@camstack/addon-import-alexa 0.2.163 → 0.2.165

package/dist/addon.mjs

@@ -8864,28 +8864,6 @@ function event(data) {
 var StaticDirOutputSchema$1 = object({ staticDir: string() });
 var VersionOutputSchema$1 = object({ version: string() });
 method(_void(), StaticDirOutputSchema$1, { auth: "admin" }), method(_void(), VersionOutputSchema$1, { auth: "admin" });
-/**
-* Identity — preserves literal types for downstream inference.
-*
-* The constraint is `Record<string, unknown>` (not `CustomActionsSpec`) so
-* TypeScript does not widen each entry's literal `kind`/`auth` fields to
-* the broader unions declared on `CustomActionSpec`'s default generics.
-* Shape validity is enforced separately by the `customAction(...)` helper
-* whose return type is already a `CustomActionSpec<...>`.
-*/
-function defineCustomActions(spec) {
-	return spec;
-}
-function customAction(input, output, options) {
-	return {
-		input,
-		output,
-		kind: options?.kind ?? "query",
-		auth: options?.auth ?? "protected",
-		scope: options?.scope ?? { kind: "system" },
-		...options?.caller ? { caller: "required" } : {}
-	};
-}
 var StaticDirOutputSchema = object({ staticDir: string() });
 var VersionOutputSchema = object({ version: string() });
 method(_void(), StaticDirOutputSchema, { auth: "admin" }), method(_void(), VersionOutputSchema, { auth: "admin" });
@@ -11230,7 +11208,7 @@ function errMsg(err) {
 	return String(err);
 }
 //#endregion
-//#region ../types/dist/composition-CZImLpOI.mjs
+//#region ../types/dist/composition-DwA0uVW5.mjs
 /**
 * The ffmpeg build every CamStack node downloads, per platform and arch.
 *
@@ -16475,24 +16453,7 @@ var AddonPageDeclarationSchema = object({
 	/** Display label for a CUSTOM `section` id (ignored for well-known ids). */
 	sectionLabel: string().optional()
 });
-var addonPagesSourceCapability = {
-	name: "addon-pages-source",
-	scope: "system",
-	mode: "collection",
-	internal: true,
-	methods: { 
-	/**
-	* `internal: true` did not gate the mount (see the 2026-08-26 note on
-	* `data-store-provider`) — this was reachable on the AppRouter by ANY
-	* authenticated session at the default `auth: 'protected'`. The only
-	* consumer, the `addon-pages-aggregator` builtin, reads it via
-	* `ctx.capabilities.getCollection('addon-pages-source')` — LOCAL-PROCESS
-	* only, never tRPC (per `ctx.capabilities` seeing only the local
-	* process). The public, enriched listing admin-ui actually consumes is
-	* the separate `addon-pages` cap, unaffected by this change.
-	*/
-listPages: method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" }) }
-};
+method(_void(), array(AddonPageDeclarationSchema).readonly(), { auth: "admin" });
 var AddonHttpRouteSchema = object({
 	method: _enum([
 		"GET",
@@ -19450,12 +19411,13 @@ var CHANGED = {
 	expr: "now"
 };
 function numeric(input) {
+	const { alsoFrom, ...base } = input;
 	return {
-		...input,
+		...base,
 		family: "numeric",
 		deviceType: DeviceType.Sensor,
 		memberDeviceType: DeviceType.Sensor,
-		memberDeviceTypes: [DeviceType.Sensor],
+		memberDeviceTypes: [DeviceType.Sensor, ...alsoFrom?.deviceTypes ?? []],
 		activeWhen: void 0,
 		commandCaps: [],
 		baseUnit: baseUnitOf(input.quantity),
@@ -19463,9 +19425,10 @@ function numeric(input) {
 		accept: [{
 			cap: input.outputCap,
 			fieldPath: input.outputField
-		}]
+		}, ...alsoFrom === void 0 ? [] : [alsoFrom.accept]]
 	};
 }
+var CLIMATE_DEVICES = [DeviceType.Thermostat, DeviceType.Climate];
 function binary(input) {
 	return {
 		...input,
@@ -19491,7 +19454,14 @@ var GROUP_TEMPLATES = [
 		quantity: "temperature",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentTemp"
+			}
+		}
 	}),
 	numeric({
 		id: "humidity",
@@ -19502,7 +19472,14 @@ var GROUP_TEMPLATES = [
 		quantity: "humidity",
 		defaultAggregate: "mean",
 		empty: "null",
-		companions: [NOW$2]
+		companions: [NOW$2],
+		alsoFrom: {
+			deviceTypes: CLIMATE_DEVICES,
+			accept: {
+				cap: "climate-control",
+				fieldPath: "currentHumidity"
+			}
+		}
 	}),
 	numeric({
 		id: "pressure",
@@ -43929,6 +43906,17 @@ var LlmProfileSchema = object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: _enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -43967,6 +43955,7 @@ var LlmProfileFieldSchema = _enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -45217,6 +45206,43 @@ var NotificationActionSchema = object({
 	*/
 	mode: _enum(["navigate", "background"]).optional()
 });
+/** A delivery parameter value: what a notifier declared it takes. */
+var DeliveryParamValueSchema = union([
+	string(),
+	number(),
+	boolean()
+]);
+/**
+* One extra delivery parameter a notifier KIND declares (D938). A rule that
+* addresses a target of that kind may set it; a kind that declares nothing is
+* never handed one. The admin UI derives its control from this descriptor —
+* no editor knows a service by name.
+*
+* Optional fields are `.optional()`, never `.default()` (a Zod default does not
+* run on the addon cap path).
+*/
+var DeliveryParamSchema = object({
+	key: string().min(1),
+	label: string(),
+	/** i18n key of the label, resolved by the declaring addon's namespace. */
+	labelKey: string().optional(),
+	type: _enum([
+		"enum",
+		"number",
+		"boolean",
+		"string"
+	]),
+	/** `enum` only: the closed set of accepted values. */
+	options: array(object({
+		value: string(),
+		label: string()
+	})).optional(),
+	/** `number` only. */
+	min: number().optional(),
+	max: number().optional(),
+	/** What the notifier does when the rule sets nothing; shown as the placeholder. */
+	default: DeliveryParamValueSchema.optional()
+});
 /**
 * The canonical notification. `body` is the only hard field (Apprise model).
 * `priority` is a 5-level ORDINAL (1=lowest … 3=normal(default) … 5=urgent),
@@ -45239,7 +45265,13 @@ var NotificationSchema = object({
 	tag: string().optional(),
 	deviceId: number().optional(),
 	eventId: string().optional(),
-	metadata: record(string(), unknown()).optional()
+	metadata: record(string(), unknown()).optional(),
+	/**
+	* Values for the parameters the target's kind DECLARES in
+	* {@link TargetKindSchema} `deliveryParams`. Already validated against the
+	* declaration by the sender; a notifier reads only the keys it declared.
+	*/
+	delivery: record(string(), DeliveryParamValueSchema).optional()
 });
 /** One declared native severity/priority level for a kind. */
 var TargetKindLevelSchema = object({
@@ -45345,6 +45377,11 @@ var TargetKindSchema = object({
 	*/
 	destinationKeys: array(string()).optional(),
 	supportsDiscovery: boolean(),
+	/**
+	* Extra delivery parameters a rule may set for a target of this kind (D938).
+	* Absent = none; the rule editor then offers nothing.
+	*/
+	deliveryParams: array(DeliveryParamSchema).optional(),
 	caps: TargetKindCapsSchema
 });
 /**
@@ -57658,7 +57695,9 @@ var ManifestShapeSchema = object({
 		icon: string().optional()
 	}).optional(),
 	protected: boolean().optional(),
-	removable: boolean().optional()
+	removable: boolean().optional(),
+	/** Declared Integrations-page block (mirror of `AddonDeclaration.integrationSection`). */
+	integrationSection: _enum(["system", "providers"]).optional()
 });
 var AddonProcessSchema = object({
 	pid: number().optional(),
@@ -90790,6 +90829,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -90808,6 +90870,29 @@ function rewriteReferer(referer, route) {
 	if (upstream === void 0) return null;
 	return `${upstream.scheme}://${upstream.host}${rest?.[2] ?? "/"}${url.search}`;
 }
+function decodeFormComponent(raw) {
+	try {
+		return decodeURIComponent(raw.replace(/\+/g, " "));
+	} catch {
+		return null;
+	}
+}
+/**
+* An `application/x-www-form-urlencoded` body whose field VALUES that are proxy URLs of
+* this attempt (absolute or root-relative) are turned back into the vendor URL they stand
+* for — the page's hidden inputs were rewritten on the way out (`rewriteBody`), and the
+* vendor must get its own URL back. Field order and every untouched pair stay byte-identical.
+*/
+function rewriteFormBody(body, route) {
+	return body.split("&").map((pair) => {
+		const eq = pair.indexOf("=");
+		if (eq === -1) return pair;
+		const value = decodeFormComponent(pair.slice(eq + 1));
+		if (value === null || !/^(?:https?:\/\/|\/)/i.test(value)) return pair;
+		const back = rewriteReferer(value, route);
+		return back === null ? pair : `${pair.slice(0, eq + 1)}${encodeURIComponent(back)}`;
+	}).join("&");
+}
 /** Cookies the browser holds for the hub itself must never reach a vendor. */
 function filterForwardedCookies(cookieHeader) {
 	return cookieHeader.split(";").map((part) => part.trim()).filter((part) => part.length > 0 && !part.toLowerCase().startsWith("camstack_")).join("; ");
@@ -90866,6 +90951,9 @@ function bodyKindOf(contentType) {
 	if (type.startsWith("text/") || type.includes("javascript") || type.includes("json") || type.includes("xml")) return "other";
 	return null;
 }
+function isFormEncoded(contentType) {
+	return (firstHeader(contentType) ?? "").toLowerCase().startsWith("application/x-www-form-urlencoded");
+}
 function firstHeader(value) {
 	return Array.isArray(value) ? value[0] : value;
 }
@@ -90880,6 +90968,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -90996,7 +91104,7 @@ var VendorLoginProxy = class {
 				sendPlain(res, 413, "Request too large");
 				return;
 			}
-			body = read;
+			body = isFormEncoded(req.headers["content-type"]) ? Buffer.from(rewriteFormBody(read.toString("utf8"), route), "utf8") : read;
 		}
 		const headers = this.#requestHeaders(req, route, upstream);
 		const upstreamRes = await this.#fetch(target, {
@@ -91010,11 +91118,16 @@ var VendorLoginProxy = class {
 		const kind = bodyKindOf(upstreamRes.headers.get("content-type") ?? "");
 		const declaredLength = Number(upstreamRes.headers.get("content-length") ?? "0");
 		const text = kind !== null && !(declaredLength > MAX_TEXT_BODY_BYTES) && method !== "HEAD" ? await upstreamRes.text() : null;
-		this.#logger.debug("vendor login proxy: upstream answered", { meta: {
+		this.#logger.info("vendor login proxy: upstream answered", { meta: {
 			addonId: this.#addonId,
 			host: upstream.host,
+			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -91036,7 +91149,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {
@@ -91145,59 +91258,37 @@ var AlexaBrokerEntrySchema = object({
 */
 var alexaProxyLoginSchema = object({ proxyPort: preprocess((v) => v === "" || v === null ? void 0 : v, number().int().min(1).max(65535).default(3456)).describe("Loopback port the local Amazon-login proxy listens on (never exposed)") });
 /**
-* Echo speech settings. Speech signs in as an import broker, so the targets
-* are what lives here. `email`, `password`, `region` and `session` are the OLD
-* standalone login: they are read once to migrate it onto the single broker
-* (see `speak/migration.ts`) and written back empty.
-*/
-var alexaSpeakSettingsSchema = object({
-	email: string().default(""),
-	password: string().default("").describe("Legacy Amazon password").meta({ secret: true }),
-	region: _enum([
-		"NA",
-		"EU",
-		"FE"
-	]).default("EU"),
-	session: string().default("").describe("Legacy Alexa session blob").meta({ secret: true }),
-	targets: array(object({
-		id: string(),
-		name: string(),
-		enabled: boolean(),
-		/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
-		brokerId: string().default(""),
-		echoId: string(),
-		mode: _enum(["speak", "announce"]),
-		volume: number(),
-		respectDnd: boolean()
-	})).default([])
+* The Echo notification targets this addon owns. Speech signs in as an import
+* broker, so a target is only the Echo it speaks on and how.
+*/
+var alexaEchoTargetSchema = object({
+	id: string(),
+	name: string(),
+	enabled: boolean(),
+	/** The broker (Amazon account) the Echo belongs to; '' until one is chosen. */
+	brokerId: string().default(""),
+	echoId: string(),
+	mode: _enum(["speak", "announce"]),
+	volume: number(),
+	respectDnd: boolean()
 });
 function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** Resolved settings. A keychain marker (an object) is an empty secret, not a password. */
-function readSpeakSettings(config) {
-	const raw = isRecord$3(config.speak) ? config.speak : {};
-	const region = raw["region"];
-	const targets = raw["targets"];
-	return alexaSpeakSettingsSchema.parse({
-		email: typeof raw["email"] === "string" ? raw["email"] : "",
-		password: typeof raw["password"] === "string" ? raw["password"] : "",
-		session: typeof raw["session"] === "string" ? raw["session"] : "",
-		...region === "NA" || region === "EU" || region === "FE" ? { region } : {},
-		...Array.isArray(targets) ? { targets } : {}
+/** The stored Echo targets; a row that no longer parses is dropped, never guessed. */
+function readEchoTargets(config) {
+	const raw = config.echoTargets;
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((row) => {
+		const parsed = alexaEchoTargetSchema.safeParse(isRecord$3(row) ? row : {});
+		return parsed.success ? [parsed.data] : [];
 	});
 }
 /** Top-level addon config — broker entries + the proxy-login settings. */
 var alexaAddonConfigSchema = object({
 	brokers: array(AlexaBrokerEntrySchema).default([]),
 	proxyLogin: alexaProxyLoginSchema.default({ proxyPort: 3456 }),
-	speak: alexaSpeakSettingsSchema.default({
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	})
+	echoTargets: array(alexaEchoTargetSchema).default([])
 });
 /** Narrow an `unknown` to a shallow plain-object record (cast-free boundary). */
 function toRecord(value) {
@@ -132744,6 +132835,33 @@ var ALEXA_API_USER_AGENT_POSTFIX = `AlexaRemote/${{
 	readmeFilename: "readme.md"
 }.version}`;
 //#endregion
+//#region src/alexa-region-options.ts
+var DEFAULT_LOCALE = "en-US";
+var LOCALE_BY_DOMAIN = {
+	"amazon.com": "en-US",
+	"amazon.it": "it-IT",
+	"amazon.de": "de-DE",
+	"amazon.co.uk": "en-GB",
+	"amazon.fr": "fr-FR",
+	"amazon.es": "es-ES",
+	"amazon.ca": "en-CA",
+	"amazon.com.au": "en-AU",
+	"amazon.co.jp": "ja-JP",
+	"amazon.in": "en-IN",
+	"amazon.com.br": "pt-BR",
+	"amazon.com.mx": "es-MX"
+};
+function alexaRegionOptions(amazonDomain) {
+	const domain = amazonDomain.length > 0 ? amazonDomain : "amazon.com";
+	const locale = LOCALE_BY_DOMAIN[domain] ?? DEFAULT_LOCALE;
+	return {
+		baseAmazonPage: domain,
+		amazonPage: domain,
+		acceptLanguage: locale,
+		amazonPageProxyLanguage: locale.replace("-", "_")
+	};
+}
+//#endregion
 //#region src/alexa-proxy-trace.ts
 /**
 * Sanitised one-line trace of the alexa-cookie2 proxy's own log lines.
@@ -132876,7 +132994,7 @@ var AlexaProxyLoginSession = class {
 	async start() {
 		const remote = new import_alexa_remote.default();
 		this.#remote = remote;
-		const amazonPage = this.#opts.amazonDomain.length > 0 ? this.#opts.amazonDomain : "amazon.com";
+		const region = alexaRegionOptions(this.#opts.amazonDomain);
 		remote.on("cookie", () => this.#onCookieEvent(remote));
 		remote.init({
 			proxyOnly: true,
@@ -132884,7 +133002,7 @@ var AlexaProxyLoginSession = class {
 			proxyListenBind: ALEXA_PROXY_LOOPBACK_HOST,
 			proxyPort: this.#opts.proxyPort,
 			proxyLogLevel: "warn",
-			amazonPage,
+			...region,
 			apiUserAgentPostfix: ALEXA_API_USER_AGENT_POSTFIX,
 			logger: (...args) => {
 				const line = args.map(String).join(" ");
@@ -135150,126 +135268,6 @@ var AlexaBrokerStore = class AlexaBrokerStore {
 	}
 };
 //#endregion
-//#region src/speak/constants.ts
-/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
-var ALEXA_SPEAK_ADDON_ID = "import-alexa";
-var ALEXA_SPEAK_KIND = "alexa-echo";
-var DEVICE_REFRESH_MS = 5 * 6e4;
-/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
-var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
-//#endregion
-//#region src/speak/worker-protocol.ts
-/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
-var EchoDeviceSchema = object({
-	id: string().min(1),
-	name: string(),
-	family: string(),
-	online: boolean(),
-	kind: _enum(["device", "group"]),
-	dnd: boolean(),
-	deviceType: string(),
-	/** The room the account files the device under, when Amazon names one. */
-	room: string().optional()
-});
-var LoginStatusSchema = _enum(["ok", "failed"]);
-var SessionStatusSchema = object({
-	loggedIn: boolean(),
-	ageSec: number().int().nonnegative(),
-	lastSuccessAt: number().int().nullable()
-});
-var TargetDeliverySchema = object({
-	targetId: string(),
-	ok: boolean(),
-	error: string().optional()
-});
-var WorkerLineSchema = union([object({
-	id: string(),
-	ok: literal(true),
-	result: unknown().optional()
-}), object({
-	id: string(),
-	ok: literal(false),
-	error: string()
-})]);
-function requestLine(id, request) {
-	return `${JSON.stringify({
-		id,
-		...request
-	})}\n`;
-}
-function parseLoginResult(result) {
-	const parsed = object({
-		status: LoginStatusSchema,
-		error: string().optional()
-	}).safeParse(result);
-	if (!parsed.success) return {
-		status: "failed",
-		error: "worker returned an unexpected login result"
-	};
-	return parsed.data;
-}
-function parseDevices(result) {
-	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected device list");
-	return parsed.data.devices;
-}
-function parseDeliveries(result) {
-	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
-	return parsed.data.outcomes;
-}
-function parseSessionStatus(result) {
-	const parsed = SessionStatusSchema.safeParse(result);
-	if (!parsed.success) throw new Error("worker returned an unexpected session status");
-	return parsed.data;
-}
-//#endregion
-//#region src/speak/actions.ts
-var BrokerEchoStateSchema = _enum([
-	"starting",
-	"ready",
-	"broker-not-signed-in",
-	"failed"
-]);
-var SpeakStatusSchema = object({
-	brokers: array(object({
-		id: string(),
-		name: string(),
-		state: BrokerEchoStateSchema,
-		error: string().optional(),
-		devices: array(EchoDeviceSchema),
-		session: SessionStatusSchema
-	})),
-	/** Targets that name no Amazon account yet (they cannot speak until one is chosen). */
-	unassignedTargets: number().int().nonnegative(),
-	/** What the old standalone login left behind, named; '' when nothing is pending. */
-	notice: _enum([
-		"",
-		"no-broker",
-		"choose-broker"
-	])
-});
-var alexaSpeakActions = defineCustomActions({
-	speakStatus: customAction(object({}), SpeakStatusSchema, {
-		kind: "mutation",
-		auth: "admin"
-	}),
-	sendTest: customAction(object({
-		brokerId: string().min(1),
-		echoIds: array(string().min(1)).min(1),
-		mode: _enum(["speak", "announce"]),
-		volume: number().int().min(0).max(100),
-		text: string().min(1).max(450)
-	}), object({ outcomes: array(object({
-		echoId: string(),
-		ok: boolean(),
-		error: string().optional()
-	})) }), {
-		kind: "mutation",
-		auth: "admin"
-	})
-});
-//#endregion
 //#region src/speak/broker-seed.ts
 /**
 * What the Echo worker needs from an import broker to act as the same Amazon
@@ -135504,6 +135502,72 @@ function scrubSecrets(text, secrets) {
 	return out;
 }
 //#endregion
+//#region src/speak/worker-protocol.ts
+/** Line-delimited JSON the long-lived Python worker speaks. One object per line. */
+var EchoDeviceSchema = object({
+	id: string().min(1),
+	name: string(),
+	family: string(),
+	online: boolean(),
+	kind: _enum(["device", "group"]),
+	dnd: boolean(),
+	deviceType: string(),
+	/** The room the account files the device under, when Amazon names one. */
+	room: string().optional()
+});
+var LoginStatusSchema = _enum(["ok", "failed"]);
+var SessionStatusSchema = object({
+	loggedIn: boolean(),
+	ageSec: number().int().nonnegative(),
+	lastSuccessAt: number().int().nullable()
+});
+var TargetDeliverySchema = object({
+	targetId: string(),
+	ok: boolean(),
+	error: string().optional()
+});
+var WorkerLineSchema = union([object({
+	id: string(),
+	ok: literal(true),
+	result: unknown().optional()
+}), object({
+	id: string(),
+	ok: literal(false),
+	error: string()
+})]);
+function requestLine(id, request) {
+	return `${JSON.stringify({
+		id,
+		...request
+	})}\n`;
+}
+function parseLoginResult(result) {
+	const parsed = object({
+		status: LoginStatusSchema,
+		error: string().optional()
+	}).safeParse(result);
+	if (!parsed.success) return {
+		status: "failed",
+		error: "worker returned an unexpected login result"
+	};
+	return parsed.data;
+}
+function parseDevices(result) {
+	const parsed = object({ devices: array(EchoDeviceSchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected device list");
+	return parsed.data.devices;
+}
+function parseDeliveries(result) {
+	const parsed = object({ outcomes: array(TargetDeliverySchema) }).safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected delivery list");
+	return parsed.data.outcomes;
+}
+function parseSessionStatus(result) {
+	const parsed = SessionStatusSchema.safeParse(result);
+	if (!parsed.success) throw new Error("worker returned an unexpected session status");
+	return parsed.data;
+}
+//#endregion
 //#region src/speak/broker-echo.ts
 var BrokerEcho = class {
 	deps;
@@ -135632,40 +135696,13 @@ var BrokerEcho = class {
 	}
 };
 //#endregion
-//#region src/speak/migration.ts
-function legacyLoginOf(settings) {
-	return {
-		email: settings.email,
-		password: settings.password,
-		session: settings.session
-	};
-}
-function planLegacyMigration(legacy, brokerIds, targets) {
-	const present = legacy.email.length > 0 || legacy.password.length > 0 || legacy.session.length > 0;
-	const only = brokerIds.length === 1 ? brokerIds[0] ?? null : null;
-	if (!present || only === null) return {
-		present,
-		attachTo: null,
-		targets
-	};
-	return {
-		present,
-		attachTo: legacy.session.length > 0 ? only : null,
-		targets: targets.map((row) => row.brokerId.length > 0 ? row : {
-			...row,
-			brokerId: only
-		})
-	};
-}
-/** What the page must tell the operator about targets that name no account. */
-function noticeFor(targets, brokerIds) {
-	if (!targets.some((row) => row.brokerId.length === 0)) return "";
-	if (brokerIds.length === 0) return "no-broker";
-	return brokerIds.length > 1 ? "choose-broker" : "";
-}
-function unassignedCount(targets) {
-	return targets.filter((row) => row.brokerId.length === 0).length;
-}
+//#region src/speak/constants.ts
+/** Echo speech limits and the worker restart bound (same window as CrashSupervisor). */
+var ALEXA_SPEAK_ADDON_ID = "import-alexa";
+var ALEXA_SPEAK_KIND = "alexa-echo";
+var DEVICE_REFRESH_MS = 5 * 6e4;
+/** Where the addon serves the Alexa mark; `listTargetKinds` stamps it as `iconUrl`. */
+var ALEXA_SPEAK_ICON_URL = `/addon/${ALEXA_SPEAK_ADDON_ID}/icons/${ALEXA_SPEAK_KIND}`;
 //#endregion
 //#region src/speak/rate-limit.ts
 /**
@@ -135770,14 +135807,42 @@ function readString(config, key) {
 	const value = config[key];
 	return typeof value === "string" ? value : "";
 }
-function readMode(config) {
-	return config["mode"] === "announce" ? "announce" : "speak";
+/** The rule's value for this send wins; the target's saved config is the fallback. */
+function readMode(config, delivery) {
+	return (delivery?.["mode"] ?? config["mode"]) === "announce" ? "announce" : "speak";
 }
-function readVolume(config) {
-	const value = config["volume"];
+function readVolume(config, delivery) {
+	const ruled = delivery?.["volume"];
+	const value = typeof ruled === "number" ? ruled : config["volume"];
 	if (typeof value !== "number" || !Number.isFinite(value)) return 40;
 	return Math.max(0, Math.min(100, Math.round(value)));
 }
+/**
+* The delivery parameters a rule may set for an Echo target (D938). The
+* target's own config holds the default; these override it per notification.
+*/
+var DELIVERY_PARAMS = [{
+	key: "mode",
+	label: "Mode",
+	labelKey: "import-alexa:echoTarget.s_echo.mode.label",
+	type: "enum",
+	options: [{
+		value: "speak",
+		label: "Speak (quiet hours apply)"
+	}, {
+		value: "announce",
+		label: "Announce (chime, then speech)"
+	}],
+	default: "speak"
+}, {
+	key: "volume",
+	label: "Volume",
+	labelKey: "import-alexa:echoTarget.s_echo.volume.label",
+	type: "number",
+	min: 0,
+	max: 100,
+	default: 40
+}];
 function respectDnd(config) {
 	return config["respectDnd"] !== false;
 }
@@ -135878,6 +135943,7 @@ function alexaTargetKind(brokers) {
 		supportsDiscovery: true,
 		destinationKeys: ["brokerId", "echoId"],
 		configSchema: configSchema(brokers),
+		deliveryParams: DELIVERY_PARAMS,
 		caps: {
 			attachments: {
 				mediaTypes: [],
@@ -136060,14 +136126,14 @@ function createAlexaNotificationProvider(ports) {
 				renderedAs: speech.renderedAs
 			};
 		}
-		const mode = readMode(target.config);
+		const mode = readMode(target.config, notification.delivery);
 		try {
 			const outcomes = await ports.speak({
 				brokerId: broker.id,
 				mode,
 				targets: [echoId],
 				text: speech.text,
-				volume: readVolume(target.config)
+				volume: readVolume(target.config, notification.delivery)
 			});
 			const one = outcomes.find((row) => row.targetId === echoId) ?? outcomes[0];
 			if (one === void 0 || !one.ok) {
@@ -136467,8 +136533,8 @@ function startAlexaWorker(deps) {
 }
 //#endregion
 //#region src/speak/controller.ts
-function targetsFrom(settings) {
-	return settings.targets.map((row) => ({
+function targetsFrom(rows) {
+	return rows.map((row) => ({
 		id: row.id,
 		name: row.name,
 		kind: ALEXA_SPEAK_KIND,
@@ -136498,7 +136564,7 @@ function rowsFrom(targets) {
 var AlexaSpeakController = class {
 	host;
 	provider;
-	settings;
+	rows;
 	pythonPath = null;
 	echoes = /* @__PURE__ */ new Map();
 	timer = null;
@@ -136507,17 +136573,14 @@ var AlexaSpeakController = class {
 	constructor(host) {
 		this.host = host;
 		this.now = host.now ?? (() => Date.now());
-		this.settings = readSpeakSettings(host.readConfig());
+		this.rows = readEchoTargets(host.readConfig());
 		this.provider = createAlexaNotificationProvider({
 			brokers: () => this.brokerViews(),
 			now: this.now,
 			logger: host.logger,
-			loadTargets: () => targetsFrom(this.settings),
+			loadTargets: () => targetsFrom(this.rows),
 			saveTargets: (targets) => {
-				this.settings = {
-					...this.settings,
-					targets: [...rowsFrom(targets)]
-				};
+				this.rows = rowsFrom(targets);
 				this.persist();
 			},
 			speak: (command) => this.utter(command.brokerId, command.mode, command.targets, command.text, command.volume)
@@ -136529,7 +136592,6 @@ var AlexaSpeakController = class {
 			this.host.logger.warn("alexa speak: embedded Python unavailable; Echo speech will not run");
 			return;
 		}
-		await this.migrateLegacyLogin();
 		await this.brokersChanged();
 		this.timer = setInterval(() => {
 			this.refreshAll();
@@ -136546,12 +136608,6 @@ var AlexaSpeakController = class {
 		this.queue = this.queue.then(() => this.reconcile()).catch(() => void 0);
 		return this.queue;
 	}
-	handlers() {
-		return {
-			speakStatus: async () => this.status(),
-			sendTest: async (input) => this.sendTest(input)
-		};
-	}
 	brokerViews() {
 		return this.host.listBrokers().map((ref) => {
 			const echo = this.echoes.get(ref.id);
@@ -136565,36 +136621,11 @@ var AlexaSpeakController = class {
 	}
 	async persist() {
 		try {
-			await this.host.writeSpeak(this.settings);
+			await this.host.writeTargets(this.rows);
 		} catch (err) {
-			this.host.logger.warn("alexa speak: could not store settings", { meta: { error: err instanceof Error ? err.message : String(err) } });
+			this.host.logger.warn("alexa speak: could not store targets", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		}
 	}
-	/**
-	* Drain the old standalone login once. With exactly one broker its jar and
-	* its targets move onto that broker; otherwise the jar is dropped and the
-	* targets wait for the operator to choose (the status names that state).
-	*/
-	async migrateLegacyLogin() {
-		const brokers = this.host.listBrokers();
-		const plan = planLegacyMigration(legacyLoginOf(this.settings), brokers.map((ref) => ref.id), this.settings.targets);
-		if (!plan.present) return;
-		if (plan.attachTo !== null) await this.host.sessions.put(plan.attachTo, this.settings.session);
-		this.settings = {
-			...this.settings,
-			email: "",
-			password: "",
-			session: "",
-			targets: [...plan.targets]
-		};
-		await this.persist();
-		await this.host.clearLegacySecrets();
-		this.host.logger.info("alexa speak: the old standalone login was retired", { meta: {
-			attachedTo: plan.attachTo ?? "none",
-			brokers: brokers.length,
-			targets: plan.targets.length
-		} });
-	}
 	makeWorker(brokerId, pythonPath) {
 		if (this.host.startWorker !== void 0) return this.host.startWorker(brokerId, pythonPath);
 		return startAlexaWorker({
@@ -136644,59 +136675,6 @@ var AlexaSpeakController = class {
 		if (echo === void 0) throw new Error("no Echo session for this Amazon account");
 		return echo.utter(mode === "announce" ? "announce" : "speak", targets, text, volume);
 	}
-	async status() {
-		const brokers = this.host.listBrokers();
-		const rows = await Promise.all(brokers.map(async (ref) => {
-			const echo = this.echoes.get(ref.id);
-			return {
-				id: ref.id,
-				name: ref.name,
-				state: echo?.state ?? "failed",
-				...echo === void 0 ? { error: "embedded Python unavailable" } : echo.error === null ? {} : { error: echo.error },
-				devices: [...echo?.devices ?? []],
-				session: echo === void 0 ? {
-					loggedIn: false,
-					ageSec: 0,
-					lastSuccessAt: null
-				} : await echo.session()
-			};
-		}));
-		const targets = this.settings.targets;
-		const ids = brokers.map((ref) => ref.id);
-		return {
-			brokers: rows,
-			unassignedTargets: unassignedCount(targets),
-			notice: noticeFor(targets, ids)
-		};
-	}
-	async sendTest(input) {
-		const outcomes = await this.utter(input.brokerId, input.mode, input.echoIds, input.text, input.volume);
-		const known = new Map((this.echoes.get(input.brokerId)?.devices ?? []).map((device) => [device.id, device]));
-		const next = [...this.settings.targets];
-		for (const echoId of input.echoIds) {
-			if (next.some((row) => row.echoId === echoId && row.brokerId === input.brokerId)) continue;
-			next.push({
-				id: `echo-${input.brokerId}-${echoId}`,
-				name: known.get(echoId)?.name ?? echoId,
-				enabled: true,
-				brokerId: input.brokerId,
-				echoId,
-				mode: input.mode,
-				volume: input.volume,
-				respectDnd: true
-			});
-		}
-		this.settings = {
-			...this.settings,
-			targets: next
-		};
-		await this.persist();
-		return { outcomes: outcomes.map((row) => ({
-			echoId: row.targetId,
-			ok: row.ok,
-			...row.error !== void 0 ? { error: row.error } : {}
-		})) };
-	}
 };
 //#endregion
 //#region src/speak/icon-routes.ts
@@ -136749,26 +136727,11 @@ var RecordsSpeakSessionStore = class RecordsSpeakSessionStore {
 };
 //#endregion
 //#region src/addon.ts
-var SPEAK_PAGE = {
-	id: "speak",
-	label: "Speak on Echo",
-	icon: "megaphone",
-	path: "/addon/import-alexa",
-	remoteName: "addon_import_alexa_page",
-	bundle: "remoteEntry.js",
-	section: "administration"
-};
 /** Default config — a fresh install starts with no accounts. */
 var DEFAULTS = {
 	brokers: [],
 	proxyLogin: { proxyPort: 3456 },
-	speak: {
-		email: "",
-		password: "",
-		region: "EU",
-		session: "",
-		targets: []
-	}
+	echoTargets: []
 };
 /** Device types an imported Alexa appliance can materialise as. */
 var ALEXA_DEVICE_TYPES = [
@@ -136812,7 +136775,6 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 	brokerStore = null;
 	activeBrokers = [];
 	speak = null;
-	secretStatePaths = ["speak.password", "speak.session"];
 	constructor() {
 		super({ ...DEFAULTS });
 	}
@@ -136867,8 +136829,8 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 		const speak = new AlexaSpeakController({
 			logger: this.ctx.logger.child("speak"),
 			readConfig: () => this.config,
-			writeSpeak: async (next) => {
-				await this.updateGlobalSettings({ speak: next });
+			writeTargets: async (next) => {
+				await this.updateGlobalSettings({ echoTargets: [...next] });
 			},
 			listBrokers: () => this.activeBrokers.map((entry) => ({
 				id: entry.id,
@@ -136880,50 +136842,31 @@ var AlexaImportAddon = class extends BaseDeviceProvider {
 				return entry === void 0 ? null : readBrokerSeed(this.ctx.dataDir, entry);
 			},
 			sessions: RecordsSpeakSessionStore.of(records),
-			clearLegacySecrets: async () => {
-				await this.updateGlobalSettingsAsOperator({ speak: {
-					...this.config.speak,
-					password: SECRET_CLEAR,
-					session: SECRET_CLEAR
-				} });
-			},
 			ensurePython: () => this.ctx.deps.ensurePython()
 		});
 		this.speak = speak;
 		speak.start().catch((err) => {
 			this.ctx.logger.warn("alexa speak: worker did not start", { meta: { error: err instanceof Error ? err.message : String(err) } });
 		});
-		const pages = {
-			id: this.addonId,
-			listPages: () => [SPEAK_PAGE]
-		};
-		return {
-			providers: [
-				...regs,
-				{
-					capability: brokerCapability,
-					provider: this.buildBrokerProvider()
-				},
-				{
-					capability: deviceAdoptionCapability,
-					provider: this.buildAdoptionProvider()
-				},
-				{
-					capability: addonRoutesCapability,
-					provider: buildAddonRouteProvider("import-alexa", loginRoutes)
-				},
-				{
-					capability: notificationOutputCapability,
-					provider: speak.provider
-				},
-				{
-					capability: addonPagesSourceCapability,
-					provider: pages
-				}
-			],
-			customActions: alexaSpeakActions,
-			actionHandlers: speak.handlers()
-		};
+		return { providers: [
+			...regs,
+			{
+				capability: brokerCapability,
+				provider: this.buildBrokerProvider()
+			},
+			{
+				capability: deviceAdoptionCapability,
+				provider: this.buildAdoptionProvider()
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: buildAddonRouteProvider("import-alexa", loginRoutes)
+			},
+			{
+				capability: notificationOutputCapability,
+				provider: speak.provider
+			}
+		] };
 	}
 	async loadPersistedBrokers() {
 		const store = this.brokerStore;
@@ -137307,4 +137250,4 @@ function capsEqual(a, b) {
 	return true;
 }
 //#endregion
-export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, alexaSpeakActions as customActions, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };
+export { AlexaImportAddon, AlexaClientNotWiredError as a, alexaAddonConfigSchema as c, connectionToCredentials as d, settingsToAlexaConnection as f, AlexaAuthError as i, alexaConnectionSchema as l, mappableAppliance as n, StubAlexaClient as o, mapAlexaCapabilitiesToCamStack as r, createAlexaClient as s, buildAlexaApplianceCandidate as t, buildConnectionFormSchema as u };