@camstack/addon-import-alexa 0.2.162 → 0.2.164

package/dist/addon.mjs

@@ -8864,28 +8864,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-/**
-* Identity — preserves literal types for downstream inference.
-*
-* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
-* TypeScript does not widen each entry's literal `kind`/`auth` fields to
-* the broader unions declared on `CustomActionSpec`'s default generics.
-* Shape validity is enforced separately by the `customAction(...)` helper
-* whose return type is already a `CustomActionSpec<...>`.
-*/
-function defineCustomActions(spec) {
-	return spec;
-}
-function customAction(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
-		scope: options?.scope ?? { kind: "system" },
-		...options?.caller ? { caller: "required" } : {}
-	};
-}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -11230,7 +11208,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-CZImLpOI.mjs
+//#region ../types/dist/composition-DwA0uVW5.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -16475,24 +16453,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the `addon-pages-aggregator` builtin, reads it via
-	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
-	* only, never tRPC (per `ctx.capabilities` seeing only the local
-	* process). The public, enriched listing admin-ui actually consumes is
-	* the separate `addon-pages` cap, unaffected by this change.
-	*/
-listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
-};
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -19450,12 +19411,13 @@ var CHANGED = {
 	expr: "now"
 };
 function numeric(input) {
+	const { alsoFrom, ...base } = input;
 	return {
-		...input,
+		...base,
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
-		memberDeviceTypes: [DeviceType.Sensor],
+		memberDeviceTypes: [DeviceType.Sensor, ...alsoFrom?.deviceTypes ?? []],
 		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
@@ -19463,9 +19425,10 @@ function numeric(input) {
 		accept: [{
 			cap: input.outputCap,
 			fieldPath: input.outputField
-		}]
+		}, ...alsoFrom === void 0 ? [] : [alsoFrom.accept]]
 	};
 }
+var CLIMATE_DEVICES = [DeviceType.Thermostat, DeviceType.Climate];
 function binary(input) {
 	return {
 		...input,
@@ -19491,7 +19454,14 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentTemp"
+			}
+		}
 	}),
 	numeric({
 		id: "humidity",
@@ -19502,7 +19472,14 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentHumidity"
+			}
+		}
 	}),
 	numeric({
 		id: "pressure",
@@ -45217,6 +45194,43 @@ var NotificationActionSchema = object({
 	*/
 	mode: _enum(["navigate", "background"]).optional()
 });
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
 * `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
@@ -45239,7 +45253,13 @@ var NotificationSchema = object({
 	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
 });
 /** One declared native severity/priority level for a kind. */
 var TargetKindLevelSchema = object({
@@ -45345,6 +45365,11 @@ var TargetKindSchema = object({
 	*/
 	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
 	caps: TargetKindCapsSchema
 });
 /**
@@ -57658,7 +57683,9 @@ var ManifestShapeSchema = object({
 		icon: string().optional()
 	}).optional(),
 	protected: boolean().optional(),
-	removable: boolean().optional()
+	removable: boolean().optional(),
+	/** Declared Integrations-page block (mirror of `AddonDeclaration.integrationSection`). */
+	integrationSection: _enum(["system", "providers"]).optional()
 });
 var AddonProcessSchema = object({
 	pid: number().optional(),
@@ -90808,6 +90835,29 @@ function rewriteReferer(referer, route) {
 	if (upstream === void 0) return null;
 	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
 }
+function decodeFormComponent(raw) {
+	try {
+		return decodeURIComponent(raw.replace(/\+/g, " "));
+	} catch {
+		return null;
+	}
+}
+/**
+* An `application/x-www-form-urlencoded` body whose field VALUES that are proxy URLs of
+* this attempt (absolute or root-relative) are turned back into the vendor URL they stand
+* for — the page's hidden inputs were rewritten on the way out (`rewriteBody`), and the
+* vendor must get its own URL back. Field order and every untouched pair stay byte-identical.
+*/
+function rewriteFormBody(body, route) {
+	return body.split("&").map((pair) => {
+		const eq = pair.indexOf("=");
+		if (eq === -1) return pair;
+		const value = decodeFormComponent(pair.slice(eq + 1));
+		if (value === null || !/^(?:https?:\/\/|\/)/i.test(value)) return pair;
+		const back = rewriteReferer(value, route);
+		return back === null ? pair : `${pair.slice(0, eq + 1)}${encodeURIComponent(back)}`;
+	}).join("&");
+}
 /** Cookies the browser holds for the hub itself must never reach a vendor. */
 function filterForwardedCookies(cookieHeader) {
 	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
@@ -90866,6 +90916,9 @@ function bodyKindOf(contentType) {
 	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
 	return null;
 }
+function isFormEncoded(contentType) {
+	return (firstHeader(contentType) ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded");
+}
 function firstHeader(value) {
 	return Array.isArray(value) ? value[0] : value;
 }
@@ -90996,7 +91049,7 @@ var VendorLoginProxy = class {
 				sendPlain(res, 413, "Request too large");
 				return;
 			}
-			body = read;
+			body = isFormEncoded(req.headers["content-type"]) ? Buffer.from(rewriteFormBody(read.toString("utf8"), route), "utf8") : read;
 		}
 		const headers = this.#requestHeaders(req, route, upstream);
 		const upstreamRes = await this.#fetch(target, {
@@ -91010,9 +91063,10 @@ var VendorLoginProxy = class {
 		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
 		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
 		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
-		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+		this.#logger.info("vendor login proxy: upstream answered", { meta: {
 			addonId: this.#addonId,
 			host: upstream.host,
+			path: target.pathname,
 			status: upstreamRes.status,
 			method
 		} });
@@ -91145,59 +91199,37 @@ var AlexaBrokerEntrySchema = object({
 */
 var alexaProxyLoginSchema = object({ proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Loopback port the local Amazon-login proxy listens on (never exposed)") });
 /**
-* Echo speech settings. Speech signs in as an import broker, so the targets
-* are what lives here. `email`, `password`, `region` and `session` are the OLD
-* standalone login: they are read once to migrate it onto the single broker
-* (see `speak/migration.ts`) and written back empty.
-*/
-var alexaSpeakSettingsSchema = object({
-	email: string().default(""),
-	password: string().default("").describe("Legacy Amazon password").meta({ secret: true }),
-	region: _enum([
-		"NA",
-		"EU",
-		"FE"
-	]).default("EU"),
-	session: string().default("").describe("Legacy Alexa session blob").meta({ secret: true }),
-	targets: array(object({
-		id: string(),
-		name: string(),
-		enabled: boolean(),
-		/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
-		brokerId: string().default(""),
-		echoId: string(),
-		mode: _enum(["speak", "announce"]),
-		volume: number(),
-		respectDnd: boolean()
-	})).default([])
+* The Echo notification targets this addon owns. Speech signs in as an import
+* broker, so a target is only the Echo it speaks on and how.
+*/
+var alexaEchoTargetSchema = object({
+	id: string(),
+	name: string(),
+	enabled: boolean(),
+	/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
+	brokerId: string().default(""),
+	echoId: string(),
+	mode: _enum(["speak", "announce"]),
+	volume: number(),
+	respectDnd: boolean()
 });
 function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
-function readSpeakSettings(config) {
-	const raw = isRecord$3(config.speak) ? config.speak : {};
-	const region = raw["region"];
-	const targets = raw["targets"];
-	return alexaSpeakSettingsSchema.parse({
-		email: typeof raw["email"] === "string" ? raw["email"] : "",
-		password: typeof raw["password"] === "string" ? raw["password"] : "",
-		session: typeof raw["session"] === "string" ? raw["session"] : "",
-		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
-		...Array.isArray(targets) ? { targets } : {}
+/** The stored Echo targets; a row that no longer parses is dropped, never guessed. */
+function readEchoTargets(config) {
+	const raw = config.echoTargets;
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((row) => {
+		const parsed = alexaEchoTargetSchema.safeParse(isRecord$3(row) ? row : {});
+		return parsed.success ? [parsed.data] : [];
 	});
 }
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({ proxyPort: 3456 }),
-	speak: alexaSpeakSettingsSchema.default({
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	})
+	echoTargets: array(alexaEchoTargetSchema).default([])
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
 function toRecord(value) {
@@ -132744,6 +132776,67 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 	readmeFilename: "readme.md"
 }.version}`;
 //#endregion
+//#region src/alexa-region-options.ts
+var DEFAULT_LOCALE = "en-US";
+var LOCALE_BY_DOMAIN = {
+	"amazon.com": "en-US",
+	"amazon.it": "it-IT",
+	"amazon.de": "de-DE",
+	"amazon.co.uk": "en-GB",
+	"amazon.fr": "fr-FR",
+	"amazon.es": "es-ES",
+	"amazon.ca": "en-CA",
+	"amazon.com.au": "en-AU",
+	"amazon.co.jp": "ja-JP",
+	"amazon.in": "en-IN",
+	"amazon.com.br": "pt-BR",
+	"amazon.com.mx": "es-MX"
+};
+function alexaRegionOptions(amazonDomain) {
+	const domain = amazonDomain.length > 0 ? amazonDomain : "amazon.com";
+	const locale = LOCALE_BY_DOMAIN[domain] ?? DEFAULT_LOCALE;
+	return {
+		baseAmazonPage: domain,
+		amazonPage: domain,
+		acceptLanguage: locale,
+		amazonPageProxyLanguage: locale.replace("-", "_")
+	};
+}
+//#endregion
+//#region src/alexa-proxy-trace.ts
+/**
+* Sanitised one-line trace of the alexa-cookie2 proxy's own log lines.
+*
+* alexa-cookie2 logs every step it takes (routing, upstream request, redirect),
+* but its lines also carry headers, cookies and query values. This keeps only
+* what diagnoses a failed login: the method, the path or upstream host, and the
+* redirect target — always WITHOUT a query string or fragment. Any line that is
+* not one of the known step lines yields `null` and is never traced.
+*/
+var ROUTER_RE = /^Router: (\S+) \/ ([A-Z]+) \//;
+var PROXY_REQUEST_RE = /^Alexa-Cookie: Proxy-Request: ([A-Z]+) (\S+)$/;
+var PROXY_RESPONSE_RE = /^Alexa-Cookie: Proxy Response from Host: (\S+)$/;
+var REDIRECT_ORIGINAL_RE = /^Redirect: Original Location ----> (\S+)$/;
+var REDIRECT_FINAL_RE = /^Redirect: Final Location ----> (\S+)$/;
+/** Cut a URL or path at its query string or fragment. */
+function stripQuery(target) {
+	const cut = target.search(/[?#]/);
+	return cut === -1 ? target : target.slice(0, cut);
+}
+function sanitizeProxyTraceLine(line) {
+	const router = ROUTER_RE.exec(line);
+	if (router !== null) return `router ${router[2]} ${stripQuery(router[1] ?? "")}`;
+	const request = PROXY_REQUEST_RE.exec(line);
+	if (request !== null) return `proxy-request ${request[1]} ${stripQuery(request[2] ?? "")}`;
+	const response = PROXY_RESPONSE_RE.exec(line);
+	if (response !== null) return `proxy-response host=${response[1]}`;
+	const original = REDIRECT_ORIGINAL_RE.exec(line);
+	if (original !== null) return `redirect-original ${stripQuery(original[1] ?? "")}`;
+	const final = REDIRECT_FINAL_RE.exec(line);
+	if (final !== null) return `redirect-final ${stripQuery(final[1] ?? "")}`;
+	return null;
+}
+//#endregion
 //#region src/alexa-proxy-login.ts
 /**
 * INTERACTIVE Amazon login via `alexa-remote2`'s built-in proxy auth mode, behind the
@@ -132842,7 +132935,7 @@ var AlexaProxyLoginSession = class {
 	async start() {
 		const remote = new import_alexa_remote.default();
 		this.#remote = remote;
-		const amazonPage = this.#opts.amazonDomain.length > 0 ? this.#opts.amazonDomain : "amazon.com";
+		const region = alexaRegionOptions(this.#opts.amazonDomain);
 		remote.on("cookie", () => this.#onCookieEvent(remote));
 		remote.init({
 			proxyOnly: true,
@@ -132850,10 +132943,15 @@ var AlexaProxyLoginSession = class {
 			proxyListenBind: ALEXA_PROXY_LOOPBACK_HOST,
 			proxyPort: this.#opts.proxyPort,
 			proxyLogLevel: "warn",
-			amazonPage,
+			...region,
 			apiUserAgentPostfix: ALEXA_API_USER_AGENT_POSTFIX,
 			logger: (...args) => {
 				const line = args.map(String).join(" ");
+				const trace = sanitizeProxyTraceLine(line);
+				if (trace !== null) {
+					this.#logger.info(`alexa proxy-login: ${trace}`, { meta: { sessionId: this.#opts.sessionId } });
+					return;
+				}
 				if (SECRET_LINE_RE.test(line)) return;
 				this.#logger.debug("alexa proxy-login", { meta: {
 					sessionId: this.#opts.sessionId,
@@ -132915,7 +133013,10 @@ var AlexaProxyLoginSession = class {
 		if (isProxyReadyError(err)) {
 			if (this.#phase === "starting") {
 				this.#phase = "awaiting-login";
-				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: { sessionId: this.#opts.sessionId } });
+				this.#logger.info("alexa proxy-login: proxy ready — awaiting Amazon login", { meta: {
+					sessionId: this.#opts.sessionId,
+					amazonDomain: this.#opts.amazonDomain
+				} });
 			}
 			return;
 		}
@@ -135108,126 +135209,6 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
-//#region src/speak/constants.ts
-/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
-var ALEXA_SPEAK_ADDON_ID = "import-alexa";
-var ALEXA_SPEAK_KIND = "alexa-echo";
-var DEVICE_REFRESH_MS = 5 * 6e4;
-/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
-var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
-//#endregion
-//#region src/speak/worker-protocol.ts
-/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
-var EchoDeviceSchema = object({
-	id: string().min(1),
-	name: string(),
-	family: string(),
-	online: boolean(),
-	kind: _enum(["device", "group"]),
-	dnd: boolean(),
-	deviceType: string(),
-	/** The room the account files the device under, when Amazon names one. */
-	room: string().optional()
-});
-var LoginStatusSchema = _enum(["ok", "failed"]);
-var SessionStatusSchema = object({
-	loggedIn: boolean(),
-	ageSec: number().int().nonnegative(),
-	lastSuccessAt: number().int().nullable()
-});
-var TargetDeliverySchema = object({
-	targetId: string(),
-	ok: boolean(),
-	error: string().optional()
-});
-var WorkerLineSchema = union([object({
-	id: string(),
-	ok: literal(true),
-	result: unknown().optional()
-}), object({
-	id: string(),
-	ok: literal(false),
-	error: string()
-})]);
-function requestLine(id, request) {
-	return `${JSON.stringify({
-		id,
-		...request
-	})}\n`;
-}
-function parseLoginResult(result) {
-	const parsed = object({
-		status: LoginStatusSchema,
-		error: string().optional()
-	}).safeParse(result);
-	if (!parsed.success) return {
-		status: "failed",
-		error: "worker returned an unexpected login result"
-	};
-	return parsed.data;
-}
-function parseDevices(result) {
-	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected device list");
-	return parsed.data.devices;
-}
-function parseDeliveries(result) {
-	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
-	return parsed.data.outcomes;
-}
-function parseSessionStatus(result) {
-	const parsed = SessionStatusSchema.safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected session status");
-	return parsed.data;
-}
-//#endregion
-//#region src/speak/actions.ts
-var BrokerEchoStateSchema = _enum([
-	"starting",
-	"ready",
-	"broker-not-signed-in",
-	"failed"
-]);
-var SpeakStatusSchema = object({
-	brokers: array(object({
-		id: string(),
-		name: string(),
-		state: BrokerEchoStateSchema,
-		error: string().optional(),
-		devices: array(EchoDeviceSchema),
-		session: SessionStatusSchema
-	})),
-	/** Targets that name no Amazon account yet (they cannot speak until one is chosen). */
-	unassignedTargets: number().int().nonnegative(),
-	/** What the old standalone login left behind, named; '' when nothing is pending. */
-	notice: _enum([
-		"",
-		"no-broker",
-		"choose-broker"
-	])
-});
-var alexaSpeakActions = defineCustomActions({
-	speakStatus: customAction(object({}), SpeakStatusSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	sendTest: customAction(object({
-		brokerId: string().min(1),
-		echoIds: array(string().min(1)).min(1),
-		mode: _enum(["speak", "announce"]),
-		volume: number().int().min(0).max(100),
-		text: string().min(1).max(450)
-	}), object({ outcomes: array(object({
-		echoId: string(),
-		ok: boolean(),
-		error: string().optional()
-	})) }), {
-		kind: "mutation",
-		auth: "admin"
-	})
-});
-//#endregion
 //#region src/speak/broker-seed.ts
 /**
 * What the Echo worker needs from an import broker to act as the same Amazon
@@ -135462,6 +135443,72 @@ function scrubSecrets(text, secrets) {
 	return out;
 }
 //#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string(),
+	/** The room the account files the device under, when Amazon names one. */
+	room: string().optional()
+});
+var LoginStatusSchema = _enum(["ok", "failed"]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
 //#region src/speak/broker-echo.ts
 var BrokerEcho = class {
 	deps;
@@ -135590,40 +135637,13 @@ var BrokerEcho = class {
 	}
 };
 //#endregion
-//#region src/speak/migration.ts
-function legacyLoginOf(settings) {
-	return {
-		email: settings.email,
-		password: settings.password,
-		session: settings.session
-	};
-}
-function planLegacyMigration(legacy, brokerIds, targets) {
-	const present = legacy.email.length > 0 || legacy.password.length > 0 || legacy.session.length > 0;
-	const only = brokerIds.length === 1 ? brokerIds[0] ?? null : null;
-	if (!present || only === null) return {
-		present,
-		attachTo: null,
-		targets
-	};
-	return {
-		present,
-		attachTo: legacy.session.length > 0 ? only : null,
-		targets: targets.map((row) => row.brokerId.length > 0 ? row : {
-			...row,
-			brokerId: only
-		})
-	};
-}
-/** What the page must tell the operator about targets that name no account. */
-function noticeFor(targets, brokerIds) {
-	if (!targets.some((row) => row.brokerId.length === 0)) return "";
-	if (brokerIds.length === 0) return "no-broker";
-	return brokerIds.length > 1 ? "choose-broker" : "";
-}
-function unassignedCount(targets) {
-	return targets.filter((row) => row.brokerId.length === 0).length;
-}
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
 //#endregion
 //#region src/speak/rate-limit.ts
 /**
@@ -135728,14 +135748,42 @@ function readString(config, key) {
 	const value = config[key];
 	return typeof value === "string" ? value : "";
 }
-function readMode(config) {
-	return config["mode"] === "announce" ? "announce" : "speak";
+/** The rule's value for this send wins; the target's saved config is the fallback. */
+function readMode(config, delivery) {
+	return (delivery?.["mode"] ?? config["mode"]) === "announce" ? "announce" : "speak";
 }
-function readVolume(config) {
-	const value = config["volume"];
+function readVolume(config, delivery) {
+	const ruled = delivery?.["volume"];
+	const value = typeof ruled === "number" ? ruled : config["volume"];
 	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
 	return Math.max(0, Math.min(100, Math.round(value)));
 }
+/**
+* The delivery parameters a rule may set for an Echo target (D938). The
+* target's own config holds the default; these override it per notification.
+*/
+var DELIVERY_PARAMS = [{
+	key: "mode",
+	label: "Mode",
+	labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+	type: "enum",
+	options: [{
+		value: "speak",
+		label: "Speak (quiet hours apply)"
+	}, {
+		value: "announce",
+		label: "Announce (chime, then speech)"
+	}],
+	default: "speak"
+}, {
+	key: "volume",
+	label: "Volume",
+	labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+	type: "number",
+	min: 0,
+	max: 100,
+	default: 40
+}];
 function respectDnd(config) {
 	return config["respectDnd"] !== false;
 }
@@ -135836,6 +135884,7 @@ function alexaTargetKind(brokers) {
 		supportsDiscovery: true,
 		destinationKeys: ["brokerId", "echoId"],
 		configSchema: configSchema(brokers),
+		deliveryParams: DELIVERY_PARAMS,
 		caps: {
 			attachments: {
 				mediaTypes: [],
@@ -136018,14 +136067,14 @@ function createAlexaNotificationProvider(ports) {
 				renderedAs: speech.renderedAs
 			};
 		}
-		const mode = readMode(target.config);
+		const mode = readMode(target.config, notification.delivery);
 		try {
 			const outcomes = await ports.speak({
 				brokerId: broker.id,
 				mode,
 				targets: [echoId],
 				text: speech.text,
-				volume: readVolume(target.config)
+				volume: readVolume(target.config, notification.delivery)
 			});
 			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
 			if (one === void 0 || !one.ok) {
@@ -136425,8 +136474,8 @@ function startAlexaWorker(deps) {
 }
 //#endregion
 //#region src/speak/controller.ts
-function targetsFrom(settings) {
-	return settings.targets.map((row) => ({
+function targetsFrom(rows) {
+	return rows.map((row) => ({
 		id: row.id,
 		name: row.name,
 		kind: ALEXA_SPEAK_KIND,
@@ -136456,7 +136505,7 @@ function rowsFrom(targets) {
 var AlexaSpeakController = class {
 	host;
 	provider;
-	settings;
+	rows;
 	pythonPath = null;
 	echoes = /* @__PURE__ */ new Map();
 	timer = null;
@@ -136465,17 +136514,14 @@ var AlexaSpeakController = class {
 	constructor(host) {
 		this.host = host;
 		this.now = host.now ?? (() => Date.now());
-		this.settings = readSpeakSettings(host.readConfig());
+		this.rows = readEchoTargets(host.readConfig());
 		this.provider = createAlexaNotificationProvider({
 			brokers: () => this.brokerViews(),
 			now: this.now,
 			logger: host.logger,
-			loadTargets: () => targetsFrom(this.settings),
+			loadTargets: () => targetsFrom(this.rows),
 			saveTargets: (targets) => {
-				this.settings = {
-					...this.settings,
-					targets: [...rowsFrom(targets)]
-				};
+				this.rows = rowsFrom(targets);
 				this.persist();
 			},
 			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text, command.volume)
@@ -136487,7 +136533,6 @@ var AlexaSpeakController = class {
 			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
 			return;
 		}
-		await this.migrateLegacyLogin();
 		await this.brokersChanged();
 		this.timer = setInterval(() => {
 			this.refreshAll();
@@ -136504,12 +136549,6 @@ var AlexaSpeakController = class {
 		this.queue = this.queue.then(() => this.reconcile()).catch(() => void 0);
 		return this.queue;
 	}
-	handlers() {
-		return {
-			speakStatus: async () => this.status(),
-			sendTest: async (input) => this.sendTest(input)
-		};
-	}
 	brokerViews() {
 		return this.host.listBrokers().map((ref) => {
 			const echo = this.echoes.get(ref.id);
@@ -136523,36 +136562,11 @@ var AlexaSpeakController = class {
 	}
 	async persist() {
 		try {
-			await this.host.writeSpeak(this.settings);
+			await this.host.writeTargets(this.rows);
 		} catch (err) {
-			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			this.host.logger.warn("alexa speak: could not store targets", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	/**
-	* Drain the old standalone login once. With exactly one broker its jar and
-	* its targets move onto that broker; otherwise the jar is dropped and the
-	* targets wait for the operator to choose (the status names that state).
-	*/
-	async migrateLegacyLogin() {
-		const brokers = this.host.listBrokers();
-		const plan = planLegacyMigration(legacyLoginOf(this.settings), brokers.map((ref) => ref.id), this.settings.targets);
-		if (!plan.present) return;
-		if (plan.attachTo !== null) await this.host.sessions.put(plan.attachTo, this.settings.session);
-		this.settings = {
-			...this.settings,
-			email: "",
-			password: "",
-			session: "",
-			targets: [...plan.targets]
-		};
-		await this.persist();
-		await this.host.clearLegacySecrets();
-		this.host.logger.info("alexa speak: the old standalone login was retired", { meta: {
-			attachedTo: plan.attachTo ?? "none",
-			brokers: brokers.length,
-			targets: plan.targets.length
-		} });
-	}
 	makeWorker(brokerId, pythonPath) {
 		if (this.host.startWorker !== void 0) return this.host.startWorker(brokerId, pythonPath);
 		return startAlexaWorker({
@@ -136602,59 +136616,6 @@ var AlexaSpeakController = class {
 		if (echo === void 0) throw new Error("no Echo session for this Amazon account");
 		return echo.utter(mode === "announce" ? "announce" : "speak", targets, text, volume);
 	}
-	async status() {
-		const brokers = this.host.listBrokers();
-		const rows = await Promise.all(brokers.map(async (ref) => {
-			const echo = this.echoes.get(ref.id);
-			return {
-				id: ref.id,
-				name: ref.name,
-				state: echo?.state ?? "failed",
-				...echo === void 0 ? { error: "embedded Python unavailable" } : echo.error === null ? {} : { error: echo.error },
-				devices: [...echo?.devices ?? []],
-				session: echo === void 0 ? {
-					loggedIn: false,
-					ageSec: 0,
-					lastSuccessAt: null
-				} : await echo.session()
-			};
-		}));
-		const targets = this.settings.targets;
-		const ids = brokers.map((ref) => ref.id);
-		return {
-			brokers: rows,
-			unassignedTargets: unassignedCount(targets),
-			notice: noticeFor(targets, ids)
-		};
-	}
-	async sendTest(input) {
-		const outcomes = await this.utter(input.brokerId, input.mode, input.echoIds, input.text, input.volume);
-		const known = new Map((this.echoes.get(input.brokerId)?.devices ?? []).map((device) => [device.id, device]));
-		const next = [...this.settings.targets];
-		for (const echoId of input.echoIds) {
-			if (next.some((row) => row.echoId === echoId && row.brokerId === input.brokerId)) continue;
-			next.push({
-				id: `echo-${input.brokerId}-${echoId}`,
-				name: known.get(echoId)?.name ?? echoId,
-				enabled: true,
-				brokerId: input.brokerId,
-				echoId,
-				mode: input.mode,
-				volume: input.volume,
-				respectDnd: true
-			});
-		}
-		this.settings = {
-			...this.settings,
-			targets: next
-		};
-		await this.persist();
-		return { outcomes: outcomes.map((row) => ({
-			echoId: row.targetId,
-			ok: row.ok,
-			...row.error !== void 0 ? { error: row.error } : {}
-		})) };
-	}
 };
 //#endregion
 //#region src/speak/icon-routes.ts
@@ -136707,26 +136668,11 @@ var RecordsSpeakSessionStore = class RecordsSpeakSessionStore {
 };
 //#endregion
 //#region src/addon.ts
-var SPEAK_PAGE = {
-	id: "speak",
-	label: "Speak on Echo",
-	icon: "megaphone",
-	path: "/addon/import-alexa",
-	remoteName: "addon_import_alexa_page",
-	bundle: "remoteEntry.js",
-	section: "administration"
-};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: { proxyPort: 3456 },
-	speak: {
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	}
+	echoTargets: []
 };
 /** Device types an imported Alexa appliance can materialise as. */
 var ALEXA_DEVICE_TYPES = [
@@ -136770,7 +136716,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	brokerStore = null;
 	activeBrokers = [];
 	speak = null;
-	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -136825,8 +136770,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,
-			writeSpeak: async (next) => {
-				await this.updateGlobalSettings({ speak: next });
+			writeTargets: async (next) => {
+				await this.updateGlobalSettings({ echoTargets: [...next] });
 			},
 			listBrokers: () => this.activeBrokers.map((entry) => ({
 				id: entry.id,
@@ -136838,50 +136783,31 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				return entry === void 0 ? null : readBrokerSeed(this.ctx.dataDir, entry);
 			},
 			sessions: RecordsSpeakSessionStore.of(records),
-			clearLegacySecrets: async () => {
-				await this.updateGlobalSettingsAsOperator({ speak: {
-					...this.config.speak,
-					password: SECRET_CLEAR,
-					session: SECRET_CLEAR
-				} });
-			},
 			ensurePython: () => this.ctx.deps.ensurePython()
 		});
 		this.speak = speak;
 		speak.start().catch((err) => {
 			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
-		const pages = {
-			id: this.addonId,
-			listPages: () => [SPEAK_PAGE]
-		};
-		return {
-			providers: [
-				...regs,
-				{
-					capability: brokerCapability,
-					provider: this.buildBrokerProvider()
-				},
-				{
-					capability: deviceAdoptionCapability,
-					provider: this.buildAdoptionProvider()
-				},
-				{
-					capability: addonRoutesCapability,
-					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-				},
-				{
-					capability: notificationOutputCapability,
-					provider: speak.provider
-				},
-				{
-					capability: addonPagesSourceCapability,
-					provider: pages
-				}
-			],
-			customActions: alexaSpeakActions,
-			actionHandlers: speak.handlers()
-		};
+		return { providers: [
+			...regs,
+			{
+				capability: brokerCapability,
+				provider: this.buildBrokerProvider()
+			},
+			{
+				capability: deviceAdoptionCapability,
+				provider: this.buildAdoptionProvider()
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+			},
+			{
+				capability: notificationOutputCapability,
+				provider: speak.provider
+			}
+		] };
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -137265,4 +137191,4 @@ function capsEqual(a, b) {
 	return true;
 }
 //#endregion
-export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, alexaSpeakActions as customActions, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };
+export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };