@camstack/addon-google-services 0.2.11 → 0.2.13

package/dist/google-services.addon.mjs

@@ -1,5 +1,5 @@
 import { randomBytes } from "node:crypto";
-//#region ../types/dist/event-category-BvOFi6PY.mjs
+//#region ../types/dist/event-category-DOl51-Ij.mjs
 var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	EventCategory["SystemBoot"] = "system.boot";
 	EventCategory["SystemAddonsReady"] = "system.addons-ready";
@@ -78,9 +78,18 @@ var EventCategory = /* @__PURE__ */ function(EventCategory) {
 	/**
 	* The node's one-shot runner boot check (D877): planned runners against the
 	* process service, `degraded` when any is failed, refused or missing. The
-	* alert centre turns it into one alert and a direct critical push.
+	* alert centre turns it into one critical alert.
 	*/
 	EventCategory["SystemRunnerCheck"] = "system.runner-check";
+	/**
+	* An alert EPISODE opened or closed, emitted by the alert centre for alerts
+	* of severity `critical` or `error` (`AlertEpisodePayload`). The alert
+	* centre sends no notification of its own: Notification Center turns this
+	* into the `alert-critical` / `alert-error` / `alert-critical-resolved`
+	* system-event kinds, and reconciles from the alerts store because a bus
+	* event may be dropped (D8, D11).
+	*/
+	EventCategory["AlertEpisode"] = "alert.episode";
 	EventCategory["AddonError"] = "addon.error";
 	EventCategory["AddonPageReady"] = "addon.page-ready";
 	EventCategory["AddonWidgetReady"] = "addon.widget-ready";
@@ -5538,7 +5547,7 @@ var ZodIssueCode = {
 var ZodFirstPartyTypeKind;
 ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {});
 //#endregion
-//#region ../types/dist/sleep-BegKjwUu.mjs
+//#region ../types/dist/sleep-BxjU_fJM.mjs
 /**
 * The audio chunk plane's byte format, and the ONE expansion from a coded
 * window to float samples (D455).
@@ -7920,6 +7929,12 @@ function normalizeAddonInitResult(result) {
 	if (Array.isArray(result)) return { providers: result };
 	return result;
 }
+/**
+* The share-view scope kinds a `csv_*` share token can carry. The hub mints
+* and validates them (`share-token.service.ts` builds its enum from this
+* list); a data plane names the kinds it ACCEPTS in `share`.
+*/
+var SHARE_VIEW_KINDS = ["grid-view", "events-view"];
 /** The wire shape of {@link PeerBytesTicket} — see the type for what it is. */
 var PeerBytesTicketSchema = object({
 	/** `http://127.0.0.1:<port>/<token>`. One `GET` takes it. */
@@ -12902,6 +12917,229 @@ var ConvertResultSchema = object({
 		files: array(string()).readonly()
 	})).readonly()
 });
+/**
+* Zod schemas for persisted record types.
+*
+* These schemas serve as the single source of truth for types that are
+* stored in the settings-store backend and retrieved via tRPC. They
+* replace the manual TypeScript interfaces with schema-derived types,
+* enabling runtime validation when reading from the backend.
+*
+* Convention: each schema is named `<Type>Schema`, the inferred TS type
+* keeps the original name for backward compatibility.
+*/
+/**
+* Auth model (v2 — 2026-05-12 caps-only):
+*
+* Two principals:
+*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
+*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
+*
+* No role enum. There used to be `viewer / agent / scoped` and earlier
+* `super_admin` — collapsed onto the single boolean because every
+* non-admin caller is governed by the same scope-check rules; the
+* distinction was only ever used to route role-specific procedures
+* which we no longer have. CLI / webhook integrations are `cst_*` tokens
+* with `isAdmin: false` + an explicit scope list.
+*/
+/** Per-method access flavour. Materialised on every cap method via codegen. */
+var MethodAccessSchema = _enum([
+	"view",
+	"create",
+	"delete"
+]);
+/**
+* A single scope grant. Three forms — checked in matcher with OR
+* semantics; the first match decides whether the call passes:
+*
+*   - `category` — broadest. `target: 'device' | 'system'` selects every
+*     cap with the matching `scope` declaration. New caps inherit grants
+*     automatically — adding a device cap to the codebase makes it
+*     reachable to every user with `category:device [...]` without a
+*     re-grant. Use this for "family viewer" / "operator" tiers.
+*
+*   - `addon` — every cap that ships inside a given addon id. Niche;
+*     useful when an integration needs to interact with one specific
+*     addon's surface regardless of how many caps it exports.
+*
+*   - `capability` — the most precise form. Single cap name. Use for
+*     integration tokens where you want to grant `addons.installPackage`
+*     and nothing else.
+*
+* `access` is REQUIRED with min 1 element. `admin` bypass is the
+* "give me everything" escape; there is no wildcard scope.
+*/
+var AllowedProviderSchema = union([literal("*"), array(string())]);
+var AllowedDevicesSchema = record(string(), union([literal("*"), array(string())]));
+var CapScopeSchema = _enum(["device", "system"]);
+/**
+* DeviceSelector (scope model v3 — 2026-08-12).
+*
+* A `device` grant no longer carries a frozen list of deviceIds. It carries
+* a SELECTOR the matcher resolves against the live fleet, so the grant can be
+* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
+* AFTER the grant was minted — no re-grant, no re-login.
+*
+*   - `all`       — every device in the deployment. The broad viewer/operator
+*     lever without a `category` grant (a `category` grant also covers device
+*     caps that carry no deviceId; `all` is specifically the device set).
+*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
+*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
+*     is NOT covered until the grant is edited.
+*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
+*     DYNAMIC. A device that changes type, or a new device of the type,
+*     re-resolves on the next request.
+*   - `locations` — every device whose operator-assigned `location` label is
+*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
+*     null/unset location matches NO `locations` selector.
+*/
+var DeviceSelectorSchema = discriminatedUnion("kind", [
+	object({ kind: literal("all") }),
+	object({
+		kind: literal("ids"),
+		ids: array(number().int()).min(1)
+	}),
+	object({
+		kind: literal("types"),
+		types: array(_enum(DeviceType)).min(1)
+	}),
+	object({
+		kind: literal("locations"),
+		locations: array(string().min(1)).min(1)
+	})
+]);
+var DeviceTokenScopeSchema = object({
+	type: literal("device"),
+	/** The device SET this grant covers — resolved against the live fleet. */
+	selector: DeviceSelectorSchema,
+	access: array(MethodAccessSchema).min(1),
+	/**
+	* Whether a grant on a PARENT device transparently covers its accessory
+	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
+	* Direction is parent → children ONLY.
+	*
+	* Absent → the matcher DERIVES it from the access flavour: `view`
+	* inherits (a camera viewer sees the camera's accessories), `create` /
+	* `delete` do NOT (actuating/removing a child is an explicit act the
+	* operator must grant on the child, not inherit from the parent). Set it
+	* explicitly to override that default per grant.
+	*/
+	includeLinked: boolean().optional()
+});
+/**
+* v2 → v3 lazy migration. A pre-v3 `device` grant carried
+* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
+* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
+* EVERY parse path — stored records AND the JWT-carried scope arrays
+* normalised at the request boundary ({@link normalizeTokenScopes} in
+* `device-selector.ts`). Chosen over a one-time DB migration because a
+* migration cannot reach a JWT already in a client's hands; parse-time
+* migration covers both without a flag day. No cast — the raw object is read
+* through `Reflect.get` (its static type is `unknown`).
+*/
+function migrateLegacyTokenScope(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
+	if (Reflect.get(raw, "type") !== "device") return raw;
+	if (Reflect.get(raw, "selector") !== void 0) return raw;
+	const targets = Reflect.get(raw, "targets");
+	if (!Array.isArray(targets)) return raw;
+	return {
+		type: "device",
+		selector: {
+			kind: "ids",
+			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
+		},
+		access: Reflect.get(raw, "access")
+	};
+}
+var TokenScopeSchema = preprocess(migrateLegacyTokenScope, discriminatedUnion("type", [
+	object({
+		type: literal("category"),
+		target: CapScopeSchema,
+		access: array(MethodAccessSchema).min(1)
+	}),
+	object({
+		type: literal("capability"),
+		target: string(),
+		access: array(MethodAccessSchema).min(1)
+	}),
+	object({
+		type: literal("addon"),
+		target: string(),
+		access: array(MethodAccessSchema).min(1)
+	}),
+	DeviceTokenScopeSchema
+]));
+object({
+	id: string(),
+	username: string(),
+	passwordHash: string(),
+	/**
+	* Admin bypass. When true, the middleware skips the scope-access
+	* check entirely. There is no other axis of privilege; the legacy
+	* role enum collapsed onto this boolean in v2.
+	*/
+	isAdmin: boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	/**
+	* Scopes granted to this user. Admins bypass; their `scopes` is
+	* ignored. Non-admins without scopes are locked out of every
+	* protected call.
+	*/
+	scopes: array(TokenScopeSchema).default([]),
+	createdAt: number(),
+	updatedAt: number()
+});
+object({
+	id: string(),
+	label: string(),
+	isAdmin: boolean().default(false),
+	allowedProviders: AllowedProviderSchema,
+	allowedDevices: AllowedDevicesSchema,
+	tokenHash: string(),
+	tokenPrefix: string(),
+	createdAt: number(),
+	lastUsedAt: number().optional()
+});
+object({
+	id: string(),
+	userId: string(),
+	name: string(),
+	tokenHash: string(),
+	tokenPrefix: string(),
+	scopes: array(TokenScopeSchema),
+	expiresAt: number().nullish(),
+	lastUsedAt: number().nullish(),
+	createdAt: number()
+});
+/** What a share-view grant lets its holder see. */
+var ShareViewGrantSchema = object({
+	kind: _enum(SHARE_VIEW_KINDS),
+	deviceIds: array(number().int().nonnegative()).min(1).max(64),
+	/** Talk-back, opt-in at mint time; absent means off. */
+	talk: boolean().optional()
+});
+var ShareViewScopeSchema = object({
+	type: literal("share-view"),
+	grant: ShareViewGrantSchema
+});
+var AddonRoutesScopeSchema = object({
+	type: literal("addon-routes"),
+	access: array(MethodAccessSchema).min(1)
+});
+var CredentialScopeSchema = union([
+	literal("*"),
+	ShareViewScopeSchema,
+	AddonRoutesScopeSchema,
+	TokenScopeSchema
+]);
+object({
+	kind: literal("credential"),
+	sub: string().min(1),
+	jti: string().min(16),
+	scopes: array(CredentialScopeSchema).min(1)
+});
 _enum(["new-session", "step-up"]);
 /** The languages the hub's app landing pages are written in (D858). */
 var AppPageLangSchema = _enum(["en", "it"]);
@@ -13637,7 +13875,14 @@ var AlertSeveritySchema = _enum([
 ]);
 var AlertActionSchema = object({
 	label: string(),
-	href: string().optional()
+	href: string().optional(),
+	/**
+	* How `href` is followed. Absent / `app`: an admin-ui route (client-side).
+	* `server`: a route the HUB serves (an addon HTTP route such as an OAuth
+	* start) — the browser must leave the SPA with a full navigation, because
+	* the SPA has no such route and would bounce to the home page.
+	*/
+	navigation: _enum(["app", "server"]).optional()
 });
 var AlertStatusSchema = _enum([
 	"active",
@@ -42062,6 +42307,9 @@ var NcSystemEventKindSchema = _enum([
 	"server-updated",
 	"export-completed",
 	"backup-completed",
+	"alert-critical",
+	"alert-error",
+	"alert-critical-resolved",
 	"camera-online",
 	"camera-offline",
 	"camera-disabled",
@@ -44097,202 +44345,6 @@ method(object({}), object({ rules: array(NcRuleSchema) }), { auth: "admin" }), m
 	auth: "admin"
 }), method(NcAlarmSensorsInputSchema, NcAlarmSensorsSchema, { auth: "admin" });
 /**
-* Zod schemas for persisted record types.
-*
-* These schemas serve as the single source of truth for types that are
-* stored in the settings-store backend and retrieved via tRPC. They
-* replace the manual TypeScript interfaces with schema-derived types,
-* enabling runtime validation when reading from the backend.
-*
-* Convention: each schema is named `<Type>Schema`, the inferred TS type
-* keeps the original name for backward compatibility.
-*/
-/**
-* Auth model (v2 — 2026-05-12 caps-only):
-*
-* Two principals:
-*   - `isAdmin: true`  — full bypass. Admin scope set is ignored.
-*   - `isAdmin: false` — every call gated by `scopes` (see TokenScope).
-*
-* No role enum. There used to be `viewer / agent / scoped` and earlier
-* `super_admin` — collapsed onto the single boolean because every
-* non-admin caller is governed by the same scope-check rules; the
-* distinction was only ever used to route role-specific procedures
-* which we no longer have. CLI / webhook integrations are `cst_*` tokens
-* with `isAdmin: false` + an explicit scope list.
-*/
-/** Per-method access flavour. Materialised on every cap method via codegen. */
-var MethodAccessSchema = _enum([
-	"view",
-	"create",
-	"delete"
-]);
-/**
-* A single scope grant. Three forms — checked in matcher with OR
-* semantics; the first match decides whether the call passes:
-*
-*   - `category` — broadest. `target: 'device' | 'system'` selects every
-*     cap with the matching `scope` declaration. New caps inherit grants
-*     automatically — adding a device cap to the codebase makes it
-*     reachable to every user with `category:device [...]` without a
-*     re-grant. Use this for "family viewer" / "operator" tiers.
-*
-*   - `addon` — every cap that ships inside a given addon id. Niche;
-*     useful when an integration needs to interact with one specific
-*     addon's surface regardless of how many caps it exports.
-*
-*   - `capability` — the most precise form. Single cap name. Use for
-*     integration tokens where you want to grant `addons.installPackage`
-*     and nothing else.
-*
-* `access` is REQUIRED with min 1 element. `admin` bypass is the
-* "give me everything" escape; there is no wildcard scope.
-*/
-var AllowedProviderSchema = union([literal("*"), array(string())]);
-var AllowedDevicesSchema = record(string(), union([literal("*"), array(string())]));
-var CapScopeSchema = _enum(["device", "system"]);
-/**
-* DeviceSelector (scope model v3 — 2026-08-12).
-*
-* A `device` grant no longer carries a frozen list of deviceIds. It carries
-* a SELECTOR the matcher resolves against the live fleet, so the grant can be
-* DYNAMIC: a `types:['camera']` selector automatically covers a camera added
-* AFTER the grant was minted — no re-grant, no re-login.
-*
-*   - `all`       — every device in the deployment. The broad viewer/operator
-*     lever without a `category` grant (a `category` grant also covers device
-*     caps that carry no deviceId; `all` is specifically the device set).
-*   - `ids`       — an explicit deviceId list. This is what a v2 `device:[…]`
-*     grant migrates to (see {@link TokenScopeSchema}); STATIC — a new camera
-*     is NOT covered until the grant is edited.
-*   - `types`     — every device of a `DeviceType` (e.g. every `camera`).
-*     DYNAMIC. A device that changes type, or a new device of the type,
-*     re-resolves on the next request.
-*   - `locations` — every device whose operator-assigned `location` label is
-*     in the set (e.g. "Garden", "Front door"). DYNAMIC. A device with a
-*     null/unset location matches NO `locations` selector.
-*/
-var DeviceSelectorSchema = discriminatedUnion("kind", [
-	object({ kind: literal("all") }),
-	object({
-		kind: literal("ids"),
-		ids: array(number().int()).min(1)
-	}),
-	object({
-		kind: literal("types"),
-		types: array(_enum(DeviceType)).min(1)
-	}),
-	object({
-		kind: literal("locations"),
-		locations: array(string().min(1)).min(1)
-	})
-]);
-var DeviceTokenScopeSchema = object({
-	type: literal("device"),
-	/** The device SET this grant covers — resolved against the live fleet. */
-	selector: DeviceSelectorSchema,
-	access: array(MethodAccessSchema).min(1),
-	/**
-	* Whether a grant on a PARENT device transparently covers its accessory
-	* CHILDREN (siren / floodlight / PIR) via the persisted-parentage walk.
-	* Direction is parent → children ONLY.
-	*
-	* Absent → the matcher DERIVES it from the access flavour: `view`
-	* inherits (a camera viewer sees the camera's accessories), `create` /
-	* `delete` do NOT (actuating/removing a child is an explicit act the
-	* operator must grant on the child, not inherit from the parent). Set it
-	* explicitly to override that default per grant.
-	*/
-	includeLinked: boolean().optional()
-});
-/**
-* v2 → v3 lazy migration. A pre-v3 `device` grant carried
-* `targets: string[]` (stringified deviceIds); it rewrites to the equivalent
-* `selector: {kind:'ids', ids}`. Applied as a `preprocess` so it runs on
-* EVERY parse path — stored records AND the JWT-carried scope arrays
-* normalised at the request boundary ({@link normalizeTokenScopes} in
-* `device-selector.ts`). Chosen over a one-time DB migration because a
-* migration cannot reach a JWT already in a client's hands; parse-time
-* migration covers both without a flag day. No cast — the raw object is read
-* through `Reflect.get` (its static type is `unknown`).
-*/
-function migrateLegacyTokenScope(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return raw;
-	if (Reflect.get(raw, "type") !== "device") return raw;
-	if (Reflect.get(raw, "selector") !== void 0) return raw;
-	const targets = Reflect.get(raw, "targets");
-	if (!Array.isArray(targets)) return raw;
-	return {
-		type: "device",
-		selector: {
-			kind: "ids",
-			ids: targets.map((t) => typeof t === "string" ? Number(t) : t).filter((n) => typeof n === "number" && Number.isInteger(n))
-		},
-		access: Reflect.get(raw, "access")
-	};
-}
-var TokenScopeSchema = preprocess(migrateLegacyTokenScope, discriminatedUnion("type", [
-	object({
-		type: literal("category"),
-		target: CapScopeSchema,
-		access: array(MethodAccessSchema).min(1)
-	}),
-	object({
-		type: literal("capability"),
-		target: string(),
-		access: array(MethodAccessSchema).min(1)
-	}),
-	object({
-		type: literal("addon"),
-		target: string(),
-		access: array(MethodAccessSchema).min(1)
-	}),
-	DeviceTokenScopeSchema
-]));
-object({
-	id: string(),
-	username: string(),
-	passwordHash: string(),
-	/**
-	* Admin bypass. When true, the middleware skips the scope-access
-	* check entirely. There is no other axis of privilege; the legacy
-	* role enum collapsed onto this boolean in v2.
-	*/
-	isAdmin: boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	/**
-	* Scopes granted to this user. Admins bypass; their `scopes` is
-	* ignored. Non-admins without scopes are locked out of every
-	* protected call.
-	*/
-	scopes: array(TokenScopeSchema).default([]),
-	createdAt: number(),
-	updatedAt: number()
-});
-object({
-	id: string(),
-	label: string(),
-	isAdmin: boolean().default(false),
-	allowedProviders: AllowedProviderSchema,
-	allowedDevices: AllowedDevicesSchema,
-	tokenHash: string(),
-	tokenPrefix: string(),
-	createdAt: number(),
-	lastUsedAt: number().optional()
-});
-object({
-	id: string(),
-	userId: string(),
-	name: string(),
-	tokenHash: string(),
-	tokenPrefix: string(),
-	scopes: array(TokenScopeSchema),
-	expiresAt: number().nullish(),
-	lastUsedAt: number().nullish(),
-	createdAt: number()
-});
-/**
 * `oauth-integration` — a collection cap by which an addon declares
 * itself a linkable OAuth client of the hub's core `/oauth2/*` server.
 * Each provider returns a static descriptor; the core enumerates them
@@ -51107,7 +51159,10 @@ method(StorageMigrationInputSchema, StorageMigrationPlanSchema, { auth: "admin"
 }), method(object({ jobId: string().optional() }), StorageMigrationJobSchema.nullable(), { auth: "admin" }), method(object({ jobId: string() }), object({ cancelled: boolean() }), {
 	kind: "mutation",
 	auth: "admin"
-}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
+}), method(object({}), array(StorageMigrationMoverSchema).readonly(), { auth: "admin" }), method(object({ locationIds: array(string()).readonly() }), object({
+	clear: boolean(),
+	repointLocationId: string().optional()
+}), { auth: "admin" }), method(object({}), array(StorageMigrationResidueSchema).readonly(), { auth: "admin" }), method(StorageMigrationDrainInputSchema, object({ jobId: string() }), {
 	kind: "mutation",
 	auth: "admin"
 }), method(StorageCleanupInputSchema, object({ jobId: string() }), {
@@ -54552,6 +54607,11 @@ object({
 *
 * `kind: 'poll'` — cloud REST APIs typically have no push channel; the
 * provider refreshes the slice on an interval and eagerly after commands.
+*
+* UNKNOWN IS NOT OFF. Every field the appliance reports separately is
+* nullable: `null` means "not known right now" (the appliance has not said,
+* the link is down, or the description does not carry it) and is never
+* rendered or exported as `false` / `0`. `availability` says why.
 */
 var DishwasherStateSchema = _enum([
 	"idle",
@@ -54561,112 +54621,227 @@ var DishwasherStateSchema = _enum([
 	"error",
 	"unavailable"
 ]);
+/**
+* The appliance's own operation state, uncollapsed. `state` above is the coarse
+* view for compact surfaces; this is what the appliance said.
+*/
+var DishwasherOperationStateSchema = _enum([
+	"Inactive",
+	"Ready",
+	"DelayedStart",
+	"Run",
+	"Pause",
+	"ActionRequired",
+	"Finished",
+	"Error",
+	"Aborting"
+]);
+/**
+* Why fields may be `null`:
+*  - `available`           — the link is up and the description is loaded;
+*  - `offline`             — the local link is down (values are unknown, not last-known);
+*  - `description-missing` — the link is up but the appliance's description could not
+*                            be loaded, so its values cannot be decoded.
+*/
+var DishwasherAvailabilitySchema = _enum([
+	"available",
+	"offline",
+	"description-missing"
+]);
 var DishwasherConsumableLevelSchema = _enum([
 	"ok",
 	"low",
 	"empty"
 ]);
 object({
+	availability: DishwasherAvailabilitySchema,
+	/** Coarse state for compact surfaces; `unavailable` whenever the appliance state is not known. */
 	state: DishwasherStateSchema,
-	/** Active program id/name, or null when none selected / unknown. */
+	/** The appliance's operation state as reported; null when not known. */
+	operationState: DishwasherOperationStateSchema.nullable(),
+	/** Feature key of the ACTIVE (running) program, or null when none runs / not known. */
 	program: string().nullable(),
-	/** Program tokens the hardware accepts — drives the UI selector. */
+	/** Feature key of the SELECTED program (what Start would run), or null when none / not known. */
+	selectedProgram: string().nullable(),
+	/** Feature keys of the programs the appliance currently offers — drives the UI selector. */
 	availablePrograms: array(string()),
-	/** Minutes remaining on the active cycle, or null when not running. */
-	remainingMinutes: number().int().nonnegative().nullable(),
+	/** Seconds remaining on the active cycle, or null when not running / not known. */
+	remainingSeconds: number().int().nonnegative().nullable(),
+	/** Seconds the delayed start is set to (time until the cycle starts), or null. */
+	delayedStartSeconds: number().int().nonnegative().nullable(),
 	/** Cycle completion 0..100, or null when not applicable. */
 	progressPercent: number().min(0).max(100).nullable(),
-	/** True when the door is reported open. */
-	doorOpen: boolean(),
-	/** True when remote start is allowed (door closed, power on, etc.). */
-	remoteStartAllowed: boolean(),
-	/** Main power / switched-on state. */
-	powerOn: boolean(),
+	/** True when the door is reported open; null when the door state is not known. */
+	doorOpen: boolean().nullable(),
+	/** True when the door is latched (locked) during a cycle; null when not reported. */
+	doorLocked: boolean().nullable(),
+	/** True when remote start is allowed (door closed, power on, etc.); null when not known. */
+	remoteStartAllowed: boolean().nullable(),
+	/** True when the appliance accepts remote control now; null when not known. */
+	remoteControlActive: boolean().nullable(),
+	/** True while somebody operates the appliance at its panel; null when not reported. */
+	localControlActive: boolean().nullable(),
+	/** Main power / switched-on state; null when not known. */
+	powerOn: boolean().nullable(),
+	/** The raw power state (`On`, `Off`, `Standby`, …); null when not known. */
+	powerState: string().nullable(),
 	saltLevel: DishwasherConsumableLevelSchema.nullable(),
 	rinseAidLevel: DishwasherConsumableLevelSchema.nullable(),
-	halfLoad: boolean(),
-	hygienePlus: boolean(),
+	/** Option states: null when the appliance does not expose the option or has not said. */
+	halfLoad: boolean().nullable(),
+	hygienePlus: boolean().nullable(),
 	/** Extra dry option when the appliance exposes it. */
-	extraDry: boolean(),
+	extraDry: boolean().nullable(),
 	/** Intensive zone (lower basket) when the appliance exposes it. */
-	intensiveZone: boolean(),
+	intensiveZone: boolean().nullable(),
 	/** VarioSpeed / VarioSpeed+ when the appliance exposes it. */
-	varioSpeedPlus: boolean(),
-	/** Child lock (controls disabled on the appliance). */
-	childLock: boolean(),
+	varioSpeedPlus: boolean().nullable(),
+	/** Child lock (controls disabled on the appliance); null when not known. */
+	childLock: boolean().nullable(),
+	/** Feature keys of the events currently raised (salt low, rinse aid low, program finished, …). */
+	activeEvents: array(string()),
+	/** Numeric error code when the appliance reports one; null otherwise. */
 	errorCode: number().nullable(),
+	/** Name of the raised alert-level event while the appliance is in error; null otherwise. */
 	errorLabel: string().nullable(),
+	/** Ms epoch of the last value received from the appliance; 0 = never. */
 	lastFetchedAt: number()
 });
-DeviceType.Dishwasher, method(object({ deviceId: number().int().nonnegative() }), _void(), {
+var DeviceIdSchema = number().int().nonnegative();
+/** A value a program option or setting can take. */
+var DishwasherValueSchema = union([
+	boolean(),
+	string(),
+	number()
+]);
+var DishwasherAccessSchema = _enum([
+	"none",
+	"read",
+	"readWrite",
+	"writeOnly",
+	"readStatic"
+]);
+/**
+* One option or setting the appliance declares, with the constraints its description
+* gives. A `readWrite` descriptor that is `available` is what `setOption` accepts.
+*/
+var DishwasherOptionDescriptorSchema = object({
+	/** Feature key (`Dishcare.Dishwasher.Option.ExtraDry`). */
+	key: string(),
+	/** Last segment of the key, for display. */
+	name: string(),
+	type: _enum([
+		"boolean",
+		"number",
+		"enum",
+		"string"
+	]),
+	access: DishwasherAccessSchema,
+	/** The appliance reports this entity as currently available. */
+	available: boolean(),
+	/** Unit the description declares for a number; null when it declares none. */
+	unit: string().nullable(),
+	min: number().nullable(),
+	max: number().nullable(),
+	step: number().nullable(),
+	/** Allowed members of an enum; null for other types. */
+	enumValues: array(string()).nullable(),
+	defaultValue: DishwasherValueSchema.nullable()
+});
+var DishwasherProgramSchema = object({
+	/** Feature key (`Dishcare.Dishwasher.Program.Eco50`) — what `setProgram` / `start` take. */
+	key: string(),
+	name: string(),
+	/** The appliance currently offers this program. */
+	available: boolean(),
+	/** The options this program lists, with the program-level access / availability / default. */
+	options: array(DishwasherOptionDescriptorSchema)
+});
+var DishwasherOptionsSchema = object({
+	availability: DishwasherAvailabilitySchema,
+	/** What the appliance can be told to do, from the commands its description declares. */
+	supportsStart: boolean(),
+	supportsPause: boolean(),
+	supportsResume: boolean(),
+	supportsStop: boolean(),
+	supportsPower: boolean(),
+	/** Every program the description lists, with its options. */
+	programs: array(DishwasherProgramSchema),
+	/** Every option and setting entity the description lists (programs reference these by key). */
+	options: array(DishwasherOptionDescriptorSchema)
+});
+DeviceType.Dishwasher, method(object({
+	deviceId: DeviceIdSchema,
+	program: string().min(1).optional(),
+	options: record(string(), DishwasherValueSchema).optional()
+}), _void(), {
 	kind: "mutation",
 	auth: "protected"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+}), method(object({ deviceId: DeviceIdSchema }), _void(), {
 	kind: "mutation",
 	auth: "protected"
-}), method(object({ deviceId: number().int().nonnegative() }), _void(), {
+}), method(object({ deviceId: DeviceIdSchema }), _void(), {
+	kind: "mutation",
+	auth: "protected"
+}), method(object({ deviceId: DeviceIdSchema }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	program: string().min(1)
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	on: boolean()
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
 }), method(object({
-	deviceId: number().int().nonnegative(),
+	deviceId: DeviceIdSchema,
 	key: string().min(1),
-	value: union([
-		boolean(),
-		string(),
-		number()
-	])
+	value: DishwasherValueSchema
 }), _void(), {
 	kind: "mutation",
 	auth: "protected"
-});
+}), method(object({ deviceId: DeviceIdSchema }), DishwasherOptionsSchema, { auth: "protected" });
 object({
 	/** Ms epoch of the last press. null = never observed since this provider started. */
 	lastPressedAt: number().nullable(),
@@ -64726,6 +64901,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"dishwasher.getOptions": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "view"
+	},
 	"dishwasher.getStatus": {
 		capName: "dishwasher",
 		capScope: "device",
@@ -64738,6 +64919,12 @@ Object.freeze({
 		addonId: null,
 		access: "create"
 	},
+	"dishwasher.resume": {
+		capName: "dishwasher",
+		capScope: "device",
+		addonId: null,
+		access: "create"
+	},
 	"dishwasher.setChildLock": {
 		capName: "dishwasher",
 		capScope: "device",
@@ -69238,6 +69425,12 @@ Object.freeze({
 		addonId: null,
 		access: "view"
 	},
+	"storageMigration.moverClearance": {
+		capName: "storage-migration",
+		capScope: "system",
+		addonId: null,
+		access: "view"
+	},
 	"storageMigration.movers": {
 		capName: "storage-migration",
 		capScope: "system",
@@ -71431,6 +71624,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"dishwasher.getOptions": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"dishwasher.getStatus": [{
 		name: "deviceId",
 		form: "single",
@@ -71441,6 +71639,11 @@ Object.freeze({
 		form: "single",
 		optional: false
 	}],
+	"dishwasher.resume": [{
+		name: "deviceId",
+		form: "single",
+		optional: false
+	}],
 	"dishwasher.setChildLock": [{
 		name: "deviceId",
 		form: "single",
@@ -73527,6 +73730,9 @@ new Map(Object.entries({
 	"wrapper-update-available": "system",
 	"backup-completed": "system",
 	"export-completed": "system",
+	"alert-critical": "system",
+	"alert-error": "system",
+	"alert-critical-resolved": "system",
 	"storage-location-low": "system",
 	"storage-location-critical": "system",
 	"storage-location-ok": "system",
@@ -73651,6 +73857,16 @@ var NC_SYSTEM_EVENT_KIND_GROUP_SPECS = [
 			"storage-location-ok"
 		]
 	},
+	{
+		id: "alerts",
+		family: "system",
+		label: "Alerts",
+		kinds: [
+			"alert-critical",
+			"alert-error",
+			"alert-critical-resolved"
+		]
+	},
 	{
 		id: "alarm",
 		family: "alarm",
@@ -73695,6 +73911,21 @@ var NC_SENSOR_RAISED_FIELD_BY_KIND = Object.freeze(Object.fromEntries(Object.ent
 	return [[descriptor.kind, field]];
 })));
 Object.freeze(Object.keys(NC_SENSOR_RAISED_FIELD_BY_KIND));
+object({
+	phase: _enum(["raised", "resolved"]),
+	episodeId: string().min(1),
+	alertId: string().min(1),
+	severity: AlertSeveritySchema,
+	category: string(),
+	title: string(),
+	message: string(),
+	sourceType: string().optional(),
+	sourceId: string().optional(),
+	nodeId: string().optional(),
+	/** The alert's own action link (where the operator acts on it), when it has one. */
+	actionUrl: string().optional(),
+	at: number()
+});
 var RULE_BODY_ONLY = ["body"];
 var RULE_TEXT = ["title", "body"];
 var BATTERY = ["device-battery-low", "device-battery-normal"];
@@ -73704,6 +73935,11 @@ var TANK = [
 	"device-tank-full",
 	"device-tank-normal"
 ];
+var ALERT_EPISODE = [
+	"alert-critical",
+	"alert-error",
+	"alert-critical-resolved"
+];
 var UPDATES = [
 	"addon-update-available",
 	"server-update-available",
@@ -73896,14 +74132,14 @@ var STATE_SUMMARY_VARS = [
 	([...RULE_TEXT], [...CONSUMABLE]),
 	([...RULE_TEXT], [...TANK]),
 	[...RULE_TEXT],
-	([...RULE_TEXT], [...UPDATES]),
-	([...RULE_TEXT], [...UPDATES]),
-	[...RULE_TEXT],
+	([...RULE_TEXT], [...UPDATES, ...ALERT_EPISODE]),
+	([...RULE_TEXT], [...UPDATES, ...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
+	([...RULE_TEXT], [...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
@@ -73921,7 +74157,11 @@ var STATE_SUMMARY_VARS = [
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
-	[...RULE_TEXT],
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
+	([...RULE_TEXT], [...ALERT_EPISODE]),
 	[...RULE_TEXT],
 	[...RULE_TEXT],
 	[...RULE_TEXT],
@@ -74459,6 +74699,37 @@ DEFAULT_NATIVE_LEASE_SETTINGS.activityMs;
 DEFAULT_NATIVE_LEASE_SETTINGS.tileBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.sceneBudgetMb;
 DEFAULT_NATIVE_LEASE_SETTINGS.admission;
+/**
+* Where an OAuth round-trip ends: the admin-ui completion route
+* (`/sso-complete`, the page every popup sign-in already lands on), with the
+* OUTCOME in the URL fragment.
+*
+* The outcome is a status plus a reason CODE from a closed list. It never
+* carries a token, a code, a client secret or a free-form error message: the
+* page words each code itself, and an unknown code reads as `unknown` rather
+* than being echoed. Fragment only, so nothing here reaches a server log.
+*
+* Pure and browser-safe.
+*/
+/** The admin-ui route the hub's OAuth completions land on (relative to its mount). */
+var OAUTH_LANDING_PATH = "/sso-complete";
+/**
+* The landing URL for `outcome`. `origin` is the hub address the flow already
+* runs on (from the `local-network` palette role, never a literal); `null`
+* gives a hub-relative URL.
+*/
+function oauthLandingUrl(origin, outcome) {
+	const params = new URLSearchParams({
+		return: "oauth",
+		status: outcome.status
+	});
+	if (outcome.addonId !== void 0) params.set("addon", outcome.addonId);
+	if (outcome.brokerId !== void 0) params.set("broker", outcome.brokerId);
+	if (outcome.integration !== void 0) params.set("integration", outcome.integration);
+	if (outcome.status === "error") params.set("reason", outcome.reason ?? "unknown");
+	if (outcome.action === "disconnect") params.set("action", "disconnect");
+	return `${origin === null ? "" : origin.replace(/\/+$/, "")}${OAUTH_LANDING_PATH}#${params.toString()}`;
+}
 var MB = 1024 * 1024;
 1024 * MB, 3072 * MB;
 //#endregion
@@ -74506,13 +74777,22 @@ var DEFAULT_OAUTH_STATE = {
 	accessExpiresAt: 0,
 	accountEmail: ""
 };
-var GoogleOauthAccountsStateSchema = object({ accounts: array(object({
+/** Per-broker OAuth tokens (durable state `oauthAccounts`). */
+var GoogleOauthAccountSchema = object({
 	id: string().min(1),
 	refreshToken: string().default("").meta({ secret: true }),
 	accessToken: string().default("").meta({ secret: true }),
 	accessExpiresAt: number().default(0),
-	accountEmail: string().default("")
-})).default([]) });
+	accountEmail: string().default(""),
+	/**
+	* Google refused the refresh token (`invalid_grant`): it is dead and only a
+	* new sign-in replaces it. Set where the refusal is seen, cleared by the
+	* OAuth callback that stores a fresh token — so the status, the Sign-in
+	* button and the alert all read the same fact.
+	*/
+	needsReauth: boolean().default(false)
+});
+var GoogleOauthAccountsStateSchema = object({ accounts: array(GoogleOauthAccountSchema).default([]) });
 var GOOGLE_BROKER_KIND = "google";
 var GOOGLE_BROKER_KIND_LABEL = "Google";
 var GOOGLE_CALENDAR_SCOPE = "https://www.googleapis.com/auth/calendar.readonly";
@@ -74601,7 +74881,8 @@ function migrateLegacyToBrokers(rawConfig, legacyOauth) {
 		refreshToken: legacyOauth.refreshToken,
 		accessToken: legacyOauth.accessToken,
 		accessExpiresAt: legacyOauth.accessExpiresAt,
-		accountEmail: legacyOauth.accountEmail
+		accountEmail: legacyOauth.accountEmail,
+		needsReauth: false
 	}] : [];
 	return {
 		brokers: [entry],
@@ -74636,7 +74917,10 @@ var GoogleBrokerRegistry = class {
 	oauthById = /* @__PURE__ */ new Map();
 	seedFrom(entries, accounts) {
 		this.entries = entries.map((e) => GoogleBrokerEntrySchema.parse(e));
-		this.oauthById = new Map(accounts.map((a) => [a.id, { ...a }]));
+		this.oauthById = new Map(accounts.map((a) => {
+			const account = GoogleOauthAccountSchema.parse(a);
+			return [account.id, account];
+		}));
 		this.seedCounterFromEntries(this.entries);
 	}
 	listEntries() {
@@ -74652,14 +74936,28 @@ var GoogleBrokerRegistry = class {
 		return [...this.oauthById.values()];
 	}
 	setOauth(account) {
-		this.oauthById.set(account.id, { ...account });
+		const parsed = GoogleOauthAccountSchema.parse(account);
+		this.oauthById.set(parsed.id, parsed);
 	}
 	removeOauth(id) {
 		this.oauthById.delete(id);
 	}
 	isConnected(id) {
 		const o = this.oauthById.get(id);
-		return o !== void 0 && o.refreshToken.length > 0;
+		return o !== void 0 && o.refreshToken.length > 0 && !o.needsReauth;
+	}
+	/** A refresh token Google refused: kept (a sign-in replaces it) but not usable. */
+	needsReauth(id) {
+		return this.oauthById.get(id)?.needsReauth === true;
+	}
+	markNeedsReauth(id) {
+		const o = this.oauthById.get(id);
+		if (o === void 0 || o.needsReauth) return false;
+		this.oauthById.set(id, {
+			...o,
+			needsReauth: true
+		});
+		return true;
 	}
 	allocateId() {
 		const id = `google_${String(this.nextIdCounter).padStart(3, "0")}`;
@@ -74709,18 +75007,19 @@ var GoogleBrokerRegistry = class {
 	toBrokerInfo(entry, addonId) {
 		const oauth = this.oauthById.get(entry.id);
 		const connected = this.isConnected(entry.id);
+		const reauth = this.needsReauth(entry.id);
 		return {
 			id: entry.id,
 			addonId,
 			name: entry.name,
 			kind: GOOGLE_BROKER_KIND,
-			status: connected ? "connected" : "disconnected",
+			status: connected ? "connected" : reauth ? "auth-failed" : "disconnected",
 			info: {
 				accountEmail: oauth?.accountEmail ?? "",
 				hasClient: entry.clientId.length > 0
 			},
 			lastCheckedAt: connected ? Date.now() : null,
-			error: connected ? null : entry.clientId.length === 0 ? "Configure Client ID / secret, then Connect Google" : "Not connected — open Connect Google on this broker"
+			error: connected ? null : reauth ? "Google session expired — sign in again" : entry.clientId.length === 0 ? "Configure Client ID / secret, then Connect Google" : "Not connected — open Connect Google on this broker"
 		};
 	}
 	listBrokerInfos(addonId, kind) {
@@ -74772,7 +75071,7 @@ function consoleLinksHtml$1() {
 	].join("");
 }
 function introHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$2(redirectUriDisplay(publicOrigin));
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
 	const console = consoleLinksHtml$1();
 	if (cap === "smtp-provider") return [
 		"<ol>",
@@ -74805,7 +75104,7 @@ function introHtml(cap, publicOrigin) {
 	].join("");
 }
 function connectHtml(cap, publicOrigin) {
-	const redirect = escapeHtml$2(redirectUriDisplay(publicOrigin));
+	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
 	if (cap === "smtp-provider") return [
 		`After Save, open <a href="${OAUTH_START_PATH}">Connect Google</a> in this hub (admin session required). `,
 		"Connect requests <code>gmail.send</code> (and Calendar read for the Calendars page). ",
@@ -74825,7 +75124,7 @@ function connectHtml(cap, publicOrigin) {
 		`Console: ${consoleLinksHtml$1()}.`
 	].join("");
 }
-function escapeHtml$2(s) {
+function escapeHtml$1(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
@@ -74844,7 +75143,7 @@ function consoleLinksHtml() {
 }
 /** Setup steps shown on Add / Edit — includes Audience / Test users. */
 function googleBrokerSetupHtml(publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	const redirect = escapeHtml(redirectUriDisplay(publicOrigin));
 	return [
 		"<ol>",
 		`<li>Open Google Cloud Console (${consoleLinksHtml()}). Create a <strong>new project</strong> (or pick an existing one) from the project picker at the top.</li>`,
@@ -74920,7 +75219,7 @@ function buildGoogleBrokerSettingsSchema(publicOrigin) {
 }
 /** Connectivity Calendars / Email pages — calendar import picker lives here (not on broker Add). */
 function buildGoogleFeatureSettingsSchema(cap, publicOrigin) {
-	const redirect = escapeHtml$1(redirectUriDisplay(publicOrigin));
+	const redirect = escapeHtml(redirectUriDisplay(publicOrigin));
 	if (cap === "calendar-source") return { sections: [{
 		id: "setup-intro",
 		title: "Google brokers",
@@ -74978,7 +75277,7 @@ function buildGoogleFeatureSettingsSchema(cap, publicOrigin) {
 		}]
 	}] };
 }
-function escapeHtml$1(s) {
+function escapeHtml(s) {
 	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 //#endregion
@@ -75273,7 +75572,6 @@ function isInvalidGrantRefreshError(err) {
 	return (err instanceof Error ? err.message : String(err)).includes("invalid_grant");
 }
 function buildGoogleBrokerReconnectAlert(brokerId, brokerName) {
-	const pushLine = `${brokerName}: Google session expired — sign in again`;
 	return {
 		id: googleBrokerReconnectAlertId(brokerId),
 		category: "google.broker-reconnect",
@@ -75282,7 +75580,8 @@ function buildGoogleBrokerReconnectAlert(brokerId, brokerName) {
 		message: `${brokerName} needs you to sign in to Google again.`,
 		action: {
 			label: "Sign in again",
-			href: `/addon/google-services/oauth/start?brokerId=${encodeURIComponent(brokerId)}`
+			href: `/addon/google-services/oauth/start?brokerId=${encodeURIComponent(brokerId)}`,
+			navigation: "server"
 		},
 		status: "active",
 		read: false,
@@ -75292,10 +75591,7 @@ function buildGoogleBrokerReconnectAlert(brokerId, brokerName) {
 			type: "google-broker",
 			id: brokerId
 		},
-		metadata: {
-			episodeKey: "reconnect",
-			pushLine
-		}
+		metadata: { episodeKey: "reconnect" }
 	};
 }
 //#endregion
@@ -75504,6 +75800,14 @@ var GoogleBrokerStore = class GoogleBrokerStore {
 * One OAuth account = one broker entry; feature caps aggregate connected brokers.
 */
 var ADDON_ID = "google-services";
+/** A callback failure the landing page can name by code. */
+var GoogleCallbackError = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+	}
+};
 var CALLBACK_PATH = "/oauth/callback";
 var START_PATH = "/oauth/start";
 var DISCONNECT_PATH = "/oauth/disconnect";
@@ -75524,7 +75828,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 	registry = new GoogleBrokerRegistry();
 	brokerStore = null;
 	activeBrokers = [];
-	/** CSRF state → { brokerId, popup, issuedAt } — popup mirrors OIDC D794. */
+	/** CSRF state → { brokerId, issuedAt } for the in-flight OAuth consents. */
 	pendingStates = /* @__PURE__ */ new Map();
 	publicOrigin = null;
 	constructor() {
@@ -75560,7 +75864,8 @@ var GoogleServicesAddon = class extends BaseAddon {
 				refreshToken: legacyOauth.refreshToken,
 				accessToken: legacyOauth.accessToken,
 				accessExpiresAt: legacyOauth.accessExpiresAt,
-				accountEmail: legacyOauth.accountEmail
+				accountEmail: legacyOauth.accountEmail,
+				needsReauth: false
 			}] };
 			await this.oauthAccountsHandle.set(oauthAccounts);
 			await legacyHandle.set({ ...DEFAULT_OAUTH_STATE });
@@ -75831,12 +76136,9 @@ var GoogleServicesAddon = class extends BaseAddon {
 			reply.status(500).send({ error: err instanceof Error ? err.message : String(err) });
 			return;
 		}
-		const popupRaw = req.query["popup"];
-		const popup = popupRaw === "1" || popupRaw === "true";
 		const state = randomBytes(16).toString("hex");
 		this.pendingStates.set(state, {
 			brokerId,
-			popup,
 			issuedAt: Date.now()
 		});
 		this.prunePendingStates();
@@ -75848,42 +76150,39 @@ var GoogleServicesAddon = class extends BaseAddon {
 		reply.redirect(url);
 	}
 	async handleCallback(req, reply) {
+		const state = typeof req.query["state"] === "string" ? req.query["state"] : "";
 		const err = req.query["error"];
 		if (err) {
-			const statePeek = typeof req.query["state"] === "string" ? req.query["state"] : "";
-			const pendingPeek = statePeek ? this.pendingStates.get(statePeek) : void 0;
-			if (pendingPeek?.popup) {
-				this.pendingStates.delete(statePeek);
-				this.popupComplete(reply, {
-					ok: false,
-					brokerId: pendingPeek.brokerId,
-					error: String(err)
-				});
-				return;
-			}
-			this.html(reply, 400, `Google OAuth error: ${err}`);
+			const pendingPeek = state ? this.pendingStates.get(state) : void 0;
+			if (pendingPeek !== void 0) this.pendingStates.delete(state);
+			await this.landOnAdminUi(reply, {
+				status: "error",
+				addonId: ADDON_ID,
+				...pendingPeek !== void 0 ? { brokerId: pendingPeek.brokerId } : {},
+				reason: err === "access_denied" ? "access_denied" : "invalid_request"
+			});
 			return;
 		}
 		const code = req.query["code"];
-		const state = req.query["state"];
-		const pending = typeof state === "string" ? this.pendingStates.get(state) : void 0;
+		const pending = state ? this.pendingStates.get(state) : void 0;
 		if (!code || !state || pending === void 0) {
-			this.html(reply, 400, "Invalid or expired OAuth state.");
+			await this.landOnAdminUi(reply, {
+				status: "error",
+				addonId: ADDON_ID,
+				reason: "invalid_state"
+			});
 			return;
 		}
 		this.pendingStates.delete(state);
-		const { brokerId, popup } = pending;
+		const { brokerId } = pending;
 		const entry = this.registry.getEntry(brokerId);
 		if (entry === null) {
-			if (popup) {
-				this.popupComplete(reply, {
-					ok: false,
-					brokerId,
-					error: `Unknown Google broker: ${brokerId}`
-				});
-				return;
-			}
-			this.html(reply, 404, `Unknown Google broker: ${brokerId}`);
+			await this.landOnAdminUi(reply, {
+				status: "error",
+				addonId: ADDON_ID,
+				brokerId,
+				reason: "unknown_broker"
+			});
 			return;
 		}
 		try {
@@ -75895,11 +76194,12 @@ var GoogleServicesAddon = class extends BaseAddon {
 			}, code);
 			const prev = this.registry.getOauth(brokerId) ?? {
 				id: brokerId,
-				...DEFAULT_OAUTH_STATE
+				...DEFAULT_OAUTH_STATE,
+				needsReauth: false
 			};
-			if (!tokens.refresh_token && !prev.refreshToken) throw new Error("Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
+			if (!tokens.refresh_token && (!prev.refreshToken || prev.needsReauth)) throw new GoogleCallbackError("no_refresh_token", "Google did not return a refresh_token. Revoke CamStack access in Google Account → Security and retry with prompt=consent.");
 			const applied = applyTokenResponse({
-				refreshToken: prev.refreshToken,
+				refreshToken: prev.needsReauth && tokens.refresh_token ? "" : prev.refreshToken,
 				accessToken: prev.accessToken,
 				accessExpiresAt: prev.accessExpiresAt,
 				accountEmail: prev.accountEmail
@@ -75910,7 +76210,8 @@ var GoogleServicesAddon = class extends BaseAddon {
 				refreshToken: applied.refreshToken,
 				accessToken: applied.accessToken,
 				accessExpiresAt: applied.accessExpiresAt,
-				accountEmail: email || applied.accountEmail
+				accountEmail: email || applied.accountEmail,
+				needsReauth: false
 			};
 			this.registry.setOauth(next);
 			await this.persistOauthAccounts();
@@ -75923,65 +76224,44 @@ var GoogleServicesAddon = class extends BaseAddon {
 				this.registry.replaceEntries(this.registry.listEntries().map((e) => e.id === brokerId ? renamed : e));
 				await this.persistBrokers();
 			}
-			this.ctx.logger.info("google oauth connected", { meta: {
-				brokerId,
-				hasRefresh: next.refreshToken.length > 0,
-				accountEmail: next.accountEmail || void 0
-			} });
-			if (popup) {
-				this.popupComplete(reply, {
-					ok: true,
+			this.ctx.logger.info("google oauth connected", {
+				tags: { brokerId },
+				meta: {
 					brokerId,
-					message: "Google account connected. This window should close."
-				});
-				return;
-			}
-			this.html(reply, 200, `Google account connected for ${brokerId} (Calendar + Gmail send). You can close this window.`);
+					hasRefresh: next.refreshToken.length > 0,
+					accountEmail: next.accountEmail || void 0
+				}
+			});
+			await this.landOnAdminUi(reply, {
+				status: "success",
+				addonId: ADDON_ID,
+				brokerId
+			});
 		} catch (e) {
 			const message = e instanceof Error ? e.message : String(e);
 			this.ctx.logger.warn("google oauth callback failed", { meta: {
 				brokerId,
 				error: message
 			} });
-			if (popup) {
-				this.popupComplete(reply, {
-					ok: false,
-					brokerId,
-					error: message
-				});
-				return;
-			}
-			this.html(reply, 500, `OAuth failed: ${message}`);
+			await this.landOnAdminUi(reply, {
+				status: "error",
+				addonId: ADDON_ID,
+				brokerId,
+				reason: e instanceof GoogleCallbackError ? e.reason : "exchange_failed"
+			});
 		}
 	}
 	/**
-	* Popup completion page (OIDC D794 pattern): postMessage to opener at the
-	* hub origin, then close. Google never redirects back to admin-ui — this
-	* page is the only return surface.
+	* Every OAuth completion ends in CamStack: a redirect to the admin-ui
+	* completion page (`/sso-complete`) on the hub's public address (the
+	* `local-network` palette role), carrying a status and a reason CODE — never
+	* a token, a code or an error message. The page hands a popup's outcome to
+	* its opener and closes it, or, in a full-page flow, shows the result and
+	* returns to Connectivity.
 	*/
-	popupComplete(reply, outcome) {
-		const payload = JSON.stringify({
-			type: "camstack:broker-oauth",
-			ok: outcome.ok,
-			brokerId: outcome.brokerId,
-			...outcome.error !== void 0 ? { error: outcome.error } : {}
-		});
-		const body = outcome.ok ? outcome.message ?? "Done. This window should close." : `OAuth failed: ${outcome.error ?? "unknown"}`;
-		reply.header("content-type", "text/html; charset=utf-8");
-		reply.status(outcome.ok ? 200 : 400).send(`<!doctype html><html><head><title>Google</title></head><body>
-<p>${escapeHtml(body)}</p>
-<script>
-(function () {
-  var msg = ${payload};
-  try {
-    if (window.opener) {
-      window.opener.postMessage(msg, window.location.origin);
-    }
-  } catch (e) {}
-  setTimeout(function () { window.close(); }, 200);
-})();
-<\/script>
-</body></html>`);
+	async landOnAdminUi(reply, outcome) {
+		await this.refreshPublicOrigin();
+		reply.redirect(oauthLandingUrl(this.publicOrigin, outcome));
 	}
 	async fetchAccountEmail(accessToken) {
 		try {
@@ -75993,10 +76273,6 @@ var GoogleServicesAddon = class extends BaseAddon {
 			return "";
 		}
 	}
-	html(reply, code, body) {
-		reply.header("content-type", "text/html; charset=utf-8");
-		reply.status(code).send(`<!doctype html><html><body><p>${escapeHtml(body)}</p></body></html>`);
-	}
 	prunePendingStates() {
 		const cutoff = Date.now() - 10 * 6e4;
 		for (const [k, v] of this.pendingStates) if (v.issuedAt < cutoff) this.pendingStates.delete(k);
@@ -76084,6 +76360,7 @@ var GoogleServicesAddon = class extends BaseAddon {
 		const entry = this.registry.getEntry(brokerId);
 		const oauth = this.registry.getOauth(brokerId);
 		if (entry === null || oauth === null || !oauth.refreshToken.trim()) throw new Error(`Google broker ${brokerId} is not connected — use Sign in under Connectivity → Brokers`);
+		if (oauth.needsReauth) throw new Error(`Google broker ${brokerId} needs a new sign-in — use Sign in under Connectivity → Brokers`);
 		if (!entry.clientId.trim() || !entry.clientSecret.trim()) throw userError("google.client-credentials-required", void 0, "Configure Client ID and Client secret before refreshing the Google token");
 		const state = {
 			refreshToken: oauth.refreshToken.trim(),
@@ -76099,7 +76376,10 @@ var GoogleServicesAddon = class extends BaseAddon {
 				clientSecret: entry.clientSecret.trim()
 			}, state.refreshToken);
 		} catch (err) {
-			if (isInvalidGrantRefreshError(err)) this.emitGoogleBrokerReconnectAlert(brokerId, entry.name);
+			if (isInvalidGrantRefreshError(err)) {
+				if (this.registry.markNeedsReauth(brokerId)) await this.persistOauthAccounts();
+				this.emitGoogleBrokerReconnectAlert(brokerId, entry.name);
+			}
 			throw err;
 		}
 		if (typeof tokens.access_token !== "string" || tokens.access_token.trim().length === 0) throw new Error("Google token refresh returned an empty access_token — Sign out and Sign in again");
@@ -76109,7 +76389,8 @@ var GoogleServicesAddon = class extends BaseAddon {
 			refreshToken: nextState.refreshToken,
 			accessToken: nextState.accessToken,
 			accessExpiresAt: nextState.accessExpiresAt,
-			accountEmail: nextState.accountEmail
+			accountEmail: nextState.accountEmail,
+			needsReauth: false
 		});
 		await this.persistOauthAccounts();
 		return nextState.accessToken;
@@ -76125,20 +76406,18 @@ var GoogleServicesAddon = class extends BaseAddon {
 			reply.status(404).send({ error: `Unknown Google broker: ${brokerId}` });
 			return;
 		}
-		const popupRaw = req.query["popup"];
-		const popup = popupRaw === "1" || popupRaw === "true";
 		this.registry.removeOauth(brokerId);
 		await this.persistOauthAccounts();
-		this.ctx.logger.info("google oauth disconnected", { meta: { brokerId } });
-		if (popup) {
-			this.popupComplete(reply, {
-				ok: true,
-				brokerId,
-				message: "Google account disconnected. This window should close."
-			});
-			return;
-		}
-		this.html(reply, 200, `Google account disconnected for ${brokerId}. You can close this window.`);
+		this.ctx.logger.info("google oauth disconnected", {
+			tags: { brokerId },
+			meta: { brokerId }
+		});
+		await this.landOnAdminUi(reply, {
+			status: "success",
+			addonId: ADDON_ID,
+			brokerId,
+			action: "disconnect"
+		});
 	}
 	async resolveRedirectUri() {
 		await this.refreshPublicOrigin();
@@ -76175,8 +76454,5 @@ var GoogleServicesAddon = class extends BaseAddon {
 function asSettingsCap(cap) {
 	if (cap === "calendar-source" || cap === "smtp-provider") return cap;
 }
-function escapeHtml(s) {
-	return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
 //#endregion
 export { GOOGLE_GMAIL_SEND_SCOPE as C, OAUTH_START_PATH as E, GoogleServicesAddon, GoogleServicesAddon as default, GOOGLE_BROKER_KIND as S, GoogleServicesConfigSchema as T, GoogleBrokerRegistry as _, refreshAccessToken as a, stampCalendarId as b, selectGmailAccount as c, mapGoogleEvent as d, GOOGLE_CONSOLE_APIS_URL as f, redirectUriDisplay as g, introHtml as h, needsRefresh as i, createGoogleCalendarApi as l, connectHtml as m, buildAuthorizeUrl as n, buildRawMime as o, GOOGLE_CONSOLE_CREDENTIALS_URL as p, exchangeCode as r, createGmailSmtpProvider as s, applyTokenResponse as t, createGoogleCalendarSource as u, migrateLegacyToBrokers as v, GOOGLE_OAUTH_SCOPES as w, DEFAULT_GOOGLE_CONFIG as x, parseStampedCalendarId as y };