@camstack/addon-import-alexa 0.2.163 → 0.2.165

package/dist/addon.js

@@ -8865,28 +8865,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-/**
-* Identity — preserves literal types for downstream inference.
-*
-* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
-* TypeScript does not widen each entry's literal `kind`/`auth` fields to
-* the broader unions declared on `CustomActionSpec`'s default generics.
-* Shape validity is enforced separately by the `customAction(...)` helper
-* whose return type is already a `CustomActionSpec<...>`.
-*/
-function defineCustomActions(spec) {
-	return spec;
-}
-function customAction(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
-		scope: options?.scope ?? { kind: "system" },
-		...options?.caller ? { caller: "required" } : {}
-	};
-}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -11231,7 +11209,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-CZImLpOI.mjs
+//#region ../types/dist/composition-DwA0uVW5.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -16476,24 +16454,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the `addon-pages-aggregator` builtin, reads it via
-	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
-	* only, never tRPC (per `ctx.capabilities` seeing only the local
-	* process). The public, enriched listing admin-ui actually consumes is
-	* the separate `addon-pages` cap, unaffected by this change.
-	*/
-listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
-};
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -19451,12 +19412,13 @@ var CHANGED = {
 	expr: "now"
 };
 function numeric(input) {
+	const { alsoFrom, ...base } = input;
 	return {
-		...input,
+		...base,
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
-		memberDeviceTypes: [DeviceType.Sensor],
+		memberDeviceTypes: [DeviceType.Sensor, ...alsoFrom?.deviceTypes ?? []],
 		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
@@ -19464,9 +19426,10 @@ function numeric(input) {
 		accept: [{
 			cap: input.outputCap,
 			fieldPath: input.outputField
-		}]
+		}, ...alsoFrom === void 0 ? [] : [alsoFrom.accept]]
 	};
 }
+var CLIMATE_DEVICES = [DeviceType.Thermostat, DeviceType.Climate];
 function binary(input) {
 	return {
 		...input,
@@ -19492,7 +19455,14 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentTemp"
+			}
+		}
 	}),
 	numeric({
 		id: "humidity",
@@ -19503,7 +19473,14 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentHumidity"
+			}
+		}
 	}),
 	numeric({
 		id: "pressure",
@@ -43930,6 +43907,17 @@ var LlmProfileSchema = object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: _enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -43968,6 +43956,7 @@ var LlmProfileFieldSchema = _enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -45218,6 +45207,43 @@ var NotificationActionSchema = object({
 	*/
 	mode: _enum(["navigate", "background"]).optional()
 });
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
 * `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
@@ -45240,7 +45266,13 @@ var NotificationSchema = object({
 	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
 });
 /** One declared native severity/priority level for a kind. */
 var TargetKindLevelSchema = object({
@@ -45346,6 +45378,11 @@ var TargetKindSchema = object({
 	*/
 	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
 	caps: TargetKindCapsSchema
 });
 /**
@@ -57659,7 +57696,9 @@ var ManifestShapeSchema = object({
 		icon: string().optional()
 	}).optional(),
 	protected: boolean().optional(),
-	removable: boolean().optional()
+	removable: boolean().optional(),
+	/** Declared Integrations-page block (mirror of `AddonDeclaration.integrationSection`). */
+	integrationSection: _enum(["system", "providers"]).optional()
 });
 var AddonProcessSchema = object({
 	pid: number().optional(),
@@ -90791,6 +90830,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -90809,6 +90871,29 @@ function rewriteReferer(referer, route) {
 	if (upstream === void 0) return null;
 	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
 }
+function decodeFormComponent(raw) {
+	try {
+		return decodeURIComponent(raw.replace(/\+/g, " "));
+	} catch {
+		return null;
+	}
+}
+/**
+* An `application/x-www-form-urlencoded` body whose field VALUES that are proxy URLs of
+* this attempt (absolute or root-relative) are turned back into the vendor URL they stand
+* for — the page's hidden inputs were rewritten on the way out (`rewriteBody`), and the
+* vendor must get its own URL back. Field order and every untouched pair stay byte-identical.
+*/
+function rewriteFormBody(body, route) {
+	return body.split("&").map((pair) => {
+		const eq = pair.indexOf("=");
+		if (eq === -1) return pair;
+		const value = decodeFormComponent(pair.slice(eq + 1));
+		if (value === null || !/^(?:https?:\/\/|\/)/i.test(value)) return pair;
+		const back = rewriteReferer(value, route);
+		return back === null ? pair : `${pair.slice(0, eq + 1)}${encodeURIComponent(back)}`;
+	}).join("&");
+}
 /** Cookies the browser holds for the hub itself must never reach a vendor. */
 function filterForwardedCookies(cookieHeader) {
 	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
@@ -90867,6 +90952,9 @@ function bodyKindOf(contentType) {
 	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
 	return null;
 }
+function isFormEncoded(contentType) {
+	return (firstHeader(contentType) ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded");
+}
 function firstHeader(value) {
 	return Array.isArray(value) ? value[0] : value;
 }
@@ -90881,6 +90969,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -90997,7 +91105,7 @@ var VendorLoginProxy = class {
 				sendPlain(res, 413, "Request too large");
 				return;
 			}
-			body = read;
+			body = isFormEncoded(req.headers["content-type"]) ? Buffer.from(rewriteFormBody(read.toString("utf8"), route), "utf8") : read;
 		}
 		const headers = this.#requestHeaders(req, route, upstream);
 		const upstreamRes = await this.#fetch(target, {
@@ -91011,11 +91119,16 @@ var VendorLoginProxy = class {
 		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
 		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
 		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
-		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+		this.#logger.info("vendor login proxy: upstream answered", { meta: {
 			addonId: this.#addonId,
 			host: upstream.host,
+			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -91037,7 +91150,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {
@@ -91146,59 +91259,37 @@ var AlexaBrokerEntrySchema = object({
 */
 var alexaProxyLoginSchema = object({ proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Loopback port the local Amazon-login proxy listens on (never exposed)") });
 /**
-* Echo speech settings. Speech signs in as an import broker, so the targets
-* are what lives here. `email`, `password`, `region` and `session` are the OLD
-* standalone login: they are read once to migrate it onto the single broker
-* (see `speak/migration.ts`) and written back empty.
-*/
-var alexaSpeakSettingsSchema = object({
-	email: string().default(""),
-	password: string().default("").describe("Legacy Amazon password").meta({ secret: true }),
-	region: _enum([
-		"NA",
-		"EU",
-		"FE"
-	]).default("EU"),
-	session: string().default("").describe("Legacy Alexa session blob").meta({ secret: true }),
-	targets: array(object({
-		id: string(),
-		name: string(),
-		enabled: boolean(),
-		/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
-		brokerId: string().default(""),
-		echoId: string(),
-		mode: _enum(["speak", "announce"]),
-		volume: number(),
-		respectDnd: boolean()
-	})).default([])
+* The Echo notification targets this addon owns. Speech signs in as an import
+* broker, so a target is only the Echo it speaks on and how.
+*/
+var alexaEchoTargetSchema = object({
+	id: string(),
+	name: string(),
+	enabled: boolean(),
+	/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
+	brokerId: string().default(""),
+	echoId: string(),
+	mode: _enum(["speak", "announce"]),
+	volume: number(),
+	respectDnd: boolean()
 });
 function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
-function readSpeakSettings(config) {
-	const raw = isRecord$3(config.speak) ? config.speak : {};
-	const region = raw["region"];
-	const targets = raw["targets"];
-	return alexaSpeakSettingsSchema.parse({
-		email: typeof raw["email"] === "string" ? raw["email"] : "",
-		password: typeof raw["password"] === "string" ? raw["password"] : "",
-		session: typeof raw["session"] === "string" ? raw["session"] : "",
-		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
-		...Array.isArray(targets) ? { targets } : {}
+/** The stored Echo targets; a row that no longer parses is dropped, never guessed. */
+function readEchoTargets(config) {
+	const raw = config.echoTargets;
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((row) => {
+		const parsed = alexaEchoTargetSchema.safeParse(isRecord$3(row) ? row : {});
+		return parsed.success ? [parsed.data] : [];
 	});
 }
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({ proxyPort: 3456 }),
-	speak: alexaSpeakSettingsSchema.default({
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	})
+	echoTargets: array(alexaEchoTargetSchema).default([])
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
 function toRecord(value) {
@@ -132745,6 +132836,33 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 	readmeFilename: "readme.md"
 }.version}`;
 //#endregion
+//#region src/alexa-region-options.ts
+var DEFAULT_LOCALE = "en-US";
+var LOCALE_BY_DOMAIN = {
+	"amazon.com": "en-US",
+	"amazon.it": "it-IT",
+	"amazon.de": "de-DE",
+	"amazon.co.uk": "en-GB",
+	"amazon.fr": "fr-FR",
+	"amazon.es": "es-ES",
+	"amazon.ca": "en-CA",
+	"amazon.com.au": "en-AU",
+	"amazon.co.jp": "ja-JP",
+	"amazon.in": "en-IN",
+	"amazon.com.br": "pt-BR",
+	"amazon.com.mx": "es-MX"
+};
+function alexaRegionOptions(amazonDomain) {
+	const domain = amazonDomain.length > 0 ? amazonDomain : "amazon.com";
+	const locale = LOCALE_BY_DOMAIN[domain] ?? DEFAULT_LOCALE;
+	return {
+		baseAmazonPage: domain,
+		amazonPage: domain,
+		acceptLanguage: locale,
+		amazonPageProxyLanguage: locale.replace("-", "_")
+	};
+}
+//#endregion
 //#region src/alexa-proxy-trace.ts
 /**
 * Sanitised one-line trace of the alexa-cookie2 proxy's own log lines.
@@ -132877,7 +132995,7 @@ var AlexaProxyLoginSession = class {
 	async start() {
 		const remote = new import_alexa_remote.default();
 		this.#remote = remote;
-		const amazonPage = this.#opts.amazonDomain.length > 0 ? this.#opts.amazonDomain : "amazon.com";
+		const region = alexaRegionOptions(this.#opts.amazonDomain);
 		remote.on("cookie", () => this.#onCookieEvent(remote));
 		remote.init({
 			proxyOnly: true,
@@ -132885,7 +133003,7 @@ var AlexaProxyLoginSession = class {
 			proxyListenBind: ALEXA_PROXY_LOOPBACK_HOST,
 			proxyPort: this.#opts.proxyPort,
 			proxyLogLevel: "warn",
-			amazonPage,
+			...region,
 			apiUserAgentPostfix: ALEXA_API_USER_AGENT_POSTFIX,
 			logger: (...args) => {
 				const line = args.map(String).join(" ");
@@ -135151,126 +135269,6 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
-//#region src/speak/constants.ts
-/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
-var ALEXA_SPEAK_ADDON_ID = "import-alexa";
-var ALEXA_SPEAK_KIND = "alexa-echo";
-var DEVICE_REFRESH_MS = 5 * 6e4;
-/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
-var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
-//#endregion
-//#region src/speak/worker-protocol.ts
-/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
-var EchoDeviceSchema = object({
-	id: string().min(1),
-	name: string(),
-	family: string(),
-	online: boolean(),
-	kind: _enum(["device", "group"]),
-	dnd: boolean(),
-	deviceType: string(),
-	/** The room the account files the device under, when Amazon names one. */
-	room: string().optional()
-});
-var LoginStatusSchema = _enum(["ok", "failed"]);
-var SessionStatusSchema = object({
-	loggedIn: boolean(),
-	ageSec: number().int().nonnegative(),
-	lastSuccessAt: number().int().nullable()
-});
-var TargetDeliverySchema = object({
-	targetId: string(),
-	ok: boolean(),
-	error: string().optional()
-});
-var WorkerLineSchema = union([object({
-	id: string(),
-	ok: literal(true),
-	result: unknown().optional()
-}), object({
-	id: string(),
-	ok: literal(false),
-	error: string()
-})]);
-function requestLine(id, request) {
-	return `${JSON.stringify({
-		id,
-		...request
-	})}\n`;
-}
-function parseLoginResult(result) {
-	const parsed = object({
-		status: LoginStatusSchema,
-		error: string().optional()
-	}).safeParse(result);
-	if (!parsed.success) return {
-		status: "failed",
-		error: "worker returned an unexpected login result"
-	};
-	return parsed.data;
-}
-function parseDevices(result) {
-	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected device list");
-	return parsed.data.devices;
-}
-function parseDeliveries(result) {
-	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
-	return parsed.data.outcomes;
-}
-function parseSessionStatus(result) {
-	const parsed = SessionStatusSchema.safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected session status");
-	return parsed.data;
-}
-//#endregion
-//#region src/speak/actions.ts
-var BrokerEchoStateSchema = _enum([
-	"starting",
-	"ready",
-	"broker-not-signed-in",
-	"failed"
-]);
-var SpeakStatusSchema = object({
-	brokers: array(object({
-		id: string(),
-		name: string(),
-		state: BrokerEchoStateSchema,
-		error: string().optional(),
-		devices: array(EchoDeviceSchema),
-		session: SessionStatusSchema
-	})),
-	/** Targets that name no Amazon account yet (they cannot speak until one is chosen). */
-	unassignedTargets: number().int().nonnegative(),
-	/** What the old standalone login left behind, named; '' when nothing is pending. */
-	notice: _enum([
-		"",
-		"no-broker",
-		"choose-broker"
-	])
-});
-var alexaSpeakActions = defineCustomActions({
-	speakStatus: customAction(object({}), SpeakStatusSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	sendTest: customAction(object({
-		brokerId: string().min(1),
-		echoIds: array(string().min(1)).min(1),
-		mode: _enum(["speak", "announce"]),
-		volume: number().int().min(0).max(100),
-		text: string().min(1).max(450)
-	}), object({ outcomes: array(object({
-		echoId: string(),
-		ok: boolean(),
-		error: string().optional()
-	})) }), {
-		kind: "mutation",
-		auth: "admin"
-	})
-});
-//#endregion
 //#region src/speak/broker-seed.ts
 /**
 * What the Echo worker needs from an import broker to act as the same Amazon
@@ -135505,6 +135503,72 @@ function scrubSecrets(text, secrets) {
 	return out;
 }
 //#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string(),
+	/** The room the account files the device under, when Amazon names one. */
+	room: string().optional()
+});
+var LoginStatusSchema = _enum(["ok", "failed"]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
 //#region src/speak/broker-echo.ts
 var BrokerEcho = class {
 	deps;
@@ -135633,40 +135697,13 @@ var BrokerEcho = class {
 	}
 };
 //#endregion
-//#region src/speak/migration.ts
-function legacyLoginOf(settings) {
-	return {
-		email: settings.email,
-		password: settings.password,
-		session: settings.session
-	};
-}
-function planLegacyMigration(legacy, brokerIds, targets) {
-	const present = legacy.email.length > 0 || legacy.password.length > 0 || legacy.session.length > 0;
-	const only = brokerIds.length === 1 ? brokerIds[0] ?? null : null;
-	if (!present || only === null) return {
-		present,
-		attachTo: null,
-		targets
-	};
-	return {
-		present,
-		attachTo: legacy.session.length > 0 ? only : null,
-		targets: targets.map((row) => row.brokerId.length > 0 ? row : {
-			...row,
-			brokerId: only
-		})
-	};
-}
-/** What the page must tell the operator about targets that name no account. */
-function noticeFor(targets, brokerIds) {
-	if (!targets.some((row) => row.brokerId.length === 0)) return "";
-	if (brokerIds.length === 0) return "no-broker";
-	return brokerIds.length > 1 ? "choose-broker" : "";
-}
-function unassignedCount(targets) {
-	return targets.filter((row) => row.brokerId.length === 0).length;
-}
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
 //#endregion
 //#region src/speak/rate-limit.ts
 /**
@@ -135771,14 +135808,42 @@ function readString(config, key) {
 	const value = config[key];
 	return typeof value === "string" ? value : "";
 }
-function readMode(config) {
-	return config["mode"] === "announce" ? "announce" : "speak";
+/** The rule's value for this send wins; the target's saved config is the fallback. */
+function readMode(config, delivery) {
+	return (delivery?.["mode"] ?? config["mode"]) === "announce" ? "announce" : "speak";
 }
-function readVolume(config) {
-	const value = config["volume"];
+function readVolume(config, delivery) {
+	const ruled = delivery?.["volume"];
+	const value = typeof ruled === "number" ? ruled : config["volume"];
 	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
 	return Math.max(0, Math.min(100, Math.round(value)));
 }
+/**
+* The delivery parameters a rule may set for an Echo target (D938). The
+* target's own config holds the default; these override it per notification.
+*/
+var DELIVERY_PARAMS = [{
+	key: "mode",
+	label: "Mode",
+	labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+	type: "enum",
+	options: [{
+		value: "speak",
+		label: "Speak (quiet hours apply)"
+	}, {
+		value: "announce",
+		label: "Announce (chime, then speech)"
+	}],
+	default: "speak"
+}, {
+	key: "volume",
+	label: "Volume",
+	labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+	type: "number",
+	min: 0,
+	max: 100,
+	default: 40
+}];
 function respectDnd(config) {
 	return config["respectDnd"] !== false;
 }
@@ -135879,6 +135944,7 @@ function alexaTargetKind(brokers) {
 		supportsDiscovery: true,
 		destinationKeys: ["brokerId", "echoId"],
 		configSchema: configSchema(brokers),
+		deliveryParams: DELIVERY_PARAMS,
 		caps: {
 			attachments: {
 				mediaTypes: [],
@@ -136061,14 +136127,14 @@ function createAlexaNotificationProvider(ports) {
 				renderedAs: speech.renderedAs
 			};
 		}
-		const mode = readMode(target.config);
+		const mode = readMode(target.config, notification.delivery);
 		try {
 			const outcomes = await ports.speak({
 				brokerId: broker.id,
 				mode,
 				targets: [echoId],
 				text: speech.text,
-				volume: readVolume(target.config)
+				volume: readVolume(target.config, notification.delivery)
 			});
 			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
 			if (one === void 0 || !one.ok) {
@@ -136468,8 +136534,8 @@ function startAlexaWorker(deps) {
 }
 //#endregion
 //#region src/speak/controller.ts
-function targetsFrom(settings) {
-	return settings.targets.map((row) => ({
+function targetsFrom(rows) {
+	return rows.map((row) => ({
 		id: row.id,
 		name: row.name,
 		kind: ALEXA_SPEAK_KIND,
@@ -136499,7 +136565,7 @@ function rowsFrom(targets) {
 var AlexaSpeakController = class {
 	host;
 	provider;
-	settings;
+	rows;
 	pythonPath = null;
 	echoes = /* @__PURE__ */ new Map();
 	timer = null;
@@ -136508,17 +136574,14 @@ var AlexaSpeakController = class {
 	constructor(host) {
 		this.host = host;
 		this.now = host.now ?? (() => Date.now());
-		this.settings = readSpeakSettings(host.readConfig());
+		this.rows = readEchoTargets(host.readConfig());
 		this.provider = createAlexaNotificationProvider({
 			brokers: () => this.brokerViews(),
 			now: this.now,
 			logger: host.logger,
-			loadTargets: () => targetsFrom(this.settings),
+			loadTargets: () => targetsFrom(this.rows),
 			saveTargets: (targets) => {
-				this.settings = {
-					...this.settings,
-					targets: [...rowsFrom(targets)]
-				};
+				this.rows = rowsFrom(targets);
 				this.persist();
 			},
 			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text, command.volume)
@@ -136530,7 +136593,6 @@ var AlexaSpeakController = class {
 			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
 			return;
 		}
-		await this.migrateLegacyLogin();
 		await this.brokersChanged();
 		this.timer = setInterval(() => {
 			this.refreshAll();
@@ -136547,12 +136609,6 @@ var AlexaSpeakController = class {
 		this.queue = this.queue.then(() => this.reconcile()).catch(() => void 0);
 		return this.queue;
 	}
-	handlers() {
-		return {
-			speakStatus: async () => this.status(),
-			sendTest: async (input) => this.sendTest(input)
-		};
-	}
 	brokerViews() {
 		return this.host.listBrokers().map((ref) => {
 			const echo = this.echoes.get(ref.id);
@@ -136566,36 +136622,11 @@ var AlexaSpeakController = class {
 	}
 	async persist() {
 		try {
-			await this.host.writeSpeak(this.settings);
+			await this.host.writeTargets(this.rows);
 		} catch (err) {
-			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			this.host.logger.warn("alexa speak: could not store targets", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	/**
-	* Drain the old standalone login once. With exactly one broker its jar and
-	* its targets move onto that broker; otherwise the jar is dropped and the
-	* targets wait for the operator to choose (the status names that state).
-	*/
-	async migrateLegacyLogin() {
-		const brokers = this.host.listBrokers();
-		const plan = planLegacyMigration(legacyLoginOf(this.settings), brokers.map((ref) => ref.id), this.settings.targets);
-		if (!plan.present) return;
-		if (plan.attachTo !== null) await this.host.sessions.put(plan.attachTo, this.settings.session);
-		this.settings = {
-			...this.settings,
-			email: "",
-			password: "",
-			session: "",
-			targets: [...plan.targets]
-		};
-		await this.persist();
-		await this.host.clearLegacySecrets();
-		this.host.logger.info("alexa speak: the old standalone login was retired", { meta: {
-			attachedTo: plan.attachTo ?? "none",
-			brokers: brokers.length,
-			targets: plan.targets.length
-		} });
-	}
 	makeWorker(brokerId, pythonPath) {
 		if (this.host.startWorker !== void 0) return this.host.startWorker(brokerId, pythonPath);
 		return startAlexaWorker({
@@ -136645,59 +136676,6 @@ var AlexaSpeakController = class {
 		if (echo === void 0) throw new Error("no Echo session for this Amazon account");
 		return echo.utter(mode === "announce" ? "announce" : "speak", targets, text, volume);
 	}
-	async status() {
-		const brokers = this.host.listBrokers();
-		const rows = await Promise.all(brokers.map(async (ref) => {
-			const echo = this.echoes.get(ref.id);
-			return {
-				id: ref.id,
-				name: ref.name,
-				state: echo?.state ?? "failed",
-				...echo === void 0 ? { error: "embedded Python unavailable" } : echo.error === null ? {} : { error: echo.error },
-				devices: [...echo?.devices ?? []],
-				session: echo === void 0 ? {
-					loggedIn: false,
-					ageSec: 0,
-					lastSuccessAt: null
-				} : await echo.session()
-			};
-		}));
-		const targets = this.settings.targets;
-		const ids = brokers.map((ref) => ref.id);
-		return {
-			brokers: rows,
-			unassignedTargets: unassignedCount(targets),
-			notice: noticeFor(targets, ids)
-		};
-	}
-	async sendTest(input) {
-		const outcomes = await this.utter(input.brokerId, input.mode, input.echoIds, input.text, input.volume);
-		const known = new Map((this.echoes.get(input.brokerId)?.devices ?? []).map((device) => [device.id, device]));
-		const next = [...this.settings.targets];
-		for (const echoId of input.echoIds) {
-			if (next.some((row) => row.echoId === echoId && row.brokerId === input.brokerId)) continue;
-			next.push({
-				id: `echo-${input.brokerId}-${echoId}`,
-				name: known.get(echoId)?.name ?? echoId,
-				enabled: true,
-				brokerId: input.brokerId,
-				echoId,
-				mode: input.mode,
-				volume: input.volume,
-				respectDnd: true
-			});
-		}
-		this.settings = {
-			...this.settings,
-			targets: next
-		};
-		await this.persist();
-		return { outcomes: outcomes.map((row) => ({
-			echoId: row.targetId,
-			ok: row.ok,
-			...row.error !== void 0 ? { error: row.error } : {}
-		})) };
-	}
 };
 //#endregion
 //#region src/speak/icon-routes.ts
@@ -136750,26 +136728,11 @@ var RecordsSpeakSessionStore = class RecordsSpeakSessionStore {
 };
 //#endregion
 //#region src/addon.ts
-var SPEAK_PAGE = {
-	id: "speak",
-	label: "Speak on Echo",
-	icon: "megaphone",
-	path: "/addon/import-alexa",
-	remoteName: "addon_import_alexa_page",
-	bundle: "remoteEntry.js",
-	section: "administration"
-};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: { proxyPort: 3456 },
-	speak: {
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	}
+	echoTargets: []
 };
 /** Device types an imported Alexa appliance can materialise as. */
 var ALEXA_DEVICE_TYPES = [
@@ -136813,7 +136776,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	brokerStore = null;
 	activeBrokers = [];
 	speak = null;
-	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -136868,8 +136830,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,
-			writeSpeak: async (next) => {
-				await this.updateGlobalSettings({ speak: next });
+			writeTargets: async (next) => {
+				await this.updateGlobalSettings({ echoTargets: [...next] });
 			},
 			listBrokers: () => this.activeBrokers.map((entry) => ({
 				id: entry.id,
@@ -136881,50 +136843,31 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				return entry === void 0 ? null : readBrokerSeed(this.ctx.dataDir, entry);
 			},
 			sessions: RecordsSpeakSessionStore.of(records),
-			clearLegacySecrets: async () => {
-				await this.updateGlobalSettingsAsOperator({ speak: {
-					...this.config.speak,
-					password: SECRET_CLEAR,
-					session: SECRET_CLEAR
-				} });
-			},
 			ensurePython: () => this.ctx.deps.ensurePython()
 		});
 		this.speak = speak;
 		speak.start().catch((err) => {
 			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
-		const pages = {
-			id: this.addonId,
-			listPages: () => [SPEAK_PAGE]
-		};
-		return {
-			providers: [
-				...regs,
-				{
-					capability: brokerCapability,
-					provider: this.buildBrokerProvider()
-				},
-				{
-					capability: deviceAdoptionCapability,
-					provider: this.buildAdoptionProvider()
-				},
-				{
-					capability: addonRoutesCapability,
-					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-				},
-				{
-					capability: notificationOutputCapability,
-					provider: speak.provider
-				},
-				{
-					capability: addonPagesSourceCapability,
-					provider: pages
-				}
-			],
-			customActions: alexaSpeakActions,
-			actionHandlers: speak.handlers()
-		};
+		return { providers: [
+			...regs,
+			{
+				capability: brokerCapability,
+				provider: this.buildBrokerProvider()
+			},
+			{
+				capability: deviceAdoptionCapability,
+				provider: this.buildAdoptionProvider()
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+			},
+			{
+				capability: notificationOutputCapability,
+				provider: speak.provider
+			}
+		] };
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -137315,12 +137258,10 @@ exports.StubAlexaClient = StubAlexaClient;
 exports.__toCommonJS = __toCommonJS;
 exports.alexaAddonConfigSchema = alexaAddonConfigSchema;
 exports.alexaConnectionSchema = alexaConnectionSchema;
-exports.alexaSpeakActions = alexaSpeakActions;
 exports.buildAlexaApplianceCandidate = buildAlexaApplianceCandidate;
 exports.buildConnectionFormSchema = buildConnectionFormSchema;
 exports.connectionToCredentials = connectionToCredentials;
 exports.createAlexaClient = createAlexaClient;
-exports.customActions = alexaSpeakActions;
 exports.mapAlexaCapabilitiesToCamStack = mapAlexaCapabilitiesToCamStack;
 exports.mappableAppliance = mappableAppliance;
 exports.settingsToAlexaConnection = settingsToAlexaConnection;