@camstack/addon-google-services 0.1.4 → 0.1.6

package/dist/google-services.addon.js

@@ -52805,8 +52805,6 @@ var GoogleServicesConfigSchema = object({
 	clientSecret: string().default("").meta({ secret: true }),
 	/** Comma-separated Google calendar ids to expose; empty = all. */
 	calendarFilter: string().default(""),
-	/** Offer Gmail send via `smtp-provider` (same OAuth account). */
-	gmailSendEnabled: boolean().default(false),
 	/** Default From for Gmail send — usually the connected account email. */
 	fromAddress: string().default(""),
 	fromName: string().default("")
@@ -52827,6 +52825,8 @@ var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_CALENDAR_API = "https://www.googleapis.com/calendar/v3";
 var GOOGLE_GMAIL_API = "https://gmail.googleapis.com/gmail/v1";
 var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+var OAUTH_START_PATH = `/addon/google-services/oauth/start`;
+var OAUTH_CALLBACK_SUFFIX = `/addon/google-services/oauth/callback`;
 //#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
@@ -52984,12 +52984,6 @@ function createGmailSmtpProvider(deps) {
 	const status = () => {
 		const cfg = deps.getConfig();
 		const email = deps.getAccountEmail() || cfg.fromAddress.trim() || "gmail";
-		if (!cfg.gmailSendEnabled) return {
-			ready: false,
-			host: email,
-			error: "Gmail send is disabled in Google Services settings.",
-			lastVerifiedAt
-		};
 		if (!deps.connected()) return {
 			ready: false,
 			host: email,
@@ -53006,10 +53000,6 @@ function createGmailSmtpProvider(deps) {
 	return {
 		getStatus: async () => status(),
 		verify: async () => {
-			if (!deps.getConfig().gmailSendEnabled) {
-				lastError = "Gmail send is disabled in Google Services settings.";
-				return status();
-			}
 			if (!deps.connected()) {
 				lastError = "Google account is not connected.";
 				return status();
@@ -53032,7 +53022,6 @@ function createGmailSmtpProvider(deps) {
 		},
 		sendEmail: async (input) => {
 			const cfg = deps.getConfig();
-			if (!cfg.gmailSendEnabled) throw new Error("Gmail send is disabled in Google Services settings.");
 			if (!deps.connected()) throw new Error("Google account is not connected — open Connect Google.");
 			const from = input.from?.trim() || buildFromHeader(cfg, deps.getAccountEmail());
 			if (!from) throw new Error("Set From address in Google Services settings (or connect an account).");
@@ -53138,6 +53127,86 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/google-settings-copy.ts
+/**
+* Operator-facing setup copy for Connectivity → Calendars / Email.
+* Keep Connect as a same-origin relative link so the admin session cookie
+* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
+* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
+*/
+/** Enable APIs library in Google Cloud Console. */
+var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
+/** Create / manage OAuth Web clients. */
+var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
+function redirectUriDisplay(publicOrigin) {
+	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
+	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
+}
+function consoleLinksHtml() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+function introHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	const console = consoleLinksHtml();
+	if (cap === "smtp-provider") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
+		"</ol>"
+	].join("");
+	if (cap === "calendar-source") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
+		"</ol>"
+	].join("");
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
+		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
+		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
+		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
+		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
+		"</ol>"
+	].join("");
+}
+function connectHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	if (cap === "smtp-provider") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+	if (cap === "calendar-source") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+	return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
+		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+}
+function escapeHtml$1(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
 //#region src/oauth-redirect-origin.ts
 /**
 * Google OAuth redirect origin — same role as hub OAuth2 / sign-in
@@ -53167,12 +53236,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 	oauth = { ...DEFAULT_OAUTH_STATE };
 	/** CSRF state → issuedAt ms */
 	pendingStates = /* @__PURE__ */ new Map();
+	/** Cached Public-endpoint origin for settings copy (redirect URI display). */
+	publicOrigin = null;
 	constructor() {
 		super({ ...DEFAULT_GOOGLE_CONFIG });
 	}
 	async onInitialize() {
 		this.oauthHandle = this.state("oauth", OauthStateSchema, { ...DEFAULT_OAUTH_STATE });
 		this.oauth = await this.oauthHandle.get();
+		await this.refreshPublicOrigin();
 		const api = createGoogleCalendarApi(async () => this.ensureAccessToken());
 		const calendarProvider = createGoogleCalendarSource({
 			logger: this.ctx.logger,
@@ -53203,7 +53275,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 		this.ctx.logger.info("Initialized — google calendar-source + gmail smtp", { meta: {
 			connected: this.oauth.refreshToken.length > 0,
 			accountEmail: this.oauth.accountEmail || void 0,
-			gmailSendEnabled: this.config.gmailSendEnabled
+			publicOrigin: this.publicOrigin ?? void 0
 		} });
 		return { providers: [
 			{
@@ -53320,9 +53392,17 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
-		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
-		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
+		await this.refreshPublicOrigin();
+		if (!this.publicOrigin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
+		return `${this.publicOrigin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
+	}
+	async refreshPublicOrigin() {
+		try {
+			const book = await this.ctx.api.localNetwork.getAddresses.query({});
+			this.publicOrigin = pickOauthRedirectOrigin(book);
+		} catch {
+			this.publicOrigin = null;
+		}
 	}
 	/**
 	* Connectivity asks for settings scoped to the page capability, so Calendar
@@ -53330,23 +53410,25 @@ var GoogleServicesAddon = class extends BaseAddon {
 	* mqtt-broker under `broker`). The addon page (no cap) keeps every section.
 	*/
 	globalSettingsSchema(cap) {
-		const schema = this.fullSettingsSchema();
-		if (cap === "calendar-source") return {
-			...schema,
-			sections: schema.sections.filter((s) => s.id === "google-oauth" || s.id === "google-calendar")
-		};
-		if (cap === "smtp-provider") return {
-			...schema,
-			sections: schema.sections.filter((s) => s.id === "google-oauth" || s.id === "gmail-send")
-		};
-		return schema;
-	}
-	fullSettingsSchema() {
+		const scoped = asSettingsCap(cap);
 		return this.schema({ sections: [
+			{
+				id: "setup-intro",
+				title: "Setup",
+				description: scoped === "smtp-provider" ? "Connect a Google account for Gmail send (same OAuth as Calendars)." : scoped === "calendar-source" ? "Connect a Google account for Calendar (same OAuth as Email)." : "One Google account for Calendar and optional Gmail send.",
+				columns: 1,
+				fields: [{
+					type: "info",
+					key: "_setupSteps",
+					label: "Steps",
+					format: "html",
+					content: introHtml(scoped, this.publicOrigin)
+				}]
+			},
 			{
 				id: "google-oauth",
 				title: "Google account",
-				description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API and Gmail API enabled. Connect grants both Calendar read and Gmail send on the same account. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
+				description: "OAuth client credentials (Web application) stored in the hub keychain.",
 				columns: 1,
 				fields: [
 					{
@@ -53365,11 +53447,11 @@ var GoogleServicesAddon = class extends BaseAddon {
 						key: "_connectInfo",
 						label: "Connect",
 						format: "html",
-						content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>). If you connected before Gmail send was added, revoke CamStack in Google Account security and reconnect so the refresh token includes <code>gmail.send</code>.`
+						content: connectHtml(scoped, this.publicOrigin)
 					}
 				]
 			},
-			{
+			...scoped === "smtp-provider" ? [] : [{
 				id: "google-calendar",
 				title: "Google Calendar",
 				description: "Which calendars this hub exposes as calendar-source entries.",
@@ -53380,52 +53462,56 @@ var GoogleServicesAddon = class extends BaseAddon {
 					label: "Calendar id filter (optional)",
 					description: "Comma-separated Google calendar ids to expose. Empty = all calendars the account can read."
 				}]
-			},
-			{
+			}],
+			...scoped === "calendar-source" ? [] : [{
 				id: "gmail-send",
 				title: "Gmail send",
-				description: "Optional email delivery via the Gmail API (`smtp-provider`). Uses the same OAuth account — From must be that account or a verified send-as alias.",
+				description: "Delivery via the Gmail API. Disable this capability with the page Enable toggle — not a second switch here. From must be the connected account or a verified send-as.",
 				columns: 1,
-				fields: [
-					{
-						type: "boolean",
-						key: "gmailSendEnabled",
-						label: "Enable Gmail send",
-						description: "When off, Calendar still works; this addon reports smtp-provider not ready."
-					},
-					{
-						type: "text",
-						key: "fromAddress",
-						label: "From address",
-						description: "Defaults to the connected Google account email when empty."
-					},
-					{
-						type: "text",
-						key: "fromName",
-						label: "From display name (optional)"
-					}
-				]
-			}
+				fields: [{
+					type: "text",
+					key: "fromAddress",
+					label: "From address",
+					description: "Defaults to the connected Google account email when empty."
+				}, {
+					type: "text",
+					key: "fromName",
+					label: "From display name (optional)"
+				}]
+			}]
 		] });
 	}
+	async getGlobalSettings(overlay, cap, nodeId) {
+		await this.refreshPublicOrigin();
+		return super.getGlobalSettings(overlay, cap, nodeId);
+	}
 };
+function asSettingsCap(cap) {
+	if (cap === "calendar-source" || cap === "smtp-provider") return cap;
+}
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
 exports.DEFAULT_GOOGLE_CONFIG = DEFAULT_GOOGLE_CONFIG;
+exports.GOOGLE_CONSOLE_APIS_URL = GOOGLE_CONSOLE_APIS_URL;
+exports.GOOGLE_CONSOLE_CREDENTIALS_URL = GOOGLE_CONSOLE_CREDENTIALS_URL;
 exports.GOOGLE_GMAIL_SEND_SCOPE = GOOGLE_GMAIL_SEND_SCOPE;
 exports.GOOGLE_OAUTH_SCOPES = GOOGLE_OAUTH_SCOPES;
 exports.GoogleServicesAddon = GoogleServicesAddon;
 exports.default = GoogleServicesAddon;
 exports.GoogleServicesConfigSchema = GoogleServicesConfigSchema;
+exports.OAUTH_START_PATH = OAUTH_START_PATH;
 exports.applyTokenResponse = applyTokenResponse;
 exports.buildAuthorizeUrl = buildAuthorizeUrl;
 exports.buildRawMime = buildRawMime;
+exports.connectHtml = connectHtml;
 exports.createGmailSmtpProvider = createGmailSmtpProvider;
 exports.createGoogleCalendarApi = createGoogleCalendarApi;
 exports.createGoogleCalendarSource = createGoogleCalendarSource;
 exports.exchangeCode = exchangeCode;
+exports.introHtml = introHtml;
 exports.mapGoogleEvent = mapGoogleEvent;
 exports.needsRefresh = needsRefresh;
+exports.redirectUriDisplay = redirectUriDisplay;
 exports.refreshAccessToken = refreshAccessToken;

package/dist/google-services.addon.mjs

@@ -52801,8 +52801,6 @@ var GoogleServicesConfigSchema = object({
 	clientSecret: string().default("").meta({ secret: true }),
 	/** Comma-separated Google calendar ids to expose; empty = all. */
 	calendarFilter: string().default(""),
-	/** Offer Gmail send via `smtp-provider` (same OAuth account). */
-	gmailSendEnabled: boolean().default(false),
 	/** Default From for Gmail send — usually the connected account email. */
 	fromAddress: string().default(""),
 	fromName: string().default("")
@@ -52823,6 +52821,8 @@ var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_CALENDAR_API = "https://www.googleapis.com/calendar/v3";
 var GOOGLE_GMAIL_API = "https://gmail.googleapis.com/gmail/v1";
 var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+var OAUTH_START_PATH = `/addon/google-services/oauth/start`;
+var OAUTH_CALLBACK_SUFFIX = `/addon/google-services/oauth/callback`;
 //#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
@@ -52980,12 +52980,6 @@ function createGmailSmtpProvider(deps) {
 	const status = () => {
 		const cfg = deps.getConfig();
 		const email = deps.getAccountEmail() || cfg.fromAddress.trim() || "gmail";
-		if (!cfg.gmailSendEnabled) return {
-			ready: false,
-			host: email,
-			error: "Gmail send is disabled in Google Services settings.",
-			lastVerifiedAt
-		};
 		if (!deps.connected()) return {
 			ready: false,
 			host: email,
@@ -53002,10 +52996,6 @@ function createGmailSmtpProvider(deps) {
 	return {
 		getStatus: async () => status(),
 		verify: async () => {
-			if (!deps.getConfig().gmailSendEnabled) {
-				lastError = "Gmail send is disabled in Google Services settings.";
-				return status();
-			}
 			if (!deps.connected()) {
 				lastError = "Google account is not connected.";
 				return status();
@@ -53028,7 +53018,6 @@ function createGmailSmtpProvider(deps) {
 		},
 		sendEmail: async (input) => {
 			const cfg = deps.getConfig();
-			if (!cfg.gmailSendEnabled) throw new Error("Gmail send is disabled in Google Services settings.");
 			if (!deps.connected()) throw new Error("Google account is not connected — open Connect Google.");
 			const from = input.from?.trim() || buildFromHeader(cfg, deps.getAccountEmail());
 			if (!from) throw new Error("Set From address in Google Services settings (or connect an account).");
@@ -53134,6 +53123,86 @@ function needsRefresh(state, nowMs = Date.now()) {
 	return state.accessExpiresAt <= nowMs;
 }
 //#endregion
+//#region src/google-settings-copy.ts
+/**
+* Operator-facing setup copy for Connectivity → Calendars / Email.
+* Keep Connect as a same-origin relative link so the admin session cookie
+* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
+* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
+*/
+/** Enable APIs library in Google Cloud Console. */
+var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
+/** Create / manage OAuth Web clients. */
+var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
+function redirectUriDisplay(publicOrigin) {
+	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
+	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
+}
+function consoleLinksHtml() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+function introHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	const console = consoleLinksHtml();
+	if (cap === "smtp-provider") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
+		"</ol>"
+	].join("");
+	if (cap === "calendar-source") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
+		"</ol>"
+	].join("");
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
+		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
+		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
+		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
+		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
+		"</ol>"
+	].join("");
+}
+function connectHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	if (cap === "smtp-provider") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+	if (cap === "calendar-source") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+	return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
+		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml()}.`
+	].join("");
+}
+function escapeHtml$1(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
 //#region src/oauth-redirect-origin.ts
 /**
 * Google OAuth redirect origin — same role as hub OAuth2 / sign-in
@@ -53163,12 +53232,15 @@ var GoogleServicesAddon = class extends BaseAddon {
 	oauth = { ...DEFAULT_OAUTH_STATE };
 	/** CSRF state → issuedAt ms */
 	pendingStates = /* @__PURE__ */ new Map();
+	/** Cached Public-endpoint origin for settings copy (redirect URI display). */
+	publicOrigin = null;
 	constructor() {
 		super({ ...DEFAULT_GOOGLE_CONFIG });
 	}
 	async onInitialize() {
 		this.oauthHandle = this.state("oauth", OauthStateSchema, { ...DEFAULT_OAUTH_STATE });
 		this.oauth = await this.oauthHandle.get();
+		await this.refreshPublicOrigin();
 		const api = createGoogleCalendarApi(async () => this.ensureAccessToken());
 		const calendarProvider = createGoogleCalendarSource({
 			logger: this.ctx.logger,
@@ -53199,7 +53271,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 		this.ctx.logger.info("Initialized — google calendar-source + gmail smtp", { meta: {
 			connected: this.oauth.refreshToken.length > 0,
 			accountEmail: this.oauth.accountEmail || void 0,
-			gmailSendEnabled: this.config.gmailSendEnabled
+			publicOrigin: this.publicOrigin ?? void 0
 		} });
 		return { providers: [
 			{
@@ -53316,9 +53388,17 @@ var GoogleServicesAddon = class extends BaseAddon {
 		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
 	}
 	async resolveRedirectUri() {
-		const origin = pickOauthRedirectOrigin(await this.ctx.api.localNetwork.getAddresses.query({}));
-		if (!origin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
-		return `${origin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
+		await this.refreshPublicOrigin();
+		if (!this.publicOrigin) throw new Error("No hub public address available from local-network — set a Public endpoint on the Network page (OAuth2 redirects use that role, not Internal).");
+		return `${this.publicOrigin.replace(/\/$/, "")}/addon/${ADDON_ID}${CALLBACK_PATH}`;
+	}
+	async refreshPublicOrigin() {
+		try {
+			const book = await this.ctx.api.localNetwork.getAddresses.query({});
+			this.publicOrigin = pickOauthRedirectOrigin(book);
+		} catch {
+			this.publicOrigin = null;
+		}
 	}
 	/**
 	* Connectivity asks for settings scoped to the page capability, so Calendar
@@ -53326,23 +53406,25 @@ var GoogleServicesAddon = class extends BaseAddon {
 	* mqtt-broker under `broker`). The addon page (no cap) keeps every section.
 	*/
 	globalSettingsSchema(cap) {
-		const schema = this.fullSettingsSchema();
-		if (cap === "calendar-source") return {
-			...schema,
-			sections: schema.sections.filter((s) => s.id === "google-oauth" || s.id === "google-calendar")
-		};
-		if (cap === "smtp-provider") return {
-			...schema,
-			sections: schema.sections.filter((s) => s.id === "google-oauth" || s.id === "gmail-send")
-		};
-		return schema;
-	}
-	fullSettingsSchema() {
+		const scoped = asSettingsCap(cap);
 		return this.schema({ sections: [
+			{
+				id: "setup-intro",
+				title: "Setup",
+				description: scoped === "smtp-provider" ? "Connect a Google account for Gmail send (same OAuth as Calendars)." : scoped === "calendar-source" ? "Connect a Google account for Calendar (same OAuth as Email)." : "One Google account for Calendar and optional Gmail send.",
+				columns: 1,
+				fields: [{
+					type: "info",
+					key: "_setupSteps",
+					label: "Steps",
+					format: "html",
+					content: introHtml(scoped, this.publicOrigin)
+				}]
+			},
 			{
 				id: "google-oauth",
 				title: "Google account",
-				description: "Create an OAuth client (Web application) in Google Cloud Console with the Calendar API and Gmail API enabled. Connect grants both Calendar read and Gmail send on the same account. Register the redirect URI `<public-hub>/addon/google-services/oauth/callback` — hub = Public endpoint from Network (same role as sign-in / OAuth2; Google rejects plain LAN http).",
+				description: "OAuth client credentials (Web application) stored in the hub keychain.",
 				columns: 1,
 				fields: [
 					{
@@ -53361,11 +53443,11 @@ var GoogleServicesAddon = class extends BaseAddon {
 						key: "_connectInfo",
 						label: "Connect",
 						format: "html",
-						content: `After saving client id/secret, open <a href="/addon/${ADDON_ID}${START_PATH}">Connect Google</a> while signed in as admin. Redirect URI uses the Network <b>Public endpoint</b> (today typically <code>https://…/addon/google-services/oauth/callback</code>). If you connected before Gmail send was added, revoke CamStack in Google Account security and reconnect so the refresh token includes <code>gmail.send</code>.`
+						content: connectHtml(scoped, this.publicOrigin)
 					}
 				]
 			},
-			{
+			...scoped === "smtp-provider" ? [] : [{
 				id: "google-calendar",
 				title: "Google Calendar",
 				description: "Which calendars this hub exposes as calendar-source entries.",
@@ -53376,37 +53458,35 @@ var GoogleServicesAddon = class extends BaseAddon {
 					label: "Calendar id filter (optional)",
 					description: "Comma-separated Google calendar ids to expose. Empty = all calendars the account can read."
 				}]
-			},
-			{
+			}],
+			...scoped === "calendar-source" ? [] : [{
 				id: "gmail-send",
 				title: "Gmail send",
-				description: "Optional email delivery via the Gmail API (`smtp-provider`). Uses the same OAuth account — From must be that account or a verified send-as alias.",
+				description: "Delivery via the Gmail API. Disable this capability with the page Enable toggle — not a second switch here. From must be the connected account or a verified send-as.",
 				columns: 1,
-				fields: [
-					{
-						type: "boolean",
-						key: "gmailSendEnabled",
-						label: "Enable Gmail send",
-						description: "When off, Calendar still works; this addon reports smtp-provider not ready."
-					},
-					{
-						type: "text",
-						key: "fromAddress",
-						label: "From address",
-						description: "Defaults to the connected Google account email when empty."
-					},
-					{
-						type: "text",
-						key: "fromName",
-						label: "From display name (optional)"
-					}
-				]
-			}
+				fields: [{
+					type: "text",
+					key: "fromAddress",
+					label: "From address",
+					description: "Defaults to the connected Google account email when empty."
+				}, {
+					type: "text",
+					key: "fromName",
+					label: "From display name (optional)"
+				}]
+			}]
 		] });
 	}
+	async getGlobalSettings(overlay, cap, nodeId) {
+		await this.refreshPublicOrigin();
+		return super.getGlobalSettings(overlay, cap, nodeId);
+	}
 };
+function asSettingsCap(cap) {
+	if (cap === "calendar-source" || cap === "smtp-provider") return cap;
+}
 function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
-export { GoogleServicesAddon, GoogleServicesAddon as default, refreshAccessToken as a, createGoogleCalendarApi as c, DEFAULT_GOOGLE_CONFIG as d, GOOGLE_GMAIL_SEND_SCOPE as f, needsRefresh as i, createGoogleCalendarSource as l, GoogleServicesConfigSchema as m, buildAuthorizeUrl as n, buildRawMime as o, GOOGLE_OAUTH_SCOPES as p, exchangeCode as r, createGmailSmtpProvider as s, applyTokenResponse as t, mapGoogleEvent as u };
+export { GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_GMAIL_SEND_SCOPE as _, redirectUriDisplay as a, OAUTH_START_PATH as b, exchangeCode as c, buildRawMime as d, createGmailSmtpProvider as f, DEFAULT_GOOGLE_CONFIG as g, mapGoogleEvent as h, introHtml as i, needsRefresh as l, createGoogleCalendarSource as m, GOOGLE_CONSOLE_CREDENTIALS_URL as n, applyTokenResponse as o, createGoogleCalendarApi as p, connectHtml as r, buildAuthorizeUrl as s, GOOGLE_CONSOLE_APIS_URL as t, refreshAccessToken as u, GOOGLE_OAUTH_SCOPES as v, GoogleServicesConfigSchema as y };

package/dist/index.js

@@ -4,18 +4,24 @@ Object.defineProperties(exports, {
 });
 const require_google_services_addon = require("./google-services.addon.js");
 exports.DEFAULT_GOOGLE_CONFIG = require_google_services_addon.DEFAULT_GOOGLE_CONFIG;
+exports.GOOGLE_CONSOLE_APIS_URL = require_google_services_addon.GOOGLE_CONSOLE_APIS_URL;
+exports.GOOGLE_CONSOLE_CREDENTIALS_URL = require_google_services_addon.GOOGLE_CONSOLE_CREDENTIALS_URL;
 exports.GOOGLE_GMAIL_SEND_SCOPE = require_google_services_addon.GOOGLE_GMAIL_SEND_SCOPE;
 exports.GOOGLE_OAUTH_SCOPES = require_google_services_addon.GOOGLE_OAUTH_SCOPES;
 exports.GoogleServicesAddon = require_google_services_addon.GoogleServicesAddon;
 exports.GoogleServicesConfigSchema = require_google_services_addon.GoogleServicesConfigSchema;
+exports.OAUTH_START_PATH = require_google_services_addon.OAUTH_START_PATH;
 exports.applyTokenResponse = require_google_services_addon.applyTokenResponse;
 exports.buildAuthorizeUrl = require_google_services_addon.buildAuthorizeUrl;
 exports.buildRawMime = require_google_services_addon.buildRawMime;
+exports.connectHtml = require_google_services_addon.connectHtml;
 exports.createGmailSmtpProvider = require_google_services_addon.createGmailSmtpProvider;
 exports.createGoogleCalendarApi = require_google_services_addon.createGoogleCalendarApi;
 exports.createGoogleCalendarSource = require_google_services_addon.createGoogleCalendarSource;
 exports.default = require_google_services_addon.GoogleServicesAddon;
 exports.exchangeCode = require_google_services_addon.exchangeCode;
+exports.introHtml = require_google_services_addon.introHtml;
 exports.mapGoogleEvent = require_google_services_addon.mapGoogleEvent;
 exports.needsRefresh = require_google_services_addon.needsRefresh;
+exports.redirectUriDisplay = require_google_services_addon.redirectUriDisplay;
 exports.refreshAccessToken = require_google_services_addon.refreshAccessToken;

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { GoogleServicesAddon, a as refreshAccessToken, c as createGoogleCalendarApi, d as DEFAULT_GOOGLE_CONFIG, f as GOOGLE_GMAIL_SEND_SCOPE, i as needsRefresh, l as createGoogleCalendarSource, m as GoogleServicesConfigSchema, n as buildAuthorizeUrl, o as buildRawMime, p as GOOGLE_OAUTH_SCOPES, r as exchangeCode, s as createGmailSmtpProvider, t as applyTokenResponse, u as mapGoogleEvent } from "./google-services.addon.mjs";
-export { DEFAULT_GOOGLE_CONFIG, GOOGLE_GMAIL_SEND_SCOPE, GOOGLE_OAUTH_SCOPES, GoogleServicesAddon, GoogleServicesAddon as default, GoogleServicesConfigSchema, applyTokenResponse, buildAuthorizeUrl, buildRawMime, createGmailSmtpProvider, createGoogleCalendarApi, createGoogleCalendarSource, exchangeCode, mapGoogleEvent, needsRefresh, refreshAccessToken };
+import { GoogleServicesAddon, _ as GOOGLE_GMAIL_SEND_SCOPE, a as redirectUriDisplay, b as OAUTH_START_PATH, c as exchangeCode, d as buildRawMime, f as createGmailSmtpProvider, g as DEFAULT_GOOGLE_CONFIG, h as mapGoogleEvent, i as introHtml, l as needsRefresh, m as createGoogleCalendarSource, n as GOOGLE_CONSOLE_CREDENTIALS_URL, o as applyTokenResponse, p as createGoogleCalendarApi, r as connectHtml, s as buildAuthorizeUrl, t as GOOGLE_CONSOLE_APIS_URL, u as refreshAccessToken, v as GOOGLE_OAUTH_SCOPES, y as GoogleServicesConfigSchema } from "./google-services.addon.mjs";
+export { DEFAULT_GOOGLE_CONFIG, GOOGLE_CONSOLE_APIS_URL, GOOGLE_CONSOLE_CREDENTIALS_URL, GOOGLE_GMAIL_SEND_SCOPE, GOOGLE_OAUTH_SCOPES, GoogleServicesAddon, GoogleServicesAddon as default, GoogleServicesConfigSchema, OAUTH_START_PATH, applyTokenResponse, buildAuthorizeUrl, buildRawMime, connectHtml, createGmailSmtpProvider, createGoogleCalendarApi, createGoogleCalendarSource, exchangeCode, introHtml, mapGoogleEvent, needsRefresh, redirectUriDisplay, refreshAccessToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camstack/addon-google-services",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Google Services — Google Calendar (calendar-source) and Gmail send (smtp-provider) via one OAuth2 account.",
   "keywords": [
     "camstack",