node-red-contrib-alarm-ultimate 1.0.0 → 1.0.2

package/CHANGELOG.MD

@@ -1,13 +1,34 @@
 # Changelog
 
 > Stable release track from `0.3.0`.
-> Previous beta history is preserved below.
+> Previous pre-release history is preserved below.
+
+## [1.0.2] - 2026-04-08
+
+### Fixed
+
+- **Tools + adminAuth (OAuth):** fixed `401/Unauthorized` when opening tools pages from the editor with protected Node-RED admin access.
+- **OAuth token handling:** tools now support `access_token` propagation from editor links and keep the token while navigating between tool pages.
+- **Bearer parsing conflict:** fixed `400 Bad Request` when both query `access_token` and `Authorization` header were present by normalizing auth before permission checks.
+- **Control Panel auth fallback:** improved token lookup to support Node-RED token storage keys with `httpAdminRoot` suffix.
+
+## [1.0.1] - 2026-04-07
+
+### Changed
+
+- **Tools UI (Vue shell):** aligned all pages in `tools/` to the KNX AI visual style (layout, colors, typography, shared CSS shell).
+- **Navigation:** renamed sections to **Control Panel**, **Zones**, and **Settings** with SVG icons and improved selected-menu highlighting.
+- **Zones page:** reorganized import flow by moving the full **Import Wizard** into its own dedicated box (now positioned above the zones list).
+- **Settings page:** moved JSON import/export actions from Zones to Settings and renamed actions to **Export Zones** / **Import Zones**.
+- **Control Panel page:** removed redundant helper texts in the Node box and improved node-selection button readability.
+- **Zones supervision timeout:** default timeout is now `120` seconds and empty timeout fields no longer trigger validation errors.
+- **Packaging:** added `prepublishOnly` hook to automatically run `build:vue-tools` before publishing.
 
 ## [0.3.0] - 2026-02-18
 
 ### Release
 
-- First stable release of `node-red-contrib-alarm-ultimate` (from `0.3.0-beta.7`).
+- First stable release of `node-red-contrib-alarm-ultimate` (from `0.3.0-pre-release.7`).
 
 ### Fixed
 
@@ -18,9 +39,9 @@
 
 - **Packaging:** added explicit npm publish allowlist (`package.json` `files`) to avoid accidental inclusion of unwanted files.
 
-## [0.3.0-beta.7] - 2026-02-08
+## [0.3.0-pre-release.7] - 2026-02-08
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Alarm outputs (Open zones):** removed **Open zones (on request)** output + `list_open_zones` / request-topic behavior. Open zones listing while arming and cyclic listing are now always-on outputs (configurable intervals). Total outputs: **9**.
 - **Alarm Zone / Alarm State (outputs):** `msg.payload` is now always a boolean (`true|false`). All extra fields are emitted as root properties on `msg`.
@@ -34,9 +55,9 @@
 - **Alarm System:** output label renamed to **Any zone open (bool)** and help now documents each output pin.
 - **Examples/Docs/Tests:** updated for new pins and helper node payload shape.
 
-## [0.3.0-beta.6] - 2026-02-07
+## [0.3.0-pre-release.6] - 2026-02-07
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Alarm Zone:** `AlarmUltimateZone` is now output-only (removed Input mode and all adapters).
 - **Alarm System:** moved zone input adapters into the Alarm node (**Zones → Zone input adapter** + **AX Pro match**).
@@ -49,9 +70,9 @@
 
 - **Tests:** expanded unit test coverage for core Alarm behaviors (arming violations, topic prefix matching, code denial, persistence fallback).
 
-## [0.3.0-beta.5] - 2026-02-07
+## [0.3.0-pre-release.5] - 2026-02-07
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Alarm System:** removed `blockArmOnViolations`. Arming is now always blocked by violations (open zones, or supervised zones that are **MISSING** when `supervision.blockArm: true`).
 
@@ -65,7 +86,7 @@
 - **Tools:** moved **Export JSON** / **Import JSON** from the node edit dialog to `/alarm-ultimate/alarm-json-mapper`.
 - **Tools / Runtime:** `supervision.blockArm` now treats false-like values (e.g. `"false"`, `0`) as `false`.
 
-## [0.3.0-beta.4] - 2026-02-06
+## [0.3.0-pre-release.4] - 2026-02-06
 
 ### Changed
 
@@ -73,7 +94,7 @@
 - **UI:** `AlarmUltimateZone` now allows selecting the **Ax Pro** adapter also in **Output** mode.
 - **Docs:** refreshed node help and README for coherence (HomeKit input notes, Ax Pro mapping notes, "click Done" reminder).
 
-## [0.3.0-beta.3] - 2026-02-06
+## [0.3.0-pre-release.3] - 2026-02-06
 
 ### Changed
 
@@ -85,7 +106,7 @@
 - **Tools (Zones JSON Mapper):** improved visibility of the "click Done in Node-RED editor to apply" reminder.
 - **UI:** clarified AX Pro matching help text in `AlarmUltimateZone`.
 
-## [0.3.0-beta.2] - 2026-02-04
+## [0.3.0-pre-release.2] - 2026-02-04
 
 ### Changed
 
@@ -94,9 +115,9 @@
 - **Tools:** Zones JSON Mapper now accepts **JSON array only** (aligned with `AlarmSystemUltimate.zones`).
 - **UI:** refined AX Pro “match” option labels in `AlarmUltimateZone`.
 
-## [0.3.0-beta.1] - 2026-02-04
+## [0.3.0-pre-release.1] - 2026-02-04
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Zones identifier:** removed the `id`/`zoneId` field from zones. Zones are identified only by `topic`.
 - **Zones format:** `AlarmSystemUltimate.zones` now accepts **JSON array only** (no single-object, no JSON-per-line).
@@ -113,9 +134,9 @@
 - **Alarm State (Input + AX Pro):** added support for AX Pro `CIDEvent.code` to inject arm/disarm (`3401` Away, `3441` Stay, `1401` Disarmed).
 - **Tools:** Alarm JSON Mapper and Alarm Panel updated to reflect topic-only zones and the simplified zones format.
 
-## [0.3.0-beta.0] - 2026-02-04
+## [0.3.0-pre-release.0] - 2026-02-04
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Removed adapter nodes:** `AlarmUltimateInputAdapter` and `AlarmUltimateOutputAdapter` have been removed.
 - **Alarm State / Alarm Zone I/O mode:** `AlarmUltimateState` and `AlarmUltimateZone` can now be configured as **Input** (flow → selected alarm) or **Output** (selected alarm → flow).
@@ -131,9 +152,9 @@
 - Replace any `AlarmUltimateOutputAdapter` nodes with:
   - `AlarmUltimateState` / `AlarmUltimateZone` → **Mode: Output**, pick an **Adapter**, wire their output to your integrations.
 
-## [0.2.0-beta.0] - 2026-02-03
+## [0.2.0-pre-release.0] - 2026-02-03
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Canonical envelope:** all nodes now emit `msg.alarmUltimate` (versioned) as the stable, canonical representation of alarm messages.
 - **Output-only helper nodes:** `Alarm State`, `Alarm Zone`, `Alarm Siren` now emit the same “default telegrams” as `AlarmSystemUltimate`:
@@ -155,7 +176,7 @@
 
 ## [0.1.17] - 2026-02-02
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Output Adapter (Homekit Alarm Status):** on `arming` the node keeps `SecuritySystemCurrentState` at the previous value (while updating `SecuritySystemTargetState`). If you relied on both being the same during arming, update your downstream flows.
 
@@ -197,7 +218,7 @@
 
 ## [Unreleased]
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - TBD.
 
@@ -215,7 +236,7 @@
 
 ## [0.1.9] - 2026-02-02
 
-### Breaking (BETA)
+### Breaking (pre-release)
 
 - **Alarm node:** removed classic multi-output mode; `AlarmSystemUltimate` now has a single output only.
 

package/README.md

@@ -7,7 +7,6 @@
 [![Node-RED Flows][flows-image]][flows-url]
 [![License][license-image]][license-url]
 [![GitHub issues][issues-image]][issues-url]
-[![Status: beta][beta-image]][repo-url]
 
 # node-red-contrib-alarm-ultimate
 
@@ -23,14 +22,14 @@ Alarm System Ultimate nodes + web panel for Node-RED.
 
 Includes:
 
-- `AlarmSystemUltimate` (BETA): full alarm control panel node (zones, entry/exit delays, bypass, chime, 24h/fire/tamper, siren, event log, optional per-zone sensor supervision).
+- `AlarmSystemUltimate`: main alarm node with panel-style behavior (zones, entry/exit delays, bypass, chime, 24h/fire/tamper, siren, event log, optional per-zone sensor supervision).
 - Helper nodes: `AlarmUltimateState`, `AlarmUltimateZone`, `AlarmUltimateSiren`.
-  - `AlarmUltimateState`: Input/Output node with embedded adapters (Default / Homekit / Ax Pro / KNX-Ultimate).
+  - `AlarmUltimateState`: input/output helper for arm/disarm and state integration (Default / Homekit / Ax Pro / KNX-Ultimate).
   - `AlarmUltimateZone`: output-only zone events splitter (no adapters).
   - `AlarmUltimateSiren`: output-only siren state splitter.
 - Web tools: Zones JSON mapper + web Alarm Panel (embeddable in Node-RED Dashboard).
 
-Note: `AlarmSystemUltimate` is currently **BETA**.
+`AlarmSystemUltimate` is now stable.
 
 ## Table of contents
 
@@ -40,8 +39,8 @@ Note: `AlarmSystemUltimate` is currently **BETA**.
 - [Nodes](#nodes)
 - [Web tools](#web-tools)
 - [Examples](#examples)
-- [Permissions and endpoints](#permissions-and-endpoints)
-- [Development](#development)
+- [Advanced integration reference (optional)](#advanced-integration-reference-optional)
+- [Contributing (optional)](#contributing-optional)
 
 ## Install
 
@@ -56,8 +55,8 @@ npm i node-red-contrib-alarm-ultimate
 
 Beginner-friendly flow:
 
-1. Add an **AlarmSystemUltimate (BETA)** node.
-2. Click **Manage zones** and add at least one zone (example topic: `sensor/frontdoor`). Use **Export JSON** / **Import JSON** in the Zones JSON Mapper web tool to backup/restore your zones.
+1. Add an **AlarmSystemUltimate** node.
+2. Click **Manage zones** and add at least one zone (example topic: `sensor/frontdoor`). For backup/restore use **Export Zones** / **Import Zones** in the **Settings** page.
    **Important:** after editing zones, click **Done** in the Node-RED editor to save (if you click **Cancel**, changes are lost).
 3. Send sensor messages to the Alarm node:
    - open: `msg.topic="sensor/frontdoor"`, `msg.payload=true`
@@ -91,7 +90,7 @@ Optional (recommended):
 
 ## Nodes
 
-### Alarm System Ultimate (BETA)
+### Alarm System Ultimate 
 
 Main node that:
 
@@ -152,7 +151,9 @@ Example zone:
 - `Alarm Zone` (`AlarmUltimateZone`): emits `zone_open` / `zone_close` as `.../event` telegrams
 - `Alarm Siren` (`AlarmUltimateSiren`): emits siren telegrams (`msg.topic = <controlTopic>/siren`, `msg.event = siren_on|siren_off`, `msg.payload = true|false`)
 
-### Canonical envelope (`msg.alarmUltimate`)
+### Advanced integration (optional): `msg.alarmUltimate`
+
+If you are just wiring nodes in Node-RED, you can safely skip this section.
 
 All nodes in this package add a stable, versioned object to every output message:
 
@@ -168,11 +169,11 @@ msg.alarmUltimate = {
 };
 ```
 
-Embedded adapters use `msg.alarmUltimate` as the canonical source, so they do not depend on user-configurable `msg.topic` / `msg.payload` formats.
+Adapters and advanced integrations can use `msg.alarmUltimate` as a consistent source of alarm details.
 
 ## Web tools
 
-These pages are served via the Node-RED admin HTTP endpoint:
+These web pages are available from your Node-RED editor at:
 
 - Zones JSON Mapper: `/alarm-ultimate/alarm-json-mapper`
 - Alarm Panel: `/alarm-ultimate/alarm-panel`
@@ -187,9 +188,12 @@ The Zones JSON Mapper supports:
 
 - Sample message mapping (e.g. KNX Ultimate): map `topic`/`payload` fields and generate a zone template.
 - ETS Group Addresses export (TSV): paste the exported table and generate zones in batch (boolean datapoints only).
-- Backup/restore: **Export JSON** / **Import JSON** for zone definitions.
 - Quality-of-life: bulk apply (Kind/Supervision), sorting, duplicate-topic skipping on import, persisted Step 1 input.
 
+The Settings page supports:
+
+- Backup/restore: **Export Zones** / **Import Zones** for zone definitions.
+
 ## Examples
 
 - `examples/alarm-ultimate-basic.json`: ready-to-import flow with `AlarmSystemUltimate`, injects and debug nodes.
@@ -200,7 +204,7 @@ The Zones JSON Mapper supports:
 
 See `examples/README.md`.
 
-## Development
+## Contributing (optional)
 
 Run tests:
 
@@ -208,7 +212,9 @@ Run tests:
 npm test
 ```
 
-## Permissions and endpoints
+## Advanced integration reference (optional)
+
+If you are using the package normally in flows, you can ignore this section.
 
 When Node-RED authentication is enabled, the admin endpoints use these permissions (if available):
 
@@ -236,4 +242,3 @@ HTTP admin endpoints:
 [flows-image]: https://img.shields.io/badge/Node--RED%20Flows-library-8f0000?logo=nodered&logoColor=white
 [license-image]: https://img.shields.io/npm/l/node-red-contrib-alarm-ultimate.svg
 [issues-image]: https://img.shields.io/github/issues/Supergiovane/node-red-contrib-alarm-ultimate.svg
-[beta-image]: https://img.shields.io/badge/status-beta-orange.svg

package/nodes/AlarmSystemUltimate.html

@@ -267,13 +267,35 @@
         zoneAxProMatchRow.toggle(adapter === "axpro");
       }
 
+      function getEditorAccessToken() {
+        try {
+          const tokens =
+            RED && RED.settings && typeof RED.settings.get === "function"
+              ? RED.settings.get("auth-tokens")
+              : null;
+          return tokens && typeof tokens.access_token === "string"
+            ? tokens.access_token.trim()
+            : "";
+        } catch (_err) {
+          return "";
+        }
+      }
+
+      function withAccessToken(url) {
+        const token = getEditorAccessToken();
+        if (!token) return url;
+        const sep = url.includes("?") ? "&" : "?";
+        return `${url}${sep}access_token=${encodeURIComponent(token)}`;
+      }
+
       function openZonesManager() {
         const httpAdminRoot = (RED.settings && RED.settings.httpAdminRoot) || "/";
         const root = httpAdminRoot.endsWith("/") ? httpAdminRoot : `${httpAdminRoot}/`;
         const currentName = String($("#node-input-name").val() || "").trim();
         const namePart = currentName ? `&name=${encodeURIComponent(currentName)}` : "";
         const idPart = nodeId ? `?id=${encodeURIComponent(nodeId)}${namePart}` : "";
-        window.open(`${root}alarm-ultimate/alarm-json-mapper${idPart}`, "_blank");
+        const targetUrl = `${root}alarm-ultimate/alarm-json-mapper${idPart}`;
+        window.open(withAccessToken(targetUrl), "_blank");
       }
 
       $("#node-input-zones-panel").on("click", function (evt) {
@@ -281,8 +303,9 @@
         const httpAdminRoot = (RED.settings && RED.settings.httpAdminRoot) || "/";
         const root = httpAdminRoot.endsWith("/") ? httpAdminRoot : `${httpAdminRoot}/`;
         const idPart = nodeId ? `?id=${encodeURIComponent(nodeId)}` : "";
+        const targetUrl = `${root}alarm-ultimate/alarm-panel${idPart}`;
         window.open(
-          `${root}alarm-ultimate/alarm-panel${idPart}`,
+          withAccessToken(targetUrl),
           "_blank",
           "noopener,noreferrer",
         );
@@ -748,7 +771,7 @@
   ## Quick start (5 minutes)
 
   1. Add an **Alarm System** node to your flow.
-  2. Click **Manage zones** and create at least one zone (example topic: `sensor/frontdoor`). Use **Export JSON** / **Import JSON** in the web tool to backup/restore your zones.  
+  2. Click **Manage zones** and create at least one zone (example topic: `sensor/frontdoor`). For backup/restore use **Export Zones** / **Import Zones** in the **Settings** web page.  
      **Important:** after editing zones, click **Done** in the Node-RED editor to save (if you click **Cancel**, changes are lost).
   3. Send sensor messages to the Alarm node:
      - open: `msg.topic="sensor/frontdoor"` + `msg.payload=true` (also works: `"open"`, `"on"`, `1`)
@@ -769,10 +792,11 @@
 
   <br/>
 
-  ### WEB PAGE
+  ### Editor and web pages
 
   - **Panel**: `/alarm-ultimate/alarm-panel` (supports `?id=<alarmNodeId>` and `?embed=1&id=<alarmNodeId>`).
-  - **Zones**: use **Manage zones** to open `/alarm-ultimate/alarm-json-mapper` and sync the JSON back into the editor. Click **Done** in the editor to apply/save. Use **Export JSON** / **Import JSON** in the web tool to backup/restore zone definitions.
+  - **Zones**: use **Manage zones** to open `/alarm-ultimate/alarm-json-mapper` and sync zones back into the editor. Click **Done** in the Node-RED node editor to apply/save.
+  - **Settings**: open `/alarm-ultimate/alarm-settings` to **Export Zones** / **Import Zones**.
   - **Name**: optional label shown in the Alarm Panel.
   - **Control topic**: topic that receives commands (and is used as base for some outputs).
   - **With Input**: message property evaluated as sensor value (default `payload`). It must be convertible to boolean (`true/false`, `open/closed`, `on/off`, `1/0`, ...).
@@ -800,11 +824,11 @@
   | Emit restore events          | Emits `zone_restore` when a zone returns to false.                                                                                   |
   | Event log size               | Max stored log entries in node context (0 disables log).                                                                             |
   | Sync other alarms            | Optional: when this node is armed/disarmed, it can arm/disarm other Alarm nodes. The original `msg.code` is forwarded.               |
-  | Zones                        | Zone definitions. Use **Manage zones** (web tool) to edit advanced JSON (including optional supervision). Use **Export JSON** / **Import JSON** in the web tool to backup/restore. |
+  | Zones                        | Zone definitions. Use **Manage zones** to edit them in the web page (including optional supervision). For backup/restore use **Settings** → **Export Zones / Import Zones**. |
 
   <br/>
 
-  ## Zones JSON (advanced)
+  ## Zones (advanced, optional)
 
   Each zone can optionally enable **sensor supervision** (per-zone): if no valid sensor updates are received within `timeoutSeconds`, the node emits `supervision_lost` (supervision starts immediately when the node runs, and `supervision_restored` is emitted on the next valid update).
 
@@ -827,11 +851,11 @@
 
   <br/>
 
-  ## Output
+  ## Output reference
 
   The node has **9 outputs** (pins).
 
-  Important: **Output #1 (All messages)** is a *superset* of all other outputs. It can emit:
+  Important: **Output #1 (All messages)** includes everything from the other outputs. It can emit:
 
   - a single message, or
   - an array of messages (for example, when the node emits an event **and** a siren update at the same time).
@@ -889,7 +913,7 @@
 
   <br/>
 
-  ## Events (`msg.event`)
+  ## Event reference (`msg.event`, optional)
 
   Arming / state:
 
@@ -921,7 +945,7 @@
 
   <br/>
 
-  ## Control messages (`msg.topic === controlTopic`)
+  ## Control message reference (`msg.topic === controlTopic`)
 
   Arm:
 
@@ -937,11 +961,11 @@
 
   - `msg.command = "status"` or `msg.status = true`
 
-	  Bypass / unbypass (zone topic):
+  Bypass / unbypass (zone topic):
 
   - `msg.command = "bypass"` / `msg.command = "unbypass"`
   - or `msg.bypass = true` / `msg.unbypass = true`
-		  - pass the zone **topic** in `msg.zoneTopic`
+  - pass the zone **topic** in `msg.zoneTopic`
 
   Siren:
 
@@ -963,18 +987,18 @@
 
   <br/>
 
-  ## Zones
+  ## Zone fields
 
-	  Zones must be configured as a JSON array of objects.
+  Zones must be configured as a JSON array of objects.
 
-	  Minimal fields:
+  Minimal fields:
 
-	  - `topic` (exact topic, or a prefix ending with `*`)
+  - `topic` (exact topic, or a prefix ending with `*`)
 
-	  Common fields:
+  Common fields:
 
-		  - `topic`: **unique identifier** of the zone (used for bypass via `msg.zoneTopic`)
-	  - `name`: label used in events (optional; defaults to `topic`)
+  - `topic`: **unique identifier** of the zone (used for bypass via `msg.zoneTopic`)
+  - `name`: label used in events (optional; defaults to `topic`)
   - `type`: `perimeter` (default), `motion`, `tamper`, `fire`, `24h`
   - `entry`: `true` to use entry delay, otherwise triggers instantly
   - `entryDelaySeconds`: overrides the global entry delay
@@ -990,13 +1014,13 @@
 
   Example (formatted JSON array):
 
-	  ```json
-	  [
-	    {
-	      "name": "Front door",
-	      "topic": "house/door/front",
-	      "type": "perimeter",
-	      "entry": true,
+  ```json
+  [
+    {
+      "name": "Front door",
+      "topic": "house/door/front",
+      "type": "perimeter",
+      "entry": true,
       "entryDelaySeconds": 30,
       "bypassable": true,
       "chime": true

package/nodes/AlarmSystemUltimate.js

@@ -86,6 +86,37 @@ module.exports = function (RED) {
         ? RED.auth.needsPermission('AlarmSystemUltimate.write')
         : (req, res, next) => next();
 
+    function applyAccessTokenFromQuery(req) {
+      const token =
+        req &&
+        req.query &&
+        typeof req.query.access_token === 'string' &&
+        req.query.access_token.trim().length > 0
+          ? req.query.access_token.trim()
+          : '';
+      if (!token) {
+        return;
+      }
+      if (!req.headers || typeof req.headers !== 'object') {
+        req.headers = {};
+      }
+      const authHeader =
+        typeof req.headers.authorization === 'string' ? req.headers.authorization.trim() : '';
+      if (!authHeader && token) {
+        req.headers.authorization = `Bearer ${token}`;
+      }
+      // passport-http-bearer returns 400 if token is present in both header and query.
+      // Normalize to header-only for this request.
+      if (req.query && Object.prototype.hasOwnProperty.call(req.query, 'access_token')) {
+        delete req.query.access_token;
+      }
+    }
+
+    function needsReadWithQueryToken(req, res, next) {
+      applyAccessTokenFromQuery(req);
+      return needsRead(req, res, next);
+    }
+
     function sendToolFile(res, filename) {
       const filePath = path.join(__dirname, '..', 'tools', filename);
       res.set('Cache-Control', 'no-store, max-age=0');
@@ -97,14 +128,38 @@ module.exports = function (RED) {
       });
     }
 
-    RED.httpAdmin.get('/alarm-ultimate/alarm-json-mapper', needsRead, (req, res) => {
+    function sendToolAssetFile(res, filename) {
+      const assetsRoot = path.join(__dirname, '..', 'tools', 'assets');
+      const requested = String(filename || '').replace(/^\/+/, '');
+      const rootPath = path.resolve(assetsRoot);
+      const fullPath = path.resolve(rootPath, requested);
+      if (!fullPath.startsWith(rootPath + path.sep)) {
+        res.status(403).end();
+        return;
+      }
+      res.sendFile(fullPath, (err) => {
+        if (err) {
+          res.status(err.statusCode || 404).end();
+        }
+      });
+    }
+
+    RED.httpAdmin.get('/alarm-ultimate/alarm-json-mapper', needsReadWithQueryToken, (req, res) => {
       sendToolFile(res, 'alarm-json-mapper.html');
     });
 
-    RED.httpAdmin.get('/alarm-ultimate/alarm-panel', needsRead, (req, res) => {
+    RED.httpAdmin.get('/alarm-ultimate/alarm-panel', needsReadWithQueryToken, (req, res) => {
       sendToolFile(res, 'alarm-panel.html');
     });
 
+    RED.httpAdmin.get('/alarm-ultimate/alarm-settings', needsReadWithQueryToken, (req, res) => {
+      sendToolFile(res, 'alarm-settings.html');
+    });
+
+    RED.httpAdmin.get('/alarm-ultimate/alarm-tools/assets/:file', (req, res) => {
+      sendToolAssetFile(res, req.params.file);
+    });
+
     RED.httpAdmin.get('/alarm-ultimate/alarm/nodes', needsRead, (req, res) => {
       const nodes = Array.from(alarmInstances.values()).map((api) => ({
         id: api.id,

package/nodes/AlarmUltimateSiren.html

@@ -31,12 +31,34 @@
       const url = `${root}alarm-ultimate/alarm/nodes`;
       const panelButton = $("#node-input-alarm-panel");
 
+      function getEditorAccessToken() {
+        try {
+          const tokens =
+            RED && RED.settings && typeof RED.settings.get === "function"
+              ? RED.settings.get("auth-tokens")
+              : null;
+          return tokens && typeof tokens.access_token === "string"
+            ? tokens.access_token.trim()
+            : "";
+        } catch (_err) {
+          return "";
+        }
+      }
+
+      function withAccessToken(urlValue) {
+        const token = getEditorAccessToken();
+        if (!token) return urlValue;
+        const sep = urlValue.includes("?") ? "&" : "?";
+        return `${urlValue}${sep}access_token=${encodeURIComponent(token)}`;
+      }
+
       panelButton.off("click").on("click", (evt) => {
         evt.preventDefault();
         const alarmId = alarmSelect.val() || this.alarmId || "";
         const idPart = alarmId ? `?id=${encodeURIComponent(alarmId)}` : "";
+        const targetUrl = `${root}alarm-ultimate/alarm-panel${idPart}`;
         window.open(
-          `${root}alarm-ultimate/alarm-panel${idPart}`,
+          withAccessToken(targetUrl),
           "_blank",
           "noopener,noreferrer",
         );
@@ -112,10 +134,10 @@ Output message (same format as the Alarm node siren output):
 - `msg.event`: `siren_on` or `siren_off`
 - `msg.payload`: `true` when the siren is on, otherwise `false`
 - `msg.reason`: `manual|timeout|arm|disarm|...`
-- `msg.alarmUltimate`: canonical, versioned envelope (stable fields for adapters)
+- `msg.alarmUltimate`: optional standard object with extra alarm details
 
 Notes:
 
-- No wiring from the Alarm node is required: select the Alarm node and this node subscribes internally.
+- No wire from the Alarm node is required: just select the Alarm node in this editor.
 - Use the **Panel** button to open the Alarm Panel preselected on the chosen Alarm node.
 </script>

package/nodes/AlarmUltimateState.html

@@ -40,6 +40,27 @@
       const topicRow = $("#au-row-topic");
       const initRow = $("#au-row-outputInitialState");
 
+      function getEditorAccessToken() {
+        try {
+          const tokens =
+            RED && RED.settings && typeof RED.settings.get === "function"
+              ? RED.settings.get("auth-tokens")
+              : null;
+          return tokens && typeof tokens.access_token === "string"
+            ? tokens.access_token.trim()
+            : "";
+        } catch (_err) {
+          return "";
+        }
+      }
+
+      function withAccessToken(urlValue) {
+        const token = getEditorAccessToken();
+        if (!token) return urlValue;
+        const sep = urlValue.includes("?") ? "&" : "?";
+        return `${urlValue}${sep}access_token=${encodeURIComponent(token)}`;
+      }
+
       function refreshVisibility() {
         const mode = String(ioSelect.val() || "out");
         const isOut = mode === "out";
@@ -51,8 +72,9 @@
         evt.preventDefault();
         const alarmId = alarmSelect.val() || this.alarmId || "";
         const idPart = alarmId ? `?id=${encodeURIComponent(alarmId)}` : "";
+        const targetUrl = `${root}alarm-ultimate/alarm-panel${idPart}`;
         window.open(
-          `${root}alarm-ultimate/alarm-panel${idPart}`,
+          withAccessToken(targetUrl),
           "_blank",
           "noopener,noreferrer",
         );
@@ -166,11 +188,11 @@ Output message (same format as the Alarm node `.../event` output):
 - `msg.payload`: `true|false` (armed/active boolean)
 - `msg.mode`: `armed|disarmed`
 - other event fields (reason, seconds, violations, ...) are emitted as **root properties** on `msg`
-- `msg.alarmUltimate`: canonical, versioned envelope (stable fields for adapters)
+- `msg.alarmUltimate`: optional standard object with extra alarm details
 
 Notes:
 
-- No wiring from the Alarm node is required: select the Alarm node and this node subscribes internally.
+- No wire from the Alarm node is required: just select the Alarm node in this editor.
 - Use the **Panel** button to open the Alarm Panel preselected on the chosen Alarm node.
 
 ## Input mode details
@@ -215,7 +237,7 @@ Only arming/disarming CID codes are handled (other CID events are ignored):
 - `3441` → `arm` (Stay)
 - `1401` → `disarm`
 
-## Output adapter notes
+## Adapter output behavior
 
 - **Default / Ax Pro**: keeps a boolean `msg.payload` and emits details as root properties.
 - **Homekit**: emits `msg.SecuritySystemTargetState` and `msg.SecuritySystemCurrentState` as root properties (while keeping boolean `msg.payload`).