@camstack/addon-google-services 0.1.1 → 0.1.3

package/dist/google-services.addon.js

@@ -18195,14 +18195,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough$2
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19323,7 +19323,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough = unknown();
+var ConfigSchemaPassthrough$1 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19360,7 +19360,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
+	configSchema: ConfigSchemaPassthrough$1,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -28708,15 +28708,28 @@ var SmtpStatusSchema = object({
 	/** Last successful verify timestamp (unix ms). */
 	lastVerifiedAt: number().optional()
 });
-method(SendEmailInputSchema, SendEmailResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(_void(), SmtpStatusSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
-}), method(_void(), SmtpStatusSchema, { auth: "admin" });
+var smtpProviderCapability = {
+	name: "smtp-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	providerKind: "email",
+	methods: {
+		sendEmail: method(SendEmailInputSchema, SendEmailResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Round-trip ping against the SMTP relay (EHLO + AUTH if configured).
+		*  Used by the operator's "Test connection" button. */
+		verify: method(_void(), SmtpStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		getStatus: method(_void(), SmtpStatusSchema, { auth: "admin" })
+	}
+};
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
 *
@@ -31683,6 +31696,7 @@ var calendarSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
+	providerKind: "calendar",
 	methods: {
 		listCalendars: method(_void(), array(CalendarInfoSchema).readonly(), { auth: "admin" }),
 		listEvents: method(CalendarListEventsInputSchema, array(CalendarEventSchema).readonly(), { auth: "admin" })
@@ -35164,6 +35178,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39487,6 +39502,12 @@ var TrainingProviderDefaultsSchema = object({
 	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
 	failedDatasetGraceHours: number().nonnegative()
 });
+/**
+* Entry form schema for a provider type — same seam as notification
+* `TargetKind.configSchema` (`z.unknown()` at the wire; callers tighten to
+* {@link ConfigUISchema}). Drives `ConfigFormBuilder` on Training → Providers.
+*/
+var ConfigSchemaPassthrough = unknown();
 /** One creatable provider type, for the Add-entry dialog. */
 var TrainingProviderTypeSchema = object({
 	typeId: string(),
@@ -39494,7 +39515,13 @@ var TrainingProviderTypeSchema = object({
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
 	/** Owning `training-provider` addon — collection selector for createEntry. */
-	addonId: string()
+	addonId: string(),
+	/**
+	* Fields for one entry of this type (credentials + defaults). Absent on a
+	* type that only needs a name. Password fields are keychain-backed on the
+	* provider addon (`secretStatePaths`), not D634 plaintext.
+	*/
+	configSchema: ConfigSchemaPassthrough.optional()
 });
 /** One configured account / workspace under a provider type. */
 var TrainingProviderEntrySchema = object({
@@ -39524,7 +39551,30 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+	* fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+	* never plaintext. Same hydrate contract as settings forms (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39594,6 +39644,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -47155,6 +47208,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -51700,6 +51759,7 @@ Object.freeze({
 });
 Object.freeze({
 	"broker": "broker",
+	"calendar-source": "calendar",
 	"device-export": "device-export",
 	"llm": "ai",
 	"mesh-network": "mesh",
@@ -52744,7 +52804,12 @@ var GoogleServicesConfigSchema = object({
 	clientId: string().default(""),
 	clientSecret: string().default("").meta({ secret: true }),
 	/** Comma-separated Google calendar ids to expose; empty = all. */
-	calendarFilter: string().default("")
+	calendarFilter: string().default(""),
+	/** Offer Gmail send via `smtp-provider` (same OAuth account). */
+	gmailSendEnabled: boolean().default(false),
+	/** Default From for Gmail send — usually the connected account email. */
+	fromAddress: string().default(""),
+	fromName: string().default("")
 });
 var DEFAULT_GOOGLE_CONFIG = GoogleServicesConfigSchema.parse({});
 var DEFAULT_OAUTH_STATE = {
@@ -52754,9 +52819,14 @@ var DEFAULT_OAUTH_STATE = {
 	accountEmail: ""
 };
 var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
+var GOOGLE_GMAIL_SEND_SCOPE = "https://www.googleapis.com/auth/gmail.send";
+/** Space-separated scopes requested on Connect (Calendar read + Gmail send). */
+var GOOGLE_OAUTH_SCOPES = `${GOOGLE_CALENDAR_SCOPE} ${GOOGLE_GMAIL_SEND_SCOPE}`;
 var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_CALENDAR_API = "https://www.googleapis.com/calendar/v3";
+var GOOGLE_GMAIL_API = "https://gmail.googleapis.com/gmail/v1";
+var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
 //#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
@@ -52859,6 +52929,148 @@ function createGoogleCalendarSource(deps) {
 	};
 }
 //#endregion
+//#region src/google-gmail-smtp.ts
+function encodeBase64Url(bytes) {
+	return Buffer.from(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function encodeHeaderWord(value) {
+	if (/^[\x20-\x7E]*$/.test(value)) return value;
+	return `=?UTF-8?B?${Buffer.from(value, "utf8").toString("base64")}?=`;
+}
+function formatAddressList(addrs) {
+	return (Array.isArray(addrs) ? addrs : [addrs]).join(", ");
+}
+function buildFromHeader(cfg, accountEmail) {
+	const addr = cfg.fromAddress.trim() || accountEmail;
+	if (!addr) return "";
+	if (cfg.fromName.trim()) return `${encodeHeaderWord(cfg.fromName.trim())} <${addr}>`;
+	return addr;
+}
+/** Build a minimal multipart/alternative-capable plain (and optional HTML) message. */
+function buildRawMime(input) {
+	const lines = [`From: ${input.from}`, `To: ${formatAddressList(input.to)}`];
+	if (input.cc !== void 0 && input.cc.length > 0) lines.push(`Cc: ${formatAddressList(input.cc)}`);
+	if (input.bcc !== void 0 && input.bcc.length > 0) lines.push(`Bcc: ${formatAddressList(input.bcc)}`);
+	if (input.replyTo !== void 0 && input.replyTo.length > 0) lines.push(`Reply-To: ${input.replyTo}`);
+	lines.push(`Subject: ${encodeHeaderWord(input.subject)}`);
+	lines.push("MIME-Version: 1.0");
+	if (input.html !== void 0 && input.html.length > 0) {
+		const boundary = `camstack_${Date.now().toString(36)}`;
+		lines.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+		lines.push("");
+		lines.push(`--${boundary}`);
+		lines.push("Content-Type: text/plain; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.text);
+		lines.push(`--${boundary}`);
+		lines.push("Content-Type: text/html; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.html);
+		lines.push(`--${boundary}--`);
+	} else {
+		lines.push("Content-Type: text/plain; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.text);
+	}
+	return lines.join("\r\n");
+}
+function createGmailSmtpProvider(deps) {
+	const http = deps.fetch ?? fetch;
+	let lastVerifiedAt;
+	let lastError;
+	const status = () => {
+		const cfg = deps.getConfig();
+		const email = deps.getAccountEmail() || cfg.fromAddress.trim() || "gmail";
+		if (!cfg.gmailSendEnabled) return {
+			ready: false,
+			host: email,
+			error: "Gmail send is disabled in Google Services settings.",
+			lastVerifiedAt
+		};
+		if (!deps.connected()) return {
+			ready: false,
+			host: email,
+			error: "Google account is not connected — open Connect Google.",
+			lastVerifiedAt
+		};
+		return {
+			ready: lastError === void 0 && lastVerifiedAt !== void 0,
+			host: email,
+			error: lastError,
+			lastVerifiedAt
+		};
+	};
+	return {
+		getStatus: async () => status(),
+		verify: async () => {
+			if (!deps.getConfig().gmailSendEnabled) {
+				lastError = "Gmail send is disabled in Google Services settings.";
+				return status();
+			}
+			if (!deps.connected()) {
+				lastError = "Google account is not connected.";
+				return status();
+			}
+			try {
+				const token = await deps.getAccessToken();
+				const res = await http(`${GOOGLE_GMAIL_API}/users/me/profile`, { headers: { Authorization: `Bearer ${token}` } });
+				if (!res.ok) {
+					const text = await res.text();
+					lastError = `Gmail profile failed (${res.status}): ${text.slice(0, 200)}`;
+					return status();
+				}
+				lastError = void 0;
+				lastVerifiedAt = Date.now();
+				return status();
+			} catch (err) {
+				lastError = err instanceof Error ? err.message : String(err);
+				return status();
+			}
+		},
+		sendEmail: async (input) => {
+			const cfg = deps.getConfig();
+			if (!cfg.gmailSendEnabled) throw new Error("Gmail send is disabled in Google Services settings.");
+			if (!deps.connected()) throw new Error("Google account is not connected — open Connect Google.");
+			const from = input.from?.trim() || buildFromHeader(cfg, deps.getAccountEmail());
+			if (!from) throw new Error("Set From address in Google Services settings (or connect an account).");
+			const raw = buildRawMime({
+				from,
+				to: input.to,
+				cc: input.cc,
+				bcc: input.bcc,
+				replyTo: input.replyTo,
+				subject: input.subject,
+				text: input.text,
+				html: input.html
+			});
+			const token = await deps.getAccessToken();
+			const res = await http(`${GOOGLE_GMAIL_API}/users/me/messages/send`, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ raw: encodeBase64Url(Buffer.from(raw, "utf8")) })
+			});
+			if (!res.ok) {
+				const text = await res.text();
+				throw new Error(`Gmail send failed (${res.status}): ${text.slice(0, 400)}`);
+			}
+			const messageId = (await res.json()).id ?? `gmail-${Date.now()}`;
+			lastError = void 0;
+			lastVerifiedAt = Date.now();
+			return {
+				messageId,
+				accepted: [...Array.isArray(input.to) ? input.to : [input.to]],
+				rejected: []
+			};
+		}
+	};
+}
+//#endregion
 //#region src/google-oauth.ts
 /**
 * Google OAuth2 authorization-code + refresh for Calendar API.
@@ -52868,7 +53080,7 @@ function buildAuthorizeUrl(cfg, state) {
 	u.searchParams.set("client_id", cfg.clientId);
 	u.searchParams.set("redirect_uri", cfg.redirectUri);
 	u.searchParams.set("response_type", "code");
-	u.searchParams.set("scope", GOOGLE_CALENDAR_SCOPE);
+	u.searchParams.set("scope", GOOGLE_OAUTH_SCOPES);
 	u.searchParams.set("access_type", "offline");
 	u.searchParams.set("prompt", "consent");
 	u.searchParams.set("state", state);
@@ -52926,9 +53138,19 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/oauth-redirect-origin.ts
+/**
+* Google OAuth redirect origin — same role as hub OAuth2 / sign-in
+* (`local-network` cap: `roles.publicEndpoint`), never `internal` (LAN / agents).
+* Google rejects non-localhost `http://` redirect URIs for Web clients.
+*/
+function pickOauthRedirectOrigin(book) {
+	return book.roles.publicEndpoint.resolved ?? book.roles.internal.resolved ?? null;
+}
+//#endregion
 //#region src/google-services.addon.ts
 /**
-* Google Services — hub-only calendar-source over Google Calendar API (OAuth2).
+* Google Services — hub-only calendar-source + Gmail smtp-provider (same OAuth2).
 */
 var ADDON_ID = "google-services";
 var CALLBACK_PATH = "/oauth/callback";
@@ -52952,17 +53174,23 @@ var GoogleServicesAddon = class extends BaseAddon {
 		this.oauthHandle = this.state("oauth", OauthStateSchema, { ...DEFAULT_OAUTH_STATE });
 		this.oauth = await this.oauthHandle.get();
 		const api = createGoogleCalendarApi(async () => this.ensureAccessToken());
-		const provider = createGoogleCalendarSource({
+		const calendarProvider = createGoogleCalendarSource({
 			logger: this.ctx.logger,
 			api,
 			connected: () => this.oauth.refreshToken.length > 0,
 			filterIds: () => this.parseFilter()
 		});
+		const smtpProvider = createGmailSmtpProvider({
+			getAccessToken: () => this.ensureAccessToken(),
+			getConfig: () => this.config,
+			getAccountEmail: () => this.oauth.accountEmail,
+			connected: () => this.oauth.refreshToken.length > 0
+		});
 		const routeProvider = buildAddonRouteProvider(ADDON_ID, [{
 			method: "GET",
 			path: START_PATH,
 			access: "admin",
-			description: "Begin Google Calendar OAuth",
+			description: "Begin Google OAuth (Calendar + Gmail send)",
 			handler: async (_req, reply) => this.handleStart(reply)
 		}, {
 			method: "GET",
@@ -52972,17 +53200,25 @@ var GoogleServicesAddon = class extends BaseAddon {
 			description: "Google OAuth callback",
 			handler: async (req, reply) => this.handleCallback(req, reply)
 		}]);
-		this.ctx.logger.info("Initialized — google calendar-source", { meta: {
+		this.ctx.logger.info("Initialized — google calendar-source + gmail smtp", { meta: {
 			connected: this.oauth.refreshToken.length > 0,
-			accountEmail: this.oauth.accountEmail || void 0
+			accountEmail: this.oauth.accountEmail || void 0,
+			gmailSendEnabled: this.config.gmailSendEnabled
 		} });
-		return { providers: [{
-			capability: calendarSourceCapability,
-			provider
-		}, {
-			capability: addonRoutesCapability,
-			provider: routeProvider
-		}] };
+		return { providers: [
+			{
+				capability: calendarSourceCapability,
+				provider: calendarProvider
+			},
+			{
+				capability: smtpProviderCapability,
+				provider: smtpProvider
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: routeProvider
+			}
+		] };
 	}
 	async handleStart(reply) {
 		if (!this.config.clientId || !this.config.clientSecret) {
@@ -53028,15 +53264,33 @@ var GoogleServicesAddon = class extends BaseAddon {
 			}, code);
 			if (!tokens.refresh_token && !this.oauth.refreshToken) throw new Error("Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
 			this.oauth = applyTokenResponse(this.oauth, tokens);
+			const email = await this.fetchAccountEmail(this.oauth.accessToken);
+			if (email) this.oauth = {
+				...this.oauth,
+				accountEmail: email
+			};
 			await this.persistOauth();
-			this.ctx.logger.info("google oauth connected", { meta: { hasRefresh: this.oauth.refreshToken.length > 0 } });
-			this.html(reply, 200, "Google Calendar connected. You can close this window.");
+			this.ctx.logger.info("google oauth connected", { meta: {
+				hasRefresh: this.oauth.refreshToken.length > 0,
+				accountEmail: this.oauth.accountEmail || void 0
+			} });
+			this.html(reply, 200, "Google account connected (Calendar + Gmail send). You can close this window.");
 		} catch (e) {
 			const message = e instanceof Error ? e.message : String(e);
 			this.ctx.logger.warn("google oauth callback failed", { meta: { error: message } });
 			this.html(reply, 500, `OAuth failed: ${message}`);
 		}
 	}
+	async fetchAccountEmail(accessToken) {
+		try {
+			const res = await fetch(GOOGLE_USERINFO_URL, { headers: { Authorization: `Bearer ${accessToken}` } });
+			if (!res.ok) return "";
+			const body = await res.json();
+			return typeof body.email === "string" ? body.email.trim() : "";
+		} catch {
+			return "";
+		}
+	}
 	html(reply, code, body) {
 		reply.header("content-type", "text/html; charset=utf-8");
 		reply.status(code).send(`<!doctype html><html><body><p>${escapeHtml(body)}</p></body></html>`);
@@ -53066,16 +53320,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const book = await this.ctx.api.localNetwork.getAddresses.query({});
-		const origin = book.roles.internal.resolved ?? book.roles.publicEndpoint.resolved ?? null;
-		if (!origin) throw new Error("No hub address available from local-network — set an Internal address on the Network page.");
+		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
+		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
 		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "google-oauth",
-			title: "Google Calendar OAuth",
-			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<hub>/addon/google-services/oauth/callback` (hub = Internal address from Network).",
+			title: "Google OAuth",
+			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API and Gmail API enabled. Connect grants both Calendar read and Gmail send on the same account. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
 			columns: 1,
 			fields: [
 				{
@@ -53100,7 +53353,31 @@ var GoogleServicesAddon = class extends BaseAddon {
 					key: "_connectInfo",
 					label: "Connect",
 					format: "html",
-					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin.`
+					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>). If you connected before Gmail send was added, revoke CamStack in Google Account security and reconnect so the refresh token includes <code>gmail.send</code>.`
+				}
+			]
+		}, {
+			id: "gmail-send",
+			title: "Gmail send",
+			description: "Optional email delivery via the Gmail API (`smtp-provider`). Uses the same OAuth account — From must be that account or a verified send-as alias.",
+			columns: 1,
+			fields: [
+				{
+					type: "boolean",
+					key: "gmailSendEnabled",
+					label: "Enable Gmail send",
+					description: "When off, Calendar still works; this addon reports smtp-provider not ready."
+				},
+				{
+					type: "text",
+					key: "fromAddress",
+					label: "From address",
+					description: "Defaults to the connected Google account email when empty."
+				},
+				{
+					type: "text",
+					key: "fromName",
+					label: "From display name (optional)"
 				}
 			]
 		}] });
@@ -53111,11 +53388,15 @@ function escapeHtml(s) {
 }
 //#endregion
 exports.DEFAULT_GOOGLE_CONFIG = DEFAULT_GOOGLE_CONFIG;
+exports.GOOGLE_GMAIL_SEND_SCOPE = GOOGLE_GMAIL_SEND_SCOPE;
+exports.GOOGLE_OAUTH_SCOPES = GOOGLE_OAUTH_SCOPES;
 exports.GoogleServicesAddon = GoogleServicesAddon;
 exports.default = GoogleServicesAddon;
 exports.GoogleServicesConfigSchema = GoogleServicesConfigSchema;
 exports.applyTokenResponse = applyTokenResponse;
 exports.buildAuthorizeUrl = buildAuthorizeUrl;
+exports.buildRawMime = buildRawMime;
+exports.createGmailSmtpProvider = createGmailSmtpProvider;
 exports.createGoogleCalendarApi = createGoogleCalendarApi;
 exports.createGoogleCalendarSource = createGoogleCalendarSource;
 exports.exchangeCode = exchangeCode;

package/dist/google-services.addon.mjs

@@ -18191,14 +18191,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$1
+	configSchema: ConfigSchemaPassthrough$2
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19319,7 +19319,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough = unknown();
+var ConfigSchemaPassthrough$1 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19356,7 +19356,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough,
+	configSchema: ConfigSchemaPassthrough$1,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -28704,15 +28704,28 @@ var SmtpStatusSchema = object({
 	/** Last successful verify timestamp (unix ms). */
 	lastVerifiedAt: number().optional()
 });
-method(SendEmailInputSchema, SendEmailResultSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "create"
-}), method(_void(), SmtpStatusSchema, {
-	kind: "mutation",
-	auth: "admin",
-	access: "view"
-}), method(_void(), SmtpStatusSchema, { auth: "admin" });
+var smtpProviderCapability = {
+	name: "smtp-provider",
+	scope: "system",
+	mode: "collection",
+	internal: true,
+	providerKind: "email",
+	methods: {
+		sendEmail: method(SendEmailInputSchema, SendEmailResultSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "create"
+		}),
+		/** Round-trip ping against the SMTP relay (EHLO + AUTH if configured).
+		*  Used by the operator's "Test connection" button. */
+		verify: method(_void(), SmtpStatusSchema, {
+			kind: "mutation",
+			auth: "admin",
+			access: "view"
+		}),
+		getStatus: method(_void(), SmtpStatusSchema, { auth: "admin" })
+	}
+};
 /**
 * A single device snapshot returned as base64 JPEG/PNG.
 *
@@ -31679,6 +31692,7 @@ var calendarSourceCapability = {
 	scope: "system",
 	mode: "collection",
 	internal: true,
+	providerKind: "calendar",
 	methods: {
 		listCalendars: method(_void(), array(CalendarInfoSchema).readonly(), { auth: "admin" }),
 		listEvents: method(CalendarListEventsInputSchema, array(CalendarEventSchema).readonly(), { auth: "admin" })
@@ -35160,6 +35174,7 @@ var OsdNamedTemplateSchema = object({
 });
 /** Where a slot's value comes from. */
 var OsdSourceSchema = discriminatedUnion("kind", [
+	object({ kind: literal("none") }),
 	object({
 		kind: literal("static"),
 		text: string().max(64)
@@ -39483,6 +39498,12 @@ var TrainingProviderDefaultsSchema = object({
 	/** Hours a FAILED job's cloud dataset is kept for debugging; 0 = delete at once. */
 	failedDatasetGraceHours: number().nonnegative()
 });
+/**
+* Entry form schema for a provider type — same seam as notification
+* `TargetKind.configSchema` (`z.unknown()` at the wire; callers tighten to
+* {@link ConfigUISchema}). Drives `ConfigFormBuilder` on Training → Providers.
+*/
+var ConfigSchemaPassthrough = unknown();
 /** One creatable provider type, for the Add-entry dialog. */
 var TrainingProviderTypeSchema = object({
 	typeId: string(),
@@ -39490,7 +39511,13 @@ var TrainingProviderTypeSchema = object({
 	/** Path under the addon package (e.g. `assets/training-modal/icon.svg`). */
 	iconAsset: string(),
 	/** Owning `training-provider` addon — collection selector for createEntry. */
-	addonId: string()
+	addonId: string(),
+	/**
+	* Fields for one entry of this type (credentials + defaults). Absent on a
+	* type that only needs a name. Password fields are keychain-backed on the
+	* provider addon (`secretStatePaths`), not D634 plaintext.
+	*/
+	configSchema: ConfigSchemaPassthrough.optional()
 });
 /** One configured account / workspace under a provider type. */
 var TrainingProviderEntrySchema = object({
@@ -39520,7 +39547,30 @@ var TrainingProviderDescriptorSchema = object({
 	dataResidencyNote: string(),
 	/** Credentials are present — never the values. */
 	configured: boolean(),
-	defaults: TrainingProviderDefaultsSchema
+	defaults: TrainingProviderDefaultsSchema,
+	/**
+	* Values for {@link TrainingProviderTypeSchema}'s `configSchema` — password
+	* fields are keychain {@link SecretFieldView} or `null` / `''` (create),
+	* never plaintext. Same hydrate contract as settings forms (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one entry's name, credentials and defaults. Pin with owning `{ addonId }`.
+* An omitted or empty `tokenSecret` means KEEP the stored secret (D787).
+* `{ $secretClear: true }` clears it.
+*/
+var TrainingProviderUpdateEntryInputSchema = object({
+	entryId: string().min(1),
+	name: string().min(1),
+	tokenId: string().optional(),
+	tokenSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	environment: string().optional(),
+	gpuType: string().optional(),
+	region: string().optional(),
+	costCapUsd: number().nonnegative().optional(),
+	maxRuntimeSec: number().int().positive().optional(),
+	failedDatasetGraceHours: number().nonnegative().optional()
 });
 var TrainingCredentialCheckSchema = object({
 	ok: boolean(),
@@ -39590,6 +39640,9 @@ method(object({}), array(TrainingProviderDescriptorSchema).readonly(), { auth: "
 }), method(object({ entryId: string().min(1) }), object({ ok: literal(true) }), {
 	kind: "mutation",
 	auth: "admin"
+}), method(TrainingProviderUpdateEntryInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
 }), method(object({ entryId: string().min(1) }), TrainingCredentialCheckSchema, {
 	kind: "mutation",
 	auth: "admin",
@@ -47151,6 +47204,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"trainingProvider.updateEntry": {
+		capName: "training-provider",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"trainingProvider.uploadDataset": {
 		capName: "training-provider",
 		capScope: "system",
@@ -51696,6 +51755,7 @@ Object.freeze({
 });
 Object.freeze({
 	"broker": "broker",
+	"calendar-source": "calendar",
 	"device-export": "device-export",
 	"llm": "ai",
 	"mesh-network": "mesh",
@@ -52740,7 +52800,12 @@ var GoogleServicesConfigSchema = object({
 	clientId: string().default(""),
 	clientSecret: string().default("").meta({ secret: true }),
 	/** Comma-separated Google calendar ids to expose; empty = all. */
-	calendarFilter: string().default("")
+	calendarFilter: string().default(""),
+	/** Offer Gmail send via `smtp-provider` (same OAuth account). */
+	gmailSendEnabled: boolean().default(false),
+	/** Default From for Gmail send — usually the connected account email. */
+	fromAddress: string().default(""),
+	fromName: string().default("")
 });
 var DEFAULT_GOOGLE_CONFIG = GoogleServicesConfigSchema.parse({});
 var DEFAULT_OAUTH_STATE = {
@@ -52750,9 +52815,14 @@ var DEFAULT_OAUTH_STATE = {
 	accountEmail: ""
 };
 var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
+var GOOGLE_GMAIL_SEND_SCOPE = "https://www.googleapis.com/auth/gmail.send";
+/** Space-separated scopes requested on Connect (Calendar read + Gmail send). */
+var GOOGLE_OAUTH_SCOPES = `${GOOGLE_CALENDAR_SCOPE} ${GOOGLE_GMAIL_SEND_SCOPE}`;
 var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_CALENDAR_API = "https://www.googleapis.com/calendar/v3";
+var GOOGLE_GMAIL_API = "https://gmail.googleapis.com/gmail/v1";
+var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
 //#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
@@ -52855,6 +52925,148 @@ function createGoogleCalendarSource(deps) {
 	};
 }
 //#endregion
+//#region src/google-gmail-smtp.ts
+function encodeBase64Url(bytes) {
+	return Buffer.from(bytes).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function encodeHeaderWord(value) {
+	if (/^[\x20-\x7E]*$/.test(value)) return value;
+	return `=?UTF-8?B?${Buffer.from(value, "utf8").toString("base64")}?=`;
+}
+function formatAddressList(addrs) {
+	return (Array.isArray(addrs) ? addrs : [addrs]).join(", ");
+}
+function buildFromHeader(cfg, accountEmail) {
+	const addr = cfg.fromAddress.trim() || accountEmail;
+	if (!addr) return "";
+	if (cfg.fromName.trim()) return `${encodeHeaderWord(cfg.fromName.trim())} <${addr}>`;
+	return addr;
+}
+/** Build a minimal multipart/alternative-capable plain (and optional HTML) message. */
+function buildRawMime(input) {
+	const lines = [`From: ${input.from}`, `To: ${formatAddressList(input.to)}`];
+	if (input.cc !== void 0 && input.cc.length > 0) lines.push(`Cc: ${formatAddressList(input.cc)}`);
+	if (input.bcc !== void 0 && input.bcc.length > 0) lines.push(`Bcc: ${formatAddressList(input.bcc)}`);
+	if (input.replyTo !== void 0 && input.replyTo.length > 0) lines.push(`Reply-To: ${input.replyTo}`);
+	lines.push(`Subject: ${encodeHeaderWord(input.subject)}`);
+	lines.push("MIME-Version: 1.0");
+	if (input.html !== void 0 && input.html.length > 0) {
+		const boundary = `camstack_${Date.now().toString(36)}`;
+		lines.push(`Content-Type: multipart/alternative; boundary="${boundary}"`);
+		lines.push("");
+		lines.push(`--${boundary}`);
+		lines.push("Content-Type: text/plain; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.text);
+		lines.push(`--${boundary}`);
+		lines.push("Content-Type: text/html; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.html);
+		lines.push(`--${boundary}--`);
+	} else {
+		lines.push("Content-Type: text/plain; charset=\"UTF-8\"");
+		lines.push("Content-Transfer-Encoding: 8bit");
+		lines.push("");
+		lines.push(input.text);
+	}
+	return lines.join("\r\n");
+}
+function createGmailSmtpProvider(deps) {
+	const http = deps.fetch ?? fetch;
+	let lastVerifiedAt;
+	let lastError;
+	const status = () => {
+		const cfg = deps.getConfig();
+		const email = deps.getAccountEmail() || cfg.fromAddress.trim() || "gmail";
+		if (!cfg.gmailSendEnabled) return {
+			ready: false,
+			host: email,
+			error: "Gmail send is disabled in Google Services settings.",
+			lastVerifiedAt
+		};
+		if (!deps.connected()) return {
+			ready: false,
+			host: email,
+			error: "Google account is not connected — open Connect Google.",
+			lastVerifiedAt
+		};
+		return {
+			ready: lastError === void 0 && lastVerifiedAt !== void 0,
+			host: email,
+			error: lastError,
+			lastVerifiedAt
+		};
+	};
+	return {
+		getStatus: async () => status(),
+		verify: async () => {
+			if (!deps.getConfig().gmailSendEnabled) {
+				lastError = "Gmail send is disabled in Google Services settings.";
+				return status();
+			}
+			if (!deps.connected()) {
+				lastError = "Google account is not connected.";
+				return status();
+			}
+			try {
+				const token = await deps.getAccessToken();
+				const res = await http(`${GOOGLE_GMAIL_API}/users/me/profile`, { headers: { Authorization: `Bearer ${token}` } });
+				if (!res.ok) {
+					const text = await res.text();
+					lastError = `Gmail profile failed (${res.status}): ${text.slice(0, 200)}`;
+					return status();
+				}
+				lastError = void 0;
+				lastVerifiedAt = Date.now();
+				return status();
+			} catch (err) {
+				lastError = err instanceof Error ? err.message : String(err);
+				return status();
+			}
+		},
+		sendEmail: async (input) => {
+			const cfg = deps.getConfig();
+			if (!cfg.gmailSendEnabled) throw new Error("Gmail send is disabled in Google Services settings.");
+			if (!deps.connected()) throw new Error("Google account is not connected — open Connect Google.");
+			const from = input.from?.trim() || buildFromHeader(cfg, deps.getAccountEmail());
+			if (!from) throw new Error("Set From address in Google Services settings (or connect an account).");
+			const raw = buildRawMime({
+				from,
+				to: input.to,
+				cc: input.cc,
+				bcc: input.bcc,
+				replyTo: input.replyTo,
+				subject: input.subject,
+				text: input.text,
+				html: input.html
+			});
+			const token = await deps.getAccessToken();
+			const res = await http(`${GOOGLE_GMAIL_API}/users/me/messages/send`, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${token}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({ raw: encodeBase64Url(Buffer.from(raw, "utf8")) })
+			});
+			if (!res.ok) {
+				const text = await res.text();
+				throw new Error(`Gmail send failed (${res.status}): ${text.slice(0, 400)}`);
+			}
+			const messageId = (await res.json()).id ?? `gmail-${Date.now()}`;
+			lastError = void 0;
+			lastVerifiedAt = Date.now();
+			return {
+				messageId,
+				accepted: [...Array.isArray(input.to) ? input.to : [input.to]],
+				rejected: []
+			};
+		}
+	};
+}
+//#endregion
 //#region src/google-oauth.ts
 /**
 * Google OAuth2 authorization-code + refresh for Calendar API.
@@ -52864,7 +53076,7 @@ function buildAuthorizeUrl(cfg, state) {
 	u.searchParams.set("client_id", cfg.clientId);
 	u.searchParams.set("redirect_uri", cfg.redirectUri);
 	u.searchParams.set("response_type", "code");
-	u.searchParams.set("scope", GOOGLE_CALENDAR_SCOPE);
+	u.searchParams.set("scope", GOOGLE_OAUTH_SCOPES);
 	u.searchParams.set("access_type", "offline");
 	u.searchParams.set("prompt", "consent");
 	u.searchParams.set("state", state);
@@ -52922,9 +53134,19 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/oauth-redirect-origin.ts
+/**
+* Google OAuth redirect origin — same role as hub OAuth2 / sign-in
+* (`local-network` cap: `roles.publicEndpoint`), never `internal` (LAN / agents).
+* Google rejects non-localhost `http://` redirect URIs for Web clients.
+*/
+function pickOauthRedirectOrigin(book) {
+	return book.roles.publicEndpoint.resolved ?? book.roles.internal.resolved ?? null;
+}
+//#endregion
 //#region src/google-services.addon.ts
 /**
-* Google Services — hub-only calendar-source over Google Calendar API (OAuth2).
+* Google Services — hub-only calendar-source + Gmail smtp-provider (same OAuth2).
 */
 var ADDON_ID = "google-services";
 var CALLBACK_PATH = "/oauth/callback";
@@ -52948,17 +53170,23 @@ var GoogleServicesAddon = class extends BaseAddon {
 		this.oauthHandle = this.state("oauth", OauthStateSchema, { ...DEFAULT_OAUTH_STATE });
 		this.oauth = await this.oauthHandle.get();
 		const api = createGoogleCalendarApi(async () => this.ensureAccessToken());
-		const provider = createGoogleCalendarSource({
+		const calendarProvider = createGoogleCalendarSource({
 			logger: this.ctx.logger,
 			api,
 			connected: () => this.oauth.refreshToken.length > 0,
 			filterIds: () => this.parseFilter()
 		});
+		const smtpProvider = createGmailSmtpProvider({
+			getAccessToken: () => this.ensureAccessToken(),
+			getConfig: () => this.config,
+			getAccountEmail: () => this.oauth.accountEmail,
+			connected: () => this.oauth.refreshToken.length > 0
+		});
 		const routeProvider = buildAddonRouteProvider(ADDON_ID, [{
 			method: "GET",
 			path: START_PATH,
 			access: "admin",
-			description: "Begin Google Calendar OAuth",
+			description: "Begin Google OAuth (Calendar + Gmail send)",
 			handler: async (_req, reply) => this.handleStart(reply)
 		}, {
 			method: "GET",
@@ -52968,17 +53196,25 @@ var GoogleServicesAddon = class extends BaseAddon {
 			description: "Google OAuth callback",
 			handler: async (req, reply) => this.handleCallback(req, reply)
 		}]);
-		this.ctx.logger.info("Initialized — google calendar-source", { meta: {
+		this.ctx.logger.info("Initialized — google calendar-source + gmail smtp", { meta: {
 			connected: this.oauth.refreshToken.length > 0,
-			accountEmail: this.oauth.accountEmail || void 0
+			accountEmail: this.oauth.accountEmail || void 0,
+			gmailSendEnabled: this.config.gmailSendEnabled
 		} });
-		return { providers: [{
-			capability: calendarSourceCapability,
-			provider
-		}, {
-			capability: addonRoutesCapability,
-			provider: routeProvider
-		}] };
+		return { providers: [
+			{
+				capability: calendarSourceCapability,
+				provider: calendarProvider
+			},
+			{
+				capability: smtpProviderCapability,
+				provider: smtpProvider
+			},
+			{
+				capability: addonRoutesCapability,
+				provider: routeProvider
+			}
+		] };
 	}
 	async handleStart(reply) {
 		if (!this.config.clientId || !this.config.clientSecret) {
@@ -53024,15 +53260,33 @@ var GoogleServicesAddon = class extends BaseAddon {
 			}, code);
 			if (!tokens.refresh_token && !this.oauth.refreshToken) throw new Error("Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
 			this.oauth = applyTokenResponse(this.oauth, tokens);
+			const email = await this.fetchAccountEmail(this.oauth.accessToken);
+			if (email) this.oauth = {
+				...this.oauth,
+				accountEmail: email
+			};
 			await this.persistOauth();
-			this.ctx.logger.info("google oauth connected", { meta: { hasRefresh: this.oauth.refreshToken.length > 0 } });
-			this.html(reply, 200, "Google Calendar connected. You can close this window.");
+			this.ctx.logger.info("google oauth connected", { meta: {
+				hasRefresh: this.oauth.refreshToken.length > 0,
+				accountEmail: this.oauth.accountEmail || void 0
+			} });
+			this.html(reply, 200, "Google account connected (Calendar + Gmail send). You can close this window.");
 		} catch (e) {
 			const message = e instanceof Error ? e.message : String(e);
 			this.ctx.logger.warn("google oauth callback failed", { meta: { error: message } });
 			this.html(reply, 500, `OAuth failed: ${message}`);
 		}
 	}
+	async fetchAccountEmail(accessToken) {
+		try {
+			const res = await fetch(GOOGLE_USERINFO_URL, { headers: { Authorization: `Bearer ${accessToken}` } });
+			if (!res.ok) return "";
+			const body = await res.json();
+			return typeof body.email === "string" ? body.email.trim() : "";
+		} catch {
+			return "";
+		}
+	}
 	html(reply, code, body) {
 		reply.header("content-type", "text/html; charset=utf-8");
 		reply.status(code).send(`<!doctype html><html><body><p>${escapeHtml(body)}</p></body></html>`);
@@ -53062,16 +53316,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const book = await this.ctx.api.localNetwork.getAddresses.query({});
-		const origin = book.roles.internal.resolved ?? book.roles.publicEndpoint.resolved ?? null;
-		if (!origin) throw new Error("No hub address available from local-network — set an Internal address on the Network page.");
+		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
+		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
 		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
 	}
 	globalSettingsSchema() {
 		return this.schema({ sections: [{
 			id: "google-oauth",
-			title: "Google Calendar OAuth",
-			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API enabled. Register the redirect URI `<hub>/addon/google-services/oauth/callback` (hub = Internal address from Network).",
+			title: "Google OAuth",
+			description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API and Gmail API enabled. Connect grants both Calendar read and Gmail send on the same account. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
 			columns: 1,
 			fields: [
 				{
@@ -53096,7 +53349,31 @@ var GoogleServicesAddon = class extends BaseAddon {
 					key: "_connectInfo",
 					label: "Connect",
 					format: "html",
-					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google Calendar</a> while signed in as admin.`
+					content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>). If you connected before Gmail send was added, revoke CamStack in Google Account security and reconnect so the refresh token includes <code>gmail.send</code>.`
+				}
+			]
+		}, {
+			id: "gmail-send",
+			title: "Gmail send",
+			description: "Optional email delivery via the Gmail API (`smtp-provider`). Uses the same OAuth account — From must be that account or a verified send-as alias.",
+			columns: 1,
+			fields: [
+				{
+					type: "boolean",
+					key: "gmailSendEnabled",
+					label: "Enable Gmail send",
+					description: "When off, Calendar still works; this addon reports smtp-provider not ready."
+				},
+				{
+					type: "text",
+					key: "fromAddress",
+					label: "From address",
+					description: "Defaults to the connected Google account email when empty."
+				},
+				{
+					type: "text",
+					key: "fromName",
+					label: "From display name (optional)"
 				}
 			]
 		}] });
@@ -53106,4 +53383,4 @@ function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
-export { GoogleServicesAddon, GoogleServicesAddon as default, refreshAccessToken as a, mapGoogleEvent as c, needsRefresh as i, DEFAULT_GOOGLE_CONFIG as l, buildAuthorizeUrl as n, createGoogleCalendarApi as o, exchangeCode as r, createGoogleCalendarSource as s, applyTokenResponse as t, GoogleServicesConfigSchema as u };
+export { GoogleServicesAddon, GoogleServicesAddon as default, refreshAccessToken as a, createGoogleCalendarApi as c, DEFAULT_GOOGLE_CONFIG as d, GOOGLE_GMAIL_SEND_SCOPE as f, needsRefresh as i, createGoogleCalendarSource as l, GoogleServicesConfigSchema as m, buildAuthorizeUrl as n, buildRawMime as o, GOOGLE_OAUTH_SCOPES as p, exchangeCode as r, createGmailSmtpProvider as s, applyTokenResponse as t, mapGoogleEvent as u };

package/dist/index.js

@@ -4,10 +4,14 @@ Object.defineProperties(exports, {
 });
 const require_google_services_addon = require("./google-services.addon.js");
 exports.DEFAULT_GOOGLE_CONFIG = require_google_services_addon.DEFAULT_GOOGLE_CONFIG;
+exports.GOOGLE_GMAIL_SEND_SCOPE = require_google_services_addon.GOOGLE_GMAIL_SEND_SCOPE;
+exports.GOOGLE_OAUTH_SCOPES = require_google_services_addon.GOOGLE_OAUTH_SCOPES;
 exports.GoogleServicesAddon = require_google_services_addon.GoogleServicesAddon;
 exports.GoogleServicesConfigSchema = require_google_services_addon.GoogleServicesConfigSchema;
 exports.applyTokenResponse = require_google_services_addon.applyTokenResponse;
 exports.buildAuthorizeUrl = require_google_services_addon.buildAuthorizeUrl;
+exports.buildRawMime = require_google_services_addon.buildRawMime;
+exports.createGmailSmtpProvider = require_google_services_addon.createGmailSmtpProvider;
 exports.createGoogleCalendarApi = require_google_services_addon.createGoogleCalendarApi;
 exports.createGoogleCalendarSource = require_google_services_addon.createGoogleCalendarSource;
 exports.default = require_google_services_addon.GoogleServicesAddon;

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { GoogleServicesAddon, a as refreshAccessToken, c as mapGoogleEvent, i as needsRefresh, l as DEFAULT_GOOGLE_CONFIG, n as buildAuthorizeUrl, o as createGoogleCalendarApi, r as exchangeCode, s as createGoogleCalendarSource, t as applyTokenResponse, u as GoogleServicesConfigSchema } from "./google-services.addon.mjs";
-export { DEFAULT_GOOGLE_CONFIG, GoogleServicesAddon, GoogleServicesAddon as default, GoogleServicesConfigSchema, applyTokenResponse, buildAuthorizeUrl, createGoogleCalendarApi, createGoogleCalendarSource, exchangeCode, mapGoogleEvent, needsRefresh, refreshAccessToken };
+import { GoogleServicesAddon, a as refreshAccessToken, c as createGoogleCalendarApi, d as DEFAULT_GOOGLE_CONFIG, f as GOOGLE_GMAIL_SEND_SCOPE, i as needsRefresh, l as createGoogleCalendarSource, m as GoogleServicesConfigSchema, n as buildAuthorizeUrl, o as buildRawMime, p as GOOGLE_OAUTH_SCOPES, r as exchangeCode, s as createGmailSmtpProvider, t as applyTokenResponse, u as mapGoogleEvent } from "./google-services.addon.mjs";
+export { DEFAULT_GOOGLE_CONFIG, GOOGLE_GMAIL_SEND_SCOPE, GOOGLE_OAUTH_SCOPES, GoogleServicesAddon, GoogleServicesAddon as default, GoogleServicesConfigSchema, applyTokenResponse, buildAuthorizeUrl, buildRawMime, createGmailSmtpProvider, createGoogleCalendarApi, createGoogleCalendarSource, exchangeCode, mapGoogleEvent, needsRefresh, refreshAccessToken };

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@camstack/addon-google-services",
-  "version": "0.1.1",
-  "description": "Google Services — Google Calendar as a CamStack calendar-source via OAuth2.",
+  "version": "0.1.3",
+  "description": "Google Services — Google Calendar (calendar-source) and Gmail send (smtp-provider) via one OAuth2 account.",
   "keywords": [
     "camstack",
     "addon",
     "camstack-addon",
     "google",
     "calendar",
+    "gmail",
     "oauth"
   ],
   "license": "MIT",
@@ -27,7 +28,7 @@
         "id": "google-services",
         "category": "messaging",
         "name": "Google Services",
-        "description": "Connects a Google account (OAuth2) and exposes Google Calendar as a calendar-source for System → Calendars and notification rules.",
+        "description": "Connects a Google account (OAuth2): Calendar as calendar-source, optional Gmail send as smtp-provider.",
         "entry": "./dist/google-services.addon.js",
         "execution": {
           "placement": "hub-only"
@@ -36,6 +37,9 @@
           {
             "name": "calendar-source"
           },
+          {
+            "name": "smtp-provider"
+          },
           {
             "name": "addon-routes"
           }