captures the cookie after you complete the real Amazon login (incl. 2FA). Because Amazon URLs are rewritten to this exact host:port, it must be a directly-reachable address — leave the host blank to auto-detect the server IP, and make sure the port is reachable from the browser you log in from.",
+			description: "The \"Sign in\" button in onboarding opens the real Amazon login page through this hub (same address and HTTPS as this page) and captures the cookie after you complete it (incl. 2FA). The port below is only used on the hub itself and is never exposed.",
 			descriptionKey: "import-alexa:globalSettings.s_alexa-proxy-login.description",
 			columns: 2,
 			fields: [{
-				type: "text",
-				key: "proxyLogin.proxyHost",
-				label: "Login proxy host/IP (blank = auto-detect)",
-				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyHost.label",
-				placeholder: "auto-detect"
-			}, {
 				type: "number",
 				key: "proxyLogin.proxyPort",
-				label: "Login proxy port",
+				label: "Internal login port (loopback)",
 				labelKey: "import-alexa:globalSettings.s_alexa-proxy-login.proxyLogin_proxyPort.label",
 				min: 1,
 				max: 65535,