@camstack/addon-import-alexa 0.2.164 → 0.2.165

package/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.165] - 2026-10-28
+
+### Changed
+
+- The Alexa sign-in keeps Amazon's session cookie through the hub proxy (the email step still fails upstream, tracked separately)
+
 ## [0.2.164] - 2026-10-28
 
 ### Changed

package/dist/addon.js

@@ -43907,6 +43907,17 @@ var LlmProfileSchema = object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: _enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -43945,6 +43956,7 @@ var LlmProfileFieldSchema = _enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -90818,6 +90830,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -90934,6 +90969,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -91069,7 +91124,11 @@ var VendorLoginProxy = class {
 			host: upstream.host,
 			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -91091,7 +91150,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {

package/dist/addon.mjs

@@ -43906,6 +43906,17 @@ var LlmProfileSchema = object({
 	*  field in its editor only when its descriptor lists it in `profileFields`. */
 	topK: number().int().positive().optional(),
 	maxTokens: number().int().positive().optional(),
+	/** How hard the model "thinks" before it answers. Omitted = the model's own
+	*  default. `off` matters for structured output: a thinking model can spend
+	*  the whole completion on reasoning and return an empty `content`. Carried
+	*  only by the wires that have it — a kind offers the field in its editor
+	*  only when its descriptor lists it in `profileFields`. */
+	reasoningEffort: _enum([
+		"off",
+		"low",
+		"medium",
+		"high"
+	]).optional(),
 	/** Prompt context window. Advisory for cloud kinds (they enforce their own). */
 	contextLength: number().int().positive().optional(),
 	/** Default system prompt. A caller's `system` REPLACES it (never appends —
@@ -43944,6 +43955,7 @@ var LlmProfileFieldSchema = _enum([
 	"topP",
 	"topK",
 	"maxTokens",
+	"reasoningEffort",
 	"contextLength",
 	"systemPrompt",
 	"timeoutMs",
@@ -90817,6 +90829,29 @@ function rewriteSetCookie(cookie, route) {
 	return kept.join("; ");
 }
 /**
+* Every Set-Cookie of one vendor response, rewritten. Dropping `Domain` folds cookies
+* the vendor keeps apart (`session-id` on `.amazon.it` and on `.www.amazon.it`) into
+* one, so a past-dated set that only deleted the other domain's copy would delete the
+* live one the same response just set: that deletion is dropped.
+*/
+function rewriteSetCookies(cookies, route) {
+	const now = Date.now();
+	const liveNames = new Set(cookies.filter((c) => !isExpiredCookie(c, now)).map(cookieName));
+	return cookies.filter((c) => !(isExpiredCookie(c, now) && liveNames.has(cookieName(c)))).map((c) => rewriteSetCookie(c, route));
+}
+function cookieName(cookie) {
+	return cookie.split(";")[0]?.split("=")[0]?.trim() ?? "";
+}
+function isExpiredCookie(cookie, now) {
+	const attrs = cookie.split(";").slice(1).map((part) => part.trim());
+	const maxAge = attrs.find((a) => /^max-age=/i.test(a));
+	if (maxAge !== void 0) return Number(maxAge.slice(8)) <= 0;
+	const expires = attrs.find((a) => /^expires=/i.test(a));
+	if (expires === void 0) return false;
+	const at = Date.parse(expires.slice(8));
+	return Number.isFinite(at) && at <= now;
+}
+/**
 * A browser `Referer` that points into this proxy, turned back into the vendor URL it
 * stands for. A Referer that is not ours is dropped (null): it names the hub.
 */
@@ -90933,6 +90968,26 @@ async function readRequestBody(req) {
 	}
 	return Buffer.concat(chunks);
 }
+/** The path of the Referer sent upstream, or why none was sent — the query is never logged. */
+function forwardedRefererPath(forwarded, received) {
+	if (forwarded !== void 0) return URL.canParse(forwarded) ? new URL(forwarded).pathname : "unparsable";
+	return received === void 0 ? "absent" : "unmapped";
+}
+/** The form targets a vendor page posts to, path only (no query), so a lost path prefix is visible. */
+function formActionPaths(html) {
+	const actions = [...html.matchAll(/<form\b[^>]*\baction\s*=\s*["']([^"']*)["']/gi)].map((m) => (m[1] ?? "").split("?")[0] ?? "").slice(0, 5);
+	return actions.length === 0 ? "none" : actions.join(" | ");
+}
+/** Cookie NAMES only — values are session secrets and are never logged. */
+function cookieNames(header) {
+	if (header === void 0 || header.length === 0) return "none";
+	return header.split(";").map((part) => part.split("=")[0]?.trim() ?? "").join(",");
+}
+/** A Set-Cookie's name and attributes without its value, so a cookie the browser refuses is visible. */
+function setCookieShape(cookie) {
+	const [first, ...attrs] = cookie.split(";").map((part) => part.trim());
+	return [first?.split("=")[0] ?? "", ...attrs.filter((a) => !/^expires=/i.test(a))].join(";");
+}
 function sendPlain(res, status, text) {
 	res.writeHead(status, {
 		"content-type": "text/plain; charset=utf-8",
@@ -91068,7 +91123,11 @@ var VendorLoginProxy = class {
 			host: upstream.host,
 			path: target.pathname,
 			status: upstreamRes.status,
-			method
+			method,
+			refererPath: forwardedRefererPath(headers["referer"], req.headers["referer"]),
+			formActions: kind === "html" && text !== null ? formActionPaths(text) : void 0,
+			sentNames: cookieNames(headers["cookie"]),
+			vendorSets: setCookies.map(setCookieShape).join(" | ")
 		} });
 		const settled = await attempt.evaluate({
 			status: upstreamRes.status,
@@ -91090,7 +91149,7 @@ var VendorLoginProxy = class {
 		upstreamRes.headers.forEach((value, name) => {
 			if (!DROP_RESPONSE_HEADERS.has(name.toLowerCase())) out[name] = value;
 		});
-		if (setCookies.length > 0) out["set-cookie"] = setCookies.map((c) => rewriteSetCookie(c, route));
+		if (setCookies.length > 0) out["set-cookie"] = rewriteSetCookies(setCookies, route);
 		if (location !== null) out["location"] = rewriteLocation(location, upstream, route);
 		out["cache-control"] = "no-store";
 		if (text !== null && kind !== null) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-import-alexa",
-  "version": "0.2.164",
+  "version": "0.2.165",
   "description": "Alexa device-import provider for CamStack — imports the smart-home devices in a user's Alexa account via the unofficial alexa-remote2 cookie/token client (the inverse of the Alexa exporter)",
   "keywords": [
     "camstack",