@camstack/addon-google-services 0.1.6 → 0.2.7

package/dist/google-services.addon.mjs

@@ -13662,7 +13662,14 @@ var BrokerProviderInfoSchema = object({
 	/** Broker kinds this provider can create, with a display label. */
 	kinds: array(object({
 		kind: string(),
-		label: string()
+		label: string(),
+		/**
+		* Relative hub path to start an interactive account link (OAuth popup).
+		* May include `{{brokerId}}`; admin-ui substitutes and appends `?popup=1`.
+		*/
+		interactiveConnectPath: string().min(1).optional(),
+		/** Relative hub path to disconnect the linked account (same popup pattern). */
+		interactiveDisconnectPath: string().min(1).optional()
 	}))
 });
 var ListInputSchema = object({ 
@@ -13748,34 +13755,83 @@ var GetStateInputSchema = object({
 	*  HA:   entity_id (returns the cached entity state). */
 	key: string()
 });
-method(ListInputSchema, array(BrokerInfoSchema)), method(GetInputSchema, BrokerInfoSchema.nullable()), method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }), method(AddInputSchema, AddResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(RemoveInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, TestConnectionResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(object({
-	id: string(),
-	settings: SettingsRecordSchema$1
-}), _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }), method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }), method(TestSettingsInputSchema, TestSettingsResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(PublishInputSchema, unknown(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(SubscribeInputSchema, SubscribeResultSchema, {
-	kind: "mutation",
-	auth: "admin"
-}), method(UnsubscribeInputSchema, _void(), {
-	kind: "mutation",
-	auth: "admin"
-}), method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }), method(_void(), RegistryStatusSchema);
+var brokerCapability = {
+	name: "broker",
+	scope: "system",
+	mode: "collection",
+	providerKind: "broker",
+	status: {
+		schema: RegistryStatusSchema,
+		kind: "poll"
+	},
+	methods: {
+		list: method(ListInputSchema, array(BrokerInfoSchema)),
+		get: method(GetInputSchema, BrokerInfoSchema.nullable()),
+		/** Enumerate which addon provides which broker kind(s) for the
+		*  unified create picker. The auto-mount fans this array across
+		*  every registered `broker` provider (array-output method), so the
+		*  picker sees every kind from every provider in one call. */
+		listProviders: method(_void(), array(BrokerProviderInfoSchema), { auth: "admin" }),
+		add: method(AddInputSchema, AddResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		remove: method(RemoveInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		testConnection: method(GetInputSchema, TestConnectionResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Read the persisted settings record for a broker (kind-specific
+		*  shape). Admin-only — settings may contain secrets. Returns `null`
+		*  when the broker id is unknown to the provider (the collection
+		*  fallback may route a foreign id to the first provider). */
+		getSettings: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
+		/** Overwrite the persisted settings record. The kind-specific
+		*  provider validates the shape and applies the change (reconnects
+		*  if credentials changed). */
+		setSettings: method(object({
+			id: string(),
+			settings: SettingsRecordSchema$1
+		}), _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Returns the kind-specific connection config the consumer needs
+		*  to open its own client (MQTT pattern: `{url, username, password,
+		*  clientIdPrefix}`). HA providers MAY return the auth envelope
+		*  but typical HA consumers use `publish` / `subscribe` instead.
+		*  Returns `null` when the broker id is unknown to the provider. */
+		getBrokerConfig: method(GetInputSchema, SettingsRecordSchema$1.nullable(), { auth: "admin" }),
+		getSettingsSchema: method(SettingsSchemaInputSchema, SettingsSchemaResultSchema, { auth: "admin" }),
+		testSettings: method(TestSettingsInputSchema, TestSettingsResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		publish: method(PublishInputSchema, unknown(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		subscribe: method(SubscribeInputSchema, SubscribeResultSchema, {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		unsubscribe: method(UnsubscribeInputSchema, _void(), {
+			kind: "mutation",
+			auth: "admin"
+		}),
+		/** Read the broker's cached state for a key. Returns `null` when
+		*  unknown to the broker (never published / unknown entity). */
+		getState: method(GetStateInputSchema, unknown().nullable(), { auth: "admin" }),
+		/** Status method — explicit registration with a `z.void()` input so
+		*  the codegen-generated tRPC router types its input as
+		*  `{addonId?: string, nodeId?: string}` (system-scoped collection
+		*  shape) instead of the device-scoped `{deviceId}` fallback. */
+		getStatus: method(_void(), RegistryStatusSchema)
+	}
+};
 DeviceType.Camera;
 /** Stream delivery format. (Relocated from the retired `streaming-engine` cap.) */
 var StreamFormatSchema = _enum([
@@ -18191,14 +18247,14 @@ var LlmProfileSchema = object({
 /** ConfigUISchema tree passed through untyped on the wire (the
 *  notification-output `ConfigSchemaPassthrough` precedent at
 *  notification-output.cap.ts:151); the exported TS type re-tightens it. */
-var ConfigSchemaPassthrough$2 = unknown();
+var ConfigSchemaPassthrough$3 = unknown();
 var LlmProfileKindDescriptorSchema = object({
 	kind: LlmProfileKindSchema,
 	label: string(),
 	icon: string(),
 	/** Stamped by each provider so the concat-fanned catalog stays routable. */
 	addonId: string(),
-	configSchema: ConfigSchemaPassthrough$2
+	configSchema: ConfigSchemaPassthrough$3
 });
 var LlmDefaultSelectorSchema = union([object({ consumer: string() }), object({ purpose: _enum(["text", "vision"]) })]);
 var LlmDefaultSchema = object({
@@ -19319,7 +19375,7 @@ var TargetKindCapsSchema = object({
 * the union is large and not meant for runtime validation here; the exported
 * `TargetKind` type re-tightens `configSchema` to `ConfigUISchema`.
 */
-var ConfigSchemaPassthrough$1 = unknown();
+var ConfigSchemaPassthrough$2 = unknown();
 var TargetKindSchema = object({
 	kind: string(),
 	label: string(),
@@ -19356,7 +19412,7 @@ var TargetKindSchema = object({
 	* its raster path, which is the safe default for an unknown image.
 	*/
 	iconMediaType: string().optional(),
-	configSchema: ConfigSchemaPassthrough$1,
+	configSchema: ConfigSchemaPassthrough$2,
 	/**
 	* The config keys that decide WHERE this kind's secrets are sent (server,
 	* base URL, instance, chat, recipient). A save that changes any of them
@@ -22655,6 +22711,61 @@ var OauthIntegrationDescriptorSchema = object({
 });
 method(_void(), OauthIntegrationDescriptorSchema, { auth: "admin" });
 /**
+* `oidc-connections` — CRUD for IdP rows under `auth-oidc` (D828 sibling).
+*
+* One hub-only singleton (`auth-oidc`). The Settings UI is a DataTable +
+* ItemFormDialog; there is no `editable-array` in `globalSettingsSchema`.
+* Operator-chosen `id` is the URL slug (`/addon/auth-oidc/<id>/…`) and is
+* immutable after create.
+*/
+var ConfigSchemaPassthrough$1 = unknown();
+var OidcConnectionSchema = object({
+	id: string().min(1),
+	displayName: string(),
+	icon: string(),
+	issuerUrl: string(),
+	clientId: string(),
+	/** Client id + secret present — never the secret value. */
+	configured: boolean(),
+	/**
+	* Values for the connection form schema. `clientSecret` is a keychain
+	* {@link SecretFieldView} or `null` / `''`, never plaintext (D789).
+	*/
+	formValues: record(string(), unknown()).optional()
+});
+/**
+* Patch one connection. Omitted or empty `clientSecret` keeps the stored
+* secret (D787). `{ $secretClear: true }` clears it. `id` is never renamed.
+*/
+var OidcConnectionUpdateInputSchema = object({
+	id: string().min(1),
+	displayName: string().min(1),
+	icon: string().optional(),
+	issuerUrl: string().optional(),
+	clientId: string().optional(),
+	clientSecret: union([string(), object({ $secretClear: literal(true) })]).optional(),
+	redirectUri: string().optional(),
+	scopes: string().optional(),
+	usernameClaim: _enum([
+		"preferred_username",
+		"email",
+		"sub"
+	]).optional()
+});
+method(object({}), ConfigSchemaPassthrough$1, { auth: "admin" }), method(object({}), array(OidcConnectionSchema).readonly(), { auth: "admin" }), method(object({
+	id: string().min(1).regex(/^[a-z0-9][a-z0-9-]{0,63}$/, "id must be a lowercase slug"),
+	displayName: string().min(1)
+}), object({ id: string() }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(OidcConnectionUpdateInputSchema, object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+}), method(object({ id: string().min(1) }), object({ ok: literal(true) }), {
+	kind: "mutation",
+	auth: "admin"
+});
+/**
 * What started a camera's onboard motion (D672). `camera` is the camera's own
 * firmware; `sensor` is a device the operator ATTACHED to it. Absent on the
 * wire means the camera: only the camera-sensors bridge ever says `sensor`.
@@ -44018,6 +44129,36 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"oidcConnections.connectionFormSchema": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.createConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
+	"oidcConnections.deleteConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "delete"
+	},
+	"oidcConnections.listConnections": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
+	"oidcConnections.updateConnection": {
+		capName: "oidc-connections",
+		capScope: "system",
+		addonId: null,
+		access: "create"
+	},
 	"osd.getStatus": {
 		capName: "osd",
 		capScope: "device",
@@ -52796,34 +52937,506 @@ var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
 //#region src/google-types.ts
-var GoogleServicesConfigSchema = object({
+/** One Google account connection (broker entry). Credentials for the OAuth
+*  *app* live here; tokens live in durable oauthAccounts state keyed by id. */
+var GoogleBrokerEntrySchema = object({
+	id: string().min(1),
+	name: string().min(1),
 	clientId: string().default(""),
 	clientSecret: string().default("").meta({ secret: true }),
-	/** Comma-separated Google calendar ids to expose; empty = all. */
+	/**
+	* @deprecated Per-broker filter; import selection lives on addon
+	* `calendarIds` (Connectivity → Calendars). Kept for migrate only.
+	*/
 	calendarFilter: string().default(""),
 	/** Default From for Gmail send — usually the connected account email. */
 	fromAddress: string().default(""),
 	fromName: string().default("")
 });
+var GoogleServicesConfigSchema = object({
+	brokers: array(GoogleBrokerEntrySchema).default([]),
+	/**
+	* Stamped calendar ids (`brokerId:googleCalendarId`) to import.
+	* Empty = import none. Edited under Connectivity → Calendars.
+	*/
+	calendarIds: array(string()).default([]),
+	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
+	clientId: string().optional(),
+	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
+	clientSecret: string().optional().meta({ secret: true }),
+	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
+	calendarFilter: string().optional(),
+	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
+	fromAddress: string().optional(),
+	/** @deprecated Pre-broker singleton — cleared after migrateLegacyToBrokers. */
+	fromName: string().optional()
+});
 var DEFAULT_GOOGLE_CONFIG = GoogleServicesConfigSchema.parse({});
+/** Flat pre-broker config (singleton). Parsed only for one-shot migration. */
+var LegacyGoogleFlatConfigSchema = GoogleServicesConfigSchema;
 var DEFAULT_OAUTH_STATE = {
 	refreshToken: "",
 	accessToken: "",
 	accessExpiresAt: 0,
 	accountEmail: ""
 };
+var GoogleOauthAccountsStateSchema = object({ accounts: array(object({
+	id: string().min(1),
+	refreshToken: string().default("").meta({ secret: true }),
+	accessToken: string().default("").meta({ secret: true }),
+	accessExpiresAt: number().default(0),
+	accountEmail: string().default("")
+})).default([]) });
+var GOOGLE_BROKER_KIND = "google";
+var GOOGLE_BROKER_KIND_LABEL = "Google";
 var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
 var GOOGLE_GMAIL_SEND_SCOPE = "https://www.googleapis.com/auth/gmail.send";
-/** Space-separated scopes requested on Connect (Calendar read + Gmail send). */
-var GOOGLE_OAUTH_SCOPES = `${GOOGLE_CALENDAR_SCOPE} ${GOOGLE_GMAIL_SEND_SCOPE}`;
+/** Space-separated scopes on Connect (Calendar + Gmail + email). */
+var GOOGLE_OAUTH_SCOPES = `${GOOGLE_CALENDAR_SCOPE} ${GOOGLE_GMAIL_SEND_SCOPE} https://www.googleapis.com/auth/userinfo.email`;
 var GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 var GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 var GOOGLE_CALENDAR_API = "https://www.googleapis.com/calendar/v3";
 var GOOGLE_GMAIL_API = "https://gmail.googleapis.com/gmail/v1";
 var GOOGLE_USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
+/** Lightweight Calendar probe for Test — works with calendar.readonly alone. */
+var GOOGLE_CALENDAR_LIST_URL = `${GOOGLE_CALENDAR_API}/users/me/calendarList?maxResults=1`;
 var OAUTH_START_PATH = `/addon/google-services/oauth/start`;
 var OAUTH_CALLBACK_SUFFIX = `/addon/google-services/oauth/callback`;
 //#endregion
+//#region src/google-broker-registry.ts
+var GoogleAddSettingsSchema = object({
+	clientId: string().min(1),
+	clientSecret: string().min(1).meta({ secret: true }),
+	/** Selected Google calendar ids; empty = import all. */
+	calendarIds: array(string()).optional(),
+	/** @deprecated Prefer calendarIds — still accepted on save. */
+	calendarFilter: string().optional(),
+	fromAddress: string().optional(),
+	fromName: string().optional()
+});
+/** Persist UI calendarIds (or legacy filter string) as comma-separated filter. */
+function calendarIdsToFilter(settings) {
+	if (settings.calendarIds !== void 0) return settings.calendarIds.map((s) => s.trim()).filter((s) => s.length > 0).join(",");
+	return settings.calendarFilter ?? "";
+}
+function settingsToBrokerFields(settings) {
+	const parsed = GoogleAddSettingsSchema.parse(settings);
+	return {
+		clientId: parsed.clientId,
+		clientSecret: parsed.clientSecret,
+		calendarFilter: calendarIdsToFilter(parsed),
+		fromAddress: parsed.fromAddress ?? "",
+		fromName: parsed.fromName ?? ""
+	};
+}
+function brokerEntryToSettings(entry) {
+	return {
+		clientId: entry.clientId,
+		clientSecret: entry.clientSecret,
+		calendarIds: [...parseCalendarFilter(entry.calendarFilter)],
+		fromAddress: entry.fromAddress,
+		fromName: entry.fromName
+	};
+}
+/**
+* One-shot: flat singleton config + legacy `oauth` state → `google_001`.
+* Idempotent when `brokers` already present.
+*/
+function migrateLegacyToBrokers(rawConfig, legacyOauth) {
+	const loose = LegacyGoogleFlatConfigSchema.safeParse(rawConfig);
+	const flat = loose.success ? loose.data : {};
+	const existingBrokers = flat.brokers ?? [];
+	if (existingBrokers.length > 0) return {
+		brokers: existingBrokers.map((b) => GoogleBrokerEntrySchema.parse(b)),
+		oauthAccounts: [],
+		didMigrate: false
+	};
+	const hasClient = (flat.clientId ?? "").length > 0 || (flat.clientSecret ?? "").length > 0;
+	const hasOauth = legacyOauth !== null && legacyOauth.refreshToken.length > 0;
+	if (!hasClient && !hasOauth) return {
+		brokers: [],
+		oauthAccounts: [],
+		didMigrate: false
+	};
+	const id = "google_001";
+	const email = legacyOauth?.accountEmail?.trim() ?? "";
+	const name = email.length > 0 ? email : "Google account";
+	const entry = GoogleBrokerEntrySchema.parse({
+		id,
+		name,
+		clientId: flat.clientId ?? "",
+		clientSecret: flat.clientSecret ?? "",
+		calendarFilter: flat.calendarFilter ?? "",
+		fromAddress: flat.fromAddress ?? "",
+		fromName: flat.fromName ?? ""
+	});
+	const oauthAccounts = legacyOauth !== null && (legacyOauth.refreshToken.length > 0 || legacyOauth.accessToken.length > 0) ? [{
+		id,
+		refreshToken: legacyOauth.refreshToken,
+		accessToken: legacyOauth.accessToken,
+		accessExpiresAt: legacyOauth.accessExpiresAt,
+		accountEmail: legacyOauth.accountEmail
+	}] : [];
+	return {
+		brokers: [entry],
+		oauthAccounts,
+		didMigrate: true
+	};
+}
+function parseCalendarFilter(raw) {
+	const trimmed = raw.trim();
+	if (!trimmed) return /* @__PURE__ */ new Set();
+	return new Set(trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
+}
+/** Local calendar id stamped as `brokerId:googleCalendarId`. */
+function stampCalendarId(brokerId, googleCalendarId) {
+	return `${brokerId}:${googleCalendarId}`;
+}
+function parseStampedCalendarId(stamped) {
+	const idx = stamped.indexOf(":");
+	if (idx <= 0 || idx === stamped.length - 1) return null;
+	return {
+		brokerId: stamped.slice(0, idx),
+		googleCalendarId: stamped.slice(idx + 1)
+	};
+}
+/**
+* In-memory index over broker entries + oauth accounts. The addon owns
+* persistence; this class only allocates ids and builds BrokerInfo rows.
+*/
+var GoogleBrokerRegistry = class {
+	nextIdCounter = 1;
+	entries = [];
+	oauthById = /* @__PURE__ */ new Map();
+	seedFrom(entries, accounts) {
+		this.entries = entries.map((e) => GoogleBrokerEntrySchema.parse(e));
+		this.oauthById = new Map(accounts.map((a) => [a.id, { ...a }]));
+		this.seedCounterFromEntries(this.entries);
+	}
+	listEntries() {
+		return this.entries;
+	}
+	getEntry(id) {
+		return this.entries.find((e) => e.id === id) ?? null;
+	}
+	getOauth(id) {
+		return this.oauthById.get(id) ?? null;
+	}
+	listOauthAccounts() {
+		return [...this.oauthById.values()];
+	}
+	setOauth(account) {
+		this.oauthById.set(account.id, { ...account });
+	}
+	removeOauth(id) {
+		this.oauthById.delete(id);
+	}
+	isConnected(id) {
+		const o = this.oauthById.get(id);
+		return o !== void 0 && o.refreshToken.length > 0;
+	}
+	allocateId() {
+		const id = `google_${String(this.nextIdCounter).padStart(3, "0")}`;
+		this.nextIdCounter += 1;
+		return id;
+	}
+	adoptId(id) {
+		if (this.entries.some((e) => e.id === id)) throw new Error(`broker id "${id}" is already in use — adopt an id only to restore a broker that is gone`);
+		const match = id.match(/^google_(\d+)$/);
+		if (match?.[1] !== void 0) this.nextIdCounter = Math.max(this.nextIdCounter, Number.parseInt(match[1], 10) + 1);
+		return id;
+	}
+	createEntry(name, settings, opts = {}) {
+		const fields = settingsToBrokerFields(settings);
+		const id = opts.id !== void 0 ? this.adoptId(opts.id) : this.allocateId();
+		const entry = GoogleBrokerEntrySchema.parse({
+			id,
+			name,
+			...fields
+		});
+		this.entries = [...this.entries, entry];
+		return entry;
+	}
+	updateEntry(id, settings) {
+		const idx = this.entries.findIndex((e) => e.id === id);
+		if (idx < 0) return null;
+		const prev = this.entries[idx];
+		const fields = settingsToBrokerFields(settings);
+		const next = GoogleBrokerEntrySchema.parse({
+			id: prev.id,
+			name: prev.name,
+			...fields
+		});
+		this.entries = this.entries.map((e, i) => i === idx ? next : e);
+		return next;
+	}
+	removeEntry(id) {
+		const before = this.entries.length;
+		this.entries = this.entries.filter((e) => e.id !== id);
+		this.oauthById.delete(id);
+		return this.entries.length < before;
+	}
+	replaceEntries(entries) {
+		this.entries = entries.map((e) => GoogleBrokerEntrySchema.parse(e));
+		this.seedCounterFromEntries(this.entries);
+	}
+	toBrokerInfo(entry, addonId) {
+		const oauth = this.oauthById.get(entry.id);
+		const connected = this.isConnected(entry.id);
+		return {
+			id: entry.id,
+			addonId,
+			name: entry.name,
+			kind: GOOGLE_BROKER_KIND,
+			status: connected ? "connected" : "disconnected",
+			info: {
+				accountEmail: oauth?.accountEmail ?? "",
+				hasClient: entry.clientId.length > 0
+			},
+			lastCheckedAt: connected ? Date.now() : null,
+			error: connected ? null : entry.clientId.length === 0 ? "Configure Client ID / secret, then Connect Google" : "Not connected — open Connect Google on this broker"
+		};
+	}
+	listBrokerInfos(addonId, kind) {
+		if (kind !== void 0 && kind !== "google") return [];
+		return this.entries.map((e) => this.toBrokerInfo(e, addonId));
+	}
+	size() {
+		return this.entries.length;
+	}
+	connectedSize() {
+		return this.entries.filter((e) => this.isConnected(e.id)).length;
+	}
+	toConfig(calendarIds = []) {
+		return {
+			brokers: [...this.entries],
+			calendarIds: [...calendarIds]
+		};
+	}
+	seedCounterFromEntries(entries) {
+		let maxSeen = 0;
+		for (const e of entries) {
+			const match = e.id.match(/^google_(\d+)$/);
+			if (match?.[1] !== void 0) maxSeen = Math.max(maxSeen, Number.parseInt(match[1], 10));
+		}
+		this.nextIdCounter = maxSeen + 1;
+	}
+};
+//#endregion
+//#region src/google-settings-copy.ts
+/**
+* Operator-facing setup copy for Connectivity → Calendars / Email.
+* Keep Connect as a same-origin relative link so the admin session cookie
+* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
+* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
+*/
+/** Enable APIs library in Google Cloud Console. */
+var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
+/** Create / manage OAuth Web clients. */
+var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
+function redirectUriDisplay(publicOrigin) {
+	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
+	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
+}
+function consoleLinksHtml$1() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+function introHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$2(redirectUriDisplay(publicOrigin));
+	const console = consoleLinksHtml$1();
+	if (cap === "smtp-provider") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
+		"</ol>"
+	].join("");
+	if (cap === "calendar-source") return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
+		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
+		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
+		"</ol>"
+	].join("");
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
+		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
+		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
+		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
+		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
+		"</ol>"
+	].join("");
+}
+function connectHtml(cap, publicOrigin) {
+	const redirect = escapeHtml$2(redirectUriDisplay(publicOrigin));
+	if (cap === "smtp-provider") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+	if (cap === "calendar-source") return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
+		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
+		`Google must list exactly: <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+	return [
+		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
+		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
+		`Console: ${consoleLinksHtml$1()}.`
+	].join("");
+}
+function escapeHtml$2(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
+//#region src/google-broker-settings-schema.ts
+/**
+* Per-kind broker creation/edit form for kind=`google`.
+* Account linking (Sign in) is driven by `listProviders.interactiveConnectPath`
+* in BrokerManager — not a hard-coded Connect link in this form.
+*/
+function consoleLinksHtml() {
+	return [
+		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
+		` · `,
+		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
+	].join("");
+}
+/** Setup steps shown on Add / Edit — includes Audience / Test users. */
+function googleBrokerSetupHtml(publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	return [
+		"<ol>",
+		`<li>Open Google Cloud Console (${consoleLinksHtml()}). Create a <strong>new project</strong> (or pick an existing one) from the project picker at the top.</li>`,
+		"<li>In that project, enable <strong>Google Calendar API</strong> and/or <strong>Gmail API</strong> (API library).</li>",
+		"<li>Open <strong>Google Auth Platform → Audience</strong> (or APIs &amp; Services → OAuth consent screen → <strong>Audience</strong>). User type <strong>External</strong> + publishing status <strong>Testing</strong> is fine for a personal hub. Under <strong>Test users</strong>, add the Google account(s) that will Sign in — otherwise Google returns <code>403: access_denied</code>. (If you only see Branding / Data Access, open the <strong>Audience</strong> tab in the left sidebar of Google Auth Platform.) Publishing / verification is optional for a private hub.</li>",
+		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
+		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
+		"<li>Paste Client ID and Client secret below. <strong>Test connection</strong> checks those with Google (not the account yet).</li>",
+		"<li>Add the broker — the hub then opens Google sign-in in a popup to link the account (Calendar + Gmail). Use <strong>Sign in</strong> on the row if you skip or cancel.</li>",
+		"</ol>"
+	].join("");
+}
+function buildGoogleBrokerSettingsSchema(publicOrigin) {
+	return { sections: [
+		{
+			id: "setup-intro",
+			title: "Setup",
+			description: "Google Cloud Console — register the hub redirect before Add / Sign in.",
+			columns: 1,
+			fields: [{
+				type: "info",
+				key: "_setupSteps",
+				label: "Steps",
+				format: "html",
+				content: googleBrokerSetupHtml(publicOrigin)
+			}]
+		},
+		{
+			id: "google-oauth-client",
+			title: "Google OAuth client",
+			description: "Web application client from Google Cloud Console. The same Cloud project can be reused across Google brokers.",
+			columns: 1,
+			fields: [{
+				type: "text",
+				key: "clientId",
+				label: "Client ID"
+			}, {
+				type: "password",
+				key: "clientSecret",
+				label: "Client secret",
+				showToggle: true
+			}]
+		},
+		{
+			id: "gmail-send",
+			title: "Gmail send",
+			description: "From must be this connected account or a verified send-as. Disable Email on Connectivity to turn Gmail off without removing the broker.",
+			columns: 1,
+			fields: [{
+				type: "text",
+				key: "fromAddress",
+				label: "From address",
+				description: "Defaults to the connected Google account email when empty."
+			}, {
+				type: "text",
+				key: "fromName",
+				label: "From display name (optional)"
+			}]
+		}
+	] };
+}
+/** Connectivity Calendars / Email pages — calendar import picker lives here (not on broker Add). */
+function buildGoogleFeatureSettingsSchema(cap, publicOrigin) {
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	if (cap === "calendar-source") return { sections: [{
+		id: "setup-intro",
+		title: "Google brokers",
+		columns: 1,
+		fields: [{
+			type: "info",
+			key: "_setupSteps",
+			label: "Setup",
+			format: "html",
+			content: [
+				"<p>Link a Google account under Connectivity → <strong>Brokers</strong> ",
+				"(Client ID / secret + Sign in). Then pick calendars below. ",
+				`OAuth redirect URI: <code>${redirect}</code>.</p>`
+			].join("")
+		}]
+	}, {
+		id: "google-calendars-import",
+		title: "Calendars to import",
+		description: "Nothing selected = no calendars imported. Options appear after at least one Google broker is signed in.",
+		columns: 1,
+		fields: [{
+			type: "multiselect",
+			key: "calendarIds",
+			label: "Calendars",
+			options: [],
+			optionsFrom: "_calendarCatalog",
+			description: "Ids are stamped as brokerId:googleCalendarId across every Google broker."
+		}]
+	}] };
+	return { sections: [{
+		id: "setup-intro",
+		title: cap === "smtp-provider" ? "Gmail send uses Google brokers" : "Google brokers",
+		columns: 1,
+		fields: [{
+			type: "info",
+			key: "_setupSteps",
+			label: "Setup",
+			format: "html",
+			content: cap === "smtp-provider" ? [
+				"<p>Add or edit a <strong>Google</strong> broker under Connectivity → <strong>Brokers</strong> ",
+				"(Client ID / secret + Sign in). From address and send-as live on that broker. ",
+				`OAuth redirect URI: <code>${redirect}</code>.</p>`
+			].join("") : [
+				"<p>Add or edit a <strong>Google</strong> broker under Connectivity → <strong>Brokers</strong> ",
+				"(Client ID / secret + Sign in). ",
+				`OAuth redirect URI: <code>${redirect}</code>.</p>`
+			].join("")
+		}]
+	}] };
+}
+function escapeHtml$1(s) {
+	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+//#endregion
 //#region src/google-calendar-source.ts
 function parseGoogleInstant(value) {
 	const ms = Date.parse(value);
@@ -52886,39 +53499,75 @@ function createGoogleCalendarApi(getAccessToken, http = { fetch }) {
 function createGoogleCalendarSource(deps) {
 	return {
 		listCalendars: async () => {
-			if (!deps.connected()) return [];
-			const filter = deps.filterIds();
-			return (await deps.api.listCalendars()).filter((c) => filter.size === 0 ? true : filter.has(c.id)).map((c) => ({
-				id: c.id,
-				name: c.summary,
-				source: "addon",
-				enabled: true
-			}));
+			const selected = deps.selectedCalendarIds();
+			if (selected.size === 0) return [];
+			const out = [];
+			for (const account of deps.accounts()) {
+				if (!account.connected) continue;
+				try {
+					const list = await account.api.listCalendars();
+					for (const c of list) {
+						const stamped = stampCalendarId(account.brokerId, c.id);
+						if (!selected.has(stamped)) continue;
+						out.push({
+							id: stamped,
+							name: c.summary,
+							source: "addon",
+							enabled: true
+						});
+					}
+				} catch (err) {
+					deps.logger.warn("google calendar listCalendars failed", { meta: {
+						brokerId: account.brokerId,
+						error: err instanceof Error ? err.message : String(err)
+					} });
+				}
+			}
+			return out;
 		},
 		listEvents: async (input) => {
-			if (!deps.connected()) return [];
-			const filter = deps.filterIds();
-			let calendarIds = input.calendarIds;
-			if (calendarIds === void 0) calendarIds = (await deps.api.listCalendars()).filter((c) => filter.size === 0 ? true : filter.has(c.id)).map((c) => c.id);
-			else if (filter.size > 0) calendarIds = calendarIds.filter((id) => filter.has(id));
+			const selected = deps.selectedCalendarIds();
+			if (selected.size === 0) return [];
 			const timeMin = new Date(input.startMs).toISOString();
 			const timeMax = new Date(input.endMs).toISOString();
+			const accounts = deps.accounts().filter((a) => a.connected);
+			const byBroker = new Map(accounts.map((a) => [a.brokerId, a]));
+			const requestIds = input.calendarIds !== void 0 && input.calendarIds.length > 0 ? input.calendarIds : [...selected];
+			/** brokerId → google calendar ids to fetch */
+			const wanted = /* @__PURE__ */ new Map();
+			for (const stamped of requestIds) {
+				if (!selected.has(stamped)) continue;
+				const parsed = parseStampedCalendarId(stamped);
+				if (parsed === null) continue;
+				if (!byBroker.has(parsed.brokerId)) continue;
+				const list = wanted.get(parsed.brokerId) ?? [];
+				list.push(parsed.googleCalendarId);
+				wanted.set(parsed.brokerId, list);
+			}
 			const out = [];
-			for (const calendarId of calendarIds) try {
-				const events = await deps.api.listEvents({
-					calendarId,
-					timeMin,
-					timeMax
-				});
-				for (const ev of events) {
-					const mapped = mapGoogleEvent(calendarId, ev);
-					if (mapped) out.push(mapped);
+			for (const [brokerId, googleIds] of wanted) {
+				const account = byBroker.get(brokerId);
+				if (account === void 0) continue;
+				for (const googleCalendarId of googleIds) {
+					const stampedId = stampCalendarId(brokerId, googleCalendarId);
+					try {
+						const events = await account.api.listEvents({
+							calendarId: googleCalendarId,
+							timeMin,
+							timeMax
+						});
+						for (const ev of events) {
+							const mapped = mapGoogleEvent(stampedId, ev);
+							if (mapped) out.push(mapped);
+						}
+					} catch (err) {
+						deps.logger.warn("google calendar listEvents failed", { meta: {
+							brokerId,
+							calendarId: googleCalendarId,
+							error: err instanceof Error ? err.message : String(err)
+						} });
+					}
 				}
-			} catch (err) {
-				deps.logger.warn("google calendar listEvents failed", { meta: {
-					calendarId,
-					error: err instanceof Error ? err.message : String(err)
-				} });
 			}
 			return out;
 		}
@@ -52936,12 +53585,26 @@ function encodeHeaderWord(value) {
 function formatAddressList(addrs) {
 	return (Array.isArray(addrs) ? addrs : [addrs]).join(", ");
 }
-function buildFromHeader(cfg, accountEmail) {
-	const addr = cfg.fromAddress.trim() || accountEmail;
+function buildFromHeader(account) {
+	const addr = account.fromAddress.trim() || account.accountEmail;
 	if (!addr) return "";
-	if (cfg.fromName.trim()) return `${encodeHeaderWord(cfg.fromName.trim())} <${addr}>`;
+	if (account.fromName.trim()) return `${encodeHeaderWord(account.fromName.trim())} <${addr}>`;
 	return addr;
 }
+function extractEmail(fromHeader) {
+	const angled = /<([^>]+)>/.exec(fromHeader);
+	if (angled?.[1] !== void 0) return angled[1].trim().toLowerCase();
+	return fromHeader.trim().toLowerCase();
+}
+/** Pick account: match From to accountEmail/fromAddress; else first connected. */
+function selectGmailAccount(accounts, fromHeader) {
+	const connected = accounts.filter((a) => a.connected);
+	if (connected.length === 0) return null;
+	if (fromHeader === void 0 || fromHeader.trim().length === 0) return connected[0] ?? null;
+	const want = extractEmail(fromHeader);
+	for (const a of connected) if ([a.accountEmail, a.fromAddress].map((s) => s.trim().toLowerCase()).filter((s) => s.length > 0).includes(want)) return a;
+	return connected[0] ?? null;
+}
 /** Build a minimal multipart/alternative-capable plain (and optional HTML) message. */
 function buildRawMime(input) {
 	const lines = [`From: ${input.from}`, `To: ${formatAddressList(input.to)}`];
@@ -52978,17 +53641,17 @@ function createGmailSmtpProvider(deps) {
 	let lastVerifiedAt;
 	let lastError;
 	const status = () => {
-		const cfg = deps.getConfig();
-		const email = deps.getAccountEmail() || cfg.fromAddress.trim() || "gmail";
-		if (!deps.connected()) return {
+		const connected = deps.accounts().filter((a) => a.connected);
+		const host = connected[0]?.accountEmail || connected[0]?.fromAddress.trim() || (connected.length > 0 ? "gmail" : "gmail");
+		if (connected.length === 0) return {
 			ready: false,
-			host: email,
-			error: "Google account is not connected — open Connect Google.",
+			host,
+			error: "No Google broker connected — add one under Connectivity → Brokers and Connect.",
 			lastVerifiedAt
 		};
 		return {
 			ready: lastError === void 0 && lastVerifiedAt !== void 0,
-			host: email,
+			host: connected.length === 1 ? host : `${host} (+${connected.length - 1})`,
 			error: lastError,
 			lastVerifiedAt
 		};
@@ -52996,12 +53659,13 @@ function createGmailSmtpProvider(deps) {
 	return {
 		getStatus: async () => status(),
 		verify: async () => {
-			if (!deps.connected()) {
-				lastError = "Google account is not connected.";
+			const account = selectGmailAccount(deps.accounts(), void 0);
+			if (account === null) {
+				lastError = "No Google broker connected.";
 				return status();
 			}
 			try {
-				const token = await deps.getAccessToken();
+				const token = await account.getAccessToken();
 				const res = await http(`${GOOGLE_GMAIL_API}/users/me/profile`, { headers: { Authorization: `Bearer ${token}` } });
 				if (!res.ok) {
 					const text = await res.text();
@@ -53017,10 +53681,10 @@ function createGmailSmtpProvider(deps) {
 			}
 		},
 		sendEmail: async (input) => {
-			const cfg = deps.getConfig();
-			if (!deps.connected()) throw new Error("Google account is not connected — open Connect Google.");
-			const from = input.from?.trim() || buildFromHeader(cfg, deps.getAccountEmail());
-			if (!from) throw new Error("Set From address in Google Services settings (or connect an account).");
+			const account = selectGmailAccount(deps.accounts(), input.from);
+			if (account === null) throw new Error("No Google broker connected — add one under Connectivity → Brokers and Connect.");
+			const from = input.from?.trim() || buildFromHeader(account);
+			if (!from) throw new Error("Set From address on the Google broker (or Connect an account).");
 			const raw = buildRawMime({
 				from,
 				to: input.to,
@@ -53031,7 +53695,7 @@ function createGmailSmtpProvider(deps) {
 				text: input.text,
 				html: input.html
 			});
-			const token = await deps.getAccessToken();
+			const token = await account.getAccessToken();
 			const res = await http(`${GOOGLE_GMAIL_API}/users/me/messages/send`, {
 				method: "POST",
 				headers: {
@@ -53122,85 +53786,59 @@ function needsRefresh(state, nowMs = Date.now()) {
 	if (!state.accessToken) return true;
 	return state.accessExpiresAt <= nowMs;
 }
-//#endregion
-//#region src/google-settings-copy.ts
 /**
-* Operator-facing setup copy for Connectivity → Calendars / Email.
-* Keep Connect as a same-origin relative link so the admin session cookie
-* rides along (an absolute Public URL from a LAN admin tab drops the cookie).
-* Root-relative hrefs must survive `sanitizeInfoHtml` in ui-library.
+* Probe Client ID / secret against Google's token endpoint with a throwaway
+* authorization code. `invalid_client` means bad credentials; `invalid_grant`
+* / `redirect_uri_mismatch` mean Google accepted the client (code was fake).
 */
-/** Enable APIs library in Google Cloud Console. */
-var GOOGLE_CONSOLE_APIS_URL = "https://console.cloud.google.com/apis/library";
-/** Create / manage OAuth Web clients. */
-var GOOGLE_CONSOLE_CREDENTIALS_URL = "https://console.cloud.google.com/apis/credentials";
-function redirectUriDisplay(publicOrigin) {
-	if (publicOrigin === null || publicOrigin.length === 0) return `<public-hub>${OAUTH_CALLBACK_SUFFIX}`;
-	return `${publicOrigin.replace(/\/$/, "")}${OAUTH_CALLBACK_SUFFIX}`;
-}
-function consoleLinksHtml() {
-	return [
-		`<a href="${GOOGLE_CONSOLE_APIS_URL}">API library</a>`,
-		` · `,
-		`<a href="${GOOGLE_CONSOLE_CREDENTIALS_URL}">Credentials</a>`
-	].join("");
-}
-function introHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
-	const console = consoleLinksHtml();
-	if (cap === "smtp-provider") return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable the <strong>Gmail API</strong> (and Calendar API if you also use Calendars).</li>`,
-		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
-		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
-		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
-		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
-		"<li>Set From address (connected account or a verified send-as). Turn this integration off with the page <strong>Enable</strong> toggle when you do not want Gmail send — Calendar can stay connected.</li>",
-		"</ol>"
-	].join("");
-	if (cap === "calendar-source") return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable the <strong>Google Calendar API</strong> (and Gmail API if you also use Email).</li>`,
-		"<li>Under Credentials, create an OAuth client of type <strong>Web application</strong>.</li>",
-		`<li>Add this authorized redirect URI (Network → <strong>Public endpoint</strong>, not Internal): <code>${redirect}</code></li>`,
-		"<li>Paste Client ID and Client secret below, then <strong>Save</strong>.</li>",
-		`<li>Open <a href="${OAUTH_START_PATH}">Connect Google</a> while signed in as admin (same browser tab as this hub).</li>`,
-		"<li>Optionally restrict which calendars are exposed with the filter below.</li>",
-		"</ol>"
-	].join("");
-	return [
-		"<ol>",
-		`<li>Open Google Cloud Console (${console}) and enable <strong>Google Calendar API</strong> and <strong>Gmail API</strong>.</li>`,
-		"<li>Create a <strong>Web application</strong> OAuth client under Credentials.</li>",
-		`<li>Register redirect URI: <code>${redirect}</code> (Network → Public endpoint).</li>`,
-		`<li>Paste Client ID / secret, Save, then <a href="${OAUTH_START_PATH}">Connect Google</a>.</li>`,
-		"<li>Calendars and Email share one Google account; use each page’s <strong>Enable</strong> toggle to turn a capability off without revoking OAuth.</li>",
-		"</ol>"
-	].join("");
-}
-function connectHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
-	if (cap === "smtp-provider") return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
-		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
-		`Google must list exactly: <code>${redirect}</code>. `,
-		"If an older Connect predates Gmail send, revoke CamStack in Google Account → Security and Connect again. ",
-		`Console: ${consoleLinksHtml()}.`
-	].join("");
-	if (cap === "calendar-source") return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
-		"Connect requests <code>calendar.readonly</code> (and Gmail send for the Email page). ",
-		`Google must list exactly: <code>${redirect}</code>. `,
-		`Console: ${consoleLinksHtml()}.`
-	].join("");
-	return [
-		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a>. `,
-		`Redirect URI registered in Google Cloud must be <code>${redirect}</code>. `,
-		`Console: ${consoleLinksHtml()}.`
-	].join("");
-}
-function escapeHtml$1(s) {
-	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+async function probeGoogleOauthClient(cfg, http = { fetch }) {
+	const started = Date.now();
+	const body = new URLSearchParams({
+		code: "camstack-probe-invalid",
+		client_id: cfg.clientId,
+		client_secret: cfg.clientSecret,
+		redirect_uri: cfg.redirectUri,
+		grant_type: "authorization_code"
+	});
+	let res;
+	try {
+		res = await http.fetch(GOOGLE_TOKEN_URL, {
+			method: "POST",
+			headers: { "Content-Type": "application/x-www-form-urlencoded" },
+			body
+		});
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+	const text = await res.text();
+	let errorCode = "";
+	try {
+		const json = JSON.parse(text);
+		if (typeof json.error === "string") errorCode = json.error;
+	} catch {}
+	if (errorCode === "invalid_client") return {
+		ok: false,
+		error: "Invalid Client ID or Client secret (Google rejected the client)"
+	};
+	if (errorCode === "unauthorized_client") return {
+		ok: false,
+		error: "This OAuth client is not allowed to use the authorization-code grant"
+	};
+	if (errorCode === "invalid_grant" || errorCode === "redirect_uri_mismatch" || errorCode === "invalid_request") return {
+		ok: true,
+		latencyMs: Math.max(0, Date.now() - started)
+	};
+	if (res.ok) return {
+		ok: true,
+		latencyMs: Math.max(0, Date.now() - started)
+	};
+	return {
+		ok: false,
+		error: errorCode.length > 0 ? `Google token probe failed (${errorCode}): ${text.slice(0, 200)}` : `Google token probe failed (${res.status}): ${text.slice(0, 200)}`
+	};
 }
 //#endregion
 //#region src/oauth-redirect-origin.ts
@@ -53215,65 +53853,125 @@ function pickOauthRedirectOrigin(book) {
 //#endregion
 //#region src/google-services.addon.ts
 /**
-* Google Services — hub-only calendar-source + Gmail smtp-provider (same OAuth2).
+* Google Services — hub-only broker kind `google` + calendar-source + Gmail smtp.
+* One OAuth account = one broker entry; feature caps aggregate connected brokers.
 */
 var ADDON_ID = "google-services";
 var CALLBACK_PATH = "/oauth/callback";
 var START_PATH = "/oauth/start";
-var OauthStateSchema = object({
-	refreshToken: string().default(""),
-	accessToken: string().default(""),
+var DISCONNECT_PATH = "/oauth/disconnect";
+var LegacyOauthStateSchema = object({
+	refreshToken: string().default("").meta({ secret: true }),
+	accessToken: string().default("").meta({ secret: true }),
 	accessExpiresAt: number().default(0),
 	accountEmail: string().default("")
 });
 var GoogleServicesAddon = class extends BaseAddon {
-	secretStatePaths = ["oauth.refreshToken", "oauth.accessToken"];
-	oauthHandle = null;
-	oauth = { ...DEFAULT_OAUTH_STATE };
-	/** CSRF state → issuedAt ms */
+	secretStatePaths = [
+		"oauthAccounts.accounts[id].refreshToken",
+		"oauthAccounts.accounts[id].accessToken",
+		"oauth.refreshToken",
+		"oauth.accessToken"
+	];
+	oauthAccountsHandle = null;
+	registry = new GoogleBrokerRegistry();
+	/** CSRF state → { brokerId, popup, issuedAt } — popup mirrors OIDC D794. */
 	pendingStates = /* @__PURE__ */ new Map();
-	/** Cached Public-endpoint origin for settings copy (redirect URI display). */
 	publicOrigin = null;
 	constructor() {
 		super({ ...DEFAULT_GOOGLE_CONFIG });
 	}
 	async onInitialize() {
-		this.oauthHandle = this.state("oauth", OauthStateSchema, { ...DEFAULT_OAUTH_STATE });
-		this.oauth = await this.oauthHandle.get();
+		this.oauthAccountsHandle = this.state("oauthAccounts", GoogleOauthAccountsStateSchema, { accounts: [] });
+		let oauthAccounts = await this.oauthAccountsHandle.get();
+		const legacyHandle = this.state("oauth", LegacyOauthStateSchema, { ...DEFAULT_OAUTH_STATE });
+		const legacyOauth = await legacyHandle.get();
+		const migrated = migrateLegacyToBrokers(this.config, legacyOauth);
+		if (migrated.didMigrate) {
+			await this.updateGlobalSettings({
+				brokers: [...migrated.brokers],
+				clientId: void 0,
+				clientSecret: void 0,
+				calendarFilter: void 0,
+				fromAddress: void 0,
+				fromName: void 0
+			});
+			if (migrated.oauthAccounts.length > 0) {
+				oauthAccounts = { accounts: [...migrated.oauthAccounts] };
+				await this.oauthAccountsHandle.set(oauthAccounts);
+			}
+			await legacyHandle.set({ ...DEFAULT_OAUTH_STATE });
+			this.ctx.logger.info("google-services: migrated singleton OAuth to broker google_001", { meta: {
+				brokerId: "google_001",
+				accountEmail: legacyOauth.accountEmail || void 0
+			} });
+		} else if (oauthAccounts.accounts.length === 0 && legacyOauth.refreshToken.length > 0 && this.config.brokers.length > 0) {
+			oauthAccounts = { accounts: [{
+				id: this.config.brokers[0].id,
+				refreshToken: legacyOauth.refreshToken,
+				accessToken: legacyOauth.accessToken,
+				accessExpiresAt: legacyOauth.accessExpiresAt,
+				accountEmail: legacyOauth.accountEmail
+			}] };
+			await this.oauthAccountsHandle.set(oauthAccounts);
+			await legacyHandle.set({ ...DEFAULT_OAUTH_STATE });
+		}
+		this.registry.seedFrom(this.config.brokers, oauthAccounts.accounts);
 		await this.refreshPublicOrigin();
-		const api = createGoogleCalendarApi(async () => this.ensureAccessToken());
 		const calendarProvider = createGoogleCalendarSource({
 			logger: this.ctx.logger,
-			api,
-			connected: () => this.oauth.refreshToken.length > 0,
-			filterIds: () => this.parseFilter()
+			accounts: () => this.registry.listEntries().map((entry) => ({
+				brokerId: entry.id,
+				connected: this.registry.isConnected(entry.id),
+				api: createGoogleCalendarApi(() => this.ensureAccessToken(entry.id))
+			})),
+			selectedCalendarIds: () => new Set(this.config.calendarIds ?? [])
 		});
-		const smtpProvider = createGmailSmtpProvider({
-			getAccessToken: () => this.ensureAccessToken(),
-			getConfig: () => this.config,
-			getAccountEmail: () => this.oauth.accountEmail,
-			connected: () => this.oauth.refreshToken.length > 0
-		});
-		const routeProvider = buildAddonRouteProvider(ADDON_ID, [{
-			method: "GET",
-			path: START_PATH,
-			access: "admin",
-			description: "Begin Google OAuth (Calendar + Gmail send)",
-			handler: async (_req, reply) => this.handleStart(reply)
-		}, {
-			method: "GET",
-			path: CALLBACK_PATH,
-			access: "public",
-			rateLimit: "auth",
-			description: "Google OAuth callback",
-			handler: async (req, reply) => this.handleCallback(req, reply)
-		}]);
-		this.ctx.logger.info("Initialized — google calendar-source + gmail smtp", { meta: {
-			connected: this.oauth.refreshToken.length > 0,
-			accountEmail: this.oauth.accountEmail || void 0,
+		const smtpProvider = createGmailSmtpProvider({ accounts: () => this.registry.listEntries().map((entry) => {
+			const oauth = this.registry.getOauth(entry.id);
+			return {
+				brokerId: entry.id,
+				accountEmail: oauth?.accountEmail ?? "",
+				fromAddress: entry.fromAddress,
+				fromName: entry.fromName,
+				connected: this.registry.isConnected(entry.id),
+				getAccessToken: () => this.ensureAccessToken(entry.id)
+			};
+		}) });
+		const routeProvider = buildAddonRouteProvider(ADDON_ID, [
+			{
+				method: "GET",
+				path: START_PATH,
+				access: "admin",
+				description: "Begin Google OAuth for a broker (Calendar + Gmail send)",
+				handler: async (req, reply) => this.handleStart(req, reply)
+			},
+			{
+				method: "GET",
+				path: CALLBACK_PATH,
+				access: "public",
+				rateLimit: "auth",
+				description: "Google OAuth callback",
+				handler: async (req, reply) => this.handleCallback(req, reply)
+			},
+			{
+				method: "GET",
+				path: DISCONNECT_PATH,
+				access: "admin",
+				description: "Clear Google OAuth tokens for a broker (Sign out)",
+				handler: async (req, reply) => this.handleDisconnect(req, reply)
+			}
+		]);
+		this.ctx.logger.info("Initialized — google broker + calendar-source + gmail smtp", { meta: {
+			brokerCount: this.registry.size(),
+			connectedCount: this.registry.connectedSize(),
 			publicOrigin: this.publicOrigin ?? void 0
 		} });
 		return { providers: [
+			{
+				capability: brokerCapability,
+				provider: this.buildBrokerProvider()
+			},
 			{
 				capability: calendarSourceCapability,
 				provider: calendarProvider
@@ -53288,9 +53986,183 @@ var GoogleServicesAddon = class extends BaseAddon {
 			}
 		] };
 	}
-	async handleStart(reply) {
-		if (!this.config.clientId || !this.config.clientSecret) {
-			reply.status(400).send({ error: "Configure clientId and clientSecret in Google Services settings first." });
+	async onConfigChanged() {
+		const accounts = this.registry.listOauthAccounts();
+		this.registry.seedFrom(this.config.brokers, accounts);
+	}
+	buildBrokerProvider() {
+		const ownerAddonId = this.ctx.id;
+		const owns = (id) => this.registry.getEntry(id) !== null;
+		const notSupported = async () => {
+			throw new Error("google-services broker: publish/subscribe/getState are not supported — use calendar-source / smtp-provider");
+		};
+		return {
+			list: async ({ kind }) => this.registry.listBrokerInfos(ownerAddonId, kind),
+			get: async ({ id }) => {
+				const entry = this.registry.getEntry(id);
+				return entry ? this.registry.toBrokerInfo(entry, ownerAddonId) : null;
+			},
+			listProviders: async () => [{
+				addonId: ownerAddonId,
+				kinds: [{
+					kind: GOOGLE_BROKER_KIND,
+					label: GOOGLE_BROKER_KIND_LABEL,
+					interactiveConnectPath: `/addon/${ADDON_ID}${START_PATH}?brokerId={{brokerId}}`,
+					interactiveDisconnectPath: `/addon/${ADDON_ID}${DISCONNECT_PATH}?brokerId={{brokerId}}`
+				}]
+			}],
+			add: async ({ kind, name, settings, id }) => {
+				if (kind !== "google") throw new Error(`google-services: only kind '${GOOGLE_BROKER_KIND}' is handled here (got '${kind}')`);
+				const entry = this.registry.createEntry(name, settings, id !== void 0 ? { id } : {});
+				await this.persistBrokers();
+				return { id: entry.id };
+			},
+			remove: async ({ id }) => {
+				if (!owns(id)) return;
+				this.registry.removeEntry(id);
+				await this.persistBrokers();
+				await this.persistOauthAccounts();
+			},
+			testConnection: async ({ id }) => {
+				if (!owns(id)) return {
+					ok: false,
+					error: "unknown broker"
+				};
+				const entry = this.registry.getEntry(id);
+				if (entry === null) return {
+					ok: false,
+					error: "unknown broker"
+				};
+				if (!entry.clientId || !entry.clientSecret) return {
+					ok: false,
+					error: "Configure Client ID and Client secret first"
+				};
+				let redirectUri;
+				try {
+					redirectUri = await this.resolveRedirectUri();
+				} catch (err) {
+					return {
+						ok: false,
+						error: err instanceof Error ? err.message : String(err)
+					};
+				}
+				if (!this.registry.isConnected(id)) return probeGoogleOauthClient({
+					clientId: entry.clientId,
+					clientSecret: entry.clientSecret,
+					redirectUri
+				});
+				try {
+					const started = Date.now();
+					const token = await this.ensureAccessToken(id, { forceRefresh: true });
+					if (token.trim().length === 0) return {
+						ok: false,
+						error: "No access token after refresh — Sign out and Sign in again"
+					};
+					let res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${token}` } });
+					if (res.status === 401) {
+						const retryToken = await this.ensureAccessToken(id, { forceRefresh: true });
+						res = await fetch(GOOGLE_CALENDAR_LIST_URL, { headers: { Authorization: `Bearer ${retryToken}` } });
+					}
+					if (!res.ok) {
+						const text = await res.text();
+						return {
+							ok: false,
+							error: `Google Calendar probe failed (${res.status}): ${text.slice(0, 200)}`
+						};
+					}
+					const email = await this.fetchAccountEmail(token);
+					if (email.length > 0) {
+						const oauth = this.registry.getOauth(id);
+						if (oauth !== null && oauth.accountEmail !== email) {
+							this.registry.setOauth({
+								...oauth,
+								accountEmail: email
+							});
+							await this.persistOauthAccounts();
+						}
+					}
+					return {
+						ok: true,
+						latencyMs: Date.now() - started
+					};
+				} catch (err) {
+					return {
+						ok: false,
+						error: err instanceof Error ? err.message : String(err)
+					};
+				}
+			},
+			getSettings: async ({ id }) => {
+				const entry = this.registry.getEntry(id);
+				if (entry === null) return null;
+				return brokerEntryToSettings(entry);
+			},
+			setSettings: async ({ id, settings }) => {
+				if (!owns(id)) return;
+				this.registry.updateEntry(id, settings);
+				await this.persistBrokers();
+			},
+			getBrokerConfig: async ({ id }) => {
+				const entry = this.registry.getEntry(id);
+				if (entry === null) return null;
+				const oauth = this.registry.getOauth(id);
+				return {
+					...brokerEntryToSettings(entry),
+					accountEmail: oauth?.accountEmail ?? "",
+					connected: this.registry.isConnected(id)
+				};
+			},
+			getSettingsSchema: async ({ kind }) => {
+				if (kind !== "google") return null;
+				return buildGoogleBrokerSettingsSchema(this.publicOrigin);
+			},
+			testSettings: async ({ kind, settings }) => {
+				if (kind !== "google") return {
+					ok: false,
+					error: `unsupported kind: ${kind}`
+				};
+				try {
+					const parsed = object({
+						clientId: string().min(1),
+						clientSecret: string().min(1).meta({ secret: true })
+					}).parse(settings);
+					const redirectUri = await this.resolveRedirectUri();
+					return probeGoogleOauthClient({
+						clientId: parsed.clientId,
+						clientSecret: parsed.clientSecret,
+						redirectUri
+					});
+				} catch (err) {
+					return {
+						ok: false,
+						error: err instanceof Error ? err.message : String(err)
+					};
+				}
+			},
+			publish: notSupported,
+			subscribe: notSupported,
+			unsubscribe: notSupported,
+			getState: notSupported,
+			getStatus: async () => ({
+				brokerCount: this.registry.size(),
+				connectedCount: this.registry.connectedSize()
+			})
+		};
+	}
+	async handleStart(req, reply) {
+		const brokerIdRaw = req.query["brokerId"];
+		const brokerId = typeof brokerIdRaw === "string" ? brokerIdRaw.trim() : "";
+		if (!brokerId) {
+			reply.status(400).send({ error: "Missing brokerId query parameter — Connect from Connectivity → Brokers → Edit." });
+			return;
+		}
+		const entry = this.registry.getEntry(brokerId);
+		if (entry === null) {
+			reply.status(404).send({ error: `Unknown Google broker: ${brokerId}` });
+			return;
+		}
+		if (!entry.clientId || !entry.clientSecret) {
+			reply.status(400).send({ error: "Configure Client ID and Client secret on this broker, Save, then Connect." });
 			return;
 		}
 		let redirectUri;
@@ -53300,12 +54172,18 @@ var GoogleServicesAddon = class extends BaseAddon {
 			reply.status(500).send({ error: err instanceof Error ? err.message : String(err) });
 			return;
 		}
+		const popupRaw = req.query["popup"];
+		const popup = popupRaw === "1" || popupRaw === "true";
 		const state = randomBytes(16).toString("hex");
-		this.pendingStates.set(state, Date.now());
+		this.pendingStates.set(state, {
+			brokerId,
+			popup,
+			issuedAt: Date.now()
+		});
 		this.prunePendingStates();
 		const url = buildAuthorizeUrl({
-			clientId: this.config.clientId,
-			clientSecret: this.config.clientSecret,
+			clientId: entry.clientId,
+			clientSecret: entry.clientSecret,
 			redirectUri
 		}, state);
 		reply.redirect(url);
@@ -53313,42 +54191,138 @@ var GoogleServicesAddon = class extends BaseAddon {
 	async handleCallback(req, reply) {
 		const err = req.query["error"];
 		if (err) {
+			const statePeek = typeof req.query["state"] === "string" ? req.query["state"] : "";
+			const pendingPeek = statePeek ? this.pendingStates.get(statePeek) : void 0;
+			if (pendingPeek?.popup) {
+				this.pendingStates.delete(statePeek);
+				this.popupComplete(reply, {
+					ok: false,
+					brokerId: pendingPeek.brokerId,
+					error: String(err)
+				});
+				return;
+			}
 			this.html(reply, 400, `Google OAuth error: ${err}`);
 			return;
 		}
 		const code = req.query["code"];
 		const state = req.query["state"];
-		if (!code || !state || !this.pendingStates.has(state)) {
+		const pending = typeof state === "string" ? this.pendingStates.get(state) : void 0;
+		if (!code || !state || pending === void 0) {
 			this.html(reply, 400, "Invalid or expired OAuth state.");
 			return;
 		}
 		this.pendingStates.delete(state);
+		const { brokerId, popup } = pending;
+		const entry = this.registry.getEntry(brokerId);
+		if (entry === null) {
+			if (popup) {
+				this.popupComplete(reply, {
+					ok: false,
+					brokerId,
+					error: `Unknown Google broker: ${brokerId}`
+				});
+				return;
+			}
+			this.html(reply, 404, `Unknown Google broker: ${brokerId}`);
+			return;
+		}
 		try {
 			const redirectUri = await this.resolveRedirectUri();
 			const tokens = await exchangeCode({
-				clientId: this.config.clientId,
-				clientSecret: this.config.clientSecret,
+				clientId: entry.clientId,
+				clientSecret: entry.clientSecret,
 				redirectUri
 			}, code);
-			if (!tokens.refresh_token && !this.oauth.refreshToken) throw new Error("Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
-			this.oauth = applyTokenResponse(this.oauth, tokens);
-			const email = await this.fetchAccountEmail(this.oauth.accessToken);
-			if (email) this.oauth = {
-				...this.oauth,
-				accountEmail: email
+			const prev = this.registry.getOauth(brokerId) ?? {
+				id: brokerId,
+				...DEFAULT_OAUTH_STATE
+			};
+			if (!tokens.refresh_token && !prev.refreshToken) throw new Error("Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
+			const applied = applyTokenResponse({
+				refreshToken: prev.refreshToken,
+				accessToken: prev.accessToken,
+				accessExpiresAt: prev.accessExpiresAt,
+				accountEmail: prev.accountEmail
+			}, tokens);
+			const email = await this.fetchAccountEmail(applied.accessToken);
+			const next = {
+				id: brokerId,
+				refreshToken: applied.refreshToken,
+				accessToken: applied.accessToken,
+				accessExpiresAt: applied.accessExpiresAt,
+				accountEmail: email || applied.accountEmail
 			};
-			await this.persistOauth();
+			this.registry.setOauth(next);
+			await this.persistOauthAccounts();
+			if (next.accountEmail && (entry.name === "Google account" || entry.name.startsWith("google_"))) {
+				const renamed = {
+					...entry,
+					name: next.accountEmail
+				};
+				this.registry.replaceEntries(this.registry.listEntries().map((e) => e.id === brokerId ? renamed : e));
+				await this.persistBrokers();
+			}
 			this.ctx.logger.info("google oauth connected", { meta: {
-				hasRefresh: this.oauth.refreshToken.length > 0,
-				accountEmail: this.oauth.accountEmail || void 0
+				brokerId,
+				hasRefresh: next.refreshToken.length > 0,
+				accountEmail: next.accountEmail || void 0
 			} });
-			this.html(reply, 200, "Google account connected (Calendar + Gmail send). You can close this window.");
+			if (popup) {
+				this.popupComplete(reply, {
+					ok: true,
+					brokerId,
+					message: "Google account connected. This window should close."
+				});
+				return;
+			}
+			this.html(reply, 200, `Google account connected for ${brokerId} (Calendar + Gmail send). You can close this window.`);
 		} catch (e) {
 			const message = e instanceof Error ? e.message : String(e);
-			this.ctx.logger.warn("google oauth callback failed", { meta: { error: message } });
+			this.ctx.logger.warn("google oauth callback failed", { meta: {
+				brokerId,
+				error: message
+			} });
+			if (popup) {
+				this.popupComplete(reply, {
+					ok: false,
+					brokerId,
+					error: message
+				});
+				return;
+			}
 			this.html(reply, 500, `OAuth failed: ${message}`);
 		}
 	}
+	/**
+	* Popup completion page (OIDC D794 pattern): postMessage to opener at the
+	* hub origin, then close. Google never redirects back to admin-ui — this
+	* page is the only return surface.
+	*/
+	popupComplete(reply, outcome) {
+		const payload = JSON.stringify({
+			type: "camstack:broker-oauth",
+			ok: outcome.ok,
+			brokerId: outcome.brokerId,
+			...outcome.error !== void 0 ? { error: outcome.error } : {}
+		});
+		const body = outcome.ok ? outcome.message ?? "Done. This window should close." : `OAuth failed: ${outcome.error ?? "unknown"}`;
+		reply.header("content-type", "text/html; charset=utf-8");
+		reply.status(outcome.ok ? 200 : 400).send(`<!doctype html><html><head><title>Google</title></head><body>
+<p>${escapeHtml(body)}</p>
+<script>
+(function () {
+  var msg = ${payload};
+  try {
+    if (window.opener) {
+      window.opener.postMessage(msg, window.location.origin);
+    }
+  } catch (e) {}
+  setTimeout(function () { window.close(); }, 200);
+})();
+<\/script>
+</body></html>`);
+	}
 	async fetchAccountEmail(accessToken) {
 		try {
 			const res = await fetch(GOOGLE_USERINFO_URL, { headers: { Authorization: `Bearer ${accessToken}` } });
@@ -53365,27 +54339,92 @@ var GoogleServicesAddon = class extends BaseAddon {
 	}
 	prunePendingStates() {
 		const cutoff = Date.now() - 10 * 6e4;
-		for (const [k, at] of this.pendingStates) if (at < cutoff) this.pendingStates.delete(k);
+		for (const [k, v] of this.pendingStates) if (v.issuedAt < cutoff) this.pendingStates.delete(k);
+	}
+	async persistBrokers() {
+		await this.updateGlobalSettings({ brokers: [...this.registry.listEntries()] });
 	}
-	async persistOauth() {
-		if (!this.oauthHandle) return;
-		await this.oauthHandle.set({ ...this.oauth });
+	async persistOauthAccounts() {
+		if (!this.oauthAccountsHandle) return;
+		await this.oauthAccountsHandle.set({ accounts: [...this.registry.listOauthAccounts()] });
 	}
-	async ensureAccessToken() {
-		if (!this.oauth.refreshToken) throw new Error("Google Calendar is not connected — open /addon/google-services/oauth/start");
-		if (!needsRefresh(this.oauth)) return this.oauth.accessToken;
+	/** Stamped catalog for Connectivity → Calendars (`optionsFrom`). */
+	async loadStampedCalendarCatalog() {
+		const out = [];
+		for (const entry of this.registry.listEntries()) {
+			if (!this.registry.isConnected(entry.id)) continue;
+			try {
+				const list = await createGoogleCalendarApi(() => this.ensureAccessToken(entry.id)).listCalendars();
+				const accountLabel = this.registry.getOauth(entry.id)?.accountEmail || entry.name;
+				for (const c of list) {
+					const summary = c.summary.trim().length > 0 ? c.summary : c.id;
+					out.push({
+						value: stampCalendarId(entry.id, c.id),
+						label: `${summary} (${accountLabel})`
+					});
+				}
+			} catch (err) {
+				this.ctx.logger.warn("google calendar catalog failed", { meta: {
+					brokerId: entry.id,
+					error: err instanceof Error ? err.message : String(err)
+				} });
+			}
+		}
+		return out.toSorted((a, b) => a.label.localeCompare(b.label));
+	}
+	async ensureAccessToken(brokerId, opts = {}) {
+		const entry = this.registry.getEntry(brokerId);
+		const oauth = this.registry.getOauth(brokerId);
+		if (entry === null || oauth === null || !oauth.refreshToken.trim()) throw new Error(`Google broker ${brokerId} is not connected — use Sign in under Connectivity → Brokers`);
+		if (!entry.clientId.trim() || !entry.clientSecret.trim()) throw new Error("Configure Client ID and Client secret before refreshing the Google token");
+		const state = {
+			refreshToken: oauth.refreshToken.trim(),
+			accessToken: oauth.accessToken.trim(),
+			accessExpiresAt: oauth.accessExpiresAt,
+			accountEmail: oauth.accountEmail
+		};
+		if (!opts.forceRefresh && !needsRefresh(state)) return state.accessToken;
 		const tokens = await refreshAccessToken({
-			clientId: this.config.clientId,
-			clientSecret: this.config.clientSecret
-		}, this.oauth.refreshToken);
-		this.oauth = applyTokenResponse(this.oauth, tokens);
-		await this.persistOauth();
-		return this.oauth.accessToken;
+			clientId: entry.clientId.trim(),
+			clientSecret: entry.clientSecret.trim()
+		}, state.refreshToken);
+		if (typeof tokens.access_token !== "string" || tokens.access_token.trim().length === 0) throw new Error("Google token refresh returned an empty access_token — Sign out and Sign in again");
+		const nextState = applyTokenResponse(state, tokens);
+		this.registry.setOauth({
+			id: brokerId,
+			refreshToken: nextState.refreshToken,
+			accessToken: nextState.accessToken,
+			accessExpiresAt: nextState.accessExpiresAt,
+			accountEmail: nextState.accountEmail
+		});
+		await this.persistOauthAccounts();
+		return nextState.accessToken;
 	}
-	parseFilter() {
-		const raw = this.config.calendarFilter.trim();
-		if (!raw) return /* @__PURE__ */ new Set();
-		return new Set(raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0));
+	async handleDisconnect(req, reply) {
+		const brokerIdRaw = req.query["brokerId"];
+		const brokerId = typeof brokerIdRaw === "string" ? brokerIdRaw.trim() : "";
+		if (!brokerId) {
+			reply.status(400).send({ error: "Missing brokerId query parameter" });
+			return;
+		}
+		if (this.registry.getEntry(brokerId) === null) {
+			reply.status(404).send({ error: `Unknown Google broker: ${brokerId}` });
+			return;
+		}
+		const popupRaw = req.query["popup"];
+		const popup = popupRaw === "1" || popupRaw === "true";
+		this.registry.removeOauth(brokerId);
+		await this.persistOauthAccounts();
+		this.ctx.logger.info("google oauth disconnected", { meta: { brokerId } });
+		if (popup) {
+			this.popupComplete(reply, {
+				ok: true,
+				brokerId,
+				message: "Google account disconnected. This window should close."
+			});
+			return;
+		}
+		this.html(reply, 200, `Google account disconnected for ${brokerId}. You can close this window.`);
 	}
 	async resolveRedirectUri() {
 		await this.refreshPublicOrigin();
@@ -53401,85 +54440,22 @@ var GoogleServicesAddon = class extends BaseAddon {
 		}
 	}
 	/**
-	* Connectivity asks for settings scoped to the page capability, so Calendar
-	* and Email do not each redraw the other's fields (same pattern as
-	* mqtt-broker under `broker`). The addon page (no cap) keeps every section.
+	* Connectivity Calendars / Email: point at Brokers (no duplicate OAuth fields).
+	* Addon page without cap: same pointer + note.
 	*/
 	globalSettingsSchema(cap) {
 		const scoped = asSettingsCap(cap);
-		return this.schema({ sections: [
-			{
-				id: "setup-intro",
-				title: "Setup",
-				description: scoped === "smtp-provider" ? "Connect a Google account for Gmail send (same OAuth as Calendars)." : scoped === "calendar-source" ? "Connect a Google account for Calendar (same OAuth as Email)." : "One Google account for Calendar and optional Gmail send.",
-				columns: 1,
-				fields: [{
-					type: "info",
-					key: "_setupSteps",
-					label: "Steps",
-					format: "html",
-					content: introHtml(scoped, this.publicOrigin)
-				}]
-			},
-			{
-				id: "google-oauth",
-				title: "Google account",
-				description: "OAuth client credentials (Web application) stored in the hub keychain.",
-				columns: 1,
-				fields: [
-					{
-						type: "text",
-						key: "clientId",
-						label: "Client ID"
-					},
-					{
-						type: "password",
-						key: "clientSecret",
-						label: "Client secret",
-						showToggle: true
-					},
-					{
-						type: "info",
-						key: "_connectInfo",
-						label: "Connect",
-						format: "html",
-						content: connectHtml(scoped, this.publicOrigin)
-					}
-				]
-			},
-			...scoped === "smtp-provider" ? [] : [{
-				id: "google-calendar",
-				title: "Google Calendar",
-				description: "Which calendars this hub exposes as calendar-source entries.",
-				columns: 1,
-				fields: [{
-					type: "text",
-					key: "calendarFilter",
-					label: "Calendar id filter (optional)",
-					description: "Comma-separated Google calendar ids to expose. Empty = all calendars the account can read."
-				}]
-			}],
-			...scoped === "calendar-source" ? [] : [{
-				id: "gmail-send",
-				title: "Gmail send",
-				description: "Delivery via the Gmail API. Disable this capability with the page Enable toggle — not a second switch here. From must be the connected account or a verified send-as.",
-				columns: 1,
-				fields: [{
-					type: "text",
-					key: "fromAddress",
-					label: "From address",
-					description: "Defaults to the connected Google account email when empty."
-				}, {
-					type: "text",
-					key: "fromName",
-					label: "From display name (optional)"
-				}]
-			}]
-		] });
+		return this.schema(buildGoogleFeatureSettingsSchema(scoped, this.publicOrigin));
 	}
 	async getGlobalSettings(overlay, cap, nodeId) {
 		await this.refreshPublicOrigin();
-		return super.getGlobalSettings(overlay, cap, nodeId);
+		if (cap !== "calendar-source") return super.getGlobalSettings(overlay, cap, nodeId);
+		const catalog = await this.loadStampedCalendarCatalog();
+		return super.getGlobalSettings({
+			...overlay,
+			calendarIds: this.config.calendarIds ?? [],
+			...catalog.length > 0 ? { _calendarCatalog: catalog } : {}
+		}, cap, nodeId);
 	}
 };
 function asSettingsCap(cap) {
@@ -53489,4 +54465,4 @@ function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
-export { GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_GMAIL_SEND_SCOPE as _, redirectUriDisplay as a, OAUTH_START_PATH as b, exchangeCode as c, buildRawMime as d, createGmailSmtpProvider as f, DEFAULT_GOOGLE_CONFIG as g, mapGoogleEvent as h, introHtml as i, needsRefresh as l, createGoogleCalendarSource as m, GOOGLE_CONSOLE_CREDENTIALS_URL as n, applyTokenResponse as o, createGoogleCalendarApi as p, connectHtml as r, buildAuthorizeUrl as s, GOOGLE_CONSOLE_APIS_URL as t, refreshAccessToken as u, GOOGLE_OAUTH_SCOPES as v, GoogleServicesConfigSchema as y };
+export { GOOGLE_GMAIL_SEND_SCOPE as C, OAUTH_START_PATH as E, GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_BROKER_KIND as S, GoogleServicesConfigSchema as T, GoogleBrokerRegistry as _, refreshAccessToken as a, stampCalendarId as b, selectGmailAccount as c, mapGoogleEvent as d, GOOGLE_CONSOLE_APIS_URL as f, redirectUriDisplay as g, introHtml as h, needsRefresh as i, createGoogleCalendarApi as l, connectHtml as m, buildAuthorizeUrl as n, buildRawMime as o, GOOGLE_CONSOLE_CREDENTIALS_URL as p, exchangeCode as r, createGmailSmtpProvider as s, applyTokenResponse as t, createGoogleCalendarSource as u, migrateLegacyToBrokers as v, GOOGLE_OAUTH_SCOPES as w, DEFAULT_GOOGLE_CONFIG as x, parseStampedCalendarId as y };