@camstack/addon-import-alexa 0.2.173 → 0.2.175

package/CHANGELOG.md

@@ -7,11 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.175] - 2026-11-01
+
+### Changed
+
+- Alexa cookie login: the login proxy no longer forwards Amazon's upgrade-insecure-requests directive, which stopped the page from completing over http
+- Echo sign-in through a broker now uses the cookies Amazon returns for the token directly, and a failed sign-in names its step
+
+## [0.2.174] - 2026-11-01
+
+### Changed
+
+- Declares the minimum CamStack server it needs; the Addons page shows a held update as requires server >= X
+
 ## [0.2.173] - 2026-11-01
 
 ### Changed
 
 - The Amazon device-code sign-in's refresh token and session cookie are declared secret
+- Declares the minimum CamStack server it needs; the Addons page shows a held update as requires server >= X
 
 ## [0.2.172] - 2026-10-31
 

package/dist/addon.js

@@ -6027,7 +6027,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-BHS4ImRX.mjs
+//#region ../types/dist/sleep-CSYuxssh.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9494,7 +9494,7 @@ var ProfileRtspEntrySchema = object({
 /**
 * The model weight formats a catalog entry can ship. Schema-free on purpose:
 * `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
-* (the model downloader in `@camstack/system`) needs only the list and must
+* (the model downloader in `@camstack/server/system`) needs only the list and must
 * reach it through `@camstack/types/addon` without building the cap schema
 * graph (D28).
 */
@@ -12869,6 +12869,71 @@ var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
 var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 /**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
 * Which integration instance a settings form is for. An addon that serves several instances
 * (`instanceMode: multiple`) can show a different form per instance — an NVR integration
 * needs its connection, the default integration needs the addon's own sections.
@@ -43423,7 +43488,7 @@ var notificationOutputCapability = {
 * rebuilds without manual reload.
 *
 * The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-pages-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written
 * `addon-pages.router.ts` wrapper anymore.
@@ -43513,7 +43578,7 @@ var addonRoutesCapability = {
 		*/
 		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
 	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/server/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
 var ConfigTabDeclarationSchema = object({
@@ -43742,7 +43807,7 @@ method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 * manual reload — same scheme used by `addon-pages`.
 *
 * The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-widgets-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written wrapper.
 */
@@ -61878,7 +61943,18 @@ var ServerUpdateActionResultSchema = object({
 	* store (D877), present when the pre-flight refused the update
 	* (`reason: 'addon-would-refuse'`). Optional for version skew.
 	*/
-	blockers: array(UpdateBlockerSchema).optional()
+	blockers: array(UpdateBlockerSchema).optional(),
+	/**
+	* The minimums the target server declares and this node does not meet
+	* (D989), present when the update was refused with
+	* `reason: 'requirements-unmet'`. Each names the versions on both sides.
+	*/
+	unmet: array(UnmetRequirementSchema).optional(),
+	/**
+	* The addons this node has below the minimum the staged server declares —
+	* the ones to update WITH the server. Present on an accepted update.
+	*/
+	requiredAddonUpdates: array(RequiredAddonUpdateSchema).optional()
 });
 var LaunchOverridesSchema = object({ 
 /** The persisted heap ceiling in MB, or `null` when none is set. */
@@ -64422,7 +64498,9 @@ var PackageUpdateSchema = object({
 	latestVersion: string(),
 	category: _enum(["addon", "core"]),
 	requiresRestart: boolean(),
-	isSystem: boolean()
+	isSystem: boolean(),
+	/** Held: what the newer version needs and this node does not meet (D989). */
+	blockedBy: array(UnmetRequirementSchema).readonly().optional()
 });
 var PackageVersionInfoSchema = object({
 	version: string(),
@@ -69722,7 +69800,7 @@ var lawnMowerControlCapability = {
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
-* Implementation in `@camstack/system/builtins/local-network/`.
+* Implementation in `@camstack/server/system/builtins/local-network/`.
 */
 /** Coarse classification derived from the interface name + IP range. */
 var InterfaceKindEnum = _enum([
@@ -71610,7 +71688,7 @@ onStatusChanged: { data: object({
 * jitter, and observed/peak bandwidth per device + per client.
 *
 * Implementation lives in the server's `NetworkQualityService` (thin
-* wrapper over the shared `NetworkQualityTracker` from `@camstack/system`).
+* wrapper over the shared `NetworkQualityTracker` from `@camstack/server/system`).
 * The provider is registered from `trpc.router.ts` against the existing
 * service instance — no addon owns this state.
 *
@@ -73761,7 +73839,7 @@ var ptzAutotrackCapability = {
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
 	*    model-dependent).
-	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*  - **Wrapper**: the emulated implementation (`@camstack/server/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
 	*    the bindings UI.
@@ -133162,6 +133240,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.proxyLogLevel === "debug" && _options.logger && _options.logger(`Alexa-Cookie: Proxy-Request: (modified:${modified})${customStringify(proxyReq, null, 2)}`);
 		}
 		function onProxyRes(proxyRes, req, res) {
+			stripUpgradeInsecureRequestsHeaders(proxyRes);
 			const url = req.originalUrl || req.url;
 			if (url.endsWith(".ico") || url.endsWith(".js") || url.endsWith(".ttf") || url.endsWith(".svg") || url.endsWith(".png") || url.endsWith(".appcache")) return;
 			if (url.startsWith("/ap/uedata")) return;
@@ -133254,7 +133333,18 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			callbackListening = null;
 		});
 	}
+	function stripUpgradeInsecureRequestsHeaders(proxyRes) {
+		const headers = proxyRes && proxyRes.headers;
+		if (!headers) return;
+		for (const name of ["content-security-policy", "content-security-policy-report-only"]) {
+			if (headers[name] === void 0) continue;
+			const kept = (Array.isArray(headers[name]) ? headers[name] : [headers[name]]).map((v) => String(v).split(";").map((d) => d.trim()).filter((d) => d && !/^upgrade-insecure-requests$/i.test(d)).join("; ")).filter((v) => v);
+			if (kept.length) headers[name] = kept.length === 1 ? kept[0] : kept;
+			else delete headers[name];
+		}
+	}
 	module.exports.initAmazonProxy = initAmazonProxy;
+	module.exports.stripUpgradeInsecureRequestsHeaders = stripUpgradeInsecureRequestsHeaders;
 }));
 //#endregion
 //#region ../../node_modules/alexa-cookie2/alexa-cookie.js
@@ -140876,7 +140966,7 @@ var BrokerEcho = class {
 		try {
 			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
 		} catch (err) {
-			this.deps.logger.warn("alexa speak: device refresh failed", {
+			this.deps.logger.warn("alexa speak: step 3 of 3, device list failed after a good sign-in", {
 				tags: { brokerId: this.deps.brokerId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
@@ -141406,6 +141496,7 @@ function createAlexaNotificationProvider(ports) {
 			return found;
 		},
 		async discoverTargets(input) {
+			for (const broker of ports.brokers()) if (!broker.ready) ports.logger.warn(`alexa echo discovery: no Echo listed for '${broker.name}', the Amazon account is not signed in for this broker`, { tags: { brokerId: broker.id } });
 			const named = readString(input.config ?? {}, "brokerId");
 			if (named.length > 0) {
 				const owner = ports.brokers().find((broker) => broker.id === named);

package/dist/addon.mjs

@@ -6025,7 +6025,7 @@ function number(params) {
 	return /* @__PURE__ */ _coercedNumber(ZodNumber, params);
 }
 //#endregion
-//#region ../types/dist/sleep-BHS4ImRX.mjs
+//#region ../types/dist/sleep-CSYuxssh.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -9492,7 +9492,7 @@ var ProfileRtspEntrySchema = object({
 /**
 * The model weight formats a catalog entry can ship. Schema-free on purpose:
 * `types/models.ts` builds Zod schemas from it, but a runner-closure consumer
-* (the model downloader in `@camstack/system`) needs only the list and must
+* (the model downloader in `@camstack/server/system`) needs only the list and must
 * reach it through `@camstack/types/addon` without building the cap schema
 * graph (D28).
 */
@@ -12867,6 +12867,71 @@ var EventOwnerTypeSchema = _enum(EVENT_OWNER_TYPES);
 var MediaPresenceOwnerKindSchema = _enum([...EVENT_OWNER_TYPES, "track"]);
 new Set(EVENT_OWNER_TYPES);
 /**
+* What a published package needs from the rest of the install (D989).
+*
+* One published framework package (`@camstack/server`) carries the kernel, the
+* builtins and the capability contracts, so "which addon runs on which
+* framework" is a question of version, and the answer is DECLARED by the
+* package that knows it:
+*
+*   - an addon says the oldest server it runs on (`requires.server: ">=X"`);
+*   - the server says the oldest addon it works with
+*     (`requires.addons: { "@camstack/addon-x": ">=Y" }`) and the oldest shell
+*     around it (`requires.wrapper: { desktop, image }`);
+*   - a wrapper (the desktop app, the container starter) says which server
+*     range it can host, and reports its own kind and version.
+*
+* The publish workflow STAMPS these after the version bump
+* (`scripts/ci/stamp-requires.mjs`); nobody types a number by hand.
+*
+* A requirement that cannot be checked is NOT met: a shell that reports no
+* version counts as below the minimum, and an unreadable running version is
+* named in the result (a failed read is never a pass).
+*/
+/** `>=MAJOR.MINOR.PATCH[-prerelease]` — the only range shape a requirement uses. */
+var MinVersionSchema = string().regex(/^>=\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/, "a minimum is written \">=X.Y.Z\"");
+object({
+	/** The oldest `@camstack/server` this package runs on. */
+	server: MinVersionSchema.optional(),
+	/** The oldest installed version of each named addon package. */
+	addons: record(string(), MinVersionSchema).optional(),
+	/** The oldest shell around the server, per shell kind. */
+	wrapper: object({
+		desktop: MinVersionSchema.optional(),
+		image: MinVersionSchema.optional()
+	}).optional()
+});
+/** One unmet requirement; each names the versions on both sides. */
+var UnmetRequirementSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("server-too-old"),
+		required: string(),
+		/** `null` — the running server version could not be read. */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("addon-too-old"),
+		packageName: string(),
+		required: string(),
+		/** `null` — the addon is not installed (or its version is unreadable). */
+		running: string().nullable()
+	}),
+	object({
+		kind: literal("wrapper-too-old"),
+		wrapper: _enum(["desktop", "image"]),
+		required: string(),
+		/** `null` — the wrapper reported no version. */
+		running: string().nullable()
+	})
+]);
+var RequiredAddonUpdateSchema = object({
+	packageName: string(),
+	/** The minimum the target server declares. */
+	required: string(),
+	/** What this node has; `null` when the addon is not installed. */
+	installed: string().nullable()
+});
+/**
 * Which integration instance a settings form is for. An addon that serves several instances
 * (`instanceMode: multiple`) can show a different form per instance — an NVR integration
 * needs its connection, the default integration needs the addon's own sections.
@@ -43421,7 +43486,7 @@ var notificationOutputCapability = {
 * rebuilds without manual reload.
 *
 * The hub-local builtin `addon-pages-aggregator` (see
-* `@camstack/system/builtins/addon-pages-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-pages-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written
 * `addon-pages.router.ts` wrapper anymore.
@@ -43511,7 +43576,7 @@ var addonRoutesCapability = {
 		*/
 		invoke: method(InvokeRequestSchema, InvokeReplyEnvelopeSchema, { kind: "mutation" })
 	},
-	/** BIG PLAN 2: declarative mount hint — read by `@camstack/system` `buildCapRouters`. */
+	/** BIG PLAN 2: declarative mount hint — read by `@camstack/server/system` `buildCapRouters`. */
 	mount: { kind: "skip" }
 };
 var ConfigTabDeclarationSchema = object({
@@ -43740,7 +43805,7 @@ method(_void(), array(WidgetMetadataSchema).readonly(), { auth: "admin" });
 * manual reload — same scheme used by `addon-pages`.
 *
 * The hub-local builtin `addon-widgets-aggregator` (see
-* `@camstack/system/builtins/addon-widgets-aggregator`) registers the
+* `@camstack/server/system/builtins/addon-widgets-aggregator`) registers the
 * provider. Splitting the public aggregator from the raw collection
 * keeps both ends in codegen — there's no hand-written wrapper.
 */
@@ -61876,7 +61941,18 @@ var ServerUpdateActionResultSchema = object({
 	* store (D877), present when the pre-flight refused the update
 	* (`reason: 'addon-would-refuse'`). Optional for version skew.
 	*/
-	blockers: array(UpdateBlockerSchema).optional()
+	blockers: array(UpdateBlockerSchema).optional(),
+	/**
+	* The minimums the target server declares and this node does not meet
+	* (D989), present when the update was refused with
+	* `reason: 'requirements-unmet'`. Each names the versions on both sides.
+	*/
+	unmet: array(UnmetRequirementSchema).optional(),
+	/**
+	* The addons this node has below the minimum the staged server declares —
+	* the ones to update WITH the server. Present on an accepted update.
+	*/
+	requiredAddonUpdates: array(RequiredAddonUpdateSchema).optional()
 });
 var LaunchOverridesSchema = object({ 
 /** The persisted heap ceiling in MB, or `null` when none is set. */
@@ -64420,7 +64496,9 @@ var PackageUpdateSchema = object({
 	latestVersion: string(),
 	category: _enum(["addon", "core"]),
 	requiresRestart: boolean(),
-	isSystem: boolean()
+	isSystem: boolean(),
+	/** Held: what the newer version needs and this node does not meet (D989). */
+	blockedBy: array(UnmetRequirementSchema).readonly().optional()
 });
 var PackageVersionInfoSchema = object({
 	version: string(),
@@ -69720,7 +69798,7 @@ var lawnMowerControlCapability = {
 * clients — they reverse-connect to the hub. Exposing their interfaces
 * via the same surface would leak internal topology with no upside.
 *
-* Implementation in `@camstack/system/builtins/local-network/`.
+* Implementation in `@camstack/server/system/builtins/local-network/`.
 */
 /** Coarse classification derived from the interface name + IP range. */
 var InterfaceKindEnum = _enum([
@@ -71608,7 +71686,7 @@ onStatusChanged: { data: object({
 * jitter, and observed/peak bandwidth per device + per client.
 *
 * Implementation lives in the server's `NetworkQualityService` (thin
-* wrapper over the shared `NetworkQualityTracker` from `@camstack/system`).
+* wrapper over the shared `NetworkQualityTracker` from `@camstack/server/system`).
 * The provider is registered from `trpc.router.ts` against the existing
 * service instance — no addon owns this state.
 *
@@ -73759,7 +73837,7 @@ var ptzAutotrackCapability = {
 	*  - **Native**: the camera's own firmware autotrack, registered per device by
 	*    the driver when the probe says it exists (Reolink: yes; Hikvision:
 	*    model-dependent).
-	*  - **Wrapper**: the emulated implementation (`@camstack/system`'s `autotrack` builtin),
+	*  - **Wrapper**: the emulated implementation (`@camstack/server/system`'s `autotrack` builtin),
 	*    which follows a subject with `ptz.move` pulses driven by the detection
 	*    pipeline. `defaultActive: false` — the operator binds it per camera in
 	*    the bindings UI.
@@ -133160,6 +133238,7 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			_options.proxyLogLevel === "debug" && _options.logger && _options.logger(`Alexa-Cookie: Proxy-Request: (modified:${modified})${customStringify(proxyReq, null, 2)}`);
 		}
 		function onProxyRes(proxyRes, req, res) {
+			stripUpgradeInsecureRequestsHeaders(proxyRes);
 			const url = req.originalUrl || req.url;
 			if (url.endsWith(".ico") || url.endsWith(".js") || url.endsWith(".ttf") || url.endsWith(".svg") || url.endsWith(".png") || url.endsWith(".appcache")) return;
 			if (url.startsWith("/ap/uedata")) return;
@@ -133252,7 +133331,18 @@ var require_proxy = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			callbackListening = null;
 		});
 	}
+	function stripUpgradeInsecureRequestsHeaders(proxyRes) {
+		const headers = proxyRes && proxyRes.headers;
+		if (!headers) return;
+		for (const name of ["content-security-policy", "content-security-policy-report-only"]) {
+			if (headers[name] === void 0) continue;
+			const kept = (Array.isArray(headers[name]) ? headers[name] : [headers[name]]).map((v) => String(v).split(";").map((d) => d.trim()).filter((d) => d && !/^upgrade-insecure-requests$/i.test(d)).join("; ")).filter((v) => v);
+			if (kept.length) headers[name] = kept.length === 1 ? kept[0] : kept;
+			else delete headers[name];
+		}
+	}
 	module.exports.initAmazonProxy = initAmazonProxy;
+	module.exports.stripUpgradeInsecureRequestsHeaders = stripUpgradeInsecureRequestsHeaders;
 }));
 //#endregion
 //#region ../../node_modules/alexa-cookie2/alexa-cookie.js
@@ -140874,7 +140964,7 @@ var BrokerEcho = class {
 		try {
 			this.currentDevices = [...parseDevices(await this.deps.worker.request({ op: "devices" }))];
 		} catch (err) {
-			this.deps.logger.warn("alexa speak: device refresh failed", {
+			this.deps.logger.warn("alexa speak: step 3 of 3, device list failed after a good sign-in", {
 				tags: { brokerId: this.deps.brokerId },
 				meta: { error: err instanceof Error ? err.message : String(err) }
 			});
@@ -141404,6 +141494,7 @@ function createAlexaNotificationProvider(ports) {
 			return found;
 		},
 		async discoverTargets(input) {
+			for (const broker of ports.brokers()) if (!broker.ready) ports.logger.warn(`alexa echo discovery: no Echo listed for '${broker.name}', the Amazon account is not signed in for this broker`, { tags: { brokerId: broker.id } });
 			const named = readString(input.config ?? {}, "brokerId");
 			if (named.length > 0) {
 				const owner = ports.brokers().find((broker) => broker.id === named);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-import-alexa",
-  "version": "0.2.173",
+  "version": "0.2.175",
   "description": "Alexa device-import provider for CamStack — imports the smart-home devices in a user's Alexa account via the unofficial alexa-remote2 cookie/token client (the inverse of the Alexa exporter)",
   "keywords": [
     "camstack",
@@ -66,7 +66,10 @@
           "requirements": "./python/requirements.txt"
         }
       }
-    ]
+    ],
+    "requires": {
+      "server": ">=1.2.723"
+    }
   },
   "files": [
     "dist",

package/python/alexa_gateway.py

@@ -119,14 +119,32 @@ class AlexaPyGateway:
             bare_domain(domain), label, "", session_output(session_path), False, oauth=oauth
         )
         self._login = login
+        cookies: dict = {}
         if refresh_token != "":
             exchanged = await _exchange_refresh_token(login, device_app_name)
             if not exchanged:
-                return {"status": "failed", "error": "Amazon did not accept the broker's token"}
+                return {
+                    "status": "failed",
+                    "error": "step 1 of 3, token exchange: Amazon refused the broker's token",
+                }
             await login.save_cookiefile()
-        cookies = await login.load_cookie()
-        if not cookies:
-            return {"status": "failed", "error": "no Amazon session to start from"}
+            # The exchange put its cookies in the live session; use them as they are. Reading
+            # them back through the cookie file filters them by host and can come back empty.
+            cookies = _session_cookies(login)
+            if not cookies:
+                cookies = await login.load_cookie() or {}
+            if not cookies:
+                return {
+                    "status": "failed",
+                    "error": "step 2 of 3, cookies: the token exchange was accepted but returned no cookies",
+                }
+        else:
+            cookies = await login.load_cookie() or {}
+            if not cookies:
+                return {
+                    "status": "failed",
+                    "error": "step 2 of 3, cookies: no stored Amazon session and no broker token to start from",
+                }
         await login.login(cookies=cookies)
         await self._persist_session()
         return self._status_result()
@@ -213,6 +231,22 @@ def _import_alexapy():
     return AlexaLogin, AlexaAPI
 
 
+def _session_cookies(login) -> dict:
+    """Every cookie the login's live session holds, by name. Values only leave this process
+    inside the library; nothing here logs them."""
+    session = getattr(login, "_session", None)
+    jar = getattr(session, "cookie_jar", None)
+    found: dict = {}
+    if jar is None:
+        return found
+    for morsel in jar:
+        name = getattr(morsel, "key", None)
+        value = getattr(morsel, "value", None)
+        if isinstance(name, str) and isinstance(value, str) and name != "":
+            found[name] = value.strip('"')
+    return found
+
+
 async def _exchange_refresh_token(login, device_app_name: str) -> bool:
     """Trade the broker's refresh token for cookies, under the name that token was registered with."""
     import alexapy.alexalogin as module

package/python/test_alexa_gateway.py

@@ -19,7 +19,9 @@ sys.path.insert(0, str(Path(__file__).resolve().parent))
 from alexa_gateway import AlexaPyGateway, bare_domain, normalize_device, session_output
 
 
-def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None = None):
+def install_fake_alexapy(
+    exchange_ok: bool = True, stored_cookies: dict | None = None, file_readback: bool = True
+):
     """Put a fake `alexapy` (and `alexapy.alexalogin`) in sys.modules; return the call log."""
     calls: dict = {"exchange_app_names": [], "logins": [], "saved": 0}
     module = types.ModuleType("alexapy.alexalogin")
@@ -34,10 +36,13 @@ def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None =
             calls["jar_path"] = outputpath(".storage/alexa_media.x.pickle")
             self.status = {"login_successful": True}
             self.refresh_token = (oauth or {}).get("refresh_token")
+            self._session = types.SimpleNamespace(cookie_jar=[])
 
         async def exchange_token_for_cookies(self):
             calls["exchange_app_names"].append(module.APP_NAME)
             calls["exchanged_token"] = self.refresh_token
+            if exchange_ok:
+                self._session.cookie_jar.append(types.SimpleNamespace(key="session-id", value="1"))
             return exchange_ok
 
         async def save_cookiefile(self):
@@ -45,7 +50,9 @@ def install_fake_alexapy(exchange_ok: bool = True, stored_cookies: dict | None =
             Path(calls["jar_path"]).write_bytes(b"jar")
 
         async def load_cookie(self):
-            return {"session-id": "1"} if (exchange_ok or stored_cookies) else {}
+            if stored_cookies:
+                return stored_cookies
+            return {"session-id": "1"} if (exchange_ok and file_readback) else {}
 
         async def login(self, cookies=None, data=None):
             calls["logins"].append(cookies)
@@ -68,6 +75,10 @@ def run(coro):
     return asyncio.run(coro)
 
 
+async def _accept_without_cookies(self):
+    return True
+
+
 class GatewayTests(unittest.TestCase):
     def tearDown(self) -> None:
         remove_fake_alexapy()
@@ -113,6 +124,27 @@ class GatewayTests(unittest.TestCase):
         self.assertEqual(calls["logins"], [])
         self.assertEqual(module.APP_NAME, "Alexa Media Player")
 
+    def test_cookies_from_the_exchange_are_used_when_the_file_reads_back_empty(self) -> None:
+        calls, _ = install_fake_alexapy(file_readback=False)
+        with tempfile.TemporaryDirectory() as directory:
+            result = run(
+                AlexaPyGateway().login_broker("alexa_002", "t", "", "amazon.com", "NA", str(Path(directory) / "s"))
+            )
+        self.assertEqual(result, {"status": "ok"})
+        self.assertEqual(calls["logins"], [{"session-id": "1"}])
+
+    def test_an_exchange_that_yields_no_cookies_names_its_step(self) -> None:
+        calls, _ = install_fake_alexapy(file_readback=False)
+        sys.modules["alexapy"].AlexaLogin.exchange_token_for_cookies = _accept_without_cookies
+        with tempfile.TemporaryDirectory() as directory:
+            result = run(
+                AlexaPyGateway().login_broker("alexa_002", "t", "", "amazon.com", "NA", str(Path(directory) / "s"))
+            )
+        self.assertEqual(result["status"], "failed")
+        self.assertIn("cookies", result["error"])
+        self.assertIn("exchange was accepted", result["error"])
+        self.assertEqual(calls["logins"], [])
+
     def test_with_no_token_only_the_stored_jar_is_tried(self) -> None:
         calls, _ = install_fake_alexapy(stored_cookies={"session-id": "1"})
         with tempfile.TemporaryDirectory() as directory: