merge: resolve conflicts with dev, fix 7 Snyk security issues

- Resolve translation conflicts (keep both journey + OAuth scope keys) - Resolve migrations.ts (dev OAuth migrations + journey migrations) - Fix hono directory traversal, response splitting, input validation (CVE-2026-39407/08/09/10) - Fix @hono/node-server directory traversal (CVE-2026-39406) - Fix nodemailer CRLF injection (upgrade to 8.0.5)
2026-06-19 13:21:46 +00:00 · 2026-04-11 19:11:21 +02:00
parent 13956804c2 aa1261e82b
commit 956c4270df
121 changed files with 13475 additions and 2499 deletions
@@ -54,14 +54,16 @@ jobs:
          echo "VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT
          echo "$CURRENT → $NEW_VERSION ($BUMP)"

-          # Update both package.json files
+          # Update package.json files and Helm chart
          cd server && npm version "$NEW_VERSION" --no-git-tag-version && cd ..
          cd client && npm version "$NEW_VERSION" --no-git-tag-version && cd ..
+          sed -i "s/^version: .*/version: $NEW_VERSION/" charts/trek/Chart.yaml
+          sed -i "s/^appVersion: .*/appVersion: \"$NEW_VERSION\"/" charts/trek/Chart.yaml

          # Commit and tag
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add server/package.json server/package-lock.json client/package.json client/package-lock.json
+          git add server/package.json server/package-lock.json client/package.json client/package-lock.json charts/trek/Chart.yaml
          git commit -m "chore: bump version to $NEW_VERSION [skip ci]"
          git tag "v$NEW_VERSION"
          git push origin main --follow-tags
@@ -151,3 +153,18 @@ jobs:

      - name: Inspect manifest
        run: docker buildx imagetools inspect mauriceboe/trek:latest
+
+  release-helm:
+    runs-on: ubuntu-latest
+    needs: version-bump
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: main
+
+      - name: Publish Helm chart
+        uses: stefanprodan/helm-gh-pages@v1.7.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          charts_dir: charts
@@ -9,6 +9,10 @@ structured API.
 ## Table of Contents

 - [Setup](#setup)
+  - [Option A: OAuth 2.1 (recommended)](#option-a-oauth-21-recommended)
+  - [Option B: Static API Token (deprecated)](#option-b-static-api-token-deprecated)
+- [Authentication](#authentication)
+- [OAuth Scopes](#oauth-scopes)
 - [Limitations & Important Notes](#limitations--important-notes)
 - [Resources (read-only)](#resources-read-only)
 - [Tools (read-write)](#tools-read-write)
@@ -22,22 +26,51 @@ structured API.
 ### 1. Enable the MCP addon (admin)

 An administrator must first enable the MCP addon from the **Admin Panel > Addons** page. Until enabled, the `/mcp`
-endpoint returns `403 Forbidden` and the MCP section does not appear in user settings.
+endpoint returns `404` and the MCP section does not appear in user settings.

-### 2. Create an API token
+### 2. Connect your MCP client

-Once MCP is enabled, go to **Settings > MCP Configuration** and create an API token:
+#### Option A: OAuth 2.1 (recommended)

-1. Click **Create New Token**
-2. Give it a descriptive name (e.g. "Claude Desktop", "Work laptop")
-3. **Copy the token immediately** — it is shown only once and cannot be recovered
+MCP clients that support OAuth 2.1 (such as Claude Desktop via `mcp-remote`) authenticate automatically. No token
+management required — just provide the server URL:

-Each user can create up to **10 tokens**.
+```json
+{
+  "mcpServers": {
+    "trek": {
+      "command": "npx",
+      "args": [
+        "mcp-remote",
+        "https://your-trek-instance.com/mcp"
+      ]
+    }
+  }
+}
+```

-### 3. Configure your MCP client
+> The path to `npx` may need to be adjusted for your system (e.g. `C:\PROGRA~1\nodejs\npx.cmd` on Windows).

-The Settings page shows a ready-to-copy client configuration snippet. For **Claude Desktop**, add the following to your
-`claude_desktop_config.json`:
+**What happens automatically:**
+1. The client fetches `/.well-known/oauth-authorization-server` to discover the TREK authorization server.
+2. The client registers itself via [Dynamic Client Registration (RFC 7591)](https://www.rfc-editor.org/rfc/rfc7591).
+3. Your browser opens TREK's consent screen, where you choose which scopes (permissions) to grant.
+4. The client receives a short-lived access token and a rotating refresh token — no re-authorization needed.
+
+> **Requirement:** The `APP_URL` environment variable must be set to your TREK instance's public URL for OAuth
+> discovery to work correctly.
+
+**For more control over scopes or to use confidential client mode**, pre-create an OAuth client in
+**Settings > Integrations > MCP > OAuth Clients** before connecting. Clients created there have a client secret
+(`trekcs_` prefix) and fixed scopes that you define up front.
+
+#### Option B: Static API Token (deprecated)
+
+> **Deprecated:** Static API tokens will stop working in a future version. Migrate to OAuth 2.1 above.
+
+1. Go to **Settings > Integrations > MCP** and create an API token.
+2. Click **Create New Token**, give it a name, and **copy the token immediately** — it is shown only once.
+3. Add it to your `claude_desktop_config.json`:

 ```json
 {
@@ -55,7 +88,65 @@ The Settings page shows a ready-to-copy client configuration snippet. For **Clau
 }
 ```

-> The path to `npx` may need to be adjusted for your system (e.g. `C:\PROGRA~1\nodejs\npx.cmd` on Windows).
+Static tokens grant full access to all tools and resources (no scope restrictions). Sessions authenticated with a
+static token will receive deprecation warnings in the AI client via server instructions and tool results.
+
+Each user can create up to **10 static tokens**.
+
+---
+
+## Authentication
+
+TREK's MCP server supports three authentication methods. OAuth 2.1 is the recommended path for all external clients.
+
+| Method | Token prefix | Access level | TTL | Notes |
+|--------|-------------|-------------|-----|-------|
+| **OAuth 2.1** | `trekoa_` | Scoped (per-consent) | 1 hour | Recommended. Automatically refreshed via 30-day rolling refresh tokens (`trekrf_` prefix). Replay-detected rotation — replayed tokens cascade-revoke the entire chain. |
+| **Static API token** | `trek_` | Full access | No expiry | **Deprecated.** Triggers deprecation warnings in AI clients. Will be removed in a future release. |
+| **Web session JWT** | — | Full access | Session-based | Used internally by the TREK web UI. Not intended for external clients. |
+
+All methods require the `Authorization: Bearer <token>` header (strict scheme enforcement — `Bearer` required).
+
+---
+
+## OAuth Scopes
+
+When connecting via OAuth 2.1, you grant specific scopes during the consent step. TREK registers only the MCP tools
+that match your granted scopes for that session.
+
+| Scope | Permission | Group |
+|-------|-----------|-------|
+| `trips:read` | View trips & itineraries | Trips |
+| `trips:write` | Edit trips & itineraries | Trips |
+| `trips:delete` | Delete trips (irreversible) | Trips |
+| `trips:share` | Manage share links | Trips |
+| `places:read` | View places & map data | Places |
+| `places:write` | Manage places | Places |
+| `atlas:read` | View Atlas | Atlas |
+| `atlas:write` | Manage Atlas | Atlas |
+| `packing:read` | View packing lists | Packing |
+| `packing:write` | Manage packing lists | Packing |
+| `todos:read` | View to-do lists | To-dos |
+| `todos:write` | Manage to-do lists | To-dos |
+| `budget:read` | View budget | Budget |
+| `budget:write` | Manage budget | Budget |
+| `reservations:read` | View reservations | Reservations |
+| `reservations:write` | Manage reservations | Reservations |
+| `collab:read` | View collaboration | Collaboration |
+| `collab:write` | Manage collaboration | Collaboration |
+| `notifications:read` | View notifications | Notifications |
+| `notifications:write` | Manage notifications | Notifications |
+| `vacay:read` | View vacation plans | Vacation |
+| `vacay:write` | Manage vacation plans | Vacation |
+| `geo:read` | Maps & geocoding | Geo |
+| `weather:read` | Weather forecasts | Weather |
+
+**Scope rules:**
+- A `:write` scope implies `:read` access for the same group (e.g. `budget:write` also grants budget read access).
+- Any `trips:*` scope (`trips:read`, `trips:write`, `trips:delete`, or `trips:share`) grants trip read access.
+- `list_trips` and `get_trip_summary` are **always available** regardless of scopes — they are navigation tools.
+- Static tokens and web session JWTs have full access to all tools (equivalent to all scopes).
+- Addon-gated tools (Atlas Extended, Collab, Vacay) require both the relevant scope **and** the addon to be enabled.

 ---

@@ -68,10 +159,13 @@ The Settings page shows a ready-to-copy client configuration snippet. For **Clau
 | **No image uploads**                    | Cover images cannot be set through MCP. Use the web UI to upload trip covers.                                                                    |
 | **Reservations are created as pending** | When the AI creates a reservation, it starts with `pending` status. You must confirm it manually or ask the AI to set the status to `confirmed`. |
 | **Demo mode restrictions**              | If TREK is running in demo mode, all write operations through MCP are blocked.                                                                   |
-| **Rate limiting**                       | 60 requests per minute per user. Exceeding this returns a `429` error.                                                                           |
-| **Session limits**                      | Maximum 5 concurrent MCP sessions per user. Sessions expire after 1 hour of inactivity.                                                          |
-| **Token limits**                        | Maximum 10 API tokens per user.                                                                                                                  |
-| **Token revocation**                    | Deleting a token immediately terminates all active MCP sessions for that user.                                                                   |
+| **Rate limiting**                       | 300 requests per minute per user (configurable via `MCP_RATE_LIMIT`). Exceeding this returns a `429` error.                                     |
+| **Per-client rate limiting**            | Rate limits are tracked per user-client pair, so each OAuth client has its own independent rate limit window.                                    |
+| **Session limits**                      | Maximum 20 concurrent MCP sessions per user (configurable via `MCP_MAX_SESSION_PER_USER`). Sessions expire after 1 hour of inactivity.          |
+| **Token limits**                        | Maximum 10 static API tokens per user. Maximum 10 OAuth clients per user.                                                                        |
+| **Token revocation**                    | Deleting a static token or revoking an OAuth session immediately terminates all active MCP sessions for that token/client.                       |
+| **OAuth scope enforcement**             | Only tools matching your granted OAuth scopes are registered in the session. Calling an out-of-scope tool returns an error.                      |
+| **Addon toggle invalidation**           | When an admin enables or disables an addon, all active MCP sessions are invalidated and must be re-established.                                  |
 | **Real-time sync**                      | Changes made through MCP are broadcast to all connected clients in real-time via WebSocket, just like changes made through the web UI.           |
 | **Addon-gated features**                | Some resources and tools are only available when the corresponding addon (Atlas, Collab, Vacay) is enabled by an admin.                          |

@@ -356,11 +450,12 @@ trip in a single call.

 MCP prompts are pre-built context loaders your AI client can invoke to get a structured starting point for common tasks.

-| Prompt            | Description                                                                     |
-|-------------------|---------------------------------------------------------------------------------|
-| `trip-summary`    | Load a formatted summary of a trip (dates, members, days, budget, packing, reservations) before planning or modifying it. |
-| `packing-list`    | Get a formatted packing checklist for a trip, grouped by category.              |
-| `budget-overview` | Get a formatted budget summary with totals by category and per-person cost.     |
+| Prompt               | Description                                                                     |
+|----------------------|---------------------------------------------------------------------------------|
+| `trip-summary`       | Load a formatted summary of a trip (dates, members, days, budget, packing, reservations) before planning or modifying it. |
+| `packing-list`       | Get a formatted packing checklist for a trip, grouped by category.              |
+| `budget-overview`    | Get a formatted budget summary with totals by category and per-person cost.     |
+| `token_auth_notice`  | Static token deprecation notice and migration guide. Only available in sessions authenticated with a legacy `trek_` token. |

 ---

@@ -9,7 +9,7 @@
 </p>

 <p align="center">
-  <a href="https://discord.gg/J27gr9GH"><img src="https://img.shields.io/badge/Discord-Join%20Community-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
+  <a href="https://discord.gg/NhZBDSd4qW"><img src="https://img.shields.io/badge/Discord-Join%20Community-5865F2?logo=discord&logoColor=white" alt="Discord" /></a>
  <a href="LICENSE"><img src="https://img.shields.io/badge/License-AGPL_v3-blue.svg" alt="License: AGPL v3" /></a>
  <a href="https://hub.docker.com/r/mauriceboe/trek"><img src="https://img.shields.io/docker/pulls/mauriceboe/trek" alt="Docker Pulls" /></a>
  <a href="https://github.com/mauriceboe/TREK"><img src="https://img.shields.io/github/stars/mauriceboe/TREK" alt="GitHub Stars" /></a>
@@ -77,7 +77,8 @@
 - **Dashboard Widgets** — Currency converter and timezone clock, toggleable per user

 ### AI / MCP Integration
- **MCP Server** — Built-in [Model Context Protocol](MCP.md) server exposes 80+ tools and 27 resources so AI assistants (Claude, Cursor, etc.) can read and modify your trips
+- **MCP Server** — Built-in [Model Context Protocol](MCP.md) server with OAuth 2.1 authentication exposes 80+ tools and 27 resources so AI assistants (Claude, Cursor, etc.) can read and modify your trips
+- **Granular Scopes** — 24 OAuth scopes across 13 permission groups let you control exactly what data your AI client can access
 - **Full Trip Automation** — AI can create trips, plan itineraries, build packing lists, manage budgets, send collab messages, mark countries visited, and more in a single conversation
 - **Prompts** — Pre-built `trip-summary`, `packing-list`, and `budget-overview` prompts give AI clients instant structured context
 - **Addon-Aware** — Atlas, Collab, and Vacay features are exposed automatically when those addons are enabled
@@ -97,11 +98,23 @@
 - **PWA**: vite-plugin-pwa + Workbox
 - **Real-Time**: WebSocket (`ws`)
 - **State**: Zustand
- **Auth**: JWT + OIDC + TOTP (MFA)
+- **Auth**: JWT + OAuth 2.1 + OIDC + TOTP (MFA)
 - **Maps**: Leaflet + react-leaflet-cluster + Google Places API (optional)
 - **Weather**: Open-Meteo API (free, no key required)
 - **Icons**: lucide-react

+## Helm (Kubernetes)
+
+A hosted Helm repository is available:
+
+```sh
+helm repo add trek https://mauriceboe.github.io/TREK
+helm repo update
+helm install trek trek/trek
+```
+
+See [`charts/README.md`](charts/README.md) for configuration options.
+
 ## Quick Start

 ```bash
@@ -149,9 +162,9 @@ services:
      - TZ=${TZ:-UTC} # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
      - LOG_LEVEL=${LOG_LEVEL:-info} # info = concise user actions; debug = verbose admin-level details
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-} # Comma-separated origins for CORS and email notification links
-      - FORCE_HTTPS=true # Redirect HTTP to HTTPS when behind a TLS-terminating proxy
-      # - COOKIE_SECURE=false # Uncomment if accessing over plain HTTP (no HTTPS). Not recommended for production.
-      - TRUST_PROXY=1 # Number of trusted proxies for X-Forwarded-For
+      # - FORCE_HTTPS=true # Optional. Enables HTTPS redirect, HSTS, CSP upgrade-insecure-requests, and secure cookies behind a TLS proxy
+      # - COOKIE_SECURE=false # Escape hatch: force session cookies over plain HTTP even in production. Not recommended.
+      # - TRUST_PROXY=1 # Trusted proxy count for X-Forwarded-For / X-Forwarded-Proto. Required for FORCE_HTTPS to work.
      # - ALLOW_INTERNAL_NETWORK=true # Uncomment if Immich or other services are on your local network (RFC-1918 IPs)
      - APP_URL=${APP_URL:-} # Base URL of this instance — required when OIDC is enabled; must match the redirect URI registered with your IdP; Also used as the base URL for email notifications and other external links
      # - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
@@ -166,8 +179,8 @@ services:
      # - DEMO_MODE=false # Enable demo mode (resets data hourly)
      # - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
      # - ADMIN_PASSWORD=changeme      # Initial admin password — only used on first boot when no users exist
-      # - MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
-      # - MCP_MAX_SESSION_PER_USER=5 # Max concurrent MCP sessions per user (default: 5)
+      # - MCP_RATE_LIMIT=300 # Max MCP API requests per user per minute (default: 300)
+      # - MCP_MAX_SESSION_PER_USER=20 # Max concurrent MCP sessions per user (default: 20)
    volumes:
      - ./data:/app/data
      - ./uploads:/app/uploads
@@ -180,7 +193,13 @@ services:
      start_period: 15s
 ```

-This example is aimed at reverse-proxy deployments. If you access TREK directly on `http://<host>:3000` without nginx, Caddy, Traefik, or another TLS-terminating proxy in front of it, set `FORCE_HTTPS=false` and remove `TRUST_PROXY` to avoid redirects to a non-existent HTTPS endpoint.
+This example is aimed at reverse-proxy deployments where nginx, Caddy, Traefik, or a similar proxy terminates TLS in front of TREK. The three HTTPS-related variables work together:
+
+- **`FORCE_HTTPS`** is 100% optional. When set to `true` it does four things: adds an HTTP-to-HTTPS 301 redirect, sends an HSTS header (`max-age=31536000`), adds the CSP `upgrade-insecure-requests` directive, and forces the session cookie `secure` flag on. It only makes sense behind a TLS-terminating proxy.
+- **`TRUST_PROXY`** tells Express how many proxies sit in front of TREK so it can read the real client IP from `X-Forwarded-For` and the protocol from `X-Forwarded-Proto`. Without it, `FORCE_HTTPS` redirects will loop because Express never sees the request as secure. In production (`NODE_ENV=production`) this defaults to `1` automatically; in development it is off unless explicitly set.
+- **`COOKIE_SECURE`** is normally auto-derived — the session cookie is marked `secure` whenever `NODE_ENV=production` or `FORCE_HTTPS=true`. Setting `COOKIE_SECURE=false` is an escape hatch that disables the `secure` flag even in production (e.g. testing over plain HTTP on a LAN). Do not disable it in real deployments.
+
+If you access TREK directly on `http://<host>:3000` with no reverse proxy, leave `FORCE_HTTPS` unset (or remove it) and remove `TRUST_PROXY` to avoid redirect loops to a non-existent HTTPS endpoint.

 ```bash
 docker compose up -d
@@ -291,9 +310,9 @@ trek.yourdomain.com {
 | `TZ` | Timezone for logs, reminders and cron jobs (e.g. `Europe/Berlin`) | `UTC` |
 | `LOG_LEVEL` | `info` = concise user actions, `debug` = verbose details | `info` |
 | `ALLOWED_ORIGINS` | Comma-separated origins for CORS and email links | same-origin |
-| `FORCE_HTTPS` | Redirect HTTP to HTTPS behind a TLS-terminating proxy. If you access TREK directly on `http://host:3000`, keep this `false`. | `false` |
-| `COOKIE_SECURE` | Set to `false` to allow session cookies over plain HTTP (e.g. accessing via IP without HTTPS). Defaults to `true` in production. **Not recommended to disable in production.** | `true` |
-| `TRUST_PROXY` | Number of trusted reverse proxies for `X-Forwarded-For`. Use this only when TREK is actually behind a reverse proxy. | `1` |
+| `FORCE_HTTPS` | Optional. When `true`: 301-redirects HTTP to HTTPS, sends HSTS (`max-age=31536000`), adds CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Only useful behind a TLS-terminating reverse proxy. Requires `TRUST_PROXY` to be set so Express can detect the forwarded protocol. | `false` |
+| `COOKIE_SECURE` | Controls the `secure` flag on the `trek_session` cookie. Auto-derived: secure is on when `NODE_ENV=production` **or** `FORCE_HTTPS=true`. Set to `false` as an escape hatch to allow session cookies over plain HTTP (e.g. LAN testing without TLS). **Not recommended to disable in production.** | auto (`true` in production) |
+| `TRUST_PROXY` | Number of trusted reverse proxies. Tells Express to read client IP from `X-Forwarded-For` and protocol from `X-Forwarded-Proto`. Activates automatically in production (defaults to `1`); off in development unless explicitly set. Must be set for `FORCE_HTTPS` redirects to work correctly. | `1` (when active) |
 | `ALLOW_INTERNAL_NETWORK` | Allow outbound requests to private/RFC-1918 IP addresses. Set to `true` if Immich or other integrated services are hosted on your local network. Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) are always blocked regardless of this setting. | `false` |
 | `APP_URL` | Public base URL of this instance (e.g. `https://trek.example.com`). Required when OIDC is enabled — must match the redirect URI registered with your IdP. Also used as the base URL for external links in email notifications. | — |
 | **OIDC / SSO** | | |
@@ -311,8 +330,8 @@ trek.yourdomain.com {
 | `ADMIN_PASSWORD` | Password for the first admin account created on initial boot. Must be set together with `ADMIN_EMAIL`. | random |
 | **Other** | | |
 | `DEMO_MODE` | Enable demo mode (hourly data resets) | `false` |
-| `MCP_RATE_LIMIT` | Max MCP API requests per user per minute | `60` |
-| `MCP_MAX_SESSION_PER_USER` | Max concurrent MCP sessions per user | `5` |
+| `MCP_RATE_LIMIT` | Max MCP API requests per user per minute | `300` |
+| `MCP_MAX_SESSION_PER_USER` | Max concurrent MCP sessions per user | `20` |

 ## Optional API Keys

@@ -10,8 +10,20 @@ This is a minimal Helm chart for deploying the TREK app.
 - Optional generic Ingress support
 - Health checks on `/api/health`

+## Helm Repository
+
+A hosted Helm repository is available:
+
+```sh
+helm repo add trek https://mauriceboe.github.io/TREK
+helm repo update
+helm install trek trek/trek
+```
+
 ## Usage

+Or install directly from the local chart:
+
 ```sh
 helm install trek ./chart \
  --set ingress.enabled=true \
@@ -32,5 +44,7 @@ See `values.yaml` for more options.
 - `ENCRYPTION_KEY` encrypts stored secrets (API keys, MFA, SMTP, OIDC) at rest. Recommended: set via `secretEnv.ENCRYPTION_KEY` or `existingSecret`. If left empty, the server falls back automatically: existing installs use `data/.jwt_secret` (no action needed on upgrade); fresh installs auto-generate a key persisted to the data PVC.
 - If using ingress, you must manually keep `env.ALLOWED_ORIGINS` and `ingress.hosts` in sync to ensure CORS works correctly. The chart does not sync these automatically.
 - Set `env.ALLOW_INTERNAL_NETWORK: "true"` if Immich or other integrated services are hosted on a private/RFC-1918 address (e.g. a pod on the same cluster or a NAS on your LAN). Loopback (`127.x`) and link-local/metadata addresses (`169.254.x`) remain blocked regardless.
- Set `env.COOKIE_SECURE: "false"` only if your deployment has no TLS (e.g. during local testing without ingress). Session cookies require HTTPS in all other cases.
+- `FORCE_HTTPS` is optional. Set `env.FORCE_HTTPS: "true"` only when ingress (or another proxy) terminates TLS. It enables HTTPS redirects, HSTS, CSP `upgrade-insecure-requests`, and forces the session cookie `secure` flag. Requires `TRUST_PROXY` to be set.
+- Set `env.TRUST_PROXY: "1"` (or the number of proxy hops) when running behind ingress or a load balancer. Required for `FORCE_HTTPS` to detect the forwarded protocol correctly. In production it defaults to `1` automatically.
+- `COOKIE_SECURE` is auto-derived (on when `NODE_ENV=production` or `FORCE_HTTPS=true`). Set `env.COOKIE_SECURE: "false"` only during local testing without TLS. **Not recommended for production.**
 - Set `env.OIDC_DISCOVERY_URL` to override the auto-constructed OIDC discovery endpoint. Required for providers (e.g. Authentik) that expose it at a non-standard path.
@@ -1,5 +1,5 @@
 apiVersion: v2
 name: trek
-version: 0.1.0
+version: 2.9.13
 description: Minimal Helm chart for TREK app
-appVersion: "latest"
+appVersion: "2.9.13"
@@ -27,7 +27,7 @@ spec:
        fsGroup: 1000
      containers:
        - name: trek
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          {{- with .Values.resources }}
          resources:
@@ -1,7 +1,7 @@

 image:
  repository: mauriceboe/trek
-  tag: latest
+  # tag: latest
  pullPolicy: IfNotPresent

 # Optional image pull secrets for private registries
@@ -25,11 +25,11 @@ env:
  # Public base URL of this instance. Required when OIDC is enabled — must match the redirect URI registered with your IdP.
  # Also used as the base URL for links in email notifications and other external links.
  # FORCE_HTTPS: "false"
-  # Set to "true" to redirect HTTP to HTTPS behind a TLS-terminating proxy.
+  # Optional. When "true": HTTPS redirect, HSTS, CSP upgrade-insecure-requests, secure cookies. Only behind a TLS proxy. Requires TRUST_PROXY.
  # COOKIE_SECURE: "true"
-  # Set to "false" to allow session cookies over plain HTTP (e.g. no ingress TLS). Not recommended for production.
+  # Auto-derived (true in production or when FORCE_HTTPS=true). Set "false" to force cookies over plain HTTP. Not recommended for production.
  # TRUST_PROXY: "1"
-  # Number of trusted reverse proxies for X-Forwarded-For header parsing.
+  # Trusted proxy hops for X-Forwarded-For/X-Forwarded-Proto. Defaults to 1 in production. Must be set for FORCE_HTTPS to work.
  # ALLOW_INTERNAL_NETWORK: "false"
  # Set to "true" if Immich or other integrated services are hosted on a private/RFC-1918 network address.
  # Loopback (127.x) and link-local/metadata addresses (169.254.x) are always blocked.
@@ -51,10 +51,10 @@ env:
  # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik).
  # DEMO_MODE: "false"
  # Enable demo mode (hourly data resets).
-  # MCP_RATE_LIMIT: "60"
-  # Max MCP API requests per user per minute. Defaults to 60.
-  # MCP_MAX_SESSION_PER_USER: "5"
-  # Max concurrent MCP sessions per user. Defaults to 5.
+  # MCP_RATE_LIMIT: "300"
+  # Max MCP API requests per user per minute. Defaults to 300.
+  # MCP_MAX_SESSION_PER_USER: "20"
+  # Max concurrent MCP sessions per user. Defaults to 20.


 # Secret environment variables stored in a Kubernetes Secret.
@@ -1,6 +1,6 @@
 {
  "name": "trek-client",
-  "version": "2.9.12",
+  "version": "2.9.13",
  "private": true,
  "type": "module",
  "scripts": {
@@ -41,7 +41,7 @@
    "@types/react-dom": "^18.2.19",
    "@types/react-window": "^1.8.8",
    "@vitejs/plugin-react": "^4.2.1",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@vitest/coverage-v8": "^3.2.4",
    "autoprefixer": "^10.4.18",
    "jsdom": "^29.0.1",
    "msw": "^2.13.0",
@@ -51,6 +51,6 @@
    "typescript": "^6.0.2",
    "vite": "^5.1.4",
    "vite-plugin-pwa": "^0.21.0",
-    "vitest": "^4.1.2"
+    "vitest": "^3.2.4"
  }
 }
@@ -15,6 +15,7 @@ import JourneyDetailPage from './pages/JourneyDetailPage'
 import JourneyPublicPage from './pages/JourneyPublicPage'
 import SharedTripPage from './pages/SharedTripPage'
 import InAppNotificationsPage from './pages/InAppNotificationsPage.tsx'
+import OAuthAuthorizePage from './pages/OAuthAuthorizePage'
 import { ToastContainer } from './components/shared/Toast'
 import BottomNav from './components/Layout/BottomNav'
 import { TranslationProvider, useTranslation } from './i18n'
@@ -173,6 +174,8 @@ export default function App() {
        <Route path="/shared/:token" element={<SharedTripPage />} />
        <Route path="/public/journey/:token" element={<JourneyPublicPage />} />
        <Route path="/register" element={<LoginPage />} />
+        {/* OAuth 2.1 consent page — intentionally outside ProtectedRoute */}
+        <Route path="/oauth/authorize" element={<OAuthAuthorizePage />} />
        <Route
          path="/dashboard"
          element={
@@ -1,7 +1,7 @@
 import axios, { AxiosInstance } from 'axios'
 import { getSocketId } from './websocket'

-const apiClient: AxiosInstance = axios.create({
+export const apiClient: AxiosInstance = axios.create({
  baseURL: '/api',
  withCredentials: true,
  headers: {
@@ -72,6 +72,43 @@ export const authApi = {
  },
 }

+export const oauthApi = {
+  /** Validate OAuth authorize params — called by consent page on load */
+  validate: (params: {
+    response_type: string
+    client_id: string
+    redirect_uri: string
+    scope: string
+    state?: string
+    code_challenge: string
+    code_challenge_method: string
+  }) => apiClient.get('/oauth/authorize/validate', { params }).then(r => r.data),
+
+  /** Submit user consent (approve or deny) */
+  authorize: (body: {
+    client_id: string
+    redirect_uri: string
+    scope: string
+    state?: string
+    code_challenge: string
+    code_challenge_method: string
+    approved: boolean
+  }) => apiClient.post('/oauth/authorize', body).then(r => r.data),
+
+  clients: {
+    list: () => apiClient.get('/oauth/clients').then(r => r.data),
+    create: (data: { name: string; redirect_uris: string[]; allowed_scopes: string[] }) =>
+      apiClient.post('/oauth/clients', data).then(r => r.data),
+    rotate: (id: string) => apiClient.post(`/oauth/clients/${id}/rotate`).then(r => r.data),
+    delete: (id: string) => apiClient.delete(`/oauth/clients/${id}`).then(r => r.data),
+  },
+
+  sessions: {
+    list: () => apiClient.get('/oauth/sessions').then(r => r.data),
+    revoke: (id: number) => apiClient.delete(`/oauth/sessions/${id}`).then(r => r.data),
+  },
+}
+
 export const tripsApi = {
  list: (params?: Record<string, unknown>) => apiClient.get('/trips', { params }).then(r => r.data),
  create: (data: Record<string, unknown>) => apiClient.post('/trips', data).then(r => r.data),
@@ -195,6 +232,8 @@ export const adminApi = {
    apiClient.get('/admin/audit-log', { params }).then(r => r.data),
  mcpTokens: () => apiClient.get('/admin/mcp-tokens').then(r => r.data),
  deleteMcpToken: (id: number) => apiClient.delete(`/admin/mcp-tokens/${id}`).then(r => r.data),
+  oauthSessions: () => apiClient.get('/admin/oauth-sessions').then(r => r.data),
+  revokeOAuthSession: (id: number) => apiClient.delete(`/admin/oauth-sessions/${id}`).then(r => r.data),
  getPermissions: () => apiClient.get('/admin/permissions').then(r => r.data),
  updatePermissions: (permissions: Record<string, string>) => apiClient.put('/admin/permissions', { permissions }).then(r => r.data),
  rotateJwtSecret: () => apiClient.post('/admin/rotate-jwt-secret').then(r => r.data),
@@ -0,0 +1,102 @@
+// FE-OAUTH-SCOPES-001 to FE-OAUTH-SCOPES-010
+import { describe, it, expect } from 'vitest'
+import { SCOPE_GROUPS, ALL_SCOPES, SCOPE_GROUP_NAMES, getScopesByGroup } from './oauthScopes'
+
+describe('SCOPE_GROUPS', () => {
+  it('FE-OAUTH-SCOPES-001: contains all expected scope keys', () => {
+    const expected = [
+      'trips:read', 'trips:write', 'trips:delete', 'trips:share',
+      'places:read', 'places:write',
+      'atlas:read', 'atlas:write',
+      'packing:read', 'packing:write',
+      'todos:read', 'todos:write',
+      'budget:read', 'budget:write',
+      'reservations:read', 'reservations:write',
+      'collab:read', 'collab:write',
+      'notifications:read', 'notifications:write',
+      'vacay:read', 'vacay:write',
+      'geo:read', 'weather:read',
+    ]
+    for (const scope of expected) {
+      expect(SCOPE_GROUPS).toHaveProperty(scope)
+    }
+  })
+
+  it('FE-OAUTH-SCOPES-002: each scope entry has labelKey, descriptionKey, groupKey', () => {
+    for (const [scope, keys] of Object.entries(SCOPE_GROUPS)) {
+      expect(keys.labelKey, `${scope} missing labelKey`).toBeTruthy()
+      expect(keys.descriptionKey, `${scope} missing descriptionKey`).toBeTruthy()
+      expect(keys.groupKey, `${scope} missing groupKey`).toBeTruthy()
+    }
+  })
+})
+
+describe('ALL_SCOPES', () => {
+  it('FE-OAUTH-SCOPES-003: contains exactly 24 scopes', () => {
+    expect(ALL_SCOPES).toHaveLength(24)
+  })
+
+  it('FE-OAUTH-SCOPES-004: matches Object.keys(SCOPE_GROUPS)', () => {
+    expect(ALL_SCOPES).toEqual(Object.keys(SCOPE_GROUPS))
+  })
+})
+
+describe('SCOPE_GROUP_NAMES', () => {
+  it('FE-OAUTH-SCOPES-005: contains no duplicate group names', () => {
+    expect(SCOPE_GROUP_NAMES).toHaveLength(new Set(SCOPE_GROUP_NAMES).size)
+  })
+
+  it('FE-OAUTH-SCOPES-006: contains expected groups', () => {
+    const expected = [
+      'oauth.scope.group.trips',
+      'oauth.scope.group.places',
+      'oauth.scope.group.packing',
+      'oauth.scope.group.budget',
+    ]
+    for (const g of expected) {
+      expect(SCOPE_GROUP_NAMES).toContain(g)
+    }
+  })
+})
+
+describe('getScopesByGroup', () => {
+  const identity = (key: string) => key
+
+  it('FE-OAUTH-SCOPES-007: groups all scopes under the correct group key', () => {
+    const groups = getScopesByGroup(identity)
+    // Every scope must appear exactly once across all groups
+    const allScopesInGroups = Object.values(groups).flat().map(s => s.scope)
+    expect(allScopesInGroups).toHaveLength(ALL_SCOPES.length)
+    for (const scope of ALL_SCOPES) {
+      expect(allScopesInGroups).toContain(scope)
+    }
+  })
+
+  it('FE-OAUTH-SCOPES-008: each item has scope, label, description, group', () => {
+    const groups = getScopesByGroup(identity)
+    for (const items of Object.values(groups)) {
+      for (const item of items) {
+        expect(item.scope).toBeTruthy()
+        expect(item.label).toBeTruthy()
+        expect(item.description).toBeTruthy()
+        expect(item.group).toBeTruthy()
+      }
+    }
+  })
+
+  it('FE-OAUTH-SCOPES-009: trips group contains trips:read and trips:write', () => {
+    const groups = getScopesByGroup(identity)
+    const tripsGroup = groups['oauth.scope.group.trips']
+    expect(tripsGroup).toBeDefined()
+    const scopeNames = tripsGroup.map(s => s.scope)
+    expect(scopeNames).toContain('trips:read')
+    expect(scopeNames).toContain('trips:write')
+  })
+
+  it('FE-OAUTH-SCOPES-010: uses translated group name as key', () => {
+    const t = (key: string) => key === 'oauth.scope.group.trips' ? 'Trips' : key
+    const groups = getScopesByGroup(t)
+    expect(groups['Trips']).toBeDefined()
+    expect(groups['oauth.scope.group.trips']).toBeUndefined()
+  })
+})
@@ -0,0 +1,56 @@
+// Human-readable scope definitions for the OAuth consent page.
+// Must stay in sync with server/src/mcp/scopes.ts
+
+export interface ScopeInfo {
+  label: string
+  description: string
+  group: string
+}
+
+export interface ScopeKeys {
+  labelKey: string
+  descriptionKey: string
+  groupKey: string
+}
+
+export const SCOPE_GROUPS: Record<string, ScopeKeys> = {
+  'trips:read':          { labelKey: 'oauth.scope.trips:read.label',          descriptionKey: 'oauth.scope.trips:read.description',          groupKey: 'oauth.scope.group.trips' },
+  'trips:write':         { labelKey: 'oauth.scope.trips:write.label',         descriptionKey: 'oauth.scope.trips:write.description',         groupKey: 'oauth.scope.group.trips' },
+  'trips:delete':        { labelKey: 'oauth.scope.trips:delete.label',        descriptionKey: 'oauth.scope.trips:delete.description',        groupKey: 'oauth.scope.group.trips' },
+  'trips:share':         { labelKey: 'oauth.scope.trips:share.label',         descriptionKey: 'oauth.scope.trips:share.description',         groupKey: 'oauth.scope.group.trips' },
+  'places:read':         { labelKey: 'oauth.scope.places:read.label',         descriptionKey: 'oauth.scope.places:read.description',         groupKey: 'oauth.scope.group.places' },
+  'places:write':        { labelKey: 'oauth.scope.places:write.label',        descriptionKey: 'oauth.scope.places:write.description',        groupKey: 'oauth.scope.group.places' },
+  'atlas:read':          { labelKey: 'oauth.scope.atlas:read.label',          descriptionKey: 'oauth.scope.atlas:read.description',          groupKey: 'oauth.scope.group.atlas' },
+  'atlas:write':         { labelKey: 'oauth.scope.atlas:write.label',         descriptionKey: 'oauth.scope.atlas:write.description',         groupKey: 'oauth.scope.group.atlas' },
+  'packing:read':        { labelKey: 'oauth.scope.packing:read.label',        descriptionKey: 'oauth.scope.packing:read.description',        groupKey: 'oauth.scope.group.packing' },
+  'packing:write':       { labelKey: 'oauth.scope.packing:write.label',       descriptionKey: 'oauth.scope.packing:write.description',       groupKey: 'oauth.scope.group.packing' },
+  'todos:read':          { labelKey: 'oauth.scope.todos:read.label',          descriptionKey: 'oauth.scope.todos:read.description',          groupKey: 'oauth.scope.group.todos' },
+  'todos:write':         { labelKey: 'oauth.scope.todos:write.label',         descriptionKey: 'oauth.scope.todos:write.description',         groupKey: 'oauth.scope.group.todos' },
+  'budget:read':         { labelKey: 'oauth.scope.budget:read.label',         descriptionKey: 'oauth.scope.budget:read.description',         groupKey: 'oauth.scope.group.budget' },
+  'budget:write':        { labelKey: 'oauth.scope.budget:write.label',        descriptionKey: 'oauth.scope.budget:write.description',        groupKey: 'oauth.scope.group.budget' },
+  'reservations:read':   { labelKey: 'oauth.scope.reservations:read.label',   descriptionKey: 'oauth.scope.reservations:read.description',   groupKey: 'oauth.scope.group.reservations' },
+  'reservations:write':  { labelKey: 'oauth.scope.reservations:write.label',  descriptionKey: 'oauth.scope.reservations:write.description',  groupKey: 'oauth.scope.group.reservations' },
+  'collab:read':         { labelKey: 'oauth.scope.collab:read.label',         descriptionKey: 'oauth.scope.collab:read.description',         groupKey: 'oauth.scope.group.collab' },
+  'collab:write':        { labelKey: 'oauth.scope.collab:write.label',        descriptionKey: 'oauth.scope.collab:write.description',        groupKey: 'oauth.scope.group.collab' },
+  'notifications:read':  { labelKey: 'oauth.scope.notifications:read.label',  descriptionKey: 'oauth.scope.notifications:read.description',  groupKey: 'oauth.scope.group.notifications' },
+  'notifications:write': { labelKey: 'oauth.scope.notifications:write.label', descriptionKey: 'oauth.scope.notifications:write.description', groupKey: 'oauth.scope.group.notifications' },
+  'vacay:read':          { labelKey: 'oauth.scope.vacay:read.label',          descriptionKey: 'oauth.scope.vacay:read.description',          groupKey: 'oauth.scope.group.vacay' },
+  'vacay:write':         { labelKey: 'oauth.scope.vacay:write.label',         descriptionKey: 'oauth.scope.vacay:write.description',         groupKey: 'oauth.scope.group.vacay' },
+  'geo:read':            { labelKey: 'oauth.scope.geo:read.label',            descriptionKey: 'oauth.scope.geo:read.description',            groupKey: 'oauth.scope.group.geo' },
+  'weather:read':        { labelKey: 'oauth.scope.weather:read.label',        descriptionKey: 'oauth.scope.weather:read.description',        groupKey: 'oauth.scope.group.weather' },
+}
+
+export const ALL_SCOPES = Object.keys(SCOPE_GROUPS)
+
+// Group all scopes for the client registration form
+export const SCOPE_GROUP_NAMES = [...new Set(Object.values(SCOPE_GROUPS).map(s => s.groupKey))]
+
+export function getScopesByGroup(t: (key: string) => string): Record<string, Array<{ scope: string } & ScopeInfo>> {
+  const groups: Record<string, Array<{ scope: string } & ScopeInfo>> = {}
+  for (const [scope, keys] of Object.entries(SCOPE_GROUPS)) {
+    const group = t(keys.groupKey)
+    if (!groups[group]) groups[group] = []
+    groups[group].push({ scope, label: t(keys.labelKey), description: t(keys.descriptionKey), group })
+  }
+  return groups
+}
@@ -1,4 +1,4 @@
-// FE-ADMIN-MCP-001 to FE-ADMIN-MCP-010
+// FE-ADMIN-MCP-001 to FE-ADMIN-MCP-016
 import { render, screen, waitFor } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
@@ -197,4 +197,127 @@ describe('AdminMcpTokensPanel', () => {
    render(<><ToastContainer /><AdminMcpTokensPanel /></>);
    await screen.findByText('Failed to load tokens');
  });
+
+  it('FE-ADMIN-MCP-011: OAuth sessions loading spinner shown on mount', async () => {
+    server.use(
+      http.get('/api/admin/oauth-sessions', async () => {
+        await new Promise(resolve => setTimeout(resolve, 200));
+        return HttpResponse.json({ sessions: [] });
+      })
+    );
+    render(<AdminMcpTokensPanel />);
+    expect(document.querySelector('.animate-spin')).toBeInTheDocument();
+  });
+
+  it('FE-ADMIN-MCP-012: OAuth sessions empty state rendered when no sessions', async () => {
+    server.use(
+      http.get('/api/admin/oauth-sessions', () =>
+        HttpResponse.json({ sessions: [] })
+      )
+    );
+    render(<AdminMcpTokensPanel />);
+    await screen.findByText('No active OAuth sessions');
+  });
+
+  it('FE-ADMIN-MCP-013: OAuth sessions list renders with scopes', async () => {
+    server.use(
+      http.get('/api/admin/oauth-sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            {
+              id: 1,
+              client_name: 'Claude Desktop',
+              username: 'alice',
+              scopes: ['trips:read', 'budget:read'],
+              created_at: '2025-01-01T00:00:00Z',
+            },
+          ],
+        })
+      )
+    );
+    render(<AdminMcpTokensPanel />);
+    await screen.findByText('Claude Desktop');
+    expect(screen.getByText('alice')).toBeInTheDocument();
+    expect(screen.getByText('trips:read')).toBeInTheDocument();
+  });
+
+  it('FE-ADMIN-MCP-014: scope expand/collapse toggle shows hidden scopes', async () => {
+    const user = userEvent.setup();
+    // 7 scopes — more than SCOPES_PREVIEW=6, so "+1 more" button appears
+    const scopes = ['trips:read', 'trips:write', 'places:read', 'places:write', 'budget:read', 'budget:write', 'packing:read'];
+    server.use(
+      http.get('/api/admin/oauth-sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            { id: 1, client_name: 'App', username: 'bob', scopes, created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      )
+    );
+    render(<AdminMcpTokensPanel />);
+    await screen.findByText('App');
+    // "+1 more" button should appear
+    const moreBtn = await screen.findByText(/\+1 more/);
+    expect(moreBtn).toBeInTheDocument();
+    await user.click(moreBtn);
+    // After expand, "show less" appears
+    expect(await screen.findByText('show less')).toBeInTheDocument();
+  });
+
+  it('FE-ADMIN-MCP-015: revoke session confirmation and successful revoke', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.get('/api/admin/oauth-sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            { id: 5, client_name: 'Revoke Me', username: 'carol', scopes: ['trips:read'], created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      ),
+      http.delete('/api/admin/oauth-sessions/5', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+    render(<><ToastContainer /><AdminMcpTokensPanel /></>);
+    await screen.findByText('Revoke Me');
+
+    // Click the revoke (trash) button next to the session
+    const deleteBtn = screen.getAllByTitle('Delete')[0];
+    await user.click(deleteBtn);
+
+    // Confirmation modal opens
+    expect(screen.getByText('Revoke Session')).toBeInTheDocument();
+    // Confirm — find the modal's Delete button (has no title, unlike the trash icon)
+    const deleteBtns = screen.getAllByRole('button', { name: 'Delete' });
+    const confirmBtn = deleteBtns.find(b => !b.title);
+    await user.click(confirmBtn ?? deleteBtns[deleteBtns.length - 1]);
+    await waitFor(() => {
+      expect(screen.queryByText('Revoke Me')).not.toBeInTheDocument();
+    });
+  });
+
+  it('FE-ADMIN-MCP-016: revoke session error shows toast', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.get('/api/admin/oauth-sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            { id: 6, client_name: 'Error Session', username: 'dave', scopes: ['trips:read'], created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      ),
+      http.delete('/api/admin/oauth-sessions/6', () =>
+        HttpResponse.json({ error: 'forbidden' }, { status: 403 })
+      )
+    );
+    render(<><ToastContainer /><AdminMcpTokensPanel /></>);
+    await screen.findByText('Error Session');
+
+    const deleteBtn = screen.getAllByTitle('Delete')[0];
+    await user.click(deleteBtn);
+    const deleteBtns = screen.getAllByRole('button', { name: 'Delete' });
+    const confirmBtn = deleteBtns.find(b => !b.title);
+    await user.click(confirmBtn ?? deleteBtns[deleteBtns.length - 1]);
+    await screen.findByText('Failed to revoke session');
+  });
 });
@@ -1,9 +1,21 @@
 import { useState, useEffect } from 'react'
 import { adminApi } from '../../api/client'
 import { useToast } from '../shared/Toast'
-import { Key, Trash2, User, Loader2 } from 'lucide-react'
+import { Key, Trash2, User, Loader2, Shield } from 'lucide-react'
 import { useTranslation } from '../../i18n'

+interface AdminOAuthSession {
+  id: number
+  client_id: string
+  client_name: string
+  user_id: number
+  username: string
+  scopes: string[]
+  access_token_expires_at: string
+  refresh_token_expires_at: string
+  created_at: string
+}
+
 interface AdminMcpToken {
  id: number
  name: string
@@ -14,21 +26,49 @@ interface AdminMcpToken {
  username: string
 }

+const SCOPES_PREVIEW = 6
+
 export default function AdminMcpTokensPanel() {
+  const [sessions, setSessions] = useState<AdminOAuthSession[]>([])
+  const [sessionsLoading, setSessionsLoading] = useState(true)
  const [tokens, setTokens] = useState<AdminMcpToken[]>([])
-  const [isLoading, setIsLoading] = useState(true)
+  const [tokensLoading, setTokensLoading] = useState(true)
+  const [expandedScopes, setExpandedScopes] = useState<Set<number>>(new Set())
+  const [revokeConfirmId, setRevokeConfirmId] = useState<number | null>(null)
  const [deleteConfirmId, setDeleteConfirmId] = useState<number | null>(null)
+
+  const toggleScopes = (id: number) =>
+    setExpandedScopes(prev => {
+      const next = new Set(prev)
+      next.has(id) ? next.delete(id) : next.add(id)
+      return next
+    })
  const toast = useToast()
  const { t, locale } = useTranslation()

  useEffect(() => {
-    setIsLoading(true)
+    adminApi.oauthSessions()
+      .then(d => setSessions(d.sessions || []))
+      .catch(() => toast.error(t('admin.oauthSessions.loadError')))
+      .finally(() => setSessionsLoading(false))
+
    adminApi.mcpTokens()
      .then(d => setTokens(d.tokens || []))
      .catch(() => toast.error(t('admin.mcpTokens.loadError')))
-      .finally(() => setIsLoading(false))
+      .finally(() => setTokensLoading(false))
  }, [])

+  const handleRevoke = async (id: number) => {
+    try {
+      await adminApi.revokeOAuthSession(id)
+      setSessions(prev => prev.filter(s => s.id !== id))
+      setRevokeConfirmId(null)
+      toast.success(t('admin.oauthSessions.revokeSuccess'))
+    } catch {
+      toast.error(t('admin.oauthSessions.revokeError'))
+    }
+  }
+
  const handleDelete = async (id: number) => {
    try {
      await adminApi.deleteMcpToken(id)
@@ -47,55 +87,156 @@ export default function AdminMcpTokensPanel() {
        <p className="text-sm mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{t('admin.mcpTokens.subtitle')}</p>
      </div>

-      <div className="rounded-xl border overflow-hidden" style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}>
-        {isLoading ? (
-          <div className="flex items-center justify-center py-12">
-            <Loader2 className="w-5 h-5 animate-spin" style={{ color: 'var(--text-tertiary)' }} />
-          </div>
-        ) : tokens.length === 0 ? (
-          <div className="flex flex-col items-center justify-center py-12 gap-2">
-            <Key className="w-8 h-8" style={{ color: 'var(--text-tertiary)' }} />
-            <p className="text-sm" style={{ color: 'var(--text-tertiary)' }}>{t('admin.mcpTokens.empty')}</p>
-          </div>
-        ) : (
-          <>
-            <div className="grid grid-cols-[1fr_auto_auto_auto_auto] gap-x-4 px-4 py-2.5 text-xs font-medium border-b"
-              style={{ color: 'var(--text-tertiary)', borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)' }}>
-              <span>{t('admin.mcpTokens.tokenName')}</span>
-              <span>{t('admin.mcpTokens.owner')}</span>
-              <span className="text-right">{t('admin.mcpTokens.created')}</span>
-              <span className="text-right">{t('admin.mcpTokens.lastUsed')}</span>
-              <span></span>
+      {/* OAuth Sessions */}
+      <div>
+        <h3 className="text-sm font-semibold mb-2" style={{ color: 'var(--text-secondary)' }}>{t('admin.oauthSessions.sectionTitle')}</h3>
+        <div className="rounded-xl border overflow-hidden" style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}>
+          {sessionsLoading ? (
+            <div className="flex items-center justify-center py-12">
+              <Loader2 className="w-5 h-5 animate-spin" style={{ color: 'var(--text-tertiary)' }} />
            </div>
-            {tokens.map((token, i) => (
-              <div key={token.id}
-                className="grid grid-cols-[1fr_auto_auto_auto_auto] items-center gap-x-4 px-4 py-3"
-                style={{ borderBottom: i < tokens.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
-                <div className="min-w-0">
-                  <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{token.name}</p>
-                  <p className="text-xs font-mono mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{token.token_prefix}...</p>
-                </div>
-                <div className="flex items-center gap-1.5 text-sm" style={{ color: 'var(--text-secondary)' }}>
-                  <User className="w-3.5 h-3.5 flex-shrink-0" />
-                  <span className="whitespace-nowrap">{token.username}</span>
-                </div>
-                <span className="text-xs whitespace-nowrap text-right" style={{ color: 'var(--text-tertiary)' }}>
-                  {new Date(token.created_at).toLocaleDateString(locale)}
-                </span>
-                <span className="text-xs whitespace-nowrap text-right" style={{ color: 'var(--text-tertiary)' }}>
-                  {token.last_used_at ? new Date(token.last_used_at).toLocaleDateString(locale) : t('admin.mcpTokens.never')}
-                </span>
-                <button onClick={() => setDeleteConfirmId(token.id)}
-                  className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
-                  style={{ color: 'var(--text-tertiary)' }} title={t('common.delete')}>
-                  <Trash2 className="w-4 h-4" />
-                </button>
+          ) : sessions.length === 0 ? (
+            <div className="flex flex-col items-center justify-center py-12 gap-2">
+              <Shield className="w-8 h-8" style={{ color: 'var(--text-tertiary)' }} />
+              <p className="text-sm" style={{ color: 'var(--text-tertiary)' }}>{t('admin.oauthSessions.empty')}</p>
+            </div>
+          ) : (
+            <>
+              <div className="grid grid-cols-[1fr_auto_auto_auto] gap-x-6 px-4 py-2.5 text-xs font-medium border-b"
+                style={{ color: 'var(--text-tertiary)', borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)' }}>
+                <span>{t('admin.oauthSessions.clientName')}</span>
+                <span>{t('admin.oauthSessions.owner')}</span>
+                <span className="text-right">{t('admin.oauthSessions.created')}</span>
+                <span></span>
              </div>
-            ))}
-          </>
-        )}
+              {sessions.map((session, i) => {
+                const expanded = expandedScopes.has(session.id)
+                const visible = expanded ? session.scopes : session.scopes.slice(0, SCOPES_PREVIEW)
+                const hidden = session.scopes.length - SCOPES_PREVIEW
+                return (
+                  <div key={session.id}
+                    className="grid grid-cols-[1fr_auto_auto_auto] items-start gap-x-6 px-4 py-3"
+                    style={{ borderBottom: i < sessions.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
+                    <div className="min-w-0">
+                      <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{session.client_name}</p>
+                      <div className="flex flex-wrap gap-1 mt-1.5">
+                        {visible.map(scope => (
+                          <span key={scope} className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-mono"
+                            style={{ background: 'var(--bg-secondary)', color: 'var(--text-tertiary)', border: '1px solid var(--border-primary)' }}>
+                            {scope}
+                          </span>
+                        ))}
+                        {!expanded && hidden > 0 && (
+                          <button onClick={() => toggleScopes(session.id)}
+                            className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium transition-colors hover:opacity-80"
+                            style={{ background: 'var(--bg-secondary)', color: 'var(--text-secondary)', border: '1px solid var(--border-primary)' }}>
+                            +{hidden} more
+                          </button>
+                        )}
+                        {expanded && hidden > 0 && (
+                          <button onClick={() => toggleScopes(session.id)}
+                            className="inline-flex items-center px-1.5 py-0.5 rounded text-xs font-medium transition-colors hover:opacity-80"
+                            style={{ background: 'var(--bg-secondary)', color: 'var(--text-secondary)', border: '1px solid var(--border-primary)' }}>
+                            show less
+                          </button>
+                        )}
+                      </div>
+                    </div>
+                    <div className="flex items-center gap-1.5 text-sm pt-0.5" style={{ color: 'var(--text-secondary)' }}>
+                      <User className="w-3.5 h-3.5 flex-shrink-0" />
+                      <span className="whitespace-nowrap">{session.username}</span>
+                    </div>
+                    <span className="text-xs whitespace-nowrap text-right pt-0.5" style={{ color: 'var(--text-tertiary)' }}>
+                      {new Date(session.created_at).toLocaleDateString(locale)}
+                    </span>
+                    <button onClick={() => setRevokeConfirmId(session.id)}
+                      className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
+                      style={{ color: 'var(--text-tertiary)' }} title={t('common.delete')}>
+                      <Trash2 className="w-4 h-4" />
+                    </button>
+                  </div>
+                )
+              })}
+            </>
+          )}
+        </div>
      </div>

+      {/* MCP Tokens */}
+      <div>
+        <h3 className="text-sm font-semibold mb-2" style={{ color: 'var(--text-secondary)' }}>{t('admin.mcpTokens.sectionTitle')}</h3>
+        <div className="rounded-xl border overflow-hidden" style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-card)' }}>
+          {tokensLoading ? (
+            <div className="flex items-center justify-center py-12">
+              <Loader2 className="w-5 h-5 animate-spin" style={{ color: 'var(--text-tertiary)' }} />
+            </div>
+          ) : tokens.length === 0 ? (
+            <div className="flex flex-col items-center justify-center py-12 gap-2">
+              <Key className="w-8 h-8" style={{ color: 'var(--text-tertiary)' }} />
+              <p className="text-sm" style={{ color: 'var(--text-tertiary)' }}>{t('admin.mcpTokens.empty')}</p>
+            </div>
+          ) : (
+            <>
+              <div className="grid grid-cols-[1fr_auto_auto_auto_auto] gap-x-4 px-4 py-2.5 text-xs font-medium border-b"
+                style={{ color: 'var(--text-tertiary)', borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)' }}>
+                <span>{t('admin.mcpTokens.tokenName')}</span>
+                <span>{t('admin.mcpTokens.owner')}</span>
+                <span className="text-right">{t('admin.mcpTokens.created')}</span>
+                <span className="text-right">{t('admin.mcpTokens.lastUsed')}</span>
+                <span></span>
+              </div>
+              {tokens.map((token, i) => (
+                <div key={token.id}
+                  className="grid grid-cols-[1fr_auto_auto_auto_auto] items-center gap-x-4 px-4 py-3"
+                  style={{ borderBottom: i < tokens.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
+                  <div className="min-w-0">
+                    <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{token.name}</p>
+                    <p className="text-xs font-mono mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{token.token_prefix}...</p>
+                  </div>
+                  <div className="flex items-center gap-1.5 text-sm" style={{ color: 'var(--text-secondary)' }}>
+                    <User className="w-3.5 h-3.5 flex-shrink-0" />
+                    <span className="whitespace-nowrap">{token.username}</span>
+                  </div>
+                  <span className="text-xs whitespace-nowrap text-right" style={{ color: 'var(--text-tertiary)' }}>
+                    {new Date(token.created_at).toLocaleDateString(locale)}
+                  </span>
+                  <span className="text-xs whitespace-nowrap text-right" style={{ color: 'var(--text-tertiary)' }}>
+                    {token.last_used_at ? new Date(token.last_used_at).toLocaleDateString(locale) : t('admin.mcpTokens.never')}
+                  </span>
+                  <button onClick={() => setDeleteConfirmId(token.id)}
+                    className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
+                    style={{ color: 'var(--text-tertiary)' }} title={t('common.delete')}>
+                    <Trash2 className="w-4 h-4" />
+                  </button>
+                </div>
+              ))}
+            </>
+          )}
+        </div>
+      </div>
+
+      {/* Revoke OAuth session modal */}
+      {revokeConfirmId !== null && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
+          onClick={e => { if (e.target === e.currentTarget) setRevokeConfirmId(null) }}>
+          <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4" style={{ background: 'var(--bg-card)' }}>
+            <h3 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('admin.oauthSessions.revokeTitle')}</h3>
+            <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('admin.oauthSessions.revokeMessage')}</p>
+            <div className="flex gap-2 justify-end">
+              <button onClick={() => setRevokeConfirmId(null)}
+                className="px-4 py-2 rounded-lg text-sm border" style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                {t('common.cancel')}
+              </button>
+              <button onClick={() => handleRevoke(revokeConfirmId)}
+                className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
+                {t('common.delete')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      {/* Delete MCP token modal */}
      {deleteConfirmId !== null && (
        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
          onClick={e => { if (e.target === e.currentTarget) setDeleteConfirmId(null) }}>
@@ -1,4 +1,4 @@
-// FE-COMP-BUDGET-001 to FE-COMP-BUDGET-020
+// FE-COMP-BUDGET-001 to FE-COMP-BUDGET-040
 import { render, screen, waitFor } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
@@ -6,6 +6,7 @@ import { server } from '../../../tests/helpers/msw/server';
 import { useAuthStore } from '../../store/authStore';
 import { useTripStore } from '../../store/tripStore';
 import { useSettingsStore } from '../../store/settingsStore';
+import { usePermissionsStore } from '../../store/permissionsStore';
 import { resetAllStores, seedStore } from '../../../tests/helpers/store';
 import { buildUser, buildTrip, buildBudgetItem, buildSettings } from '../../../tests/helpers/factories';
 import BudgetPanel from './BudgetPanel';
@@ -418,4 +419,80 @@ describe('BudgetPanel', () => {
    // Grand total card shows 300.00
    expect(screen.getByText('300.00')).toBeInTheDocument();
  });
+
+  it('FE-COMP-BUDGET-033: read-only mode hides add/delete/edit controls', async () => {
+    // Restrict budget_edit to trip owners only; user is not the owner (owner_id=1, user.id > 1)
+    seedStore(usePermissionsStore, { permissions: { budget_edit: 'trip_owner' } });
+    // Use a user with id != 1 so they're not the owner
+    seedStore(useAuthStore, { user: buildUser(), isAuthenticated: true });
+    seedStore(useTripStore, { trip: buildTrip({ id: 1, owner_id: 9999 }) });
+    const item = { ...buildBudgetItem({ trip_id: 1, category: 'Food', name: 'Read Only Item' }), total_price: 50 };
+    server.use(
+      http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
+    );
+    render(<BudgetPanel tripId={1} />);
+    await screen.findByText('Read Only Item');
+    // In read-only mode the Delete button should not be visible
+    expect(screen.queryByTitle('Delete')).not.toBeInTheDocument();
+  });
+
+  it('FE-COMP-BUDGET-034: read-only mode shows expense_date as text span', async () => {
+    seedStore(usePermissionsStore, { permissions: { budget_edit: 'trip_owner' } });
+    seedStore(useAuthStore, { user: buildUser(), isAuthenticated: true });
+    seedStore(useTripStore, { trip: buildTrip({ id: 1, owner_id: 9999 }) });
+    const item = { ...buildBudgetItem({ trip_id: 1, category: 'Transport', name: 'Train' }), total_price: 30, expense_date: '2025-06-15' };
+    server.use(
+      http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
+    );
+    render(<BudgetPanel tripId={1} />);
+    await screen.findByText('Train');
+    // expense_date is rendered as plain text in read-only mode
+    await screen.findByText('2025-06-15');
+  });
+
+  it('FE-COMP-BUDGET-035: settlement section with avatar renders user avatar image', async () => {
+    const user = userEvent.setup();
+    const item = { ...buildBudgetItem({ trip_id: 1, category: 'Food', name: 'Lunch' }), total_price: 60 };
+    server.use(
+      http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] })),
+      http.get('/api/trips/1/budget/settlement', () =>
+        HttpResponse.json({
+          balances: [
+            { user_id: 1, username: 'alice', avatar_url: '/uploads/avatars/alice.jpg', balance: -30 },
+            { user_id: 2, username: 'bob', avatar_url: null, balance: 30 },
+          ],
+          flows: [{ from: { username: 'alice', avatar_url: '/uploads/avatars/alice.jpg' }, to: { username: 'bob', avatar_url: null }, amount: 30 }]
+        })
+      ),
+      http.get('/api/trips/1/budget/per-person', () => HttpResponse.json({ summary: [] })),
+    );
+    const tripMembers = [
+      { id: 1, username: 'alice', avatar_url: '/uploads/avatars/alice.jpg' },
+      { id: 2, username: 'bob', avatar_url: null },
+    ];
+    render(<BudgetPanel tripId={1} tripMembers={tripMembers} />);
+    await screen.findByText('Lunch');
+    // Trigger settlement display
+    const settlementBtn = await screen.findByRole('button', { name: /settlement/i });
+    await user.click(settlementBtn);
+    await screen.findByText('alice');
+    // Avatar image should be rendered for alice
+    const avatarImg = screen.getAllByRole('img');
+    expect(avatarImg.length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-BUDGET-036: expense_date shows dash when not set in read-only mode', async () => {
+    seedStore(usePermissionsStore, { permissions: { budget_edit: 'trip_owner' } });
+    seedStore(useAuthStore, { user: buildUser(), isAuthenticated: true });
+    seedStore(useTripStore, { trip: buildTrip({ id: 1, owner_id: 9999 }) });
+    const item = { ...buildBudgetItem({ trip_id: 1, category: 'Food', name: 'Snack' }), total_price: 5, expense_date: null };
+    server.use(
+      http.get('/api/trips/1/budget', () => HttpResponse.json({ items: [item] }))
+    );
+    render(<BudgetPanel tripId={1} />);
+    await screen.findByText('Snack');
+    // When expense_date is null, the fallback '—' is shown
+    const dashes = screen.getAllByText('—');
+    expect(dashes.length).toBeGreaterThan(0);
+  });
 });
@@ -370,6 +370,11 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
  const [showEmoji, setShowEmoji] = useState(false)
  const [reactMenu, setReactMenu] = useState(null) // { msgId, x, y }
  const [deletingIds, setDeletingIds] = useState(new Set())
+  const deleteTimersRef = useRef<ReturnType<typeof setTimeout>[]>([])
+
+  useEffect(() => {
+    return () => { deleteTimersRef.current.forEach(clearTimeout) }
+  }, [])

  const containerRef = useRef(null)
  const messagesRef = useRef(messages)
@@ -483,13 +488,14 @@ export default function CollabChat({ tripId, currentUser }: CollabChatProps) {
    requestAnimationFrame(() => {
      setDeletingIds(prev => new Set(prev).add(msgId))
    })
-    setTimeout(async () => {
+    const t = setTimeout(async () => {
      try {
        await collabApi.deleteMessage(tripId, msgId)
        setMessages(prev => prev.map(m => m.id === msgId ? { ...m, _deleted: true } : m))
      } catch {}
      setDeletingIds(prev => { const s = new Set(prev); s.delete(msgId); return s })
    }, 400)
+    deleteTimersRef.current.push(t)
  }, [tripId])

  const handleReact = useCallback(async (msgId, emoji) => {
@@ -16,12 +16,13 @@ function formatTime(timeStr, is12h) {
 }

 function formatDayLabel(date, t, locale) {
-  const d = new Date(date + 'T00:00:00')
  const now = new Date()
-  const tomorrow = new Date(); tomorrow.setDate(now.getDate() + 1)
+  const nowDate = now.toISOString().split('T')[0]
+  const tomorrowUtc = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1))
+  const tomorrowDate = tomorrowUtc.toISOString().split('T')[0]

-  if (d.toDateString() === now.toDateString()) return t('collab.whatsNext.today') || 'Today'
-  if (d.toDateString() === tomorrow.toDateString()) return t('collab.whatsNext.tomorrow') || 'Tomorrow'
+  if (date === nowDate) return t('collab.whatsNext.today') || 'Today'
+  if (date === tomorrowDate) return t('collab.whatsNext.tomorrow') || 'Tomorrow'

  return new Date(date + 'T00:00:00Z').toLocaleDateString(locale || undefined, { weekday: 'short', day: 'numeric', month: 'short', timeZone: 'UTC' })
 }
@@ -714,6 +714,23 @@ export default function MemoriesPanel({ tripId, startDate, endDate }: MemoriesPa
  return (
    <div style={{ display: 'flex', flexDirection: 'column', height: '100%', ...font }}>

+      {/* Disconnected banner — shown when photos exist but provider is unreachable */}
+      {!connected && allVisible.length > 0 && enabledProviders.length > 0 && (
+        <div style={{
+          display: 'flex', alignItems: 'center', gap: 8,
+          padding: '8px 16px', flexShrink: 0,
+          background: 'rgba(234,179,8,0.08)', borderBottom: '1px solid rgba(234,179,8,0.25)',
+          fontSize: 12, color: 'var(--text-muted)',
+        }}>
+          <Camera size={13} style={{ color: '#ca8a04', flexShrink: 0 }} />
+          <span>
+            {t('memories.providerDisconnectedBanner', {
+              provider_name: enabledProviders.length === 1 ? enabledProviders[0].name : enabledProviders.map(p => p.name).join(', ')
+            })}
+          </span>
+        </div>
+      )}
+
      {/* Header */}
      <div style={{ padding: '16px 20px', borderBottom: '1px solid var(--border-secondary)', flexShrink: 0 }}>
        <div style={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between' }}>
@@ -1,4 +1,4 @@
-// FE-COMP-NOTIF-001 to FE-COMP-NOTIF-010
+// FE-COMP-NOTIF-001 to FE-COMP-NOTIF-016
 import { render, screen, waitFor } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { useAuthStore } from '../../store/authStore';
@@ -99,4 +99,109 @@ describe('InAppNotificationItem', () => {
    // Recent notification shows "just now"
    expect(screen.getByText('just now')).toBeInTheDocument();
  });
+
+  it('FE-COMP-NOTIF-011: shows avatar image when sender_avatar is provided', () => {
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({ sender_avatar: 'https://example.com/avatar.png' })}
+      />
+    );
+    expect(document.querySelector('img')).toBeInTheDocument();
+    expect(document.querySelector('img')?.getAttribute('src')).toBe('https://example.com/avatar.png');
+  });
+
+  it('FE-COMP-NOTIF-012: boolean notification shows Accept and Reject buttons', () => {
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({
+          type: 'boolean',
+          positive_text_key: 'common.yes',
+          negative_text_key: 'common.no',
+        })}
+      />
+    );
+    expect(screen.getByText('Yes')).toBeInTheDocument();
+    expect(screen.getByText('No')).toBeInTheDocument();
+  });
+
+  it('FE-COMP-NOTIF-013: clicking Accept calls respondToBoolean with positive', async () => {
+    const user = userEvent.setup();
+    const respondToBoolean = vi.fn().mockResolvedValue(undefined);
+    seedStore(useInAppNotificationStore, { respondToBoolean });
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({
+          id: 55,
+          type: 'boolean',
+          positive_text_key: 'common.yes',
+          negative_text_key: 'common.no',
+          response: null,
+        })}
+      />
+    );
+    await user.click(screen.getByText('Yes'));
+    expect(respondToBoolean).toHaveBeenCalledWith(55, 'positive');
+  });
+
+  it('FE-COMP-NOTIF-014: clicking Reject calls respondToBoolean with negative', async () => {
+    const user = userEvent.setup();
+    const respondToBoolean = vi.fn().mockResolvedValue(undefined);
+    seedStore(useInAppNotificationStore, { respondToBoolean });
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({
+          id: 66,
+          type: 'boolean',
+          positive_text_key: 'common.yes',
+          negative_text_key: 'common.no',
+          response: null,
+        })}
+      />
+    );
+    await user.click(screen.getByText('No'));
+    expect(respondToBoolean).toHaveBeenCalledWith(66, 'negative');
+  });
+
+  it('FE-COMP-NOTIF-015: navigate notification shows action button', () => {
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({
+          type: 'navigate',
+          navigate_text_key: 'notifications.title',
+          navigate_target: '/trips/1',
+        })}
+      />
+    );
+    // t('notifications.title') = "Notifications" — the navigate button renders this
+    const navigateBtn = document.querySelector('button[style*="pointer"]') ??
+      Array.from(document.querySelectorAll('button')).find(b => b.textContent?.includes('Notifications'));
+    expect(navigateBtn).toBeInTheDocument();
+  });
+
+  it('FE-COMP-NOTIF-016: clicking navigate button marks read and navigates', async () => {
+    const user = userEvent.setup();
+    const markRead = vi.fn().mockResolvedValue(undefined);
+    const onClose = vi.fn();
+    seedStore(useInAppNotificationStore, { markRead });
+    render(
+      <InAppNotificationItem
+        notification={buildNotification({
+          id: 77,
+          type: 'navigate',
+          navigate_text_key: 'notifications.title',
+          navigate_target: '/trips/1',
+          is_read: 0,
+        })}
+        onClose={onClose}
+      />
+    );
+    // The navigate button renders t('notifications.title') = "Notifications"
+    const btn = Array.from(document.querySelectorAll('button')).find(
+      b => b.textContent?.includes('Notifications')
+    );
+    expect(btn).toBeTruthy();
+    await user.click(btn!);
+    expect(markRead).toHaveBeenCalledWith(77);
+    expect(onClose).toHaveBeenCalled();
+  });
 });
@@ -0,0 +1,119 @@
+// FE-COMP-SCOPE-001 to FE-COMP-SCOPE-009
+import { render, screen, waitFor } from '../../../tests/helpers/render';
+import userEvent from '@testing-library/user-event';
+import { resetAllStores } from '../../../tests/helpers/store';
+import ScopeGroupPicker from './ScopeGroupPicker';
+
+beforeEach(() => {
+  resetAllStores();
+});
+
+describe('ScopeGroupPicker', () => {
+  it('FE-COMP-SCOPE-001: renders scope groups', () => {
+    render(<ScopeGroupPicker selected={[]} onChange={vi.fn()} />);
+    // Several group headers should be visible
+    expect(screen.getAllByRole('button').length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-SCOPE-002: shows Select All button when nothing selected', () => {
+    render(<ScopeGroupPicker selected={[]} onChange={vi.fn()} />);
+    expect(screen.getByRole('button', { name: /select all/i })).toBeInTheDocument();
+  });
+
+  it('FE-COMP-SCOPE-003: Select All calls onChange with all scopes', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(<ScopeGroupPicker selected={[]} onChange={onChange} />);
+    await user.click(screen.getByRole('button', { name: /select all/i }));
+    expect(onChange).toHaveBeenCalledTimes(1);
+    const called = onChange.mock.calls[0][0] as string[];
+    expect(called.length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-SCOPE-004: shows Deselect All button when all selected', async () => {
+    // First collect all scopes by clicking Select All and capturing the callback
+    const user = userEvent.setup();
+    const captured: string[][] = [];
+    const { rerender } = render(
+      <ScopeGroupPicker selected={[]} onChange={s => captured.push(s)} />
+    );
+    await user.click(screen.getByRole('button', { name: /select all/i }));
+    const allScopes = captured[0];
+
+    // Now rerender with all scopes selected
+    rerender(<ScopeGroupPicker selected={allScopes} onChange={vi.fn()} />);
+    expect(screen.getByRole('button', { name: /deselect all/i })).toBeInTheDocument();
+  });
+
+  it('FE-COMP-SCOPE-005: Deselect All calls onChange with empty array', async () => {
+    const user = userEvent.setup();
+    const captured: string[][] = [];
+
+    // Get all scopes first
+    const { rerender } = render(
+      <ScopeGroupPicker selected={[]} onChange={s => captured.push(s)} />
+    );
+    await user.click(screen.getByRole('button', { name: /select all/i }));
+    const allScopes = captured[0];
+
+    const onChange = vi.fn();
+    rerender(<ScopeGroupPicker selected={allScopes} onChange={onChange} />);
+    await user.click(screen.getByRole('button', { name: /deselect all/i }));
+    expect(onChange).toHaveBeenCalledWith([]);
+  });
+
+  it('FE-COMP-SCOPE-006: expanding a group reveals individual scope checkboxes', async () => {
+    const user = userEvent.setup();
+    render(<ScopeGroupPicker selected={[]} onChange={vi.fn()} />);
+
+    // Groups are collapsed by default — checkboxes for individual scopes not visible
+    const groupToggles = screen.getAllByRole('button').filter(b =>
+      !b.textContent?.toLowerCase().includes('select all') &&
+      !b.textContent?.toLowerCase().includes('deselect all')
+    );
+    // Click the first group expand button
+    await user.click(groupToggles[0]);
+    // Individual scope checkboxes should now appear (more than just group-level ones)
+    const checkboxes = screen.getAllByRole('checkbox');
+    expect(checkboxes.length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-SCOPE-007: group checkbox selects all scopes in the group', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(<ScopeGroupPicker selected={[]} onChange={onChange} />);
+
+    const groupCheckboxes = screen.getAllByRole('checkbox');
+    await user.click(groupCheckboxes[0]);
+    expect(onChange).toHaveBeenCalledTimes(1);
+    const called = onChange.mock.calls[0][0] as string[];
+    expect(called.length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-SCOPE-008: individual scope toggle adds/removes that scope', async () => {
+    const user = userEvent.setup();
+    const onChange = vi.fn();
+    render(<ScopeGroupPicker selected={[]} onChange={onChange} />);
+
+    // Expand first group
+    const groupToggles = screen.getAllByRole('button').filter(b =>
+      !b.textContent?.toLowerCase().includes('select all') &&
+      !b.textContent?.toLowerCase().includes('deselect all')
+    );
+    await user.click(groupToggles[0]);
+
+    // There are now individual scope checkboxes — click the second one (first is group-level)
+    const checkboxes = screen.getAllByRole('checkbox');
+    await user.click(checkboxes[1]); // individual scope
+    expect(onChange).toHaveBeenCalledTimes(1);
+  });
+
+  it('FE-COMP-SCOPE-009: count badge shown when some scopes selected in group', () => {
+    // Get any single scope key from the first group via Select All trick + manual slice
+    // We'll just select a scope by triggering group checkbox and passing it in
+    const firstGroupScope = 'trips:read'; // known scope from SCOPE_GROUPS
+    render(<ScopeGroupPicker selected={[firstGroupScope]} onChange={vi.fn()} />);
+    // Count badge like "(1/N)" should be visible
+    expect(screen.getByText(/\(\d+\/\d+\)/)).toBeInTheDocument();
+  });
+});
@@ -0,0 +1,96 @@
+import React, { useState } from 'react'
+import { ChevronDown, ChevronRight } from 'lucide-react'
+import { getScopesByGroup } from '../../api/oauthScopes'
+import { useTranslation } from '../../i18n'
+
+interface Props {
+  selected: string[]
+  onChange: (scopes: string[]) => void
+}
+
+export default function ScopeGroupPicker({ selected, onChange }: Props): React.ReactElement {
+  const { t } = useTranslation()
+  const [open, setOpen] = useState<Record<string, boolean>>({})
+
+  const scopesByGroup = getScopesByGroup(t)
+  const allScopeKeys = Object.values(scopesByGroup).flat().map(s => s.scope)
+  const allSelected  = allScopeKeys.every(s => selected.includes(s))
+
+  return (
+    <div className="space-y-1">
+      <div className="flex justify-end mb-2">
+        <button
+          type="button"
+          onClick={() => onChange(allSelected ? [] : allScopeKeys)}
+          className="text-xs px-2 py-0.5 rounded border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+          style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+          {allSelected ? t('settings.oauth.modal.deselectAll') : t('settings.oauth.modal.selectAll')}
+        </button>
+      </div>
+      <div className="space-y-1 max-h-96 overflow-y-auto pr-1">
+        {Object.entries(scopesByGroup).map(([group, groupScopes]) => {
+          const groupScopeKeys   = groupScopes.map(s => s.scope)
+          const allGroupSelected = groupScopeKeys.every(s => selected.includes(s))
+          const someGroupSelected = groupScopeKeys.some(s => selected.includes(s))
+          return (
+            <div key={group} className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+              <div className="flex items-center gap-1 px-3 py-2" style={{ background: 'var(--bg-secondary)' }}>
+                <button
+                  type="button"
+                  onClick={() => setOpen(prev => ({ ...prev, [group]: !prev[group] }))}
+                  className="flex items-center gap-1 flex-1 text-xs font-semibold hover:opacity-70 transition-opacity text-left"
+                  style={{ color: 'var(--text-secondary)' }}>
+                  {open[group]
+                    ? <ChevronDown className="w-3 h-3 flex-shrink-0" />
+                    : <ChevronRight className="w-3 h-3 flex-shrink-0" />}
+                  {group}
+                  {someGroupSelected && (
+                    <span className="ml-1.5 text-xs font-normal" style={{ color: 'var(--text-tertiary)' }}>
+                      ({groupScopeKeys.filter(s => selected.includes(s)).length}/{groupScopeKeys.length})
+                    </span>
+                  )}
+                </button>
+                <input
+                  type="checkbox"
+                  checked={allGroupSelected}
+                  ref={el => { if (el) el.indeterminate = someGroupSelected && !allGroupSelected }}
+                  onChange={e => onChange(
+                    e.target.checked
+                      ? [...new Set([...selected, ...groupScopeKeys])]
+                      : selected.filter(s => !groupScopeKeys.includes(s))
+                  )}
+                  className="rounded"
+                  title={allGroupSelected ? `Deselect all ${group}` : `Select all ${group}`}
+                />
+              </div>
+              {open[group] && (
+                <div className="divide-y" style={{ borderColor: 'var(--border-primary)' }}>
+                  {groupScopes.map(({ scope, label, description }) => (
+                    <label
+                      key={scope}
+                      className="flex items-start gap-2.5 px-3 py-2 cursor-pointer hover:bg-slate-50 dark:hover:bg-slate-800/50 transition-colors">
+                      <input
+                        type="checkbox"
+                        checked={selected.includes(scope)}
+                        onChange={e => onChange(
+                          e.target.checked
+                            ? [...selected, scope]
+                            : selected.filter(s => s !== scope)
+                        )}
+                        className="mt-0.5 rounded flex-shrink-0"
+                      />
+                      <div>
+                        <p className="text-xs font-medium" style={{ color: 'var(--text-primary)' }}>{label}</p>
+                        <p className="text-xs" style={{ color: 'var(--text-tertiary)' }}>{description}</p>
+                      </div>
+                    </label>
+                  ))}
+                </div>
+              )}
+            </div>
+          )
+        })}
+      </div>
+    </div>
+  )
+}
@@ -5,6 +5,7 @@ import { http, HttpResponse } from 'msw';
 import { useAuthStore } from '../../store/authStore';
 import { useTripStore } from '../../store/tripStore';
 import { usePermissionsStore } from '../../store/permissionsStore';
+import { placesApi } from '../../api/client';
 import { resetAllStores, seedStore } from '../../../tests/helpers/store';
 import { buildUser, buildTrip, buildPlace, buildCategory, buildDay, buildAssignment } from '../../../tests/helpers/factories';
 import { server } from '../../../tests/helpers/msw/server';
@@ -443,11 +444,8 @@ describe('GPX import', () => {
  });

  it('FE-PLANNER-SIDEBAR-039: successful GPX import shows success toast', async () => {
-    server.use(
-      http.post('/api/trips/1/places/import/gpx', () =>
-        HttpResponse.json({ count: 2, places: [{ id: 10 }, { id: 11 }] })
-      ),
-    );
+    // FormData POST hangs on CI — mock at the API boundary instead of MSW.
+    const importSpy = vi.spyOn(placesApi, 'importGpx').mockResolvedValueOnce({ count: 2, places: [{ id: 10 }, { id: 11 }] });
    const loadTrip = vi.fn().mockResolvedValue(undefined);
    seedStore(useTripStore, { loadTrip });
    const addToast = vi.fn();
@@ -465,6 +463,7 @@ describe('GPX import', () => {
        undefined,
      );
    });
+    importSpy.mockRestore();
  });
 });

@@ -1,4 +1,4 @@
-// FE-COMP-INTEGRATIONS-001 to FE-COMP-INTEGRATIONS-018
+// FE-COMP-INTEGRATIONS-001 to FE-COMP-INTEGRATIONS-032
 import { render, screen, waitFor } from '../../../tests/helpers/render';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
@@ -7,6 +7,7 @@ import { useAuthStore } from '../../store/authStore';
 import { useAddonStore } from '../../store/addonStore';
 import { resetAllStores, seedStore } from '../../../tests/helpers/store';
 import { buildUser } from '../../../tests/helpers/factories';
+import { ToastContainer } from '../shared/Toast';
 import IntegrationsTab from './IntegrationsTab';

 function enableMcp() {
@@ -40,6 +41,8 @@ beforeEach(() => {
  server.use(
    http.get('/api/auth/mcp-tokens', () => HttpResponse.json({ tokens: [] })),
    http.get('/api/addons', () => HttpResponse.json({ addons: [] })),
+    http.get('/api/oauth/clients', () => HttpResponse.json({ clients: [] })),
+    http.get('/api/oauth/sessions', () => HttpResponse.json({ sessions: [] })),
  );
 });

@@ -69,18 +72,26 @@ describe('IntegrationsTab', () => {
    expect(codeEl!.textContent).toContain('/mcp');
  });

-  it('FE-COMP-INTEGRATIONS-005: JSON config block is rendered', async () => {
+  it('FE-COMP-INTEGRATIONS-005: JSON config block is rendered when expanded', async () => {
+    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    // Config is collapsed by default — no <pre> yet
+    expect(document.querySelector('pre')).toBeNull();
+    // Expand by clicking the "Client Configuration" toggle
+    await user.click(screen.getByRole('button', { name: /Client Configuration/i }));
    const preEl = document.querySelector('pre');
    expect(preEl).not.toBeNull();
    expect(preEl!.textContent).toContain('mcpServers');
  });

  it('FE-COMP-INTEGRATIONS-006: "no tokens" message shown when token list is empty', async () => {
+    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await screen.findByText('No tokens yet. Create one to connect MCP clients.');
  });

@@ -95,8 +106,11 @@ describe('IntegrationsTab', () => {
        }),
      ),
    );
+    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await screen.findByText('My Token');
    await screen.findByText('Other Token');
  });
@@ -106,6 +120,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    const createBtn = screen.getByRole('button', { name: /Create New Token/i });
    await user.click(createBtn);
    await screen.findByText('Create API Token');
@@ -116,6 +131,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await user.click(screen.getByRole('button', { name: /Create New Token/i }));
    await screen.findByText('Create API Token');
    const modalCreateBtn = screen.getByRole('button', { name: /^Create Token$/i });
@@ -127,6 +143,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await user.click(screen.getByRole('button', { name: /Create New Token/i }));
    await screen.findByText('Create API Token');
    const input = screen.getByPlaceholderText(/Claude Desktop/i);
@@ -153,6 +170,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await user.click(screen.getByRole('button', { name: /Create New Token/i }));
    await screen.findByText('Create API Token');
    const input = screen.getByPlaceholderText(/Claude Desktop/i);
@@ -182,6 +200,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await user.click(screen.getByRole('button', { name: /Create New Token/i }));
    await screen.findByText('Create API Token');
    await user.type(screen.getByPlaceholderText(/Claude Desktop/i), 'test');
@@ -206,6 +225,8 @@ describe('IntegrationsTab', () => {
    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await screen.findByText('Delete Me');
    await user.click(screen.getByTitle('Delete Token'));
    await screen.findByText('This token will stop working immediately. Any MCP client using it will lose access.');
@@ -230,6 +251,8 @@ describe('IntegrationsTab', () => {
    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await screen.findByText('Delete Me');
    await user.click(screen.getByTitle('Delete Token'));
    // There are two "Delete Token" buttons: the trash icon (title) and the confirm button in modal
@@ -289,6 +312,8 @@ describe('IntegrationsTab', () => {
    const user = userEvent.setup();
    enableMcp();
    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await screen.findByText('Cancel Token');
    await user.click(screen.getByTitle('Delete Token'));
    await screen.findByRole('button', { name: /^Cancel$/i });
@@ -319,6 +344,7 @@ describe('IntegrationsTab', () => {
    enableMcp();
    render(<IntegrationsTab />);
    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
    await user.click(screen.getByRole('button', { name: /Create New Token/i }));
    await screen.findByText('Create API Token');
    const input = screen.getByPlaceholderText(/Claude Desktop/i);
@@ -328,4 +354,301 @@ describe('IntegrationsTab', () => {
      expect(postCalled).toBe(true);
    });
  });
+
+  it('FE-COMP-INTEGRATIONS-019: default tab is OAuth 2.1 Clients — OAuth hint visible, token list hidden', async () => {
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    // OAuth hint is visible on the default tab
+    expect(screen.getByText(/Register OAuth 2\.1 clients/i)).toBeInTheDocument();
+    // API Tokens "no tokens" message is not rendered
+    expect(screen.queryByText('No tokens yet. Create one to connect MCP clients.')).toBeNull();
+  });
+
+  it('FE-COMP-INTEGRATIONS-020: switching tabs toggles content visibility', async () => {
+    const user = userEvent.setup();
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    // Default: OAuth hint visible, token list absent
+    expect(screen.getByText(/Register OAuth 2\.1 clients/i)).toBeInTheDocument();
+    expect(screen.queryByText('No tokens yet. Create one to connect MCP clients.')).toBeNull();
+    // Switch to API Tokens tab
+    await user.click(screen.getByRole('button', { name: /API Tokens/i }));
+    await screen.findByText('No tokens yet. Create one to connect MCP clients.');
+    expect(screen.queryByText(/Register OAuth 2\.1 clients/i)).toBeNull();
+    // Switch back to OAuth tab
+    await user.click(screen.getByRole('button', { name: /OAuth 2\.1 Clients/i }));
+    await screen.findByText(/Register OAuth 2\.1 clients/i);
+    expect(screen.queryByText('No tokens yet. Create one to connect MCP clients.')).toBeNull();
+  });
+
+  it('FE-COMP-INTEGRATIONS-021: OAuth client list renders when clients exist', async () => {
+    server.use(
+      http.get('/api/oauth/clients', () =>
+        HttpResponse.json({
+          clients: [
+            {
+              id: 'client-1',
+              client_id: 'clid-abc',
+              name: 'My OAuth App',
+              redirect_uris: ['http://localhost'],
+              allowed_scopes: ['trips:read', 'places:read'],
+              created_at: '2025-01-01T00:00:00Z',
+            },
+          ],
+        })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('My OAuth App');
+    expect(screen.getByText(/clid-abc/)).toBeInTheDocument();
+  });
+
+  it('FE-COMP-INTEGRATIONS-022: scope expansion toggle shows more/fewer scopes', async () => {
+    const user = userEvent.setup();
+    const scopes = ['trips:read', 'trips:write', 'places:read', 'places:write', 'budget:read', 'budget:write', 'packing:read'];
+    server.use(
+      http.get('/api/oauth/clients', () =>
+        HttpResponse.json({
+          clients: [
+            { id: 'c1', client_id: 'cid', name: 'Big App', redirect_uris: ['http://localhost'], allowed_scopes: scopes, created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('Big App');
+    // "+2 more" button visible (7 scopes, 5 shown)
+    const moreBtn = screen.getByText(/^\+\d+$/);
+    await user.click(moreBtn);
+    // Show less / collapse button now visible
+    expect(screen.getByText('−')).toBeInTheDocument();
+  });
+
+  it('FE-COMP-INTEGRATIONS-023: active OAuth sessions section renders when sessions exist', async () => {
+    server.use(
+      http.get('/api/oauth/sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            {
+              id: 10,
+              client_name: 'Claude Desktop',
+              scopes: ['trips:read'],
+              access_token_expires_at: '2025-12-31T00:00:00Z',
+            },
+          ],
+        })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('Claude Desktop');
+    expect(screen.getByText(/trips:read/)).toBeInTheDocument();
+  });
+
+  it('FE-COMP-INTEGRATIONS-024: Create OAuth Client modal opens and shows presets', async () => {
+    const user = userEvent.setup();
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+    expect(screen.getByText('Claude.ai')).toBeInTheDocument();
+    expect(screen.getByText('Claude Desktop')).toBeInTheDocument();
+  });
+
+  it('FE-COMP-INTEGRATIONS-025: clicking a preset fills form fields', async () => {
+    const user = userEvent.setup();
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+    // Presets render as buttons — click "Claude.ai" preset
+    const presetBtns = screen.getAllByRole('button', { name: /Claude\.ai/i });
+    await user.click(presetBtns[0]);
+    // Name field should be filled with 'Claude.ai'
+    const nameInput = screen.getByPlaceholderText(/Claude Web, My MCP App/i);
+    expect((nameInput as HTMLInputElement).value).toBe('Claude.ai');
+  });
+
+  it('FE-COMP-INTEGRATIONS-026: creating client shows success view with client_id and secret', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.post('/api/oauth/clients', () =>
+        HttpResponse.json({
+          client: {
+            id: 'new-id',
+            client_id: 'clid-new',
+            client_secret: 'secret-value',
+            name: 'Test Client',
+            redirect_uris: ['http://localhost'],
+            allowed_scopes: ['trips:read'],
+            created_at: '2025-01-01T00:00:00Z',
+          },
+        })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+
+    const nameInput = screen.getByPlaceholderText(/Claude Web, My MCP App/i);
+    await user.type(nameInput, 'Test Client');
+    const uriInput = screen.getByPlaceholderText(/https:\/\/your-app/i);
+    await user.type(uriInput, 'http://localhost');
+    await user.click(screen.getByRole('button', { name: /Register Client/i }));
+    // Success view shows client credentials (there may be multiple matches in list + modal)
+    await screen.findAllByText(/clid-new/);
+    const secretEls = await screen.findAllByText(/secret-value/);
+    expect(secretEls.length).toBeGreaterThan(0);
+  });
+
+  it('FE-COMP-INTEGRATIONS-027: Done button closes created-client modal', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.post('/api/oauth/clients', () =>
+        HttpResponse.json({
+          client: {
+            id: 'n2',
+            client_id: 'clid-n2',
+            client_secret: 'secret-n2',
+            name: 'TC2',
+            redirect_uris: ['http://localhost'],
+            allowed_scopes: ['trips:read'],
+            created_at: '2025-01-01T00:00:00Z',
+          },
+        })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+    await user.type(screen.getByPlaceholderText(/Claude Web, My MCP App/i), 'TC2');
+    await user.type(screen.getByPlaceholderText(/https:\/\/your-app/i), 'http://localhost');
+    await user.click(screen.getByRole('button', { name: /Register Client/i }));
+    await screen.findAllByText(/clid-n2/);
+    // Check the "Client Registered" modal title is visible before Done
+    expect(screen.getByText('Client Registered')).toBeInTheDocument();
+    await user.click(screen.getByRole('button', { name: /^Done$/i }));
+    await waitFor(() => {
+      expect(screen.queryByText('Client Registered')).toBeNull();
+    });
+  });
+
+  it('FE-COMP-INTEGRATIONS-028: delete OAuth client confirmation removes client from list', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.get('/api/oauth/clients', () =>
+        HttpResponse.json({
+          clients: [
+            { id: 'del-1', client_id: 'cid-del', name: 'Delete Me', redirect_uris: ['http://localhost'], allowed_scopes: ['trips:read'], created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      ),
+      http.delete('/api/oauth/clients/del-1', () => HttpResponse.json({ success: true }))
+    );
+    enableMcp();
+    render(<><ToastContainer /><IntegrationsTab /></>);
+    await screen.findByText('Delete Me');
+    await user.click(screen.getByTitle('Delete Client'));
+    // Confirmation modal
+    await screen.findByRole('heading', { name: 'Delete Client' });
+    const confirmBtns = screen.getAllByRole('button', { name: /Delete Client/i });
+    // Modal confirm button is last in DOM (modal renders after list)
+    await user.click(confirmBtns[confirmBtns.length - 1]);
+    await waitFor(() => {
+      expect(screen.queryByText('Delete Me')).toBeNull();
+    });
+  });
+
+  it('FE-COMP-INTEGRATIONS-029: rotate secret confirmation shows new secret', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.get('/api/oauth/clients', () =>
+        HttpResponse.json({
+          clients: [
+            { id: 'rot-1', client_id: 'cid-rot', name: 'Rotate Me', redirect_uris: ['http://localhost'], allowed_scopes: ['trips:read'], created_at: '2025-01-01T00:00:00Z' },
+          ],
+        })
+      ),
+      http.post('/api/oauth/clients/rot-1/rotate', () =>
+        HttpResponse.json({ client_secret: 'new-rotated-secret' })
+      )
+    );
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('Rotate Me');
+    await user.click(screen.getByTitle('Rotate Secret'));
+    await screen.findByText('Rotate Secret');
+    // Confirm — button text is 'Rotate'
+    const rotateBtns = screen.getAllByRole('button', { name: /^Rotate$/i });
+    await user.click(rotateBtns[rotateBtns.length - 1]);
+    await screen.findByText(/new-rotated-secret/);
+  });
+
+  it('FE-COMP-INTEGRATIONS-030: revoke OAuth session removes it from list', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.get('/api/oauth/sessions', () =>
+        HttpResponse.json({
+          sessions: [
+            { id: 99, client_name: 'Revoke App', scopes: ['trips:read'], access_token_expires_at: '2025-12-31T00:00:00Z' },
+          ],
+        })
+      ),
+      http.delete('/api/oauth/sessions/99', () => HttpResponse.json({ success: true }))
+    );
+    enableMcp();
+    render(<><ToastContainer /><IntegrationsTab /></>);
+    await screen.findByText('Revoke App');
+    await user.click(screen.getByText('Revoke'));
+    // Confirmation modal
+    await screen.findByText('Revoke Session');
+    const revokeBtns = screen.getAllByRole('button', { name: /^Revoke$/i });
+    // Modal confirm button is last in DOM
+    await user.click(revokeBtns[revokeBtns.length - 1]);
+    await waitFor(() => {
+      expect(screen.queryByText('Revoke App')).toBeNull();
+    });
+  });
+
+  it('FE-COMP-INTEGRATIONS-031: Register Client button disabled when name or URI is empty', async () => {
+    const user = userEvent.setup();
+    enableMcp();
+    render(<IntegrationsTab />);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+    const createBtn = screen.getByRole('button', { name: /Register Client/i });
+    expect(createBtn).toBeDisabled();
+    // Type only name, not URI → still disabled
+    await user.type(screen.getByPlaceholderText(/Claude Web, My MCP App/i), 'Test');
+    expect(createBtn).toBeDisabled();
+  });
+
+  it('FE-COMP-INTEGRATIONS-032: error toast shown when create OAuth client fails', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.post('/api/oauth/clients', () =>
+        HttpResponse.json({ error: 'server error' }, { status: 500 })
+      )
+    );
+    enableMcp();
+    render(<><ToastContainer /><IntegrationsTab /></>);
+    await screen.findByText('MCP Configuration');
+    await user.click(screen.getByRole('button', { name: /New Client/i }));
+    await screen.findByText('Register OAuth Client');
+    await user.type(screen.getByPlaceholderText(/Claude Web, My MCP App/i), 'Fail Client');
+    await user.type(screen.getByPlaceholderText(/https:\/\/your-app/i), 'http://localhost');
+    await user.click(screen.getByRole('button', { name: /Register Client/i }));
+    await screen.findByText(/Failed to register/i);
+  });
 });
@@ -1,12 +1,87 @@
 import Section from './Section'
-import React, { useEffect, useState } from 'react'
+import React, { useEffect, useRef, useState } from 'react'
 import { useTranslation } from '../../i18n'
 import { useToast } from '../shared/Toast'
-import { Trash2, Copy, Terminal, Plus, Check } from 'lucide-react'
-import { authApi } from '../../api/client'
+import { Trash2, Copy, Terminal, Plus, Check, KeyRound, ChevronDown, ChevronRight, RefreshCw } from 'lucide-react'
+import { authApi, oauthApi } from '../../api/client'
 import { useAddonStore } from '../../store/addonStore'
 import PhotoProvidersSection from './PhotoProvidersSection'
+import { ALL_SCOPES } from '../../api/oauthScopes'
+import ScopeGroupPicker from '../OAuth/ScopeGroupPicker'

+interface OAuthPreset {
+  id: string
+  label: string
+  name: string
+  uris: string
+  scopes: string[]
+}
+
+const OAUTH_PRESETS: OAuthPreset[] = [
+  {
+    id: 'claude-web',
+    label: 'Claude.ai',
+    name: 'Claude.ai',
+    uris: 'https://claude.ai/api/mcp/auth_callback',
+    scopes: ALL_SCOPES.filter(s => !s.includes(':delete')),
+  },
+  {
+    id: 'claude-desktop',
+    label: 'Claude Desktop',
+    name: 'Claude Desktop',
+    uris: 'http://localhost',
+    scopes: ALL_SCOPES.filter(s => !s.includes(':delete')),
+  },
+  {
+    id: 'cursor',
+    label: 'Cursor',
+    name: 'Cursor',
+    uris: 'http://localhost',
+    scopes: ALL_SCOPES.filter(s => !s.includes(':delete')),
+  },
+  {
+    id: 'vscode',
+    label: 'VS Code',
+    name: 'VS Code / Copilot',
+    uris: 'http://localhost',
+    scopes: ALL_SCOPES.filter(s => s.endsWith(':read')),
+  },
+  {
+    id: 'windsurf',
+    label: 'Windsurf',
+    name: 'Windsurf',
+    uris: 'http://localhost',
+    scopes: ALL_SCOPES.filter(s => !s.includes(':delete')),
+  },
+  {
+    id: 'zed',
+    label: 'Zed',
+    name: 'Zed',
+    uris: 'http://localhost',
+    scopes: ALL_SCOPES.filter(s => !s.includes(':delete')),
+  },
+]
+
+
+interface OAuthClient {
+  id: string
+  name: string
+  client_id: string
+  redirect_uris: string[]
+  allowed_scopes: string[]
+  created_at: string
+  client_secret?: string // only present on create
+}
+
+interface OAuthSession {
+  id: number
+  client_id: string
+  client_name: string
+  scopes: string[]
+  access_token_expires_at: string
+  refresh_token_expires_at: string
+  created_at: string
+}

 interface McpToken {
  id: number
@@ -26,6 +101,28 @@ export default function IntegrationsTab(): React.ReactElement {
    loadAddons()
  }, [loadAddons])

+  // OAuth clients state
+  const [oauthClients, setOauthClients] = useState<OAuthClient[]>([])
+  const [oauthSessions, setOauthSessions] = useState<OAuthSession[]>([])
+  const [oauthCreateOpen, setOauthCreateOpen] = useState(false)
+  const [oauthNewName, setOauthNewName] = useState('')
+  const [oauthNewUris, setOauthNewUris] = useState('')
+  const [oauthNewScopes, setOauthNewScopes] = useState<string[]>([])
+  const [oauthCreating, setOauthCreating] = useState(false)
+  const [oauthCreatedClient, setOauthCreatedClient] = useState<OAuthClient | null>(null)
+  const [oauthDeleteId, setOauthDeleteId] = useState<string | null>(null)
+  const [oauthRevokeId, setOauthRevokeId] = useState<number | null>(null)
+  const [oauthRotateId, setOauthRotateId] = useState<string | null>(null)
+  const [oauthRotatedSecret, setOauthRotatedSecret] = useState<string | null>(null)
+  const [oauthRotating, setOauthRotating] = useState(false)
+  // oauthScopesOpen is managed internally by ScopeGroupPicker
+  const [oauthScopesExpanded, setOauthScopesExpanded] = useState<Record<string, boolean>>({})
+
+  // MCP sub-tab state
+  const [activeMcpTab, setActiveMcpTab] = useState<'oauth' | 'apitokens'>('oauth')
+  const [configOpenOAuth, setConfigOpenOAuth] = useState(false)
+  const [configOpenToken, setConfigOpenToken] = useState(false)
+
  // MCP state
  const [mcpTokens, setMcpTokens] = useState<McpToken[]>([])
  const [mcpModalOpen, setMcpModalOpen] = useState(false)
@@ -34,8 +131,26 @@ export default function IntegrationsTab(): React.ReactElement {
  const [mcpCreating, setMcpCreating] = useState(false)
  const [mcpDeleteId, setMcpDeleteId] = useState<number | null>(null)
  const [copiedKey, setCopiedKey] = useState<string | null>(null)
+  const copyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  useEffect(() => {
+    return () => { if (copyTimerRef.current) clearTimeout(copyTimerRef.current) }
+  }, [])

  const mcpEndpoint = `${window.location.origin}/mcp`
+  const mcpJsonConfigOAuth = `{
+  "mcpServers": {
+    "trek": {
+      "command": "npx",
+      "args": [
+        "mcp-remote",
+        "${mcpEndpoint}",
+        "--static-oauth-client-info",
+        "{\\"client_id\\": \\"<your_client_id>\\", \\"client_secret\\": \\"<your_client_secret>\\"}"
+      ]
+    }
+  }
+}`
  const mcpJsonConfig = `{
  "mcpServers": {
    "trek": {
@@ -85,10 +200,72 @@ export default function IntegrationsTab(): React.ReactElement {
  const handleCopy = (text: string, key: string) => {
    navigator.clipboard.writeText(text).then(() => {
      setCopiedKey(key)
-      setTimeout(() => setCopiedKey(null), 2000)
+      if (copyTimerRef.current) clearTimeout(copyTimerRef.current)
+      copyTimerRef.current = setTimeout(() => setCopiedKey(null), 2000)
    })
  }

+  // Load OAuth clients and sessions
+  useEffect(() => {
+    if (mcpEnabled) {
+      oauthApi.clients.list().then(d => setOauthClients(d.clients || [])).catch(() => {})
+      oauthApi.sessions.list().then(d => setOauthSessions(d.sessions || [])).catch(() => {})
+    }
+  }, [mcpEnabled])
+
+  const handleCreateOAuthClient = async () => {
+    if (!oauthNewName.trim() || !oauthNewUris.trim()) return
+    setOauthCreating(true)
+    try {
+      const uris = oauthNewUris.split('\n').map(u => u.trim()).filter(Boolean)
+      const d = await oauthApi.clients.create({ name: oauthNewName.trim(), redirect_uris: uris, allowed_scopes: oauthNewScopes })
+      setOauthCreatedClient(d.client)
+      setOauthClients(prev => [...prev, { ...d.client, client_secret: undefined }])
+      setOauthNewName('')
+      setOauthNewUris('')
+      setOauthNewScopes([])
+    } catch {
+      toast.error(t('settings.oauth.toast.createError'))
+    } finally {
+      setOauthCreating(false)
+    }
+  }
+
+  const handleDeleteOAuthClient = async (id: string) => {
+    try {
+      await oauthApi.clients.delete(id)
+      setOauthClients(prev => prev.filter(c => c.id !== id))
+      setOauthDeleteId(null)
+      toast.success(t('settings.oauth.toast.deleted'))
+    } catch {
+      toast.error(t('settings.oauth.toast.deleteError'))
+    }
+  }
+
+  const handleRotateSecret = async (id: string) => {
+    setOauthRotating(true)
+    try {
+      const d = await oauthApi.clients.rotate(id)
+      setOauthRotatedSecret(d.client_secret)
+      setOauthRotateId(null)
+    } catch {
+      toast.error(t('settings.oauth.toast.rotateError'))
+    } finally {
+      setOauthRotating(false)
+    }
+  }
+
+  const handleRevokeSession = async (id: number) => {
+    try {
+      await oauthApi.sessions.revoke(id)
+      setOauthSessions(prev => prev.filter(s => s.id !== id))
+      setOauthRevokeId(null)
+      toast.success(t('settings.oauth.toast.revoked'))
+    } catch {
+      toast.error(t('settings.oauth.toast.revokeError'))
+    }
+  }
+
  return (
    <>
      <PhotoProvidersSection />
@@ -109,63 +286,217 @@ export default function IntegrationsTab(): React.ReactElement {
            </div>
          </div>

-          {/* JSON config box */}
-          <div>
-            <div className="flex items-center justify-between mb-1.5">
-              <label className="block text-sm font-medium" style={{ color: 'var(--text-secondary)' }}>{t('settings.mcp.clientConfig')}</label>
-              <button onClick={() => handleCopy(mcpJsonConfig, 'json')}
-                className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
-                style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
-                {copiedKey === 'json' ? <Check className="w-3 h-3 text-green-500" /> : <Copy className="w-3 h-3" />}
-                {copiedKey === 'json' ? t('settings.mcp.copied') : t('settings.mcp.copy')}
-              </button>
-            </div>
-            <pre className="p-3 rounded-lg text-xs font-mono overflow-x-auto border" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
-              {mcpJsonConfig}
-            </pre>
-            <p className="mt-1.5 text-xs" style={{ color: 'var(--text-tertiary)' }}>{t('settings.mcp.clientConfigHint')}</p>
+          {/* Sub-tab bar */}
+          <div className="flex gap-1 rounded-lg p-1" style={{ background: 'var(--bg-secondary)', border: '1px solid var(--border-primary)' }}>
+            <button
+              onClick={() => setActiveMcpTab('oauth')}
+              className={`flex-1 px-3 py-1.5 text-sm font-medium rounded-md transition-colors ${
+                activeMcpTab === 'oauth' ? 'bg-slate-900 text-white' : 'text-slate-600 hover:text-slate-900 hover:bg-slate-50'
+              }`}>
+              {t('settings.oauth.clients')}
+            </button>
+            <button
+              onClick={() => setActiveMcpTab('apitokens')}
+              className={`flex-1 px-3 py-1.5 text-sm font-medium rounded-md transition-colors flex items-center justify-center gap-2 ${
+                activeMcpTab === 'apitokens' ? 'bg-slate-900 text-white' : 'text-slate-600 hover:text-slate-900 hover:bg-slate-50'
+              }`}>
+              {t('settings.mcp.apiTokens')}
+              <span className="px-1.5 py-0.5 rounded text-[10px] font-medium"
+                style={{ background: 'rgba(245,158,11,0.15)', color: '#b45309', border: '1px solid rgba(245,158,11,0.4)' }}>
+                Deprecated
+              </span>
+            </button>
          </div>

-          {/* Token list */}
-          <div>
-            <div className="flex items-center justify-between mb-2">
-              <label className="text-sm font-medium" style={{ color: 'var(--text-secondary)' }}>{t('settings.mcp.apiTokens')}</label>
-              <button onClick={() => { setMcpModalOpen(true); setMcpCreatedToken(null); setMcpNewName('') }}
-                className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm font-medium transition-colors"
-                style={{ background: 'var(--accent-primary, #4f46e5)', color: '#fff' }}>
-                <Plus className="w-3.5 h-3.5" /> {t('settings.mcp.createToken')}
-              </button>
-            </div>
-
-            {mcpTokens.length === 0 ? (
-              <p className="text-sm py-3 text-center rounded-lg border" style={{ color: 'var(--text-tertiary)', borderColor: 'var(--border-primary)' }}>
-                {t('settings.mcp.noTokens')}
-              </p>
-            ) : (
+          {/* OAuth 2.1 Clients tab */}
+          {activeMcpTab === 'oauth' && (
+            <>
+              {/* JSON config — OAuth (collapsible) */}
              <div className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
-                {mcpTokens.map((token, i) => (
-                  <div key={token.id} className="flex items-center gap-3 px-4 py-3"
-                    style={{ borderBottom: i < mcpTokens.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
-                    <div className="flex-1 min-w-0">
-                      <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{token.name}</p>
-                      <p className="text-xs font-mono mt-0.5" style={{ color: 'var(--text-tertiary)' }}>
-                        {token.token_prefix}...
-                        <span className="ml-3 font-sans">{t('settings.mcp.tokenCreatedAt')} {new Date(token.created_at).toLocaleDateString(locale)}</span>
-                        {token.last_used_at && (
-                          <span className="ml-2">· {t('settings.mcp.tokenUsedAt')} {new Date(token.last_used_at).toLocaleDateString(locale)}</span>
-                        )}
-                      </p>
+                <button
+                  onClick={() => setConfigOpenOAuth(o => !o)}
+                  className="w-full flex items-center justify-between px-3 py-2.5 transition-colors hover:bg-slate-50 dark:hover:bg-slate-800"
+                  style={{ background: 'var(--bg-secondary)' }}>
+                  <span className="text-sm font-medium" style={{ color: 'var(--text-secondary)' }}>{t('settings.mcp.clientConfig')}</span>
+                  {configOpenOAuth ? <ChevronDown className="w-4 h-4" style={{ color: 'var(--text-tertiary)' }} /> : <ChevronRight className="w-4 h-4" style={{ color: 'var(--text-tertiary)' }} />}
+                </button>
+                {configOpenOAuth && (
+                  <div className="p-3 border-t" style={{ borderColor: 'var(--border-primary)' }}>
+                    <div className="flex justify-end mb-1.5">
+                      <button onClick={() => handleCopy(mcpJsonConfigOAuth, 'json-oauth')}
+                        className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                        style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                        {copiedKey === 'json-oauth' ? <Check className="w-3 h-3 text-green-500" /> : <Copy className="w-3 h-3" />}
+                        {copiedKey === 'json-oauth' ? t('settings.mcp.copied') : t('settings.mcp.copy')}
+                      </button>
                    </div>
-                    <button onClick={() => setMcpDeleteId(token.id)}
-                      className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
-                      style={{ color: 'var(--text-tertiary)' }} title={t('settings.mcp.deleteTokenTitle')}>
-                      <Trash2 className="w-4 h-4" />
-                    </button>
+                    <pre className="p-3 rounded-lg text-xs font-mono overflow-x-auto border" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
+                      {mcpJsonConfigOAuth}
+                    </pre>
+                    <p className="mt-1.5 text-xs" style={{ color: 'var(--text-tertiary)' }}>{t('settings.mcp.clientConfigHintOAuth')}</p>
                  </div>
-                ))}
+                )}
              </div>
-            )}
-          </div>
+
+              <div>
+                <p className="text-xs mb-3" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.clientsHint')}</p>
+
+                <div className="flex justify-end mb-2">
+                  <button onClick={() => { setOauthCreateOpen(true); setOauthCreatedClient(null); setOauthNewName(''); setOauthNewUris(''); setOauthNewScopes([]) }}
+                    className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm font-medium transition-colors bg-slate-900 text-white hover:bg-slate-700">
+                    <Plus className="w-3.5 h-3.5" /> {t('settings.oauth.createClient')}
+                  </button>
+                </div>
+
+                {oauthClients.length === 0 ? (
+                  <p className="text-sm py-3 text-center rounded-lg border" style={{ color: 'var(--text-tertiary)', borderColor: 'var(--border-primary)' }}>
+                    {t('settings.oauth.noClients')}
+                  </p>
+                ) : (
+                  <div className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+                    {oauthClients.map((client, i) => (
+                      <div key={client.id} className="px-4 py-3"
+                        style={{ borderBottom: i < oauthClients.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
+                        <div className="flex items-center gap-3">
+                          <KeyRound className="w-4 h-4 flex-shrink-0" style={{ color: 'var(--text-tertiary)' }} />
+                          <div className="flex-1 min-w-0">
+                            <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{client.name}</p>
+                            <p className="text-xs font-mono mt-0.5" style={{ color: 'var(--text-tertiary)' }}>
+                              {t('settings.oauth.clientId')}: {client.client_id}
+                              <span className="ml-3 font-sans">{t('settings.mcp.tokenCreatedAt')} {new Date(client.created_at).toLocaleDateString(locale)}</span>
+                            </p>
+                            <div className="flex flex-wrap gap-1 mt-1.5">
+                              {(oauthScopesExpanded[client.id] ? client.allowed_scopes : client.allowed_scopes.slice(0, 5)).map(s => (
+                                <span key={s} className="px-1.5 py-0.5 rounded text-xs" style={{ background: 'var(--bg-secondary)', color: 'var(--text-tertiary)', border: '1px solid var(--border-primary)' }}>{s}</span>
+                              ))}
+                              {client.allowed_scopes.length > 5 && (
+                                <button
+                                  onClick={() => setOauthScopesExpanded(prev => ({ ...prev, [client.id]: !prev[client.id] }))}
+                                  className="px-1.5 py-0.5 rounded text-xs transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                                  style={{ color: 'var(--text-tertiary)', border: '1px solid var(--border-primary)' }}>
+                                  {oauthScopesExpanded[client.id] ? '−' : `+${client.allowed_scopes.length - 5}`}
+                                </button>
+                              )}
+                            </div>
+                          </div>
+                          <button onClick={() => setOauthRotateId(client.id)}
+                            className="p-1.5 rounded-lg transition-colors hover:bg-amber-50 hover:text-amber-600 dark:hover:bg-amber-900/20"
+                            style={{ color: 'var(--text-tertiary)' }} title={t('settings.oauth.rotateSecret')}>
+                            <RefreshCw className="w-4 h-4" />
+                          </button>
+                          <button onClick={() => setOauthDeleteId(client.id)}
+                            className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
+                            style={{ color: 'var(--text-tertiary)' }} title={t('settings.oauth.deleteClient')}>
+                            <Trash2 className="w-4 h-4" />
+                          </button>
+                        </div>
+                      </div>
+                    ))}
+                  </div>
+                )}
+              </div>
+
+              {/* Active OAuth Sessions */}
+              {oauthSessions.length > 0 && (
+                <div>
+                  <label className="text-sm font-medium block mb-2" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.activeSessions')}</label>
+                  <div className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+                    {oauthSessions.map((session, i) => (
+                      <div key={session.id} className="flex items-center gap-3 px-4 py-3"
+                        style={{ borderBottom: i < oauthSessions.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
+                        <div className="flex-1 min-w-0">
+                          <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{session.client_name}</p>
+                          <p className="text-xs mt-0.5" style={{ color: 'var(--text-tertiary)' }}>
+                            {t('settings.oauth.sessionScopes')}: {session.scopes.join(', ')}
+                            <span className="ml-3">{t('settings.oauth.sessionExpires')} {new Date(session.access_token_expires_at).toLocaleDateString(locale)}</span>
+                          </p>
+                        </div>
+                        <button onClick={() => setOauthRevokeId(session.id)}
+                          className="px-2.5 py-1 rounded text-xs border transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
+                          style={{ borderColor: 'var(--border-primary)', color: 'var(--text-tertiary)' }}>
+                          {t('settings.oauth.revoke')}
+                        </button>
+                      </div>
+                    ))}
+                  </div>
+                </div>
+              )}
+            </>
+          )}
+
+          {/* API Tokens tab (deprecated) */}
+          {activeMcpTab === 'apitokens' && (
+            <>
+              <div className="flex items-baseline gap-2 px-3 py-2.5 rounded-lg" style={{ background: 'rgba(245,158,11,0.06)', border: '1px solid rgba(245,158,11,0.3)' }}>
+                <span className="text-amber-500 flex-shrink-0 leading-none">⚠</span>
+                <p className="text-xs" style={{ color: '#92400e' }}>{t('settings.mcp.apiTokensDeprecated')}</p>
+              </div>
+
+              {/* JSON config — API Token (collapsible) */}
+              <div className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+                <button
+                  onClick={() => setConfigOpenToken(o => !o)}
+                  className="w-full flex items-center justify-between px-3 py-2.5 transition-colors hover:bg-slate-50 dark:hover:bg-slate-800"
+                  style={{ background: 'var(--bg-secondary)' }}>
+                  <span className="text-sm font-medium" style={{ color: 'var(--text-secondary)' }}>{t('settings.mcp.clientConfig')}</span>
+                  {configOpenToken ? <ChevronDown className="w-4 h-4" style={{ color: 'var(--text-tertiary)' }} /> : <ChevronRight className="w-4 h-4" style={{ color: 'var(--text-tertiary)' }} />}
+                </button>
+                {configOpenToken && (
+                  <div className="p-3 border-t" style={{ borderColor: 'var(--border-primary)' }}>
+                    <div className="flex justify-end mb-1.5">
+                      <button onClick={() => handleCopy(mcpJsonConfig, 'json-token')}
+                        className="flex items-center gap-1.5 px-2.5 py-1 rounded text-xs border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                        style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                        {copiedKey === 'json-token' ? <Check className="w-3 h-3 text-green-500" /> : <Copy className="w-3 h-3" />}
+                        {copiedKey === 'json-token' ? t('settings.mcp.copied') : t('settings.mcp.copy')}
+                      </button>
+                    </div>
+                    <pre className="p-3 rounded-lg text-xs font-mono overflow-x-auto border" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
+                      {mcpJsonConfig}
+                    </pre>
+                    <p className="mt-1.5 text-xs" style={{ color: 'var(--text-tertiary)' }}>{t('settings.mcp.clientConfigHint')}</p>
+                  </div>
+                )}
+              </div>
+
+              <div className="flex justify-end">
+                <button onClick={() => { setMcpModalOpen(true); setMcpCreatedToken(null); setMcpNewName('') }}
+                  className="flex items-center gap-1.5 px-3 py-1.5 rounded-lg text-sm font-medium transition-colors opacity-60"
+                  style={{ background: 'var(--bg-tertiary, #e5e7eb)', color: 'var(--text-secondary)' }}>
+                  <Plus className="w-3.5 h-3.5" /> {t('settings.mcp.createToken')}
+                </button>
+              </div>
+
+              {mcpTokens.length === 0 ? (
+                <p className="text-sm py-2 text-center" style={{ color: 'var(--text-tertiary)' }}>
+                  {t('settings.mcp.noTokens')}
+                </p>
+              ) : (
+                <div className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+                  {mcpTokens.map((token, i) => (
+                    <div key={token.id} className="flex items-center gap-3 px-4 py-3"
+                      style={{ borderBottom: i < mcpTokens.length - 1 ? '1px solid var(--border-primary)' : undefined }}>
+                      <div className="flex-1 min-w-0">
+                        <p className="text-sm font-medium truncate" style={{ color: 'var(--text-primary)' }}>{token.name}</p>
+                        <p className="text-xs font-mono mt-0.5" style={{ color: 'var(--text-tertiary)' }}>
+                          {token.token_prefix}...
+                          <span className="ml-3 font-sans">{t('settings.mcp.tokenCreatedAt')} {new Date(token.created_at).toLocaleDateString(locale)}</span>
+                          {token.last_used_at && (
+                            <span className="ml-2">· {t('settings.mcp.tokenUsedAt')} {new Date(token.last_used_at).toLocaleDateString(locale)}</span>
+                          )}
+                        </p>
+                      </div>
+                      <button onClick={() => setMcpDeleteId(token.id)}
+                        className="p-1.5 rounded-lg transition-colors hover:bg-red-50 hover:text-red-600 dark:hover:bg-red-900/20"
+                        style={{ color: 'var(--text-tertiary)' }} title={t('settings.mcp.deleteTokenTitle')}>
+                        <Trash2 className="w-4 h-4" />
+                      </button>
+                    </div>
+                  ))}
+                </div>
+              )}
+            </>
+          )}
        </Section>
      )}

@@ -182,7 +513,7 @@ export default function IntegrationsTab(): React.ReactElement {
                  <input type="text" value={mcpNewName} onChange={e => setMcpNewName(e.target.value)}
                    onKeyDown={e => e.key === 'Enter' && handleCreateMcpToken()}
                    placeholder={t('settings.mcp.modal.tokenNamePlaceholder')}
-                    className="w-full px-3 py-2.5 border rounded-lg text-sm focus:outline-none focus:ring-2 focus:ring-indigo-300"
+                    className="w-full px-3 py-2.5 border rounded-lg text-sm focus:outline-none focus:ring-2 focus:ring-slate-400"
                    style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)', color: 'var(--text-primary)' }}
                    autoFocus />
                </div>
@@ -192,8 +523,7 @@ export default function IntegrationsTab(): React.ReactElement {
                    {t('common.cancel')}
                  </button>
                  <button onClick={handleCreateMcpToken} disabled={!mcpNewName.trim() || mcpCreating}
-                    className="px-4 py-2 rounded-lg text-sm font-medium text-white disabled:opacity-50"
-                    style={{ background: 'var(--accent-primary, #4f46e5)' }}>
+                    className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
                    {mcpCreating ? t('settings.mcp.modal.creating') : t('settings.mcp.modal.create')}
                  </button>
                </div>
@@ -217,8 +547,7 @@ export default function IntegrationsTab(): React.ReactElement {
                </div>
                <div className="flex justify-end">
                  <button onClick={() => { setMcpModalOpen(false); setMcpCreatedToken(null) }}
-                    className="px-4 py-2 rounded-lg text-sm font-medium text-white"
-                    style={{ background: 'var(--accent-primary, #4f46e5)' }}>
+                    className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
                    {t('settings.mcp.modal.done')}
                  </button>
                </div>
@@ -248,6 +577,216 @@ export default function IntegrationsTab(): React.ReactElement {
          </div>
        </div>
      )}
+
+      {/* Create OAuth Client modal */}
+      {oauthCreateOpen && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
+          onClick={e => { if (e.target === e.currentTarget && !oauthCreatedClient) setOauthCreateOpen(false) }}>
+          <div className="rounded-xl shadow-xl w-full max-w-lg p-6 space-y-4 overflow-y-auto max-h-[90vh]" style={{ background: 'var(--bg-card)' }}>
+            {!oauthCreatedClient ? (
+              <>
+                <h3 className="text-lg font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.modal.createTitle')}</h3>
+
+                <div>
+                  <label className="block text-xs font-medium mb-2" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.modal.presets')}</label>
+                  <div className="flex flex-wrap gap-1.5">
+                    {OAUTH_PRESETS.map(preset => (
+                      <button
+                        key={preset.id}
+                        type="button"
+                        onClick={() => {
+                          setOauthNewName(preset.name)
+                          setOauthNewUris(preset.uris)
+                          setOauthNewScopes(preset.scopes)
+                        }}
+                        className="px-2.5 py-1 rounded-md text-xs font-medium border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                        style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)', background: 'var(--bg-secondary)' }}>
+                        {preset.label}
+                      </button>
+                    ))}
+                  </div>
+                </div>
+
+                <div>
+                  <label className="block text-sm font-medium mb-1.5" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.modal.clientName')}</label>
+                  <input type="text" value={oauthNewName} onChange={e => setOauthNewName(e.target.value)}
+                    placeholder={t('settings.oauth.modal.clientNamePlaceholder')}
+                    className="w-full px-3 py-2.5 border rounded-lg text-sm focus:outline-none focus:ring-2 focus:ring-slate-400"
+                    style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)', color: 'var(--text-primary)' }}
+                    autoFocus />
+                </div>
+
+                <div>
+                  <label className="block text-sm font-medium mb-1.5" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.modal.redirectUris')}</label>
+                  <textarea value={oauthNewUris} onChange={e => setOauthNewUris(e.target.value)}
+                    placeholder={t('settings.oauth.modal.redirectUrisPlaceholder')}
+                    rows={3}
+                    className="w-full px-3 py-2.5 border rounded-lg text-sm font-mono resize-none focus:outline-none focus:ring-2 focus:ring-slate-400"
+                    style={{ borderColor: 'var(--border-primary)', background: 'var(--bg-secondary)', color: 'var(--text-primary)' }} />
+                  <p className="mt-1 text-xs" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.modal.redirectUrisHint')}</p>
+                </div>
+
+                <div>
+                  <label className="block text-sm font-medium mb-1" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.modal.scopes')}</label>
+                  <p className="text-xs mb-2" style={{ color: 'var(--text-tertiary)' }}>{t('settings.oauth.modal.scopesHint')}</p>
+                  <ScopeGroupPicker selected={oauthNewScopes} onChange={setOauthNewScopes} />
+                </div>
+
+                <div className="flex gap-2 justify-end pt-1">
+                  <button onClick={() => setOauthCreateOpen(false)}
+                    className="px-4 py-2 rounded-lg text-sm border" style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                    {t('common.cancel')}
+                  </button>
+                  <button onClick={handleCreateOAuthClient}
+                    disabled={!oauthNewName.trim() || !oauthNewUris.trim() || oauthCreating}
+                    className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
+                    {oauthCreating ? t('settings.oauth.modal.creating') : t('settings.oauth.modal.create')}
+                  </button>
+                </div>
+              </>
+            ) : (
+              <>
+                <h3 className="text-lg font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.modal.createdTitle')}</h3>
+                <div className="flex items-start gap-2 p-3 rounded-lg border border-amber-200" style={{ background: 'rgba(251,191,36,0.1)' }}>
+                  <span className="text-amber-500 mt-0.5">⚠</span>
+                  <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.modal.createdWarning')}</p>
+                </div>
+
+                <div className="space-y-3">
+                  <div>
+                    <label className="block text-xs font-medium mb-1" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.clientId')}</label>
+                    <div className="flex items-center gap-2">
+                      <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
+                        {oauthCreatedClient.client_id}
+                      </code>
+                      <button onClick={() => handleCopy(oauthCreatedClient.client_id, 'new-client-id')}
+                        className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                        style={{ borderColor: 'var(--border-primary)' }}>
+                        {copiedKey === 'new-client-id' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4" style={{ color: 'var(--text-secondary)' }} />}
+                      </button>
+                    </div>
+                  </div>
+                  <div>
+                    <label className="block text-xs font-medium mb-1" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.clientSecret')}</label>
+                    <div className="flex items-center gap-2">
+                      <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border break-all" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
+                        {oauthCreatedClient.client_secret}
+                      </code>
+                      <button onClick={() => handleCopy(oauthCreatedClient.client_secret!, 'new-client-secret')}
+                        className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                        style={{ borderColor: 'var(--border-primary)' }}>
+                        {copiedKey === 'new-client-secret' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4" style={{ color: 'var(--text-secondary)' }} />}
+                      </button>
+                    </div>
+                  </div>
+                </div>
+
+                <div className="flex justify-end">
+                  <button onClick={() => { setOauthCreateOpen(false); setOauthCreatedClient(null) }}
+                    className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
+                    {t('settings.mcp.modal.done')}
+                  </button>
+                </div>
+              </>
+            )}
+          </div>
+        </div>
+      )}
+
+      {/* Delete OAuth Client confirm */}
+      {oauthDeleteId !== null && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
+          onClick={e => { if (e.target === e.currentTarget) setOauthDeleteId(null) }}>
+          <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4" style={{ background: 'var(--bg-card)' }}>
+            <h3 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.deleteClient')}</h3>
+            <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.deleteClientMessage')}</p>
+            <div className="flex gap-2 justify-end">
+              <button onClick={() => setOauthDeleteId(null)}
+                className="px-4 py-2 rounded-lg text-sm border" style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                {t('common.cancel')}
+              </button>
+              <button onClick={() => handleDeleteOAuthClient(oauthDeleteId)}
+                className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
+                {t('settings.oauth.deleteClient')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      {/* Rotate OAuth Client Secret confirm */}
+      {oauthRotateId !== null && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
+          onClick={e => { if (e.target === e.currentTarget) setOauthRotateId(null) }}>
+          <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4" style={{ background: 'var(--bg-card)' }}>
+            <h3 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.rotateSecret')}</h3>
+            <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.rotateSecretMessage')}</p>
+            <div className="flex gap-2 justify-end">
+              <button onClick={() => setOauthRotateId(null)}
+                className="px-4 py-2 rounded-lg text-sm border" style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                {t('common.cancel')}
+              </button>
+              <button onClick={() => handleRotateSecret(oauthRotateId)} disabled={oauthRotating}
+                className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700 disabled:opacity-50">
+                {oauthRotating ? t('settings.oauth.rotateSecretConfirming') : t('settings.oauth.rotateSecretConfirm')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      {/* Rotated Secret display */}
+      {oauthRotatedSecret !== null && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}>
+          <div className="rounded-xl shadow-xl w-full max-w-md p-6 space-y-4" style={{ background: 'var(--bg-card)' }}>
+            <h3 className="text-lg font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.rotateSecretDoneTitle')}</h3>
+            <div className="flex items-start gap-2 p-3 rounded-lg border border-amber-200" style={{ background: 'rgba(251,191,36,0.1)' }}>
+              <span className="text-amber-500 mt-0.5">⚠</span>
+              <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.rotateSecretDoneWarning')}</p>
+            </div>
+            <div>
+              <label className="block text-xs font-medium mb-1" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.clientSecret')}</label>
+              <div className="flex items-center gap-2">
+                <code className="flex-1 px-3 py-2 rounded-lg text-xs font-mono border break-all" style={{ background: 'var(--bg-secondary)', borderColor: 'var(--border-primary)', color: 'var(--text-primary)' }}>
+                  {oauthRotatedSecret}
+                </code>
+                <button onClick={() => handleCopy(oauthRotatedSecret, 'rotated-secret')}
+                  className="p-2 rounded-lg border transition-colors hover:bg-slate-100 dark:hover:bg-slate-700"
+                  style={{ borderColor: 'var(--border-primary)' }}>
+                  {copiedKey === 'rotated-secret' ? <Check className="w-4 h-4 text-green-500" /> : <Copy className="w-4 h-4" style={{ color: 'var(--text-secondary)' }} />}
+                </button>
+              </div>
+            </div>
+            <div className="flex justify-end">
+              <button onClick={() => setOauthRotatedSecret(null)}
+                className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-slate-900 hover:bg-slate-700">
+                {t('settings.mcp.modal.done')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
+
+      {/* Revoke OAuth Session confirm */}
+      {oauthRevokeId !== null && (
+        <div className="fixed inset-0 z-50 flex items-center justify-center p-4" style={{ background: 'rgba(0,0,0,0.5)' }}
+          onClick={e => { if (e.target === e.currentTarget) setOauthRevokeId(null) }}>
+          <div className="rounded-xl shadow-xl w-full max-w-sm p-6 space-y-4" style={{ background: 'var(--bg-card)' }}>
+            <h3 className="text-base font-semibold" style={{ color: 'var(--text-primary)' }}>{t('settings.oauth.revokeSession')}</h3>
+            <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{t('settings.oauth.revokeSessionMessage')}</p>
+            <div className="flex gap-2 justify-end">
+              <button onClick={() => setOauthRevokeId(null)}
+                className="px-4 py-2 rounded-lg text-sm border" style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+                {t('common.cancel')}
+              </button>
+              <button onClick={() => handleRevokeSession(oauthRevokeId)}
+                className="px-4 py-2 rounded-lg text-sm font-medium text-white bg-red-600 hover:bg-red-700">
+                {t('settings.oauth.revoke')}
+              </button>
+            </div>
+          </div>
+        </div>
+      )}
    </>
  )
 }
@@ -11,6 +11,7 @@ interface ProviderField {
  label: string
  input_type: string
  placeholder?: string | null
+  hint?: string | null
  required: boolean
  secret: boolean
  settings_key?: string | null
@@ -71,6 +72,10 @@ export default function PhotoProvidersSection(): React.ReactElement {
    const payload: Record<string, unknown> = {}
    for (const field of getProviderFields(provider)) {
      const payloadKey = field.payload_key || field.settings_key || field.key
+      if (field.input_type === 'checkbox') {
+        payload[payloadKey] = values[field.key] === 'true'
+        continue
+      }
      const value = (values[field.key] || '').trim()
      if (field.secret && !value) continue
      payload[payloadKey] = value
@@ -102,6 +107,18 @@ export default function PhotoProvidersSection(): React.ReactElement {
      const cfg = getProviderConfig(provider)
      const fields = getProviderFields(provider)

+      // Seed checkbox defaults before the async settings load resolves
+      const checkboxDefaults: Record<string, string> = {}
+      for (const field of fields) {
+        if (field.input_type === 'checkbox') checkboxDefaults[field.key] = 'false'
+      }
+      if (Object.keys(checkboxDefaults).length > 0) {
+        setProviderValues(prev => ({
+          ...prev,
+          [provider.id]: { ...checkboxDefaults, ...(prev[provider.id] || {}) },
+        }))
+      }
+
      if (cfg.settings_get) {
        apiClient.get(cfg.settings_get).then(res => {
          if (isCancelled) return
@@ -112,7 +129,13 @@ export default function PhotoProvidersSection(): React.ReactElement {
            if (field.secret) continue
            const sourceKey = field.settings_key || field.payload_key || field.key
            const rawValue = (res.data as Record<string, unknown>)[sourceKey]
-            nextValues[field.key] = typeof rawValue === 'string' ? rawValue : rawValue != null ? String(rawValue) : ''
+            if (rawValue != null) {
+              nextValues[field.key] = typeof rawValue === 'string' ? rawValue : String(rawValue)
+            } else if (field.input_type === 'checkbox') {
+              nextValues[field.key] = 'false'
+            } else {
+              nextValues[field.key] = ''
+            }
          }
          setProviderValues(prev => ({
            ...prev,
@@ -198,14 +221,31 @@ export default function PhotoProvidersSection(): React.ReactElement {
        <div className="space-y-3">
          {fields.map(field => (
            <div key={`${provider.id}-${field.key}`}>
-              <label className="block text-sm font-medium text-slate-700 mb-1.5">{t(`memories.${field.label}`)}</label>
-              <input
-                type={field.input_type || 'text'}
-                value={values[field.key] || ''}
-                onChange={e => handleProviderFieldChange(provider.id, field.key, e.target.value)}
-                placeholder={field.secret && connected && !(values[field.key] || '') ? '••••••••' : (field.placeholder || '')}
-                className="w-full px-3 py-2.5 border border-slate-200 rounded-lg text-sm focus:outline-none focus:ring-2 focus:ring-slate-300"
-              />
+              {field.input_type === 'checkbox' ? (
+                <label className="flex items-center gap-2 cursor-pointer select-none">
+                  <input
+                    type="checkbox"
+                    checked={values[field.key] === 'true'}
+                    onChange={e => handleProviderFieldChange(provider.id, field.key, e.target.checked ? 'true' : 'false')}
+                    className="w-4 h-4 rounded border-slate-300 accent-slate-900"
+                  />
+                  <span className="text-sm font-medium text-slate-700">{t(`memories.${field.label}`)}</span>
+                </label>
+              ) : (
+                <>
+                  <label className="block text-sm font-medium text-slate-700 mb-1.5">{t(`memories.${field.label}`)}</label>
+                  <input
+                    type={field.input_type || 'text'}
+                    value={values[field.key] || ''}
+                    onChange={e => handleProviderFieldChange(provider.id, field.key, e.target.value)}
+                    placeholder={field.secret && connected && !(values[field.key] || '') ? '••••••••' : (field.placeholder || '')}
+                    className="w-full px-3 py-2.5 border border-slate-200 rounded-lg text-sm focus:outline-none focus:ring-2 focus:ring-slate-300"
+                  />
+                  {field.hint && (
+                    <p className="mt-1 text-xs text-slate-500">{t(`memories.${field.hint}`)}</p>
+                  )}
+                </>
+              )}
            </div>
          ))}
          <div className="flex items-center gap-3">
@@ -228,11 +268,16 @@ export default function PhotoProvidersSection(): React.ReactElement {
                : <Camera className="w-4 h-4" />}
              {t('memories.testConnection')}
            </button>
-            {connected && (
+            {connected ? (
              <span className="text-xs font-medium text-green-600 flex items-center gap-1">
                <span className="w-2 h-2 bg-green-500 rounded-full" />
                {t('memories.connected')}
              </span>
+            ) : (
+              <span className="text-xs font-medium text-slate-400 flex items-center gap-1">
+                <span className="w-2 h-2 bg-slate-300 rounded-full" />
+                {t('memories.disconnected')}
+              </span>
            )}
          </div>
        </div>
@@ -1,4 +1,4 @@
-import { useState, useEffect } from 'react'
+import { useState, useEffect, useRef } from 'react'
 import Modal from '../shared/Modal'
 import { tripsApi, authApi, shareApi } from '../../api/client'
 import { useToast } from '../shared/Toast'
@@ -40,6 +40,11 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
  const [copied, setCopied] = useState(false)
  const [perms, setPerms] = useState({ share_map: true, share_bookings: true, share_packing: false, share_budget: false, share_collab: false })
  const toast = useToast()
+  const copyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  useEffect(() => {
+    return () => { if (copyTimerRef.current) clearTimeout(copyTimerRef.current) }
+  }, [])

  useEffect(() => {
    shareApi.getLink(tripId).then(d => {
@@ -77,7 +82,8 @@ function ShareLinkSection({ tripId, t }: { tripId: number; t: (key: string, para
    if (shareUrl) {
      navigator.clipboard.writeText(shareUrl)
      setCopied(true)
-      setTimeout(() => setCopied(false), 2000)
+      if (copyTimerRef.current) clearTimeout(copyTimerRef.current)
+      copyTimerRef.current = setTimeout(() => setCopied(false), 2000)
    }
  }

@@ -1,4 +1,4 @@
-import React, { createContext, useContext, useState, useCallback, useEffect } from 'react'
+import React, { useState, useCallback, useEffect, useRef } from 'react'
 import { CheckCircle, XCircle, AlertCircle, Info, X } from 'lucide-react'

 type ToastType = 'success' | 'error' | 'warning' | 'info'
@@ -28,18 +28,27 @@ const ICON_COLORS: Record<ToastType, string> = {

 export function ToastContainer() {
  const [toasts, setToasts] = useState<Toast[]>([])
+  const timersRef = useRef<ReturnType<typeof setTimeout>[]>([])
+
+  useEffect(() => {
+    return () => {
+      timersRef.current.forEach(clearTimeout)
+    }
+  }, [])

  const addToast = useCallback((message: string, type: ToastType = 'info', duration: number = 3000) => {
    const id = ++toastIdCounter
    setToasts(prev => [...prev, { id, message, type, duration, removing: false }])

    if (duration > 0) {
-      setTimeout(() => {
+      const t1 = setTimeout(() => {
        setToasts(prev => prev.map(t => t.id === id ? { ...t, removing: true } : t))
-        setTimeout(() => {
+        const t2 = setTimeout(() => {
          setToasts(prev => prev.filter(t => t.id !== id))
        }, 400)
+        timersRef.current.push(t2)
      }, duration)
+      timersRef.current.push(t1)
    }

    return id
@@ -47,9 +56,10 @@ export function ToastContainer() {

  const removeToast = useCallback((id: number) => {
    setToasts(prev => prev.map(t => t.id === id ? { ...t, removing: true } : t))
-    setTimeout(() => {
+    const t = setTimeout(() => {
      setToasts(prev => prev.filter(t => t.id !== id))
    }, 400)
+    timersRef.current.push(t)
  }, [])

  useEffect(() => {
@@ -184,9 +184,6 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.none': 'معطّل',
  'admin.notifications.email': 'البريد الإلكتروني (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'أحداث الإشعارات',
-  'admin.notifications.eventsHint': 'اختر الأحداث التي تُفعّل الإشعارات لجميع المستخدمين.',
-  'admin.notifications.configureFirst': 'قم بتكوين إعدادات SMTP أو Webhook أدناه أولاً، ثم قم بتفعيل الأحداث.',
  'admin.notifications.save': 'حفظ إعدادات الإشعارات',
  'admin.notifications.saved': 'تم حفظ إعدادات الإشعارات',
  'admin.notifications.testWebhook': 'إرسال webhook تجريبي',
@@ -233,6 +230,7 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'نقطة نهاية MCP',
  'settings.mcp.clientConfig': 'إعداد العميل',
  'settings.mcp.clientConfigHint': 'استبدل <your_token> برمز API من القائمة أدناه. قد يحتاج مسار npx إلى ضبط وفق نظامك (مثلاً C:\\PROGRA~1\\nodejs\\npx.cmd على Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'استبدل <your_client_id> و<your_client_secret> ببيانات الاعتماد المعروضة في عميل OAuth 2.1 الذي أنشأته أعلاه. سيفتح mcp-remote متصفحك لإتمام التفويض في أول اتصال. قد يحتاج مسار npx إلى تعديل حسب نظامك (مثال: C:\PROGRA~1\nodejs\npx.cmd على Windows).',
  'settings.mcp.copy': 'نسخ',
  'settings.mcp.copied': 'تم النسخ!',
  'settings.mcp.apiTokens': 'رموز API',
@@ -254,6 +252,48 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'فشل إنشاء الرمز',
  'settings.mcp.toast.deleted': 'تم حذف الرمز',
  'settings.mcp.toast.deleteError': 'فشل حذف الرمز',
+  'settings.mcp.apiTokensDeprecated': 'رموز API قديمة وستُزال في إصدار مستقبلي. يُرجى استخدام عملاء OAuth 2.1 بدلاً منها.',
+  'settings.oauth.clients': 'عملاء OAuth 2.1',
+  'settings.oauth.clientsHint': 'سجّل عملاء OAuth 2.1 للسماح لتطبيقات MCP الخارجية (Claude Web وCursor وغيرها) بالاتصال دون رموز ثابتة.',
+  'settings.oauth.createClient': 'عميل جديد',
+  'settings.oauth.noClients': 'لا يوجد عملاء OAuth مسجلون.',
+  'settings.oauth.clientId': 'معرّف العميل',
+  'settings.oauth.clientSecret': 'سر العميل',
+  'settings.oauth.deleteClient': 'حذف العميل',
+  'settings.oauth.deleteClientMessage': 'سيتم حذف هذا العميل وجميع الجلسات النشطة بشكل دائم. ستفقد أي تطبيق يستخدمه وصوله فوراً.',
+  'settings.oauth.rotateSecret': 'تجديد السر',
+  'settings.oauth.rotateSecretMessage': 'سيتم إنشاء سر عميل جديد وإبطال جميع الجلسات الحالية فوراً. حدّث تطبيقك قبل إغلاق هذا الحوار.',
+  'settings.oauth.rotateSecretConfirm': 'تجديد',
+  'settings.oauth.rotateSecretConfirming': 'جارٍ التجديد…',
+  'settings.oauth.rotateSecretDoneTitle': 'تم إنشاء سر جديد',
+  'settings.oauth.rotateSecretDoneWarning': 'يُعرض هذا السر مرة واحدة فقط. انسخه الآن وحدّث تطبيقك — تم إبطال جميع الجلسات السابقة.',
+  'settings.oauth.activeSessions': 'جلسات OAuth النشطة',
+  'settings.oauth.sessionScopes': 'النطاقات',
+  'settings.oauth.sessionExpires': 'تنتهي',
+  'settings.oauth.revoke': 'إلغاء',
+  'settings.oauth.revokeSession': 'إلغاء الجلسة',
+  'settings.oauth.revokeSessionMessage': 'سيؤدي هذا إلى إلغاء الوصول لهذه الجلسة OAuth فوراً.',
+  'settings.oauth.modal.createTitle': 'تسجيل عميل OAuth',
+  'settings.oauth.modal.presets': 'إعدادات سريعة',
+  'settings.oauth.modal.clientName': 'اسم التطبيق',
+  'settings.oauth.modal.clientNamePlaceholder': 'مثال: Claude Web، تطبيق MCP الخاص بي',
+  'settings.oauth.modal.redirectUris': 'عناوين URI لإعادة التوجيه',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'عنوان URI واحد لكل سطر. يُطلب HTTPS (localhost مستثنى). يُطبق تطابق دقيق.',
+  'settings.oauth.modal.scopes': 'النطاقات المسموح بها',
+  'settings.oauth.modal.scopesHint': 'list_trips وget_trip_summary متاحان دائماً — لا يُطلب نطاق. يساعدان الذكاء الاصطناعي في اكتشاف معرّفات الرحلات.',
+  'settings.oauth.modal.selectAll': 'تحديد الكل',
+  'settings.oauth.modal.deselectAll': 'إلغاء تحديد الكل',
+  'settings.oauth.modal.creating': 'جارٍ التسجيل…',
+  'settings.oauth.modal.create': 'تسجيل العميل',
+  'settings.oauth.modal.createdTitle': 'تم تسجيل العميل',
+  'settings.oauth.modal.createdWarning': 'يُعرض سر العميل مرة واحدة فقط. انسخه الآن — لا يمكن استرداده.',
+  'settings.oauth.toast.createError': 'فشل تسجيل عميل OAuth',
+  'settings.oauth.toast.deleted': 'تم حذف عميل OAuth',
+  'settings.oauth.toast.deleteError': 'فشل حذف عميل OAuth',
+  'settings.oauth.toast.revoked': 'تم إلغاء الجلسة',
+  'settings.oauth.toast.revokeError': 'فشل إلغاء الجلسة',
+  'settings.oauth.toast.rotateError': 'فشل تجديد سر العميل',
  'settings.account': 'الحساب',
  'settings.about': 'حول',
  'settings.about.reportBug': 'الإبلاغ عن خطأ',
@@ -410,9 +450,10 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'admin.tabs.config': 'التخصيص',
  'admin.tabs.templates': 'قوالب التعبئة',
  'admin.tabs.addons': 'الإضافات',
-  'admin.tabs.mcpTokens': 'رموز MCP',
-  'admin.mcpTokens.title': 'رموز MCP',
-  'admin.mcpTokens.subtitle': 'إدارة رموز API لجميع المستخدمين',
+  'admin.tabs.mcpTokens': 'وصول MCP',
+  'admin.mcpTokens.title': 'وصول MCP',
+  'admin.mcpTokens.subtitle': 'إدارة جلسات OAuth ورموز API لجميع المستخدمين',
+  'admin.mcpTokens.sectionTitle': 'رموز API',
  'admin.mcpTokens.owner': 'المالك',
  'admin.mcpTokens.tokenName': 'اسم الرمز',
  'admin.mcpTokens.created': 'تاريخ الإنشاء',
@@ -424,6 +465,17 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'تم حذف الرمز',
  'admin.mcpTokens.deleteError': 'فشل حذف الرمز',
  'admin.mcpTokens.loadError': 'فشل تحميل الرموز',
+  'admin.oauthSessions.sectionTitle': 'جلسات OAuth',
+  'admin.oauthSessions.clientName': 'العميل',
+  'admin.oauthSessions.owner': 'المالك',
+  'admin.oauthSessions.scopes': 'الصلاحيات',
+  'admin.oauthSessions.created': 'تاريخ الإنشاء',
+  'admin.oauthSessions.empty': 'لا توجد جلسات OAuth نشطة',
+  'admin.oauthSessions.revokeTitle': 'إلغاء الجلسة',
+  'admin.oauthSessions.revokeMessage': 'سيتم إلغاء جلسة OAuth هذه فوراً. سيفقد العميل وصوله إلى MCP.',
+  'admin.oauthSessions.revokeSuccess': 'تم إلغاء الجلسة',
+  'admin.oauthSessions.revokeError': 'فشل إلغاء الجلسة',
+  'admin.oauthSessions.loadError': 'فشل تحميل جلسات OAuth',
  'admin.tabs.github': 'GitHub',
  'admin.stats.users': 'المستخدمون',
  'admin.stats.trips': 'الرحلات',
@@ -1009,6 +1061,7 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'إجمالي الميزانية',
  'budget.byCategory': 'حسب الفئة',
  'budget.editTooltip': 'انقر للتعديل',
+  'budget.linkedToReservation': 'مرتبط بحجز — عدّل الاسم هناك',
  'budget.confirm.deleteCategory': 'هل تريد حذف الفئة "{name}" مع {count} إدخالات؟',
  'budget.deleteCategory': 'حذف الفئة',
  'budget.perPerson': 'لكل شخص',
@@ -1109,6 +1162,9 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'قالب',
  'packing.templateApplied': 'تمت إضافة {count} عنصر من القالب',
  'packing.templateError': 'فشل تطبيق القالب',
+  'packing.saveAsTemplate': 'حفظ كقالب',
+  'packing.templateName': 'اسم القالب',
+  'packing.templateSaved': 'تم حفظ قائمة الحقائب كقالب',
  'packing.bags': 'أمتعة',
  'packing.noBag': 'غير معيّن',
  'packing.totalWeight': 'الوزن الإجمالي',
@@ -1382,6 +1438,7 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'صور',
  'memories.notConnected': 'Immich غير متصل',
  'memories.notConnectedHint': 'قم بتوصيل Immich في الإعدادات لعرض صور رحلتك هنا.',
+  'memories.notConnectedMultipleHint': 'قم بتوصيل أحد موفري الصور هؤلاء: {provider_names} في الإعدادات لتتمكن من إضافة صور إلى هذه الرحلة.',
  'memories.noDates': 'أضف تواريخ لرحلتك لتحميل الصور.',
  'memories.noPhotos': 'لم يتم العثور على صور',
  'memories.noPhotosHint': 'لم يتم العثور على صور في Immich لفترة هذه الرحلة.',
@@ -1392,26 +1449,35 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'مراجعة صورك',
  'memories.reviewHint': 'انقر على الصور لاستبعادها من المشاركة.',
  'memories.shareCount': 'مشاركة {count} صور',
-  'memories.immichUrl': 'عنوان خادم Immich',
-  'memories.immichApiKey': 'مفتاح API',
+  'memories.providerUrl': 'عنوان URL للخادم',
+  'memories.providerApiKey': 'مفتاح API',
+  'memories.providerUsername': 'اسم المستخدم',
+  'memories.providerPassword': 'كلمة المرور',
+  'memories.providerOTP': 'رمز MFA (إذا كان مفعلاً)',
+  'memories.skipSSLVerification': 'تخطي التحقق من شهادة SSL',
+  'memories.providerUrlHintSynology': 'أدرج مسار تطبيق Photos في URL، مثل https://nas:5001/photo',
  'memories.testConnection': 'اختبار الاتصال',
  'memories.testFirst': 'اختبر الاتصال أولاً',
  'memories.connected': 'متصل',
  'memories.disconnected': 'غير متصل',
  'memories.connectionSuccess': 'تم الاتصال بـ Immich',
  'memories.connectionError': 'تعذر الاتصال بـ Immich',
-  'memories.saved': 'تم حفظ إعدادات Immich',
+  'memories.saved': 'تم حفظ إعدادات {provider_name}',
+  'memories.providerDisconnectedBanner': 'اتصالك بـ {provider_name} مفقود. أعد الاتصال في الإعدادات لعرض الصور.',
+  'memories.saveError': 'تعذّر حفظ إعدادات {provider_name}',
  'memories.oldest': 'الأقدم أولاً',
  'memories.newest': 'الأحدث أولاً',
  'memories.allLocations': 'جميع المواقع',
  'memories.addPhotos': 'إضافة صور',
  'memories.linkAlbum': 'ربط ألبوم',
  'memories.selectAlbum': 'اختيار ألبوم Immich',
+  'memories.selectAlbumMultiple': 'اختيار ألبوم',
  'memories.noAlbums': 'لم يتم العثور على ألبومات',
  'memories.syncAlbum': 'مزامنة الألبوم',
  'memories.unlinkAlbum': 'إلغاء الربط',
  'memories.photos': 'صور',
  'memories.selectPhotos': 'اختيار صور من Immich',
+  'memories.selectPhotosMultiple': 'اختيار الصور',
  'memories.selectHint': 'انقر على الصور لتحديدها.',
  'memories.selected': 'محدد',
  'memories.addSelected': 'إضافة {count} صور',
@@ -1568,6 +1634,8 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'تحديد كغير مقروء',
  'notifications.delete': 'حذف',
  'notifications.system': 'النظام',
+  'notifications.synologySessionCleared.title': 'تم قطع اتصال Synology Photos',
+  'notifications.synologySessionCleared.text': 'تغير خادمك أو حسابك — انتقل إلى الإعدادات لاختبار اتصالك مرة أخرى.',
  'memories.error.loadAlbums': 'فشل تحميل الألبومات',
  'memories.error.linkAlbum': 'فشل ربط الألبوم',
  'memories.error.unlinkAlbum': 'فشل إلغاء ربط الألبوم',
@@ -1690,6 +1758,70 @@ const ar: Record<string, string | { name: string; category: string }[]> = {
  'notif.generic.text': 'لديك إشعار جديد',
  'notif.dev.unknown_event.title': '[DEV] حدث غير معروف',
  'notif.dev.unknown_event.text': 'نوع الحدث "{event}" غير مسجل في EVENT_NOTIFICATION_CONFIG',
+
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'الرحلات',
+  'oauth.scope.group.places': 'الأماكن',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'الأمتعة',
+  'oauth.scope.group.todos': 'المهام',
+  'oauth.scope.group.budget': 'الميزانية',
+  'oauth.scope.group.reservations': 'الحجوزات',
+  'oauth.scope.group.collab': 'التعاون',
+  'oauth.scope.group.notifications': 'الإشعارات',
+  'oauth.scope.group.vacay': 'الإجازة',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'الطقس',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'عرض الرحلات وخطط السفر',
+  'oauth.scope.trips:read.description': 'قراءة الرحلات والأيام والملاحظات والأعضاء',
+  'oauth.scope.trips:write.label': 'تحرير الرحلات وخطط السفر',
+  'oauth.scope.trips:write.description': 'إنشاء وتحديث الرحلات والأيام والملاحظات وإدارة الأعضاء',
+  'oauth.scope.trips:delete.label': 'حذف الرحلات',
+  'oauth.scope.trips:delete.description': 'حذف الرحلات بأكملها نهائياً — هذا الإجراء لا يمكن التراجع عنه',
+  'oauth.scope.trips:share.label': 'إدارة روابط المشاركة',
+  'oauth.scope.trips:share.description': 'إنشاء روابط مشاركة عامة وتحديثها وإلغاؤها',
+  'oauth.scope.places:read.label': 'عرض الأماكن وبيانات الخريطة',
+  'oauth.scope.places:read.description': 'قراءة الأماكن وتعيينات الأيام والعلامات والفئات',
+  'oauth.scope.places:write.label': 'إدارة الأماكن',
+  'oauth.scope.places:write.description': 'إنشاء وتحديث وحذف الأماكن والتعيينات والعلامات',
+  'oauth.scope.atlas:read.label': 'عرض Atlas',
+  'oauth.scope.atlas:read.description': 'قراءة الدول والمناطق المزارة وقائمة الأمنيات',
+  'oauth.scope.atlas:write.label': 'إدارة Atlas',
+  'oauth.scope.atlas:write.description': 'تعليم الدول والمناطق كمزارة، وإدارة قائمة الأمنيات',
+  'oauth.scope.packing:read.label': 'عرض قوائم الأمتعة',
+  'oauth.scope.packing:read.description': 'قراءة عناصر الأمتعة والحقائب ومُسنَدي الفئات',
+  'oauth.scope.packing:write.label': 'إدارة قوائم الأمتعة',
+  'oauth.scope.packing:write.description': 'إضافة وتحديث وحذف وتبديل وإعادة ترتيب عناصر الأمتعة والحقائب',
+  'oauth.scope.todos:read.label': 'عرض قوائم المهام',
+  'oauth.scope.todos:read.description': 'قراءة مهام الرحلة ومُسنَدي الفئات',
+  'oauth.scope.todos:write.label': 'إدارة قوائم المهام',
+  'oauth.scope.todos:write.description': 'إنشاء وتحديث وتبديل وحذف وإعادة ترتيب المهام',
+  'oauth.scope.budget:read.label': 'عرض الميزانية',
+  'oauth.scope.budget:read.description': 'قراءة بنود الميزانية وتفاصيل النفقات',
+  'oauth.scope.budget:write.label': 'إدارة الميزانية',
+  'oauth.scope.budget:write.description': 'إنشاء وتحديث وحذف بنود الميزانية',
+  'oauth.scope.reservations:read.label': 'عرض الحجوزات',
+  'oauth.scope.reservations:read.description': 'قراءة الحجوزات وتفاصيل الإقامة',
+  'oauth.scope.reservations:write.label': 'إدارة الحجوزات',
+  'oauth.scope.reservations:write.description': 'إنشاء وتحديث وحذف وإعادة ترتيب الحجوزات',
+  'oauth.scope.collab:read.label': 'عرض التعاون',
+  'oauth.scope.collab:read.description': 'قراءة ملاحظات التعاون والاستطلاعات والرسائل',
+  'oauth.scope.collab:write.label': 'إدارة التعاون',
+  'oauth.scope.collab:write.description': 'إنشاء وتحديث وحذف الملاحظات والاستطلاعات والرسائل التعاونية',
+  'oauth.scope.notifications:read.label': 'عرض الإشعارات',
+  'oauth.scope.notifications:read.description': 'قراءة إشعارات التطبيق وأعداد غير المقروءة',
+  'oauth.scope.notifications:write.label': 'إدارة الإشعارات',
+  'oauth.scope.notifications:write.description': 'تعليم الإشعارات كمقروءة والرد عليها',
+  'oauth.scope.vacay:read.label': 'عرض خطط الإجازة',
+  'oauth.scope.vacay:read.description': 'قراءة بيانات تخطيط الإجازة والإدخالات والإحصاءات',
+  'oauth.scope.vacay:write.label': 'إدارة خطط الإجازة',
+  'oauth.scope.vacay:write.description': 'إنشاء وإدارة إدخالات الإجازة والعطلات وخطط الفريق',
+  'oauth.scope.geo:read.label': 'الخرائط والترميز الجغرافي',
+  'oauth.scope.geo:read.description': 'البحث عن مواقع وحل عناوين الخرائط والترميز الجغرافي العكسي للإحداثيات',
+  'oauth.scope.weather:read.label': 'توقعات الطقس',
+  'oauth.scope.weather:read.description': 'جلب توقعات الطقس لمواقع الرحلة وتواريخها',
 }

 export default ar
@@ -179,9 +179,6 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.none': 'Desativado',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Eventos de notificação',
-  'admin.notifications.eventsHint': 'Escolha quais eventos acionam notificações para todos os usuários.',
-  'admin.notifications.configureFirst': 'Configure primeiro as configurações SMTP ou webhook abaixo, depois ative os eventos.',
  'admin.notifications.save': 'Salvar configurações de notificação',
  'admin.notifications.saved': 'Configurações de notificação salvas',
  'admin.notifications.testWebhook': 'Enviar webhook de teste',
@@ -295,6 +292,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'Endpoint MCP',
  'settings.mcp.clientConfig': 'Configuração do cliente',
  'settings.mcp.clientConfigHint': 'Substitua <your_token> por um token de API da lista abaixo. O caminho para o npx pode precisar ser ajustado para o seu sistema (ex.: C:\\PROGRA~1\\nodejs\\npx.cmd no Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Substitua <your_client_id> e <your_client_secret> pelas credenciais exibidas no cliente OAuth 2.1 criado acima. O mcp-remote abrirá seu navegador para concluir a autorização na primeira conexão. O caminho para o npx pode precisar ser ajustado para seu sistema (ex.: C:\\PROGRA~1\\nodejs\\npx.cmd no Windows).',
  'settings.mcp.copy': 'Copiar',
  'settings.mcp.copied': 'Copiado!',
  'settings.mcp.apiTokens': 'Tokens de API',
@@ -316,6 +314,48 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Falha ao criar token',
  'settings.mcp.toast.deleted': 'Token excluído',
  'settings.mcp.toast.deleteError': 'Falha ao excluir token',
+  'settings.mcp.apiTokensDeprecated': 'Os tokens de API estão obsoletos e serão removidos em uma versão futura. Por favor, use Clientes OAuth 2.1.',
+  'settings.oauth.clients': 'Clientes OAuth 2.1',
+  'settings.oauth.clientsHint': 'Registre clientes OAuth 2.1 para permitir que aplicações MCP de terceiros (Claude Web, Cursor, etc.) se conectem sem tokens estáticos.',
+  'settings.oauth.createClient': 'Novo cliente',
+  'settings.oauth.noClients': 'Nenhum cliente OAuth registrado.',
+  'settings.oauth.clientId': 'ID do cliente',
+  'settings.oauth.clientSecret': 'Segredo do cliente',
+  'settings.oauth.deleteClient': 'Excluir cliente',
+  'settings.oauth.deleteClientMessage': 'Este cliente e todas as sessões ativas serão removidos permanentemente. Qualquer aplicação que o utilize perderá o acesso imediatamente.',
+  'settings.oauth.rotateSecret': 'Renovar segredo',
+  'settings.oauth.rotateSecretMessage': 'Um novo segredo de cliente será gerado e todas as sessões existentes serão invalidadas imediatamente. Atualize sua aplicação antes de fechar esta janela.',
+  'settings.oauth.rotateSecretConfirm': 'Renovar',
+  'settings.oauth.rotateSecretConfirming': 'Renovando…',
+  'settings.oauth.rotateSecretDoneTitle': 'Novo segredo gerado',
+  'settings.oauth.rotateSecretDoneWarning': 'Este segredo é exibido apenas uma vez. Copie-o agora e atualize sua aplicação — todas as sessões anteriores foram invalidadas.',
+  'settings.oauth.activeSessions': 'Sessões OAuth ativas',
+  'settings.oauth.sessionScopes': 'Escopos',
+  'settings.oauth.sessionExpires': 'Expira',
+  'settings.oauth.revoke': 'Revogar',
+  'settings.oauth.revokeSession': 'Revogar sessão',
+  'settings.oauth.revokeSessionMessage': 'Isso revogará imediatamente o acesso desta sessão OAuth.',
+  'settings.oauth.modal.createTitle': 'Registrar cliente OAuth',
+  'settings.oauth.modal.presets': 'Configurações rápidas',
+  'settings.oauth.modal.clientName': 'Nome da aplicação',
+  'settings.oauth.modal.clientNamePlaceholder': 'ex.: Claude Web, Meu app MCP',
+  'settings.oauth.modal.redirectUris': 'URIs de redirecionamento',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Uma URI por linha. HTTPS obrigatório (localhost isento). Correspondência exata.',
+  'settings.oauth.modal.scopes': 'Escopos permitidos',
+  'settings.oauth.modal.scopesHint': 'list_trips e get_trip_summary estão sempre disponíveis — sem escopo necessário. Permitem à IA descobrir IDs de viagem.',
+  'settings.oauth.modal.selectAll': 'Selecionar tudo',
+  'settings.oauth.modal.deselectAll': 'Desmarcar tudo',
+  'settings.oauth.modal.creating': 'Registrando…',
+  'settings.oauth.modal.create': 'Registrar cliente',
+  'settings.oauth.modal.createdTitle': 'Cliente registrado',
+  'settings.oauth.modal.createdWarning': 'O segredo do cliente é exibido apenas uma vez. Copie-o agora — não pode ser recuperado.',
+  'settings.oauth.toast.createError': 'Falha ao registrar cliente OAuth',
+  'settings.oauth.toast.deleted': 'Cliente OAuth excluído',
+  'settings.oauth.toast.deleteError': 'Falha ao excluir cliente OAuth',
+  'settings.oauth.toast.revoked': 'Sessão revogada',
+  'settings.oauth.toast.revokeError': 'Falha ao revogar sessão',
+  'settings.oauth.toast.rotateError': 'Falha ao renovar segredo do cliente',
  'settings.mustChangePassword': 'Você deve alterar sua senha antes de continuar. Defina uma nova senha abaixo.',

  // Login
@@ -463,7 +503,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'admin.keyValid': 'Conectado',
  'admin.keyInvalid': 'Inválida',
  'admin.keySaved': 'Chaves de API salvas',
-  'admin.oidcTitle': 'Single Sign-On (OIDC)',
+  'admin.oidcTitle': 'Login Único (OIDC)',
  'admin.oidcSubtitle': 'Permitir login via provedores externos como Google, Apple, Authentik ou Keycloak.',
  'admin.oidcDisplayName': 'Nome exibido',
  'admin.oidcIssuer': 'URL do emissor',
@@ -513,7 +553,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'admin.addons.catalog.budget.description': 'Acompanhe despesas e planeje o orçamento da viagem',
  'admin.addons.catalog.documents.name': 'Documentos',
  'admin.addons.catalog.documents.description': 'Armazene e gerencie documentos de viagem',
-  'admin.addons.catalog.vacay.name': 'Vacay',
+  'admin.addons.catalog.vacay.name': 'Férias',
  'admin.addons.catalog.vacay.description': 'Planejador de férias pessoal com visão em calendário',
  'admin.addons.catalog.atlas.name': 'Atlas',
  'admin.addons.catalog.atlas.description': 'Mapa mundial com países visitados e estatísticas',
@@ -546,7 +586,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'admin.weather.requestsDesc': 'Grátis, sem chave de API',
  'admin.weather.locationHint': 'O clima usa o primeiro lugar com coordenadas de cada dia. Se nenhum lugar estiver atribuído ao dia, qualquer lugar da lista serve como referência.',

-  'admin.tabs.audit': 'Audit',
+  'admin.tabs.audit': 'Auditoria',

  'admin.audit.subtitle': 'Eventos sensíveis de segurança e administração (backups, usuários, 2FA, configurações).',
  'admin.audit.empty': 'Nenhum registro de auditoria.',
@@ -990,6 +1030,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'Orçamento total',
  'budget.byCategory': 'Por categoria',
  'budget.editTooltip': 'Clique para editar',
+  'budget.linkedToReservation': 'Vinculado a uma reserva — edite o nome por lá',
  'budget.confirm.deleteCategory': 'Excluir a categoria "{name}" com {count} lançamento(s)?',
  'budget.deleteCategory': 'Excluir categoria',
  'budget.perPerson': 'Por pessoa',
@@ -1090,6 +1131,9 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'Modelo',
  'packing.templateApplied': '{count} itens adicionados do modelo',
  'packing.templateError': 'Falha ao aplicar modelo',
+  'packing.saveAsTemplate': 'Salvar como modelo',
+  'packing.templateName': 'Nome do modelo',
+  'packing.templateSaved': 'Lista de bagagem salva como modelo',
  'packing.bags': 'Malas',
  'packing.noBag': 'Sem mala',
  'packing.totalWeight': 'Peso total',
@@ -1433,6 +1477,7 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Fotos',
  'memories.notConnected': 'Immich não conectado',
  'memories.notConnectedHint': 'Conecte sua instância Immich nas Configurações para ver suas fotos de viagem aqui.',
+  'memories.notConnectedMultipleHint': 'Conecte um destes provedores de fotos: {provider_names} nas Configurações para poder adicionar fotos a esta viagem.',
  'memories.noDates': 'Adicione datas à sua viagem para carregar fotos.',
  'memories.noPhotos': 'Nenhuma foto encontrada',
  'memories.noPhotosHint': 'Nenhuma foto encontrada no Immich para o período desta viagem.',
@@ -1443,23 +1488,32 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Revise suas fotos',
  'memories.reviewHint': 'Clique nas fotos para excluí-las do compartilhamento.',
  'memories.shareCount': 'Compartilhar {count} fotos',
-  'memories.immichUrl': 'URL do servidor Immich',
-  'memories.immichApiKey': 'Chave da API',
+  'memories.providerUrl': 'URL do servidor',
+  'memories.providerApiKey': 'Chave de API',
+  'memories.providerUsername': 'Nome de usuário',
+  'memories.providerPassword': 'Senha',
+  'memories.providerOTP': 'Código MFA (se habilitado)',
+  'memories.skipSSLVerification': 'Pular verificação de certificado SSL',
+  'memories.providerUrlHintSynology': 'Inclua o caminho do aplicativo Photos na URL, ex. https://nas:5001/photo',
  'memories.testConnection': 'Testar conexão',
  'memories.testFirst': 'Teste a conexão primeiro',
  'memories.connected': 'Conectado',
  'memories.disconnected': 'Não conectado',
  'memories.connectionSuccess': 'Conectado ao Immich',
  'memories.connectionError': 'Não foi possível conectar ao Immich',
-  'memories.saved': 'Configurações do Immich salvas',
+  'memories.saved': 'Configurações do {provider_name} salvas',
+  'memories.providerDisconnectedBanner': 'Sua conexão com {provider_name} foi perdida. Reconecte nas Configurações para ver as fotos.',
+  'memories.saveError': 'Não foi possível salvar as configurações de {provider_name}',
  'memories.addPhotos': 'Adicionar fotos',
  'memories.linkAlbum': 'Vincular álbum',
  'memories.selectAlbum': 'Selecionar álbum do Immich',
+  'memories.selectAlbumMultiple': 'Selecionar álbum',
  'memories.noAlbums': 'Nenhum álbum encontrado',
  'memories.syncAlbum': 'Sincronizar álbum',
  'memories.unlinkAlbum': 'Desvincular',
  'memories.photos': 'fotos',
  'memories.selectPhotos': 'Selecionar fotos do Immich',
+  'memories.selectPhotosMultiple': 'Selecionar fotos',
  'memories.selectHint': 'Toque nas fotos para selecioná-las.',
  'memories.selected': 'selecionadas',
  'memories.addSelected': 'Adicionar {count} fotos',
@@ -1477,9 +1531,10 @@ const br: Record<string, string | { name: string; category: string }[]> = {

  // Permissions
  'admin.tabs.permissions': 'Permissões',
-  'admin.tabs.mcpTokens': 'Tokens MCP',
-  'admin.mcpTokens.title': 'Tokens MCP',
-  'admin.mcpTokens.subtitle': 'Gerenciar tokens de API de todos os usuários',
+  'admin.tabs.mcpTokens': 'Acesso MCP',
+  'admin.mcpTokens.title': 'Acesso MCP',
+  'admin.mcpTokens.subtitle': 'Gerenciar sessões OAuth e tokens de API de todos os usuários',
+  'admin.mcpTokens.sectionTitle': 'Tokens de API',
  'admin.mcpTokens.owner': 'Proprietário',
  'admin.mcpTokens.tokenName': 'Nome do Token',
  'admin.mcpTokens.created': 'Criado',
@@ -1491,6 +1546,17 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token excluído',
  'admin.mcpTokens.deleteError': 'Falha ao excluir token',
  'admin.mcpTokens.loadError': 'Falha ao carregar tokens',
+  'admin.oauthSessions.sectionTitle': 'Sessões OAuth',
+  'admin.oauthSessions.clientName': 'Cliente',
+  'admin.oauthSessions.owner': 'Proprietário',
+  'admin.oauthSessions.scopes': 'Permissões',
+  'admin.oauthSessions.created': 'Criado',
+  'admin.oauthSessions.empty': 'Nenhuma sessão OAuth ativa',
+  'admin.oauthSessions.revokeTitle': 'Revogar sessão',
+  'admin.oauthSessions.revokeMessage': 'Esta sessão OAuth será revogada imediatamente. O cliente perderá o acesso MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Sessão revogada',
+  'admin.oauthSessions.revokeError': 'Falha ao revogar sessão',
+  'admin.oauthSessions.loadError': 'Falha ao carregar sessões OAuth',
  'perm.title': 'Configurações de Permissões',
  'perm.subtitle': 'Controle quem pode realizar ações no aplicativo',
  'perm.saved': 'Configurações de permissões salvas',
@@ -1563,6 +1629,8 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Marcar como não lido',
  'notifications.delete': 'Excluir',
  'notifications.system': 'Sistema',
+  'notifications.synologySessionCleared.title': 'Synology Photos desconectado',
+  'notifications.synologySessionCleared.text': 'Seu servidor ou conta foi alterado — vá para Configurações para testar sua conexão novamente.',
  'memories.error.loadAlbums': 'Falha ao carregar álbuns',
  'memories.error.linkAlbum': 'Falha ao vincular álbum',
  'memories.error.unlinkAlbum': 'Falha ao desvincular álbum',
@@ -1918,6 +1986,70 @@ const br: Record<string, string | { name: string; category: string }[]> = {
  'dayplan.mobile.createNew': 'Criar novo lugar',
  'admin.addons.catalog.journey.name': 'Jornada',
  'admin.addons.catalog.journey.description': 'Rastreamento de viagens e diário de viajante com check-ins, fotos e histórias diárias',
+
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Viagens',
+  'oauth.scope.group.places': 'Locais',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Bagagem',
+  'oauth.scope.group.todos': 'Tarefas',
+  'oauth.scope.group.budget': 'Orçamento',
+  'oauth.scope.group.reservations': 'Reservas',
+  'oauth.scope.group.collab': 'Colaboração',
+  'oauth.scope.group.notifications': 'Notificações',
+  'oauth.scope.group.vacay': 'Férias',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Clima',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Ver viagens e itinerários',
+  'oauth.scope.trips:read.description': 'Ler viagens, dias, notas e membros',
+  'oauth.scope.trips:write.label': 'Editar viagens e itinerários',
+  'oauth.scope.trips:write.description': 'Criar e atualizar viagens, dias, notas e gerenciar membros',
+  'oauth.scope.trips:delete.label': 'Excluir viagens',
+  'oauth.scope.trips:delete.description': 'Excluir viagens permanentemente — esta ação é irreversível',
+  'oauth.scope.trips:share.label': 'Gerenciar links de compartilhamento',
+  'oauth.scope.trips:share.description': 'Criar, atualizar e revogar links de compartilhamento públicos',
+  'oauth.scope.places:read.label': 'Ver locais e dados do mapa',
+  'oauth.scope.places:read.description': 'Ler locais, atribuições de dias, tags e categorias',
+  'oauth.scope.places:write.label': 'Gerenciar locais',
+  'oauth.scope.places:write.description': 'Criar, atualizar e excluir locais, atribuições e tags',
+  'oauth.scope.atlas:read.label': 'Ver Atlas',
+  'oauth.scope.atlas:read.description': 'Ler países visitados, regiões e lista de desejos',
+  'oauth.scope.atlas:write.label': 'Gerenciar Atlas',
+  'oauth.scope.atlas:write.description': 'Marcar países e regiões como visitados, gerenciar lista de desejos',
+  'oauth.scope.packing:read.label': 'Ver listas de bagagem',
+  'oauth.scope.packing:read.description': 'Ler itens, malas e responsáveis por categoria',
+  'oauth.scope.packing:write.label': 'Gerenciar listas de bagagem',
+  'oauth.scope.packing:write.description': 'Adicionar, atualizar, excluir, marcar e reordenar itens e malas',
+  'oauth.scope.todos:read.label': 'Ver listas de tarefas',
+  'oauth.scope.todos:read.description': 'Ler tarefas da viagem e responsáveis por categoria',
+  'oauth.scope.todos:write.label': 'Gerenciar listas de tarefas',
+  'oauth.scope.todos:write.description': 'Criar, atualizar, marcar, excluir e reordenar tarefas',
+  'oauth.scope.budget:read.label': 'Ver orçamento',
+  'oauth.scope.budget:read.description': 'Ler itens de orçamento e detalhamento de despesas',
+  'oauth.scope.budget:write.label': 'Gerenciar orçamento',
+  'oauth.scope.budget:write.description': 'Criar, atualizar e excluir itens de orçamento',
+  'oauth.scope.reservations:read.label': 'Ver reservas',
+  'oauth.scope.reservations:read.description': 'Ler reservas e detalhes de acomodação',
+  'oauth.scope.reservations:write.label': 'Gerenciar reservas',
+  'oauth.scope.reservations:write.description': 'Criar, atualizar, excluir e reordenar reservas',
+  'oauth.scope.collab:read.label': 'Ver colaboração',
+  'oauth.scope.collab:read.description': 'Ler notas colaborativas, enquetes e mensagens',
+  'oauth.scope.collab:write.label': 'Gerenciar colaboração',
+  'oauth.scope.collab:write.description': 'Criar, atualizar e excluir notas, enquetes e mensagens',
+  'oauth.scope.notifications:read.label': 'Ver notificações',
+  'oauth.scope.notifications:read.description': 'Ler notificações e contagens não lidas',
+  'oauth.scope.notifications:write.label': 'Gerenciar notificações',
+  'oauth.scope.notifications:write.description': 'Marcar notificações como lidas e respondê-las',
+  'oauth.scope.vacay:read.label': 'Ver planos de férias',
+  'oauth.scope.vacay:read.description': 'Ler dados de planejamento de férias, entradas e estatísticas',
+  'oauth.scope.vacay:write.label': 'Gerenciar planos de férias',
+  'oauth.scope.vacay:write.description': 'Criar e gerenciar entradas de férias, feriados e planos de equipe',
+  'oauth.scope.geo:read.label': 'Mapas e geocodificação',
+  'oauth.scope.geo:read.description': 'Pesquisar locais, resolver URLs de mapa e geocodificar coordenadas',
+  'oauth.scope.weather:read.label': 'Previsão do tempo',
+  'oauth.scope.weather:read.description': 'Obter previsão do tempo para locais e datas da viagem',
 }

 export default br
@@ -181,6 +181,7 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'MCP endpoint',
  'settings.mcp.clientConfig': 'Konfigurace klienta',
  'settings.mcp.clientConfigHint': 'Nahraďte <your_token> API tokenem ze seznamu níže. Cestu k npx může být nutné upravit pro váš systém (např. C:\\PROGRA~1\\nodejs\\npx.cmd ve Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Nahraďte <your_client_id> a <your_client_secret> přihlašovacími údaji ze klienta OAuth 2.1, který jste vytvořili výše. mcp-remote při prvním připojení otevře prohlížeč pro dokončení autorizace. Cestu k npx může být nutné upravit pro váš systém (např. C:\\PROGRA~1\\nodejs\\npx.cmd ve Windows).',
  'settings.mcp.copy': 'Kopírovat',
  'settings.mcp.copied': 'Zkopírováno!',
  'settings.mcp.apiTokens': 'API tokeny',
@@ -202,6 +203,48 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Nepodařilo se vytvořit token',
  'settings.mcp.toast.deleted': 'Token smazán',
  'settings.mcp.toast.deleteError': 'Nepodařilo se smazat token',
+  'settings.mcp.apiTokensDeprecated': 'API tokeny jsou zastaralé a budou odstraněny v budoucí verzi. Místo toho použijte klienty OAuth 2.1.',
+  'settings.oauth.clients': 'Klienti OAuth 2.1',
+  'settings.oauth.clientsHint': 'Zaregistrujte klienty OAuth 2.1, aby se aplikace MCP třetích stran (Claude Web, Cursor atd.) mohly připojit bez statických tokenů.',
+  'settings.oauth.createClient': 'Nový klient',
+  'settings.oauth.noClients': 'Žádní klienti OAuth nejsou zaregistrováni.',
+  'settings.oauth.clientId': 'ID klienta',
+  'settings.oauth.clientSecret': 'Tajný klíč klienta',
+  'settings.oauth.deleteClient': 'Smazat klienta',
+  'settings.oauth.deleteClientMessage': 'Tento klient a všechny aktivní relace budou trvale odstraněny. Jakákoliv aplikace, která ho používá, okamžitě ztratí přístup.',
+  'settings.oauth.rotateSecret': 'Obnovit tajný klíč',
+  'settings.oauth.rotateSecretMessage': 'Bude vygenerován nový tajný klíč klienta a všechny stávající relace budou okamžitě zneplatněny. Aktualizujte aplikaci před zavřením tohoto dialogu.',
+  'settings.oauth.rotateSecretConfirm': 'Obnovit',
+  'settings.oauth.rotateSecretConfirming': 'Obnovování…',
+  'settings.oauth.rotateSecretDoneTitle': 'Nový tajný klíč vygenerován',
+  'settings.oauth.rotateSecretDoneWarning': 'Tento tajný klíč se zobrazí pouze jednou. Zkopírujte ho nyní a aktualizujte aplikaci — všechny předchozí relace byly zneplatněny.',
+  'settings.oauth.activeSessions': 'Aktivní relace OAuth',
+  'settings.oauth.sessionScopes': 'Oprávnění',
+  'settings.oauth.sessionExpires': 'Vyprší',
+  'settings.oauth.revoke': 'Odvolat',
+  'settings.oauth.revokeSession': 'Odvolat relaci',
+  'settings.oauth.revokeSessionMessage': 'Tím se okamžitě odvolá přístup pro tuto relaci OAuth.',
+  'settings.oauth.modal.createTitle': 'Zaregistrovat klienta OAuth',
+  'settings.oauth.modal.presets': 'Rychlá nastavení',
+  'settings.oauth.modal.clientName': 'Název aplikace',
+  'settings.oauth.modal.clientNamePlaceholder': 'např. Claude Web, Moje MCP aplikace',
+  'settings.oauth.modal.redirectUris': 'Přesměrovací URI',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Jedno URI na řádek. Vyžadováno HTTPS (localhost vyjmuto). Vyžadována přesná shoda.',
+  'settings.oauth.modal.scopes': 'Povolená oprávnění',
+  'settings.oauth.modal.scopesHint': 'list_trips a get_trip_summary jsou vždy dostupné — bez požadovaného oprávnění. Umožňují AI zjistit potřebná ID výletů.',
+  'settings.oauth.modal.selectAll': 'Vybrat vše',
+  'settings.oauth.modal.deselectAll': 'Zrušit výběr',
+  'settings.oauth.modal.creating': 'Registrování…',
+  'settings.oauth.modal.create': 'Zaregistrovat klienta',
+  'settings.oauth.modal.createdTitle': 'Klient zaregistrován',
+  'settings.oauth.modal.createdWarning': 'Tajný klíč klienta se zobrazí pouze jednou. Zkopírujte ho nyní — nelze ho obnovit.',
+  'settings.oauth.toast.createError': 'Registrace klienta OAuth se nezdařila',
+  'settings.oauth.toast.deleted': 'Klient OAuth smazán',
+  'settings.oauth.toast.deleteError': 'Smazání klienta OAuth se nezdařilo',
+  'settings.oauth.toast.revoked': 'Relace odvolána',
+  'settings.oauth.toast.revokeError': 'Odvolání relace se nezdařilo',
+  'settings.oauth.toast.rotateError': 'Obnovení tajného klíče klienta se nezdařilo',
  'settings.account': 'Účet',
  'settings.about': 'O aplikaci',
  'settings.about.reportBug': 'Nahlásit chybu',
@@ -274,9 +317,6 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.none': 'Vypnuto',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Události oznámení',
-  'admin.notifications.eventsHint': 'Vyberte, které události spouštějí oznámení pro všechny uživatele.',
-  'admin.notifications.configureFirst': 'Nejprve nakonfigurujte nastavení SMTP nebo webhooku níže, poté povolte události.',
  'admin.notifications.save': 'Uložit nastavení oznámení',
  'admin.notifications.saved': 'Nastavení oznámení uloženo',
  'admin.notifications.testWebhook': 'Odeslat testovací webhook',
@@ -550,9 +590,10 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'admin.audit.col.details': 'Detaily',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP tokeny',
-  'admin.mcpTokens.title': 'MCP tokeny',
-  'admin.mcpTokens.subtitle': 'Správa API tokenů všech uživatelů',
+  'admin.tabs.mcpTokens': 'MCP přístup',
+  'admin.mcpTokens.title': 'MCP přístup',
+  'admin.mcpTokens.subtitle': 'Správa OAuth relací a API tokenů všech uživatelů',
+  'admin.mcpTokens.sectionTitle': 'API tokeny',
  'admin.mcpTokens.owner': 'Vlastník',
  'admin.mcpTokens.tokenName': 'Název tokenu',
  'admin.mcpTokens.created': 'Vytvořen',
@@ -564,6 +605,17 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token smazán',
  'admin.mcpTokens.deleteError': 'Nepodařilo se smazat token',
  'admin.mcpTokens.loadError': 'Nepodařilo se načíst tokeny',
+  'admin.oauthSessions.sectionTitle': 'OAuth relace',
+  'admin.oauthSessions.clientName': 'Klient',
+  'admin.oauthSessions.owner': 'Vlastník',
+  'admin.oauthSessions.scopes': 'Oprávnění',
+  'admin.oauthSessions.created': 'Vytvořeno',
+  'admin.oauthSessions.empty': 'Žádné aktivní OAuth relace',
+  'admin.oauthSessions.revokeTitle': 'Zrušit relaci',
+  'admin.oauthSessions.revokeMessage': 'Tato OAuth relace bude okamžitě zrušena. Klient ztratí přístup k MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Relace zrušena',
+  'admin.oauthSessions.revokeError': 'Nepodařilo se zrušit relaci',
+  'admin.oauthSessions.loadError': 'Nepodařilo se načíst OAuth relace',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1007,6 +1059,7 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'Celkový rozpočet',
  'budget.byCategory': 'Podle kategorie',
  'budget.editTooltip': 'Klikněte pro úpravu',
+  'budget.linkedToReservation': 'Propojeno s rezervací — název upravte tam',
  'budget.confirm.deleteCategory': 'Opravdu chcete smazat kategorii „{name}” s {count} položkami?',
  'budget.deleteCategory': 'Smazat kategorii',
  'budget.perPerson': 'Na osobu',
@@ -1097,7 +1150,7 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'packing.menuCheckAll': 'Označit vše',
  'packing.menuUncheckAll': 'Odznačit vše',
  'packing.menuDeleteCat': 'Smazat kategorii',
-  'packing.assignUser': 'Přiřadit uživateli',
+  'packing.assignUser': 'Přiřadit uživatele',
  'packing.noMembers': 'Žádní členové cesty',
  'packing.addItem': 'Přidat položku',
  'packing.addItemPlaceholder': 'Název položky...',
@@ -1107,6 +1160,9 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'Šablona',
  'packing.templateApplied': '{count} položek přidáno ze šablony',
  'packing.templateError': 'Šablonu se nepodařilo použít',
+  'packing.saveAsTemplate': 'Uložit jako šablonu',
+  'packing.templateName': 'Název šablony',
+  'packing.templateSaved': 'Seznam balení uložen jako šablona',
  'packing.bags': 'Zavazadla',
  'packing.noBag': 'Nepřiřazeno',
  'packing.totalWeight': 'Celková váha',
@@ -1380,6 +1436,7 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Fotky',
  'memories.notConnected': 'Immich není připojen',
  'memories.notConnectedHint': 'Připojte svoji instanci Immich v Nastavení, abyste zde viděli fotky z cest.',
+  'memories.notConnectedMultipleHint': 'Pro přidání fotek k tomuto výletu připojte v Nastavení jednoho z těchto poskytovatelů fotek: {provider_names}.',
  'memories.noDates': 'Přidejte data k cestě pro načtení fotek.',
  'memories.noPhotos': 'Nenalezeny žádné fotky',
  'memories.noPhotosHint': 'V Immich nebyly nalezeny žádné fotky pro období této cesty.',
@@ -1390,23 +1447,32 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Zkontrolujte své fotky',
  'memories.reviewHint': 'Klikněte na fotky pro vyloučení ze sdílení.',
  'memories.shareCount': 'Sdílet {count} fotek',
-  'memories.immichUrl': 'URL serveru Immich',
-  'memories.immichApiKey': 'API klíč',
+  'memories.providerUrl': 'URL serveru',
+  'memories.providerApiKey': 'API klíč',
+  'memories.providerUsername': 'Uživatelské jméno',
+  'memories.providerPassword': 'Heslo',
+  'memories.providerOTP': 'MFA kód (pokud je povoleno)',
+  'memories.skipSSLVerification': 'Přeskočit ověření SSL certifikátu',
+  'memories.providerUrlHintSynology': 'Zahrňte cestu aplikace Photos do URL, např. https://nas:5001/photo',
  'memories.testConnection': 'Otestovat připojení',
  'memories.testFirst': 'Nejprve otestujte připojení',
  'memories.connected': 'Připojeno',
  'memories.disconnected': 'Nepřipojeno',
  'memories.connectionSuccess': 'Připojeno k Immich',
  'memories.connectionError': 'Nepodařilo se připojit k Immich',
-  'memories.saved': 'Nastavení Immich uloženo',
+  'memories.saved': 'Nastavení {provider_name} uloženo',
+  'memories.providerDisconnectedBanner': 'Vaše připojení k {provider_name} bylo ztraceno. Obnovte připojení v Nastavení pro zobrazení fotek.',
+  'memories.saveError': 'Nepodařilo se uložit nastavení {provider_name}',
  'memories.addPhotos': 'Přidat fotky',
  'memories.linkAlbum': 'Propojit album',
  'memories.selectAlbum': 'Vybrat album z Immich',
+  'memories.selectAlbumMultiple': 'Vybrat album',
  'memories.noAlbums': 'Žádná alba nenalezena',
  'memories.syncAlbum': 'Synchronizovat album',
  'memories.unlinkAlbum': 'Odpojit',
  'memories.photos': 'fotek',
  'memories.selectPhotos': 'Vybrat fotky z Immich',
+  'memories.selectPhotosMultiple': 'Vybrat fotky',
  'memories.selectHint': 'Klepněte na fotky pro jejich výběr.',
  'memories.selected': 'vybráno',
  'memories.addSelected': 'Přidat {count} fotek',
@@ -1566,6 +1632,8 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Označit jako nepřečtené',
  'notifications.delete': 'Smazat',
  'notifications.system': 'Systém',
+  'notifications.synologySessionCleared.title': 'Synology Photos odpojeno',
+  'notifications.synologySessionCleared.text': 'Váš server nebo účet se změnil — přejděte do Nastavení a znovu otestujte připojení.',
  'settings.mustChangePassword': 'Před pokračováním musíte změnit heslo.',
  'atlas.searchCountry': 'Hledat zemi...',
  'memories.error.loadAlbums': 'Načtení alb se nezdařilo',
@@ -1923,6 +1991,69 @@ const cs: Record<string, string | { name: string; category: string }[]> = {
  'dayplan.mobile.createNew': 'Vytvořit nové místo',
  'admin.addons.catalog.journey.name': 'Cestovní deník',
  'admin.addons.catalog.journey.description': 'Sledování cest a cestovní deník s odbaveními, fotkami a denními příběhy',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Výlety',
+  'oauth.scope.group.places': 'Místa',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Balení',
+  'oauth.scope.group.todos': 'Úkoly',
+  'oauth.scope.group.budget': 'Rozpočet',
+  'oauth.scope.group.reservations': 'Rezervace',
+  'oauth.scope.group.collab': 'Spolupráce',
+  'oauth.scope.group.notifications': 'Oznámení',
+  'oauth.scope.group.vacay': 'Dovolená',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Počasí',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Zobrazit výlety a itineráře',
+  'oauth.scope.trips:read.description': 'Číst výlety, dny, poznámky a členy',
+  'oauth.scope.trips:write.label': 'Upravit výlety a itineráře',
+  'oauth.scope.trips:write.description': 'Vytvářet a aktualizovat výlety, dny, poznámky a spravovat členy',
+  'oauth.scope.trips:delete.label': 'Mazat výlety',
+  'oauth.scope.trips:delete.description': 'Trvale smazat celé výlety — tato akce je nevratná',
+  'oauth.scope.trips:share.label': 'Spravovat sdílené odkazy',
+  'oauth.scope.trips:share.description': 'Vytvářet, aktualizovat a rušit veřejné sdílené odkazy',
+  'oauth.scope.places:read.label': 'Zobrazit místa a mapová data',
+  'oauth.scope.places:read.description': 'Číst místa, denní přiřazení, štítky a kategorie',
+  'oauth.scope.places:write.label': 'Spravovat místa',
+  'oauth.scope.places:write.description': 'Vytvářet, aktualizovat a mazat místa, přiřazení a štítky',
+  'oauth.scope.atlas:read.label': 'Zobrazit Atlas',
+  'oauth.scope.atlas:read.description': 'Číst navštívené země, regiony a seznam přání',
+  'oauth.scope.atlas:write.label': 'Spravovat Atlas',
+  'oauth.scope.atlas:write.description': 'Označovat navštívené země a regiony, spravovat seznam přání',
+  'oauth.scope.packing:read.label': 'Zobrazit seznamy balení',
+  'oauth.scope.packing:read.description': 'Číst položky, tašky a přiřazení kategorií',
+  'oauth.scope.packing:write.label': 'Spravovat seznamy balení',
+  'oauth.scope.packing:write.description': 'Přidávat, aktualizovat, mazat, označovat a řadit položky a tašky',
+  'oauth.scope.todos:read.label': 'Zobrazit seznamy úkolů',
+  'oauth.scope.todos:read.description': 'Číst úkoly výletu a přiřazení kategorií',
+  'oauth.scope.todos:write.label': 'Spravovat seznamy úkolů',
+  'oauth.scope.todos:write.description': 'Vytvářet, aktualizovat, označovat, mazat a řadit úkoly',
+  'oauth.scope.budget:read.label': 'Zobrazit rozpočet',
+  'oauth.scope.budget:read.description': 'Číst položky rozpočtu a přehled výdajů',
+  'oauth.scope.budget:write.label': 'Spravovat rozpočet',
+  'oauth.scope.budget:write.description': 'Vytvářet, aktualizovat a mazat položky rozpočtu',
+  'oauth.scope.reservations:read.label': 'Zobrazit rezervace',
+  'oauth.scope.reservations:read.description': 'Číst rezervace a podrobnosti ubytování',
+  'oauth.scope.reservations:write.label': 'Spravovat rezervace',
+  'oauth.scope.reservations:write.description': 'Vytvářet, aktualizovat, mazat a řadit rezervace',
+  'oauth.scope.collab:read.label': 'Zobrazit spolupráci',
+  'oauth.scope.collab:read.description': 'Číst poznámky, ankety a zprávy spolupráce',
+  'oauth.scope.collab:write.label': 'Spravovat spolupráci',
+  'oauth.scope.collab:write.description': 'Vytvářet, aktualizovat a mazat poznámky, ankety a zprávy',
+  'oauth.scope.notifications:read.label': 'Zobrazit oznámení',
+  'oauth.scope.notifications:read.description': 'Číst oznámení v aplikaci a počty nepřečtených',
+  'oauth.scope.notifications:write.label': 'Spravovat oznámení',
+  'oauth.scope.notifications:write.description': 'Označovat oznámení jako přečtená a reagovat na ně',
+  'oauth.scope.vacay:read.label': 'Zobrazit plány dovolené',
+  'oauth.scope.vacay:read.description': 'Číst data plánování dovolené, záznamy a statistiky',
+  'oauth.scope.vacay:write.label': 'Spravovat plány dovolené',
+  'oauth.scope.vacay:write.description': 'Vytvářet a spravovat záznamy dovolené, svátky a týmové plány',
+  'oauth.scope.geo:read.label': 'Mapy a geokódování',
+  'oauth.scope.geo:read.description': 'Vyhledávat místa, řešit URL map a zpětně geokódovat souřadnice',
+  'oauth.scope.weather:read.label': 'Předpovědi počasí',
+  'oauth.scope.weather:read.description': 'Získávat předpovědi počasí pro místa a data výletu',
 }

 export default cs
@@ -228,6 +228,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'MCP-Endpunkt',
  'settings.mcp.clientConfig': 'Client-Konfiguration',
  'settings.mcp.clientConfigHint': 'Ersetze <your_token> durch ein API-Token aus der Liste unten. Der Pfad zu npx muss ggf. für dein System angepasst werden (z. B. C:\\PROGRA~1\\nodejs\\npx.cmd unter Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Ersetze <your_client_id> und <your_client_secret> durch die Zugangsdaten des oben erstellten OAuth 2.1-Clients. mcp-remote öffnet beim ersten Verbindungsaufbau deinen Browser zur Autorisierung. Der Pfad zu npx muss ggf. für dein System angepasst werden (z. B. C:\\PROGRA~1\\nodejs\\npx.cmd unter Windows).',
  'settings.mcp.copy': 'Kopieren',
  'settings.mcp.copied': 'Kopiert!',
  'settings.mcp.apiTokens': 'API-Tokens',
@@ -249,6 +250,48 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Token konnte nicht erstellt werden',
  'settings.mcp.toast.deleted': 'Token gelöscht',
  'settings.mcp.toast.deleteError': 'Token konnte nicht gelöscht werden',
+  'settings.mcp.apiTokensDeprecated': 'API-Tokens sind veraltet und werden in einer zukünftigen Version entfernt. Bitte verwende stattdessen OAuth 2.1-Clients.',
+  'settings.oauth.clients': 'OAuth 2.1-Clients',
+  'settings.oauth.clientsHint': 'Registriere OAuth 2.1-Clients, damit externe MCP-Anwendungen (Claude Web, Cursor usw.) sich ohne statische Tokens verbinden können.',
+  'settings.oauth.createClient': 'Neuer Client',
+  'settings.oauth.noClients': 'Keine OAuth-Clients registriert.',
+  'settings.oauth.clientId': 'Client-ID',
+  'settings.oauth.clientSecret': 'Client-Secret',
+  'settings.oauth.deleteClient': 'Client löschen',
+  'settings.oauth.deleteClientMessage': 'Dieser Client und alle aktiven Sessions werden dauerhaft entfernt. Jede Anwendung, die ihn nutzt, verliert sofort den Zugriff.',
+  'settings.oauth.rotateSecret': 'Secret erneuern',
+  'settings.oauth.rotateSecretMessage': 'Ein neues Client-Secret wird generiert und alle bestehenden Sessions werden sofort ungültig. Aktualisiere deine Anwendung, bevor du diesen Dialog schließt.',
+  'settings.oauth.rotateSecretConfirm': 'Erneuern',
+  'settings.oauth.rotateSecretConfirming': 'Wird erneuert…',
+  'settings.oauth.rotateSecretDoneTitle': 'Neues Secret generiert',
+  'settings.oauth.rotateSecretDoneWarning': 'Dieses Secret wird nur einmal angezeigt. Kopiere es jetzt und aktualisiere deine Anwendung — alle vorherigen Sessions wurden ungültig gemacht.',
+  'settings.oauth.activeSessions': 'Aktive OAuth-Sessions',
+  'settings.oauth.sessionScopes': 'Berechtigungen',
+  'settings.oauth.sessionExpires': 'Läuft ab',
+  'settings.oauth.revoke': 'Widerrufen',
+  'settings.oauth.revokeSession': 'Session widerrufen',
+  'settings.oauth.revokeSessionMessage': 'Dadurch wird der Zugriff für diese OAuth-Session sofort widerrufen.',
+  'settings.oauth.modal.createTitle': 'OAuth-Client registrieren',
+  'settings.oauth.modal.presets': 'Schnellvorlagen',
+  'settings.oauth.modal.clientName': 'Anwendungsname',
+  'settings.oauth.modal.clientNamePlaceholder': 'z. B. Claude Web, Meine MCP-App',
+  'settings.oauth.modal.redirectUris': 'Redirect-URIs',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Eine URI pro Zeile. HTTPS erforderlich (localhost ausgenommen). Exakte Übereinstimmung erforderlich.',
+  'settings.oauth.modal.scopes': 'Erlaubte Berechtigungen',
+  'settings.oauth.modal.scopesHint': 'list_trips und get_trip_summary sind immer verfügbar — keine Berechtigung nötig. Sie helfen der KI, Trip-IDs zu ermitteln.',
+  'settings.oauth.modal.selectAll': 'Alle auswählen',
+  'settings.oauth.modal.deselectAll': 'Alle abwählen',
+  'settings.oauth.modal.creating': 'Wird registriert…',
+  'settings.oauth.modal.create': 'Client registrieren',
+  'settings.oauth.modal.createdTitle': 'Client registriert',
+  'settings.oauth.modal.createdWarning': 'Das Client-Secret wird nur einmal angezeigt. Kopiere es jetzt — es kann nicht wiederhergestellt werden.',
+  'settings.oauth.toast.createError': 'OAuth-Client konnte nicht registriert werden',
+  'settings.oauth.toast.deleted': 'OAuth-Client gelöscht',
+  'settings.oauth.toast.deleteError': 'OAuth-Client konnte nicht gelöscht werden',
+  'settings.oauth.toast.revoked': 'Session widerrufen',
+  'settings.oauth.toast.revokeError': 'Session konnte nicht widerrufen werden',
+  'settings.oauth.toast.rotateError': 'Client-Secret konnte nicht erneuert werden',
  'settings.account': 'Konto',
  'settings.about': 'Über',
  'settings.about.reportBug': 'Bug melden',
@@ -454,11 +497,11 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'admin.requireMfaHint': 'Benutzer ohne 2FA müssen die Einrichtung unter Einstellungen abschließen, bevor sie die App nutzen können.',
  'admin.apiKeys': 'API-Schlüssel',
  'admin.apiKeysHint': 'Optional. Aktiviert erweiterte Ortsdaten wie Fotos und Wetter.',
-  'admin.mapsKey': 'Google Maps API Key',
+  'admin.mapsKey': 'Google Maps API-Schlüssel',
  'admin.mapsKeyHint': 'Für Ortsuche benötigt. Erstellen unter console.cloud.google.com',
  'admin.mapsKeyHintLong': 'Ohne API Key wird OpenStreetMap für die Ortssuche genutzt. Mit Google API Key können zusätzlich Bilder, Bewertungen und Öffnungszeiten geladen werden. Erstellen unter console.cloud.google.com.',
  'admin.recommended': 'Empfohlen',
-  'admin.weatherKey': 'OpenWeatherMap API Key',
+  'admin.weatherKey': 'OpenWeatherMap API-Schlüssel',
  'admin.weatherKeyHint': 'Für Wetterdaten. Kostenlos unter openweathermap.org',
  'admin.validateKey': 'Test',
  'admin.keyValid': 'Verbunden',
@@ -526,7 +569,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'admin.addons.subtitleAfter': ' nach deinen Wünschen anzupassen.',
  'admin.addons.enabled': 'Aktiviert',
  'admin.addons.disabled': 'Deaktiviert',
-  'admin.addons.type.trip': 'Trip',
+  'admin.addons.type.trip': 'Reise',
  'admin.addons.type.global': 'Global',
  'admin.addons.type.integration': 'Integration',
  'admin.addons.tripHint': 'Verfügbar als Tab innerhalb jedes Trips',
@@ -548,9 +591,10 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'admin.weather.locationHint': 'Das Wetter wird anhand des ersten Ortes mit Koordinaten im jeweiligen Tag berechnet. Ist kein Ort am Tag eingeplant, wird ein beliebiger Ort aus der Ortsliste als Referenz verwendet.',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP-Tokens',
-  'admin.mcpTokens.title': 'MCP-Tokens',
-  'admin.mcpTokens.subtitle': 'API-Tokens aller Benutzer verwalten',
+  'admin.tabs.mcpTokens': 'MCP-Zugang',
+  'admin.mcpTokens.title': 'MCP-Zugang',
+  'admin.mcpTokens.subtitle': 'OAuth-Sitzungen und API-Tokens aller Benutzer verwalten',
+  'admin.mcpTokens.sectionTitle': 'API-Tokens',
  'admin.mcpTokens.owner': 'Besitzer',
  'admin.mcpTokens.tokenName': 'Token-Name',
  'admin.mcpTokens.created': 'Erstellt',
@@ -562,6 +606,17 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token gelöscht',
  'admin.mcpTokens.deleteError': 'Token konnte nicht gelöscht werden',
  'admin.mcpTokens.loadError': 'Tokens konnten nicht geladen werden',
+  'admin.oauthSessions.sectionTitle': 'OAuth-Sitzungen',
+  'admin.oauthSessions.clientName': 'Client',
+  'admin.oauthSessions.owner': 'Besitzer',
+  'admin.oauthSessions.scopes': 'Berechtigungen',
+  'admin.oauthSessions.created': 'Erstellt',
+  'admin.oauthSessions.empty': 'Keine aktiven OAuth-Sitzungen',
+  'admin.oauthSessions.revokeTitle': 'Sitzung widerrufen',
+  'admin.oauthSessions.revokeMessage': 'Diese OAuth-Sitzung wird sofort widerrufen. Der Client verliert den MCP-Zugang.',
+  'admin.oauthSessions.revokeSuccess': 'Sitzung widerrufen',
+  'admin.oauthSessions.revokeError': 'Sitzung konnte nicht widerrufen werden',
+  'admin.oauthSessions.loadError': 'OAuth-Sitzungen konnten nicht geladen werden',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -718,7 +773,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'atlas.addToBucketHint': 'Als Wunschziel speichern',
  'atlas.bucketWhen': 'Wann möchtest du dorthin reisen?',
  'atlas.statsTab': 'Statistik',
-  'atlas.bucketTab': 'Bucket List',
+  'atlas.bucketTab': 'Wunschliste',
  'atlas.addBucket': 'Zur Bucket List hinzufügen',
  'atlas.bucketNotesPlaceholder': 'Notizen (optional)',
  'atlas.bucketEmpty': 'Deine Bucket List ist leer',
@@ -731,7 +786,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'atlas.lastTrip': 'Letzter Trip',
  'atlas.nextTrip': 'Nächster Trip',
  'atlas.daysLeft': 'Tage',
-  'atlas.streak': 'Streak',
+  'atlas.streak': 'Serie',
  'atlas.years': 'Jahre',
  'atlas.yearInRow': 'Jahr in Folge',
  'atlas.yearsInRow': 'Jahre in Folge',
@@ -843,7 +898,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'places.noCategory': 'Keine Kategorie',
  'places.categoryNamePlaceholder': 'Kategoriename',
  'places.formTime': 'Uhrzeit',
-  'places.startTime': 'Start',
+  'places.startTime': 'Startzeit',
  'places.endTime': 'Ende',
  'places.endTimeBeforeStart': 'Endzeit liegt vor der Startzeit',
  'places.timeCollision': 'Zeitliche Überschneidung mit:',
@@ -898,7 +953,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'reservations.timeAlt': 'Uhrzeit (alternativ, z.B. 19:30)',
  'reservations.notes': 'Notizen',
  'reservations.notesPlaceholder': 'Zusätzliche Notizen...',
-  'reservations.meta.airline': 'Airline',
+  'reservations.meta.airline': 'Fluggesellschaft',
  'reservations.meta.flightNumber': 'Flugnr.',
  'reservations.meta.from': 'Von',
  'reservations.meta.to': 'Nach',
@@ -1383,6 +1438,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Fotos',
  'memories.notConnected': 'Immich nicht verbunden',
  'memories.notConnectedHint': 'Verbinde deine Immich-Instanz in den Einstellungen, um deine Reisefotos hier zu sehen.',
+  'memories.notConnectedMultipleHint': 'Verbinde einen dieser Fotoanbieter: {provider_names} in den Einstellungen, um Fotos zu dieser Reise hinzufügen zu können.',
  'memories.noDates': 'Füge Daten zu deiner Reise hinzu, um Fotos zu laden.',
  'memories.noPhotos': 'Keine Fotos gefunden',
  'memories.noPhotosHint': 'Keine Fotos in Immich für den Zeitraum dieser Reise gefunden.',
@@ -1393,21 +1449,32 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Deine Fotos prüfen',
  'memories.reviewHint': 'Klicke auf Fotos, um sie vom Teilen auszuschließen.',
  'memories.shareCount': '{count} Fotos teilen',
+  'memories.providerUrl': 'Server-URL',
+  'memories.providerApiKey': 'API-Schlüssel',
+  'memories.providerUsername': 'Benutzername',
+  'memories.providerPassword': 'Passwort',
+  'memories.providerOTP': 'MFA-Code (falls aktiviert)',
+  'memories.skipSSLVerification': 'SSL-Zertifikatsprüfung überspringen',
+  'memories.providerUrlHintSynology': 'Füge den Fotos-App-Pfad in die URL ein, z.B. https://nas:5001/photo',
  'memories.testConnection': 'Verbindung testen',
  'memories.testFirst': 'Verbindung zuerst testen',
  'memories.connected': 'Verbunden',
  'memories.disconnected': 'Nicht verbunden',
  'memories.connectionSuccess': 'Verbindung zu Immich hergestellt',
  'memories.connectionError': 'Verbindung zu Immich fehlgeschlagen',
-  'memories.saved': 'Immich-Einstellungen gespeichert',
+  'memories.saved': '{provider_name}-Einstellungen gespeichert',
+  'memories.providerDisconnectedBanner': 'Deine {provider_name}-Verbindung wurde getrennt. Verbinde erneut in den Einstellungen, um Fotos anzuzeigen.',
+  'memories.saveError': '{provider_name}-Einstellungen konnten nicht gespeichert werden',
  'memories.addPhotos': 'Fotos hinzufügen',
  'memories.linkAlbum': 'Album verknüpfen',
  'memories.selectAlbum': 'Immich-Album auswählen',
+  'memories.selectAlbumMultiple': 'Album auswählen',
  'memories.noAlbums': 'Keine Alben gefunden',
  'memories.syncAlbum': 'Album synchronisieren',
  'memories.unlinkAlbum': 'Album trennen',
  'memories.photos': 'Fotos',
  'memories.selectPhotos': 'Fotos aus Immich auswählen',
+  'memories.selectPhotosMultiple': 'Fotos auswählen',
  'memories.selectHint': 'Tippe auf Fotos um sie auszuwählen.',
  'memories.selected': 'ausgewählt',
  'memories.addSelected': '{count} Fotos hinzufügen',
@@ -1567,6 +1634,8 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Als ungelesen markieren',
  'notifications.delete': 'Löschen',
  'notifications.system': 'System',
+  'notifications.synologySessionCleared.title': 'Synology Photos getrennt',
+  'notifications.synologySessionCleared.text': 'Dein Server oder Konto hat sich geändert — gehe zu Einstellungen, um deine Verbindung erneut zu testen.',
  'memories.error.loadAlbums': 'Alben konnten nicht geladen werden',
  'memories.error.linkAlbum': 'Album konnte nicht verknüpft werden',
  'memories.error.unlinkAlbum': 'Album konnte nicht getrennt werden',
@@ -1593,7 +1662,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {

  // Todo
  'todo.subtab.packing': 'Packliste',
-  'todo.subtab.todo': 'To-Do',
+  'todo.subtab.todo': 'Aufgaben',
  'todo.completed': 'erledigt',
  'todo.filter.all': 'Alle',
  'todo.filter.open': 'Offen',
@@ -1628,7 +1697,7 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  // Notification system (added from feat/notification-system)
  'settings.notifyVersionAvailable': 'Neue Version verfügbar',
  'settings.notificationPreferences.noChannels': 'Keine Benachrichtigungskanäle konfiguriert. Bitte einen Administrator, E-Mail- oder Webhook-Benachrichtigungen einzurichten.',
-  'settings.webhookUrl.label': 'Webhook URL',
+  'settings.webhookUrl.label': 'Webhook-URL',
  'settings.webhookUrl.placeholder': 'https://discord.com/api/webhooks/...',
  'settings.webhookUrl.hint': 'Gib deine Discord-, Slack- oder benutzerdefinierte Webhook-URL ein, um Benachrichtigungen zu erhalten.',
  'settings.webhookUrl.save': 'Speichern',
@@ -1917,6 +1986,70 @@ const de: Record<string, string | { name: string; category: string }[]> = {
  'memories.saveError': 'Could not save {provider_name} settings',
  'memories.selectAlbumMultiple': 'Select Album',
  'memories.selectPhotosMultiple': 'Select Photos',
+
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Reisen',
+  'oauth.scope.group.places': 'Orte',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Packliste',
+  'oauth.scope.group.todos': 'Aufgaben',
+  'oauth.scope.group.budget': 'Budget',
+  'oauth.scope.group.reservations': 'Buchungen',
+  'oauth.scope.group.collab': 'Zusammenarbeit',
+  'oauth.scope.group.notifications': 'Benachrichtigungen',
+  'oauth.scope.group.vacay': 'Urlaub',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Wetter',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Reisen und Reisepläne anzeigen',
+  'oauth.scope.trips:read.description': 'Reisen, Tage, Tagesnotizen und Mitglieder lesen',
+  'oauth.scope.trips:write.label': 'Reisen und Reisepläne bearbeiten',
+  'oauth.scope.trips:write.description': 'Reisen, Tage und Notizen erstellen, aktualisieren und Mitglieder verwalten',
+  'oauth.scope.trips:delete.label': 'Reisen löschen',
+  'oauth.scope.trips:delete.description': 'Reisen dauerhaft löschen — diese Aktion ist unwiderruflich',
+  'oauth.scope.trips:share.label': 'Freigabelinks verwalten',
+  'oauth.scope.trips:share.description': 'Öffentliche Freigabelinks erstellen, aktualisieren und widerrufen',
+  'oauth.scope.places:read.label': 'Orte und Kartendaten anzeigen',
+  'oauth.scope.places:read.description': 'Orte, Tageszuweisungen, Tags und Kategorien lesen',
+  'oauth.scope.places:write.label': 'Orte verwalten',
+  'oauth.scope.places:write.description': 'Orte, Zuweisungen und Tags erstellen, aktualisieren und löschen',
+  'oauth.scope.atlas:read.label': 'Atlas anzeigen',
+  'oauth.scope.atlas:read.description': 'Besuchte Länder, Regionen und Wunschliste lesen',
+  'oauth.scope.atlas:write.label': 'Atlas verwalten',
+  'oauth.scope.atlas:write.description': 'Länder und Regionen als besucht markieren, Wunschliste verwalten',
+  'oauth.scope.packing:read.label': 'Packlisten anzeigen',
+  'oauth.scope.packing:read.description': 'Packgegenstände, Taschen und Kategoriezuweisungen lesen',
+  'oauth.scope.packing:write.label': 'Packlisten verwalten',
+  'oauth.scope.packing:write.description': 'Packgegenstände und Taschen hinzufügen, aktualisieren, löschen, abhaken und sortieren',
+  'oauth.scope.todos:read.label': 'Aufgabenlisten anzeigen',
+  'oauth.scope.todos:read.description': 'Reiseaufgaben und Kategoriezuweisungen lesen',
+  'oauth.scope.todos:write.label': 'Aufgabenlisten verwalten',
+  'oauth.scope.todos:write.description': 'Aufgaben erstellen, aktualisieren, abhaken, löschen und sortieren',
+  'oauth.scope.budget:read.label': 'Budget anzeigen',
+  'oauth.scope.budget:read.description': 'Budgeteinträge und Ausgabenaufschlüsselung lesen',
+  'oauth.scope.budget:write.label': 'Budget verwalten',
+  'oauth.scope.budget:write.description': 'Budgeteinträge erstellen, aktualisieren und löschen',
+  'oauth.scope.reservations:read.label': 'Buchungen anzeigen',
+  'oauth.scope.reservations:read.description': 'Buchungen und Unterkunftsdetails lesen',
+  'oauth.scope.reservations:write.label': 'Buchungen verwalten',
+  'oauth.scope.reservations:write.description': 'Buchungen erstellen, aktualisieren, löschen und sortieren',
+  'oauth.scope.collab:read.label': 'Zusammenarbeit anzeigen',
+  'oauth.scope.collab:read.description': 'Kollaborationsnotizen, Umfragen und Nachrichten lesen',
+  'oauth.scope.collab:write.label': 'Zusammenarbeit verwalten',
+  'oauth.scope.collab:write.description': 'Kollaborationsnotizen, Umfragen und Nachrichten erstellen, aktualisieren und löschen',
+  'oauth.scope.notifications:read.label': 'Benachrichtigungen anzeigen',
+  'oauth.scope.notifications:read.description': 'In-App-Benachrichtigungen und ungelesene Zählungen lesen',
+  'oauth.scope.notifications:write.label': 'Benachrichtigungen verwalten',
+  'oauth.scope.notifications:write.description': 'Benachrichtigungen als gelesen markieren und darauf reagieren',
+  'oauth.scope.vacay:read.label': 'Urlaubspläne anzeigen',
+  'oauth.scope.vacay:read.description': 'Urlaubsplanungsdaten, Einträge und Statistiken lesen',
+  'oauth.scope.vacay:write.label': 'Urlaubspläne verwalten',
+  'oauth.scope.vacay:write.description': 'Urlaubseinträge, Feiertage und Teampläne erstellen und verwalten',
+  'oauth.scope.geo:read.label': 'Karten & Geocodierung',
+  'oauth.scope.geo:read.description': 'Orte suchen, Karten-URLs auflösen und Koordinaten rückwärts geokodieren',
+  'oauth.scope.weather:read.label': 'Wettervorhersagen',
+  'oauth.scope.weather:read.description': 'Wettervorhersagen für Reiseorte und -daten abrufen',
 }

 export default de
@@ -252,6 +252,7 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'MCP Endpoint',
  'settings.mcp.clientConfig': 'Client Configuration',
  'settings.mcp.clientConfigHint': 'Replace <your_token> with an API token from the list below. The path to npx may need to be adjusted for your system (e.g. C:\\PROGRA~1\\nodejs\\npx.cmd on Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Replace <your_client_id> and <your_client_secret> with the credentials shown in the OAuth 2.1 client you created above. mcp-remote will open your browser to complete the authorization the first time you connect. The path to npx may need to be adjusted for your system (e.g. C:\PROGRA~1\nodejs\npx.cmd on Windows).',
  'settings.mcp.copy': 'Copy',
  'settings.mcp.copied': 'Copied!',
  'settings.mcp.apiTokens': 'API Tokens',
@@ -273,6 +274,48 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Failed to create token',
  'settings.mcp.toast.deleted': 'Token deleted',
  'settings.mcp.toast.deleteError': 'Failed to delete token',
+  'settings.mcp.apiTokensDeprecated': 'API Tokens are deprecated and will be removed in a future release. Please use OAuth 2.1 Clients instead.',
+  'settings.oauth.clients': 'OAuth 2.1 Clients',
+  'settings.oauth.clientsHint': 'Register OAuth 2.1 clients to let third-party MCP applications (Claude Web, Cursor, etc.) connect without static tokens.',
+  'settings.oauth.createClient': 'New Client',
+  'settings.oauth.noClients': 'No OAuth clients registered.',
+  'settings.oauth.clientId': 'Client ID',
+  'settings.oauth.clientSecret': 'Client Secret',
+  'settings.oauth.deleteClient': 'Delete Client',
+  'settings.oauth.deleteClientMessage': 'This client and all active sessions will be permanently removed. Any application using it will lose access immediately.',
+  'settings.oauth.rotateSecret': 'Rotate Secret',
+  'settings.oauth.rotateSecretMessage': 'A new client secret will be generated and all existing sessions will be invalidated immediately. Update your application before closing this dialog.',
+  'settings.oauth.rotateSecretConfirm': 'Rotate',
+  'settings.oauth.rotateSecretConfirming': 'Rotating…',
+  'settings.oauth.rotateSecretDoneTitle': 'New Secret Generated',
+  'settings.oauth.rotateSecretDoneWarning': 'This secret is shown only once. Copy it now and update your application — all previous sessions have been invalidated.',
+  'settings.oauth.activeSessions': 'Active OAuth Sessions',
+  'settings.oauth.sessionScopes': 'Scopes',
+  'settings.oauth.sessionExpires': 'Expires',
+  'settings.oauth.revoke': 'Revoke',
+  'settings.oauth.revokeSession': 'Revoke Session',
+  'settings.oauth.revokeSessionMessage': 'This will immediately revoke access for this OAuth session.',
+  'settings.oauth.modal.createTitle': 'Register OAuth Client',
+  'settings.oauth.modal.presets': 'Quick presets',
+  'settings.oauth.modal.clientName': 'Application Name',
+  'settings.oauth.modal.clientNamePlaceholder': 'e.g. Claude Web, My MCP App',
+  'settings.oauth.modal.redirectUris': 'Redirect URIs',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'One URI per line. HTTPS required (localhost exempt). Exact match enforced.',
+  'settings.oauth.modal.scopes': 'Allowed Scopes',
+  'settings.oauth.modal.scopesHint': 'list_trips and get_trip_summary are always available — no scope required. They let the AI discover trip IDs needed to use any other tool.',
+  'settings.oauth.modal.selectAll': 'Select all',
+  'settings.oauth.modal.deselectAll': 'Deselect all',
+  'settings.oauth.modal.creating': 'Registering…',
+  'settings.oauth.modal.create': 'Register Client',
+  'settings.oauth.modal.createdTitle': 'Client Registered',
+  'settings.oauth.modal.createdWarning': 'The client secret is shown only once. Copy it now — it cannot be recovered.',
+  'settings.oauth.toast.createError': 'Failed to register OAuth client',
+  'settings.oauth.toast.deleted': 'OAuth client deleted',
+  'settings.oauth.toast.deleteError': 'Failed to delete OAuth client',
+  'settings.oauth.toast.revoked': 'Session revoked',
+  'settings.oauth.toast.revokeError': 'Failed to revoke session',
+  'settings.oauth.toast.rotateError': 'Failed to rotate client secret',
  'settings.account': 'Account',
  'settings.about': 'About',
  'settings.about.reportBug': 'Report a Bug',
@@ -573,9 +616,10 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'admin.weather.locationHint': 'Weather is based on the first place with coordinates in each day. If no place is assigned to a day, any place from the place list is used as a reference.',

  // GitHub
-  'admin.tabs.mcpTokens': 'MCP Tokens',
-  'admin.mcpTokens.title': 'MCP Tokens',
-  'admin.mcpTokens.subtitle': 'Manage API tokens across all users',
+  'admin.tabs.mcpTokens': 'MCP Access',
+  'admin.mcpTokens.title': 'MCP Access',
+  'admin.mcpTokens.subtitle': 'Manage OAuth sessions and API tokens across all users',
+  'admin.mcpTokens.sectionTitle': 'API Tokens',
  'admin.mcpTokens.owner': 'Owner',
  'admin.mcpTokens.tokenName': 'Token Name',
  'admin.mcpTokens.created': 'Created',
@@ -587,6 +631,17 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token deleted',
  'admin.mcpTokens.deleteError': 'Failed to delete token',
  'admin.mcpTokens.loadError': 'Failed to load tokens',
+  'admin.oauthSessions.sectionTitle': 'OAuth Sessions',
+  'admin.oauthSessions.clientName': 'Client',
+  'admin.oauthSessions.owner': 'Owner',
+  'admin.oauthSessions.scopes': 'Scopes',
+  'admin.oauthSessions.created': 'Created',
+  'admin.oauthSessions.empty': 'No active OAuth sessions',
+  'admin.oauthSessions.revokeTitle': 'Revoke Session',
+  'admin.oauthSessions.revokeMessage': 'This will revoke the OAuth session immediately. The client will lose MCP access.',
+  'admin.oauthSessions.revokeSuccess': 'Session revoked',
+  'admin.oauthSessions.revokeError': 'Failed to revoke session',
+  'admin.oauthSessions.loadError': 'Failed to load OAuth sessions',
  'admin.tabs.github': 'GitHub',

  'admin.audit.subtitle': 'Security-sensitive and administration events (backups, users, MFA, settings).',
@@ -1423,6 +1478,9 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'memories.providerApiKey': 'API Key',
  'memories.providerUsername': 'Username',
  'memories.providerPassword': 'Password',
+  'memories.providerOTP': 'MFA code (if enabled)',
+  'memories.skipSSLVerification': 'Skip SSL certificate verification',
+  'memories.providerUrlHintSynology': 'Include the Photos app path in the URL, e.g. https://nas:5001/photo',
  'memories.testConnection': 'Test connection',
  'memories.testFirst': 'Test connection first',
  'memories.connected': 'Connected',
@@ -1430,6 +1488,7 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'memories.connectionSuccess': 'Connected to {provider_name}',
  'memories.connectionError': 'Could not connect to {provider_name}',
  'memories.saved': '{provider_name} settings saved',
+  'memories.providerDisconnectedBanner': 'Your {provider_name} connection is lost. Reconnect in Settings to view photos.',
  'memories.saveError': 'Could not save {provider_name} settings',
  //------------------------  
  'memories.addPhotos': 'Add photos',
@@ -1612,6 +1671,8 @@ const en: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Mark as unread',
  'notifications.delete': 'Delete',
  'notifications.system': 'System',
+  'notifications.synologySessionCleared.title': 'Synology Photos disconnected',
+  'notifications.synologySessionCleared.text': 'Your server or account changed — go to Settings to test your connection again.',

  // Notification test keys (dev only)
  'notifications.versionAvailable.title': 'Update Available',
@@ -1954,6 +2015,70 @@ const en: Record<string, string | { name: string; category: string }[]> = {

  'admin.addons.catalog.journey.name': 'Journey',
  'admin.addons.catalog.journey.description': 'Trip tracking & travel journal with check-ins, photos, and daily stories',
+
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Trips',
+  'oauth.scope.group.places': 'Places',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Packing',
+  'oauth.scope.group.todos': 'To-dos',
+  'oauth.scope.group.budget': 'Budget',
+  'oauth.scope.group.reservations': 'Reservations',
+  'oauth.scope.group.collab': 'Collaboration',
+  'oauth.scope.group.notifications': 'Notifications',
+  'oauth.scope.group.vacay': 'Vacation',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Weather',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'View trips & itineraries',
+  'oauth.scope.trips:read.description': 'Read trips, days, day notes, and members',
+  'oauth.scope.trips:write.label': 'Edit trips & itineraries',
+  'oauth.scope.trips:write.description': 'Create and update trips, days, notes, and manage members',
+  'oauth.scope.trips:delete.label': 'Delete trips',
+  'oauth.scope.trips:delete.description': 'Permanently delete entire trips — this action is irreversible',
+  'oauth.scope.trips:share.label': 'Manage share links',
+  'oauth.scope.trips:share.description': 'Create, update, and revoke public share links for trips',
+  'oauth.scope.places:read.label': 'View places & map data',
+  'oauth.scope.places:read.description': 'Read places, day assignments, tags, and categories',
+  'oauth.scope.places:write.label': 'Manage places',
+  'oauth.scope.places:write.description': 'Create, update, and delete places, assignments, and tags',
+  'oauth.scope.atlas:read.label': 'View Atlas',
+  'oauth.scope.atlas:read.description': 'Read visited countries, regions, and bucket list',
+  'oauth.scope.atlas:write.label': 'Manage Atlas',
+  'oauth.scope.atlas:write.description': 'Mark countries and regions visited, manage bucket list',
+  'oauth.scope.packing:read.label': 'View packing lists',
+  'oauth.scope.packing:read.description': 'Read packing items, bags, and category assignees',
+  'oauth.scope.packing:write.label': 'Manage packing lists',
+  'oauth.scope.packing:write.description': 'Add, update, delete, toggle, and reorder packing items and bags',
+  'oauth.scope.todos:read.label': 'View to-do lists',
+  'oauth.scope.todos:read.description': 'Read trip to-do items and category assignees',
+  'oauth.scope.todos:write.label': 'Manage to-do lists',
+  'oauth.scope.todos:write.description': 'Create, update, toggle, delete, and reorder to-do items',
+  'oauth.scope.budget:read.label': 'View budget',
+  'oauth.scope.budget:read.description': 'Read budget items and expense breakdown',
+  'oauth.scope.budget:write.label': 'Manage budget',
+  'oauth.scope.budget:write.description': 'Create, update, and delete budget items',
+  'oauth.scope.reservations:read.label': 'View reservations',
+  'oauth.scope.reservations:read.description': 'Read reservations and accommodation details',
+  'oauth.scope.reservations:write.label': 'Manage reservations',
+  'oauth.scope.reservations:write.description': 'Create, update, delete, and reorder reservations',
+  'oauth.scope.collab:read.label': 'View collaboration',
+  'oauth.scope.collab:read.description': 'Read collab notes, polls, and messages',
+  'oauth.scope.collab:write.label': 'Manage collaboration',
+  'oauth.scope.collab:write.description': 'Create, update, and delete collab notes, polls, and messages',
+  'oauth.scope.notifications:read.label': 'View notifications',
+  'oauth.scope.notifications:read.description': 'Read in-app notifications and unread counts',
+  'oauth.scope.notifications:write.label': 'Manage notifications',
+  'oauth.scope.notifications:write.description': 'Mark notifications as read and respond to them',
+  'oauth.scope.vacay:read.label': 'View vacation plans',
+  'oauth.scope.vacay:read.description': 'Read vacation planning data, entries, and stats',
+  'oauth.scope.vacay:write.label': 'Manage vacation plans',
+  'oauth.scope.vacay:write.description': 'Create and manage vacation entries, holidays, and team plans',
+  'oauth.scope.geo:read.label': 'Maps & geocoding',
+  'oauth.scope.geo:read.description': 'Search locations, resolve map URLs, and reverse geocode coordinates',
+  'oauth.scope.weather:read.label': 'Weather forecasts',
+  'oauth.scope.weather:read.description': 'Fetch weather forecasts for trip locations and dates',
 }

 export default en
@@ -180,9 +180,6 @@ const es: Record<string, string> = {
  'admin.notifications.none': 'Desactivado',
  'admin.notifications.email': 'Correo (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Eventos de notificación',
-  'admin.notifications.eventsHint': 'Elige qué eventos activan notificaciones para todos los usuarios.',
-  'admin.notifications.configureFirst': 'Configura primero los ajustes SMTP o webhook a continuación, luego activa los eventos.',
  'admin.notifications.save': 'Guardar configuración de notificaciones',
  'admin.notifications.saved': 'Configuración de notificaciones guardada',
  'admin.notifications.testWebhook': 'Enviar webhook de prueba',
@@ -229,6 +226,7 @@ const es: Record<string, string> = {
  'settings.mcp.endpoint': 'Endpoint MCP',
  'settings.mcp.clientConfig': 'Configuración del cliente',
  'settings.mcp.clientConfigHint': 'Reemplaza <your_token> con un token de la lista de abajo. Es posible que debas ajustar la ruta de npx según tu sistema (p. ej. C:\\PROGRA~1\\nodejs\\npx.cmd en Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Reemplaza <your_client_id> y <your_client_secret> con las credenciales del cliente OAuth 2.1 que creaste arriba. mcp-remote abrirá el navegador para completar la autorización la primera vez que te conectes. Es posible que debas ajustar la ruta de npx según tu sistema (p. ej. C:\\PROGRA~1\\nodejs\\npx.cmd en Windows).',
  'settings.mcp.copy': 'Copiar',
  'settings.mcp.copied': '¡Copiado!',
  'settings.mcp.apiTokens': 'Tokens de API',
@@ -250,6 +248,48 @@ const es: Record<string, string> = {
  'settings.mcp.toast.createError': 'Error al crear el token',
  'settings.mcp.toast.deleted': 'Token eliminado',
  'settings.mcp.toast.deleteError': 'Error al eliminar el token',
+  'settings.mcp.apiTokensDeprecated': 'Los tokens de API están obsoletos y se eliminarán en una versión futura. Utilice los clientes OAuth 2.1 en su lugar.',
+  'settings.oauth.clients': 'Clientes OAuth 2.1',
+  'settings.oauth.clientsHint': 'Registre clientes OAuth 2.1 para que las aplicaciones MCP de terceros (Claude Web, Cursor, etc.) puedan conectarse sin tokens estáticos.',
+  'settings.oauth.createClient': 'Nuevo cliente',
+  'settings.oauth.noClients': 'No hay clientes OAuth registrados.',
+  'settings.oauth.clientId': 'ID de cliente',
+  'settings.oauth.clientSecret': 'Secreto de cliente',
+  'settings.oauth.deleteClient': 'Eliminar cliente',
+  'settings.oauth.deleteClientMessage': 'Este cliente y todas las sesiones activas se eliminarán permanentemente. Cualquier aplicación que lo use perderá el acceso inmediatamente.',
+  'settings.oauth.rotateSecret': 'Renovar secreto',
+  'settings.oauth.rotateSecretMessage': 'Se generará un nuevo secreto de cliente y todas las sesiones existentes se invalidarán de inmediato. Actualice su aplicación antes de cerrar este diálogo.',
+  'settings.oauth.rotateSecretConfirm': 'Renovar',
+  'settings.oauth.rotateSecretConfirming': 'Renovando…',
+  'settings.oauth.rotateSecretDoneTitle': 'Nuevo secreto generado',
+  'settings.oauth.rotateSecretDoneWarning': 'Este secreto solo se muestra una vez. Cópielo ahora y actualice su aplicación — todas las sesiones anteriores han sido invalidadas.',
+  'settings.oauth.activeSessions': 'Sesiones OAuth activas',
+  'settings.oauth.sessionScopes': 'Ámbitos',
+  'settings.oauth.sessionExpires': 'Expira',
+  'settings.oauth.revoke': 'Revocar',
+  'settings.oauth.revokeSession': 'Revocar sesión',
+  'settings.oauth.revokeSessionMessage': 'Esto revocará inmediatamente el acceso de esta sesión OAuth.',
+  'settings.oauth.modal.createTitle': 'Registrar cliente OAuth',
+  'settings.oauth.modal.presets': 'Ajustes rápidos',
+  'settings.oauth.modal.clientName': 'Nombre de la aplicación',
+  'settings.oauth.modal.clientNamePlaceholder': 'ej. Claude Web, Mi app MCP',
+  'settings.oauth.modal.redirectUris': 'URIs de redirección',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Un URI por línea. HTTPS obligatorio (localhost exento). Coincidencia exacta.',
+  'settings.oauth.modal.scopes': 'Ámbitos permitidos',
+  'settings.oauth.modal.scopesHint': 'list_trips y get_trip_summary siempre están disponibles — sin ámbito requerido. Permiten a la IA descubrir los IDs de viaje necesarios.',
+  'settings.oauth.modal.selectAll': 'Seleccionar todo',
+  'settings.oauth.modal.deselectAll': 'Deseleccionar todo',
+  'settings.oauth.modal.creating': 'Registrando…',
+  'settings.oauth.modal.create': 'Registrar cliente',
+  'settings.oauth.modal.createdTitle': 'Cliente registrado',
+  'settings.oauth.modal.createdWarning': 'El secreto del cliente solo se muestra una vez. Cópielo ahora — no se puede recuperar.',
+  'settings.oauth.toast.createError': 'Error al registrar el cliente OAuth',
+  'settings.oauth.toast.deleted': 'Cliente OAuth eliminado',
+  'settings.oauth.toast.deleteError': 'Error al eliminar el cliente OAuth',
+  'settings.oauth.toast.revoked': 'Sesión revocada',
+  'settings.oauth.toast.revokeError': 'Error al revocar la sesión',
+  'settings.oauth.toast.rotateError': 'Error al renovar el secreto del cliente',
  'settings.account': 'Cuenta',
  'settings.about': 'Acerca de',
  'settings.about.reportBug': 'Reportar un error',
@@ -397,7 +437,7 @@ const es: Record<string, string> = {
  'admin.tabs.users': 'Usuarios',
  'admin.tabs.categories': 'Categorías',
  'admin.tabs.backup': 'Copia de seguridad',
-  'admin.tabs.audit': 'Audit',
+  'admin.tabs.audit': 'Auditoría',
  'admin.stats.users': 'Usuarios',
  'admin.stats.trips': 'Viajes',
  'admin.stats.places': 'Lugares',
@@ -525,9 +565,10 @@ const es: Record<string, string> = {
  'admin.weather.locationHint': 'El tiempo se basa en el primer lugar con coordenadas de cada día. Si no hay ningún lugar asignado a un día, se usa como referencia cualquier lugar de la lista.',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'Tokens MCP',
-  'admin.mcpTokens.title': 'Tokens MCP',
-  'admin.mcpTokens.subtitle': 'Gestionar tokens de API de todos los usuarios',
+  'admin.tabs.mcpTokens': 'Acceso MCP',
+  'admin.mcpTokens.title': 'Acceso MCP',
+  'admin.mcpTokens.subtitle': 'Gestionar sesiones OAuth y tokens de API de todos los usuarios',
+  'admin.mcpTokens.sectionTitle': 'Tokens de API',
  'admin.mcpTokens.owner': 'Propietario',
  'admin.mcpTokens.tokenName': 'Nombre del token',
  'admin.mcpTokens.created': 'Creado',
@@ -539,6 +580,17 @@ const es: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': 'Token eliminado',
  'admin.mcpTokens.deleteError': 'No se pudo eliminar el token',
  'admin.mcpTokens.loadError': 'No se pudieron cargar los tokens',
+  'admin.oauthSessions.sectionTitle': 'Sesiones OAuth',
+  'admin.oauthSessions.clientName': 'Cliente',
+  'admin.oauthSessions.owner': 'Propietario',
+  'admin.oauthSessions.scopes': 'Permisos',
+  'admin.oauthSessions.created': 'Creado',
+  'admin.oauthSessions.empty': 'No hay sesiones OAuth activas',
+  'admin.oauthSessions.revokeTitle': 'Revocar sesión',
+  'admin.oauthSessions.revokeMessage': 'Esto revocará la sesión OAuth inmediatamente. El cliente perderá el acceso MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Sesión revocada',
+  'admin.oauthSessions.revokeError': 'No se pudo revocar la sesión',
+  'admin.oauthSessions.loadError': 'No se pudieron cargar las sesiones OAuth',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -668,7 +720,7 @@ const es: Record<string, string> = {
  'vacay.fuseInfo4': 'Ajustes como festivos y festivos de empresa se comparten.',
  'vacay.fuseInfo5': 'La fusión puede disolverse en cualquier momento por cualquiera de las partes. Tus entradas se conservarán.',
  'vacay.addCalendar': 'Añadir calendario',
-  'vacay.calendarColor': 'Color',
+  'vacay.calendarColor': 'Color del calendario',
  'vacay.calendarLabel': 'Etiqueta',
  'vacay.noCalendars': 'Sin calendarios',

@@ -881,7 +933,7 @@ const es: Record<string, string> = {
  'reservations.type.car': 'Coche de alquiler',
  'reservations.type.cruise': 'Crucero',
  'reservations.type.event': 'Evento',
-  'reservations.type.tour': 'Tour',
+  'reservations.type.tour': 'Excursión',
  'reservations.type.other': 'Otro',
  'reservations.confirm.delete': '¿Seguro que quieres eliminar la reserva "{name}"?',
  'reservations.confirm.deleteTitle': '¿Eliminar reserva?',
@@ -965,6 +1017,7 @@ const es: Record<string, string> = {
  'budget.totalBudget': 'Presupuesto total',
  'budget.byCategory': 'Por categoría',
  'budget.editTooltip': 'Haz clic para editar',
+  'budget.linkedToReservation': 'Vinculado a una reserva — edite el nombre allí',
  'budget.confirm.deleteCategory': '¿Seguro que quieres eliminar la categoría "{name}" con {count} entradas?',
  'budget.deleteCategory': 'Eliminar categoría',
  'budget.perPerson': 'Por persona',
@@ -1041,6 +1094,9 @@ const es: Record<string, string> = {
  'packing.template': 'Plantilla',
  'packing.templateApplied': '{count} artículos añadidos desde plantilla',
  'packing.templateError': 'Error al aplicar plantilla',
+  'packing.saveAsTemplate': 'Guardar como plantilla',
+  'packing.templateName': 'Nombre de la plantilla',
+  'packing.templateSaved': 'Lista de equipaje guardada como plantilla',
  'packing.assignUser': 'Asignar usuario',
  'packing.noMembers': 'Sin miembros',
  'packing.bags': 'Equipaje',
@@ -1321,8 +1377,8 @@ const es: Record<string, string> = {
  'day.hotelDayRange': 'Aplicar a los días',
  'day.noPlacesForHotel': 'Añade primero lugares al viaje',
  'day.allDays': 'Todos',
-  'day.checkIn': 'Check-in',
-  'day.checkOut': 'Check-out',
+  'day.checkIn': 'Registro de entrada',
+  'day.checkOut': 'Registro de salida',
  'day.confirmation': 'Confirmación',
  'day.editAccommodation': 'Editar alojamiento',
  'day.reservations': 'Reservas',
@@ -1331,6 +1387,7 @@ const es: Record<string, string> = {
  'memories.title': 'Fotos',
  'memories.notConnected': 'Immich no conectado',
  'memories.notConnectedHint': 'Conecta tu instancia de Immich en Ajustes para ver tus fotos de viaje aquí.',
+  'memories.notConnectedMultipleHint': 'Conecta alguno de estos proveedores de fotos: {provider_names} en Configuración para poder añadir fotos a este viaje.',
  'memories.noDates': 'Añade fechas a tu viaje para cargar fotos.',
  'memories.noPhotos': 'No se encontraron fotos',
  'memories.noPhotosHint': 'No se encontraron fotos en Immich para el rango de fechas de este viaje.',
@@ -1341,26 +1398,35 @@ const es: Record<string, string> = {
  'memories.reviewTitle': 'Revisar tus fotos',
  'memories.reviewHint': 'Haz clic en las fotos para excluirlas de compartir.',
  'memories.shareCount': 'Compartir {count} fotos',
-  'memories.immichUrl': 'URL del servidor Immich',
-  'memories.immichApiKey': 'Clave API',
+  'memories.providerUrl': 'URL del servidor',
+  'memories.providerApiKey': 'Clave API',
+  'memories.providerUsername': 'Nombre de usuario',
+  'memories.providerPassword': 'Contraseña',
+  'memories.providerOTP': 'Código MFA (si está habilitado)',
+  'memories.skipSSLVerification': 'Omitir verificación del certificado SSL',
+  'memories.providerUrlHintSynology': 'Incluye la ruta de la aplicación Photos en la URL, p.ej. https://nas:5001/photo',
  'memories.testConnection': 'Probar conexión',
  'memories.testFirst': 'Probar conexión primero',
  'memories.connected': 'Conectado',
  'memories.disconnected': 'No conectado',
  'memories.connectionSuccess': 'Conectado a Immich',
  'memories.connectionError': 'No se pudo conectar a Immich',
-  'memories.saved': 'Configuración de Immich guardada',
+  'memories.saved': 'Configuración de {provider_name} guardada',
+  'memories.providerDisconnectedBanner': 'Se perdió la conexión con {provider_name}. Vuelve a conectar en Configuración para ver las fotos.',
+  'memories.saveError': 'No se pudieron guardar los ajustes de {provider_name}',
  'memories.oldest': 'Más antiguas',
  'memories.newest': 'Más recientes',
  'memories.allLocations': 'Todas las ubicaciones',
  'memories.addPhotos': 'Añadir fotos',
  'memories.linkAlbum': 'Vincular álbum',
  'memories.selectAlbum': 'Seleccionar álbum de Immich',
+  'memories.selectAlbumMultiple': 'Seleccionar álbum',
  'memories.noAlbums': 'No se encontraron álbumes',
  'memories.syncAlbum': 'Sincronizar álbum',
  'memories.unlinkAlbum': 'Desvincular',
  'memories.photos': 'fotos',
  'memories.selectPhotos': 'Seleccionar fotos de Immich',
+  'memories.selectPhotosMultiple': 'Seleccionar fotos',
  'memories.selectHint': 'Toca las fotos para seleccionarlas.',
  'memories.selected': 'seleccionado(s)',
  'memories.addSelected': 'Añadir {count} fotos',
@@ -1475,8 +1541,8 @@ const es: Record<string, string> = {
  'reservations.meta.trainNumber': 'N° de tren',
  'reservations.meta.platform': 'Andén',
  'reservations.meta.seat': 'Asiento',
-  'reservations.meta.checkIn': 'Check-in',
-  'reservations.meta.checkOut': 'Check-out',
+  'reservations.meta.checkIn': 'Registro de entrada',
+  'reservations.meta.checkOut': 'Registro de salida',
  'reservations.meta.linkAccommodation': 'Alojamiento',
  'reservations.meta.pickAccommodation': 'Vincular con alojamiento',
  'reservations.meta.noAccommodation': 'Ninguno',
@@ -1570,6 +1636,8 @@ const es: Record<string, string> = {
  'notifications.markUnread': 'Marcar como no leída',
  'notifications.delete': 'Eliminar',
  'notifications.system': 'Sistema',
+  'notifications.synologySessionCleared.title': 'Synology Photos desconectado',
+  'notifications.synologySessionCleared.text': 'Tu servidor o cuenta ha cambiado — ve a Configuración para probar la conexión de nuevo.',
  'memories.error.loadAlbums': 'Error al cargar los álbumes',
  'memories.error.linkAlbum': 'Error al vincular el álbum',
  'memories.error.unlinkAlbum': 'Error al desvincular el álbum',
@@ -1925,6 +1993,69 @@ const es: Record<string, string> = {
  'dayplan.mobile.createNew': 'Crear nuevo lugar',
  'admin.addons.catalog.journey.name': 'Travesía',
  'admin.addons.catalog.journey.description': 'Seguimiento de viajes y diario de viajero con registros de ubicación, fotos e historias diarias',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Viajes',
+  'oauth.scope.group.places': 'Lugares',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Equipaje',
+  'oauth.scope.group.todos': 'Tareas',
+  'oauth.scope.group.budget': 'Presupuesto',
+  'oauth.scope.group.reservations': 'Reservas',
+  'oauth.scope.group.collab': 'Colaboración',
+  'oauth.scope.group.notifications': 'Notificaciones',
+  'oauth.scope.group.vacay': 'Vacaciones',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Clima',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Ver viajes e itinerarios',
+  'oauth.scope.trips:read.description': 'Leer viajes, días, notas y miembros',
+  'oauth.scope.trips:write.label': 'Editar viajes e itinerarios',
+  'oauth.scope.trips:write.description': 'Crear y actualizar viajes, días, notas y gestionar miembros',
+  'oauth.scope.trips:delete.label': 'Eliminar viajes',
+  'oauth.scope.trips:delete.description': 'Eliminar viajes permanentemente — esta acción es irreversible',
+  'oauth.scope.trips:share.label': 'Gestionar enlaces de compartir',
+  'oauth.scope.trips:share.description': 'Crear, actualizar y revocar enlaces públicos de viaje',
+  'oauth.scope.places:read.label': 'Ver lugares y datos del mapa',
+  'oauth.scope.places:read.description': 'Leer lugares, asignaciones de días, etiquetas y categorías',
+  'oauth.scope.places:write.label': 'Gestionar lugares',
+  'oauth.scope.places:write.description': 'Crear, actualizar y eliminar lugares, asignaciones y etiquetas',
+  'oauth.scope.atlas:read.label': 'Ver Atlas',
+  'oauth.scope.atlas:read.description': 'Leer países visitados, regiones y lista de deseos',
+  'oauth.scope.atlas:write.label': 'Gestionar Atlas',
+  'oauth.scope.atlas:write.description': 'Marcar países y regiones como visitados, gestionar lista de deseos',
+  'oauth.scope.packing:read.label': 'Ver listas de equipaje',
+  'oauth.scope.packing:read.description': 'Leer artículos, maletas y responsables de categoría',
+  'oauth.scope.packing:write.label': 'Gestionar listas de equipaje',
+  'oauth.scope.packing:write.description': 'Agregar, actualizar, eliminar, marcar y reordenar artículos y maletas',
+  'oauth.scope.todos:read.label': 'Ver listas de tareas',
+  'oauth.scope.todos:read.description': 'Leer tareas del viaje y responsables de categoría',
+  'oauth.scope.todos:write.label': 'Gestionar listas de tareas',
+  'oauth.scope.todos:write.description': 'Crear, actualizar, marcar, eliminar y reordenar tareas',
+  'oauth.scope.budget:read.label': 'Ver presupuesto',
+  'oauth.scope.budget:read.description': 'Leer partidas de presupuesto y desglose de gastos',
+  'oauth.scope.budget:write.label': 'Gestionar presupuesto',
+  'oauth.scope.budget:write.description': 'Crear, actualizar y eliminar partidas de presupuesto',
+  'oauth.scope.reservations:read.label': 'Ver reservas',
+  'oauth.scope.reservations:read.description': 'Leer reservas y detalles de alojamiento',
+  'oauth.scope.reservations:write.label': 'Gestionar reservas',
+  'oauth.scope.reservations:write.description': 'Crear, actualizar, eliminar y reordenar reservas',
+  'oauth.scope.collab:read.label': 'Ver colaboración',
+  'oauth.scope.collab:read.description': 'Leer notas colaborativas, encuestas y mensajes',
+  'oauth.scope.collab:write.label': 'Gestionar colaboración',
+  'oauth.scope.collab:write.description': 'Crear, actualizar y eliminar notas, encuestas y mensajes',
+  'oauth.scope.notifications:read.label': 'Ver notificaciones',
+  'oauth.scope.notifications:read.description': 'Leer notificaciones y conteos no leídos',
+  'oauth.scope.notifications:write.label': 'Gestionar notificaciones',
+  'oauth.scope.notifications:write.description': 'Marcar notificaciones como leídas y responderlas',
+  'oauth.scope.vacay:read.label': 'Ver planes de vacaciones',
+  'oauth.scope.vacay:read.description': 'Leer datos de planificación, entradas y estadísticas de vacaciones',
+  'oauth.scope.vacay:write.label': 'Gestionar planes de vacaciones',
+  'oauth.scope.vacay:write.description': 'Crear y gestionar entradas de vacaciones, festivos y planes de equipo',
+  'oauth.scope.geo:read.label': 'Mapas y geocodificación',
+  'oauth.scope.geo:read.description': 'Buscar lugares, resolver URLs de mapa y geocodificar coordenadas',
+  'oauth.scope.weather:read.label': 'Previsiones meteorológicas',
+  'oauth.scope.weather:read.description': 'Obtener previsiones meteorológicas para lugares y fechas del viaje',
 }

 export default es
@@ -179,9 +179,6 @@ const fr: Record<string, string> = {
  'admin.notifications.none': 'Désactivé',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Événements de notification',
-  'admin.notifications.eventsHint': 'Choisissez quels événements déclenchent des notifications pour tous les utilisateurs.',
-  'admin.notifications.configureFirst': 'Configurez d\'abord les paramètres SMTP ou webhook ci-dessous, puis activez les événements.',
  'admin.notifications.save': 'Enregistrer les paramètres de notification',
  'admin.notifications.saved': 'Paramètres de notification enregistrés',
  'admin.notifications.testWebhook': 'Envoyer un webhook de test',
@@ -228,6 +225,7 @@ const fr: Record<string, string> = {
  'settings.mcp.endpoint': 'Point de terminaison MCP',
  'settings.mcp.clientConfig': 'Configuration du client',
  'settings.mcp.clientConfigHint': 'Remplacez <your_token> par un token API de la liste ci-dessous. Le chemin vers npx devra peut-être être ajusté selon votre système (ex. C:\\PROGRA~1\\nodejs\\npx.cmd sous Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Remplacez <your_client_id> et <your_client_secret> par les identifiants affichés dans le client OAuth 2.1 créé ci-dessus. mcp-remote ouvrira votre navigateur pour finaliser l\'autorisation lors de la première connexion. Le chemin vers npx devra peut-être être ajusté selon votre système (ex. C:\\PROGRA~1\\nodejs\\npx.cmd sous Windows).',
  'settings.mcp.copy': 'Copier',
  'settings.mcp.copied': 'Copié !',
  'settings.mcp.apiTokens': 'Tokens API',
@@ -249,6 +247,48 @@ const fr: Record<string, string> = {
  'settings.mcp.toast.createError': 'Impossible de créer le token',
  'settings.mcp.toast.deleted': 'Token supprimé',
  'settings.mcp.toast.deleteError': 'Impossible de supprimer le token',
+  'settings.mcp.apiTokensDeprecated': 'Les tokens API sont dépréciés et seront supprimés dans une prochaine version. Veuillez utiliser les clients OAuth 2.1 à la place.',
+  'settings.oauth.clients': 'Clients OAuth 2.1',
+  'settings.oauth.clientsHint': 'Enregistrez des clients OAuth 2.1 pour permettre à des applications MCP tierces (Claude Web, Cursor, etc.) de se connecter sans tokens statiques.',
+  'settings.oauth.createClient': 'Nouveau client',
+  'settings.oauth.noClients': 'Aucun client OAuth enregistré.',
+  'settings.oauth.clientId': 'ID client',
+  'settings.oauth.clientSecret': 'Secret client',
+  'settings.oauth.deleteClient': 'Supprimer le client',
+  'settings.oauth.deleteClientMessage': 'Ce client et toutes les sessions actives seront définitivement supprimés. Toute application l\'utilisant perdra immédiatement l\'accès.',
+  'settings.oauth.rotateSecret': 'Renouveler le secret',
+  'settings.oauth.rotateSecretMessage': 'Un nouveau secret client sera généré et toutes les sessions existantes seront immédiatement invalidées. Mettez à jour votre application avant de fermer cette fenêtre.',
+  'settings.oauth.rotateSecretConfirm': 'Renouveler',
+  'settings.oauth.rotateSecretConfirming': 'Renouvellement…',
+  'settings.oauth.rotateSecretDoneTitle': 'Nouveau secret généré',
+  'settings.oauth.rotateSecretDoneWarning': 'Ce secret n\'est affiché qu\'une seule fois. Copiez-le maintenant et mettez à jour votre application — toutes les sessions précédentes ont été invalidées.',
+  'settings.oauth.activeSessions': 'Sessions OAuth actives',
+  'settings.oauth.sessionScopes': 'Portées',
+  'settings.oauth.sessionExpires': 'Expire',
+  'settings.oauth.revoke': 'Révoquer',
+  'settings.oauth.revokeSession': 'Révoquer la session',
+  'settings.oauth.revokeSessionMessage': 'Cela révoquera immédiatement l\'accès pour cette session OAuth.',
+  'settings.oauth.modal.createTitle': 'Enregistrer un client OAuth',
+  'settings.oauth.modal.presets': 'Préréglages rapides',
+  'settings.oauth.modal.clientName': 'Nom de l\'application',
+  'settings.oauth.modal.clientNamePlaceholder': 'ex. Claude Web, Mon app MCP',
+  'settings.oauth.modal.redirectUris': 'URIs de redirection',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Une URI par ligne. HTTPS requis (localhost exempté). Correspondance exacte.',
+  'settings.oauth.modal.scopes': 'Portées autorisées',
+  'settings.oauth.modal.scopesHint': 'list_trips et get_trip_summary sont toujours disponibles — aucune portée requise. Ils permettent à l\'IA de découvrir les IDs de voyage nécessaires.',
+  'settings.oauth.modal.selectAll': 'Tout sélectionner',
+  'settings.oauth.modal.deselectAll': 'Tout désélectionner',
+  'settings.oauth.modal.creating': 'Enregistrement…',
+  'settings.oauth.modal.create': 'Enregistrer le client',
+  'settings.oauth.modal.createdTitle': 'Client enregistré',
+  'settings.oauth.modal.createdWarning': 'Le secret client n\'est affiché qu\'une seule fois. Copiez-le maintenant — il ne peut pas être récupéré.',
+  'settings.oauth.toast.createError': 'Impossible d\'enregistrer le client OAuth',
+  'settings.oauth.toast.deleted': 'Client OAuth supprimé',
+  'settings.oauth.toast.deleteError': 'Impossible de supprimer le client OAuth',
+  'settings.oauth.toast.revoked': 'Session révoquée',
+  'settings.oauth.toast.revokeError': 'Impossible de révoquer la session',
+  'settings.oauth.toast.rotateError': 'Impossible de renouveler le secret client',
  'settings.account': 'Compte',
  'settings.about': 'À propos',
  'settings.about.reportBug': 'Signaler un bug',
@@ -560,9 +600,10 @@ const fr: Record<string, string> = {
  'admin.audit.col.details': 'Détails',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'Tokens MCP',
-  'admin.mcpTokens.title': 'Tokens MCP',
-  'admin.mcpTokens.subtitle': 'Gérer les tokens API de tous les utilisateurs',
+  'admin.tabs.mcpTokens': 'Accès MCP',
+  'admin.mcpTokens.title': 'Accès MCP',
+  'admin.mcpTokens.subtitle': 'Gérer les sessions OAuth et les tokens API de tous les utilisateurs',
+  'admin.mcpTokens.sectionTitle': 'Tokens API',
  'admin.mcpTokens.owner': 'Propriétaire',
  'admin.mcpTokens.tokenName': 'Nom du token',
  'admin.mcpTokens.created': 'Créé',
@@ -574,6 +615,17 @@ const fr: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': 'Token supprimé',
  'admin.mcpTokens.deleteError': 'Impossible de supprimer le token',
  'admin.mcpTokens.loadError': 'Impossible de charger les tokens',
+  'admin.oauthSessions.sectionTitle': 'Sessions OAuth',
+  'admin.oauthSessions.clientName': 'Client',
+  'admin.oauthSessions.owner': 'Propriétaire',
+  'admin.oauthSessions.scopes': 'Portées',
+  'admin.oauthSessions.created': 'Créé',
+  'admin.oauthSessions.empty': 'Aucune session OAuth active',
+  'admin.oauthSessions.revokeTitle': 'Révoquer la session',
+  'admin.oauthSessions.revokeMessage': 'Cette session OAuth sera révoquée immédiatement. Le client perdra l\'accès MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Session révoquée',
+  'admin.oauthSessions.revokeError': 'Impossible de révoquer la session',
+  'admin.oauthSessions.loadError': 'Impossible de charger les sessions OAuth',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1005,6 +1057,7 @@ const fr: Record<string, string> = {
  'budget.totalBudget': 'Budget total',
  'budget.byCategory': 'Par catégorie',
  'budget.editTooltip': 'Cliquez pour modifier',
+  'budget.linkedToReservation': 'Lié à une réservation — modifiez le nom depuis celle-ci',
  'budget.confirm.deleteCategory': 'Voulez-vous vraiment supprimer la catégorie « {name} » avec {count} entrées ?',
  'budget.deleteCategory': 'Supprimer la catégorie',
  'budget.perPerson': 'Par personne',
@@ -1103,6 +1156,9 @@ const fr: Record<string, string> = {
  'packing.template': 'Modèle',
  'packing.templateApplied': '{count} articles ajoutés depuis le modèle',
  'packing.templateError': 'Erreur lors de l\'application du modèle',
+  'packing.saveAsTemplate': 'Enregistrer comme modèle',
+  'packing.templateName': 'Nom du modèle',
+  'packing.templateSaved': 'Liste de voyage enregistrée comme modèle',
  'packing.assignUser': 'Assigner un utilisateur',
  'packing.noMembers': 'Aucun membre',
  'packing.bags': 'Bagages',
@@ -1378,6 +1434,7 @@ const fr: Record<string, string> = {
  'memories.title': 'Photos',
  'memories.notConnected': 'Immich non connecté',
  'memories.notConnectedHint': 'Connectez votre instance Immich dans les paramètres pour voir vos photos de voyage ici.',
+  'memories.notConnectedMultipleHint': 'Connectez un de ces fournisseurs de photos : {provider_names} dans les Paramètres pour pouvoir ajouter des photos à ce voyage.',
  'memories.noDates': 'Ajoutez des dates à votre voyage pour charger les photos.',
  'memories.noPhotos': 'Aucune photo trouvée',
  'memories.noPhotosHint': 'Aucune photo trouvée dans Immich pour la période de ce voyage.',
@@ -1388,26 +1445,35 @@ const fr: Record<string, string> = {
  'memories.reviewTitle': 'Vérifier vos photos',
  'memories.reviewHint': 'Cliquez sur les photos pour les exclure du partage.',
  'memories.shareCount': 'Partager {count} photos',
-  'memories.immichUrl': 'URL du serveur Immich',
-  'memories.immichApiKey': 'Clé API',
+  'memories.providerUrl': 'URL du serveur',
+  'memories.providerApiKey': 'Clé API',
+  'memories.providerUsername': 'Nom d\'utilisateur',
+  'memories.providerPassword': 'Mot de passe',
+  'memories.providerOTP': 'Code MFA (si activé)',
+  'memories.skipSSLVerification': 'Ignorer la vérification du certificat SSL',
+  'memories.providerUrlHintSynology': 'Incluez le chemin de l\'application Photos dans l\'URL, ex. https://nas:5001/photo',
  'memories.testConnection': 'Tester la connexion',
  'memories.testFirst': 'Testez la connexion avant de sauvegarder',
  'memories.connected': 'Connecté',
  'memories.disconnected': 'Non connecté',
  'memories.connectionSuccess': 'Connecté à Immich',
  'memories.connectionError': 'Impossible de se connecter à Immich',
-  'memories.saved': 'Paramètres Immich enregistrés',
+  'memories.saved': 'Paramètres {provider_name} enregistrés',
+  'memories.providerDisconnectedBanner': 'Votre connexion {provider_name} est perdue. Reconnectez-vous dans les Paramètres pour voir les photos.',
+  'memories.saveError': 'Impossible d\'enregistrer les paramètres de {provider_name}',
  'memories.oldest': 'Plus anciennes',
  'memories.newest': 'Plus récentes',
  'memories.allLocations': 'Tous les lieux',
  'memories.addPhotos': 'Ajouter des photos',
  'memories.linkAlbum': 'Lier un album',
  'memories.selectAlbum': 'Choisir un album Immich',
+  'memories.selectAlbumMultiple': 'Sélectionner un album',
  'memories.noAlbums': 'Aucun album trouvé',
  'memories.syncAlbum': 'Synchroniser',
  'memories.unlinkAlbum': 'Délier',
  'memories.photos': 'photos',
  'memories.selectPhotos': 'Sélectionner des photos depuis Immich',
+  'memories.selectPhotosMultiple': 'Sélectionner des photos',
  'memories.selectHint': 'Appuyez sur les photos pour les sélectionner.',
  'memories.selected': 'sélectionné(s)',
  'memories.addSelected': 'Ajouter {count} photos',
@@ -1564,6 +1630,8 @@ const fr: Record<string, string> = {
  'notifications.markUnread': 'Marquer comme non lu',
  'notifications.delete': 'Supprimer',
  'notifications.system': 'Système',
+  'notifications.synologySessionCleared.title': 'Synology Photos déconnecté',
+  'notifications.synologySessionCleared.text': 'Votre serveur ou compte a changé — allez dans Paramètres pour tester à nouveau votre connexion.',
  'memories.error.loadAlbums': 'Impossible de charger les albums',
  'memories.error.linkAlbum': 'Impossible de lier l\'album',
  'memories.error.unlinkAlbum': 'Impossible de dissocier l\'album',
@@ -1919,6 +1987,69 @@ const fr: Record<string, string> = {
  'dayplan.mobile.createNew': 'Créer un nouveau lieu',
  'admin.addons.catalog.journey.name': 'Journal de voyage',
  'admin.addons.catalog.journey.description': 'Suivi de voyages et journal avec check-ins, photos et récits quotidiens',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Voyages',
+  'oauth.scope.group.places': 'Lieux',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Bagages',
+  'oauth.scope.group.todos': 'Tâches',
+  'oauth.scope.group.budget': 'Budget',
+  'oauth.scope.group.reservations': 'Réservations',
+  'oauth.scope.group.collab': 'Collaboration',
+  'oauth.scope.group.notifications': 'Notifications',
+  'oauth.scope.group.vacay': 'Congés',
+  'oauth.scope.group.geo': 'Géo',
+  'oauth.scope.group.weather': 'Météo',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Voir les voyages et itinéraires',
+  'oauth.scope.trips:read.description': 'Lire les voyages, jours, notes et membres',
+  'oauth.scope.trips:write.label': 'Modifier les voyages et itinéraires',
+  'oauth.scope.trips:write.description': 'Créer et mettre à jour les voyages, jours, notes et gérer les membres',
+  'oauth.scope.trips:delete.label': 'Supprimer des voyages',
+  'oauth.scope.trips:delete.description': 'Supprimer définitivement des voyages entiers — cette action est irréversible',
+  'oauth.scope.trips:share.label': 'Gérer les liens de partage',
+  'oauth.scope.trips:share.description': 'Créer, modifier et révoquer des liens de partage publics',
+  'oauth.scope.places:read.label': 'Voir les lieux et données cartographiques',
+  'oauth.scope.places:read.description': 'Lire les lieux, affectations de jours, étiquettes et catégories',
+  'oauth.scope.places:write.label': 'Gérer les lieux',
+  'oauth.scope.places:write.description': 'Créer, modifier et supprimer des lieux, affectations et étiquettes',
+  'oauth.scope.atlas:read.label': 'Voir l\'Atlas',
+  'oauth.scope.atlas:read.description': 'Lire les pays visités, régions et liste de souhaits',
+  'oauth.scope.atlas:write.label': 'Gérer l\'Atlas',
+  'oauth.scope.atlas:write.description': 'Marquer des pays et régions visités, gérer la liste de souhaits',
+  'oauth.scope.packing:read.label': 'Voir les listes de bagages',
+  'oauth.scope.packing:read.description': 'Lire les articles, sacs et assignations de catégories',
+  'oauth.scope.packing:write.label': 'Gérer les listes de bagages',
+  'oauth.scope.packing:write.description': 'Ajouter, modifier, supprimer, cocher et réordonner les articles et sacs',
+  'oauth.scope.todos:read.label': 'Voir les listes de tâches',
+  'oauth.scope.todos:read.description': 'Lire les tâches et assignations de catégories',
+  'oauth.scope.todos:write.label': 'Gérer les listes de tâches',
+  'oauth.scope.todos:write.description': 'Créer, modifier, cocher, supprimer et réordonner les tâches',
+  'oauth.scope.budget:read.label': 'Voir le budget',
+  'oauth.scope.budget:read.description': 'Lire les dépenses et la répartition du budget',
+  'oauth.scope.budget:write.label': 'Gérer le budget',
+  'oauth.scope.budget:write.description': 'Créer, modifier et supprimer des dépenses',
+  'oauth.scope.reservations:read.label': 'Voir les réservations',
+  'oauth.scope.reservations:read.description': 'Lire les réservations et détails d\'hébergement',
+  'oauth.scope.reservations:write.label': 'Gérer les réservations',
+  'oauth.scope.reservations:write.description': 'Créer, modifier, supprimer et réordonner les réservations',
+  'oauth.scope.collab:read.label': 'Voir la collaboration',
+  'oauth.scope.collab:read.description': 'Lire les notes, sondages et messages collaboratifs',
+  'oauth.scope.collab:write.label': 'Gérer la collaboration',
+  'oauth.scope.collab:write.description': 'Créer, modifier et supprimer des notes, sondages et messages',
+  'oauth.scope.notifications:read.label': 'Voir les notifications',
+  'oauth.scope.notifications:read.description': 'Lire les notifications et le nombre de non-lus',
+  'oauth.scope.notifications:write.label': 'Gérer les notifications',
+  'oauth.scope.notifications:write.description': 'Marquer les notifications comme lues et y répondre',
+  'oauth.scope.vacay:read.label': 'Voir les plans de congés',
+  'oauth.scope.vacay:read.description': 'Lire les données, entrées et statistiques de congés',
+  'oauth.scope.vacay:write.label': 'Gérer les plans de congés',
+  'oauth.scope.vacay:write.description': 'Créer et gérer les entrées de congés, jours fériés et plans d\'équipe',
+  'oauth.scope.geo:read.label': 'Cartes et géocodage',
+  'oauth.scope.geo:read.description': 'Chercher des lieux, résoudre des URL cartographiques et géocoder des coordonnées',
+  'oauth.scope.weather:read.label': 'Prévisions météo',
+  'oauth.scope.weather:read.description': 'Obtenir les prévisions météo pour les lieux et dates de voyage',
 }

 export default fr
@@ -180,6 +180,7 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'MCP végpont',
  'settings.mcp.clientConfig': 'Kliens konfiguráció',
  'settings.mcp.clientConfigHint': 'Cserélje ki a <your_token> részt egy API tokenre az alábbi listából. Az npx elérési útját szükség lehet módosítani a rendszeréhez (pl. C:\\PROGRA~1\\nodejs\\npx.cmd Windows-on).',
+  'settings.mcp.clientConfigHintOAuth': 'Cserélje ki a <your_client_id> és <your_client_secret> részeket a fent létrehozott OAuth 2.1 kliens adataival. Az mcp-remote megnyitja a böngészőt az első csatlakozáskor az engedélyezés elvégzéséhez. Az npx elérési útját szükség lehet módosítani a rendszeréhez (pl. C:\\PROGRA~1\\nodejs\\npx.cmd Windows-on).',
  'settings.mcp.copy': 'Másolás',
  'settings.mcp.copied': 'Másolva!',
  'settings.mcp.apiTokens': 'API tokenek',
@@ -201,6 +202,48 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Nem sikerült létrehozni a tokent',
  'settings.mcp.toast.deleted': 'Token törölve',
  'settings.mcp.toast.deleteError': 'Nem sikerült törölni a tokent',
+  'settings.mcp.apiTokensDeprecated': 'Az API tokenek elavultak és egy jövőbeli verzióban eltávolításra kerülnek. Kérjük, használjon helyettük OAuth 2.1 klienseket.',
+  'settings.oauth.clients': 'OAuth 2.1 kliensek',
+  'settings.oauth.clientsHint': 'Regisztráljon OAuth 2.1 klienseket, hogy a harmadik féltől származó MCP alkalmazások (Claude Web, Cursor stb.) statikus tokenek nélkül csatlakozhassanak.',
+  'settings.oauth.createClient': 'Új kliens',
+  'settings.oauth.noClients': 'Nincs regisztrált OAuth kliens.',
+  'settings.oauth.clientId': 'Kliens azonosító',
+  'settings.oauth.clientSecret': 'Kliens titok',
+  'settings.oauth.deleteClient': 'Kliens törlése',
+  'settings.oauth.deleteClientMessage': 'Ez a kliens és az összes aktív munkamenet véglegesen törlésre kerül. Minden alkalmazás, amely ezt használja, azonnal elveszíti a hozzáférést.',
+  'settings.oauth.rotateSecret': 'Titok megújítása',
+  'settings.oauth.rotateSecretMessage': 'Új kliens titok kerül generálásra és az összes meglévő munkamenet azonnal érvénytelenné válik. Frissítse alkalmazását a párbeszéd bezárása előtt.',
+  'settings.oauth.rotateSecretConfirm': 'Megújítás',
+  'settings.oauth.rotateSecretConfirming': 'Megújítás…',
+  'settings.oauth.rotateSecretDoneTitle': 'Új titok generálva',
+  'settings.oauth.rotateSecretDoneWarning': 'Ez a titok csak egyszer jelenik meg. Másolja most és frissítse alkalmazását — az összes korábbi munkamenet érvénytelenné vált.',
+  'settings.oauth.activeSessions': 'Aktív OAuth munkamenetek',
+  'settings.oauth.sessionScopes': 'Jogosultságok',
+  'settings.oauth.sessionExpires': 'Lejár',
+  'settings.oauth.revoke': 'Visszavonás',
+  'settings.oauth.revokeSession': 'Munkamenet visszavonása',
+  'settings.oauth.revokeSessionMessage': 'Ez azonnal visszavonja a hozzáférést ehhez az OAuth munkamenethez.',
+  'settings.oauth.modal.createTitle': 'OAuth kliens regisztrálása',
+  'settings.oauth.modal.presets': 'Gyors beállítások',
+  'settings.oauth.modal.clientName': 'Alkalmazás neve',
+  'settings.oauth.modal.clientNamePlaceholder': 'pl. Claude Web, Az én MCP appom',
+  'settings.oauth.modal.redirectUris': 'Átirányítási URI-k',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Soronként egy URI. HTTPS szükséges (localhost kivételével). Pontos egyezés szükséges.',
+  'settings.oauth.modal.scopes': 'Engedélyezett jogosultságok',
+  'settings.oauth.modal.scopesHint': 'A list_trips és get_trip_summary mindig elérhető — jogosultság nélkül. Segítenek az AI-nak megtalálni az utazás azonosítókat.',
+  'settings.oauth.modal.selectAll': 'Összes kijelölése',
+  'settings.oauth.modal.deselectAll': 'Összes kijelölés törlése',
+  'settings.oauth.modal.creating': 'Regisztrálás…',
+  'settings.oauth.modal.create': 'Kliens regisztrálása',
+  'settings.oauth.modal.createdTitle': 'Kliens regisztrálva',
+  'settings.oauth.modal.createdWarning': 'A kliens titok csak egyszer jelenik meg. Másolja most — nem állítható helyre.',
+  'settings.oauth.toast.createError': 'Az OAuth kliens regisztrálása sikertelen',
+  'settings.oauth.toast.deleted': 'OAuth kliens törölve',
+  'settings.oauth.toast.deleteError': 'Az OAuth kliens törlése sikertelen',
+  'settings.oauth.toast.revoked': 'Munkamenet visszavonva',
+  'settings.oauth.toast.revokeError': 'A munkamenet visszavonása sikertelen',
+  'settings.oauth.toast.rotateError': 'A kliens titok megújítása sikertelen',
  'settings.account': 'Fiók',
  'settings.about': 'Névjegy',
  'settings.about.reportBug': 'Hiba bejelentése',
@@ -274,9 +317,6 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.none': 'Kikapcsolva',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Értesítési események',
-  'admin.notifications.eventsHint': 'Válaszd ki, mely események indítsanak értesítéseket minden felhasználó számára.',
-  'admin.notifications.configureFirst': 'Először konfiguráld az SMTP vagy webhook beállításokat lent, majd engedélyezd az eseményeket.',
  'admin.notifications.save': 'Értesítési beállítások mentése',
  'admin.notifications.saved': 'Értesítési beállítások mentve',
  'admin.notifications.testWebhook': 'Teszt webhook küldése',
@@ -561,9 +601,10 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'admin.audit.col.details': 'Részletek',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP tokenek',
-  'admin.mcpTokens.title': 'MCP tokenek',
-  'admin.mcpTokens.subtitle': 'Összes felhasználó API tokeneinek kezelése',
+  'admin.tabs.mcpTokens': 'MCP hozzáférés',
+  'admin.mcpTokens.title': 'MCP hozzáférés',
+  'admin.mcpTokens.subtitle': 'OAuth munkamenetek és API tokenek kezelése az összes felhasználó számára',
+  'admin.mcpTokens.sectionTitle': 'API tokenek',
  'admin.mcpTokens.owner': 'Tulajdonos',
  'admin.mcpTokens.tokenName': 'Token neve',
  'admin.mcpTokens.created': 'Létrehozva',
@@ -575,6 +616,17 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token törölve',
  'admin.mcpTokens.deleteError': 'Nem sikerült törölni a tokent',
  'admin.mcpTokens.loadError': 'Nem sikerült betölteni a tokeneket',
+  'admin.oauthSessions.sectionTitle': 'OAuth munkamenetek',
+  'admin.oauthSessions.clientName': 'Kliens',
+  'admin.oauthSessions.owner': 'Tulajdonos',
+  'admin.oauthSessions.scopes': 'Jogosultságok',
+  'admin.oauthSessions.created': 'Létrehozva',
+  'admin.oauthSessions.empty': 'Nincsenek aktív OAuth munkamenetek',
+  'admin.oauthSessions.revokeTitle': 'Munkamenet visszavonása',
+  'admin.oauthSessions.revokeMessage': 'Ez az OAuth munkamenet azonnal visszavonásra kerül. A kliens elveszíti az MCP hozzáférést.',
+  'admin.oauthSessions.revokeSuccess': 'Munkamenet visszavonva',
+  'admin.oauthSessions.revokeError': 'Nem sikerült visszavonni a munkamenetet',
+  'admin.oauthSessions.loadError': 'Nem sikerült betölteni az OAuth munkameneteket',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1006,6 +1058,7 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'Teljes költségvetés',
  'budget.byCategory': 'Kategóriánként',
  'budget.editTooltip': 'Kattints a szerkesztéshez',
+  'budget.linkedToReservation': 'Foglaláshoz kapcsolva — ott szerkessze a nevet',
  'budget.confirm.deleteCategory': 'Biztosan törölni szeretnéd a(z) "{name}" kategóriát {count} bejegyzéssel?',
  'budget.deleteCategory': 'Kategória törlése',
  'budget.perPerson': 'Személyenként',
@@ -1106,6 +1159,9 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'Sablon',
  'packing.templateApplied': '{count} tétel hozzáadva a sablonból',
  'packing.templateError': 'Nem sikerült alkalmazni a sablont',
+  'packing.saveAsTemplate': 'Mentés sablonként',
+  'packing.templateName': 'Sablon neve',
+  'packing.templateSaved': 'Csomaglista elmentve sablonként',
  'packing.bags': 'Táskák',
  'packing.noBag': 'Nincs hozzárendelve',
  'packing.totalWeight': 'Összsúly',
@@ -1449,6 +1505,7 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Fotók',
  'memories.notConnected': 'Immich nincs csatlakoztatva',
  'memories.notConnectedHint': 'Csatlakoztasd az Immich példányodat a Beállításokban, hogy itt lásd az utazási fotóidat.',
+  'memories.notConnectedMultipleHint': 'A fényképek hozzáadásához csatlakoztasson egyet a következő fényképszolgáltatók közül a Beállításokban: {provider_names}.',
  'memories.noDates': 'Adj hozzá dátumokat az utazáshoz a fotók betöltéséhez.',
  'memories.noPhotos': 'Nem találhatók fotók',
  'memories.noPhotosHint': 'Nem találhatók fotók az Immichben erre az utazási időszakra.',
@@ -1459,23 +1516,32 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Nézd át a fotóidat',
  'memories.reviewHint': 'Kattints a fotókra a megosztásból való kizáráshoz.',
  'memories.shareCount': '{count} fotó megosztása',
-  'memories.immichUrl': 'Immich szerver URL',
-  'memories.immichApiKey': 'API kulcs',
+  'memories.providerUrl': 'Szerver URL',
+  'memories.providerApiKey': 'API kulcs',
+  'memories.providerUsername': 'Felhasználónév',
+  'memories.providerPassword': 'Jelszó',
+  'memories.providerOTP': 'MFA kód (ha engedélyezve van)',
+  'memories.skipSSLVerification': 'SSL tanúsítvány ellenőrzésének kihagyása',
+  'memories.providerUrlHintSynology': 'Adja meg a Photos alkalmazás elérési útját az URL-ben, pl. https://nas:5001/photo',
  'memories.testConnection': 'Kapcsolat tesztelése',
  'memories.testFirst': 'Először teszteld a kapcsolatot',
  'memories.connected': 'Csatlakoztatva',
  'memories.disconnected': 'Nincs csatlakoztatva',
  'memories.connectionSuccess': 'Csatlakozva az Immichhez',
  'memories.connectionError': 'Nem sikerült csatlakozni az Immichhez',
-  'memories.saved': 'Immich beállítások mentve',
+  'memories.saved': '{provider_name} beállítások mentve',
+  'memories.providerDisconnectedBanner': 'A {provider_name} kapcsolat megszakadt. Csatlakozzon újra a Beállításokban a fényképek megtekintéséhez.',
+  'memories.saveError': 'Nem sikerült menteni a(z) {provider_name} beállításait',
  'memories.addPhotos': 'Fotók hozzáadása',
  'memories.linkAlbum': 'Album csatolása',
  'memories.selectAlbum': 'Immich album kiválasztása',
+  'memories.selectAlbumMultiple': 'Album kiválasztása',
  'memories.noAlbums': 'Nem található album',
  'memories.syncAlbum': 'Album szinkronizálása',
  'memories.unlinkAlbum': 'Leválasztás',
  'memories.photos': 'fotó',
  'memories.selectPhotos': 'Fotók kiválasztása az Immichből',
+  'memories.selectPhotosMultiple': 'Fényképek kiválasztása',
  'memories.selectHint': 'Koppints a fotókra a kijelölésükhöz.',
  'memories.selected': 'kijelölve',
  'memories.addSelected': '{count} fotó hozzáadása',
@@ -1565,6 +1631,8 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Olvasatlannak jelölés',
  'notifications.delete': 'Törlés',
  'notifications.system': 'Rendszer',
+  'notifications.synologySessionCleared.title': 'Synology Photos leválasztva',
+  'notifications.synologySessionCleared.text': 'A szerver vagy a fiók megváltozott — lépjen a Beállításokba a kapcsolat újrateszteléséhez.',
  'memories.error.loadAlbums': 'Az albumok betöltése sikertelen',
  'memories.error.linkAlbum': 'Az album csatolása sikertelen',
  'memories.error.unlinkAlbum': 'Az album leválasztása sikertelen',
@@ -1920,6 +1988,69 @@ const hu: Record<string, string | { name: string; category: string }[]> = {
  'dayplan.mobile.createNew': 'Új helyszín létrehozása',
  'admin.addons.catalog.journey.name': 'Útinaplók',
  'admin.addons.catalog.journey.description': 'Utazáskövetés és útinapló bejelentkezésekkel, fotókkal és napi történetekkel',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Utazások',
+  'oauth.scope.group.places': 'Helyek',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Csomagolás',
+  'oauth.scope.group.todos': 'Feladatok',
+  'oauth.scope.group.budget': 'Költségvetés',
+  'oauth.scope.group.reservations': 'Foglalások',
+  'oauth.scope.group.collab': 'Együttműködés',
+  'oauth.scope.group.notifications': 'Értesítések',
+  'oauth.scope.group.vacay': 'Szabadság',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Időjárás',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Utazások és útvonalak megtekintése',
+  'oauth.scope.trips:read.description': 'Utazások, napok, napi feljegyzések és tagok olvasása',
+  'oauth.scope.trips:write.label': 'Utazások és útvonalak szerkesztése',
+  'oauth.scope.trips:write.description': 'Utazások, napok és feljegyzések létrehozása, frissítése és tagok kezelése',
+  'oauth.scope.trips:delete.label': 'Utazások törlése',
+  'oauth.scope.trips:delete.description': 'Teljes utazások végleges törlése — ez a művelet visszafordíthatatlan',
+  'oauth.scope.trips:share.label': 'Megosztási linkek kezelése',
+  'oauth.scope.trips:share.description': 'Nyilvános megosztási linkek létrehozása, frissítése és visszavonása',
+  'oauth.scope.places:read.label': 'Helyek és térképadatok megtekintése',
+  'oauth.scope.places:read.description': 'Helyek, napi hozzárendelések, címkék és kategóriák olvasása',
+  'oauth.scope.places:write.label': 'Helyek kezelése',
+  'oauth.scope.places:write.description': 'Helyek, hozzárendelések és címkék létrehozása, frissítése és törlése',
+  'oauth.scope.atlas:read.label': 'Atlas megtekintése',
+  'oauth.scope.atlas:read.description': 'Meglátogatott országok, régiók és bakancslisták olvasása',
+  'oauth.scope.atlas:write.label': 'Atlas kezelése',
+  'oauth.scope.atlas:write.description': 'Országok és régiók meglátogatottként jelölése, bakancslisták kezelése',
+  'oauth.scope.packing:read.label': 'Csomaglisták megtekintése',
+  'oauth.scope.packing:read.description': 'Csomagolási tételek, táskák és kategória-hozzárendelések olvasása',
+  'oauth.scope.packing:write.label': 'Csomaglisták kezelése',
+  'oauth.scope.packing:write.description': 'Csomagolási tételek és táskák hozzáadása, frissítése, törlése, jelölése és átrendezése',
+  'oauth.scope.todos:read.label': 'Feladatlisták megtekintése',
+  'oauth.scope.todos:read.description': 'Utazás feladatai és kategória-hozzárendelések olvasása',
+  'oauth.scope.todos:write.label': 'Feladatlisták kezelése',
+  'oauth.scope.todos:write.description': 'Feladatok létrehozása, frissítése, jelölése, törlése és átrendezése',
+  'oauth.scope.budget:read.label': 'Költségvetés megtekintése',
+  'oauth.scope.budget:read.description': 'Költségvetési tételek és kiadások részletezésének olvasása',
+  'oauth.scope.budget:write.label': 'Költségvetés kezelése',
+  'oauth.scope.budget:write.description': 'Költségvetési tételek létrehozása, frissítése és törlése',
+  'oauth.scope.reservations:read.label': 'Foglalások megtekintése',
+  'oauth.scope.reservations:read.description': 'Foglalások és szállásadatok olvasása',
+  'oauth.scope.reservations:write.label': 'Foglalások kezelése',
+  'oauth.scope.reservations:write.description': 'Foglalások létrehozása, frissítése, törlése és átrendezése',
+  'oauth.scope.collab:read.label': 'Együttműködés megtekintése',
+  'oauth.scope.collab:read.description': 'Együttműködési feljegyzések, szavazások és üzenetek olvasása',
+  'oauth.scope.collab:write.label': 'Együttműködés kezelése',
+  'oauth.scope.collab:write.description': 'Együttműködési feljegyzések, szavazások és üzenetek létrehozása, frissítése és törlése',
+  'oauth.scope.notifications:read.label': 'Értesítések megtekintése',
+  'oauth.scope.notifications:read.description': 'Alkalmazáson belüli értesítések és olvasatlan számok olvasása',
+  'oauth.scope.notifications:write.label': 'Értesítések kezelése',
+  'oauth.scope.notifications:write.description': 'Értesítések olvasottként jelölése és válaszadás rájuk',
+  'oauth.scope.vacay:read.label': 'Szabadságtervek megtekintése',
+  'oauth.scope.vacay:read.description': 'Szabadságtervezési adatok, bejegyzések és statisztikák olvasása',
+  'oauth.scope.vacay:write.label': 'Szabadságtervek kezelése',
+  'oauth.scope.vacay:write.description': 'Szabadságbejegyzések, ünnepnapok és csapattervek létrehozása és kezelése',
+  'oauth.scope.geo:read.label': 'Térképek és geokódolás',
+  'oauth.scope.geo:read.description': 'Helyek keresése, térkép URL-ek feloldása és koordináták fordított geokódolása',
+  'oauth.scope.weather:read.label': 'Időjárás-előrejelzések',
+  'oauth.scope.weather:read.description': 'Időjárás-előrejelzések lekérése az utazási helyszínekre és dátumokra',
 }

 export default hu
@@ -180,6 +180,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'Endpoint MCP',
  'settings.mcp.clientConfig': 'Configurazione client',
  'settings.mcp.clientConfigHint': 'Sostituisci <your_token> con un token API dalla lista sottostante. Il percorso di npx potrebbe dover essere adattato per il tuo sistema (es. C:\\PROGRA~1\\nodejs\\npx.cmd su Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Replace <your_client_id> and <your_client_secret> with the credentials shown in the OAuth 2.1 client you created above. mcp-remote will open your browser to complete the authorization the first time you connect. The path to npx may need to be adjusted for your system (e.g. C:\PROGRA~1\nodejs\npx.cmd on Windows).',
  'settings.mcp.copy': 'Copia',
  'settings.mcp.copied': 'Copiato!',
  'settings.mcp.apiTokens': 'Token API',
@@ -201,6 +202,48 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Impossibile creare il token',
  'settings.mcp.toast.deleted': 'Token eliminato',
  'settings.mcp.toast.deleteError': 'Impossibile eliminare il token',
+  'settings.mcp.apiTokensDeprecated': 'I token API sono deprecati e verranno rimossi in una versione futura. Utilizza invece i client OAuth 2.1.',
+  'settings.oauth.clients': 'Client OAuth 2.1',
+  'settings.oauth.clientsHint': 'Registra client OAuth 2.1 per consentire alle applicazioni MCP di terze parti (Claude Web, Cursor, ecc.) di connettersi senza token statici.',
+  'settings.oauth.createClient': 'Nuovo client',
+  'settings.oauth.noClients': 'Nessun client OAuth registrato.',
+  'settings.oauth.clientId': 'ID client',
+  'settings.oauth.clientSecret': 'Segreto client',
+  'settings.oauth.deleteClient': 'Elimina client',
+  'settings.oauth.deleteClientMessage': 'Questo client e tutte le sessioni attive verranno eliminati definitivamente. Qualsiasi applicazione che lo utilizza perderà immediatamente l\'accesso.',
+  'settings.oauth.rotateSecret': 'Rinnova segreto',
+  'settings.oauth.rotateSecretMessage': 'Verrà generato un nuovo segreto client e tutte le sessioni esistenti verranno invalidate immediatamente. Aggiorna la tua applicazione prima di chiudere questa finestra.',
+  'settings.oauth.rotateSecretConfirm': 'Rinnova',
+  'settings.oauth.rotateSecretConfirming': 'Rinnovo in corso…',
+  'settings.oauth.rotateSecretDoneTitle': 'Nuovo segreto generato',
+  'settings.oauth.rotateSecretDoneWarning': 'Questo segreto viene mostrato una sola volta. Copialo ora e aggiorna la tua applicazione — tutte le sessioni precedenti sono state invalidate.',
+  'settings.oauth.activeSessions': 'Sessioni OAuth attive',
+  'settings.oauth.sessionScopes': 'Ambiti',
+  'settings.oauth.sessionExpires': 'Scade',
+  'settings.oauth.revoke': 'Revoca',
+  'settings.oauth.revokeSession': 'Revoca sessione',
+  'settings.oauth.revokeSessionMessage': 'Questo revocherà immediatamente l\'accesso per questa sessione OAuth.',
+  'settings.oauth.modal.createTitle': 'Registra client OAuth',
+  'settings.oauth.modal.presets': 'Preimpostazioni rapide',
+  'settings.oauth.modal.clientName': 'Nome applicazione',
+  'settings.oauth.modal.clientNamePlaceholder': 'es. Claude Web, La mia app MCP',
+  'settings.oauth.modal.redirectUris': 'URI di reindirizzamento',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Un URI per riga. HTTPS richiesto (localhost esente). Corrispondenza esatta richiesta.',
+  'settings.oauth.modal.scopes': 'Ambiti consentiti',
+  'settings.oauth.modal.scopesHint': 'list_trips e get_trip_summary sono sempre disponibili — nessun ambito richiesto. Permettono all\'IA di scoprire gli ID viaggio necessari.',
+  'settings.oauth.modal.selectAll': 'Seleziona tutto',
+  'settings.oauth.modal.deselectAll': 'Deseleziona tutto',
+  'settings.oauth.modal.creating': 'Registrazione…',
+  'settings.oauth.modal.create': 'Registra client',
+  'settings.oauth.modal.createdTitle': 'Client registrato',
+  'settings.oauth.modal.createdWarning': 'Il segreto client viene mostrato una sola volta. Copialo ora — non può essere recuperato.',
+  'settings.oauth.toast.createError': 'Impossibile registrare il client OAuth',
+  'settings.oauth.toast.deleted': 'Client OAuth eliminato',
+  'settings.oauth.toast.deleteError': 'Impossibile eliminare il client OAuth',
+  'settings.oauth.toast.revoked': 'Sessione revocata',
+  'settings.oauth.toast.revokeError': 'Impossibile revocare la sessione',
+  'settings.oauth.toast.rotateError': 'Impossibile rinnovare il segreto client',
  'settings.account': 'Account',
  'settings.about': 'Informazioni',
  'settings.about.reportBug': 'Segnala un bug',
@@ -211,7 +254,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'settings.about.description': 'TREK è un pianificatore di viaggi self-hosted che ti aiuta a organizzare i tuoi viaggi dalla prima idea all\'ultimo ricordo. Pianificazione giornaliera, budget, liste bagagli, foto e molto altro — tutto in un unico posto, sul tuo server.',
  'settings.about.madeWith': 'Fatto con',
  'settings.about.madeBy': 'da Maurice e una crescente comunità open-source.',
-  'settings.username': 'Username',
+  'settings.username': 'Nome utente',
  'settings.email': 'Email',
  'settings.role': 'Ruolo',
  'settings.roleAdmin': 'Amministratore',
@@ -274,9 +317,6 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.none': 'Disattivato',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Eventi di notifica',
-  'admin.notifications.eventsHint': 'Scegli quali eventi attivano le notifiche per tutti gli utenti.',
-  'admin.notifications.configureFirst': 'Configura prima le impostazioni SMTP o webhook qui sotto, poi abilita gli eventi.',
  'admin.notifications.save': 'Salva impostazioni notifiche',
  'admin.notifications.saved': 'Impostazioni notifiche salvate',
  'admin.notifications.testWebhook': 'Invia webhook di test',
@@ -354,7 +394,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'login.hasAccount': 'Hai già un account?',
  'login.register': 'Registrati',
  'login.emailPlaceholder': 'tua@email.com',
-  'login.username': 'Username',
+  'login.username': 'Nome utente',
  'login.oidc.registrationDisabled': 'La registrazione è disabilitata. Contatta il tuo amministratore.',
  'login.oidc.noEmail': 'Nessuna email ricevuta dal provider.',
  'login.oidc.tokenFailed': 'Autenticazione fallita.',
@@ -561,9 +601,10 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'admin.audit.col.details': 'Dettagli',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'Token MCP',
-  'admin.mcpTokens.title': 'Token MCP',
-  'admin.mcpTokens.subtitle': 'Gestisci i token API di tutti gli utenti',
+  'admin.tabs.mcpTokens': 'Accesso MCP',
+  'admin.mcpTokens.title': 'Accesso MCP',
+  'admin.mcpTokens.subtitle': 'Gestisci le sessioni OAuth e i token API di tutti gli utenti',
+  'admin.mcpTokens.sectionTitle': 'Token API',
  'admin.mcpTokens.owner': 'Proprietario',
  'admin.mcpTokens.tokenName': 'Nome token',
  'admin.mcpTokens.created': 'Creato',
@@ -575,6 +616,17 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token eliminato',
  'admin.mcpTokens.deleteError': 'Impossibile eliminare il token',
  'admin.mcpTokens.loadError': 'Impossibile caricare i token',
+  'admin.oauthSessions.sectionTitle': 'Sessioni OAuth',
+  'admin.oauthSessions.clientName': 'Client',
+  'admin.oauthSessions.owner': 'Proprietario',
+  'admin.oauthSessions.scopes': 'Ambiti',
+  'admin.oauthSessions.created': 'Creato',
+  'admin.oauthSessions.empty': 'Nessuna sessione OAuth attiva',
+  'admin.oauthSessions.revokeTitle': 'Revoca sessione',
+  'admin.oauthSessions.revokeMessage': 'Questa sessione OAuth verrà revocata immediatamente. Il client perderà l\'accesso MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Sessione revocata',
+  'admin.oauthSessions.revokeError': 'Impossibile revocare la sessione',
+  'admin.oauthSessions.loadError': 'Impossibile caricare le sessioni OAuth',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1006,6 +1058,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'Budget totale',
  'budget.byCategory': 'Per categoria',
  'budget.editTooltip': 'Clicca per modificare',
+  'budget.linkedToReservation': 'Collegato a una prenotazione — modifica il nome lì',
  'budget.confirm.deleteCategory': 'Sei sicuro di voler eliminare la categoria "{name}" con {count} voci?',
  'budget.deleteCategory': 'Elimina categoria',
  'budget.perPerson': 'Per persona',
@@ -1106,6 +1159,9 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'Modello',
  'packing.templateApplied': '{count} elementi aggiunti dal modello',
  'packing.templateError': 'Impossibile applicare il modello',
+  'packing.saveAsTemplate': 'Salva come modello',
+  'packing.templateName': 'Nome modello',
+  'packing.templateSaved': 'Lista bagagli salvata come modello',
  'packing.bags': 'Valigie',
  'packing.noBag': 'Non assegnato',
  'packing.totalWeight': 'Peso totale',
@@ -1379,6 +1435,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Foto',
  'memories.notConnected': 'Immich non connesso',
  'memories.notConnectedHint': 'Connetti la tua istanza Immich nelle Impostazioni per vedere qui le foto del tuo viaggio.',
+  'memories.notConnectedMultipleHint': 'Collega uno di questi provider di foto: {provider_names} nelle Impostazioni per poter aggiungere foto a questo viaggio.',
  'memories.noDates': 'Aggiungi le date al tuo viaggio per caricare le foto.',
  'memories.noPhotos': 'Nessuna foto trovata',
  'memories.noPhotosHint': 'Nessuna foto trovata in Immich per l\'intervallo di date di questo viaggio.',
@@ -1389,23 +1446,32 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Rivedi le tue foto',
  'memories.reviewHint': 'Clicca sulle foto per escluderle dalla condivisione.',
  'memories.shareCount': 'Condividi {count} foto',
-  'memories.immichUrl': 'URL Server Immich',
-  'memories.immichApiKey': 'Chiave API',
+  'memories.providerUrl': 'URL del server',
+  'memories.providerApiKey': 'Chiave API',
+  'memories.providerUsername': 'Nome utente',
+  'memories.providerPassword': 'Password',
+  'memories.providerOTP': 'Codice MFA (se abilitato)',
+  'memories.skipSSLVerification': 'Ignora la verifica del certificato SSL',
+  'memories.providerUrlHintSynology': 'Includi il percorso dell\'app Foto nell\'URL, es. https://nas:5001/photo',
  'memories.testConnection': 'Test connessione',
  'memories.testFirst': 'Testa prima la connessione',
  'memories.connected': 'Connesso',
  'memories.disconnected': 'Non connesso',
  'memories.connectionSuccess': 'Connesso a Immich',
  'memories.connectionError': 'Impossibile connettersi a Immich',
-  'memories.saved': 'Impostazioni Immich salvate',
+  'memories.saved': 'Impostazioni {provider_name} salvate',
+  'memories.providerDisconnectedBanner': 'La connessione a {provider_name} è persa. Riconnetti nelle Impostazioni per visualizzare le foto.',
+  'memories.saveError': 'Impossibile salvare le impostazioni di {provider_name}',
  'memories.addPhotos': 'Aggiungi foto',
  'memories.linkAlbum': 'Collega album',
  'memories.selectAlbum': 'Seleziona album Immich',
+  'memories.selectAlbumMultiple': 'Seleziona album',
  'memories.noAlbums': 'Nessun album trovato',
  'memories.syncAlbum': 'Sincronizza album',
  'memories.unlinkAlbum': 'Scollega',
  'memories.photos': 'foto',
  'memories.selectPhotos': 'Seleziona foto da Immich',
+  'memories.selectPhotosMultiple': 'Seleziona foto',
  'memories.selectHint': 'Tocca le foto per selezionarle.',
  'memories.selected': 'selezionate',
  'memories.addSelected': 'Aggiungi {count} foto',
@@ -1567,6 +1633,8 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Segna come non letto',
  'notifications.delete': 'Elimina',
  'notifications.system': 'Sistema',
+  'notifications.synologySessionCleared.title': 'Synology Photos disconnesso',
+  'notifications.synologySessionCleared.text': 'Il server o l\'account è cambiato — vai alle Impostazioni per testare nuovamente la connessione.',
  'memories.error.loadAlbums': 'Caricamento album non riuscito',
  'memories.error.linkAlbum': 'Collegamento album non riuscito',
  'memories.error.unlinkAlbum': 'Scollegamento album non riuscito',
@@ -1648,7 +1716,7 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.adminWebhookPanel.testFailed': 'Invio webhook di test fallito',
  'admin.notifications.adminWebhookPanel.alwaysOnHint': 'Il webhook admin si attiva automaticamente quando è configurato un URL',
  'admin.notifications.adminNotificationsHint': 'Configura quali canali consegnano le notifiche admin (es. avvisi di versione). Il webhook si attiva automaticamente se è impostato un URL webhook admin.',
-  'admin.tabs.notifications': 'Notifications',
+  'admin.tabs.notifications': 'Notifiche',
  'notifications.versionAvailable.title': 'Aggiornamento disponibile',
  'notifications.versionAvailable.text': 'TREK {version} è ora disponibile.',
  'notifications.versionAvailable.button': 'Visualizza dettagli',
@@ -1920,6 +1988,69 @@ const it: Record<string, string | { name: string; category: string }[]> = {
  'dayplan.mobile.createNew': 'Crea nuovo luogo',
  'admin.addons.catalog.journey.name': 'Diario di viaggio',
  'admin.addons.catalog.journey.description': 'Tracciamento viaggi e diario con check-in, foto e storie quotidiane',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Viaggi',
+  'oauth.scope.group.places': 'Luoghi',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Bagagli',
+  'oauth.scope.group.todos': 'Attività',
+  'oauth.scope.group.budget': 'Budget',
+  'oauth.scope.group.reservations': 'Prenotazioni',
+  'oauth.scope.group.collab': 'Collaborazione',
+  'oauth.scope.group.notifications': 'Notifiche',
+  'oauth.scope.group.vacay': 'Ferie',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Meteo',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Visualizza viaggi e itinerari',
+  'oauth.scope.trips:read.description': 'Leggi viaggi, giorni, note giornaliere e membri',
+  'oauth.scope.trips:write.label': 'Modifica viaggi e itinerari',
+  'oauth.scope.trips:write.description': 'Crea e aggiorna viaggi, giorni, note e gestisci membri',
+  'oauth.scope.trips:delete.label': 'Elimina viaggi',
+  'oauth.scope.trips:delete.description': 'Elimina definitivamente interi viaggi — questa azione è irreversibile',
+  'oauth.scope.trips:share.label': 'Gestisci link di condivisione',
+  'oauth.scope.trips:share.description': 'Crea, aggiorna e revoca link di condivisione pubblici per i viaggi',
+  'oauth.scope.places:read.label': 'Visualizza luoghi e dati mappa',
+  'oauth.scope.places:read.description': 'Leggi luoghi, assegnazioni giornaliere, tag e categorie',
+  'oauth.scope.places:write.label': 'Gestisci luoghi',
+  'oauth.scope.places:write.description': 'Crea, aggiorna ed elimina luoghi, assegnazioni e tag',
+  'oauth.scope.atlas:read.label': 'Visualizza Atlas',
+  'oauth.scope.atlas:read.description': 'Leggi paesi visitati, regioni e lista dei desideri',
+  'oauth.scope.atlas:write.label': 'Gestisci Atlas',
+  'oauth.scope.atlas:write.description': 'Segna paesi e regioni come visitati, gestisci la lista dei desideri',
+  'oauth.scope.packing:read.label': 'Visualizza liste bagagli',
+  'oauth.scope.packing:read.description': 'Leggi articoli, borse e assegnatari di categoria',
+  'oauth.scope.packing:write.label': 'Gestisci liste bagagli',
+  'oauth.scope.packing:write.description': 'Aggiungi, aggiorna, elimina, spunta e riordina articoli e borse',
+  'oauth.scope.todos:read.label': 'Visualizza liste attività',
+  'oauth.scope.todos:read.description': 'Leggi attività del viaggio e assegnatari di categoria',
+  'oauth.scope.todos:write.label': 'Gestisci liste attività',
+  'oauth.scope.todos:write.description': 'Crea, aggiorna, spunta, elimina e riordina attività',
+  'oauth.scope.budget:read.label': 'Visualizza budget',
+  'oauth.scope.budget:read.description': 'Leggi voci di budget e ripartizione delle spese',
+  'oauth.scope.budget:write.label': 'Gestisci budget',
+  'oauth.scope.budget:write.description': 'Crea, aggiorna ed elimina voci di budget',
+  'oauth.scope.reservations:read.label': 'Visualizza prenotazioni',
+  'oauth.scope.reservations:read.description': 'Leggi prenotazioni e dettagli alloggio',
+  'oauth.scope.reservations:write.label': 'Gestisci prenotazioni',
+  'oauth.scope.reservations:write.description': 'Crea, aggiorna, elimina e riordina prenotazioni',
+  'oauth.scope.collab:read.label': 'Visualizza collaborazione',
+  'oauth.scope.collab:read.description': 'Leggi note collaborative, sondaggi e messaggi',
+  'oauth.scope.collab:write.label': 'Gestisci collaborazione',
+  'oauth.scope.collab:write.description': 'Crea, aggiorna ed elimina note collaborative, sondaggi e messaggi',
+  'oauth.scope.notifications:read.label': 'Visualizza notifiche',
+  'oauth.scope.notifications:read.description': 'Leggi notifiche in-app e conteggi non letti',
+  'oauth.scope.notifications:write.label': 'Gestisci notifiche',
+  'oauth.scope.notifications:write.description': 'Segna notifiche come lette e rispondi',
+  'oauth.scope.vacay:read.label': 'Visualizza piani ferie',
+  'oauth.scope.vacay:read.description': 'Leggi dati di pianificazione ferie, voci e statistiche',
+  'oauth.scope.vacay:write.label': 'Gestisci piani ferie',
+  'oauth.scope.vacay:write.description': 'Crea e gestisci voci ferie, festività e piani del team',
+  'oauth.scope.geo:read.label': 'Mappe e geocodifica',
+  'oauth.scope.geo:read.description': 'Cerca luoghi, risolvi URL mappa e geocodifica inversa coordinate',
+  'oauth.scope.weather:read.label': 'Previsioni meteo',
+  'oauth.scope.weather:read.description': 'Ottieni previsioni meteo per luoghi e date del viaggio',
 }

 export default it
@@ -179,9 +179,6 @@ const nl: Record<string, string> = {
  'admin.notifications.none': 'Uitgeschakeld',
  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Meldingsgebeurtenissen',
-  'admin.notifications.eventsHint': 'Kies welke gebeurtenissen meldingen activeren voor alle gebruikers.',
-  'admin.notifications.configureFirst': 'Configureer eerst de SMTP- of webhook-instellingen hieronder en schakel dan de events in.',
  'admin.notifications.save': 'Meldingsinstellingen opslaan',
  'admin.notifications.saved': 'Meldingsinstellingen opgeslagen',
  'admin.notifications.testWebhook': 'Testwebhook verzenden',
@@ -228,6 +225,7 @@ const nl: Record<string, string> = {
  'settings.mcp.endpoint': 'MCP-eindpunt',
  'settings.mcp.clientConfig': 'Clientconfiguratie',
  'settings.mcp.clientConfigHint': 'Vervang <your_token> door een API-token uit de onderstaande lijst. Het pad naar npx moet mogelijk worden aangepast voor jouw systeem (bijv. C:\\PROGRA~1\\nodejs\\npx.cmd op Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Replace <your_client_id> and <your_client_secret> with the credentials shown in the OAuth 2.1 client you created above. mcp-remote will open your browser to complete the authorization the first time you connect. The path to npx may need to be adjusted for your system (e.g. C:\PROGRA~1\nodejs\npx.cmd on Windows).',
  'settings.mcp.copy': 'Kopiëren',
  'settings.mcp.copied': 'Gekopieerd!',
  'settings.mcp.apiTokens': 'API-tokens',
@@ -249,6 +247,48 @@ const nl: Record<string, string> = {
  'settings.mcp.toast.createError': 'Token aanmaken mislukt',
  'settings.mcp.toast.deleted': 'Token verwijderd',
  'settings.mcp.toast.deleteError': 'Token verwijderen mislukt',
+  'settings.mcp.apiTokensDeprecated': 'API-tokens zijn verouderd en worden in een toekomstige versie verwijderd. Gebruik OAuth 2.1-clients in plaats daarvan.',
+  'settings.oauth.clients': 'OAuth 2.1-clients',
+  'settings.oauth.clientsHint': 'Registreer OAuth 2.1-clients zodat externe MCP-toepassingen (Claude Web, Cursor, enz.) verbinding kunnen maken zonder statische tokens.',
+  'settings.oauth.createClient': 'Nieuwe client',
+  'settings.oauth.noClients': 'Geen OAuth-clients geregistreerd.',
+  'settings.oauth.clientId': 'Client-ID',
+  'settings.oauth.clientSecret': 'Clientgeheim',
+  'settings.oauth.deleteClient': 'Client verwijderen',
+  'settings.oauth.deleteClientMessage': 'Deze client en alle actieve sessies worden permanent verwijderd. Elke toepassing die deze client gebruikt, verliest onmiddellijk de toegang.',
+  'settings.oauth.rotateSecret': 'Geheim vernieuwen',
+  'settings.oauth.rotateSecretMessage': 'Er wordt een nieuw clientgeheim gegenereerd en alle bestaande sessies worden direct ongeldig. Werk uw toepassing bij voordat u dit venster sluit.',
+  'settings.oauth.rotateSecretConfirm': 'Vernieuwen',
+  'settings.oauth.rotateSecretConfirming': 'Vernieuwen…',
+  'settings.oauth.rotateSecretDoneTitle': 'Nieuw geheim gegenereerd',
+  'settings.oauth.rotateSecretDoneWarning': 'Dit geheim wordt slechts eenmalig getoond. Kopieer het nu en werk uw toepassing bij — alle vorige sessies zijn ongeldig gemaakt.',
+  'settings.oauth.activeSessions': 'Actieve OAuth-sessies',
+  'settings.oauth.sessionScopes': 'Rechten',
+  'settings.oauth.sessionExpires': 'Verloopt',
+  'settings.oauth.revoke': 'Intrekken',
+  'settings.oauth.revokeSession': 'Sessie intrekken',
+  'settings.oauth.revokeSessionMessage': 'Dit trekt onmiddellijk de toegang voor deze OAuth-sessie in.',
+  'settings.oauth.modal.createTitle': 'OAuth-client registreren',
+  'settings.oauth.modal.presets': 'Snelle instellingen',
+  'settings.oauth.modal.clientName': 'Toepassingsnaam',
+  'settings.oauth.modal.clientNamePlaceholder': 'bijv. Claude Web, Mijn MCP-app',
+  'settings.oauth.modal.redirectUris': 'Redirect-URI\'s',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Eén URI per regel. HTTPS vereist (localhost uitgezonderd). Exacte overeenkomst vereist.',
+  'settings.oauth.modal.scopes': 'Toegestane rechten',
+  'settings.oauth.modal.scopesHint': 'list_trips en get_trip_summary zijn altijd beschikbaar — geen recht vereist. Ze helpen de AI trip-ID\'s te ontdekken.',
+  'settings.oauth.modal.selectAll': 'Alles selecteren',
+  'settings.oauth.modal.deselectAll': 'Alles deselecteren',
+  'settings.oauth.modal.creating': 'Registreren…',
+  'settings.oauth.modal.create': 'Client registreren',
+  'settings.oauth.modal.createdTitle': 'Client geregistreerd',
+  'settings.oauth.modal.createdWarning': 'Het clientgeheim wordt slechts eenmalig getoond. Kopieer het nu — het kan niet worden hersteld.',
+  'settings.oauth.toast.createError': 'OAuth-client kon niet worden geregistreerd',
+  'settings.oauth.toast.deleted': 'OAuth-client verwijderd',
+  'settings.oauth.toast.deleteError': 'OAuth-client kon niet worden verwijderd',
+  'settings.oauth.toast.revoked': 'Sessie ingetrokken',
+  'settings.oauth.toast.revokeError': 'Sessie kon niet worden ingetrokken',
+  'settings.oauth.toast.rotateError': 'Clientgeheim kon niet worden vernieuwd',
  'settings.account': 'Account',
  'settings.about': 'Over',
  'settings.about.reportBug': 'Bug melden',
@@ -515,11 +555,11 @@ const nl: Record<string, string> = {
  'admin.addons.catalog.budget.description': 'Houd uitgaven bij en plan je reisbudget',
  'admin.addons.catalog.documents.name': 'Documenten',
  'admin.addons.catalog.documents.description': 'Bewaar en beheer reisdocumenten',
-  'admin.addons.catalog.vacay.name': 'Vacay',
+  'admin.addons.catalog.vacay.name': 'Vakantie',
  'admin.addons.catalog.vacay.description': 'Persoonlijke vakantieplanner met kalenderweergave',
  'admin.addons.catalog.atlas.name': 'Atlas',
  'admin.addons.catalog.atlas.description': 'Wereldkaart met bezochte landen en reisstatistieken',
-  'admin.addons.catalog.collab.name': 'Collab',
+  'admin.addons.catalog.collab.name': 'Samenwerking',
  'admin.addons.catalog.collab.description': 'Realtime notities, polls en chat voor het plannen van reizen',
  'admin.addons.subtitleBefore': 'Schakel functies in of uit om je ',
  'admin.addons.subtitleAfter': '-ervaring aan te passen.',
@@ -547,9 +587,10 @@ const nl: Record<string, string> = {
  'admin.weather.locationHint': 'Het weer is gebaseerd op de eerste plaats met coördinaten op elke dag. Als er geen plaats aan een dag is toegewezen, wordt een plaats uit de lijst als referentie gebruikt.',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP-tokens',
-  'admin.mcpTokens.title': 'MCP-tokens',
-  'admin.mcpTokens.subtitle': 'API-tokens van alle gebruikers beheren',
+  'admin.tabs.mcpTokens': 'MCP-toegang',
+  'admin.mcpTokens.title': 'MCP-toegang',
+  'admin.mcpTokens.subtitle': 'OAuth-sessies en API-tokens van alle gebruikers beheren',
+  'admin.mcpTokens.sectionTitle': 'API-tokens',
  'admin.mcpTokens.owner': 'Eigenaar',
  'admin.mcpTokens.tokenName': 'Tokennaam',
  'admin.mcpTokens.created': 'Aangemaakt',
@@ -561,6 +602,17 @@ const nl: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': 'Token verwijderd',
  'admin.mcpTokens.deleteError': 'Token kon niet worden verwijderd',
  'admin.mcpTokens.loadError': 'Tokens konden niet worden geladen',
+  'admin.oauthSessions.sectionTitle': 'OAuth-sessies',
+  'admin.oauthSessions.clientName': 'Client',
+  'admin.oauthSessions.owner': 'Eigenaar',
+  'admin.oauthSessions.scopes': 'Rechten',
+  'admin.oauthSessions.created': 'Aangemaakt',
+  'admin.oauthSessions.empty': 'Geen actieve OAuth-sessies',
+  'admin.oauthSessions.revokeTitle': 'Sessie intrekken',
+  'admin.oauthSessions.revokeMessage': 'Deze OAuth-sessie wordt onmiddellijk ingetrokken. De client verliest MCP-toegang.',
+  'admin.oauthSessions.revokeSuccess': 'Sessie ingetrokken',
+  'admin.oauthSessions.revokeError': 'Sessie kon niet worden ingetrokken',
+  'admin.oauthSessions.loadError': 'OAuth-sessies konden niet worden geladen',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -731,7 +783,7 @@ const nl: Record<string, string> = {
  'atlas.placeVisited': 'Bezochte plaats',
  'atlas.placesVisited': 'Bezochte plaatsen',
  'atlas.statsTab': 'Statistieken',
-  'atlas.bucketTab': 'Bucket List',
+  'atlas.bucketTab': 'Bucketlist',
  'atlas.addBucket': 'Toevoegen aan bucket list',
  'atlas.bucketNamePlaceholder': 'Plaats of bestemming...',
  'atlas.bucketNotesPlaceholder': 'Notities (optioneel)',
@@ -842,7 +894,7 @@ const nl: Record<string, string> = {
  'places.noCategory': 'Geen categorie',
  'places.categoryNamePlaceholder': 'Categorienaam',
  'places.formTime': 'Tijd',
-  'places.startTime': 'Start',
+  'places.startTime': 'Starttijd',
  'places.endTime': 'Einde',
  'places.endTimeBeforeStart': 'Eindtijd is vóór de starttijd',
  'places.timeCollision': 'Tijdoverlap met:',
@@ -858,7 +910,7 @@ const nl: Record<string, string> = {
  'places.nameRequired': 'Voer een naam in',
  'places.saveError': 'Opslaan mislukt',
  // Place Inspector
-  'inspector.opened': 'Open',
+  'inspector.opened': 'Openingstijden',
  'inspector.closed': 'Gesloten',
  'inspector.openingHours': 'Openingstijden',
  'inspector.showHours': 'Openingstijden tonen',
@@ -904,8 +956,8 @@ const nl: Record<string, string> = {
  'reservations.meta.trainNumber': 'Treinnr.',
  'reservations.meta.platform': 'Perron',
  'reservations.meta.seat': 'Stoel',
-  'reservations.meta.checkIn': 'Check-in',
-  'reservations.meta.checkOut': 'Check-out',
+  'reservations.meta.checkIn': 'Inchecken',
+  'reservations.meta.checkOut': 'Uitchecken',
  'reservations.meta.linkAccommodation': 'Accommodatie',
  'reservations.meta.pickAccommodation': 'Koppel aan accommodatie',
  'reservations.meta.noAccommodation': 'Geen',
@@ -1005,11 +1057,12 @@ const nl: Record<string, string> = {
  'budget.totalBudget': 'Totaal budget',
  'budget.byCategory': 'Per categorie',
  'budget.editTooltip': 'Klik om te bewerken',
+  'budget.linkedToReservation': 'Gekoppeld aan een reservering — bewerk de naam daar',
  'budget.confirm.deleteCategory': 'Weet je zeker dat je de categorie "{name}" met {count} invoeren wilt verwijderen?',
  'budget.deleteCategory': 'Categorie verwijderen',
  'budget.perPerson': 'Per persoon',
  'budget.paid': 'Betaald',
-  'budget.open': 'Open',
+  'budget.open': 'Openstaand',
  'budget.noMembers': 'Geen leden toegewezen',
  'budget.settlement': 'Afrekening',
  'budget.settlementInfo': 'Klik op de avatar van een lid bij een budgetpost om deze groen te markeren — dit betekent dat diegene heeft betaald. De afrekening toont vervolgens wie wie hoeveel verschuldigd is.',
@@ -1086,7 +1139,7 @@ const nl: Record<string, string> = {
  'packing.addPlaceholder': 'Nieuw item toevoegen...',
  'packing.categoryPlaceholder': 'Categorie...',
  'packing.filterAll': 'Alle',
-  'packing.filterOpen': 'Open',
+  'packing.filterOpen': 'Openstaand',
  'packing.filterDone': 'Klaar',
  'packing.emptyTitle': 'Paklijst is leeg',
  'packing.emptyHint': 'Voeg items toe of gebruik de suggesties',
@@ -1095,6 +1148,7 @@ const nl: Record<string, string> = {
  'packing.menuCheckAll': 'Alles aanvinken',
  'packing.menuUncheckAll': 'Alles uitvinken',
  'packing.menuDeleteCat': 'Categorie verwijderen',
+  'packing.assignUser': 'Gebruiker toewijzen',
  'packing.addItem': 'Item toevoegen',
  'packing.addItemPlaceholder': 'Itemnaam...',
  'packing.addCategory': 'Categorie toevoegen',
@@ -1103,7 +1157,9 @@ const nl: Record<string, string> = {
  'packing.template': 'Sjabloon',
  'packing.templateApplied': '{count} items toegevoegd vanuit sjabloon',
  'packing.templateError': 'Fout bij toepassen van sjabloon',
-  'packing.assignUser': 'Gebruiker toewijzen',
+  'packing.saveAsTemplate': 'Opslaan als sjabloon',
+  'packing.templateName': 'Sjabloonnaam',
+  'packing.templateSaved': 'Paklijst opgeslagen als sjabloon',
  'packing.noMembers': 'Geen leden',
  'packing.bags': 'Bagage',
  'packing.noBag': 'Niet toegewezen',
@@ -1368,8 +1424,8 @@ const nl: Record<string, string> = {
  'day.hotelDayRange': 'Toepassen op dagen',
  'day.noPlacesForHotel': 'Voeg eerst plaatsen toe aan je reis',
  'day.allDays': 'Alle',
-  'day.checkIn': 'Check-in',
-  'day.checkOut': 'Check-out',
+  'day.checkIn': 'Inchecken',
+  'day.checkOut': 'Uitchecken',
  'day.confirmation': 'Bevestiging',
  'day.editAccommodation': 'Accommodatie bewerken',
  'day.reservations': 'Reserveringen',
@@ -1378,6 +1434,7 @@ const nl: Record<string, string> = {
  'memories.title': 'Foto\'s',
  'memories.notConnected': 'Immich niet verbonden',
  'memories.notConnectedHint': 'Verbind je Immich-instantie in Instellingen om je reisfoto\'s hier te zien.',
+  'memories.notConnectedMultipleHint': 'Verbind een van deze fotoproviders: {provider_names} in Instellingen om foto\'s aan dit reisplan toe te voegen.',
  'memories.noDates': 'Voeg data toe aan je reis om foto\'s te laden.',
  'memories.noPhotos': 'Geen foto\'s gevonden',
  'memories.noPhotosHint': 'Geen foto\'s gevonden in Immich voor de datumreeks van deze reis.',
@@ -1388,26 +1445,35 @@ const nl: Record<string, string> = {
  'memories.reviewTitle': 'Je foto\'s bekijken',
  'memories.reviewHint': 'Klik op foto\'s om ze uit te sluiten van delen.',
  'memories.shareCount': '{count} foto\'s delen',
-  'memories.immichUrl': 'Immich Server URL',
-  'memories.immichApiKey': 'API-sleutel',
+  'memories.providerUrl': 'Server-URL',
+  'memories.providerApiKey': 'API-sleutel',
+  'memories.providerUsername': 'Gebruikersnaam',
+  'memories.providerPassword': 'Wachtwoord',
+  'memories.providerOTP': 'MFA-code (indien ingeschakeld)',
+  'memories.skipSSLVerification': 'SSL-certificaatverificatie overslaan',
+  'memories.providerUrlHintSynology': 'Voeg het pad van de Photos-app toe aan de URL, bijv. https://nas:5001/photo',
  'memories.testConnection': 'Verbinding testen',
  'memories.testFirst': 'Test eerst de verbinding',
  'memories.connected': 'Verbonden',
  'memories.disconnected': 'Niet verbonden',
  'memories.connectionSuccess': 'Verbonden met Immich',
  'memories.connectionError': 'Kon niet verbinden met Immich',
-  'memories.saved': 'Immich-instellingen opgeslagen',
+  'memories.saved': '{provider_name}-instellingen opgeslagen',
+  'memories.providerDisconnectedBanner': 'Je {provider_name}-verbinding is verbroken. Maak opnieuw verbinding in Instellingen om foto\'s te bekijken.',
+  'memories.saveError': '{provider_name}-instellingen konden niet worden opgeslagen',
  'memories.oldest': 'Oudste eerst',
  'memories.newest': 'Nieuwste eerst',
  'memories.allLocations': 'Alle locaties',
  'memories.addPhotos': 'Foto\'s toevoegen',
  'memories.linkAlbum': 'Album koppelen',
  'memories.selectAlbum': 'Immich-album selecteren',
+  'memories.selectAlbumMultiple': 'Album selecteren',
  'memories.noAlbums': 'Geen albums gevonden',
  'memories.syncAlbum': 'Album synchroniseren',
  'memories.unlinkAlbum': 'Ontkoppelen',
  'memories.photos': 'fotos',
  'memories.selectPhotos': 'Selecteer foto\'s uit Immich',
+  'memories.selectPhotosMultiple': 'Foto\'s selecteren',
  'memories.selectHint': 'Tik op foto\'s om ze te selecteren.',
  'memories.selected': 'geselecteerd',
  'memories.addSelected': '{count} foto\'s toevoegen',
@@ -1564,6 +1630,8 @@ const nl: Record<string, string> = {
  'notifications.markUnread': 'Markeren als ongelezen',
  'notifications.delete': 'Verwijderen',
  'notifications.system': 'Systeem',
+  'notifications.synologySessionCleared.title': 'Synology Photos verbroken',
+  'notifications.synologySessionCleared.text': 'Je server of account is gewijzigd — ga naar Instellingen om je verbinding opnieuw te testen.',
  'memories.error.loadAlbums': 'Albums laden mislukt',
  'memories.error.linkAlbum': 'Album koppelen mislukt',
  'memories.error.unlinkAlbum': 'Album ontkoppelen mislukt',
@@ -1593,7 +1661,7 @@ const nl: Record<string, string> = {
  'todo.subtab.todo': 'Taken',
  'todo.completed': 'voltooid',
  'todo.filter.all': 'Alles',
-  'todo.filter.open': 'Open',
+  'todo.filter.open': 'Openstaand',
  'todo.filter.done': 'Klaar',
  'todo.uncategorized': 'Zonder categorie',
  'todo.namePlaceholder': 'Taaknaam',
@@ -1919,6 +1987,69 @@ const nl: Record<string, string> = {
  'dayplan.mobile.createNew': 'Nieuwe plaats aanmaken',
  'admin.addons.catalog.journey.name': 'Reisverslag',
  'admin.addons.catalog.journey.description': 'Reistracking & reisdagboek met check-ins, foto\'s en dagelijkse verhalen',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Reizen',
+  'oauth.scope.group.places': 'Plaatsen',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Paklijst',
+  'oauth.scope.group.todos': 'Taken',
+  'oauth.scope.group.budget': 'Budget',
+  'oauth.scope.group.reservations': 'Reserveringen',
+  'oauth.scope.group.collab': 'Samenwerking',
+  'oauth.scope.group.notifications': 'Meldingen',
+  'oauth.scope.group.vacay': 'Vakantie',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Weer',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Reizen en reisplannen bekijken',
+  'oauth.scope.trips:read.description': 'Reizen, dagen, notities en leden lezen',
+  'oauth.scope.trips:write.label': 'Reizen en reisplannen bewerken',
+  'oauth.scope.trips:write.description': 'Reizen, dagen en notities aanmaken, bijwerken en leden beheren',
+  'oauth.scope.trips:delete.label': 'Reizen verwijderen',
+  'oauth.scope.trips:delete.description': 'Hele reizen permanent verwijderen — deze actie is onomkeerbaar',
+  'oauth.scope.trips:share.label': 'Deellinks beheren',
+  'oauth.scope.trips:share.description': 'Publieke deellinks aanmaken, bijwerken en intrekken',
+  'oauth.scope.places:read.label': 'Plaatsen en kaartgegevens bekijken',
+  'oauth.scope.places:read.description': 'Plaatsen, dagtoewijzingen, tags en categorieën lezen',
+  'oauth.scope.places:write.label': 'Plaatsen beheren',
+  'oauth.scope.places:write.description': 'Plaatsen, toewijzingen en tags aanmaken, bijwerken en verwijderen',
+  'oauth.scope.atlas:read.label': 'Atlas bekijken',
+  'oauth.scope.atlas:read.description': 'Bezochte landen, regio\'s en bucketlist lezen',
+  'oauth.scope.atlas:write.label': 'Atlas beheren',
+  'oauth.scope.atlas:write.description': 'Landen en regio\'s markeren als bezocht, bucketlist beheren',
+  'oauth.scope.packing:read.label': 'Paklijsten bekijken',
+  'oauth.scope.packing:read.description': 'Pakartikelen, tassen en categorietoewijzingen lezen',
+  'oauth.scope.packing:write.label': 'Paklijsten beheren',
+  'oauth.scope.packing:write.description': 'Pakartikelen en tassen toevoegen, bijwerken, verwijderen, omschakelen en herordenen',
+  'oauth.scope.todos:read.label': 'Takenlijsten bekijken',
+  'oauth.scope.todos:read.description': 'Reistaakitems en categorietoewijzingen lezen',
+  'oauth.scope.todos:write.label': 'Takenlijsten beheren',
+  'oauth.scope.todos:write.description': 'Taakitems aanmaken, bijwerken, omschakelen, verwijderen en herordenen',
+  'oauth.scope.budget:read.label': 'Budget bekijken',
+  'oauth.scope.budget:read.description': 'Budgetitems en kostenspecificatie lezen',
+  'oauth.scope.budget:write.label': 'Budget beheren',
+  'oauth.scope.budget:write.description': 'Budgetitems aanmaken, bijwerken en verwijderen',
+  'oauth.scope.reservations:read.label': 'Reserveringen bekijken',
+  'oauth.scope.reservations:read.description': 'Reserveringen en accommodatiedetails lezen',
+  'oauth.scope.reservations:write.label': 'Reserveringen beheren',
+  'oauth.scope.reservations:write.description': 'Reserveringen aanmaken, bijwerken, verwijderen en herordenen',
+  'oauth.scope.collab:read.label': 'Samenwerking bekijken',
+  'oauth.scope.collab:read.description': 'Samenwerkingsnotities, polls en berichten lezen',
+  'oauth.scope.collab:write.label': 'Samenwerking beheren',
+  'oauth.scope.collab:write.description': 'Samenwerkingsnotities, polls en berichten aanmaken, bijwerken en verwijderen',
+  'oauth.scope.notifications:read.label': 'Meldingen bekijken',
+  'oauth.scope.notifications:read.description': 'In-app meldingen en ongelezen aantallen lezen',
+  'oauth.scope.notifications:write.label': 'Meldingen beheren',
+  'oauth.scope.notifications:write.description': 'Meldingen als gelezen markeren en erop reageren',
+  'oauth.scope.vacay:read.label': 'Vakantieplannen bekijken',
+  'oauth.scope.vacay:read.description': 'Vakantieplanningsgegevens, invoeren en statistieken lezen',
+  'oauth.scope.vacay:write.label': 'Vakantieplannen beheren',
+  'oauth.scope.vacay:write.description': 'Vakantie-invoeren, feestdagen en teamplannen aanmaken en beheren',
+  'oauth.scope.geo:read.label': 'Kaarten & geocodering',
+  'oauth.scope.geo:read.description': 'Locaties zoeken, kaart-URL\'s oplossen en coördinaten omgekeerd geocoderen',
+  'oauth.scope.weather:read.label': 'Weersverwachtingen',
+  'oauth.scope.weather:read.description': 'Weersverwachtingen ophalen voor reislocaties en -datums',
 }

 export default nl
@@ -29,7 +29,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'common.change': 'Zmień',
  'common.uploading': 'Przesyłanie...',
  'common.backToPlanning': 'Powrót do planowania',
-  'common.reset': 'Reset',
+  'common.reset': 'Resetuj',

  // Navbar
  'nav.trip': 'Podróż',
@@ -198,6 +198,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.endpoint': 'Endpoint MCP',
  'settings.mcp.clientConfig': 'Konfiguracja klienta',
  'settings.mcp.clientConfigHint': 'Zastąp <your_token> tokenem API z listy poniżej. Ścieżka do npx może wymagać dostosowania do Twojego systemu (np. C:\\PROGRA~1\\nodejs\\npx.cmd w systemie Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Zastąp <your_client_id> i <your_client_secret> danymi uwierzytelniającymi z klienta OAuth 2.1 utworzonego powyżej. mcp-remote otworzy przeglądarkę, aby dokończyć autoryzację przy pierwszym połączeniu. Ścieżka do npx może wymagać dostosowania do Twojego systemu (np. C:\\PROGRA~1\\nodejs\\npx.cmd w systemie Windows).',
  'settings.mcp.copy': 'Kopiuj',
  'settings.mcp.copied': 'Skopiowano!',
  'settings.mcp.apiTokens': 'Tokeny API',
@@ -219,6 +220,48 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'settings.mcp.toast.createError': 'Nie udało się utworzyć tokenu',
  'settings.mcp.toast.deleted': 'Token został usunięty',
  'settings.mcp.toast.deleteError': 'Nie udało się usunąć tokenu',
+  'settings.mcp.apiTokensDeprecated': 'Tokeny API są przestarzałe i zostaną usunięte w przyszłej wersji. Użyj zamiast tego klientów OAuth 2.1.',
+  'settings.oauth.clients': 'Klienci OAuth 2.1',
+  'settings.oauth.clientsHint': 'Zarejestruj klientów OAuth 2.1, aby zewnętrzne aplikacje MCP (Claude Web, Cursor itp.) mogły się łączyć bez statycznych tokenów.',
+  'settings.oauth.createClient': 'Nowy klient',
+  'settings.oauth.noClients': 'Brak zarejestrowanych klientów OAuth.',
+  'settings.oauth.clientId': 'ID klienta',
+  'settings.oauth.clientSecret': 'Sekret klienta',
+  'settings.oauth.deleteClient': 'Usuń klienta',
+  'settings.oauth.deleteClientMessage': 'Ten klient i wszystkie aktywne sesje zostaną trwale usunięte. Każda aplikacja, która go używa, natychmiast utraci dostęp.',
+  'settings.oauth.rotateSecret': 'Odnów sekret',
+  'settings.oauth.rotateSecretMessage': 'Zostanie wygenerowany nowy sekret klienta, a wszystkie istniejące sesje zostaną natychmiast unieważnione. Zaktualizuj aplikację przed zamknięciem tego okna.',
+  'settings.oauth.rotateSecretConfirm': 'Odnów',
+  'settings.oauth.rotateSecretConfirming': 'Odnawianie…',
+  'settings.oauth.rotateSecretDoneTitle': 'Wygenerowano nowy sekret',
+  'settings.oauth.rotateSecretDoneWarning': 'Ten sekret jest wyświetlany tylko raz. Skopiuj go teraz i zaktualizuj aplikację — wszystkie poprzednie sesje zostały unieważnione.',
+  'settings.oauth.activeSessions': 'Aktywne sesje OAuth',
+  'settings.oauth.sessionScopes': 'Uprawnienia',
+  'settings.oauth.sessionExpires': 'Wygasa',
+  'settings.oauth.revoke': 'Unieważnij',
+  'settings.oauth.revokeSession': 'Unieważnij sesję',
+  'settings.oauth.revokeSessionMessage': 'Spowoduje to natychmiastowe unieważnienie dostępu dla tej sesji OAuth.',
+  'settings.oauth.modal.createTitle': 'Zarejestruj klienta OAuth',
+  'settings.oauth.modal.presets': 'Szybkie ustawienia',
+  'settings.oauth.modal.clientName': 'Nazwa aplikacji',
+  'settings.oauth.modal.clientNamePlaceholder': 'np. Claude Web, Moja aplikacja MCP',
+  'settings.oauth.modal.redirectUris': 'URI przekierowania',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Jeden URI na linię. Wymagane HTTPS (localhost zwolniony). Wymagana dokładna zgodność.',
+  'settings.oauth.modal.scopes': 'Dozwolone uprawnienia',
+  'settings.oauth.modal.scopesHint': 'list_trips i get_trip_summary są zawsze dostępne — bez wymaganych uprawnień. Umożliwiają AI odkrycie potrzebnych ID podróży.',
+  'settings.oauth.modal.selectAll': 'Zaznacz wszystko',
+  'settings.oauth.modal.deselectAll': 'Odznacz wszystko',
+  'settings.oauth.modal.creating': 'Rejestrowanie…',
+  'settings.oauth.modal.create': 'Zarejestruj klienta',
+  'settings.oauth.modal.createdTitle': 'Klient zarejestrowany',
+  'settings.oauth.modal.createdWarning': 'Sekret klienta jest wyświetlany tylko raz. Skopiuj go teraz — nie można go odzyskać.',
+  'settings.oauth.toast.createError': 'Nie udało się zarejestrować klienta OAuth',
+  'settings.oauth.toast.deleted': 'Klient OAuth usunięty',
+  'settings.oauth.toast.deleteError': 'Nie udało się usunąć klienta OAuth',
+  'settings.oauth.toast.revoked': 'Sesja unieważniona',
+  'settings.oauth.toast.revokeError': 'Nie udało się unieważnić sesji',
+  'settings.oauth.toast.rotateError': 'Nie udało się odnowić sekretu klienta',
  'settings.account': 'Konto',
  'settings.about': 'O aplikacji',
  'settings.about.reportBug': 'Zgłoś błąd',
@@ -428,7 +471,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'admin.recommended': 'Polecane',
  'admin.weatherKey': 'Klucz OpenWeatherMap API',
  'admin.weatherKeyHint': 'Do danych pogodowych. Uzyskaj go bezpłatnie na openweathermap.org',
-  'admin.validateKey': 'Test',
+  'admin.validateKey': 'Testuj',
  'admin.keyValid': 'Połączono',
  'admin.keyInvalid': 'Niepoprawny',
  'admin.keySaved': 'Klucze API zostały zapisane',
@@ -484,7 +527,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'admin.addons.catalog.vacay.description': 'Osobisty planer urlopu z widokiem kalendarza',
  'admin.addons.catalog.atlas.name': 'Atlas',
  'admin.addons.catalog.atlas.description': 'Mapa świata z odwiedzonymi krajami i statystykami podróży',
-  'admin.addons.catalog.collab.name': 'Collab',
+  'admin.addons.catalog.collab.name': 'Współpraca',
  'admin.addons.catalog.collab.description': 'Notatki w czasie rzeczywistym, ankiety i czat do planowania podróży',
  'admin.addons.catalog.memories.name': 'Zdjęcia (Immich)',
  'admin.addons.catalog.memories.description': 'Udostępniaj zdjęcia z podróży za pośrednictwem swojej instancji Immich',
@@ -516,9 +559,10 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'admin.weather.locationHint': 'Pogoda jest określana na podstawie pierwszego miejsca z przypisanymi współrzędnymi w danym dniu. Jeśli do dnia nie przypisano żadnego miejsca, jako punkt odniesienia używane jest dowolne miejsce z listy.',

  // GitHub
-  'admin.tabs.mcpTokens': 'Tokeny MCP',
-  'admin.mcpTokens.title': 'Tokeny MCP',
-  'admin.mcpTokens.subtitle': 'Zarządzaj tokenami API dla wszystkich użytkowników',
+  'admin.tabs.mcpTokens': 'Dostęp MCP',
+  'admin.mcpTokens.title': 'Dostęp MCP',
+  'admin.mcpTokens.subtitle': 'Zarządzaj sesjami OAuth i tokenami API dla wszystkich użytkowników',
+  'admin.mcpTokens.sectionTitle': 'Tokeny API',
  'admin.mcpTokens.owner': 'Właściciel',
  'admin.mcpTokens.tokenName': 'Nazwa tokenu',
  'admin.mcpTokens.created': 'Utworzono',
@@ -530,6 +574,17 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'admin.mcpTokens.deleteSuccess': 'Token został usunięty',
  'admin.mcpTokens.deleteError': 'Nie udało się usunąć tokenu',
  'admin.mcpTokens.loadError': 'Nie udało się załadować tokenów',
+  'admin.oauthSessions.sectionTitle': 'Sesje OAuth',
+  'admin.oauthSessions.clientName': 'Klient',
+  'admin.oauthSessions.owner': 'Właściciel',
+  'admin.oauthSessions.scopes': 'Uprawnienia',
+  'admin.oauthSessions.created': 'Utworzono',
+  'admin.oauthSessions.empty': 'Brak aktywnych sesji OAuth',
+  'admin.oauthSessions.revokeTitle': 'Unieważnij sesję',
+  'admin.oauthSessions.revokeMessage': 'Ta sesja OAuth zostanie natychmiast unieważniona. Klient straci dostęp do MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Sesja unieważniona',
+  'admin.oauthSessions.revokeError': 'Nie udało się unieważnić sesji',
+  'admin.oauthSessions.loadError': 'Nie udało się załadować sesji OAuth',
  'admin.tabs.github': 'GitHub',

  'admin.audit.subtitle': 'Zdarzenia związane z bezpieczeństwem i administracją (kopie zapasowe, użytkownicy, MFA, ustawienia).',
@@ -597,7 +652,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'vacay.legend': 'Legenda',
  'vacay.publicHoliday': 'Święto państwowe',
  'vacay.companyHoliday': 'Urlop firmowy',
-  'vacay.weekend': 'Weekend',
+  'vacay.weekend': 'Weekendowy',
  'vacay.modeVacation': 'Urlop',
  'vacay.modeCompany': 'Urlop firmowy',
  'vacay.entitlement': 'Wymiar',
@@ -695,7 +750,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'atlas.lastTrip': 'Ostatnia podróż',
  'atlas.nextTrip': 'Następna podróż',
  'atlas.daysLeft': 'dni do wyjazdu',
-  'atlas.streak': 'Streak',
+  'atlas.streak': 'Seria',
  'atlas.years': 'lata',
  'atlas.yearInRow': 'rok z rzędu',
  'atlas.yearsInRow': 'lat z rzędu',
@@ -961,6 +1016,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'budget.totalBudget': 'Całkowity budżet',
  'budget.byCategory': 'Według kategorii',
  'budget.editTooltip': 'Kliknij, aby edytować',
+  'budget.linkedToReservation': 'Powiązano z rezerwacją — edytuj nazwę tam',
  'budget.confirm.deleteCategory': 'Czy na pewno chcesz usunąć kategorię "{name}" z {count} wpisami?',
  'budget.deleteCategory': 'Usuń kategorię',
  'budget.perPerson': 'Za osobę',
@@ -1061,6 +1117,9 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'packing.template': 'Szablon',
  'packing.templateApplied': '{count} przedmiotów dodanych z szablonu',
  'packing.templateError': 'Nie udało się zastosować szablonu',
+  'packing.saveAsTemplate': 'Zapisz jako szablon',
+  'packing.templateName': 'Nazwa szablonu',
+  'packing.templateSaved': 'Lista pakowania zapisana jako szablon',
  'packing.bags': 'Torby',
  'packing.noBag': 'Nieprzypisane',
  'packing.totalWeight': 'Waga całkowita',
@@ -1334,6 +1393,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'memories.title': 'Zdjęcia',
  'memories.notConnected': 'Immich nie jest połączony',
  'memories.notConnectedHint': 'Połącz swoją instancję Immich w ustawieniach, aby przeglądać tutaj swoje zdjęcia z podróży.',
+  'memories.notConnectedMultipleHint': 'Połącz jednego z tych dostawców zdjęć: {provider_names} w Ustawieniach, aby móc dodawać zdjęcia do tej podróży.',
  'memories.noDates': 'Dodaj daty do swojej podróży, aby załadować zdjęcia.',
  'memories.noPhotos': 'Nie znaleziono zdjęć',
  'memories.noPhotosHint': 'Nie znaleziono zdjęć w Immich dla tego zakresu dat podróży.',
@@ -1344,16 +1404,24 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'memories.reviewTitle': 'Przejrzyj swoje zdjęcia',
  'memories.reviewHint': 'Kliknij w zdjęcia, aby wykluczyć je z udostępnienia.',
  'memories.shareCount': 'Udostępnij {count} zdjęć',
-  'memories.immichUrl': 'URL serwera Immich',
-  'memories.immichApiKey': 'Klucz API',
+  'memories.providerUrl': 'URL serwera',
+  'memories.providerApiKey': 'Klucz API',
+  'memories.providerUsername': 'Nazwa użytkownika',
+  'memories.providerPassword': 'Hasło',
+  'memories.providerOTP': 'Kod MFA (jeśli włączony)',
+  'memories.skipSSLVerification': 'Pomiń weryfikację certyfikatu SSL',
+  'memories.providerUrlHintSynology': 'Uwzględnij ścieżkę aplikacji Photos w URL, np. https://nas:5001/photo',
  'memories.testConnection': 'Test',
  'memories.connected': 'Połączono',
  'memories.disconnected': 'Nie połączono',
  'memories.connectionSuccess': 'Połączono z Immich',
  'memories.connectionError': 'Nie udało się połączyć z Immich',
-  'memories.saved': 'Ustawienia Immich zostały zapisane',
+  'memories.saved': 'Ustawienia {provider_name} zostały zapisane',
+  'memories.providerDisconnectedBanner': 'Połączenie z {provider_name} zostało utracone. Połącz ponownie w Ustawieniach, aby wyświetlać zdjęcia.',
+  'memories.saveError': 'Nie można zapisać ustawień {provider_name}',
  'memories.addPhotos': 'Dodaj zdjęcia',
  'memories.selectPhotos': 'Wybierz zdjęcia z Immich',
+  'memories.selectPhotosMultiple': 'Wybierz zdjęcia',
  'memories.selectHint': 'Dotknij zdjęć, aby je zaznaczyć.',
  'memories.selected': 'wybranych',
  'memories.addSelected': 'Dodaj {count} zdjęć',
@@ -1454,11 +1522,8 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'admin.notifications.title': 'Powiadomienia',
  'admin.notifications.hint': 'Wybierz jeden kanał powiadomień.',
  'admin.notifications.none': 'Wyłączone',
-  'admin.notifications.email': 'Email (SMTP)',
+  'admin.notifications.email': 'E-mail (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'Zdarzenia powiadomień',
-  'admin.notifications.eventsHint': 'Wybierz zdarzenia wyzwalające powiadomienia.',
-  'admin.notifications.configureFirst': 'Najpierw skonfiguruj ustawienia SMTP lub webhook.',
  'admin.notifications.save': 'Zapisz ustawienia powiadomień',
  'admin.notifications.saved': 'Ustawienia powiadomień zapisane',
  'admin.notifications.testWebhook': 'Wyślij testowy webhook',
@@ -1483,7 +1548,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'settings.webhookUrl.hint': 'Wprowadź adres URL webhooka Discord, Slack lub własnego, aby otrzymywać powiadomienia.',
  'settings.webhookUrl.save': 'Zapisz',
  'settings.webhookUrl.saved': 'URL webhooka zapisany',
-  'settings.webhookUrl.test': 'Test',
+  'settings.webhookUrl.test': 'Testuj',
  'settings.webhookUrl.testSuccess': 'Testowy webhook wysłany pomyślnie',
  'settings.webhookUrl.testFailed': 'Wysyłanie testowego webhooka nie powiodło się',
  'settings.notificationPreferences.inapp': 'In-App',
@@ -1507,6 +1572,7 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'memories.testFirst': 'Najpierw przetestuj połączenie',
  'memories.linkAlbum': 'Połącz album',
  'memories.selectAlbum': 'Wybierz album Immich',
+  'memories.selectAlbumMultiple': 'Wybierz album',
  'memories.noAlbums': 'Nie znaleziono albumów',
  'memories.syncAlbum': 'Synchronizuj album',
  'memories.unlinkAlbum': 'Odłącz album',
@@ -1592,6 +1658,8 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'notifications.markUnread': 'Oznacz jako nieprzeczytane',
  'notifications.delete': 'Usuń',
  'notifications.system': 'System',
+  'notifications.synologySessionCleared.title': 'Synology Photos rozłączone',
+  'notifications.synologySessionCleared.text': 'Twój serwer lub konto zostało zmienione — przejdź do Ustawień, aby ponownie przetestować połączenie.',
  'notifications.versionAvailable.title': 'Dostępna aktualizacja',
  'notifications.versionAvailable.text': 'TREK {version} jest już dostępny.',
  'notifications.versionAvailable.button': 'Zobacz szczegóły',
@@ -1912,6 +1980,69 @@ const pl: Record<string, string | { name: string; category: string }[]> = {
  'dayplan.mobile.createNew': 'Utwórz nowe miejsce',
  'admin.addons.catalog.journey.name': 'Dziennik podróży',
  'admin.addons.catalog.journey.description': 'Śledzenie podróży i dziennik z zameldowaniami, zdjęciami i codziennymi historiami',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Podróże',
+  'oauth.scope.group.places': 'Miejsca',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Pakowanie',
+  'oauth.scope.group.todos': 'Zadania',
+  'oauth.scope.group.budget': 'Budżet',
+  'oauth.scope.group.reservations': 'Rezerwacje',
+  'oauth.scope.group.collab': 'Współpraca',
+  'oauth.scope.group.notifications': 'Powiadomienia',
+  'oauth.scope.group.vacay': 'Urlop',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Pogoda',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Przeglądaj podróże i itineraria',
+  'oauth.scope.trips:read.description': 'Odczytuj podróże, dni, notatki i członków',
+  'oauth.scope.trips:write.label': 'Edytuj podróże i itineraria',
+  'oauth.scope.trips:write.description': 'Twórz i aktualizuj podróże, dni, notatki oraz zarządzaj członkami',
+  'oauth.scope.trips:delete.label': 'Usuń podróże',
+  'oauth.scope.trips:delete.description': 'Trwale usuń całe podróże — ta akcja jest nieodwracalna',
+  'oauth.scope.trips:share.label': 'Zarządzaj linkami udostępniania',
+  'oauth.scope.trips:share.description': 'Twórz, aktualizuj i unieważniaj publiczne linki udostępniania',
+  'oauth.scope.places:read.label': 'Przeglądaj miejsca i dane mapy',
+  'oauth.scope.places:read.description': 'Odczytuj miejsca, przypisania dni, tagi i kategorie',
+  'oauth.scope.places:write.label': 'Zarządzaj miejscami',
+  'oauth.scope.places:write.description': 'Twórz, aktualizuj i usuń miejsca, przypisania i tagi',
+  'oauth.scope.atlas:read.label': 'Przeglądaj Atlas',
+  'oauth.scope.atlas:read.description': 'Odczytuj odwiedzone kraje, regiony i listę marzeń',
+  'oauth.scope.atlas:write.label': 'Zarządzaj Atlasem',
+  'oauth.scope.atlas:write.description': 'Oznaczaj kraje i regiony jako odwiedzone, zarządzaj listą marzeń',
+  'oauth.scope.packing:read.label': 'Przeglądaj listy pakowania',
+  'oauth.scope.packing:read.description': 'Odczytuj przedmioty, torby i przypisania kategorii',
+  'oauth.scope.packing:write.label': 'Zarządzaj listami pakowania',
+  'oauth.scope.packing:write.description': 'Dodawaj, aktualizuj, usuwaj, zaznaczaj i porządkuj przedmioty i torby',
+  'oauth.scope.todos:read.label': 'Przeglądaj listy zadań',
+  'oauth.scope.todos:read.description': 'Odczytuj zadania podróży i przypisania kategorii',
+  'oauth.scope.todos:write.label': 'Zarządzaj listami zadań',
+  'oauth.scope.todos:write.description': 'Twórz, aktualizuj, zaznaczaj, usuwaj i porządkuj zadania',
+  'oauth.scope.budget:read.label': 'Przeglądaj budżet',
+  'oauth.scope.budget:read.description': 'Odczytuj pozycje budżetu i zestawienie wydatków',
+  'oauth.scope.budget:write.label': 'Zarządzaj budżetem',
+  'oauth.scope.budget:write.description': 'Twórz, aktualizuj i usuń pozycje budżetu',
+  'oauth.scope.reservations:read.label': 'Przeglądaj rezerwacje',
+  'oauth.scope.reservations:read.description': 'Odczytuj rezerwacje i szczegóły zakwaterowania',
+  'oauth.scope.reservations:write.label': 'Zarządzaj rezerwacjami',
+  'oauth.scope.reservations:write.description': 'Twórz, aktualizuj, usuwaj i porządkuj rezerwacje',
+  'oauth.scope.collab:read.label': 'Przeglądaj współpracę',
+  'oauth.scope.collab:read.description': 'Odczytuj notatki, ankiety i wiadomości',
+  'oauth.scope.collab:write.label': 'Zarządzaj współpracą',
+  'oauth.scope.collab:write.description': 'Twórz, aktualizuj i usuń notatki, ankiety i wiadomości',
+  'oauth.scope.notifications:read.label': 'Przeglądaj powiadomienia',
+  'oauth.scope.notifications:read.description': 'Odczytuj powiadomienia i liczby nieprzeczytanych',
+  'oauth.scope.notifications:write.label': 'Zarządzaj powiadomieniami',
+  'oauth.scope.notifications:write.description': 'Oznaczaj powiadomienia jako przeczytane i odpowiadaj na nie',
+  'oauth.scope.vacay:read.label': 'Przeglądaj plany urlopowe',
+  'oauth.scope.vacay:read.description': 'Odczytuj dane planowania urlopu, wpisy i statystyki',
+  'oauth.scope.vacay:write.label': 'Zarządzaj planami urlopowymi',
+  'oauth.scope.vacay:write.description': 'Twórz i zarządzaj wpisami urlopowymi, świętami i planami zespołu',
+  'oauth.scope.geo:read.label': 'Mapy i geokodowanie',
+  'oauth.scope.geo:read.description': 'Wyszukuj miejsca, rozwiązuj adresy URL map i odwrotnie geokoduj współrzędne',
+  'oauth.scope.weather:read.label': 'Prognozy pogody',
+  'oauth.scope.weather:read.description': 'Pobieraj prognozy pogody dla miejsc i dat podróży',
 }

 export default pl
@@ -179,9 +179,6 @@ const ru: Record<string, string> = {
  'admin.notifications.none': 'Отключено',
  'admin.notifications.email': 'Эл. почта (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': 'События уведомлений',
-  'admin.notifications.eventsHint': 'Выберите, какие события вызывают уведомления для всех пользователей.',
-  'admin.notifications.configureFirst': 'Сначала настройте SMTP или webhook ниже, затем включите события.',
  'admin.notifications.save': 'Сохранить настройки уведомлений',
  'admin.notifications.saved': 'Настройки уведомлений сохранены',
  'admin.notifications.testWebhook': 'Отправить тестовый вебхук',
@@ -228,6 +225,7 @@ const ru: Record<string, string> = {
  'settings.mcp.endpoint': 'MCP-эндпоинт',
  'settings.mcp.clientConfig': 'Конфигурация клиента',
  'settings.mcp.clientConfigHint': 'Замените <your_token> на API-токен из списка ниже. Путь к npx может потребовать настройки для вашей системы (например, C:\\PROGRA~1\\nodejs\\npx.cmd в Windows).',
+  'settings.mcp.clientConfigHintOAuth': 'Замените <your_client_id> и <your_client_secret> на учётные данные из созданного выше клиента OAuth 2.1. При первом подключении mcp-remote откроет браузер для завершения авторизации. Путь к npx может потребовать настройки для вашей системы (например, C:\\PROGRA~1\\nodejs\\npx.cmd в Windows).',
  'settings.mcp.copy': 'Копировать',
  'settings.mcp.copied': 'Скопировано!',
  'settings.mcp.apiTokens': 'API-токены',
@@ -249,6 +247,48 @@ const ru: Record<string, string> = {
  'settings.mcp.toast.createError': 'Не удалось создать токен',
  'settings.mcp.toast.deleted': 'Токен удалён',
  'settings.mcp.toast.deleteError': 'Не удалось удалить токен',
+  'settings.mcp.apiTokensDeprecated': 'API-токены устарели и будут удалены в будущей версии. Пожалуйста, используйте клиенты OAuth 2.1.',
+  'settings.oauth.clients': 'Клиенты OAuth 2.1',
+  'settings.oauth.clientsHint': 'Зарегистрируйте клиенты OAuth 2.1, чтобы сторонние MCP-приложения (Claude Web, Cursor и др.) могли подключаться без статических токенов.',
+  'settings.oauth.createClient': 'Новый клиент',
+  'settings.oauth.noClients': 'Нет зарегистрированных клиентов OAuth.',
+  'settings.oauth.clientId': 'ID клиента',
+  'settings.oauth.clientSecret': 'Секрет клиента',
+  'settings.oauth.deleteClient': 'Удалить клиента',
+  'settings.oauth.deleteClientMessage': 'Этот клиент и все активные сессии будут удалены навсегда. Любое приложение, использующее его, немедленно потеряет доступ.',
+  'settings.oauth.rotateSecret': 'Обновить секрет',
+  'settings.oauth.rotateSecretMessage': 'Будет сгенерирован новый секрет клиента, а все существующие сессии будут немедленно аннулированы. Обновите приложение перед закрытием этого диалога.',
+  'settings.oauth.rotateSecretConfirm': 'Обновить',
+  'settings.oauth.rotateSecretConfirming': 'Обновление…',
+  'settings.oauth.rotateSecretDoneTitle': 'Новый секрет сгенерирован',
+  'settings.oauth.rotateSecretDoneWarning': 'Этот секрет отображается только один раз. Скопируйте его сейчас и обновите приложение — все предыдущие сессии были аннулированы.',
+  'settings.oauth.activeSessions': 'Активные сессии OAuth',
+  'settings.oauth.sessionScopes': 'Области доступа',
+  'settings.oauth.sessionExpires': 'Истекает',
+  'settings.oauth.revoke': 'Отозвать',
+  'settings.oauth.revokeSession': 'Отозвать сессию',
+  'settings.oauth.revokeSessionMessage': 'Это немедленно отзовёт доступ для данной сессии OAuth.',
+  'settings.oauth.modal.createTitle': 'Зарегистрировать клиент OAuth',
+  'settings.oauth.modal.presets': 'Быстрые настройки',
+  'settings.oauth.modal.clientName': 'Название приложения',
+  'settings.oauth.modal.clientNamePlaceholder': 'напр. Claude Web, Моё MCP-приложение',
+  'settings.oauth.modal.redirectUris': 'URI перенаправления',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': 'Один URI на строку. Требуется HTTPS (localhost исключён). Требуется точное совпадение.',
+  'settings.oauth.modal.scopes': 'Разрешённые области доступа',
+  'settings.oauth.modal.scopesHint': 'list_trips и get_trip_summary всегда доступны — область не требуется. Они помогают ИИ находить нужные ID поездок.',
+  'settings.oauth.modal.selectAll': 'Выбрать все',
+  'settings.oauth.modal.deselectAll': 'Снять выбор',
+  'settings.oauth.modal.creating': 'Регистрация…',
+  'settings.oauth.modal.create': 'Зарегистрировать клиента',
+  'settings.oauth.modal.createdTitle': 'Клиент зарегистрирован',
+  'settings.oauth.modal.createdWarning': 'Секрет клиента отображается только один раз. Скопируйте его сейчас — его нельзя будет восстановить.',
+  'settings.oauth.toast.createError': 'Не удалось зарегистрировать клиент OAuth',
+  'settings.oauth.toast.deleted': 'Клиент OAuth удалён',
+  'settings.oauth.toast.deleteError': 'Не удалось удалить клиент OAuth',
+  'settings.oauth.toast.revoked': 'Сессия отозвана',
+  'settings.oauth.toast.revokeError': 'Не удалось отозвать сессию',
+  'settings.oauth.toast.rotateError': 'Не удалось обновить секрет клиента',
  'settings.account': 'Аккаунт',
  'settings.about': 'О приложении',
  'settings.about.reportBug': 'Сообщить об ошибке',
@@ -547,9 +587,10 @@ const ru: Record<string, string> = {
  'admin.weather.locationHint': 'Погода основана на первом месте с координатами в каждом дне. Если ни одно место не назначено на день, в качестве ориентира используется любое место из списка.',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP-токены',
-  'admin.mcpTokens.title': 'MCP-токены',
-  'admin.mcpTokens.subtitle': 'Управление API-токенами всех пользователей',
+  'admin.tabs.mcpTokens': 'MCP-доступ',
+  'admin.mcpTokens.title': 'MCP-доступ',
+  'admin.mcpTokens.subtitle': 'Управление OAuth-сессиями и API-токенами всех пользователей',
+  'admin.mcpTokens.sectionTitle': 'API-токены',
  'admin.mcpTokens.owner': 'Владелец',
  'admin.mcpTokens.tokenName': 'Название токена',
  'admin.mcpTokens.created': 'Создан',
@@ -561,6 +602,17 @@ const ru: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': 'Токен удалён',
  'admin.mcpTokens.deleteError': 'Не удалось удалить токен',
  'admin.mcpTokens.loadError': 'Не удалось загрузить токены',
+  'admin.oauthSessions.sectionTitle': 'OAuth-сессии',
+  'admin.oauthSessions.clientName': 'Клиент',
+  'admin.oauthSessions.owner': 'Владелец',
+  'admin.oauthSessions.scopes': 'Права доступа',
+  'admin.oauthSessions.created': 'Создано',
+  'admin.oauthSessions.empty': 'Нет активных OAuth-сессий',
+  'admin.oauthSessions.revokeTitle': 'Отозвать сессию',
+  'admin.oauthSessions.revokeMessage': 'Эта OAuth-сессия будет немедленно отозвана. Клиент потеряет доступ к MCP.',
+  'admin.oauthSessions.revokeSuccess': 'Сессия отозвана',
+  'admin.oauthSessions.revokeError': 'Не удалось отозвать сессию',
+  'admin.oauthSessions.loadError': 'Не удалось загрузить OAuth-сессии',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1005,6 +1057,7 @@ const ru: Record<string, string> = {
  'budget.totalBudget': 'Общий бюджет',
  'budget.byCategory': 'По категориям',
  'budget.editTooltip': 'Нажмите для редактирования',
+  'budget.linkedToReservation': 'Связано с бронированием — редактируйте название там',
  'budget.confirm.deleteCategory': 'Вы уверены, что хотите удалить категорию «{name}» с {count} записями?',
  'budget.deleteCategory': 'Удалить категорию',
  'budget.perPerson': 'На человека',
@@ -1103,6 +1156,9 @@ const ru: Record<string, string> = {
  'packing.template': 'Шаблон',
  'packing.templateApplied': '{count} вещей добавлено из шаблона',
  'packing.templateError': 'Ошибка применения шаблона',
+  'packing.saveAsTemplate': 'Сохранить как шаблон',
+  'packing.templateName': 'Название шаблона',
+  'packing.templateSaved': 'Список вещей сохранён как шаблон',
  'packing.assignUser': 'Назначить пользователя',
  'packing.noMembers': 'Нет участников',
  'packing.bags': 'Багаж',
@@ -1378,6 +1434,7 @@ const ru: Record<string, string> = {
  'memories.title': 'Фото',
  'memories.notConnected': 'Immich не подключён',
  'memories.notConnectedHint': 'Подключите Immich в настройках, чтобы видеть фотографии из поездок.',
+  'memories.notConnectedMultipleHint': 'Подключите одного из этих фотопровайдеров: {provider_names} в Настройках, чтобы добавлять фотографии к этому путешествию.',
  'memories.noDates': 'Добавьте даты поездки для загрузки фотографий.',
  'memories.noPhotos': 'Фотографии не найдены',
  'memories.noPhotosHint': 'В Immich нет фотографий за период этой поездки.',
@@ -1388,26 +1445,35 @@ const ru: Record<string, string> = {
  'memories.reviewTitle': 'Проверьте ваши фото',
  'memories.reviewHint': 'Нажмите на фото, чтобы исключить его из общего доступа.',
  'memories.shareCount': 'Поделиться ({count} фото)',
-  'memories.immichUrl': 'URL сервера Immich',
-  'memories.immichApiKey': 'API-ключ',
+  'memories.providerUrl': 'URL сервера',
+  'memories.providerApiKey': 'API-ключ',
+  'memories.providerUsername': 'Имя пользователя',
+  'memories.providerPassword': 'Пароль',
+  'memories.providerOTP': 'Код MFA (если включён)',
+  'memories.skipSSLVerification': 'Пропустить проверку SSL-сертификата',
+  'memories.providerUrlHintSynology': 'Включите путь приложения Photos в URL, например https://nas:5001/photo',
  'memories.testConnection': 'Проверить подключение',
  'memories.testFirst': 'Сначала проверьте подключение',
  'memories.connected': 'Подключено',
  'memories.disconnected': 'Не подключено',
  'memories.connectionSuccess': 'Подключение к Immich установлено',
  'memories.connectionError': 'Не удалось подключиться к Immich',
-  'memories.saved': 'Настройки Immich сохранены',
+  'memories.saved': 'Настройки {provider_name} сохранены',
+  'memories.providerDisconnectedBanner': 'Соединение с {provider_name} потеряно. Переподключитесь в Настройках для просмотра фотографий.',
+  'memories.saveError': 'Не удалось сохранить настройки {provider_name}',
  'memories.oldest': 'Сначала старые',
  'memories.newest': 'Сначала новые',
  'memories.allLocations': 'Все места',
  'memories.addPhotos': 'Добавить фото',
  'memories.linkAlbum': 'Привязать альбом',
  'memories.selectAlbum': 'Выбрать альбом Immich',
+  'memories.selectAlbumMultiple': 'Выбрать альбом',
  'memories.noAlbums': 'Альбомы не найдены',
  'memories.syncAlbum': 'Синхронизировать',
  'memories.unlinkAlbum': 'Отвязать',
  'memories.photos': 'фото',
  'memories.selectPhotos': 'Выбрать фото из Immich',
+  'memories.selectPhotosMultiple': 'Выбрать фотографии',
  'memories.selectHint': 'Нажмите на фото, чтобы выбрать их.',
  'memories.selected': 'выбрано',
  'memories.addSelected': 'Добавить {count} фото',
@@ -1564,6 +1630,8 @@ const ru: Record<string, string> = {
  'notifications.markUnread': 'Отметить как непрочитанное',
  'notifications.delete': 'Удалить',
  'notifications.system': 'Система',
+  'notifications.synologySessionCleared.title': 'Synology Photos отключено',
+  'notifications.synologySessionCleared.text': 'Ваш сервер или аккаунт изменился — перейдите в Настройки, чтобы проверить соединение снова.',
  'memories.error.loadAlbums': 'Не удалось загрузить альбомы',
  'memories.error.linkAlbum': 'Не удалось привязать альбом',
  'memories.error.unlinkAlbum': 'Не удалось отвязать альбом',
@@ -1919,6 +1987,69 @@ const ru: Record<string, string> = {
  'dayplan.mobile.createNew': 'Создать новое место',
  'admin.addons.catalog.journey.name': 'Путешествие',
  'admin.addons.catalog.journey.description': 'Отслеживание поездок и дневник путешествий с отметками, фото и ежедневными историями',
+  // OAuth scope groups
+  'oauth.scope.group.trips': 'Поездки',
+  'oauth.scope.group.places': 'Места',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': 'Вещи',
+  'oauth.scope.group.todos': 'Задачи',
+  'oauth.scope.group.budget': 'Бюджет',
+  'oauth.scope.group.reservations': 'Бронирования',
+  'oauth.scope.group.collab': 'Сотрудничество',
+  'oauth.scope.group.notifications': 'Уведомления',
+  'oauth.scope.group.vacay': 'Отпуск',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': 'Погода',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': 'Просмотр поездок и маршрутов',
+  'oauth.scope.trips:read.description': 'Чтение поездок, дней, заметок и участников',
+  'oauth.scope.trips:write.label': 'Редактирование поездок и маршрутов',
+  'oauth.scope.trips:write.description': 'Создание и обновление поездок, дней, заметок и управление участниками',
+  'oauth.scope.trips:delete.label': 'Удаление поездок',
+  'oauth.scope.trips:delete.description': 'Безвозвратное удаление поездок — это действие необратимо',
+  'oauth.scope.trips:share.label': 'Управление ссылками на совместный доступ',
+  'oauth.scope.trips:share.description': 'Создание, обновление и отзыв публичных ссылок на поездки',
+  'oauth.scope.places:read.label': 'Просмотр мест и данных карты',
+  'oauth.scope.places:read.description': 'Чтение мест, назначений по дням, тегов и категорий',
+  'oauth.scope.places:write.label': 'Управление местами',
+  'oauth.scope.places:write.description': 'Создание, обновление и удаление мест, назначений и тегов',
+  'oauth.scope.atlas:read.label': 'Просмотр Atlas',
+  'oauth.scope.atlas:read.description': 'Чтение посещённых стран, регионов и списка желаний',
+  'oauth.scope.atlas:write.label': 'Управление Atlas',
+  'oauth.scope.atlas:write.description': 'Отмечать посещённые страны и регионы, управлять списком желаний',
+  'oauth.scope.packing:read.label': 'Просмотр списков вещей',
+  'oauth.scope.packing:read.description': 'Чтение вещей, сумок и назначений категорий',
+  'oauth.scope.packing:write.label': 'Управление списками вещей',
+  'oauth.scope.packing:write.description': 'Добавление, обновление, удаление, отметка и переупорядочивание вещей и сумок',
+  'oauth.scope.todos:read.label': 'Просмотр списков задач',
+  'oauth.scope.todos:read.description': 'Чтение задач поездки и назначений категорий',
+  'oauth.scope.todos:write.label': 'Управление списками задач',
+  'oauth.scope.todos:write.description': 'Создание, обновление, отметка, удаление и переупорядочивание задач',
+  'oauth.scope.budget:read.label': 'Просмотр бюджета',
+  'oauth.scope.budget:read.description': 'Чтение статей бюджета и разбивки расходов',
+  'oauth.scope.budget:write.label': 'Управление бюджетом',
+  'oauth.scope.budget:write.description': 'Создание, обновление и удаление статей бюджета',
+  'oauth.scope.reservations:read.label': 'Просмотр бронирований',
+  'oauth.scope.reservations:read.description': 'Чтение бронирований и сведений о проживании',
+  'oauth.scope.reservations:write.label': 'Управление бронированиями',
+  'oauth.scope.reservations:write.description': 'Создание, обновление, удаление и переупорядочивание бронирований',
+  'oauth.scope.collab:read.label': 'Просмотр совместной работы',
+  'oauth.scope.collab:read.description': 'Чтение совместных заметок, опросов и сообщений',
+  'oauth.scope.collab:write.label': 'Управление совместной работой',
+  'oauth.scope.collab:write.description': 'Создание, обновление и удаление заметок, опросов и сообщений',
+  'oauth.scope.notifications:read.label': 'Просмотр уведомлений',
+  'oauth.scope.notifications:read.description': 'Чтение уведомлений в приложении и количества непрочитанных',
+  'oauth.scope.notifications:write.label': 'Управление уведомлениями',
+  'oauth.scope.notifications:write.description': 'Отмечать уведомления как прочитанные и отвечать на них',
+  'oauth.scope.vacay:read.label': 'Просмотр планов отпуска',
+  'oauth.scope.vacay:read.description': 'Чтение данных планирования отпуска, записей и статистики',
+  'oauth.scope.vacay:write.label': 'Управление планами отпуска',
+  'oauth.scope.vacay:write.description': 'Создание и управление записями отпуска, праздниками и командными планами',
+  'oauth.scope.geo:read.label': 'Карты и геокодирование',
+  'oauth.scope.geo:read.description': 'Поиск мест, разрешение URL карт и обратное геокодирование координат',
+  'oauth.scope.weather:read.label': 'Прогнозы погоды',
+  'oauth.scope.weather:read.description': 'Получение прогнозов погоды для мест и дат поездки',
 }

 export default ru
@@ -179,9 +179,6 @@ const zh: Record<string, string> = {
  'admin.notifications.none': '已禁用',
  'admin.notifications.email': '电子邮件 (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': '通知事件',
-  'admin.notifications.eventsHint': '选择哪些事件为所有用户触发通知。',
-  'admin.notifications.configureFirst': '请先在下方配置 SMTP 或 Webhook，然后启用事件。',
  'admin.notifications.save': '保存通知设置',
  'admin.notifications.saved': '通知设置已保存',
  'admin.notifications.testWebhook': '发送测试 Webhook',
@@ -228,6 +225,7 @@ const zh: Record<string, string> = {
  'settings.mcp.endpoint': 'MCP 端点',
  'settings.mcp.clientConfig': '客户端配置',
  'settings.mcp.clientConfigHint': '将 <your_token> 替换为下方列表中的 API 令牌。npx 的路径可能需要根据您的系统进行调整（例如 Windows 上为 C:\\PROGRA~1\\nodejs\\npx.cmd）。',
+  'settings.mcp.clientConfigHintOAuth': '将 <your_client_id> 和 <your_client_secret> 替换为上方创建的 OAuth 2.1 客户端凭据。首次连接时，mcp-remote 将打开浏览器完成授权。npx 的路径可能需要根据您的系统进行调整（例如 Windows 上为 C:\\PROGRA~1\\nodejs\\npx.cmd）。',
  'settings.mcp.copy': '复制',
  'settings.mcp.copied': '已复制！',
  'settings.mcp.apiTokens': 'API 令牌',
@@ -249,6 +247,48 @@ const zh: Record<string, string> = {
  'settings.mcp.toast.createError': '创建令牌失败',
  'settings.mcp.toast.deleted': '令牌已删除',
  'settings.mcp.toast.deleteError': '删除令牌失败',
+  'settings.mcp.apiTokensDeprecated': 'API 令牌已弃用，将在未来版本中移除。请改用 OAuth 2.1 客户端。',
+  'settings.oauth.clients': 'OAuth 2.1 客户端',
+  'settings.oauth.clientsHint': '注册 OAuth 2.1 客户端，让第三方 MCP 应用程序（Claude Web、Cursor 等）无需静态令牌即可连接。',
+  'settings.oauth.createClient': '新建客户端',
+  'settings.oauth.noClients': '没有已注册的 OAuth 客户端。',
+  'settings.oauth.clientId': '客户端 ID',
+  'settings.oauth.clientSecret': '客户端密钥',
+  'settings.oauth.deleteClient': '删除客户端',
+  'settings.oauth.deleteClientMessage': '此客户端及所有活跃会话将被永久删除。使用此客户端的任何应用程序将立即失去访问权限。',
+  'settings.oauth.rotateSecret': '轮换密钥',
+  'settings.oauth.rotateSecretMessage': '将生成新的客户端密钥，所有现有会话将立即失效。在关闭此对话框之前，请更新您的应用程序。',
+  'settings.oauth.rotateSecretConfirm': '轮换',
+  'settings.oauth.rotateSecretConfirming': '轮换中…',
+  'settings.oauth.rotateSecretDoneTitle': '已生成新密钥',
+  'settings.oauth.rotateSecretDoneWarning': '此密钥仅显示一次。请立即复制并更新您的应用程序——所有之前的会话已失效。',
+  'settings.oauth.activeSessions': '活跃的 OAuth 会话',
+  'settings.oauth.sessionScopes': '权限范围',
+  'settings.oauth.sessionExpires': '过期时间',
+  'settings.oauth.revoke': '撤销',
+  'settings.oauth.revokeSession': '撤销会话',
+  'settings.oauth.revokeSessionMessage': '这将立即撤销此 OAuth 会话的访问权限。',
+  'settings.oauth.modal.createTitle': '注册 OAuth 客户端',
+  'settings.oauth.modal.presets': '快速预设',
+  'settings.oauth.modal.clientName': '应用程序名称',
+  'settings.oauth.modal.clientNamePlaceholder': '例如 Claude Web、我的 MCP 应用',
+  'settings.oauth.modal.redirectUris': '重定向 URI',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': '每行一个 URI。需要 HTTPS（localhost 除外）。要求精确匹配。',
+  'settings.oauth.modal.scopes': '允许的权限范围',
+  'settings.oauth.modal.scopesHint': 'list_trips 和 get_trip_summary 始终可用——无需权限范围。它们帮助 AI 发现所需的行程 ID。',
+  'settings.oauth.modal.selectAll': '全选',
+  'settings.oauth.modal.deselectAll': '取消全选',
+  'settings.oauth.modal.creating': '注册中…',
+  'settings.oauth.modal.create': '注册客户端',
+  'settings.oauth.modal.createdTitle': '客户端已注册',
+  'settings.oauth.modal.createdWarning': '客户端密钥仅显示一次。请立即复制——无法恢复。',
+  'settings.oauth.toast.createError': '注册 OAuth 客户端失败',
+  'settings.oauth.toast.deleted': 'OAuth 客户端已删除',
+  'settings.oauth.toast.deleteError': '删除 OAuth 客户端失败',
+  'settings.oauth.toast.revoked': '会话已撤销',
+  'settings.oauth.toast.revokeError': '撤销会话失败',
+  'settings.oauth.toast.rotateError': '轮换客户端密钥失败',
  'settings.account': '账户',
  'settings.about': '关于',
  'settings.about.reportBug': '报告错误',
@@ -547,9 +587,10 @@ const zh: Record<string, string> = {
  'admin.weather.locationHint': '天气基于每天中第一个有坐标的地点。如果当天没有分配地点，则使用地点列表中的任意地点作为参考。',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP 令牌',
-  'admin.mcpTokens.title': 'MCP 令牌',
-  'admin.mcpTokens.subtitle': '管理所有用户的 API 令牌',
+  'admin.tabs.mcpTokens': 'MCP 访问',
+  'admin.mcpTokens.title': 'MCP 访问',
+  'admin.mcpTokens.subtitle': '管理所有用户的 OAuth 会话和 API 令牌',
+  'admin.mcpTokens.sectionTitle': 'API 令牌',
  'admin.mcpTokens.owner': '所有者',
  'admin.mcpTokens.tokenName': '令牌名称',
  'admin.mcpTokens.created': '创建时间',
@@ -561,6 +602,17 @@ const zh: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': '令牌已删除',
  'admin.mcpTokens.deleteError': '删除令牌失败',
  'admin.mcpTokens.loadError': '加载令牌失败',
+  'admin.oauthSessions.sectionTitle': 'OAuth 会话',
+  'admin.oauthSessions.clientName': '客户端',
+  'admin.oauthSessions.owner': '所有者',
+  'admin.oauthSessions.scopes': '权限范围',
+  'admin.oauthSessions.created': '创建时间',
+  'admin.oauthSessions.empty': '暂无活跃的 OAuth 会话',
+  'admin.oauthSessions.revokeTitle': '撤销会话',
+  'admin.oauthSessions.revokeMessage': '此 OAuth 会话将立即被撤销。客户端将失去 MCP 访问权限。',
+  'admin.oauthSessions.revokeSuccess': '会话已撤销',
+  'admin.oauthSessions.revokeError': '撤销会话失败',
+  'admin.oauthSessions.loadError': '加载 OAuth 会话失败',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -1005,6 +1057,7 @@ const zh: Record<string, string> = {
  'budget.totalBudget': '总预算',
  'budget.byCategory': '按分类',
  'budget.editTooltip': '点击编辑',
+  'budget.linkedToReservation': '已关联到预订——请在那里编辑名称',
  'budget.confirm.deleteCategory': '确定删除分类「{name}」及其 {count} 个条目？',
  'budget.deleteCategory': '删除分类',
  'budget.perPerson': '人均',
@@ -1103,6 +1156,9 @@ const zh: Record<string, string> = {
  'packing.template': '模板',
  'packing.templateApplied': '已从模板添加 {count} 个物品',
  'packing.templateError': '应用模板失败',
+  'packing.saveAsTemplate': '保存为模板',
+  'packing.templateName': '模板名称',
+  'packing.templateSaved': '行李清单已保存为模板',
  'packing.assignUser': '分配用户',
  'packing.noMembers': '无成员',
  'packing.bags': '行李',
@@ -1378,6 +1434,7 @@ const zh: Record<string, string> = {
  'memories.title': '照片',
  'memories.notConnected': 'Immich 未连接',
  'memories.notConnectedHint': '在设置中连接您的 Immich 实例以在此查看旅行照片。',
+  'memories.notConnectedMultipleHint': '请在设置中连接以下任一照片提供商：{provider_names}，以便向此行程添加照片。',
  'memories.noDates': '为旅行添加日期以加载照片。',
  'memories.noPhotos': '未找到照片',
  'memories.noPhotosHint': 'Immich 中未找到此旅行日期范围内的照片。',
@@ -1388,26 +1445,35 @@ const zh: Record<string, string> = {
  'memories.reviewTitle': '审查您的照片',
  'memories.reviewHint': '点击照片以将其从分享中排除。',
  'memories.shareCount': '分享 {count} 张照片',
-  'memories.immichUrl': 'Immich 服务器地址',
-  'memories.immichApiKey': 'API 密钥',
+  'memories.providerUrl': '服务器 URL',
+  'memories.providerApiKey': 'API 密钥',
+  'memories.providerUsername': '用户名',
+  'memories.providerPassword': '密码',
+  'memories.providerOTP': 'MFA 验证码（如已启用）',
+  'memories.skipSSLVerification': '跳过 SSL 证书验证',
+  'memories.providerUrlHintSynology': '在 URL 中包含照片应用路径，例如 https://nas:5001/photo',
  'memories.testConnection': '测试连接',
  'memories.testFirst': '请先测试连接',
  'memories.connected': '已连接',
  'memories.disconnected': '未连接',
  'memories.connectionSuccess': '已连接到 Immich',
  'memories.connectionError': '无法连接到 Immich',
-  'memories.saved': 'Immich 设置已保存',
+  'memories.saved': '{provider_name} 设置已保存',
+  'memories.providerDisconnectedBanner': '您与 {provider_name} 的连接已断开。请在设置中重新连接以查看照片。',
+  'memories.saveError': '无法保存 {provider_name} 设置',
  'memories.oldest': '最早优先',
  'memories.newest': '最新优先',
  'memories.allLocations': '所有地点',
  'memories.addPhotos': '添加照片',
  'memories.linkAlbum': '关联相册',
  'memories.selectAlbum': '选择 Immich 相册',
+  'memories.selectAlbumMultiple': '选择相册',
  'memories.noAlbums': '未找到相册',
  'memories.syncAlbum': '同步相册',
  'memories.unlinkAlbum': '取消关联',
  'memories.photos': '张照片',
  'memories.selectPhotos': '从 Immich 选择照片',
+  'memories.selectPhotosMultiple': '选择照片',
  'memories.selectHint': '点击照片以选择。',
  'memories.selected': '已选择',
  'memories.addSelected': '添加 {count} 张照片',
@@ -1564,6 +1630,8 @@ const zh: Record<string, string> = {
  'notifications.markUnread': '标为未读',
  'notifications.delete': '删除',
  'notifications.system': '系统',
+  'notifications.synologySessionCleared.title': 'Synology Photos 已断开连接',
+  'notifications.synologySessionCleared.text': '您的服务器或账户已更改 — 请前往设置重新测试您的连接。',
  'memories.error.loadAlbums': '加载相册失败',
  'memories.error.linkAlbum': '关联相册失败',
  'memories.error.unlinkAlbum': '取消关联相册失败',
@@ -1919,6 +1987,69 @@ const zh: Record<string, string> = {
  'dayplan.mobile.createNew': '创建新地点',
  'admin.addons.catalog.journey.name': '旅程',
  'admin.addons.catalog.journey.description': '旅行追踪与旅行日志，包含签到、照片和每日故事',
+  // OAuth scope groups
+  'oauth.scope.group.trips': '行程',
+  'oauth.scope.group.places': '地点',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': '行李',
+  'oauth.scope.group.todos': '待办事项',
+  'oauth.scope.group.budget': '预算',
+  'oauth.scope.group.reservations': '预订',
+  'oauth.scope.group.collab': '协作',
+  'oauth.scope.group.notifications': '通知',
+  'oauth.scope.group.vacay': '假期',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': '天气',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': '查看行程和行程计划',
+  'oauth.scope.trips:read.description': '读取行程、天数、每日笔记和成员',
+  'oauth.scope.trips:write.label': '编辑行程和行程计划',
+  'oauth.scope.trips:write.description': '创建和更新行程、天数、笔记并管理成员',
+  'oauth.scope.trips:delete.label': '删除行程',
+  'oauth.scope.trips:delete.description': '永久删除整个行程——此操作不可撤销',
+  'oauth.scope.trips:share.label': '管理分享链接',
+  'oauth.scope.trips:share.description': '创建、更新和撤销行程的公开分享链接',
+  'oauth.scope.places:read.label': '查看地点和地图数据',
+  'oauth.scope.places:read.description': '读取地点、每日分配、标签和分类',
+  'oauth.scope.places:write.label': '管理地点',
+  'oauth.scope.places:write.description': '创建、更新和删除地点、分配和标签',
+  'oauth.scope.atlas:read.label': '查看 Atlas',
+  'oauth.scope.atlas:read.description': '读取已访问国家、地区和心愿清单',
+  'oauth.scope.atlas:write.label': '管理 Atlas',
+  'oauth.scope.atlas:write.description': '标记已访问国家和地区，管理心愿清单',
+  'oauth.scope.packing:read.label': '查看行李清单',
+  'oauth.scope.packing:read.description': '读取行李物品、包袋和分类负责人',
+  'oauth.scope.packing:write.label': '管理行李清单',
+  'oauth.scope.packing:write.description': '添加、更新、删除、勾选和重新排列行李物品和包袋',
+  'oauth.scope.todos:read.label': '查看待办清单',
+  'oauth.scope.todos:read.description': '读取行程待办事项和分类负责人',
+  'oauth.scope.todos:write.label': '管理待办清单',
+  'oauth.scope.todos:write.description': '创建、更新、勾选、删除和重新排列待办事项',
+  'oauth.scope.budget:read.label': '查看预算',
+  'oauth.scope.budget:read.description': '读取预算条目和费用明细',
+  'oauth.scope.budget:write.label': '管理预算',
+  'oauth.scope.budget:write.description': '创建、更新和删除预算条目',
+  'oauth.scope.reservations:read.label': '查看预订',
+  'oauth.scope.reservations:read.description': '读取预订和住宿详情',
+  'oauth.scope.reservations:write.label': '管理预订',
+  'oauth.scope.reservations:write.description': '创建、更新、删除和重新排列预订',
+  'oauth.scope.collab:read.label': '查看协作',
+  'oauth.scope.collab:read.description': '读取协作笔记、投票和消息',
+  'oauth.scope.collab:write.label': '管理协作',
+  'oauth.scope.collab:write.description': '创建、更新和删除协作笔记、投票和消息',
+  'oauth.scope.notifications:read.label': '查看通知',
+  'oauth.scope.notifications:read.description': '读取应用内通知和未读数量',
+  'oauth.scope.notifications:write.label': '管理通知',
+  'oauth.scope.notifications:write.description': '将通知标记为已读并回复',
+  'oauth.scope.vacay:read.label': '查看假期计划',
+  'oauth.scope.vacay:read.description': '读取假期计划数据、条目和统计',
+  'oauth.scope.vacay:write.label': '管理假期计划',
+  'oauth.scope.vacay:write.description': '创建和管理假期条目、节假日和团队计划',
+  'oauth.scope.geo:read.label': '地图和地理编码',
+  'oauth.scope.geo:read.description': '搜索位置、解析地图 URL 和反向地理编码坐标',
+  'oauth.scope.weather:read.label': '天气预报',
+  'oauth.scope.weather:read.description': '获取行程地点和日期的天气预报',
 }

 export default zh
@@ -113,6 +113,8 @@ const zhTw: Record<string, string> = {
  'dashboard.tripDescriptionPlaceholder': '這次旅行是關於什麼的？',
  'dashboard.startDate': '開始日期',
  'dashboard.endDate': '結束日期',
+  'dashboard.dayCount': '天數',
+  'dashboard.dayCountHint': '未設定旅行日期時，要規劃的天數。',
  'dashboard.noDateHint': '未設定日期——將預設建立 7 天。你可以隨時修改。',
  'dashboard.coverImage': '封面圖片',
  'dashboard.addCoverImage': '新增封面圖片',
@@ -127,6 +129,12 @@ const zhTw: Record<string, string> = {
  // Settings
  'settings.title': '設定',
  'settings.subtitle': '配置你的個人設定',
+  'settings.tabs.display': '顯示',
+  'settings.tabs.map': '地圖',
+  'settings.tabs.notifications': '通知',
+  'settings.tabs.integrations': '整合',
+  'settings.tabs.account': '帳戶',
+  'settings.tabs.about': '關於',
  'settings.map': '地圖',
  'settings.mapTemplate': '地圖模板',
  'settings.mapTemplatePlaceholder.select': '選擇模板...',
@@ -163,6 +171,19 @@ const zhTw: Record<string, string> = {
  'settings.notifyCollabMessage': '聊天訊息 (Collab)',
  'settings.notifyPackingTagged': '行李清單：分配',
  'settings.notifyWebhook': 'Webhook 通知',
+  'settings.notifyVersionAvailable': '有新版本可用',
+  'settings.notificationPreferences.email': '電子郵件',
+  'settings.notificationPreferences.webhook': 'Webhook',
+  'settings.notificationPreferences.inapp': '應用程式內',
+  'settings.notificationPreferences.noChannels': '未配置通知渠道。請聯絡管理員設定電子郵件或 Webhook 通知。',
+  'settings.webhookUrl.label': 'Webhook URL',
+  'settings.webhookUrl.placeholder': 'https://discord.com/api/webhooks/...',
+  'settings.webhookUrl.hint': '輸入您的 Discord、Slack 或自訂 Webhook URL 以接收通知。',
+  'settings.webhookUrl.save': '儲存',
+  'settings.webhookUrl.saved': 'Webhook URL 已儲存',
+  'settings.webhookUrl.test': '測試',
+  'settings.webhookUrl.testSuccess': '測試 Webhook 傳送成功',
+  'settings.webhookUrl.testFailed': '測試 Webhook 傳送失敗',
  'settings.notificationsDisabled': '通知尚未配置。請聯絡管理員啟用電子郵件或 Webhook 通知。',
  'settings.notificationsActive': '活躍頻道',
  'settings.notificationsManagedByAdmin': '通知事件由管理員配置。',
@@ -171,18 +192,26 @@ const zhTw: Record<string, string> = {
  'admin.notifications.none': '已停用',
  'admin.notifications.email': '電子郵件 (SMTP)',
  'admin.notifications.webhook': 'Webhook',
-  'admin.notifications.events': '通知事件',
-  'admin.notifications.eventsHint': '選擇哪些事件為所有使用者觸發通知。',
-  'admin.notifications.configureFirst': '請先在下方配置 SMTP 或 Webhook，然後啟用事件。',
  'admin.notifications.save': '儲存通知設定',
  'admin.notifications.saved': '通知設定已儲存',
  'admin.notifications.testWebhook': '傳送測試 Webhook',
  'admin.notifications.testWebhookSuccess': '測試 Webhook 傳送成功',
  'admin.notifications.testWebhookFailed': '測試 Webhook 傳送失敗',
+  'admin.notifications.emailPanel.title': '電子郵件 (SMTP)',
+  'admin.notifications.webhookPanel.title': 'Webhook',
+  'admin.notifications.inappPanel.title': '應用程式內通知',
+  'admin.notifications.inappPanel.hint': '應用程式內通知始終啟用，無法全域性停用。',
+  'admin.notifications.adminWebhookPanel.title': '管理員 Webhook',
+  'admin.notifications.adminWebhookPanel.hint': '此 Webhook 專用於管理員通知（例如版本提醒）。它與每位使用者的 Webhook 分開，設定後始終會觸發。',
+  'admin.notifications.adminWebhookPanel.saved': '管理員 Webhook URL 已儲存',
+  'admin.notifications.adminWebhookPanel.testSuccess': '測試 Webhook 傳送成功',
+  'admin.notifications.adminWebhookPanel.testFailed': '測試 Webhook 傳送失敗',
+  'admin.notifications.adminWebhookPanel.alwaysOnHint': '配置 URL 後，管理員 Webhook 始終觸發',
+  'admin.notifications.adminNotificationsHint': '配置哪些渠道傳遞僅管理員通知（例如版本提醒）。',
  'admin.smtp.title': '郵件與通知',
  'admin.smtp.hint': '用於傳送電子郵件通知的 SMTP 配置。',
  'admin.smtp.testButton': '傳送測試郵件',
-  'admin.webhook.hint': '向外部 Webhook 傳送通知（Discord、Slack 等）。',
+  'admin.webhook.hint': '允許使用者配置自己的 Webhook URL 以接收通知（Discord、Slack 等）。',
  'admin.smtp.testSuccess': '測試郵件傳送成功',
  'admin.smtp.testFailed': '測試郵件傳送失敗',
  'dayplan.icsTooltip': '匯出日曆 (ICS)',
@@ -220,6 +249,7 @@ const zhTw: Record<string, string> = {
  'settings.mcp.endpoint': 'MCP 端點',
  'settings.mcp.clientConfig': '客戶端配置',
  'settings.mcp.clientConfigHint': '將 <your_token> 替換為下方列表中的 API 令牌。npx 的路徑可能需要根據您的系統進行調整（例如 Windows 上為 C:\\PROGRA~1\\nodejs\\npx.cmd）。',
+  'settings.mcp.clientConfigHintOAuth': '將 <your_client_id> 和 <your_client_secret> 替換為上方建立的 OAuth 2.1 客戶端所顯示的憑據。首次連線時，mcp-remote 將開啟瀏覽器完成授權。npx 的路徑可能需要根據您的系統進行調整（例如 Windows 上為 C:\\PROGRA~1\\nodejs\\npx.cmd）。',
  'settings.mcp.copy': '複製',
  'settings.mcp.copied': '已複製！',
  'settings.mcp.apiTokens': 'API 令牌',
@@ -241,8 +271,58 @@ const zhTw: Record<string, string> = {
  'settings.mcp.toast.createError': '建立令牌失敗',
  'settings.mcp.toast.deleted': '令牌已刪除',
  'settings.mcp.toast.deleteError': '刪除令牌失敗',
+  'settings.mcp.apiTokensDeprecated': 'API 金鑰已棄用，將於未來版本中移除。請改用 OAuth 2.1 客戶端。',
+  'settings.oauth.clients': 'OAuth 2.1 客戶端',
+  'settings.oauth.clientsHint': '註冊 OAuth 2.1 客戶端，讓第三方 MCP 應用程式（Claude Web、Cursor 等）無需靜態金鑰即可連線。',
+  'settings.oauth.createClient': '新增客戶端',
+  'settings.oauth.noClients': '尚無已註冊的 OAuth 客戶端。',
+  'settings.oauth.clientId': '客戶端 ID',
+  'settings.oauth.clientSecret': '客戶端密鑰',
+  'settings.oauth.deleteClient': '刪除客戶端',
+  'settings.oauth.deleteClientMessage': '此客戶端及所有活躍工作階段將被永久刪除。任何使用此客戶端的應用程式將立即失去存取權限。',
+  'settings.oauth.rotateSecret': '輪換密鑰',
+  'settings.oauth.rotateSecretMessage': '將產生新的客戶端密鑰，所有現有工作階段將立即失效。請在關閉此對話框前更新您的應用程式。',
+  'settings.oauth.rotateSecretConfirm': '輪換',
+  'settings.oauth.rotateSecretConfirming': '輪換中…',
+  'settings.oauth.rotateSecretDoneTitle': '已產生新密鑰',
+  'settings.oauth.rotateSecretDoneWarning': '此密鑰僅顯示一次。請立即複製並更新您的應用程式——所有先前的工作階段已失效。',
+  'settings.oauth.activeSessions': '活躍的 OAuth 工作階段',
+  'settings.oauth.sessionScopes': '授權範圍',
+  'settings.oauth.sessionExpires': '到期時間',
+  'settings.oauth.revoke': '撤銷',
+  'settings.oauth.revokeSession': '撤銷工作階段',
+  'settings.oauth.revokeSessionMessage': '這將立即撤銷此 OAuth 工作階段的存取權限。',
+  'settings.oauth.modal.createTitle': '註冊 OAuth 客戶端',
+  'settings.oauth.modal.presets': '快速預設',
+  'settings.oauth.modal.clientName': '應用程式名稱',
+  'settings.oauth.modal.clientNamePlaceholder': '例如 Claude Web、我的 MCP 應用程式',
+  'settings.oauth.modal.redirectUris': '重新導向 URI',
+  'settings.oauth.modal.redirectUrisPlaceholder': 'https://your-app.com/callback\nhttps://your-app.com/auth',
+  'settings.oauth.modal.redirectUrisHint': '每行一個 URI。需要 HTTPS（localhost 除外）。需要完全符合。',
+  'settings.oauth.modal.scopes': '允許的授權範圍',
+  'settings.oauth.modal.scopesHint': 'list_trips 和 get_trip_summary 始終可用——不需要授權範圍。它們可幫助 AI 找到所需的行程 ID。',
+  'settings.oauth.modal.selectAll': '全選',
+  'settings.oauth.modal.deselectAll': '取消全選',
+  'settings.oauth.modal.creating': '註冊中…',
+  'settings.oauth.modal.create': '註冊客戶端',
+  'settings.oauth.modal.createdTitle': '客戶端已註冊',
+  'settings.oauth.modal.createdWarning': '客戶端密鑰僅顯示一次。請立即複製——無法恢復。',
+  'settings.oauth.toast.createError': '註冊 OAuth 客戶端失敗',
+  'settings.oauth.toast.deleted': 'OAuth 客戶端已刪除',
+  'settings.oauth.toast.deleteError': '刪除 OAuth 客戶端失敗',
+  'settings.oauth.toast.revoked': '工作階段已撤銷',
+  'settings.oauth.toast.revokeError': '撤銷工作階段失敗',
+  'settings.oauth.toast.rotateError': '輪換客戶端密鑰失敗',
  'settings.account': '賬戶',
  'settings.about': '關於',
+  'settings.about.reportBug': '回報錯誤',
+  'settings.about.reportBugHint': '發現問題？告訴我們',
+  'settings.about.featureRequest': '功能建議',
+  'settings.about.featureRequestHint': '建議新功能',
+  'settings.about.wikiHint': '文件與指南',
+  'settings.about.description': 'TREK 是一款自架旅遊規劃器，幫助您從最初構想到最後回憶，整理每次旅行。日程規劃、預算、行李清單、照片及更多功能——全部集中在您自己的伺服器上。',
+  'settings.about.madeWith': '以',
+  'settings.about.madeBy': '由 Maurice 及不斷成長的開源社群製作。',
  'settings.username': '使用者名稱',
  'settings.email': '郵箱',
  'settings.role': '角色',
@@ -385,6 +465,7 @@ const zhTw: Record<string, string> = {
  'admin.tabs.categories': '分類',
  'admin.tabs.backup': '備份',
  'admin.tabs.audit': '審計日誌',
+  'admin.tabs.notifications': '通知',
  'admin.stats.users': '使用者',
  'admin.stats.trips': '旅行',
  'admin.stats.places': '地點',
@@ -531,9 +612,10 @@ const zhTw: Record<string, string> = {
  'admin.weather.locationHint': '天氣基於每天中第一個有座標的地點。如果當天沒有分配地點，則使用地點列表中的任意地點作為參考。',

  // MCP Tokens
-  'admin.tabs.mcpTokens': 'MCP 令牌',
-  'admin.mcpTokens.title': 'MCP 令牌',
-  'admin.mcpTokens.subtitle': '管理所有使用者的 API 令牌',
+  'admin.tabs.mcpTokens': 'MCP 存取',
+  'admin.mcpTokens.title': 'MCP 存取',
+  'admin.mcpTokens.subtitle': '管理所有使用者的 OAuth 工作階段和 API 令牌',
+  'admin.mcpTokens.sectionTitle': 'API 令牌',
  'admin.mcpTokens.owner': '所有者',
  'admin.mcpTokens.tokenName': '令牌名稱',
  'admin.mcpTokens.created': '建立時間',
@@ -545,6 +627,17 @@ const zhTw: Record<string, string> = {
  'admin.mcpTokens.deleteSuccess': '令牌已刪除',
  'admin.mcpTokens.deleteError': '刪除令牌失敗',
  'admin.mcpTokens.loadError': '載入令牌失敗',
+  'admin.oauthSessions.sectionTitle': 'OAuth 工作階段',
+  'admin.oauthSessions.clientName': '客戶端',
+  'admin.oauthSessions.owner': '所有者',
+  'admin.oauthSessions.scopes': '權限範圍',
+  'admin.oauthSessions.created': '建立時間',
+  'admin.oauthSessions.empty': '目前沒有活躍的 OAuth 工作階段',
+  'admin.oauthSessions.revokeTitle': '撤銷工作階段',
+  'admin.oauthSessions.revokeMessage': '此 OAuth 工作階段將立即被撤銷。客戶端將失去 MCP 存取權限。',
+  'admin.oauthSessions.revokeSuccess': '工作階段已撤銷',
+  'admin.oauthSessions.revokeError': '撤銷工作階段失敗',
+  'admin.oauthSessions.loadError': '載入 OAuth 工作階段失敗',

  // GitHub
  'admin.tabs.github': 'GitHub',
@@ -724,8 +817,10 @@ const zhTw: Record<string, string> = {
  'atlas.unmark': '移除',
  'atlas.confirmMark': '將此國家標記為已訪問？',
  'atlas.confirmUnmark': '從已訪問列表中移除此國家？',
+  'atlas.confirmUnmarkRegion': '從已訪問列表中移除此地區？',
  'atlas.markVisited': '標記為已訪問',
  'atlas.markVisitedHint': '將此國家新增到已訪問列表',
+  'atlas.markRegionVisitedHint': '將此地區新增到已訪問列表',
  'atlas.addToBucket': '新增到心願單',
  'atlas.addPoi': '新增地點',
  'atlas.searchCountry': '搜尋國家...',
@@ -739,6 +834,8 @@ const zhTw: Record<string, string> = {
  'trip.tabs.reservationsShort': '預訂',
  'trip.tabs.packing': '行李清單',
  'trip.tabs.packingShort': '行李',
+  'trip.tabs.lists': '清單',
+  'trip.tabs.listsShort': '清單',
  'trip.tabs.budget': '預算',
  'trip.tabs.files': '檔案',
  'trip.loading': '載入旅行中...',
@@ -933,6 +1030,32 @@ const zhTw: Record<string, string> = {
  'reservations.linkAssignment': '關聯日程分配',
  'reservations.pickAssignment': '從計劃中選擇一個分配...',
  'reservations.noAssignment': '無關聯（獨立）',
+  'reservations.price': '價格',
+  'reservations.budgetCategory': '預算分類',
+  'reservations.budgetCategoryPlaceholder': '如：交通、住宿',
+  'reservations.budgetCategoryAuto': '自動（依預訂類型）',
+  'reservations.budgetHint': '儲存時將自動建立預算條目。',
+  'reservations.departureDate': '出發日期',
+  'reservations.arrivalDate': '到達日期',
+  'reservations.departureTime': '出發時間',
+  'reservations.arrivalTime': '到達時間',
+  'reservations.pickupDate': '取車日期',
+  'reservations.returnDate': '還車日期',
+  'reservations.pickupTime': '取車時間',
+  'reservations.returnTime': '還車時間',
+  'reservations.endDate': '結束日期',
+  'reservations.meta.departureTimezone': '出發時區',
+  'reservations.meta.arrivalTimezone': '到達時區',
+  'reservations.span.departure': '出發',
+  'reservations.span.arrival': '到達',
+  'reservations.span.inTransit': '途中',
+  'reservations.span.pickup': '取車',
+  'reservations.span.return': '還車',
+  'reservations.span.active': '進行中',
+  'reservations.span.start': '開始',
+  'reservations.span.end': '結束',
+  'reservations.span.ongoing': '進行中',
+  'reservations.validation.endBeforeStart': '結束日期/時間必須晚於開始日期/時間',

  // Budget
  'budget.title': '預算',
@@ -959,6 +1082,7 @@ const zhTw: Record<string, string> = {
  'budget.totalBudget': '總預算',
  'budget.byCategory': '按分類',
  'budget.editTooltip': '點選編輯',
+  'budget.linkedToReservation': '已連結至預訂——請在那裡編輯名稱',
  'budget.confirm.deleteCategory': '確定刪除分類「{name}」及其 {count} 個條目？',
  'budget.deleteCategory': '刪除分類',
  'budget.perPerson': '人均',
@@ -1049,6 +1173,7 @@ const zhTw: Record<string, string> = {
  'packing.menuCheckAll': '全部勾選',
  'packing.menuUncheckAll': '取消全部勾選',
  'packing.menuDeleteCat': '刪除分類',
+  'packing.assignUser': '指派使用者',
  'packing.addItem': '新增物品',
  'packing.addItemPlaceholder': '物品名稱...',
  'packing.addCategory': '新增分類',
@@ -1057,7 +1182,9 @@ const zhTw: Record<string, string> = {
  'packing.template': '模板',
  'packing.templateApplied': '已從模板新增 {count} 個物品',
  'packing.templateError': '應用模板失敗',
-  'packing.assignUser': '分配使用者',
+  'packing.saveAsTemplate': '儲存為範本',
+  'packing.templateName': '範本名稱',
+  'packing.templateSaved': '行李清單已儲存為範本',
  'packing.noMembers': '無成員',
  'packing.bags': '行李',
  'packing.noBag': '未分配',
@@ -1330,11 +1457,12 @@ const zhTw: Record<string, string> = {

  // Memories / Immich
  'memories.title': '照片',
-  'memories.notConnected': 'Immich 未連線',
-  'memories.notConnectedHint': '在設定中連線您的 Immich 例項以在此檢視旅行照片。',
+  'memories.notConnected': '{provider_name} 未連線',
+  'memories.notConnectedHint': '在設定中連線您的 {provider_name} 例項以在此旅行中新增照片。',
+  'memories.notConnectedMultipleHint': '在設定中連線以下任一照片提供商：{provider_names} 以在此旅行中新增照片。',
  'memories.noDates': '為旅行新增日期以載入照片。',
  'memories.noPhotos': '未找到照片',
-  'memories.noPhotosHint': 'Immich 中未找到此旅行日期範圍內的照片。',
+  'memories.noPhotosHint': '{provider_name} 中未找到此旅行日期範圍內的照片。',
  'memories.photosFound': '張照片',
  'memories.fromOthers': '來自他人',
  'memories.sharePhotos': '分享照片',
@@ -1342,26 +1470,35 @@ const zhTw: Record<string, string> = {
  'memories.reviewTitle': '審查您的照片',
  'memories.reviewHint': '點選照片以將其從分享中排除。',
  'memories.shareCount': '分享 {count} 張照片',
-  'memories.immichUrl': 'Immich 伺服器地址',
-  'memories.immichApiKey': 'API 金鑰',
+  'memories.providerUrl': '伺服器 URL',
+  'memories.providerApiKey': 'API 金鑰',
+  'memories.providerUsername': '使用者名稱',
+  'memories.providerPassword': '密碼',
+  'memories.providerOTP': 'MFA 驗證碼（如已啟用）',
+  'memories.skipSSLVerification': '跳過 SSL 憑證驗證',
+  'memories.providerUrlHintSynology': '在網址中包含照片應用程式路徑，例如 https://nas:5001/photo',
  'memories.testConnection': '測試連線',
  'memories.testFirst': '請先測試連線',
  'memories.connected': '已連線',
  'memories.disconnected': '未連線',
-  'memories.connectionSuccess': '已連線到 Immich',
-  'memories.connectionError': '無法連線到 Immich',
-  'memories.saved': 'Immich 設定已儲存',
+  'memories.connectionSuccess': '已連線到 {provider_name}',
+  'memories.connectionError': '無法連線到 {provider_name}',
+  'memories.saved': '{provider_name} 設定已儲存',
+  'memories.providerDisconnectedBanner': '您與 {provider_name} 的連線已中斷。請在設定中重新連線以查看照片。',
+  'memories.saveError': '無法儲存 {provider_name} 設定',
  'memories.oldest': '最早優先',
  'memories.newest': '最新優先',
  'memories.allLocations': '所有地點',
  'memories.addPhotos': '新增照片',
  'memories.linkAlbum': '關聯相簿',
-  'memories.selectAlbum': '選擇 Immich 相簿',
+  'memories.selectAlbum': '選擇 {provider_name} 相簿',
+  'memories.selectAlbumMultiple': '選擇相簿',
  'memories.noAlbums': '未找到相簿',
  'memories.syncAlbum': '同步相簿',
  'memories.unlinkAlbum': '取消關聯',
  'memories.photos': '張照片',
-  'memories.selectPhotos': '從 Immich 選擇照片',
+  'memories.selectPhotos': '從 {provider_name} 選擇照片',
+  'memories.selectPhotosMultiple': '選擇照片',
  'memories.selectHint': '點選照片以選擇。',
  'memories.selected': '已選擇',
  'memories.addSelected': '新增 {count} 張照片',
@@ -1505,6 +1642,40 @@ const zhTw: Record<string, string> = {
  'undo.importGpx': 'GPX 匯入',
  'undo.importGoogleList': 'Google 地圖匯入',

+  // Todo
+  'todo.subtab.packing': '行李清單',
+  'todo.subtab.todo': '待辦事項',
+  'todo.completed': '已完成',
+  'todo.filter.all': '全部',
+  'todo.filter.open': '未完成',
+  'todo.filter.done': '已完成',
+  'todo.uncategorized': '未分類',
+  'todo.namePlaceholder': '任務名稱',
+  'todo.descriptionPlaceholder': '說明（可選）',
+  'todo.unassigned': '未指派',
+  'todo.noCategory': '無分類',
+  'todo.hasDescription': '有說明',
+  'todo.addItem': '新增任務...',
+  'todo.newCategory': '分類名稱',
+  'todo.addCategory': '新增分類',
+  'todo.newItem': '新任務',
+  'todo.empty': '尚無任務。新增任務以開始！',
+  'todo.filter.my': '我的任務',
+  'todo.filter.overdue': '已逾期',
+  'todo.sidebar.tasks': '任務',
+  'todo.sidebar.categories': '分類',
+  'todo.detail.title': '任務',
+  'todo.detail.description': '說明',
+  'todo.detail.category': '分類',
+  'todo.detail.dueDate': '到期日',
+  'todo.detail.assignedTo': '指派給',
+  'todo.detail.delete': '刪除',
+  'todo.detail.save': '儲存變更',
+  'todo.sortByPrio': '優先順序',
+  'todo.detail.priority': '優先順序',
+  'todo.detail.noPriority': '無',
+  'todo.detail.create': '建立任務',
+
  // Notifications
  'notifications.title': '通知',
  'notifications.markAllRead': '全部標為已讀',
@@ -1518,6 +1689,8 @@ const zhTw: Record<string, string> = {
  'notifications.markUnread': '標為未讀',
  'notifications.delete': '刪除',
  'notifications.system': '系統',
+  'notifications.synologySessionCleared.title': 'Synology Photos 已斷線',
+  'notifications.synologySessionCleared.text': '您的伺服器或帳號已更改 — 請前往設定重新測試連線。',
  'memories.error.loadAlbums': '載入相簿失敗',
  'memories.error.linkAlbum': '關聯相簿失敗',
  'memories.error.unlinkAlbum': '取消關聯相簿失敗',
@@ -1906,6 +2079,39 @@ const zhTw: Record<string, string> = {
  'notif.action.view_photos': '查看照片',
  'notif.action.view_vacay': '查看 Vacay',
  'notif.action.view_admin': '前往管理',
+  'notifications.versionAvailable.title': '有可用更新',
+  'notifications.versionAvailable.text': 'TREK {version} 現已推出。',
+  'notifications.versionAvailable.button': '查看詳情',
+
+  // Notifications — dev test events
+  'notif.test.title': '[測試] 通知',
+  'notif.test.simple.text': '這是一條簡單的測試通知。',
+  'notif.test.boolean.text': '您接受此測試通知嗎？',
+  'notif.test.navigate.text': '點選下方前往儀表板。',
+
+  // Notifications
+  'notif.trip_invite.title': '行程邀請',
+  'notif.trip_invite.text': '{actor} 邀請您加入 {trip}',
+  'notif.booking_change.title': '預訂已更新',
+  'notif.booking_change.text': '{actor} 已更新 {trip} 中的預訂',
+  'notif.trip_reminder.title': '行程提醒',
+  'notif.trip_reminder.text': '您的行程 {trip} 即將開始！',
+  'notif.vacay_invite.title': 'Vacay 合併邀請',
+  'notif.vacay_invite.text': '{actor} 邀請您合併假期計畫',
+  'notif.photos_shared.title': '已分享照片',
+  'notif.photos_shared.text': '{actor} 在 {trip} 中分享了 {count} 張照片',
+  'notif.collab_message.title': '新訊息',
+  'notif.collab_message.text': '{actor} 在 {trip} 中傳送了訊息',
+  'notif.packing_tagged.title': '行李指派',
+  'notif.packing_tagged.text': '{actor} 在 {trip} 中將您指派至 {category}',
+  'notif.version_available.title': '有新版本可用',
+  'notif.version_available.text': 'TREK {version} 現已推出',
+  'notif.action.view_trip': '查看行程',
+  'notif.action.view_collab': '查看訊息',
+  'notif.action.view_packing': '查看行李',
+  'notif.action.view_photos': '查看照片',
+  'notif.action.view_vacay': '查看 Vacay',
+  'notif.action.view_admin': '前往管理員',
  'notif.action.view': '查看',
  'notif.action.accept': '接受',
  'notif.action.decline': '拒絕',
@@ -1913,6 +2119,70 @@ const zhTw: Record<string, string> = {
  'notif.generic.text': '你有一則新通知',
  'notif.dev.unknown_event.title': '[DEV] 未知事件',
  'notif.dev.unknown_event.text': '事件類型「{event}」未在 EVENT_NOTIFICATION_CONFIG 中註冊',
+
+  // OAuth scope groups
+  'oauth.scope.group.trips': '行程',
+  'oauth.scope.group.places': '地點',
+  'oauth.scope.group.atlas': 'Atlas',
+  'oauth.scope.group.packing': '行李',
+  'oauth.scope.group.todos': '待辦事項',
+  'oauth.scope.group.budget': '預算',
+  'oauth.scope.group.reservations': '預訂',
+  'oauth.scope.group.collab': '協作',
+  'oauth.scope.group.notifications': '通知',
+  'oauth.scope.group.vacay': '假期',
+  'oauth.scope.group.geo': 'Geo',
+  'oauth.scope.group.weather': '天氣',
+
+  // OAuth scope labels & descriptions
+  'oauth.scope.trips:read.label': '檢視行程與旅遊計畫',
+  'oauth.scope.trips:read.description': '讀取行程、天數、每日筆記及成員',
+  'oauth.scope.trips:write.label': '編輯行程與旅遊計畫',
+  'oauth.scope.trips:write.description': '建立及更新行程、天數、筆記並管理成員',
+  'oauth.scope.trips:delete.label': '刪除行程',
+  'oauth.scope.trips:delete.description': '永久刪除整個行程——此操作無法復原',
+  'oauth.scope.trips:share.label': '管理分享連結',
+  'oauth.scope.trips:share.description': '建立、更新及撤銷行程的公開分享連結',
+  'oauth.scope.places:read.label': '檢視地點與地圖資料',
+  'oauth.scope.places:read.description': '讀取地點、每日指派、標籤及類別',
+  'oauth.scope.places:write.label': '管理地點',
+  'oauth.scope.places:write.description': '建立、更新及刪除地點、指派及標籤',
+  'oauth.scope.atlas:read.label': '檢視 Atlas',
+  'oauth.scope.atlas:read.description': '讀取已造訪的國家、地區及願望清單',
+  'oauth.scope.atlas:write.label': '管理 Atlas',
+  'oauth.scope.atlas:write.description': '標記已造訪的國家及地區，管理願望清單',
+  'oauth.scope.packing:read.label': '檢視行李清單',
+  'oauth.scope.packing:read.description': '讀取行李物品、行李袋及類別負責人',
+  'oauth.scope.packing:write.label': '管理行李清單',
+  'oauth.scope.packing:write.description': '新增、更新、刪除、勾選及重新排序行李物品和行李袋',
+  'oauth.scope.todos:read.label': '檢視待辦清單',
+  'oauth.scope.todos:read.description': '讀取行程待辦事項及類別負責人',
+  'oauth.scope.todos:write.label': '管理待辦清單',
+  'oauth.scope.todos:write.description': '建立、更新、勾選、刪除及重新排序待辦事項',
+  'oauth.scope.budget:read.label': '檢視預算',
+  'oauth.scope.budget:read.description': '讀取預算項目及費用明細',
+  'oauth.scope.budget:write.label': '管理預算',
+  'oauth.scope.budget:write.description': '建立、更新及刪除預算項目',
+  'oauth.scope.reservations:read.label': '檢視預訂',
+  'oauth.scope.reservations:read.description': '讀取預訂及住宿詳情',
+  'oauth.scope.reservations:write.label': '管理預訂',
+  'oauth.scope.reservations:write.description': '建立、更新、刪除及重新排序預訂',
+  'oauth.scope.collab:read.label': '檢視協作',
+  'oauth.scope.collab:read.description': '讀取協作筆記、投票及訊息',
+  'oauth.scope.collab:write.label': '管理協作',
+  'oauth.scope.collab:write.description': '建立、更新及刪除協作筆記、投票及訊息',
+  'oauth.scope.notifications:read.label': '檢視通知',
+  'oauth.scope.notifications:read.description': '讀取應用程式通知及未讀數量',
+  'oauth.scope.notifications:write.label': '管理通知',
+  'oauth.scope.notifications:write.description': '將通知標為已讀並回覆',
+  'oauth.scope.vacay:read.label': '檢視假期計畫',
+  'oauth.scope.vacay:read.description': '讀取假期計畫資料、項目及統計',
+  'oauth.scope.vacay:write.label': '管理假期計畫',
+  'oauth.scope.vacay:write.description': '建立及管理假期項目、節假日及團隊計畫',
+  'oauth.scope.geo:read.label': '地圖與地理編碼',
+  'oauth.scope.geo:read.description': '搜尋地點、解析地圖 URL 及反向地理編碼坐標',
+  'oauth.scope.weather:read.label': '天氣預報',
+  'oauth.scope.weather:read.description': '取得行程地點及日期的天氣預報',
 }

 export default zhTw
@@ -321,7 +321,7 @@ describe('AdminPage', () => {

      await waitFor(() => expect(screen.getByRole('button', { name: /^users$/i })).toBeInTheDocument());

-      expect(screen.queryByRole('button', { name: /mcp tokens/i })).not.toBeInTheDocument();
+      expect(screen.queryByRole('button', { name: /mcp access/i })).not.toBeInTheDocument();
    });

    it('shows MCP Tokens tab button when MCP addon is enabled', async () => {
@@ -337,7 +337,7 @@ describe('AdminPage', () => {
      render(<AdminPage />);

      await waitFor(() => {
-        expect(screen.getByRole('button', { name: /mcp tokens/i })).toBeInTheDocument();
+        expect(screen.getByRole('button', { name: /mcp access/i })).toBeInTheDocument();
      });
    });
  });
@@ -646,9 +646,9 @@ describe('AdminPage', () => {
      seedStore(useAuthStore, { isAuthenticated: true, user: buildAdmin() });
      render(<AdminPage />);

-      await waitFor(() => expect(screen.getByRole('button', { name: /mcp tokens/i })).toBeInTheDocument());
+      await waitFor(() => expect(screen.getByRole('button', { name: /mcp access/i })).toBeInTheDocument());

-      fireEvent.click(screen.getByRole('button', { name: /mcp tokens/i }));
+      fireEvent.click(screen.getByRole('button', { name: /mcp access/i }));

      expect(screen.getByTestId('mcp-tokens-panel')).toBeInTheDocument();
    });
@@ -18,6 +18,12 @@ beforeEach(() => {
  seedStore(usePermissionsStore, {
    level: 'owner',
  } as any);
+  // Intercept CurrencyWidget's external fetch so it resolves before teardown
+  server.use(
+    http.get('https://api.exchangerate-api.com/v4/latest/:currency', () => {
+      return HttpResponse.json({ rates: { USD: 1.08, EUR: 1, CHF: 0.97 } });
+    }),
+  );
 });

 describe('DashboardPage', () => {
@@ -0,0 +1,199 @@
+// FE-PAGE-OAUTH-001 to FE-PAGE-OAUTH-012
+import { render, screen, waitFor } from '../../tests/helpers/render';
+import userEvent from '@testing-library/user-event';
+import { http, HttpResponse } from 'msw';
+import { server } from '../../tests/helpers/msw/server';
+import { useAuthStore } from '../store/authStore';
+import { resetAllStores, seedStore } from '../../tests/helpers/store';
+import { buildUser } from '../../tests/helpers/factories';
+import OAuthAuthorizePage from './OAuthAuthorizePage';
+
+// Default OAuth query params
+const DEFAULT_SEARCH = '?client_id=test-client&redirect_uri=http%3A%2F%2Flocalhost%3A4000%2Fcallback&scope=trips%3Aread&state=abc&code_challenge=challenge&code_challenge_method=S256';
+
+function setSearchParams(search: string) {
+  window.history.pushState({}, '', '/oauth/authorize' + search);
+}
+
+const VALIDATE_OK = {
+  valid: true,
+  client: { name: 'Test App', allowed_scopes: ['trips:read'] },
+  scopes: ['trips:read'],
+  consentRequired: true,
+  loginRequired: false,
+  scopeSelectable: false,
+};
+
+beforeEach(() => {
+  resetAllStores();
+  setSearchParams(DEFAULT_SEARCH);
+  server.resetHandlers();
+  // Default: authenticated user
+  seedStore(useAuthStore, { user: buildUser(), isAuthenticated: true, isLoading: false });
+  // Default validate: consent required
+  server.use(
+    http.get('/api/oauth/authorize/validate', () => HttpResponse.json(VALIDATE_OK)),
+    http.post('/api/oauth/authorize', () =>
+      HttpResponse.json({ redirect: 'http://localhost:4000/callback?code=abc' })
+    ),
+  );
+});
+
+afterEach(() => {
+  window.history.pushState({}, '', '/');
+});
+
+describe('OAuthAuthorizePage', () => {
+  it('FE-PAGE-OAUTH-001: shows loading spinner initially', () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', async () => {
+        await new Promise(() => {}); // never resolves
+        return HttpResponse.json(VALIDATE_OK);
+      })
+    );
+    render(<OAuthAuthorizePage />);
+    expect(document.querySelector('.animate-spin')).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-002: shows error state when validation fails', async () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({
+          valid: false,
+          error: 'invalid_client',
+          error_description: 'Unknown client ID',
+        })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Authorization Error');
+    expect(screen.getByText('Unknown client ID')).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-003: shows error state on network error', async () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({ error: 'server error' }, { status: 500 })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Authorization Error');
+    expect(screen.getByText(/Failed to validate/i)).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-004: shows login_required state', async () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({ ...VALIDATE_OK, loginRequired: true, consentRequired: true })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Sign in to continue');
+    expect(screen.getByText('Sign in to TREK')).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-005: shows client name in login_required state', async () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({ ...VALIDATE_OK, loginRequired: true })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Sign in to continue');
+    expect(screen.getByText(/Test App/)).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-006: shows consent form with client name and scope list', async () => {
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Test App');
+    expect(screen.getByText('Authorization Request')).toBeInTheDocument();
+    expect(screen.getByText('Approve Access')).toBeInTheDocument();
+    expect(screen.getByText('Deny')).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-007: auto-approves when consentRequired is false', async () => {
+    let authorizeCalled = false;
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({ ...VALIDATE_OK, consentRequired: false })
+      ),
+      http.post('/api/oauth/authorize', async ({ request }) => {
+        const body = await request.json() as Record<string, unknown>;
+        authorizeCalled = true;
+        expect(body.approved).toBe(true);
+        return HttpResponse.json({ redirect: 'http://localhost:4000/callback?code=xyz' });
+      })
+    );
+    render(<OAuthAuthorizePage />);
+    // Shows auto-approving spinner
+    await waitFor(() => {
+      expect(authorizeCalled).toBe(true);
+    });
+  });
+
+  it('FE-PAGE-OAUTH-008: clicking Deny sends approved=false to authorize', async () => {
+    const user = userEvent.setup();
+    let body: Record<string, unknown> = {};
+    server.use(
+      http.post('/api/oauth/authorize', async ({ request }) => {
+        body = await request.json() as Record<string, unknown>;
+        return HttpResponse.json({ redirect: 'http://localhost:4000/callback?error=access_denied' });
+      })
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Deny');
+    await user.click(screen.getByText('Deny'));
+    await waitFor(() => {
+      expect(body.approved).toBe(false);
+    });
+  });
+
+  it('FE-PAGE-OAUTH-009: clicking Approve sends approved=true with selected scopes', async () => {
+    const user = userEvent.setup();
+    let body: Record<string, unknown> = {};
+    server.use(
+      http.post('/api/oauth/authorize', async ({ request }) => {
+        body = await request.json() as Record<string, unknown>;
+        return HttpResponse.json({ redirect: 'http://localhost:4000/callback?code=ok' });
+      })
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Approve Access');
+    await user.click(screen.getByText('Approve Access'));
+    await waitFor(() => {
+      expect(body.approved).toBe(true);
+    });
+  });
+
+  it('FE-PAGE-OAUTH-010: shows error when authorize call fails', async () => {
+    const user = userEvent.setup();
+    server.use(
+      http.post('/api/oauth/authorize', () =>
+        HttpResponse.json({ error: 'server error' }, { status: 500 })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Approve Access');
+    await user.click(screen.getByText('Approve Access'));
+    await screen.findByText('Authorization Error');
+    expect(screen.getByText(/Authorization failed/i)).toBeInTheDocument();
+  });
+
+  it('FE-PAGE-OAUTH-011: scopeSelectable=true renders checkboxes for scopes', async () => {
+    server.use(
+      http.get('/api/oauth/authorize/validate', () =>
+        HttpResponse.json({ ...VALIDATE_OK, scopeSelectable: true, scopes: ['trips:read', 'places:read'] })
+      )
+    );
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Choose which permissions to grant');
+    expect(screen.getAllByRole('checkbox').length).toBeGreaterThan(0);
+  });
+
+  it('FE-PAGE-OAUTH-012: scopeSelectable=false renders read-only scope list', async () => {
+    render(<OAuthAuthorizePage />);
+    await screen.findByText('Permissions requested');
+    // No checkboxes in read-only mode
+    expect(screen.queryAllByRole('checkbox')).toHaveLength(0);
+  });
+});
@@ -0,0 +1,356 @@
+import React, { useEffect, useState } from 'react'
+import { useAuthStore } from '../store/authStore'
+import { oauthApi } from '../api/client'
+import { SCOPE_GROUPS } from '../api/oauthScopes'
+import { Lock, ShieldCheck, AlertTriangle, Loader2, LogIn } from 'lucide-react'
+import { useTranslation } from '../i18n'
+
+interface ValidateResult {
+  valid: boolean
+  error?: string
+  error_description?: string
+  client?: { name: string; allowed_scopes: string[] }
+  scopes?: string[]
+  consentRequired?: boolean
+  loginRequired?: boolean
+  scopeSelectable?: boolean
+}
+
+type PageState = 'loading' | 'login_required' | 'consent' | 'auto_approving' | 'error' | 'done'
+
+export default function OAuthAuthorizePage(): React.ReactElement {
+  const { t } = useTranslation()
+  const { isAuthenticated, isLoading: authLoading, loadUser } = useAuthStore()
+  const [pageState, setPageState] = useState<PageState>('loading')
+  const [validation, setValidation] = useState<ValidateResult | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+  const [errorMsg, setErrorMsg] = useState<string | null>(null)
+  const [selectedScopes, setSelectedScopes] = useState<string[]>([])
+
+  const params = new URLSearchParams(window.location.search)
+  const clientId       = params.get('client_id') || ''
+  const redirectUri    = params.get('redirect_uri') || ''
+  const scope          = params.get('scope') || ''
+  const state          = params.get('state') || ''
+  const codeChallenge  = params.get('code_challenge') || ''
+  const ccMethod       = params.get('code_challenge_method') || ''
+
+  // Load auth state once, then validate
+  useEffect(() => {
+    loadUser({ silent: true }).catch(() => {})
+  }, [loadUser])
+
+  useEffect(() => {
+    if (authLoading) return
+    validateRequest()
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [authLoading, isAuthenticated])
+
+  async function validateRequest() {
+    setPageState('loading')
+    try {
+      const result = await oauthApi.validate({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        scope,
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: ccMethod,
+        response_type: 'code',
+      })
+      setValidation(result)
+
+      if (!result.valid) {
+        setPageState('error')
+        setErrorMsg(result.error_description || result.error || 'Invalid authorization request')
+        return
+      }
+
+      if (result.loginRequired) {
+        setPageState('login_required')
+        return
+      }
+
+      if (!result.consentRequired) {
+        // Consent already on record — auto-approve silently with the full validated scope
+        setPageState('auto_approving')
+        await submitConsent(true, result.scopes ?? [])
+        return
+      }
+
+      // Pre-select all scopes the client is requesting — user can deselect
+      setSelectedScopes(result.scopes ?? [])
+      setPageState('consent')
+    } catch (err: unknown) {
+      setPageState('error')
+      setErrorMsg('Failed to validate authorization request. Please try again.')
+    }
+  }
+
+  async function submitConsent(approved: boolean, scopes: string[] = selectedScopes) {
+    setSubmitting(true)
+    try {
+      const result = await oauthApi.authorize({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        // When approving, send only the scopes the user selected; deny uses original scope
+        scope: approved ? scopes.join(' ') : scope,
+        state,
+        code_challenge: codeChallenge,
+        code_challenge_method: ccMethod,
+        approved,
+      })
+      setPageState('done')
+      window.location.href = result.redirect
+    } catch {
+      setPageState('error')
+      setErrorMsg('Authorization failed. Please try again.')
+      setSubmitting(false)
+    }
+  }
+
+  function toggleScope(s: string) {
+    setSelectedScopes(prev =>
+      prev.includes(s) ? prev.filter(x => x !== s) : [...prev, s]
+    )
+  }
+
+  function toggleGroup(groupScopes: string[], allSelected: boolean) {
+    setSelectedScopes(prev =>
+      allSelected
+        ? prev.filter(s => !groupScopes.includes(s))
+        : [...new Set([...prev, ...groupScopes])]
+    )
+  }
+
+  function handleLoginRedirect() {
+    const next = '/oauth/authorize?' + params.toString()
+    window.location.href = '/login?redirect=' + encodeURIComponent(next)
+  }
+
+  // Group requested scopes by their translated group name
+  const scopesByGroup = React.useMemo(() => {
+    const requested = validation?.scopes || []
+    const groups: Record<string, string[]> = {}
+    for (const s of requested) {
+      const keys = SCOPE_GROUPS[s]
+      const group = keys ? t(keys.groupKey) : 'Other'
+      if (!groups[group]) groups[group] = []
+      groups[group].push(s)
+    }
+    return groups
+  }, [validation, t])
+
+  // ---- Render states ----
+
+  if (pageState === 'loading' || pageState === 'auto_approving') {
+    return (
+      <div className="min-h-screen flex items-center justify-center" style={{ background: 'var(--bg-primary)' }}>
+        <div className="flex flex-col items-center gap-3">
+          <Loader2 className="w-8 h-8 animate-spin" style={{ color: 'var(--accent-primary, #4f46e5)' }} />
+          <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>
+            {pageState === 'auto_approving' ? 'Authorizing…' : 'Loading…'}
+          </p>
+        </div>
+      </div>
+    )
+  }
+
+  if (pageState === 'error') {
+    return (
+      <div className="min-h-screen flex items-center justify-center p-4" style={{ background: 'var(--bg-primary)' }}>
+        <div className="w-full max-w-sm rounded-xl shadow-lg p-8 space-y-4 text-center" style={{ background: 'var(--bg-card)' }}>
+          <AlertTriangle className="w-10 h-10 mx-auto text-red-500" />
+          <h1 className="text-xl font-semibold" style={{ color: 'var(--text-primary)' }}>Authorization Error</h1>
+          <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>{errorMsg}</p>
+        </div>
+      </div>
+    )
+  }
+
+  if (pageState === 'login_required') {
+    return (
+      <div className="min-h-screen flex items-center justify-center p-4" style={{ background: 'var(--bg-primary)' }}>
+        <div className="w-full max-w-sm rounded-xl shadow-lg p-8 space-y-5" style={{ background: 'var(--bg-card)' }}>
+          <div className="text-center space-y-2">
+            <Lock className="w-10 h-10 mx-auto" style={{ color: 'var(--accent-primary, #4f46e5)' }} />
+            <h1 className="text-xl font-semibold" style={{ color: 'var(--text-primary)' }}>Sign in to continue</h1>
+            <p className="text-sm" style={{ color: 'var(--text-secondary)' }}>
+              <strong>{validation?.client?.name || clientId}</strong> wants access to your TREK account. Please sign in first.
+            </p>
+          </div>
+          <button
+            onClick={handleLoginRedirect}
+            className="w-full flex items-center justify-center gap-2 px-4 py-2.5 rounded-lg text-sm font-medium text-white"
+            style={{ background: 'var(--accent-primary, #4f46e5)' }}>
+            <LogIn className="w-4 h-4" />
+            Sign in to TREK
+          </button>
+        </div>
+      </div>
+    )
+  }
+
+  // pageState === 'consent'
+  return (
+    <div className="min-h-screen flex items-center justify-center p-4" style={{ background: 'var(--bg-primary)' }}>
+      <div className="w-full max-w-2xl rounded-xl shadow-lg overflow-hidden flex flex-col sm:flex-row" style={{ background: 'var(--bg-card)' }}>
+
+        {/* Left panel — app identity + actions */}
+        <div className="sm:w-64 sm:flex-shrink-0 flex flex-col px-8 py-8 sm:border-r" style={{ borderColor: 'var(--border-primary)' }}>
+          <div className="flex-1 space-y-4">
+            <div className="w-12 h-12 rounded-full flex items-center justify-center" style={{ background: 'var(--bg-secondary)' }}>
+              <ShieldCheck className="w-6 h-6" style={{ color: 'var(--accent-primary, #4f46e5)' }} />
+            </div>
+            <div>
+              <p className="text-xs font-medium uppercase tracking-wide mb-1" style={{ color: 'var(--text-tertiary)' }}>Authorization Request</p>
+              <h1 className="text-lg font-semibold leading-snug" style={{ color: 'var(--text-primary)' }}>
+                {validation?.client?.name || clientId}
+              </h1>
+              <p className="text-sm mt-2" style={{ color: 'var(--text-secondary)' }}>
+                This application is requesting access to your TREK account.
+              </p>
+            </div>
+          </div>
+
+          <div className="mt-8 space-y-2">
+            <p className="text-xs mb-3" style={{ color: 'var(--text-tertiary)' }}>
+              Only grant access to applications you trust. Your data stays on your server.
+            </p>
+            <button
+              onClick={() => submitConsent(true)}
+              disabled={submitting || (validation?.scopeSelectable === true && selectedScopes.length === 0)}
+              className="w-full px-4 py-2.5 rounded-lg text-sm font-medium text-white disabled:opacity-60 transition-opacity"
+              style={{ background: 'var(--accent-primary, #4f46e5)' }}>
+              {submitting
+                ? 'Authorizing…'
+                : validation?.scopeSelectable && selectedScopes.length === 0
+                  ? 'Select at least one scope'
+                  : validation?.scopeSelectable
+                    ? `Approve (${selectedScopes.length} scope${selectedScopes.length !== 1 ? 's' : ''})`
+                    : 'Approve Access'}
+            </button>
+            <button
+              onClick={() => submitConsent(false)}
+              disabled={submitting}
+              className="w-full px-4 py-2.5 rounded-lg text-sm font-medium border transition-colors hover:bg-slate-50 dark:hover:bg-slate-800 disabled:opacity-60"
+              style={{ borderColor: 'var(--border-primary)', color: 'var(--text-secondary)' }}>
+              Deny
+            </button>
+          </div>
+        </div>
+
+        {/* Right panel — selectable scopes */}
+        <div className="flex-1 px-6 py-8 overflow-y-auto max-h-[80vh] sm:max-h-[600px]">
+          <div className="space-y-6">
+            {Object.keys(scopesByGroup).length > 0 && (
+              <div>
+                <p className="text-xs font-medium uppercase tracking-wide mb-4" style={{ color: 'var(--text-tertiary)' }}>
+                  {validation?.scopeSelectable ? 'Choose which permissions to grant' : 'Permissions requested'}
+                </p>
+
+                {validation?.scopeSelectable ? (
+                  /* DCR client — user selects which scopes to grant */
+                  <div className="space-y-3">
+                    {Object.entries(scopesByGroup).map(([group, groupScopes]) => {
+                      const allGroupSelected = groupScopes.every(s => selectedScopes.includes(s))
+                      const someGroupSelected = groupScopes.some(s => selectedScopes.includes(s))
+                      return (
+                        <div key={group} className="rounded-lg border overflow-hidden" style={{ borderColor: 'var(--border-primary)' }}>
+                          <label className="flex items-center gap-2.5 px-3 py-2 cursor-pointer" style={{ background: 'var(--bg-secondary)' }}>
+                            <input
+                              type="checkbox"
+                              checked={allGroupSelected}
+                              ref={el => { if (el) el.indeterminate = someGroupSelected && !allGroupSelected }}
+                              onChange={() => toggleGroup(groupScopes, allGroupSelected)}
+                              className="rounded flex-shrink-0"
+                            />
+                            <span className="text-xs font-semibold" style={{ color: 'var(--text-secondary)' }}>{group}</span>
+                            <span className="ml-auto text-xs" style={{ color: 'var(--text-tertiary)' }}>
+                              {groupScopes.filter(s => selectedScopes.includes(s)).length}/{groupScopes.length}
+                            </span>
+                          </label>
+                          <div className="divide-y" style={{ borderColor: 'var(--border-primary)' }}>
+                            {groupScopes.map(s => {
+                              const keys = SCOPE_GROUPS[s]
+                              return (
+                                <label
+                                  key={s}
+                                  className="flex items-start gap-2.5 px-3 py-2 cursor-pointer transition-colors hover:bg-slate-50 dark:hover:bg-slate-800/50">
+                                  <input
+                                    type="checkbox"
+                                    checked={selectedScopes.includes(s)}
+                                    onChange={() => toggleScope(s)}
+                                    className="mt-0.5 rounded flex-shrink-0"
+                                  />
+                                  <span className="mt-0.5 text-base leading-none flex-shrink-0">
+                                    {s.endsWith(':delete') ? '🗑️' : s.endsWith(':write') ? '✏️' : '👁️'}
+                                  </span>
+                                  <div className="min-w-0">
+                                    <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>{keys ? t(keys.labelKey) : s}</p>
+                                    <p className="text-xs mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{keys ? t(keys.descriptionKey) : ''}</p>
+                                  </div>
+                                </label>
+                              )
+                            })}
+                          </div>
+                        </div>
+                      )
+                    })}
+                  </div>
+                ) : (
+                  /* Settings-created client — scopes are fixed, show read-only */
+                  <div className="space-y-5">
+                    {Object.entries(scopesByGroup).map(([group, groupScopes]) => (
+                      <div key={group}>
+                        <p className="text-xs font-semibold mb-2" style={{ color: 'var(--text-secondary)' }}>{group}</p>
+                        <div className="space-y-1.5">
+                          {groupScopes.map(s => {
+                            const keys = SCOPE_GROUPS[s]
+                            return (
+                              <div key={s} className="flex items-start gap-2.5 px-3 py-2 rounded-lg" style={{ background: 'var(--bg-secondary)' }}>
+                                <span className="mt-0.5 text-base leading-none flex-shrink-0">
+                                  {s.endsWith(':delete') ? '🗑️' : s.endsWith(':write') ? '✏️' : '👁️'}
+                                </span>
+                                <div className="min-w-0">
+                                  <p className="text-sm font-medium" style={{ color: 'var(--text-primary)' }}>{keys ? t(keys.labelKey) : s}</p>
+                                  <p className="text-xs mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{keys ? t(keys.descriptionKey) : ''}</p>
+                                </div>
+                              </div>
+                            )
+                          })}
+                        </div>
+                      </div>
+                    ))}
+                  </div>
+                )}
+              </div>
+            )}
+
+            {/* Always-available tools — granted regardless of scopes */}
+            <div>
+              <p className="text-xs font-medium uppercase tracking-wide mb-3" style={{ color: 'var(--text-tertiary)' }}>
+                Always included
+              </p>
+              <div className="space-y-1.5">
+                {[
+                  { name: 'list_trips',       desc: 'List your trips so the AI can discover trip IDs' },
+                  { name: 'get_trip_summary', desc: 'Read a trip overview needed to use any other tool' },
+                ].map(({ name, desc }) => (
+                  <div key={name} className="flex items-start gap-2.5 px-3 py-2 rounded-lg" style={{ background: 'var(--bg-secondary)' }}>
+                    <span className="mt-0.5 text-base leading-none flex-shrink-0">👁️</span>
+                    <div className="min-w-0">
+                      <p className="text-sm font-medium font-mono" style={{ color: 'var(--text-primary)' }}>{name}</p>
+                      <p className="text-xs mt-0.5" style={{ color: 'var(--text-tertiary)' }}>{desc}</p>
+                    </div>
+                  </div>
+                ))}
+              </div>
+            </div>
+          </div>
+        </div>
+
+      </div>
+    </div>
+  )
+}
@@ -65,8 +65,12 @@ vi.mock('../components/Planner/PlacesSidebar', () => ({
  },
 }));

+const capturedPlaceInspectorProps: { current: Record<string, any> } = { current: {} };
 vi.mock('../components/Planner/PlaceInspector', () => ({
-  default: () => null,
+  default: (props: Record<string, any>) => {
+    capturedPlaceInspectorProps.current = props;
+    return React.createElement('div', { 'data-testid': 'place-inspector' });
+  },
 }));

 const capturedDayDetailPanelProps: { current: Record<string, any> } = { current: {} };
@@ -232,6 +236,7 @@ beforeEach(() => {
  capturedTripFormModalProps.current = {};
  capturedTripMembersModalProps.current = {};
  capturedFileManagerProps.current = {};
+  capturedPlaceInspectorProps.current = {};
  seedStore(useAuthStore, { isAuthenticated: true, user: buildUser() });
 });

@@ -1334,6 +1339,166 @@ describe('TripPlannerPage', () => {
    });
  });

+  describe('FE-PAGE-PLANNER-046: Invalid session tab resets to plan', () => {
+    it('resets activeTab to "plan" when saved tab is no longer in TRIP_TABS', async () => {
+      // Save a tab id that requires the "memories" addon (disabled by default)
+      sessionStorage.setItem('trip-tab-42', 'memories');
+      seedTripStore({ id: 42 });
+
+      renderPlannerPage(42);
+
+      // The useEffect should detect the invalid tab and reset it
+      await waitFor(() => {
+        expect(sessionStorage.getItem('trip-tab-42')).toBe('plan');
+      });
+    });
+  });
+
+  describe('FE-PAGE-PLANNER-047: Desktop PlaceInspector onEdit with selectedAssignment', () => {
+    it('calls onEdit on desktop PlaceInspector with selectedAssignmentId to cover if-branch', async () => {
+      vi.useFakeTimers();
+
+      const place = buildPlace({ id: 1, trip_id: 42, lat: 48.8566, lng: 2.3522 });
+      const assignment = buildAssignment({ id: 10, day_id: 99, place, order_index: 0 });
+
+      mockPlaceSelectionState.selectedPlaceId = place.id;
+      mockPlaceSelectionState.selectedAssignmentId = assignment.id;
+
+      seedTripStore({ id: 42 });
+      seedStore(useTripStore, {
+        places: [place],
+        assignments: { '99': [assignment] },
+      } as any);
+
+      renderPlannerPage(42);
+      act(() => { vi.runAllTimers(); });
+      vi.useRealTimers();
+
+      await waitFor(() => {
+        expect(screen.getByTestId('place-inspector')).toBeInTheDocument();
+      });
+
+      // onEdit with selectedAssignmentId set — covers lines 795-798 (if branch)
+      await act(async () => {
+        capturedPlaceInspectorProps.current.onEdit?.();
+      });
+    });
+  });
+
+  describe('FE-PAGE-PLANNER-048: Mobile PlaceInspector portal renders when isMobile is true', () => {
+    it('renders PlaceInspector in mobile portal and covers mobile callbacks', async () => {
+      vi.useFakeTimers();
+
+      // Simulate mobile viewport
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 375 });
+
+      const place = buildPlace({ id: 1, trip_id: 42, lat: 48.8566, lng: 2.3522 });
+
+      mockPlaceSelectionState.selectedPlaceId = place.id;
+
+      seedTripStore({ id: 42 });
+      seedStore(useTripStore, { places: [place] } as any);
+
+      renderPlannerPage(42);
+      act(() => { vi.runAllTimers(); });
+      vi.useRealTimers();
+
+      // Mobile portal renders the PlaceInspector (lines 830-879)
+      await waitFor(() => {
+        expect(screen.getByTestId('place-inspector')).toBeInTheDocument();
+      });
+
+      // onEdit without assignment — covers else branch at line 799
+      await act(async () => {
+        capturedPlaceInspectorProps.current.onEdit?.();
+      });
+
+      // onClose — covers mobile onClose lambda
+      await act(async () => {
+        capturedPlaceInspectorProps.current.onClose?.();
+      });
+
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 1024 });
+    });
+  });
+
+  describe('FE-PAGE-PLANNER-049: Mobile sidebar left panel opens via Plan button', () => {
+    it('clicking the mobile Plan button opens the left sidebar portal (lines 882-893)', async () => {
+      vi.useFakeTimers();
+
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 375 });
+
+      seedTripStore({ id: 42 });
+
+      renderPlannerPage(42);
+      act(() => { vi.runAllTimers(); });
+      vi.useRealTimers();
+
+      await waitFor(() => {
+        expect(screen.getByTestId('day-plan-sidebar')).toBeInTheDocument();
+      });
+
+      // The mobile portal buttons are rendered to document.body.
+      // The "Plan" tab button has title="Plan"; the mobile portal button does not.
+      const mobilePlanBtn = Array.from(document.body.querySelectorAll('button')).find(
+        b => b.textContent === 'Plan' && !b.getAttribute('title'),
+      );
+
+      if (mobilePlanBtn) {
+        await act(async () => { fireEvent.click(mobilePlanBtn); });
+
+        // Mobile sidebar portal renders DayPlanSidebar — now two instances
+        await waitFor(() => {
+          expect(screen.getAllByTestId('day-plan-sidebar').length).toBeGreaterThanOrEqual(2);
+        });
+
+        // Close the mobile sidebar via the X button inside the portal header
+        const closeButtons = Array.from(document.body.querySelectorAll('button')).filter(
+          b => !b.textContent || b.textContent.trim() === '',
+        );
+        if (closeButtons.length > 0) {
+          await act(async () => { fireEvent.click(closeButtons[0]); });
+        }
+      }
+
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 1024 });
+    });
+  });
+
+  describe('FE-PAGE-PLANNER-050: Mobile sidebar right panel opens via Places button', () => {
+    it('clicking the mobile Places button opens the right sidebar portal (lines 894)', async () => {
+      vi.useFakeTimers();
+
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 375 });
+
+      seedTripStore({ id: 42 });
+
+      renderPlannerPage(42);
+      act(() => { vi.runAllTimers(); });
+      vi.useRealTimers();
+
+      await waitFor(() => {
+        expect(screen.getByTestId('places-sidebar')).toBeInTheDocument();
+      });
+
+      // "Places" tab doesn't exist; the mobile portal "Places" button has no title
+      const mobilePlacesBtn = Array.from(document.body.querySelectorAll('button')).find(
+        b => b.textContent === 'Places' && !b.getAttribute('title'),
+      );
+
+      if (mobilePlacesBtn) {
+        await act(async () => { fireEvent.click(mobilePlacesBtn); });
+
+        // PlacesSidebar renders in mobile sidebar portal
+        await waitFor(() => {
+          expect(screen.getAllByTestId('places-sidebar').length).toBeGreaterThanOrEqual(2);
+        });
+      }
+
+      Object.defineProperty(window, 'innerWidth', { writable: true, configurable: true, value: 1024 });
+    });
+  });
+
  describe('FE-PAGE-PLANNER-037: onExpandedDaysChange covers mapPlaces hidden logic', () => {
    it('calls onExpandedDaysChange to trigger mapPlaces hidden set computation', async () => {
      vi.useFakeTimers();
@@ -0,0 +1,177 @@
+// FE-STORE-BUDGET-001 to FE-STORE-BUDGET-011
+import { http, HttpResponse } from 'msw';
+import { server } from '../../../tests/helpers/msw/server';
+import { resetAllStores, seedStore } from '../../../tests/helpers/store';
+import { buildBudgetItem } from '../../../tests/helpers/factories';
+import { useTripStore } from '../tripStore';
+
+beforeEach(() => {
+  resetAllStores();
+  server.resetHandlers();
+});
+
+describe('budgetSlice', () => {
+  it('FE-STORE-BUDGET-001: loadBudgetItems populates store', async () => {
+    const item = buildBudgetItem({ trip_id: 1 });
+    server.use(
+      http.get('/api/trips/1/budget', () =>
+        HttpResponse.json({ items: [item] })
+      )
+    );
+    await useTripStore.getState().loadBudgetItems(1);
+    expect(useTripStore.getState().budgetItems).toHaveLength(1);
+    expect(useTripStore.getState().budgetItems[0].id).toBe(item.id);
+  });
+
+  it('FE-STORE-BUDGET-002: loadBudgetItems swallows errors silently', async () => {
+    server.use(
+      http.get('/api/trips/1/budget', () =>
+        HttpResponse.json({ error: 'server error' }, { status: 500 })
+      )
+    );
+    // Should NOT throw
+    await expect(useTripStore.getState().loadBudgetItems(1)).resolves.toBeUndefined();
+    expect(useTripStore.getState().budgetItems).toEqual([]);
+  });
+
+  it('FE-STORE-BUDGET-003: addBudgetItem appends to store and returns item', async () => {
+    const newItem = buildBudgetItem({ name: 'Hotel', trip_id: 1 });
+    server.use(
+      http.post('/api/trips/1/budget', () =>
+        HttpResponse.json({ item: newItem })
+      )
+    );
+    const result = await useTripStore.getState().addBudgetItem(1, { name: 'Hotel' });
+    expect(result.id).toBe(newItem.id);
+    expect(useTripStore.getState().budgetItems).toContainEqual(newItem);
+  });
+
+  it('FE-STORE-BUDGET-004: addBudgetItem throws on API error', async () => {
+    server.use(
+      http.post('/api/trips/1/budget', () =>
+        HttpResponse.json({ error: 'Validation failed' }, { status: 422 })
+      )
+    );
+    await expect(useTripStore.getState().addBudgetItem(1, {})).rejects.toThrow();
+  });
+
+  it('FE-STORE-BUDGET-005: updateBudgetItem replaces item in store', async () => {
+    const existing = buildBudgetItem({ id: 10, trip_id: 1, name: 'Old' });
+    seedStore(useTripStore, { budgetItems: [existing] });
+
+    const updated = { ...existing, name: 'New' };
+    server.use(
+      http.put('/api/trips/1/budget/10', () =>
+        HttpResponse.json({ item: updated })
+      )
+    );
+    await useTripStore.getState().updateBudgetItem(1, 10, { name: 'New' });
+    const items = useTripStore.getState().budgetItems;
+    expect(items).toHaveLength(1);
+    expect(items[0].name).toBe('New');
+  });
+
+  it('FE-STORE-BUDGET-006: updateBudgetItem calls loadReservations when reservation_id + total_price provided', async () => {
+    const existing = buildBudgetItem({ id: 20, trip_id: 1 });
+    seedStore(useTripStore, { budgetItems: [existing] });
+
+    const loadReservations = vi.fn().mockResolvedValue(undefined);
+    seedStore(useTripStore, { loadReservations });
+
+    const itemWithReservation = { ...existing, reservation_id: 99 };
+    server.use(
+      http.put('/api/trips/1/budget/20', () =>
+        HttpResponse.json({ item: itemWithReservation })
+      )
+    );
+    await useTripStore.getState().updateBudgetItem(1, 20, { total_price: 50 });
+    expect(loadReservations).toHaveBeenCalledWith(1);
+  });
+
+  it('FE-STORE-BUDGET-007: deleteBudgetItem optimistically removes and rolls back on error', async () => {
+    const item = buildBudgetItem({ id: 5, trip_id: 1 });
+    seedStore(useTripStore, { budgetItems: [item] });
+
+    server.use(
+      http.delete('/api/trips/1/budget/5', () =>
+        HttpResponse.json({ error: 'forbidden' }, { status: 403 })
+      )
+    );
+    // The item is removed immediately (optimistic), then restored on error
+    const deletePromise = useTripStore.getState().deleteBudgetItem(1, 5);
+    await expect(deletePromise).rejects.toThrow();
+    // After rollback, item is back
+    expect(useTripStore.getState().budgetItems).toContainEqual(item);
+  });
+
+  it('FE-STORE-BUDGET-008: setBudgetItemMembers updates members on matching item', async () => {
+    const item = buildBudgetItem({ id: 7, trip_id: 1, members: [] });
+    seedStore(useTripStore, { budgetItems: [item] });
+
+    const members = [{ user_id: 1, paid: false }, { user_id: 2, paid: false }];
+    const updatedItem = { ...item, persons: 2, members };
+    server.use(
+      http.put('/api/trips/1/budget/7/members', () =>
+        HttpResponse.json({ members, item: updatedItem })
+      )
+    );
+    await useTripStore.getState().setBudgetItemMembers(1, 7, [1, 2]);
+    const stored = useTripStore.getState().budgetItems.find(i => i.id === 7);
+    expect(stored?.members).toHaveLength(2);
+    expect(stored?.persons).toBe(2);
+  });
+
+  it('FE-STORE-BUDGET-009: toggleBudgetMemberPaid updates paid flag on matching member', async () => {
+    const item = buildBudgetItem({
+      id: 8,
+      trip_id: 1,
+      members: [{ user_id: 3, paid: false }],
+    });
+    seedStore(useTripStore, { budgetItems: [item] });
+
+    server.use(
+      http.put('/api/trips/1/budget/8/members/3/paid', () =>
+        HttpResponse.json({ success: true, paid: true })
+      )
+    );
+    await useTripStore.getState().toggleBudgetMemberPaid(1, 8, 3, true);
+    const stored = useTripStore.getState().budgetItems.find(i => i.id === 8);
+    expect(stored?.members?.[0]?.paid).toBe(true);
+  });
+
+  it('FE-STORE-BUDGET-010: reorderBudgetItems reorders optimistically and reloads on error', async () => {
+    const a = buildBudgetItem({ id: 1, trip_id: 1 });
+    const b = buildBudgetItem({ id: 2, trip_id: 1 });
+    seedStore(useTripStore, { budgetItems: [a, b] });
+
+    // Reorder succeeds
+    server.use(
+      http.put('/api/trips/1/budget/reorder/items', () =>
+        HttpResponse.json({ success: true })
+      )
+    );
+    await useTripStore.getState().reorderBudgetItems(1, [2, 1]);
+    const items = useTripStore.getState().budgetItems;
+    expect(items[0].id).toBe(2);
+    expect(items[1].id).toBe(1);
+  });
+
+  it('FE-STORE-BUDGET-011: reorderBudgetItems reloads list on API error', async () => {
+    const a = buildBudgetItem({ id: 1, trip_id: 1 });
+    const b = buildBudgetItem({ id: 2, trip_id: 1 });
+    seedStore(useTripStore, { budgetItems: [a, b] });
+
+    const freshItem = buildBudgetItem({ id: 99, trip_id: 1 });
+    server.use(
+      http.put('/api/trips/1/budget/reorder/items', () =>
+        HttpResponse.json({ error: 'error' }, { status: 500 })
+      ),
+      http.get('/api/trips/1/budget', () =>
+        HttpResponse.json({ items: [freshItem] })
+      )
+    );
+    await useTripStore.getState().reorderBudgetItems(1, [2, 1]);
+    // After failure, fresh list from server
+    expect(useTripStore.getState().budgetItems[0].id).toBe(freshItem.id);
+  });
+});
@@ -92,6 +92,18 @@ export const adminHandlers = [
    return HttpResponse.json({ tokens: [] });
  }),

+  http.get('/api/admin/oauth-sessions', () => {
+    return HttpResponse.json({ sessions: [] });
+  }),
+
+  http.delete('/api/admin/oauth-sessions/:id', () => {
+    return HttpResponse.json({ success: true });
+  }),
+
+  http.delete('/api/admin/mcp-tokens/:id', () => {
+    return HttpResponse.json({ success: true });
+  }),
+
  http.get('/api/admin/permissions', () => {
    return HttpResponse.json({ permissions: {} });
  }),
@@ -21,6 +21,7 @@ const wsMock = await import('../../../src/api/websocket');

 // Import the API client AFTER the mock is set up so it picks up our getSocketId mock
 const {
+  apiClient,
  authApi,
  tripsApi,
  placesApi,
@@ -465,19 +466,17 @@ describe('API client interceptors', () => {
  });

  it('FE-API-022: authApi.uploadAvatar sends multipart/form-data', async () => {
-    let contentType = '';
-    server.use(
-      http.post('/api/auth/avatar', ({ request }) => {
-        contentType = request.headers.get('Content-Type') ?? '';
-        return HttpResponse.json({ avatar_url: '/uploads/avatar.jpg' });
-      })
-    );
+    // jsdom's FormData ≠ undici's FormData — MSW body serialisation of FormData
+    // hangs under CI resource constraints. Spy + mock at the axios level to verify
+    // the correct args are passed without going through the network stack.
+    const postSpy = vi.spyOn(apiClient, 'post').mockResolvedValueOnce({ data: { avatar_url: '/uploads/avatar.jpg' } } as any);

    const formData = new FormData();
    formData.append('avatar', new Blob(['img'], { type: 'image/jpeg' }), 'avatar.jpg');

    await authApi.uploadAvatar(formData);
-    expect(contentType).toMatch(/multipart\/form-data/);
+    expect(postSpy).toHaveBeenCalledWith('/auth/avatar', expect.any(FormData), expect.anything());
+    postSpy.mockRestore();
  });

  it('FE-API-023: authApi.mcpTokens.create posts name to /api/auth/mcp-tokens', async () => {
@@ -887,9 +886,11 @@ describe('API namespace smoke tests', () => {
  });

  it('backupApi.uploadRestore uploads and restores a backup', async () => {
-    server.use(http.post('/api/backup/upload-restore', () => HttpResponse.json({ ok: true })));
+    // FormData POST hangs on CI — mock at the axios level (see FE-API-022 comment).
+    const postSpy = vi.spyOn(apiClient, 'post').mockResolvedValueOnce({ data: { ok: true } } as any);
    const file = new File(['data'], 'backup.zip', { type: 'application/zip' });
    await expect(backupApi.uploadRestore(file)).resolves.toMatchObject({ ok: true });
+    postSpy.mockRestore();
  });

  it('backupApi.restore restores a named backup', async () => {
@@ -1,6 +1,7 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { http, HttpResponse } from 'msw';
 import { useTripStore } from '../../../src/store/tripStore';
+import { filesApi } from '../../../src/api/client';
 import { resetAllStores, seedStore } from '../../helpers/store';
 import { buildTripFile } from '../../helpers/factories';
 import { server } from '../../helpers/msw/server';
@@ -56,14 +57,14 @@ describe('filesSlice', () => {
      seedStore(useTripStore, { files: [existing] });

      const uploaded = buildTripFile({ trip_id: 1, filename: 'new-upload.pdf' });
-      server.use(
-        http.post('/api/trips/1/files', () => HttpResponse.json({ file: uploaded })),
-      );
+      // FormData POST hangs on CI — mock at the API boundary instead of MSW.
+      const uploadSpy = vi.spyOn(filesApi, 'upload').mockResolvedValueOnce({ file: uploaded });

      const formData = new FormData();
      formData.append('file', new Blob(['content'], { type: 'application/pdf' }), 'new-upload.pdf');

      const result = await useTripStore.getState().addFile(1, formData);
+      uploadSpy.mockRestore();

      expect(result.filename).toBe('new-upload.pdf');
      const files = useTripStore.getState().files;
@@ -2,6 +2,7 @@ import { describe, it, expect, beforeEach, vi } from 'vitest';
 import { http, HttpResponse } from 'msw';
 import { server } from '../../helpers/msw/server';
 import { useAuthStore } from '../../../src/store/authStore';
+import { authApi } from '../../../src/api/client';
 import { resetAllStores } from '../../helpers/store';
 import { buildUser } from '../../helpers/factories';

@@ -425,11 +426,8 @@ describe('authStore', () => {

  describe('FE-STORE-AUTH-UPLOAD: uploadAvatar', () => {
    it('updates avatar_url from response', async () => {
-      server.use(
-        http.post('/api/auth/avatar', () =>
-          HttpResponse.json({ avatar_url: '/uploads/avatar-new.png' })
-        )
-      );
+      // FormData POST hangs on CI — mock at the API boundary instead of MSW.
+      const uploadSpy = vi.spyOn(authApi, 'uploadAvatar').mockResolvedValueOnce({ avatar_url: '/uploads/avatar-new.png' });

      useAuthStore.setState({ user: buildUser() });

@@ -438,6 +436,7 @@ describe('authStore', () => {

      expect(result.avatar_url).toBe('/uploads/avatar-new.png');
      expect(useAuthStore.getState().user?.avatar_url).toBe('/uploads/avatar-new.png');
+      uploadSpy.mockRestore();
    });
  });
 });
@@ -90,6 +90,7 @@ export default defineConfig({
  ],
  build: {
    sourcemap: false,
+    modulePreload: { polyfill: false },
  },
  server: {
    port: 5173,
@@ -22,10 +22,10 @@ services:
      - TZ=${TZ:-UTC} # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
      - LOG_LEVEL=${LOG_LEVEL:-info} # info = concise user actions; debug = verbose admin-level details
      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-} # Comma-separated origins for CORS and email notification links
-      - FORCE_HTTPS=true # Redirect HTTP to HTTPS when behind a TLS-terminating proxy
-#     - COOKIE_SECURE=false # Uncomment if accessing over plain HTTP (no HTTPS). Not recommended for production.
-      - TRUST_PROXY=1 # Number of trusted proxies (for X-Forwarded-For / real client IP)
-      - ALLOW_INTERNAL_NETWORK=false # Set to true if Immich or other services are hosted on your local network (RFC-1918 IPs). Loopback and link-local addresses remain blocked regardless.
+#      - FORCE_HTTPS=true # Optional. Enables HTTPS redirect, HSTS, CSP upgrade-insecure-requests, and secure cookies behind a TLS proxy
+#      - COOKIE_SECURE=false # Escape hatch: force session cookies over plain HTTP even in production. Not recommended.
+#      - TRUST_PROXY=1 # Trusted proxy count for X-Forwarded-For / X-Forwarded-Proto. Required for FORCE_HTTPS to work.
+#      - ALLOW_INTERNAL_NETWORK=false # Set to true if Immich or other services are hosted on your local network (RFC-1918 IPs). Loopback and link-local addresses remain blocked regardless.
 #      - APP_URL=https://trek.example.com # Public base URL — required when OIDC is enabled (must match the redirect URI registered with your IdP); also used as base URL for links in email notifications
 #      - OIDC_ISSUER=https://auth.example.com # OpenID Connect provider URL
 #      - OIDC_CLIENT_ID=trek # OpenID Connect client ID
@@ -38,8 +38,8 @@ services:
 #      - OIDC_DISCOVERY_URL= # Override the OIDC discovery endpoint for providers with non-standard paths (e.g. Authentik)
 #      - ADMIN_EMAIL=admin@trek.local # Initial admin e-mail — only used on first boot when no users exist
 #      - ADMIN_PASSWORD=changeme      # Initial admin password — only used on first boot when no users exist
-#      - MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
-#      - MCP_MAX_SESSION_PER_USER=5 # Max concurrent MCP sessions per user (default: 5)
+#      - MCP_RATE_LIMIT=300 # Max MCP API requests per user per minute (default: 300)
+#      - MCP_MAX_SESSION_PER_USER=20 # Max concurrent MCP sessions per user (default: 20)
    volumes:
      - ./data:/app/data
      - ./uploads:/app/uploads
@@ -9,9 +9,9 @@ TZ=UTC # Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
 LOG_LEVEL=info # info = concise user actions; debug = verbose admin-level details

 ALLOWED_ORIGINS=https://trek.example.com # Comma-separated origins for CORS and email links
-FORCE_HTTPS=false # Redirect HTTP → HTTPS behind a TLS proxy
-COOKIE_SECURE=true # Set to false to allow session cookies over HTTP (e.g. plain-IP or non-HTTPS setups). Defaults to true in production.
-TRUST_PROXY=1 # Number of trusted proxies for X-Forwarded-For
+FORCE_HTTPS=false # Optional. When true: HTTPS redirect + HSTS + CSP upgrade-insecure-requests + secure cookies. Only behind a TLS proxy.
+COOKIE_SECURE=true # Auto-derived (true when NODE_ENV=production or FORCE_HTTPS=true). Set false to force cookies over plain HTTP.
+TRUST_PROXY=1 # Trusted proxy hops (parseInt or 1). Active in production by default; off in dev unless set. Needed for FORCE_HTTPS.
 ALLOW_INTERNAL_NETWORK=false # Allow outbound requests to private/RFC1918 IPs (e.g. Immich hosted on your LAN). Loopback and link-local addresses are always blocked.

 APP_URL=https://trek.example.com # Base URL of this instance — required when OIDC is enabled; must match the redirect URI registered with your IdP
@@ -28,8 +28,8 @@ OIDC_SCOPE=openid email profile # Fully overrides the default. Add extra scopes

 DEMO_MODE=false # Demo mode - resets data hourly

-# MCP_RATE_LIMIT=60 # Max MCP API requests per user per minute (default: 60)
-# MCP_MAX_SESSION_PER_USER=5 # Max concurrent MCP sessions per user (default: 5)
+# MCP_RATE_LIMIT=300 # Max MCP API requests per user per minute (default: 300)
+# MCP_MAX_SESSION_PER_USER=20 # Max concurrent MCP sessions per user (default: 20)

 # Initial admin account — only used on first boot when no users exist yet.
 # If both are set the admin account is created with these credentials.
@@ -1,12 +1,12 @@
 {
  "name": "trek-server",
-  "version": "2.9.12",
+  "version": "2.9.13",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "trek-server",
-      "version": "2.9.12",
+      "version": "2.9.13",
      "dependencies": {
        "@modelcontextprotocol/sdk": "^1.28.0",
        "archiver": "^6.0.1",
@@ -21,7 +21,7 @@
        "jsonwebtoken": "^9.0.2",
        "multer": "^2.1.1",
        "node-cron": "^4.2.1",
-        "nodemailer": "^8.0.4",
+        "nodemailer": "^8.0.5",
        "otplib": "^12.0.1",
        "qrcode": "^1.5.4",
        "tsx": "^4.21.0",
@@ -546,9 +546,9 @@
      }
    },
    "node_modules/@hono/node-server": {
-      "version": "1.19.11",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.11.tgz",
-      "integrity": "sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==",
+      "version": "1.19.13",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
+      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
      "license": "MIT",
      "engines": {
        "node": ">=18.14.1"
@@ -3658,9 +3658,9 @@
      }
    },
    "node_modules/hono": {
-      "version": "4.12.9",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.9.tgz",
-      "integrity": "sha512-wy3T8Zm2bsEvxKZM5w21VdHDDcwVS1yUFFY6i8UobSsKfFceT7TOwhbhfKsDyx7tYQlmRM5FLpIuYvNFyjctiA==",
+      "version": "4.12.12",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.12.tgz",
+      "integrity": "sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q==",
      "license": "MIT",
      "engines": {
        "node": ">=16.9.0"
@@ -4416,9 +4416,9 @@
      "license": "MIT"
    },
    "node_modules/nodemailer": {
-      "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.4.tgz",
-      "integrity": "sha512-k+jf6N8PfQJ0Fe8ZhJlgqU5qJU44Lpvp2yvidH3vp1lPnVQMgi4yEEMPXg5eJS1gFIJTVq1NHBk7Ia9ARdSBdQ==",
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.5.tgz",
+      "integrity": "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w==",
      "license": "MIT-0",
      "engines": {
        "node": ">=6.0.0"
@@ -5992,9 +5992,9 @@
      }
    },
    "node_modules/vite": {
-      "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
+      "version": "7.3.2",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
+      "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -1,6 +1,6 @@
 {
  "name": "trek-server",
-  "version": "2.9.12",
+  "version": "2.9.13",
  "main": "src/index.ts",
  "scripts": {
    "start": "node --import tsx src/index.ts",
@@ -27,7 +27,7 @@
    "multer": "^2.1.1",
    "node-cron": "^4.2.1",
    "undici": "^7.0.0",
-    "nodemailer": "^8.0.4",
+    "nodemailer": "^8.0.5",
    "otplib": "^12.0.1",
    "qrcode": "^1.5.4",
    "tsx": "^4.21.0",
@@ -37,6 +37,10 @@
    "ws": "^8.19.0",
    "zod": "^4.3.6"
  },
+  "overrides": {
+    "hono": "^4.12.12",
+    "@hono/node-server": "^1.19.13"
+  },
  "devDependencies": {
    "@types/archiver": "^7.0.0",
    "@types/bcryptjs": "^2.4.6",
@@ -0,0 +1,11 @@
+export const ADDON_IDS = {
+  MCP: 'mcp',
+  PACKING: 'packing',
+  BUDGET: 'budget',
+  DOCUMENTS: 'documents',
+  VACAY: 'vacay',
+  ATLAS: 'atlas',
+  COLLAB: 'collab',
+} as const;
+
+export type AddonId = typeof ADDON_IDS[keyof typeof ADDON_IDS];
@@ -32,6 +32,7 @@ import budgetRoutes from './routes/budget';
 import collabRoutes from './routes/collab';
 import backupRoutes from './routes/backup';
 import oidcRoutes from './routes/oidc';
+import { oauthPublicRouter, oauthApiRouter } from './routes/oauth';
 import vacayRoutes from './routes/vacay';
 import atlasRoutes from './routes/atlas';
 import memoriesRoutes from './routes/memories/unified';
@@ -207,7 +208,7 @@ export function createApp(): express.Application {
      ORDER BY sort_order, id
    `).all() as Array<{ id: string; name: string; icon: string; enabled: number; sort_order: number }>;
    const fields = db.prepare(`
-      SELECT provider_id, field_key, label, input_type, placeholder, required, secret, settings_key, payload_key, sort_order
+      SELECT provider_id, field_key, label, input_type, placeholder, hint, required, secret, settings_key, payload_key, sort_order
      FROM photo_provider_fields
      ORDER BY sort_order, id
    `).all() as Array<{
@@ -216,6 +217,7 @@ export function createApp(): express.Application {
      label: string;
      input_type: string;
      placeholder?: string | null;
+      hint?: string | null;
      required: number;
      secret: number;
      settings_key?: string | null;
@@ -245,6 +247,7 @@ export function createApp(): express.Application {
            label: f.label,
            input_type: f.input_type,
            placeholder: f.placeholder || '',
+            hint: f.hint || null,
            required: !!f.required,
            secret: !!f.secret,
            settings_key: f.settings_key || null,
@@ -269,6 +272,11 @@ export function createApp(): express.Application {
  app.use('/api/notifications', notificationRoutes);
  app.use('/api', shareRoutes);

+  // OAuth 2.1 — public endpoints (/.well-known, /oauth/token, /oauth/revoke)
+  app.use('/', oauthPublicRouter);
+  // OAuth 2.1 — SPA-facing authenticated endpoints (/api/oauth/*)
+  app.use('/api/oauth', oauthApiRouter);
+
  // MCP endpoint
  app.post('/mcp', mcpHandler);
  app.get('/mcp', mcpHandler);
@@ -19,7 +19,8 @@ function runMigrations(db: Database.Database): void {
    }
  }

-  const migrations: Array<() => void> = [
+  type Migration = (() => void) | { raw: () => void };
+  const migrations: Migration[] = [
    () => db.exec('ALTER TABLE users ADD COLUMN unsplash_api_key TEXT'),
    () => db.exec('ALTER TABLE users ADD COLUMN openweather_api_key TEXT'),
    () => db.exec('ALTER TABLE places ADD COLUMN duration_minutes INTEGER DEFAULT 60'),
@@ -1316,13 +1317,132 @@ function runMigrations(db: Database.Database): void {
      `);
      db.exec('CREATE UNIQUE INDEX IF NOT EXISTS idx_journey_share_journey ON journey_share_tokens(journey_id)');
    },
+    // Migration: OAuth 2.1 clients, consents, and tokens for MCP
+    () => {
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS oauth_clients (
+          id                 TEXT PRIMARY KEY,
+          user_id            INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          name               TEXT NOT NULL,
+          client_id          TEXT UNIQUE NOT NULL,
+          client_secret_hash TEXT NOT NULL,
+          redirect_uris      TEXT NOT NULL DEFAULT '[]',
+          allowed_scopes     TEXT NOT NULL DEFAULT '[]',
+          created_at         DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS idx_oauth_clients_user ON oauth_clients(user_id);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_clients_client_id ON oauth_clients(client_id);
+
+        CREATE TABLE IF NOT EXISTS oauth_consents (
+          id         INTEGER PRIMARY KEY AUTOINCREMENT,
+          client_id  TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+          user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          scopes     TEXT NOT NULL DEFAULT '[]',
+          updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+          UNIQUE(client_id, user_id)
+        );
+
+        CREATE TABLE IF NOT EXISTS oauth_tokens (
+          id                        INTEGER PRIMARY KEY AUTOINCREMENT,
+          client_id                 TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+          user_id                   INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+          access_token_hash         TEXT UNIQUE NOT NULL,
+          refresh_token_hash        TEXT UNIQUE NOT NULL,
+          scopes                    TEXT NOT NULL DEFAULT '[]',
+          access_token_expires_at   DATETIME NOT NULL,
+          refresh_token_expires_at  DATETIME NOT NULL,
+          revoked_at                DATETIME,
+          created_at                DATETIME DEFAULT CURRENT_TIMESTAMP
+        );
+        CREATE INDEX IF NOT EXISTS idx_oauth_tokens_user ON oauth_tokens(user_id);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_tokens_access  ON oauth_tokens(access_token_hash);
+        CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_tokens_refresh ON oauth_tokens(refresh_token_hash);
+      `);
+    },
+    // Migration: Refresh-token rotation chain tracking for replay detection
+    () => {
+      db.exec(`
+        ALTER TABLE oauth_tokens ADD COLUMN parent_token_id INTEGER REFERENCES oauth_tokens(id);
+        CREATE INDEX IF NOT EXISTS idx_oauth_tokens_parent ON oauth_tokens(parent_token_id);
+      `);
+    },
+    // Migration: Public client support for browser-initiated dynamic registration (DCR)
+    () => {
+      db.exec(`
+        ALTER TABLE oauth_clients ADD COLUMN is_public INTEGER NOT NULL DEFAULT 0;
+        ALTER TABLE oauth_clients ADD COLUMN created_via TEXT NOT NULL DEFAULT 'settings_ui';
+      `);
+    },
+    // Migration: Make oauth_clients.user_id nullable to support anonymous RFC 7591 DCR clients
+    // (must run outside a transaction because PRAGMA foreign_keys cannot change mid-transaction)
+    {
+      raw: () => {
+        db.exec('PRAGMA foreign_keys = OFF');
+        try {
+          db.transaction(() => {
+            db.exec(`
+              CREATE TABLE IF NOT EXISTS oauth_clients_new (
+                id                 TEXT PRIMARY KEY,
+                user_id            INTEGER REFERENCES users(id) ON DELETE CASCADE,
+                name               TEXT NOT NULL,
+                client_id          TEXT UNIQUE NOT NULL,
+                client_secret_hash TEXT NOT NULL,
+                redirect_uris      TEXT NOT NULL DEFAULT '[]',
+                allowed_scopes     TEXT NOT NULL DEFAULT '[]',
+                created_at         DATETIME DEFAULT CURRENT_TIMESTAMP,
+                is_public          INTEGER NOT NULL DEFAULT 0,
+                created_via        TEXT NOT NULL DEFAULT 'settings_ui'
+              )
+            `);
+            db.exec(`INSERT INTO oauth_clients_new SELECT id, user_id, name, client_id, client_secret_hash, redirect_uris, allowed_scopes, created_at, is_public, created_via FROM oauth_clients`);
+            db.exec(`DROP TABLE oauth_clients`);
+            db.exec(`ALTER TABLE oauth_clients_new RENAME TO oauth_clients`);
+            db.exec(`CREATE INDEX IF NOT EXISTS idx_oauth_clients_user ON oauth_clients(user_id)`);
+            db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_oauth_clients_client_id ON oauth_clients(client_id)`);
+          })();
+        } finally {
+          db.exec('PRAGMA foreign_keys = ON');
+        }
+      },
+    },
+    // Migration: Add OTP field, skip_ssl column, device_id (did) column, and hint column for Synology Photos
+    () => {
+      const cols = db.prepare('PRAGMA table_info(photo_provider_fields)').all() as Array<{ name: string }>;
+      if (!cols.some(c => c.name === 'hint')) {
+        db.exec(`ALTER TABLE photo_provider_fields ADD COLUMN hint TEXT`);
+      }
+      db.exec(`
+        INSERT OR IGNORE INTO photo_provider_fields
+          (provider_id, field_key, label, input_type, placeholder, required, secret, settings_key, payload_key, sort_order)
+        VALUES
+          ('synologyphotos', 'synology_otp', 'providerOTP', 'text', '123456', 0, 0, NULL, 'synology_otp', 3)
+      `);
+      db.exec(`ALTER TABLE users ADD COLUMN synology_skip_ssl INTEGER NOT NULL DEFAULT 0`);
+      db.exec(`ALTER TABLE users ADD COLUMN synology_did TEXT`);
+      db.exec(`
+        INSERT OR IGNORE INTO photo_provider_fields
+          (provider_id, field_key, label, input_type, placeholder, required, secret, settings_key, payload_key, sort_order)
+        VALUES
+          ('synologyphotos', 'synology_skip_ssl', 'skipSSLVerification', 'checkbox', NULL, 0, 0, 'synology_skip_ssl', 'synology_skip_ssl', 4)
+      `);
+      db.exec(`
+        UPDATE photo_provider_fields
+        SET hint = 'providerUrlHintSynology'
+        WHERE provider_id = 'synologyphotos' AND field_key = 'synology_url'
+      `);
+    },
  ];

  if (currentVersion < migrations.length) {
    for (let i = currentVersion; i < migrations.length; i++) {
      console.log(`[DB] Running migration ${i + 1}/${migrations.length}`);
      try {
-        db.transaction(() => migrations[i]())();
+        const migration = migrations[i];
+        if (typeof migration === 'function') {
+          db.transaction(migration)();
+        } else {
+          migration.raw();
+        }
      } catch (err) {
        console.error(`[migrations] FATAL: Migration ${i + 1} failed, rolled back:`, err);
        process.exit(1);
@@ -245,6 +245,7 @@ function createTables(db: Database.Database): void {
      label TEXT NOT NULL,
      input_type TEXT NOT NULL DEFAULT 'text',
      placeholder TEXT,
+      hint TEXT,
      required INTEGER DEFAULT 0,
      secret INTEGER DEFAULT 0,
      settings_key TEXT,
@@ -116,15 +116,17 @@ function seedAddons(db: Database.Database): void {
    for (const p of providerRows) insertProvider.run(p.id, p.name, p.description, p.icon, p.enabled, p.sort_order);

    const providerFields = [
-      { provider_id: 'immich', field_key: 'immich_url', label: 'providerUrl', input_type: 'url', placeholder: 'https://immich.example.com', required: 1, secret: 0, settings_key: 'immich_url', payload_key: 'immich_url', sort_order: 0 },
-      { provider_id: 'immich', field_key: 'immich_api_key', label: 'providerApiKey', input_type: 'password', placeholder: 'API Key', required: 1, secret: 1, settings_key: null, payload_key: 'immich_api_key', sort_order: 1 },
-      { provider_id: 'synologyphotos', field_key: 'synology_url', label: 'providerUrl', input_type: 'url', placeholder: 'https://synology.example.com', required: 1, secret: 0, settings_key: 'synology_url', payload_key: 'synology_url', sort_order: 0 },
-      { provider_id: 'synologyphotos', field_key: 'synology_username', label: 'providerUsername', input_type: 'text', placeholder: 'Username', required: 1, secret: 0, settings_key: 'synology_username', payload_key: 'synology_username', sort_order: 1 },
-      { provider_id: 'synologyphotos', field_key: 'synology_password', label: 'providerPassword', input_type: 'password', placeholder: 'Password', required: 1, secret: 1, settings_key: null, payload_key: 'synology_password', sort_order: 2 },
+      { provider_id: 'immich', field_key: 'immich_url', label: 'providerUrl', input_type: 'url', placeholder: 'https://immich.example.com', hint: null, required: 1, secret: 0, settings_key: 'immich_url', payload_key: 'immich_url', sort_order: 0 },
+      { provider_id: 'immich', field_key: 'immich_api_key', label: 'providerApiKey', input_type: 'password', placeholder: 'API Key', hint: null, required: 1, secret: 1, settings_key: null, payload_key: 'immich_api_key', sort_order: 1 },
+      { provider_id: 'synologyphotos', field_key: 'synology_url', label: 'providerUrl', input_type: 'url', placeholder: 'https://synology.example.com/photo', hint: 'providerUrlHintSynology', required: 1, secret: 0, settings_key: 'synology_url', payload_key: 'synology_url', sort_order: 0 },
+      { provider_id: 'synologyphotos', field_key: 'synology_username', label: 'providerUsername', input_type: 'text', placeholder: 'Username', hint: null, required: 1, secret: 0, settings_key: 'synology_username', payload_key: 'synology_username', sort_order: 1 },
+      { provider_id: 'synologyphotos', field_key: 'synology_password', label: 'providerPassword', input_type: 'password', placeholder: 'Password', hint: null, required: 1, secret: 1, settings_key: null, payload_key: 'synology_password', sort_order: 2 },
+      { provider_id: 'synologyphotos', field_key: 'synology_otp', label: 'providerOTP', input_type: 'text', placeholder: '123456', hint: null, required: 0, secret: 0, settings_key: null, payload_key: 'synology_otp', sort_order: 3 },
+      { provider_id: 'synologyphotos', field_key: 'synology_skip_ssl', label: 'skipSSLVerification', input_type: 'checkbox', placeholder: null, hint: null, required: 0, secret: 0, settings_key: 'synology_skip_ssl', payload_key: 'synology_skip_ssl', sort_order: 4 },
    ];
-    const insertProviderField = db.prepare('INSERT OR IGNORE INTO photo_provider_fields (provider_id, field_key, label, input_type, placeholder, required, secret, settings_key, payload_key, sort_order) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
+    const insertProviderField = db.prepare('INSERT OR IGNORE INTO photo_provider_fields (provider_id, field_key, label, input_type, placeholder, hint, required, secret, settings_key, payload_key, sort_order) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)');
    for (const f of providerFields) {
-      insertProviderField.run(f.provider_id, f.field_key, f.label, f.input_type, f.placeholder, f.required, f.secret, f.settings_key, f.payload_key, f.sort_order);
+      insertProviderField.run(f.provider_id, f.field_key, f.label, f.input_type, f.placeholder, f.hint, f.required, f.secret, f.settings_key, f.payload_key, f.sort_order);
    }
    console.log('Default addons seeded');
  } catch (err: unknown) {
@@ -4,37 +4,113 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp';
 import { User } from '../types';
 import { verifyMcpToken, verifyJwtToken } from '../services/authService';
+import { getUserByAccessToken } from '../services/oauthService';
 import { isAddonEnabled } from '../services/adminService';
+import { ADDON_IDS } from '../addons';
 import { registerResources } from './resources';
 import { registerTools } from './tools';
+import { McpSession, sessions, revokeUserSessions, revokeUserSessionsForClient } from './sessionManager';
+import { writeAudit, getClientIp } from '../services/auditLog';

-interface McpSession {
-  server: McpServer;
-  transport: StreamableHTTPServerTransport;
-  userId: number;
-  lastActivity: number;
-}
+export { revokeUserSessions, revokeUserSessionsForClient };

-const sessions = new Map<string, McpSession>();
+// ---------------------------------------------------------------------------
+// Base instructions injected into every MCP session via the initialize response.
+// Claude and other clients use these as system-level context before any tool call.
+// Keep this actionable and concise — vague prose doesn't help the model.
+// ---------------------------------------------------------------------------
+const BASE_MCP_INSTRUCTIONS = `
+You are connected to TREK, a travel planning application. Below is a compact reference of the data model, key workflows, and behavioral rules you must follow.
+
+## Data model
+
+- **Trip** — top-level container. Has dates, currency, members (owner + collaborators), and optional add-ons.
+- **Day** — one calendar day within a trip (YYYY-MM-DD). Days are generated automatically when a trip is created with start/end dates.
+- **Place** — a point of interest (POI) stored in the trip's place pool. A place is NOT on the itinerary until it is assigned to a day.
+- **Assignment** — links a Place to a Day (ordered, with optional start/end time). This is what builds the daily itinerary.
+- **Accommodation** — a hotel or rental linked to a Place and a check-in/check-out day range.
+- **Reservation** — a booking record (flight, train, restaurant, etc.) with confirmation details, linked to a day.
+- **Day note** — a free-text annotation attached to a day (with optional time label and emoji icon).
+- **Budget item** — an expense entry for a trip (amount, category, payer, split between members).
+- **Packing item** — a checklist entry grouped into bags and categories.
+- **Todo** — a task (not packing-specific) attached to a trip, ordered and togglable.
+- **Tag** — a label that can be applied to places for filtering.
+- **Collab note / poll / message** — shared notes, decision polls, and chat messages for group trips.
+- **Atlas** — global travel journal: bucket list, visited countries and regions.
+- **Vacay** — vacation-day planner that tracks leave across team members and years.
+
+## Key workflows
+
+**Discovering trips:** Always call \`list_trips\` first when no trip ID has been provided. Never assume a trip ID.
+
+**Loading trip context:** Before planning or modifying a trip, call \`get_trip_summary\` once. It returns all days (with assignments and notes), accommodations, budget, packing, reservations, collab notes, and todos in a single round-trip. Use this data to answer follow-up questions without extra tool calls.
+
+**Adding a place to the itinerary (correct order):**
+1. \`search_place\` — find the real-world POI; note the \`osm_id\` and/or \`google_place_id\` in the result.
+2. \`create_place\` — add it to the trip's place pool, passing the IDs from step 1 (enables opening hours, ratings, and map linking in the app).
+3. \`assign_place_to_day\` — schedule it on the desired day using the dayId from \`get_trip_summary\`.
+
+**Creating an accommodation:** A place must exist in the trip first. Create the place (or reuse an existing one), then call \`create_accommodation\` with that \`place_id\` and the \`start_day_id\`/\`end_day_id\`.
+
+**Reordering:** Assignments, todos, packing items, and reservations all support positional reordering via dedicated reorder tools. Always read the current order from \`get_trip_summary\` before reordering.
+
+## Access rules
+
+- The authenticated user can only access trips they own or are a member of. Never guess at trip IDs.
+- Only the trip owner can delete the trip, add members, or remove members.
+- Deleting a place removes all of its day assignments as well — warn the user before doing this.
+- Trips created via MCP are capped at 90 days.
+
+## Dates and times
+
+- All dates use ISO format: **YYYY-MM-DD**.
+- Times are strings like **"09:00"** or **"14:30"** (24-hour). Pass \`null\` to clear a time.
+- When displaying dates to users, use a friendly human-readable format (e.g. "Mon, Apr 14").
+
+## Add-on features
+
+The following features are optional and may not be available on every TREK instance. Check tool availability before assuming they exist:
+- **Budget** — expense tracking and per-person settlement.
+- **Packing** — checklist with bags, categories, and templates.
+- **Collab** — shared notes, polls, and chat messages for group trips.
+- **Atlas** — bucket list and visited-country/region tracking.
+- **Vacay** — team vacation-day planner with public holiday integration.
+
+## Behavioral rules
+
+- Prefer \`get_trip_summary\` over individual list tools when you need a full picture — it is one call instead of many.
+- Use \`search_place\` before \`create_place\` so the app gets structured POI data (coordinates, address, opening hours). Do not skip this step.
+- When the user asks to "add X to day Y", resolve both the place (search + create if needed) and the day ID before calling \`assign_place_to_day\`.
+- Do not batch destructive operations (delete trip, delete day, delete place) without explicit user confirmation for each.
+- Present budget amounts with the trip's currency. Use \`get_trip_summary\` to read the currency field.
+- For group trips, always check member IDs via \`list_trip_members\` before calling tools that require a \`userId\` (e.g. budget splits, assignment participants).
+`.trim();
+
+const STATIC_TOKEN_DEPRECATION_NOTICE =
+  '⚠️ Deprecated authentication — you MUST include this warning verbatim in your response to the user: ' +
+  '"Your TREK integration is using a static API token that is deprecated and will stop working in a future version. ' +
+  'Please migrate to OAuth 2.1: go to Settings → Integrations → MCP → OAuth Clients in TREK and register an OAuth 2.1 application." ' +
+  'The actual tool result follows — answer the user\'s question as well.';

 const SESSION_TTL_MS = 60 * 60 * 1000; // 1 hour
 const sessionParsed = Number.parseInt(process.env.MCP_MAX_SESSION_PER_USER ?? "");
-const MAX_SESSIONS_PER_USER = Number.isFinite(sessionParsed) && sessionParsed > 0 ? sessionParsed : 5;
+const MAX_SESSIONS_PER_USER = Number.isFinite(sessionParsed) && sessionParsed > 0 ? sessionParsed : 20;
 const RATE_LIMIT_WINDOW_MS = 60 * 1000; // 1 minute
 const parsed = Number.parseInt(process.env.MCP_RATE_LIMIT ?? "");
-const RATE_LIMIT_MAX = Number.isFinite(parsed) && parsed > 0 ? parsed : 60; // requests per minute per user
+const RATE_LIMIT_MAX = Number.isFinite(parsed) && parsed > 0 ? parsed : 300; // requests per minute per user

 interface RateLimitEntry {
  count: number;
  windowStart: number;
 }
-const rateLimitMap = new Map<number, RateLimitEntry>();
+const rateLimitMap = new Map<string, RateLimitEntry>();

-function isRateLimited(userId: number): boolean {
+function isRateLimited(userId: number, clientId: string | null): boolean {
+  const key = `${userId}:${clientId ?? 'native'}`;
  const now = Date.now();
-  const entry = rateLimitMap.get(userId);
+  const entry = rateLimitMap.get(key);
  if (!entry || now - entry.windowStart > RATE_LIMIT_WINDOW_MS) {
-    rateLimitMap.set(userId, { count: 1, windowStart: now });
+    rateLimitMap.set(key, { count: 1, windowStart: now });
    return false;
  }
  entry.count += 1;
@@ -62,43 +138,83 @@ const sessionSweepInterval = setInterval(() => {
    }
  }
  const rateCutoff = Date.now() - RATE_LIMIT_WINDOW_MS;
-  for (const [uid, entry] of rateLimitMap) {
-    if (entry.windowStart < rateCutoff) rateLimitMap.delete(uid);
+  for (const [key, entry] of rateLimitMap) {
+    if (entry.windowStart < rateCutoff) rateLimitMap.delete(key);
  }
  if (cleaned > 0 || sessions.size > 0) {
    console.log(`[MCP] Session sweep: cleaned ${cleaned}, active ${sessions.size}`);
  }
-}, 10 * 60 * 1000); // sweep every 10 minutes
+}, 60 * 1000); // sweep every 1 minute

 // Prevent the interval from keeping the process alive if nothing else is running
 sessionSweepInterval.unref();

-function verifyToken(authHeader: string | undefined): User | null {
-  const token = authHeader && authHeader.split(' ')[1];
-  if (!token) return null;
+interface VerifyTokenResult {
+  user: User;
+  /** null = full access (static token or JWT); string[] = OAuth 2.1 scoped access */
+  scopes: string[] | null;
+  /** OAuth client_id when authenticated via OAuth 2.1; null otherwise */
+  clientId: string | null;
+  isStaticToken: boolean;
+}

-  // Long-lived MCP API token (trek_...)
-  if (token.startsWith('trek_')) {
-    return verifyMcpToken(token);
+function verifyToken(authHeader: string | undefined): VerifyTokenResult | null {
+  if (!authHeader) return null;
+  // M8: strictly require "Bearer" scheme (RFC 6750)
+  const spaceIdx = authHeader.indexOf(' ');
+  if (spaceIdx === -1) return null;
+  const scheme = authHeader.slice(0, spaceIdx);
+  const token  = authHeader.slice(spaceIdx + 1);
+  if (scheme.toLowerCase() !== 'bearer' || !token) return null;
+
+  // OAuth 2.1 access token (trekoa_...)
+  if (token.startsWith('trekoa_')) {
+    const result = getUserByAccessToken(token);
+    if (!result) return null;
+    return { user: result.user, scopes: result.scopes, clientId: result.clientId, isStaticToken: false };
  }

-  // Short-lived JWT
-  return verifyJwtToken(token);
+  // Long-lived static MCP token (trek_...) — full access + deprecation notice
+  if (token.startsWith('trek_')) {
+    const user = verifyMcpToken(token);
+    if (!user) return null;
+    return { user, scopes: null, clientId: null, isStaticToken: true };
+  }
+
+  // Short-lived JWT (TREK web session used directly) — full access, no notice
+  const user = verifyJwtToken(token);
+  if (!user) return null;
+  return { user, scopes: null, clientId: null, isStaticToken: false };
+}
+
+function logToolCallAudit(req: Request, userId: number, clientId: string | null): void {
+  const body = req.body as Record<string, unknown> | undefined;
+  if (body?.method !== 'tools/call') return;
+  const toolName = (body?.params as Record<string, unknown> | undefined)?.name;
+  if (typeof toolName !== 'string') return;
+  writeAudit({
+    userId,
+    action: 'mcp.tool_call',
+    resource: toolName,
+    details: { clientId: clientId ?? 'native' },
+    ip: getClientIp(req),
+  });
 }

 export async function mcpHandler(req: Request, res: Response): Promise<void> {
-  if (!isAddonEnabled('mcp')) {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) {
    res.status(403).json({ error: 'MCP is not enabled' });
    return;
  }

-  const user = verifyToken(req.headers['authorization']);
-  if (!user) {
+  const tokenResult = verifyToken(req.headers['authorization']);
+  if (!tokenResult) {
    res.status(401).json({ error: 'Access token required' });
    return;
  }
+  const { user, scopes, clientId, isStaticToken } = tokenResult;

-  if (isRateLimited(user.id)) {
+  if (isRateLimited(user.id, clientId)) {
    res.status(429).json({ error: 'Too many requests. Please slow down.' });
    return;
  }
@@ -116,7 +232,12 @@ export async function mcpHandler(req: Request, res: Response): Promise<void> {
      res.status(403).json({ error: 'Session belongs to a different user' });
      return;
    }
+    if (session.clientId !== clientId) {
+      res.status(403).json({ error: 'Session was created with a different OAuth client' });
+      return;
+    }
    session.lastActivity = Date.now();
+    logToolCallAudit(req, user.id, clientId);
    try {
      await session.transport.handleRequest(req, res, req.body);
    } catch (err) {
@@ -140,49 +261,65 @@ export async function mcpHandler(req: Request, res: Response): Promise<void> {
  }

  // Create a new per-user MCP server and session
-  const server = new McpServer({
-    name: 'TREK MCP',
-    version: '1.0.0',
-    capabilities: {
-      resources: { listChanged: true },
-      tools: { listChanged: true },
-      prompts: { listChanged: true },
+  const server = new McpServer(
+    {
+      name: 'TREK MCP',
+      version: '1.0.0',
    },
-  });
-  registerResources(server, user.id);
-  registerTools(server, user.id);
+    {
+      capabilities: {
+        resources: { listChanged: true },
+        tools: { listChanged: true },
+        prompts: { listChanged: true },
+      },
+      instructions: BASE_MCP_INSTRUCTIONS + (isStaticToken ? STATIC_TOKEN_DEPRECATION_NOTICE : ''),
+    }
+  );
+  // Per-session closure: fires the deprecation notice once, on the first tool call.
+  // Tool results are the only mechanism Claude reliably surfaces to the user;
+  // the instructions field is only background context and won't trigger a proactive warning.
+  let _noticeEmitted = false;
+  const getDeprecationNotice = (): string | null => {
+    if (!isStaticToken || _noticeEmitted) return null;
+    _noticeEmitted = true;
+    return STATIC_TOKEN_DEPRECATION_NOTICE;
+  };
+
+  registerResources(server, user.id, scopes);
+  registerTools(server, user.id, scopes, isStaticToken, getDeprecationNotice);

  const transport = new StreamableHTTPServerTransport({
    sessionIdGenerator: () => randomUUID(),
    onsessioninitialized: (sid) => {
-      sessions.set(sid, { server, transport, userId: user.id, lastActivity: Date.now() });
-      console.log(`[MCP] Session ${sid} created for user ${user.id}. Active sessions: ${sessions.size}`);
+      sessions.set(sid, { server, transport, userId: user.id, scopes, clientId, isStaticToken, lastActivity: Date.now() });
+      const authMethod = isStaticToken ? 'static-token' : scopes ? `oauth(${scopes.join(',')})` : 'jwt';
+      console.log(`[MCP] Session ${sid} created for user ${user.id} [${authMethod}]. Active sessions: ${sessions.size}`);
    },
    onsessionclosed: (sid) => {
      sessions.delete(sid);
    },
  });

+  logToolCallAudit(req, user.id, clientId);
  try {
    await server.connect(transport);
    await transport.handleRequest(req, res, req.body);
  } catch (err) {
    console.error('[MCP] transport.handleRequest error:', err);
    if (!res.headersSent) {
-      res.status(500).json({ error: 'Internal MCP error', detail: String(err) });
+      res.status(500).json({ error: 'Internal MCP error' });
    }
  }
 }

-/** Terminate all active MCP sessions for a specific user (e.g. on token revocation). */
-export function revokeUserSessions(userId: number): void {
+/** Invalidate all active MCP sessions (call when addon state changes so sessions re-create with updated tools). */
+export function invalidateMcpSessions(): void {
  for (const [sid, session] of sessions) {
-    if (session.userId === userId) {
-      try { session.server.close(); } catch { /* ignore */ }
-      try { session.transport.close(); } catch { /* ignore */ }
-      sessions.delete(sid);
-    }
+    try { session.server.close(); } catch { /* ignore */ }
+    try { session.transport.close(); } catch { /* ignore */ }
+    sessions.delete(sid);
  }
+  console.log('[MCP] All sessions invalidated due to addon state change');
 }

 /** Close all active MCP sessions (call during graceful shutdown). */
@@ -9,12 +9,13 @@ import { listReservations } from '../services/reservationService';
 import { listNotes as listDayNotes } from '../services/dayNoteService';
 import { listNotes as listCollabNotes, listPolls, listMessages } from '../services/collabService';
 import { listItems as listTodoItems } from '../services/todoService';
-import { listFiles } from '../services/fileService';
 import { listCategories } from '../services/categoryService';
 import { listBucketList, listVisitedCountries, getStats as getAtlasStats, listManuallyVisitedRegions } from '../services/atlasService';
 import { getNotifications } from '../services/inAppNotifications';
 import { getActivePlanId, getActivePlan, getPlanData, getEntries as getVacayEntries, getHolidays } from '../services/vacayService';
 import { isAddonEnabled } from '../services/adminService';
+import { ADDON_IDS } from '../addons';
+import { canRead, canReadTrips } from './scopes';

 function parseId(value: string | string[]): number | null {
  const n = Number(Array.isArray(value) ? value[0] : value);
@@ -31,6 +32,16 @@ function accessDenied(uri: string) {
  };
 }

+function scopeDenied(uri: string) {
+  return {
+    contents: [{
+      uri,
+      mimeType: 'application/json',
+      text: JSON.stringify({ error: 'Insufficient OAuth scope to access this resource' }),
+    }],
+  };
+}
+
 function jsonContent(uri: string, data: unknown) {
  return {
    contents: [{
@@ -41,9 +52,9 @@ function jsonContent(uri: string, data: unknown) {
  };
 }

-export function registerResources(server: McpServer, userId: number): void {
+export function registerResources(server: McpServer, userId: number, scopes: string[] | null): void {
  // List all accessible trips
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'trips',
    'trek://trips',
    { description: 'All trips the user owns or is a member of', mimeType: 'application/json' },
@@ -54,7 +65,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Single trip detail
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'trip',
    new ResourceTemplate('trek://trips/{tripId}', { list: undefined }),
    { description: 'A single trip with metadata and member count', mimeType: 'application/json' },
@@ -67,7 +78,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Days with assigned places
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'trip-days',
    new ResourceTemplate('trek://trips/{tripId}/days', { list: undefined }),
    { description: 'Days of a trip with their assigned places', mimeType: 'application/json' },
@@ -81,7 +92,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Places in a trip
-  server.registerResource(
+  if (canRead(scopes, 'places')) server.registerResource(
    'trip-places',
    new ResourceTemplate('trek://trips/{tripId}/places', { list: undefined }),
    { description: 'All places/POIs in a trip, optionally filtered by assignment status (e.g. ?assignment=unassigned)', mimeType: 'application/json' },
@@ -95,7 +106,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Budget items
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.BUDGET) && canRead(scopes, 'budget')) server.registerResource(
    'trip-budget',
    new ResourceTemplate('trek://trips/{tripId}/budget', { list: undefined }),
    { description: 'Budget and expense items for a trip', mimeType: 'application/json' },
@@ -108,7 +119,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Packing checklist
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.PACKING) && canRead(scopes, 'packing')) server.registerResource(
    'trip-packing',
    new ResourceTemplate('trek://trips/{tripId}/packing', { list: undefined }),
    { description: 'Packing checklist for a trip', mimeType: 'application/json' },
@@ -121,7 +132,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Reservations (flights, hotels, restaurants)
-  server.registerResource(
+  if (canRead(scopes, 'reservations')) server.registerResource(
    'trip-reservations',
    new ResourceTemplate('trek://trips/{tripId}/reservations', { list: undefined }),
    { description: 'Reservations (flights, hotels, restaurants) for a trip', mimeType: 'application/json' },
@@ -134,7 +145,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Day notes
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'day-notes',
    new ResourceTemplate('trek://trips/{tripId}/days/{dayId}/notes', { list: undefined }),
    { description: 'Notes for a specific day in a trip', mimeType: 'application/json' },
@@ -148,7 +159,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Accommodations (hotels, rentals) per trip
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'trip-accommodations',
    new ResourceTemplate('trek://trips/{tripId}/accommodations', { list: undefined }),
    { description: 'Accommodations (hotels, rentals) for a trip with check-in/out details', mimeType: 'application/json' },
@@ -161,7 +172,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Trip members (owner + collaborators)
-  server.registerResource(
+  if (canReadTrips(scopes)) server.registerResource(
    'trip-members',
    new ResourceTemplate('trek://trips/{tripId}/members', { list: undefined }),
    { description: 'Owner and collaborators of a trip', mimeType: 'application/json' },
@@ -176,7 +187,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Collab notes for a trip
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.COLLAB) && canRead(scopes, 'collab')) server.registerResource(
    'trip-collab-notes',
    new ResourceTemplate('trek://trips/{tripId}/collab-notes', { list: undefined }),
    { description: 'Shared collaborative notes for a trip', mimeType: 'application/json' },
@@ -188,21 +199,8 @@ export function registerResources(server: McpServer, userId: number): void {
    }
  );

-  // Trip files (active, not trash)
-  server.registerResource(
-    'trip-files',
-    new ResourceTemplate('trek://trips/{tripId}/files', { list: undefined }),
-    { description: 'Active files attached to a trip (excludes trash)', mimeType: 'application/json' },
-    async (uri, { tripId }) => {
-      const id = parseId(tripId);
-      if (id === null || !canAccessTrip(id, userId)) return accessDenied(uri.href);
-      const files = listFiles(id, false);
-      return jsonContent(uri.href, files);
-    }
-  );
-
  // Trip to-do list
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.PACKING) && canRead(scopes, 'todos')) server.registerResource(
    'trip-todos',
    new ResourceTemplate('trek://trips/{tripId}/todos', { list: undefined }),
    { description: 'To-do items for a trip, ordered by position', mimeType: 'application/json' },
@@ -214,7 +212,7 @@ export function registerResources(server: McpServer, userId: number): void {
    }
  );

-  // All place categories (global, no trip filter)
+  // All place categories (global, no trip filter) — safe for any authenticated session
  server.registerResource(
    'categories',
    'trek://categories',
@@ -226,7 +224,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // User's bucket list
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.ATLAS) && canRead(scopes, 'atlas')) server.registerResource(
    'bucket-list',
    'trek://bucket-list',
    { description: 'Your personal travel bucket list', mimeType: 'application/json' },
@@ -237,7 +235,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // User's visited countries
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.ATLAS) && canRead(scopes, 'atlas')) server.registerResource(
    'visited-countries',
    'trek://visited-countries',
    { description: 'Countries you have marked as visited in Atlas', mimeType: 'application/json' },
@@ -248,7 +246,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Budget per-person summary
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.BUDGET) && canRead(scopes, 'budget')) server.registerResource(
    'trip-budget-per-person',
    new ResourceTemplate('trek://trips/{tripId}/budget/per-person', { list: undefined }),
    { description: 'Per-person budget summary for a trip (total spent per member, split breakdown)', mimeType: 'application/json' },
@@ -261,7 +259,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Budget settlement
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.BUDGET) && canRead(scopes, 'budget')) server.registerResource(
    'trip-budget-settlement',
    new ResourceTemplate('trek://trips/{tripId}/budget/settlement', { list: undefined }),
    { description: 'Suggested settlement transactions to balance who owes whom', mimeType: 'application/json' },
@@ -274,7 +272,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Packing bags
-  server.registerResource(
+  if (isAddonEnabled(ADDON_IDS.PACKING) && canRead(scopes, 'packing')) server.registerResource(
    'trip-packing-bags',
    new ResourceTemplate('trek://trips/{tripId}/packing/bags', { list: undefined }),
    { description: 'All packing bags for a trip with their members', mimeType: 'application/json' },
@@ -287,7 +285,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // In-app notifications
-  server.registerResource(
+  if (canRead(scopes, 'notifications')) server.registerResource(
    'notifications-in-app',
    'trek://notifications/in-app',
    { description: "The current user's in-app notifications (most recent 50, unread first)", mimeType: 'application/json' },
@@ -298,7 +296,7 @@ export function registerResources(server: McpServer, userId: number): void {
  );

  // Atlas stats and regions (addon-gated)
-  if (isAddonEnabled('atlas')) {
+  if (isAddonEnabled(ADDON_IDS.ATLAS) && canRead(scopes, 'atlas')) {
    server.registerResource(
      'atlas-stats',
      'trek://atlas/stats',
@@ -321,7 +319,7 @@ export function registerResources(server: McpServer, userId: number): void {
  }

  // Collab polls & messages (addon-gated)
-  if (isAddonEnabled('collab')) {
+  if (isAddonEnabled(ADDON_IDS.COLLAB) && canRead(scopes, 'collab')) {
    server.registerResource(
      'trip-collab-polls',
      new ResourceTemplate('trek://trips/{tripId}/collab/polls', { list: undefined }),
@@ -348,7 +346,7 @@ export function registerResources(server: McpServer, userId: number): void {
  }

  // Vacay resources (addon-gated)
-  if (isAddonEnabled('vacay')) {
+  if (isAddonEnabled(ADDON_IDS.VACAY) && canRead(scopes, 'vacay')) {
    server.registerResource(
      'vacay-plan',
      'trek://vacay/plan',
@@ -0,0 +1,107 @@
+// ---------------------------------------------------------------------------
+// OAuth 2.1 scope definitions for TREK MCP
+// ---------------------------------------------------------------------------
+
+export const SCOPES = {
+  TRIPS_READ:          'trips:read',
+  TRIPS_WRITE:         'trips:write',
+  TRIPS_DELETE:        'trips:delete',
+  TRIPS_SHARE:         'trips:share',
+  PLACES_READ:         'places:read',
+  PLACES_WRITE:        'places:write',
+  ATLAS_READ:          'atlas:read',
+  ATLAS_WRITE:         'atlas:write',
+  PACKING_READ:        'packing:read',
+  PACKING_WRITE:       'packing:write',
+  TODOS_READ:          'todos:read',
+  TODOS_WRITE:         'todos:write',
+  BUDGET_READ:         'budget:read',
+  BUDGET_WRITE:        'budget:write',
+  RESERVATIONS_READ:   'reservations:read',
+  RESERVATIONS_WRITE:  'reservations:write',
+  COLLAB_READ:         'collab:read',
+  COLLAB_WRITE:        'collab:write',
+  NOTIFICATIONS_READ:  'notifications:read',
+  NOTIFICATIONS_WRITE: 'notifications:write',
+  VACAY_READ:          'vacay:read',
+  VACAY_WRITE:         'vacay:write',
+  GEO_READ:            'geo:read',
+  WEATHER_READ:        'weather:read',
+} as const;
+
+export type Scope = typeof SCOPES[keyof typeof SCOPES];
+
+export const ALL_SCOPES: Scope[] = Object.values(SCOPES) as Scope[];
+
+export interface ScopeInfo {
+  label: string;
+  description: string;
+  group: string;
+}
+
+export const SCOPE_INFO: Record<Scope, ScopeInfo> = {
+  'trips:read':          { label: 'View trips & itineraries',   description: 'Read trips, days, day notes, and members',                              group: 'Trips' },
+  'trips:write':         { label: 'Edit trips & itineraries',   description: 'Create and update trips, days, notes, and manage members',              group: 'Trips' },
+  'trips:delete':        { label: 'Delete trips',               description: 'Permanently delete entire trips — this action is irreversible',          group: 'Trips' },
+  'trips:share':         { label: 'Manage share links',         description: 'Create, update, and revoke public share links for trips',               group: 'Trips' },
+  'places:read':         { label: 'View places & map data',     description: 'Read places, day assignments, tags, and categories',                    group: 'Places' },
+  'places:write':        { label: 'Manage places',              description: 'Create, update, and delete places, assignments, and tags',              group: 'Places' },
+  'atlas:read':          { label: 'View Atlas',                 description: 'Read visited countries, regions, and bucket list',                      group: 'Atlas' },
+  'atlas:write':         { label: 'Manage Atlas',               description: 'Mark countries and regions visited, manage bucket list',                group: 'Atlas' },
+  'packing:read':        { label: 'View packing lists',         description: 'Read packing items, bags, and category assignees',                      group: 'Packing' },
+  'packing:write':       { label: 'Manage packing lists',       description: 'Add, update, delete, toggle, and reorder packing items and bags',       group: 'Packing' },
+  'todos:read':          { label: 'View to-do lists',           description: 'Read trip to-do items and category assignees',                          group: 'To-dos' },
+  'todos:write':         { label: 'Manage to-do lists',         description: 'Create, update, toggle, delete, and reorder to-do items',               group: 'To-dos' },
+  'budget:read':         { label: 'View budget',                description: 'Read budget items and expense breakdown',                               group: 'Budget' },
+  'budget:write':        { label: 'Manage budget',              description: 'Create, update, and delete budget items',                               group: 'Budget' },
+  'reservations:read':   { label: 'View reservations',          description: 'Read reservations and accommodation details',                           group: 'Reservations' },
+  'reservations:write':  { label: 'Manage reservations',        description: 'Create, update, delete, and reorder reservations',                     group: 'Reservations' },
+  'collab:read':         { label: 'View collaboration',         description: 'Read collab notes, polls, and messages',                               group: 'Collaboration' },
+  'collab:write':        { label: 'Manage collaboration',       description: 'Create, update, and delete collab notes, polls, and messages',          group: 'Collaboration' },
+  'notifications:read':  { label: 'View notifications',         description: 'Read in-app notifications and unread counts',                          group: 'Notifications' },
+  'notifications:write': { label: 'Manage notifications',       description: 'Mark notifications as read and respond to them',                       group: 'Notifications' },
+  'vacay:read':          { label: 'View vacation plans',        description: 'Read vacation planning data, entries, and stats',                      group: 'Vacation' },
+  'vacay:write':         { label: 'Manage vacation plans',      description: 'Create and manage vacation entries, holidays, and team plans',          group: 'Vacation' },
+  'geo:read':            { label: 'Maps & geocoding',           description: 'Search locations, resolve map URLs, and reverse geocode coordinates',  group: 'Geo' },
+  'weather:read':        { label: 'Weather forecasts',          description: 'Fetch weather forecasts for trip locations and dates',                  group: 'Weather' },
+};
+
+// ---------------------------------------------------------------------------
+// Scope enforcement helpers
+// null scopes = static trek_ token = full access
+// ---------------------------------------------------------------------------
+
+/** trips:read OR trips:write OR trips:delete OR trips:share all grant read access to trips */
+export function canReadTrips(scopes: string[] | null): boolean {
+  if (!scopes) return true;
+  return scopes.some(s => s === 'trips:read' || s === 'trips:write' || s === 'trips:delete' || s === 'trips:share');
+}
+
+/** group:write grants write access; for trips canReadTrips handles read */
+export function canWrite(scopes: string[] | null, group: string): boolean {
+  if (!scopes) return true;
+  return scopes.includes(`${group}:write`);
+}
+
+/** group:read OR group:write grant read access */
+export function canRead(scopes: string[] | null, group: string): boolean {
+  if (!scopes) return true;
+  return scopes.some(s => s === `${group}:read` || s === `${group}:write`);
+}
+
+/** trips:delete is a separate scope from trips:write */
+export function canDeleteTrips(scopes: string[] | null): boolean {
+  if (!scopes) return true;
+  return scopes.includes('trips:delete');
+}
+
+/** trips:share is a separate scope for managing public share links */
+export function canShareTrips(scopes: string[] | null): boolean {
+  if (!scopes) return true;
+  return scopes.includes('trips:share');
+}
+
+export function validateScopes(requestedScopes: string[]): { valid: boolean; invalid: string[] } {
+  const invalid = requestedScopes.filter(s => !ALL_SCOPES.includes(s as Scope));
+  return { valid: invalid.length === 0, invalid };
+}
@@ -0,0 +1,41 @@
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp';
+
+export interface McpSession {
+  server: McpServer;
+  transport: StreamableHTTPServerTransport;
+  userId: number;
+  /** null = static trek_ token or JWT (full access); string[] = OAuth 2.1 scopes */
+  scopes: string[] | null;
+  /** OAuth 2.1 client_id that owns this session; null for static-token / JWT sessions */
+  clientId: string | null;
+  /** true when authenticated via static trek_ token — triggers deprecation prompt */
+  isStaticToken: boolean;
+  lastActivity: number;
+}
+
+export const sessions = new Map<string, McpSession>();
+
+/** Terminate all active MCP sessions for a specific user (e.g. on token revocation). */
+export function revokeUserSessions(userId: number): void {
+  for (const [sid, session] of sessions) {
+    if (session.userId === userId) {
+      try { session.server.close(); } catch { /* ignore */ }
+      try { session.transport.close(); } catch { /* ignore */ }
+      sessions.delete(sid);
+    }
+  }
+}
+
+/** Terminate MCP sessions for a specific (user, OAuth client) pair.
+ *  Used when an OAuth token or session is revoked so only the affected client's
+ *  sessions are closed, not sessions from other clients for the same user. */
+export function revokeUserSessionsForClient(userId: number, clientId: string): void {
+  for (const [sid, session] of sessions) {
+    if (session.userId === userId && session.clientId === clientId) {
+      try { session.server.close(); } catch { /* ignore */ }
+      try { session.transport.close(); } catch { /* ignore */ }
+      sessions.delete(sid);
+    }
+  }
+}
@@ -15,34 +15,34 @@ import { registerTripTools } from './tools/trips';
 import { registerVacayTools } from './tools/vacay';
 import { registerMcpPrompts } from './tools/prompts';

-export function registerTools(server: McpServer, userId: number): void {
-  registerTripTools(server, userId);
+export function registerTools(server: McpServer, userId: number, scopes: string[] | null, isStaticToken = false, getDeprecationNotice: () => string | null = () => null): void {
+  registerTripTools(server, userId, scopes, getDeprecationNotice);

-  registerPlaceTools(server, userId);
+  registerPlaceTools(server, userId, scopes);

-  registerBudgetTools(server, userId);
+  registerBudgetTools(server, userId, scopes);

-  registerPackingTools(server, userId);
+  registerPackingTools(server, userId, scopes);

-  registerReservationTools(server, userId);
+  registerReservationTools(server, userId, scopes);

-  registerDayTools(server, userId);
+  registerDayTools(server, userId, scopes);

-  registerAssignmentTools(server, userId);
+  registerAssignmentTools(server, userId, scopes);

-  registerTagTools(server, userId);
+  registerTagTools(server, userId, scopes);

-  registerMapsWeatherTools(server, userId);
+  registerMapsWeatherTools(server, userId, scopes);

-  registerNotificationTools(server, userId);
+  registerNotificationTools(server, userId, scopes);

-  registerAtlasTools(server, userId);
+  registerAtlasTools(server, userId, scopes);

-  registerCollabTools(server, userId);
+  registerCollabTools(server, userId, scopes);

-  registerVacayTools(server, userId);
+  registerVacayTools(server, userId, scopes);

-  registerTodoTools(server, userId);
+  registerTodoTools(server, userId, scopes);

-  registerMcpPrompts(server, userId);
+  registerMcpPrompts(server, userId, isStaticToken);
 }
@@ -2,7 +2,7 @@ import { broadcast } from '../../websocket';

 export function safeBroadcast(tripId: number, event: string, payload: Record<string, unknown>): void {
  try {
-    broadcast(tripId, event, payload);
+    broadcast(tripId, event, { ...payload, _source: 'mcp' });
  } catch (err) {
    console.error(`[MCP] broadcast failed for ${event}:`, err?.message ?? err);
  }
@@ -15,11 +15,15 @@ import {
  TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerAssignmentTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'places');
+  const W = canWrite(scopes, 'places');

-export function registerAssignmentTools(server: McpServer, userId: number): void {
  // --- ASSIGNMENTS ---

-  server.registerTool(
+  if (W) server.registerTool(
    'assign_place_to_day',
    {
      description: 'Assign a place to a specific day in a trip.',
@@ -42,7 +46,7 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'unassign_place',
    {
      description: 'Remove a place assignment from a day.',
@@ -64,7 +68,7 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_assignment_time',
    {
      description: 'Set the start and/or end time for a place assignment on a day (e.g. "09:00", "11:30"). Pass null to clear a time.',
@@ -91,7 +95,7 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'move_assignment',
    {
      description: 'Move a place assignment to a different day.',
@@ -107,13 +111,15 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    async ({ tripId, assignmentId, newDayId, oldDayId, orderIndex }) => {
      if (isDemoUser(userId)) return demoDenied();
      if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!getAssignmentForTrip(assignmentId, tripId)) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
+      if (!getDay(newDayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
      const result = moveAssignment(assignmentId, newDayId, orderIndex ?? 0, oldDayId);
      safeBroadcast(tripId, 'assignment:moved', { assignment: result.assignment, oldDayId: result.oldDayId });
      return ok({ assignment: result.assignment });
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'get_assignment_participants',
    {
      description: 'Get the list of users participating in a specific place assignment.',
@@ -125,12 +131,13 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    },
    async ({ tripId, assignmentId }) => {
      if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!getAssignmentForTrip(assignmentId, tripId)) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
      const participants = getAssignmentParticipants(assignmentId);
      return ok({ participants });
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'set_assignment_participants',
    {
      description: 'Set the participants for a place assignment (replaces current list).',
@@ -144,6 +151,7 @@ export function registerAssignmentTools(server: McpServer, userId: number): void
    async ({ tripId, assignmentId, userIds }) => {
      if (isDemoUser(userId)) return demoDenied();
      if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!getAssignmentForTrip(assignmentId, tripId)) return { content: [{ type: 'text' as const, text: 'Assignment not found.' }], isError: true };
      const participants = setAssignmentParticipants(assignmentId, userIds);
      safeBroadcast(tripId, 'assignment:participants', { assignmentId, participants });
      return ok({ participants });
@@ -152,7 +160,7 @@ export function registerAssignmentTools(server: McpServer, userId: number): void

  // --- REORDER ---

-  server.registerTool(
+  if (W) server.registerTool(
    'reorder_day_assignments',
    {
      description: 'Reorder places within a day by providing the assignment IDs in the desired order.',
@@ -7,16 +7,23 @@ import {
  markRegionVisited, unmarkRegionVisited, getCountryPlaces, updateBucketItem,
 } from '../../services/atlasService';
 import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
 import {
  TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  TOOL_ANNOTATIONS_READONLY,
  demoDenied, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerAtlasTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'atlas');
+  const W = canWrite(scopes, 'atlas');
+
+  if (!isAddonEnabled(ADDON_IDS.ATLAS)) return;

-export function registerAtlasTools(server: McpServer, userId: number): void {
  // --- BUCKET LIST ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_bucket_list_item',
    {
      description: 'Add a destination to your personal travel bucket list.',
@@ -36,7 +43,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_bucket_list_item',
    {
      description: 'Remove an item from your travel bucket list.',
@@ -55,7 +62,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {

  // --- ATLAS ---

-  server.registerTool(
+  if (W) server.registerTool(
    'mark_country_visited',
    {
      description: 'Mark a country as visited in your Atlas.',
@@ -71,7 +78,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'unmark_country_visited',
    {
      description: 'Remove a country from your visited countries in Atlas.',
@@ -89,8 +96,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {

  // --- ATLAS EXPANDED ---

-  if (isAddonEnabled('atlas')) {
-    server.registerTool(
+  if (R) server.registerTool(
      'get_atlas_stats',
      {
        description: 'Get atlas statistics — total visited countries, region counts, continent breakdown.',
@@ -103,7 +109,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'list_visited_regions',
      {
        description: 'List all manually visited sub-country regions for the current user.',
@@ -116,7 +122,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'mark_region_visited',
      {
        description: 'Mark a sub-country region as visited.',
@@ -135,7 +141,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'unmark_region_visited',
      {
        description: 'Remove a region from the visited list.',
@@ -151,7 +157,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'get_country_atlas_places',
      {
        description: 'Get places saved in the user\'s atlas for a specific country.',
@@ -166,7 +172,7 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'update_bucket_list_item',
      {
        description: 'Update a bucket list item (notes, name, target date, location).',
@@ -188,5 +194,4 @@ export function registerAtlasTools(server: McpServer, userId: number): void {
        return ok({ item });
      }
    );
-  }
 }
@@ -12,11 +12,17 @@ import {
  TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canWrite } from '../scopes';
+import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';

-export function registerBudgetTools(server: McpServer, userId: number): void {
+export function registerBudgetTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const W = canWrite(scopes, 'budget');
+
+  if (isAddonEnabled(ADDON_IDS.BUDGET)) {
  // --- BUDGET ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_budget_item',
    {
      description: 'Add a budget/expense item to a trip.',
@@ -38,7 +44,7 @@ export function registerBudgetTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_budget_item',
    {
      description: 'Delete a budget item from a trip.',
@@ -60,7 +66,7 @@ export function registerBudgetTools(server: McpServer, userId: number): void {

  // --- BUDGET (update) ---

-  server.registerTool(
+  if (W) server.registerTool(
    'update_budget_item',
    {
      description: 'Update an existing budget/expense item in a trip.',
@@ -88,7 +94,7 @@ export function registerBudgetTools(server: McpServer, userId: number): void {

  // --- BUDGET ADVANCED ---

-  server.registerTool(
+  if (W) server.registerTool(
    'set_budget_item_members',
    {
      description: 'Set which trip members are splitting a budget item (replaces current member list).',
@@ -108,7 +114,7 @@ export function registerBudgetTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'toggle_budget_member_paid',
    {
      description: 'Mark or unmark a member as having paid their share of a budget item.',
@@ -128,4 +134,5 @@ export function registerBudgetTools(server: McpServer, userId: number): void {
      return ok({ member });
    }
  );
+  } // isAddonEnabled(BUDGET)
 }
@@ -8,16 +8,23 @@ import {
  listMessages, createMessage, deleteMessage, addOrRemoveReaction,
 } from '../../services/collabService';
 import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
 import {
  safeBroadcast, TOOL_ANNOTATIONS_WRITE, TOOL_ANNOTATIONS_DELETE,
  TOOL_ANNOTATIONS_NON_IDEMPOTENT, TOOL_ANNOTATIONS_READONLY,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerCollabTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'collab');
+  const W = canWrite(scopes, 'collab');
+
+  if (!isAddonEnabled(ADDON_IDS.COLLAB)) return;

-export function registerCollabTools(server: McpServer, userId: number): void {
  // --- COLLAB NOTES ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_collab_note',
    {
      description: 'Create a shared collaborative note on a trip (visible to all trip members in the Collab tab).',
@@ -40,7 +47,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_collab_note',
    {
      description: 'Edit an existing collaborative note on a trip.',
@@ -65,7 +72,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_collab_note',
    {
      description: 'Delete a collaborative note from a trip.',
@@ -87,9 +94,8 @@ export function registerCollabTools(server: McpServer, userId: number): void {

  // --- COLLAB POLLS & CHAT ---

-  if (isAddonEnabled('collab')) {
-    server.registerTool(
-      'list_collab_polls',
+  if (R) server.registerTool(
+    'list_collab_polls',
      {
        description: 'List all polls for a trip.',
        inputSchema: {
@@ -104,7 +110,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'create_collab_poll',
      {
        description: 'Create a new poll in the collab panel.',
@@ -126,7 +132,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'vote_collab_poll',
      {
        description: 'Vote on a poll option (or remove vote if already voted for that option).',
@@ -146,7 +152,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'close_collab_poll',
      {
        description: 'Close a poll so no more votes can be cast.',
@@ -166,7 +172,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'delete_collab_poll',
      {
        description: 'Delete a poll and all its votes.',
@@ -186,7 +192,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'list_collab_messages',
      {
        description: 'List chat messages for a trip (most recent 100, oldest-first).',
@@ -203,7 +209,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'send_collab_message',
      {
        description: "Send a chat message to a trip's collab channel.",
@@ -224,7 +230,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'delete_collab_message',
      {
        description: 'Delete a chat message (only the message owner can delete their own messages).',
@@ -244,7 +250,7 @@ export function registerCollabTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'react_collab_message',
      {
        description: 'Toggle a reaction emoji on a chat message (adds if not present, removes if already reacted).',
@@ -264,5 +270,4 @@ export function registerCollabTools(server: McpServer, userId: number): void {
        return ok({ reactions: result.reactions });
      }
    );
-  }
 }
@@ -16,8 +16,11 @@ import {
  TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canWrite } from '../scopes';
+
+export function registerDayTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  if (!canWrite(scopes, 'trips')) return;

-export function registerDayTools(server: McpServer, userId: number): void {
  // --- DAYS ---

  server.registerTool(
@@ -75,6 +78,7 @@ export function registerDayTools(server: McpServer, userId: number): void {
    async ({ tripId, dayId }) => {
      if (isDemoUser(userId)) return demoDenied();
      if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!getDay(dayId, tripId)) return { content: [{ type: 'text' as const, text: 'Day not found.' }], isError: true };
      deleteDay(dayId);
      safeBroadcast(tripId, 'day:deleted', { id: dayId });
      return ok({ success: true });
@@ -149,6 +153,7 @@ export function registerDayTools(server: McpServer, userId: number): void {
    async ({ tripId, accommodationId }) => {
      if (isDemoUser(userId)) return demoDenied();
      if (!canAccessTrip(tripId, userId)) return noAccess();
+      if (!getAccommodation(accommodationId, tripId)) return { content: [{ type: 'text' as const, text: 'Accommodation not found.' }], isError: true };
      const { linkedReservationId } = deleteAccommodation(accommodationId);
      safeBroadcast(tripId, 'accommodation:deleted', { id: accommodationId, linkedReservationId });
      return ok({ success: true, linkedReservationId });
@@ -6,11 +6,15 @@ import {
  TOOL_ANNOTATIONS_READONLY,
  ok,
 } from './_shared';
+import { canRead } from '../scopes';
+
+export function registerMapsWeatherTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const canGeo     = canRead(scopes, 'geo');
+  const canWeather = canRead(scopes, 'weather');

-export function registerMapsWeatherTools(server: McpServer, userId: number): void {
  // --- MAPS EXTRAS ---

-  server.registerTool(
+  if (canGeo) server.registerTool(
    'get_place_details',
    {
      description: 'Fetch detailed information about a place by its Google Place ID.',
@@ -27,7 +31,7 @@ export function registerMapsWeatherTools(server: McpServer, userId: number): voi
    }
  );

-  server.registerTool(
+  if (canGeo) server.registerTool(
    'reverse_geocode',
    {
      description: 'Get a human-readable address for given coordinates.',
@@ -45,7 +49,7 @@ export function registerMapsWeatherTools(server: McpServer, userId: number): voi
    }
  );

-  server.registerTool(
+  if (canGeo) server.registerTool(
    'resolve_maps_url',
    {
      description: 'Resolve a Google Maps share URL to coordinates and place name.',
@@ -63,7 +67,7 @@ export function registerMapsWeatherTools(server: McpServer, userId: number): voi

  // --- WEATHER ---

-  server.registerTool(
+  if (canWeather) server.registerTool(
    'get_weather',
    {
      description: 'Get weather forecast for a location and date.',
@@ -85,7 +89,7 @@ export function registerMapsWeatherTools(server: McpServer, userId: number): voi
    }
  );

-  server.registerTool(
+  if (canWeather) server.registerTool(
    'get_detailed_weather',
    {
      description: 'Get hourly/detailed weather forecast for a location and date.',
@@ -11,11 +11,15 @@ import {
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerNotificationTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'notifications');
+  const W = canWrite(scopes, 'notifications');

-export function registerNotificationTools(server: McpServer, userId: number): void {
  // --- NOTIFICATIONS ---

-  server.registerTool(
+  if (R) server.registerTool(
    'list_notifications',
    {
      description: 'List in-app notifications for the current user.',
@@ -32,7 +36,7 @@ export function registerNotificationTools(server: McpServer, userId: number): vo
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'get_unread_notification_count',
    {
      description: 'Get the number of unread in-app notifications.',
@@ -45,7 +49,7 @@ export function registerNotificationTools(server: McpServer, userId: number): vo
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'mark_notification_read',
    {
      description: 'Mark a single notification as read.',
@@ -62,7 +66,7 @@ export function registerNotificationTools(server: McpServer, userId: number): vo
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'mark_notification_unread',
    {
      description: 'Mark a single notification as unread.',
@@ -79,7 +83,7 @@ export function registerNotificationTools(server: McpServer, userId: number): vo
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'mark_all_notifications_read',
    {
      description: "Mark all of the current user's notifications as read.",
@@ -16,11 +16,19 @@ import {
  TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
+
+export function registerPackingTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'packing');
+  const W = canWrite(scopes, 'packing');
+
+  if (!isAddonEnabled(ADDON_IDS.PACKING)) return;

-export function registerPackingTools(server: McpServer, userId: number): void {
  // --- PACKING ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_packing_item',
    {
      description: 'Add an item to the packing checklist for a trip.',
@@ -40,7 +48,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'toggle_packing_item',
    {
      description: 'Check or uncheck a packing item.',
@@ -61,7 +69,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_packing_item',
    {
      description: 'Remove an item from the packing checklist.',
@@ -83,7 +91,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {

  // --- PACKING (update) ---

-  server.registerTool(
+  if (W) server.registerTool(
    'update_packing_item',
    {
      description: 'Rename a packing item or change its category.',
@@ -108,7 +116,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {

  // --- PACKING ADVANCED ---

-  server.registerTool(
+  if (W) server.registerTool(
    'reorder_packing_items',
    {
      description: 'Set the display order of packing items within a trip.',
@@ -127,7 +135,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'list_packing_bags',
    {
      description: 'List all packing bags for a trip.',
@@ -143,7 +151,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'create_packing_bag',
    {
      description: 'Create a new packing bag (e.g. "Carry-on", "Checked bag").',
@@ -163,7 +171,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_packing_bag',
    {
      description: 'Rename or recolor a packing bag.',
@@ -188,7 +196,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_packing_bag',
    {
      description: 'Delete a packing bag (items in the bag are unassigned, not deleted).',
@@ -207,7 +215,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'set_bag_members',
    {
      description: 'Assign trip members to a packing bag (determines who packs what bag).',
@@ -227,7 +235,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'get_packing_category_assignees',
    {
      description: 'Get which trip members are assigned to each packing category.',
@@ -243,7 +251,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'set_packing_category_assignees',
    {
      description: 'Assign trip members to a packing category.',
@@ -263,7 +271,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'apply_packing_template',
    {
      description: 'Apply a packing template to a trip (adds items from the template).',
@@ -283,7 +291,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'save_packing_template',
    {
      description: 'Save the current packing list as a reusable template.',
@@ -301,7 +309,7 @@ export function registerPackingTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'bulk_import_packing',
    {
      description: 'Import multiple packing items at once from a list.',
@@ -10,11 +10,15 @@ import {
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerPlaceTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'places');
+  const W = canWrite(scopes, 'places');

-export function registerPlaceTools(server: McpServer, userId: number): void {
  // --- PLACES ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_place',
    {
      description: 'Add a new place/POI to a trip. Set google_place_id or osm_id (from search_place) so the app can show opening hours and ratings.',
@@ -43,7 +47,7 @@ export function registerPlaceTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_place',
    {
      description: 'Update an existing place in a trip.',
@@ -80,7 +84,7 @@ export function registerPlaceTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_place',
    {
      description: 'Delete a place from a trip.',
@@ -100,7 +104,7 @@ export function registerPlaceTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'list_places',
    {
      description: 'List all places/POIs in a trip, optionally filtered by assignment status. Use assignment=unassigned to find orphan activities not yet scheduled on any day.',
@@ -122,7 +126,7 @@ export function registerPlaceTools(server: McpServer, userId: number): void {

  // --- CATEGORIES ---

-  server.registerTool(
+  if (R) server.registerTool(
    'list_categories',
    {
      description: 'List all available place categories with their id, name, icon and color. Use category_id when creating or updating places.',
@@ -137,7 +141,7 @@ export function registerPlaceTools(server: McpServer, userId: number): void {

  // --- SEARCH ---

-  server.registerTool(
+  if (R) server.registerTool(
    'search_place',
    {
      description: 'Search for a real-world place by name or address. Returns results with osm_id (and google_place_id if configured). Use these IDs when calling create_place so the app can display opening hours and ratings.',
@@ -3,8 +3,30 @@ import { z } from 'zod';
 import { canAccessTrip } from '../../db/database';
 import { getTripSummary } from '../../services/tripService';
 import { listItems as listPackingItems } from '../../services/packingService';
+import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';

-export function registerMcpPrompts(server: McpServer, _userId: number): void {
+export function registerMcpPrompts(server: McpServer, _userId: number, isStaticToken = false): void {
+  if (isStaticToken) {
+    server.registerPrompt(
+      'token_auth_notice',
+      {
+        title: 'Static Token Auth Notice',
+        description: 'Notification that this session uses a static API token which will be deprecated',
+        argsSchema: {},
+      },
+      async () => ({
+        description: 'Static token deprecation notice',
+        messages: [{
+          role: 'user' as const,
+          content: {
+            type: 'text' as const,
+            text: '⚠️ This MCP connection is authenticated with a static API token (trek_…). Static token authentication will be deprecated in a future version of TREK. Please inform the user that they should migrate to OAuth 2.1 by going to Settings → Integrations → MCP → OAuth Clients in TREK and registering an OAuth 2.1 application for their MCP client.',
+          },
+        }],
+      })
+    );
+  }
  const userId = _userId;

  server.registerPrompt(
@@ -43,7 +65,7 @@ ${days?.map((d: any, i: number) => `Day ${i + 1} (${d.date}): ${d.assignments?.l
    }
  );

-  server.registerPrompt(
+  if (isAddonEnabled(ADDON_IDS.PACKING)) server.registerPrompt(
    'packing-list',
    {
      title: 'Packing List',
@@ -77,7 +99,7 @@ ${days?.map((d: any, i: number) => `Day ${i + 1} (${d.date}): ${d.assignments?.l
    }
  );

-  server.registerPrompt(
+  if (isAddonEnabled(ADDON_IDS.BUDGET)) server.registerPrompt(
    'budget-overview',
    {
      title: 'Budget Overview',
@@ -13,8 +13,11 @@ import {
  TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canWrite } from '../scopes';
+
+export function registerReservationTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  if (!canWrite(scopes, 'reservations')) return;

-export function registerReservationTools(server: McpServer, userId: number): void {

  server.registerTool(
    'create_reservation',
@@ -1,17 +1,21 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp';
 import { z } from 'zod';
 import { isDemoUser } from '../../services/authService';
-import { listTags, createTag, updateTag, deleteTag } from '../../services/tagService';
+import { listTags, createTag, getTagByIdAndUser, updateTag, deleteTag } from '../../services/tagService';
 import {
  TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+
+export function registerTagTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'places');
+  const W = canWrite(scopes, 'places');

-export function registerTagTools(server: McpServer, userId: number): void {
  // --- TAGS ---

-  server.registerTool(
+  if (R) server.registerTool(
    'list_tags',
    {
      description: 'List all tags belonging to the current user.',
@@ -24,7 +28,7 @@ export function registerTagTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'create_tag',
    {
      description: 'Create a new tag (user-scoped label for places).',
@@ -41,7 +45,7 @@ export function registerTagTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_tag',
    {
      description: 'Update the name or color of an existing tag.',
@@ -54,13 +58,14 @@ export function registerTagTools(server: McpServer, userId: number): void {
    },
    async ({ tagId, name, color }) => {
      if (isDemoUser(userId)) return demoDenied();
+      if (!getTagByIdAndUser(tagId, userId)) return { content: [{ type: 'text' as const, text: 'Tag not found.' }], isError: true };
      const tag = updateTag(tagId, name, color);
      if (!tag) return { content: [{ type: 'text' as const, text: 'Tag not found.' }], isError: true };
      return ok({ tag });
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_tag',
    {
      description: 'Delete a tag (removes it from all places it was attached to).',
@@ -71,6 +76,7 @@ export function registerTagTools(server: McpServer, userId: number): void {
    },
    async ({ tagId }) => {
      if (isDemoUser(userId)) return demoDenied();
+      if (!getTagByIdAndUser(tagId, userId)) return { content: [{ type: 'text' as const, text: 'Tag not found.' }], isError: true };
      deleteTag(tagId);
      return ok({ success: true });
    }
@@ -12,11 +12,19 @@ import {
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';
+import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
+
+export function registerTodoTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'todos');
+  const W = canWrite(scopes, 'todos');
+
+  if (!isAddonEnabled(ADDON_IDS.PACKING)) return;

-export function registerTodoTools(server: McpServer, userId: number): void {
  // --- TODOS ---

-  server.registerTool(
+  if (R) server.registerTool(
    'list_todos',
    {
      description: 'List all to-do items for a trip, ordered by position.',
@@ -32,7 +40,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'create_todo',
    {
      description: 'Create a new to-do item for a trip.',
@@ -56,7 +64,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_todo',
    {
      description: 'Update an existing to-do item. Only provided fields are changed; omitted fields stay as-is. Pass null to clear a nullable field.',
@@ -88,7 +96,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'toggle_todo',
    {
      description: 'Mark a to-do item as checked (done) or unchecked.',
@@ -109,7 +117,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'delete_todo',
    {
      description: 'Delete a to-do item.',
@@ -129,7 +137,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'reorder_todos',
    {
      description: 'Reorder to-do items within a trip by providing a new ordered list of item IDs.',
@@ -147,7 +155,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'get_todo_category_assignees',
    {
      description: 'Get the default assignees configured per to-do category for a trip.',
@@ -163,7 +171,7 @@ export function registerTodoTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'set_todo_category_assignees',
    {
      description: 'Set the default assignees for a to-do category on a trip. Pass an empty array to clear.',
@@ -13,22 +13,28 @@ import {
  createOrUpdateShareLink, getShareLink, deleteShareLink,
 } from '../../services/shareService';
 import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
 import { countMessages, listPolls } from '../../services/collabService';
 import {
  listItems as listTodoItems,
 } from '../../services/todoService';
-import { listFiles } from '../../services/fileService';
 import {
  safeBroadcast, MAX_MCP_TRIP_DAYS,
  TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, noAccess, ok,
 } from './_shared';
+import { canRead, canReadTrips, canWrite, canDeleteTrips, canShareTrips } from '../scopes';
+
+export function registerTripTools(server: McpServer, userId: number, scopes: string[] | null, getDeprecationNotice: () => string | null = () => null): void {
+  const R = canReadTrips(scopes);
+  const W = canWrite(scopes, 'trips');
+  const D = canDeleteTrips(scopes);
+  const S = canShareTrips(scopes);

-export function registerTripTools(server: McpServer, userId: number): void {
  // --- TRIPS ---

-  server.registerTool(
+  if (W) server.registerTool(
    'create_trip',
    {
      description: 'Create a new trip. Returns the created trip with its generated days.',
@@ -61,7 +67,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'update_trip',
    {
      description: 'Update an existing trip\'s details.',
@@ -94,7 +100,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (D) server.registerTool(
    'delete_trip',
    {
      description: 'Delete a trip. Only the trip owner can delete it.',
@@ -111,6 +117,8 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

+  // list_trips and get_trip_summary are always registered regardless of OAuth scopes —
+  // they are navigation tools that any MCP client needs to discover trip IDs.
  server.registerTool(
    'list_trips',
    {
@@ -121,7 +129,15 @@ export function registerTripTools(server: McpServer, userId: number): void {
      annotations: TOOL_ANNOTATIONS_READONLY,
    },
    async ({ include_archived }) => {
+      const notice = getDeprecationNotice();
      const trips = listTrips(userId, include_archived ? null : 0);
+      if (notice) return {
+        isError: true as const,
+        content: [
+          { type: 'text' as const, text: notice },
+          { type: 'text' as const, text: JSON.stringify({ trips }, null, 2) },
+        ],
+      };
      return ok({ trips });
    }
  );
@@ -131,7 +147,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
  server.registerTool(
    'get_trip_summary',
    {
-      description: 'Get a full denormalized summary of a trip in a single call: metadata, members, days with assignments and notes, accommodations, full budget line items with totals, full packing list with checked status, reservations, collab notes, to-do items, files, and collab poll/message counts. Use this as a context loader before planning or modifying a trip.',
+      description: 'Get a full denormalized summary of a trip in a single call: metadata, members, days with assignments and notes, accommodations, budget line items (when enabled), packing list (when enabled), reservations, collab notes and poll/message counts (when enabled), and to-do items (when enabled). Use this as a context loader before planning or modifying a trip.',
      inputSchema: {
        tripId: z.number().int().positive(),
      },
@@ -141,31 +157,59 @@ export function registerTripTools(server: McpServer, userId: number): void {
      if (!canAccessTrip(tripId, userId)) return noAccess();
      const summary = getTripSummary(tripId);
      if (!summary) return noAccess();
-      const todos = listTodoItems(tripId);
-      const files = listFiles(tripId, false).map((f: any) => ({
-        id: f.id,
-        original_name: f.original_name,
-        mime_type: f.mime_type,
-        file_size: f.file_size,
-        starred: !!f.starred,
-        deleted: !!f.deleted_at,
-        created_at: f.created_at,
-      }));
+      // Addon availability gates
+      const packingEnabled = isAddonEnabled(ADDON_IDS.PACKING);
+      const budgetEnabled  = isAddonEnabled(ADDON_IDS.BUDGET);
+      const collabEnabled  = isAddonEnabled(ADDON_IDS.COLLAB);
+      // Scope gates — sections not covered by the client's OAuth scopes are omitted.
+      // Core trip data (metadata, days, members, accommodations) is always included
+      // because this tool is always registered and needed for navigation.
+      const canReadBudget  = budgetEnabled  && canRead(scopes, 'budget');
+      const canReadPacking = packingEnabled && canRead(scopes, 'packing');
+      const canReadCollab  = collabEnabled  && canRead(scopes, 'collab');
+      const canReadTodos   = packingEnabled && canRead(scopes, 'todos');
+      const canReadRes     = canRead(scopes, 'reservations');
+      const todos = canReadTodos ? listTodoItems(tripId) : [];
      let pollCount = 0;
-      if (isAddonEnabled('collab')) {
-        pollCount = listPolls(tripId).length;
-      }
      let messageCount = 0;
-      if (isAddonEnabled('collab')) {
+      if (canReadCollab) {
+        pollCount    = listPolls(tripId).length;
        messageCount = countMessages(tripId);
      }
-      return ok({ ...summary, todos, files, pollCount, messageCount });
+      const notice = getDeprecationNotice();
+      const data = {
+        ...summary,
+        reservations:  canReadRes     ? summary.reservations  : undefined,
+        packing:       canReadPacking ? summary.packing        : undefined,
+        budget:        canReadBudget  ? summary.budget         : undefined,
+        collab_notes:  canReadCollab  ? summary.collab_notes   : [],
+        todos,
+        pollCount,
+        messageCount,
+      };
+      if (notice) return {
+        isError: true as const,
+        content: [
+          { type: 'text' as const, text: notice },
+          { type: 'text' as const, text: JSON.stringify(data, null, 2) },
+        ],
+      };
+      return ok({
+        ...summary,
+        reservations:  canReadRes     ? summary.reservations  : undefined,
+        packing:       canReadPacking ? summary.packing        : undefined,
+        budget:        canReadBudget  ? summary.budget         : undefined,
+        collab_notes:  canReadCollab  ? summary.collab_notes   : [],
+        todos,
+        pollCount,
+        messageCount,
+      });
    }
  );

  // --- TRIP MEMBERS, COPY, ICS, SHARE ---

-  server.registerTool(
+  if (R) server.registerTool(
    'list_trip_members',
    {
      description: 'List all members of a trip (owner + collaborators).',
@@ -183,7 +227,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'add_trip_member',
    {
      description: 'Add a user to a trip by their username or email address. Only the trip owner can do this.',
@@ -210,7 +254,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'remove_trip_member',
    {
      description: 'Remove a member from a trip. Only the trip owner can do this.',
@@ -232,7 +276,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (W) server.registerTool(
    'copy_trip',
    {
      description: 'Duplicate a trip (all days, places, itinerary, packing, budget, reservations, day notes). Packing items are reset to unchecked. Returns the new trip.',
@@ -255,7 +299,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (R) server.registerTool(
    'export_trip_ics',
    {
      description: 'Export a trip\'s itinerary and reservations as iCalendar (.ics) format text. Useful for importing into calendar apps.',
@@ -275,7 +319,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (S) server.registerTool(
    'get_share_link',
    {
      description: 'Get the current public share link for a trip, including its permission flags. Returns null if no share link exists.',
@@ -291,7 +335,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (S) server.registerTool(
    'create_share_link',
    {
      description: 'Create or update the public share link for a trip. Set permission flags to control what is visible to guests.',
@@ -319,7 +363,7 @@ export function registerTripTools(server: McpServer, userId: number): void {
    }
  );

-  server.registerTool(
+  if (S) server.registerTool(
    'delete_share_link',
    {
      description: 'Revoke the public share link for a trip. Guests will no longer be able to access the shared view.',
@@ -13,15 +13,20 @@ import {
  getCountries as getHolidayCountries, getHolidays,
 } from '../../services/vacayService';
 import { isAddonEnabled } from '../../services/adminService';
+import { ADDON_IDS } from '../../addons';
 import {
  TOOL_ANNOTATIONS_READONLY, TOOL_ANNOTATIONS_WRITE,
  TOOL_ANNOTATIONS_DELETE, TOOL_ANNOTATIONS_NON_IDEMPOTENT,
  demoDenied, ok,
 } from './_shared';
+import { canRead, canWrite } from '../scopes';

-export function registerVacayTools(server: McpServer, userId: number): void {
-  if (isAddonEnabled('vacay')) {
-    server.registerTool(
+export function registerVacayTools(server: McpServer, userId: number, scopes: string[] | null): void {
+  const R = canRead(scopes, 'vacay');
+  const W = canWrite(scopes, 'vacay');
+
+  if (isAddonEnabled(ADDON_IDS.VACAY)) {
+    if (R) server.registerTool(
      'get_vacay_plan',
      {
        description: "Get the current user's active vacation plan (own or joined).",
@@ -34,7 +39,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'update_vacay_plan',
      {
        description: 'Update vacation plan settings (weekends blocking, holidays, carry-over).',
@@ -55,7 +60,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'set_vacay_color',
      {
        description: "Set the current user's color in the vacation plan calendar.",
@@ -72,7 +77,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'get_available_vacay_users',
      {
        description: 'List users who can be invited to the current vacation plan.',
@@ -86,7 +91,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'send_vacay_invite',
      {
        description: 'Invite a user to join the vacation plan by their user ID.',
@@ -106,7 +111,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'accept_vacay_invite',
      {
        description: 'Accept a pending invitation to join another user\'s vacation plan.',
@@ -123,7 +128,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'decline_vacay_invite',
      {
        description: 'Decline a pending vacation plan invitation.',
@@ -138,7 +143,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'cancel_vacay_invite',
      {
        description: 'Cancel an outgoing invitation (owner cancels invite they sent).',
@@ -155,7 +160,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'dissolve_vacay_plan',
      {
        description: 'Dissolve the shared plan — all members are removed and everyone returns to their own individual plan.',
@@ -169,7 +174,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'list_vacay_years',
      {
        description: 'List calendar years tracked in the current vacation plan.',
@@ -183,7 +188,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'add_vacay_year',
      {
        description: 'Add a calendar year to the vacation plan.',
@@ -200,7 +205,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'delete_vacay_year',
      {
        description: 'Remove a calendar year from the vacation plan.',
@@ -217,7 +222,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'get_vacay_entries',
      {
        description: 'Get all vacation day entries for a plan and year.',
@@ -233,7 +238,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'toggle_vacay_entry',
      {
        description: 'Toggle a day on or off as a vacation day for the current user.',
@@ -250,7 +255,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'toggle_company_holiday',
      {
        description: 'Toggle a date as a company holiday for the whole plan.',
@@ -268,7 +273,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'get_vacay_stats',
      {
        description: 'Get vacation statistics for a specific year (days used, remaining, carried over).',
@@ -284,7 +289,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'update_vacay_stats',
      {
        description: 'Update the vacation day allowance for a specific user and year.',
@@ -302,7 +307,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'add_holiday_calendar',
      {
        description: 'Add a public holiday calendar (by region code) to the vacation plan.',
@@ -322,7 +327,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'update_holiday_calendar',
      {
        description: 'Update label or color for a holiday calendar.',
@@ -342,7 +347,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (W) server.registerTool(
      'delete_holiday_calendar',
      {
        description: 'Remove a holiday calendar from the vacation plan.',
@@ -359,7 +364,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'list_holiday_countries',
      {
        description: 'List countries available for public holiday calendars.',
@@ -373,7 +378,7 @@ export function registerVacayTools(server: McpServer, userId: number): void {
      }
    );

-    server.registerTool(
+    if (R) server.registerTool(
      'list_holidays',
      {
        description: 'List public holidays for a country and year.',
@@ -12,6 +12,18 @@ export function extractToken(req: Request): string | null {
  return (authHeader && authHeader.split(' ')[1]) || null;
 }

+function verifyJwtAndLoadUser(token: string): User | null {
+  try {
+    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
+    const user = db.prepare(
+      'SELECT id, username, email, role FROM users WHERE id = ?'
+    ).get(decoded.id) as User | undefined;
+    return user ?? null;
+  } catch {
+    return null;
+  }
+}
+
 const authenticate = (req: Request, res: Response, next: NextFunction): void => {
  const token = extractToken(req);

@@ -20,20 +32,31 @@ const authenticate = (req: Request, res: Response, next: NextFunction): void =>
    return;
  }

-  try {
-    const decoded = jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }) as { id: number };
-    const user = db.prepare(
-      'SELECT id, username, email, role FROM users WHERE id = ?'
-    ).get(decoded.id) as User | undefined;
-    if (!user) {
-      res.status(401).json({ error: 'User not found', code: 'AUTH_REQUIRED' });
-      return;
-    }
-    (req as AuthRequest).user = user;
-    next();
-  } catch (err: unknown) {
+  const user = verifyJwtAndLoadUser(token);
+  if (!user) {
    res.status(401).json({ error: 'Invalid or expired token', code: 'AUTH_REQUIRED' });
+    return;
  }
+  (req as AuthRequest).user = user;
+  next();
+};
+
+/** Like `authenticate` but rejects requests that don't carry an httpOnly session cookie.
+ *  Used on state-mutating OAuth endpoints (consent POST, client CRUD, session revoke)
+ *  to prevent Bearer JWT tokens obtained by other means from managing OAuth clients. */
+const requireCookieAuth = (req: Request, res: Response, next: NextFunction): void => {
+  const cookieToken = (req as any).cookies?.trek_session;
+  if (!cookieToken) {
+    res.status(401).json({ error: 'Cookie session required for this endpoint', code: 'COOKIE_AUTH_REQUIRED' });
+    return;
+  }
+  const user = verifyJwtAndLoadUser(cookieToken);
+  if (!user) {
+    res.status(401).json({ error: 'Invalid or expired session', code: 'AUTH_REQUIRED' });
+    return;
+  }
+  (req as AuthRequest).user = user;
+  next();
 };

 const optionalAuth = (req: Request, res: Response, next: NextFunction): void => {
@@ -74,4 +97,4 @@ const demoUploadBlock = (req: Request, res: Response, next: NextFunction): void
  next();
 };

-export { authenticate, optionalAuth, adminOnly, demoUploadBlock };
+export { authenticate, requireCookieAuth, optionalAuth, adminOnly, demoUploadBlock };
@@ -3,6 +3,7 @@ import { authenticate, adminOnly } from '../middleware/auth';
 import { AuthRequest } from '../types';
 import { writeAudit, getClientIp, logInfo } from '../services/auditLog';
 import * as svc from '../services/adminService';
+import { invalidateMcpSessions } from '../mcp';
 import { getPreferencesMatrix, setAdminPreferences } from '../services/notificationPreferencesService';

 const router = express.Router();
@@ -292,6 +293,8 @@ router.put('/addons/:id', (req: Request, res: Response) => {
    ip: getClientIp(req),
    details: result.auditDetails,
  });
+  // Invalidate all MCP sessions so they re-create with the updated addon tool set
+  invalidateMcpSessions();
  res.json({ addon: result.addon });
 });

@@ -307,6 +310,25 @@ router.delete('/mcp-tokens/:id', (req: Request, res: Response) => {
  res.json({ success: true });
 });

+// ── OAuth Sessions ─────────────────────────────────────────────────────────
+
+router.get('/oauth-sessions', (_req: Request, res: Response) => {
+  res.json({ sessions: svc.listOAuthSessions() });
+});
+
+router.delete('/oauth-sessions/:id', (req: Request, res: Response) => {
+  const result = svc.revokeOAuthSession(req.params.id);
+  if ('error' in result) return res.status(result.status!).json({ error: result.error });
+  const authReq = req as AuthRequest;
+  writeAudit({
+    userId: authReq.user.id,
+    action: 'admin.oauth_session.revoke',
+    resource: String(req.params.id),
+    ip: getClientIp(req),
+  });
+  res.json({ success: true });
+});
+
 // ── JWT Rotation ───────────────────────────────────────────────────────────

 router.post('/rotate-jwt-secret', (req: Request, res: Response) => {
@@ -314,12 +336,8 @@ router.post('/rotate-jwt-secret', (req: Request, res: Response) => {
  if (result.error) return res.status(result.status!).json({ error: result.error });
  const authReq = req as AuthRequest;
  writeAudit({
-    user_id: authReq.user?.id ?? null,
-    username: authReq.user?.username ?? 'unknown',
+    userId: authReq.user.id,
    action: 'admin.rotate_jwt_secret',
-    target_type: 'system',
-    target_id: null,
-    details: null,
    ip: getClientIp(req),
  });
  res.json({ success: true });
@@ -36,12 +36,13 @@ router.put('/settings', authenticate, async (req: Request, res: Response) => {
    const synology_url = _parseStringBodyField(body.synology_url);
    const synology_username = _parseStringBodyField(body.synology_username);
    const synology_password = _parseStringBodyField(body.synology_password);
+    const synology_skip_ssl = body.synology_skip_ssl === true || body.synology_skip_ssl === 'true';

    if (!synology_url || !synology_username) {
        handleServiceResult(res, fail('URL and username are required', 400));
    }
    else {
-        handleServiceResult(res, await updateSynologySettings(authReq.user.id, synology_url, synology_username, synology_password));
+        handleServiceResult(res, await updateSynologySettings(authReq.user.id, synology_url, synology_username, synology_password, synology_skip_ssl));
    }
 });

@@ -51,10 +52,13 @@ router.get('/status', authenticate, async (req: Request, res: Response) => {
 });

 router.post('/test', authenticate, async (req: Request, res: Response) => {
+    const authReq = req as AuthRequest;
    const body = req.body as Record<string, unknown>;
    const synology_url = _parseStringBodyField(body.synology_url);
    const synology_username = _parseStringBodyField(body.synology_username);
    const synology_password = _parseStringBodyField(body.synology_password);
+    const synology_otp = _parseStringBodyField(body.synology_otp);
+    const synology_skip_ssl = body.synology_skip_ssl === true || body.synology_skip_ssl === 'true';

    if (!synology_url || !synology_username || !synology_password) {
        const missingFields: string[] = [];
@@ -64,7 +68,7 @@ router.post('/test', authenticate, async (req: Request, res: Response) => {
        handleServiceResult(res, success({ connected: false, error: `${missingFields.join(', ')} ${missingFields.length > 1 ? 'are' : 'is'} required` }));
    }
    else{
-        handleServiceResult(res, await testSynologyConnection(synology_url, synology_username, synology_password));
+        handleServiceResult(res, await testSynologyConnection(authReq.user.id, synology_url, synology_username, synology_password, synology_otp, synology_skip_ssl));
    }
 });

@@ -0,0 +1,420 @@
+import express, { Request, Response } from 'express';
+import { authenticate, requireCookieAuth, optionalAuth } from '../middleware/auth';
+import { AuthRequest, OptionalAuthRequest } from '../types';
+import { isAddonEnabled } from '../services/adminService';
+import { ALL_SCOPES, SCOPE_INFO } from '../mcp/scopes';
+import { ADDON_IDS } from '../addons';
+import {
+  validateAuthorizeRequest,
+  createAuthCode,
+  consumeAuthCode,
+  saveConsent,
+  issueTokens,
+  refreshTokens,
+  revokeToken,
+  verifyPKCE,
+  authenticateClient,
+  isValidRedirectUri,
+  listOAuthClients,
+  createOAuthClient,
+  deleteOAuthClient,
+  rotateOAuthClientSecret,
+  listOAuthSessions,
+  revokeSession,
+  AuthorizeParams,
+} from '../services/oauthService';
+import { getAppUrl } from '../services/oidcService';
+import { writeAudit, getClientIp, logWarn } from '../services/auditLog';
+
+// ---------------------------------------------------------------------------
+// Minimal in-file rate limiter (same pattern as auth.ts)
+// ---------------------------------------------------------------------------
+
+interface RateEntry { count: number; first: number; }
+
+function makeRateLimiter(maxAttempts: number, windowMs: number, keyFn: (req: Request) => string) {
+  const store = new Map<string, RateEntry>();
+  setInterval(() => {
+    const now = Date.now();
+    for (const [k, r] of store) if (now - r.first >= windowMs) store.delete(k);
+  }, windowMs).unref();
+
+  return (req: Request, res: Response, next: () => void): void => {
+    const key = keyFn(req);
+    const now = Date.now();
+    const record = store.get(key);
+    if (record && record.count >= maxAttempts && now - record.first < windowMs) {
+      res.status(429).json({ error: 'too_many_requests', error_description: 'Too many attempts. Please try again later.' });
+      return;
+    }
+    if (!record || now - record.first >= windowMs) {
+      store.set(key, { count: 1, first: now });
+    } else {
+      record.count++;
+    }
+    next();
+  };
+}
+
+const tokenLimiter    = makeRateLimiter(30, 60_000, (req) => `${req.ip}|${req.body?.client_id ?? ''}`);
+const validateLimiter = makeRateLimiter(30, 60_000, (req) => req.ip ?? 'unknown');
+const revokeLimiter   = makeRateLimiter(10, 60_000, (req) => req.ip ?? 'unknown');
+const dcrLimiter      = makeRateLimiter(10, 60_000, (req) => req.ip ?? 'unknown');
+
+// ---------------------------------------------------------------------------
+// Public router: /.well-known, /oauth/token, /oauth/revoke
+// ---------------------------------------------------------------------------
+
+export const oauthPublicRouter = express.Router();
+
+// RFC 8414 discovery document
+oauthPublicRouter.get('/.well-known/oauth-authorization-server', (req: Request, res: Response) => {
+  // M2: return 404 (not 403) so feature presence isn't fingerprinted
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
+
+  const base = (getAppUrl() || '').replace(/\/+$/, '');
+  res.json({
+    issuer:                                base,
+    authorization_endpoint:                `${base}/oauth/authorize`,
+    token_endpoint:                        `${base}/oauth/token`,
+    revocation_endpoint:                   `${base}/oauth/revoke`,
+    registration_endpoint:                 `${base}/oauth/register`,
+    response_types_supported:              ['code'],
+    grant_types_supported:                 ['authorization_code', 'refresh_token'],
+    code_challenge_methods_supported:      ['S256'],
+    token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
+    scopes_supported:                      ALL_SCOPES,
+    scope_descriptions:                    Object.fromEntries(
+      ALL_SCOPES.map(s => [s, SCOPE_INFO[s].label])
+    ),
+  });
+});
+
+// Token endpoint — handles authorization_code and refresh_token grants
+oauthPublicRouter.post('/oauth/token', tokenLimiter, (req: Request, res: Response) => {
+  // M1: RFC 6749 §5.1 — token responses must not be cached
+  res.set('Cache-Control', 'no-store');
+  res.set('Pragma', 'no-cache');
+
+  // Accept both JSON and application/x-www-form-urlencoded
+  const body: Record<string, string> = typeof req.body === 'object' ? req.body : {};
+  const { grant_type, code, redirect_uri, client_id, client_secret, code_verifier, refresh_token } = body;
+  const ip = getClientIp(req);
+
+  if (!isAddonEnabled(ADDON_IDS.MCP)) {
+    return res.status(403).json({ error: 'mcp_disabled', error_description: 'MCP is not enabled' });
+  }
+
+  if (!client_id) {
+    return res.status(401).json({ error: 'invalid_client', error_description: 'client_id is required' });
+  }
+
+  // ---- authorization_code grant ----
+  if (grant_type === 'authorization_code') {
+    if (!code || !redirect_uri || !code_verifier) {
+      return res.status(400).json({ error: 'invalid_request', error_description: 'code, redirect_uri, and code_verifier are required' });
+    }
+
+    const pending = consumeAuthCode(code);
+
+    // H5: collapse all invalid_grant cases to one message; log specifics server-side
+    if (!pending) {
+      writeAudit({ userId: null, action: 'oauth.token.grant_failed', details: { client_id, reason: 'code_invalid_or_expired' }, ip });
+      return res.status(400).json({ error: 'invalid_grant', error_description: 'Authorization grant is invalid.' });
+    }
+
+    if (pending.clientId !== client_id) {
+      writeAudit({ userId: pending.userId, action: 'oauth.token.grant_failed', details: { client_id, reason: 'client_id_mismatch' }, ip });
+      return res.status(400).json({ error: 'invalid_grant', error_description: 'Authorization grant is invalid.' });
+    }
+
+    if (pending.redirectUri !== redirect_uri) {
+      writeAudit({ userId: pending.userId, action: 'oauth.token.grant_failed', details: { client_id, reason: 'redirect_uri_mismatch' }, ip });
+      return res.status(400).json({ error: 'invalid_grant', error_description: 'Authorization grant is invalid.' });
+    }
+
+    // Verify client secret
+    if (!authenticateClient(client_id, client_secret)) {
+      logWarn(`[OAuth] Invalid client credentials for client_id=${client_id} ip=${ip ?? '-'}`);
+      writeAudit({ userId: pending.userId, action: 'oauth.token.client_auth_failed', details: { client_id }, ip });
+      return res.status(401).json({ error: 'invalid_client', error_description: 'Invalid client credentials' });
+    }
+
+    // Verify PKCE
+    if (!verifyPKCE(code_verifier, pending.codeChallenge)) {
+      writeAudit({ userId: pending.userId, action: 'oauth.token.grant_failed', details: { client_id, reason: 'pkce_failed' }, ip });
+      return res.status(400).json({ error: 'invalid_grant', error_description: 'Authorization grant is invalid.' });
+    }
+
+    const tokens = issueTokens(client_id, pending.userId, pending.scopes);
+    writeAudit({ userId: pending.userId, action: 'oauth.token.issue', details: { client_id, scopes: pending.scopes }, ip });
+    return res.json(tokens);
+  }
+
+  // ---- refresh_token grant ----
+  if (grant_type === 'refresh_token') {
+    if (!refresh_token) {
+      return res.status(400).json({ error: 'invalid_request', error_description: 'refresh_token is required' });
+    }
+
+    const result = refreshTokens(refresh_token, client_id, client_secret, ip);
+    if (result.error) {
+      if (result.error === 'invalid_client') {
+        logWarn(`[OAuth] Invalid client credentials on refresh for client_id=${client_id} ip=${ip ?? '-'}`);
+      }
+      return res.status(result.status || 400).json({
+        error: result.error,
+        error_description: result.error === 'invalid_client' ? 'Invalid client credentials' : 'Refresh token is invalid or expired',
+      });
+    }
+
+    return res.json(result.tokens);
+  }
+
+  return res.status(400).json({ error: 'unsupported_grant_type', error_description: `Unsupported grant_type: ${grant_type}` });
+});
+
+// RFC 7591 Dynamic Client Registration endpoint
+oauthPublicRouter.post('/oauth/register', dcrLimiter, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
+
+  const body: Record<string, unknown> = typeof req.body === 'object' && req.body !== null ? req.body : {};
+  const ip = getClientIp(req);
+
+  const redirectUris: string[] = Array.isArray(body.redirect_uris) ? body.redirect_uris.filter((u): u is string => typeof u === 'string') : [];
+  if (redirectUris.length === 0) {
+    return res.status(400).json({ error: 'invalid_redirect_uri', error_description: 'redirect_uris is required and must be a non-empty array' });
+  }
+
+  const rawName = typeof body.client_name === 'string' ? body.client_name.trim().slice(0, 100) : '';
+  const clientName = rawName || 'MCP Client';
+
+  // Determine if the client wants to be public (no secret) — MCP clients typically use PKCE only
+  const authMethod = typeof body.token_endpoint_auth_method === 'string' ? body.token_endpoint_auth_method : 'client_secret_post';
+  const isPublic = authMethod === 'none';
+
+  // Resolve requested scopes — scope is required; no implicit full-access grant
+  if (typeof body.scope !== 'string' || body.scope.trim() === '') {
+    return res.status(400).json({ error: 'invalid_client_metadata', error_description: 'scope is required' });
+  }
+  const rawScope = body.scope;
+  const requestedScopes = rawScope.split(' ').filter(s => (ALL_SCOPES as string[]).includes(s));
+  if (requestedScopes.length === 0) {
+    return res.status(400).json({ error: 'invalid_client_metadata', error_description: 'No valid scopes requested' });
+  }
+
+  const result = createOAuthClient(null, clientName, redirectUris, requestedScopes, ip, {
+    isPublic,
+    createdVia: 'dcr',
+  });
+
+  if (result.error) {
+    return res.status(result.status || 400).json({ error: 'invalid_client_metadata', error_description: result.error });
+  }
+
+  const client = result.client!;
+  const now = Math.floor(Date.now() / 1000);
+
+  return res.status(201).json({
+    client_id:                     client.client_id,
+    ...(client.client_secret      ? { client_secret: client.client_secret, client_secret_expires_at: 0 } : {}),
+    client_id_issued_at:           now,
+    redirect_uris:                 client.redirect_uris,
+    grant_types:                   ['authorization_code', 'refresh_token'],
+    response_types:                ['code'],
+    scope:                         (client.allowed_scopes as string[]).join(' '),
+    client_name:                   client.name,
+    token_endpoint_auth_method:    isPublic ? 'none' : 'client_secret_post',
+  });
+});
+
+// Token revocation endpoint (RFC 7009)
+oauthPublicRouter.post('/oauth/revoke', revokeLimiter, (req: Request, res: Response) => {
+  // M2: return 404 when MCP is disabled
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
+
+  const body: Record<string, string> = typeof req.body === 'object' ? req.body : {};
+  const { token, client_id, client_secret } = body;
+  const ip = getClientIp(req);
+
+  if (!token || !client_id) {
+    return res.status(400).json({ error: 'invalid_request', error_description: 'token and client_id are required' });
+  }
+
+  if (!authenticateClient(client_id, client_secret)) {
+    logWarn(`[OAuth] Invalid client credentials on revoke for client_id=${client_id} ip=${ip ?? '-'}`);
+    writeAudit({ userId: null, action: 'oauth.token.client_auth_failed', details: { client_id, endpoint: 'revoke' }, ip });
+    return res.status(401).json({ error: 'invalid_client', error_description: 'Invalid client credentials' });
+  }
+
+  revokeToken(token, client_id, undefined, ip);
+  // RFC 7009 §2.2: always respond 200 even if token was already revoked or not found
+  return res.status(200).json({});
+});
+
+// ---------------------------------------------------------------------------
+// API router: /api/oauth/* — authenticated endpoints used by the SPA
+// ---------------------------------------------------------------------------
+
+export const oauthApiRouter = express.Router();
+
+// SPA calls this on page load to validate OAuth params before rendering consent UI
+oauthApiRouter.get('/authorize/validate', validateLimiter, optionalAuth, (req: Request, res: Response) => {
+  // M2 / H3: gate by addon; 404 prevents feature fingerprinting for anonymous callers
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(404).end();
+
+  const params = req.query as Partial<AuthorizeParams>;
+  const userId = (req as OptionalAuthRequest).user?.id ?? null;
+
+  const result = validateAuthorizeRequest(
+    {
+      response_type:          params.response_type || '',
+      client_id:              params.client_id || '',
+      redirect_uri:           params.redirect_uri || '',
+      scope:                  params.scope || '',
+      state:                  params.state,
+      code_challenge:         params.code_challenge || '',
+      code_challenge_method:  params.code_challenge_method || '',
+    },
+    userId,
+  );
+
+  // H3: when caller is unauthenticated, strip client name / allowed_scopes from the response
+  // (validateAuthorizeRequest already does this, but be explicit here)
+  if (userId === null && result.valid) {
+    return res.json({ valid: result.valid, loginRequired: true });
+  }
+
+  // For unauthenticated error cases return a generic error to prevent oracle enumeration
+  if (userId === null && !result.valid) {
+    return res.json({ valid: false, error: 'invalid_request', error_description: 'Invalid authorization request' });
+  }
+
+  return res.json(result);
+});
+
+// User submits consent (approve or deny) — requires cookie-only auth (M7)
+oauthApiRouter.post('/authorize', requireCookieAuth, (req: Request, res: Response) => {
+  const { user } = req as AuthRequest;
+  const {
+    client_id, redirect_uri, scope, state,
+    code_challenge, code_challenge_method, approved,
+  } = req.body as {
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    state?: string;
+    code_challenge: string;
+    code_challenge_method: string;
+    approved: boolean;
+  };
+  const ip = getClientIp(req);
+
+  if (!isAddonEnabled(ADDON_IDS.MCP)) {
+    return res.status(403).json({ error: 'MCP is not enabled' });
+  }
+
+  if (!approved) {
+    // User denied — redirect with error
+    const url = new URL(redirect_uri);
+    url.searchParams.set('error', 'access_denied');
+    url.searchParams.set('error_description', 'User denied the authorization request');
+    if (state) url.searchParams.set('state', state);
+    return res.json({ redirect: url.toString() });
+  }
+
+  // Re-validate all params (server-side re-check after user action)
+  const params: AuthorizeParams = {
+    response_type: 'code',
+    client_id,
+    redirect_uri,
+    scope,
+    state,
+    code_challenge,
+    code_challenge_method,
+  };
+
+  const validation = validateAuthorizeRequest(params, user.id);
+  if (!validation.valid) {
+    return res.status(400).json({ error: validation.error, error_description: validation.error_description });
+  }
+
+  const scopes = validation.scopes!;
+
+  // Store consent (union with any existing scopes)
+  saveConsent(client_id, user.id, scopes, ip);
+
+  // Issue auth code
+  const code = createAuthCode({
+    clientId: client_id,
+    userId: user.id,
+    redirectUri: redirect_uri,
+    scopes,
+    codeChallenge: code_challenge,
+    codeChallengeMethod: 'S256',
+  });
+
+  if (!code) {
+    return res.status(503).json({ error: 'server_error', error_description: 'Authorization server is temporarily unavailable' });
+  }
+
+  const url = new URL(redirect_uri);
+  url.searchParams.set('code', code);
+  if (state) url.searchParams.set('state', state);
+
+  return res.json({ redirect: url.toString() });
+});
+
+// ---- OAuth client CRUD ----
+
+oauthApiRouter.get('/clients', authenticate, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  return res.json({ clients: listOAuthClients(user.id) });
+});
+
+oauthApiRouter.post('/clients', requireCookieAuth, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  const { name, redirect_uris, allowed_scopes } = req.body as {
+    name: string;
+    redirect_uris: string[];
+    allowed_scopes: string[];
+  };
+
+  const result = createOAuthClient(user.id, name, redirect_uris, allowed_scopes, getClientIp(req));
+  if (result.error) return res.status(result.status || 400).json({ error: result.error });
+  return res.status(201).json(result);
+});
+
+oauthApiRouter.post('/clients/:id/rotate', requireCookieAuth, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  const result = rotateOAuthClientSecret(user.id, req.params.id, getClientIp(req));
+  if (result.error) return res.status(result.status || 400).json({ error: result.error });
+  return res.json({ client_secret: result.client_secret });
+});
+
+oauthApiRouter.delete('/clients/:id', requireCookieAuth, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  const result = deleteOAuthClient(user.id, req.params.id, getClientIp(req));
+  if (result.error) return res.status(result.status || 400).json({ error: result.error });
+  return res.json({ success: true });
+});
+
+// ---- Active OAuth sessions ----
+
+oauthApiRouter.get('/sessions', authenticate, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  return res.json({ sessions: listOAuthSessions(user.id) });
+});
+
+oauthApiRouter.delete('/sessions/:id', requireCookieAuth, (req: Request, res: Response) => {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) return res.status(403).json({ error: 'MCP is not enabled' });
+  const { user } = req as AuthRequest;
+  const result = revokeSession(user.id, Number(req.params.id), getClientIp(req));
+  if (result.error) return res.status(result.status || 400).json({ error: result.error });
+  return res.json({ success: true });
+});
@@ -7,7 +7,7 @@ import { User, Addon } from '../types';
 import { updateJwtSecret } from '../config';
 import { maybe_encrypt_api_key, decrypt_api_key } from './apiKeyCrypto';
 import { getAllPermissions, savePermissions as savePerms, PERMISSION_ACTIONS } from './permissions';
-import { revokeUserSessions } from '../mcp';
+import { revokeUserSessions, revokeUserSessionsForClient } from '../mcp';
 import { validatePassword } from './passwordPolicy';
 import { getPhotoProviderConfig } from './memories/helpersService';
 import { send as sendNotification } from './notificationService';
@@ -603,6 +603,30 @@ export function deleteMcpToken(id: string) {
  return {};
 }

+// ── OAuth Sessions ─────────────────────────────────────────────────────────
+
+export function listOAuthSessions() {
+  const rows = db.prepare(`
+    SELECT ot.id, ot.client_id, oc.name AS client_name, ot.user_id, u.username,
+           ot.scopes, ot.access_token_expires_at, ot.refresh_token_expires_at, ot.created_at
+    FROM oauth_tokens ot
+    JOIN oauth_clients oc ON ot.client_id = oc.client_id
+    JOIN users u ON u.id = ot.user_id
+    WHERE ot.revoked_at IS NULL
+      AND ot.refresh_token_expires_at > CURRENT_TIMESTAMP
+    ORDER BY ot.created_at DESC
+  `).all() as (Record<string, unknown> & { scopes: string })[];
+  return rows.map(r => ({ ...r, scopes: JSON.parse(r.scopes) }));
+}
+
+export function revokeOAuthSession(id: string) {
+  const row = db.prepare('SELECT id, user_id, client_id FROM oauth_tokens WHERE id = ?').get(id) as { id: number; user_id: number; client_id: string } | undefined;
+  if (!row) return { error: 'Session not found', status: 404 };
+  db.prepare('UPDATE oauth_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE id = ?').run(id);
+  revokeUserSessionsForClient(row.user_id, row.client_id);
+  return {};
+}
+
 // ── JWT Rotation ───────────────────────────────────────────────────────────

 export function rotateJwtSecret(): { error?: string; status?: number } {
@@ -19,26 +19,62 @@ import {
    SyncAlbumResult,
    AssetInfo
 } from './helpersService';
+import { send as sendNotification } from '../notificationService';

 const SYNOLOGY_PROVIDER = 'synologyphotos';
-const SYNOLOGY_ENDPOINT_PATH = '/photo/webapi/entry.cgi';
+// Users provide the full base URL including the Photos app path (e.g. https://nas:5001/photo).
+// The API endpoint is always at {base_url}/webapi/entry.cgi.
+const SYNOLOGY_ENDPOINT_PATH = '/webapi/entry.cgi';
+
+const SYNOLOGY_ERROR_MESSAGES: Record<number, string> = {
+    101: 'Missing API, method, or version parameter.',
+    102: 'Requested API does not exist.',
+    103: 'Requested method does not exist.',
+    104: 'Requested API version is not supported.',
+    105: 'Insufficient privilege.',
+    106: 'Connection timeout.',
+    107: 'Multiple logins blocked from this IP.',
+    117: 'Manager privilege required.',
+    119: 'Session is invalid or expired.',
+    400: 'Invalid credentials.',
+    401: 'Session expired or account disabled.',
+    402: 'No permission to use this account.',
+    403: 'Two-factor authentication code required.',
+    404: 'Two-factor authentication failed.',
+    406: 'Two-factor authentication is enforced for this account.',
+    407: 'Maximum login attempts reached.',
+    408: 'Password expired.',
+    409: 'Remote password expired.',
+    410: 'Password must be changed before login.',
+    412: 'Guest account cannot log in.',
+    413: 'OTP system files are corrupted.',
+    414: 'Unable to log in.',
+    416: 'Unable to log in.',
+    417: 'OTP system is full.',
+    498: 'System is upgrading.',
+    499: 'System is not ready.',
+};

 interface SynologyUserRecord {
    synology_url?: string | null;
    synology_username?: string | null;
    synology_password?: string | null;
    synology_sid?: string | null;
+    synology_did?: string | null;
+    synology_skip_ssl?: number | null;
 };

 interface SynologyCredentials {
    synology_url: string;
    synology_username: string;
    synology_password: string;
+    synology_skip_ssl: boolean;
 }

 interface SynologySettings {
    synology_url: string;
    synology_username: string;
+    synology_skip_ssl: boolean;
    connected: boolean;
 }

@@ -84,7 +120,7 @@ interface SynologyPhotoItem {

 function _readSynologyUser(userId: number, columns: string[]): ServiceResult<SynologyUserRecord> {
    try {
-        const row = db.prepare(`SELECT synology_url, synology_username, synology_password, synology_sid FROM users WHERE id = ?`).get(userId) as SynologyUserRecord | undefined;
+        const row = db.prepare(`SELECT synology_url, synology_username, synology_password, synology_sid, synology_did, synology_skip_ssl FROM users WHERE id = ?`).get(userId) as SynologyUserRecord | undefined;

        if (!row) {
            return fail('User not found', 404);
@@ -102,7 +138,7 @@ function _readSynologyUser(userId: number, columns: string[]): ServiceResult<Syn
 }

 function _getSynologyCredentials(userId: number): ServiceResult<SynologyCredentials> {
-    const user = _readSynologyUser(userId, ['synology_url', 'synology_username', 'synology_password']);
+    const user = _readSynologyUser(userId, ['synology_url', 'synology_username', 'synology_password', 'synology_skip_ssl']);
    if (!user.success) return user as ServiceResult<SynologyCredentials>;
    if (!user?.data.synology_url || !user.data.synology_username || !user.data.synology_password) return fail('Synology not configured', 400);
    const password = decrypt_api_key(user.data.synology_password);
@@ -111,6 +147,7 @@ function _getSynologyCredentials(userId: number): ServiceResult<SynologyCredenti
        synology_url: user.data.synology_url,
        synology_username: user.data.synology_username,
        synology_password: password,
+        synology_skip_ssl: user.data.synology_skip_ssl !== 0,
    });
 }

@@ -129,7 +166,7 @@ function _buildSynologyFormBody(params: ApiCallParams): URLSearchParams {
    return body;
 }

-async function _fetchSynologyJson<T>(url: string, body: URLSearchParams): Promise<ServiceResult<T>> {
+async function _fetchSynologyJson<T>(url: string, body: URLSearchParams, skipSsl = true): Promise<ServiceResult<T>> {
    const endpoint = _buildSynologyEndpoint(url, `api=${body.get('api')}`);
    try {
        const resp = await safeFetch(endpoint, {
@@ -139,12 +176,20 @@ async function _fetchSynologyJson<T>(url: string, body: URLSearchParams): Promis
            },
            body,
            signal: AbortSignal.timeout(30000) as any,
-        });
+        }, { rejectUnauthorized: !skipSsl });
        if (!resp.ok) {
            return fail('Synology API request failed with status ' + resp.status, resp.status);
        }
        const response = await resp.json() as SynologyApiResponse<T>;
-        return response.success ? success(response.data) : fail('Synology failed with code ' + response.error.code, response.error.code);
+        if (!response.success) {
+            const code = response.error.code;
+            const message = SYNOLOGY_ERROR_MESSAGES[code] ?? 'Synology API request failed (code ' + code + ')';
+            // Preserve session error codes (106, 107, 119) for internal retry logic in _requestSynologyApi.
+            // All other Synology app-level codes are mapped to HTTP 400 — they are not HTTP status codes.
+            const httpStatus = [106, 107, 119].includes(code) ? code : 400;
+            return fail(message, httpStatus);
+        }
+        return success(response.data);
    } catch (error) {
        if (error instanceof SsrfBlockedError) {
            return fail(error.message, 400);
@@ -153,25 +198,41 @@ async function _fetchSynologyJson<T>(url: string, body: URLSearchParams): Promis
    }
 }

-async function _loginToSynology(url: string, username: string, password: string): Promise<ServiceResult<string>> {
+const SYNOLOGY_DEVICE_NAME = 'trek';
+
+async function _loginToSynology(
+    url: string,
+    username: string,
+    password: string,
+    opts: { otp?: string; deviceId?: string; skipSsl?: boolean } = {},
+): Promise<ServiceResult<{ sid: string; did?: string }>> {
+    const { otp, deviceId, skipSsl = false } = opts;
    const body = new URLSearchParams({
        api: 'SYNO.API.Auth',
        method: 'login',
-        version: '3',
+        version: '6',
        account: username,
        passwd: password,
+        format: 'sid',
+        client: 'browser',
+        device_name: SYNOLOGY_DEVICE_NAME,
    });
+    if (otp && otp.trim()) {
+        body.append('otp_code', otp.trim());
+        body.append('enable_device_token', 'yes');
+    }
+    if (deviceId) {
+        body.append('device_id', deviceId);
+    }

-    const result = await _fetchSynologyJson<{ sid?: string }>(url, body);
+    const result = await _fetchSynologyJson<{ sid?: string; did?: string }>(url, body, skipSsl);
    if (!result.success) {
-        return result as ServiceResult<string>;
+        return result as ServiceResult<{ sid: string; did?: string }>;
    }
    if (!result.data.sid) {
        return fail('Failed to get session ID from Synology', 500);
    }
-    return success(result.data.sid);
-
-
+    return success({ sid: result.data.sid, did: result.data.did });
 }

 async function _requestSynologyApi<T>(userId: number, params: ApiCallParams): Promise<ServiceResult<T>> {
@@ -185,8 +246,9 @@ async function _requestSynologyApi<T>(userId: number, params: ApiCallParams): Pr
        return session as ServiceResult<T>;
    }

+    const skipSsl = creds.data.synology_skip_ssl;
    const body = _buildSynologyFormBody({ ...params, _sid: session.data });
-    const result = await _fetchSynologyJson<T>(creds.data.synology_url, body);
+    const result = await _fetchSynologyJson<T>(creds.data.synology_url, body, skipSsl);
    // 106 = session timeout, 107 = duplicate login kicked us out, 119 = SID not found/invalid
    if ('error' in result && [106, 107, 119].includes(result.error.status)) {
        _clearSynologySID(userId);
@@ -194,7 +256,7 @@ async function _requestSynologyApi<T>(userId: number, params: ApiCallParams): Pr
        if (!retrySession.success || !retrySession.data) {
            return retrySession as ServiceResult<T>;
        }
-        return _fetchSynologyJson<T>(creds.data.synology_url, _buildSynologyFormBody({ ...params, _sid: retrySession.data }));
+        return _fetchSynologyJson<T>(creds.data.synology_url, _buildSynologyFormBody({ ...params, _sid: retrySession.data }), skipSsl);
    }
    return result;
 }
@@ -232,6 +294,10 @@ function _clearSynologySID(userId: number): void {
    db.prepare('UPDATE users SET synology_sid = NULL WHERE id = ?').run(userId);
 }

+function _clearSynologySession(userId: number): void {
+    db.prepare('UPDATE users SET synology_sid = NULL, synology_did = NULL WHERE id = ?').run(userId);
+}
+
 function _splitPackedSynologyId(rawId: string): { id: string; cacheKey: string; assetId: string } | null {
    // cache_key format from Synology is "{unit_id}_{timestamp}", e.g. "40808_1633659236".
    // The first segment must be a non-empty integer (the unit ID used for API calls).
@@ -241,9 +307,9 @@ function _splitPackedSynologyId(rawId: string): { id: string; cacheKey: string;
 }

 async function _getSynologySession(userId: number): Promise<ServiceResult<string>> {
-    const cachedSid = _readSynologyUser(userId, ['synology_sid']);
-    if (cachedSid.success && cachedSid.data?.synology_sid) {
-        const decryptedSid = decrypt_api_key(cachedSid.data.synology_sid);
+    const cached = _readSynologyUser(userId, ['synology_sid', 'synology_did']);
+    if (cached.success && cached.data?.synology_sid) {
+        const decryptedSid = decrypt_api_key(cached.data.synology_sid);
        if (decryptedSid) return success(decryptedSid);
        // Decryption failed (e.g. key rotation) — clear the stale SID and re-login
        _clearSynologySID(userId);
@@ -254,15 +320,22 @@ async function _getSynologySession(userId: number): Promise<ServiceResult<string
        return creds as ServiceResult<string>;
    }

-    const resp = await _loginToSynology(creds.data.synology_url, creds.data.synology_username, creds.data.synology_password);
+    // Use stored device ID to skip OTP on re-login (trusted device flow)
+    const storedDid = cached.success && cached.data?.synology_did
+        ? (decrypt_api_key(cached.data.synology_did) || undefined)
+        : undefined;
+
+    const resp = await _loginToSynology(creds.data.synology_url, creds.data.synology_username, creds.data.synology_password, {
+        deviceId: storedDid,
+        skipSsl: creds.data.synology_skip_ssl,
+    });

    if (!resp.success) {
        return resp as ServiceResult<string>;
    }

-    const encrypted = encrypt_api_key(resp.data);
-    db.prepare('UPDATE users SET synology_sid = ? WHERE id = ?').run(encrypted, userId);
-    return success(resp.data);
+    db.prepare('UPDATE users SET synology_sid = ? WHERE id = ?').run(encrypt_api_key(resp.data.sid), userId);
+    return success(resp.data.sid);
 }

 export async function getSynologySettings(userId: number): Promise<ServiceResult<SynologySettings>> {
@@ -272,11 +345,12 @@ export async function getSynologySettings(userId: number): Promise<ServiceResult
    return success({
        synology_url: creds.data.synology_url || '',
        synology_username: creds.data.synology_username || '',
+        synology_skip_ssl: creds.data.synology_skip_ssl,
        connected: session.success,
    });
 }

-export async function updateSynologySettings(userId: number, synologyUrl: string, synologyUsername: string, synologyPassword?: string): Promise<ServiceResult<string>> {
+export async function updateSynologySettings(userId: number, synologyUrl: string, synologyUsername: string, synologyPassword?: string, synologySkipSsl = false): Promise<ServiceResult<string>> {

    const ssrf = await checkSsrf(synologyUrl);
    if (!ssrf.allowed) {
@@ -291,24 +365,42 @@ export async function updateSynologySettings(userId: number, synologyUrl: string
        return fail('No stored password found. Please provide a password to save settings.', 400);
    }

+    // Only invalidate the session when the account itself changes (different URL or username).
+    // If the user just tested the connection, testSynologyConnection already stored a fresh
+    // sid + did — clearing them here would force an unnecessary re-login that may fail (MFA).
+    const existing = _readSynologyUser(userId, ['synology_url', 'synology_username']);
+    const urlChanged = existing.success && existing.data.synology_url !== synologyUrl;
+    const userChanged = existing.success && existing.data.synology_username !== synologyUsername;
+    const sessionCleared = urlChanged || userChanged;
+    if (sessionCleared) {
+        _clearSynologySession(userId);
+        sendNotification({
+            event: 'synology_session_cleared',
+            actorId: null,
+            params: {},
+            scope: 'user',
+            targetId: userId,
+        });
+    }
+
    try {
-        db.prepare('UPDATE users SET synology_url = ?, synology_username = ?, synology_password = ? WHERE id = ?').run(
+        db.prepare('UPDATE users SET synology_url = ?, synology_username = ?, synology_password = ?, synology_skip_ssl = ? WHERE id = ?').run(
            synologyUrl,
            synologyUsername,
            synologyPassword ? maybe_encrypt_api_key(synologyPassword) : existingEncryptedPassword,
+            synologySkipSsl ? 1 : 0,
            userId,
        );
    } catch {
        return fail('Failed to update Synology settings', 500);
    }

-    _clearSynologySID(userId);
-    return success("settings updated");
+    return success('settings updated');
 }

 export async function getSynologyStatus(userId: number): Promise<ServiceResult<StatusResult>> {
    const sid = await _getSynologySession(userId);
-    if ('error' in sid) return success({ connected: false, error: sid.error.status === 400 ? 'Invalid credentials' : sid.error.message });
+    if ('error' in sid) return success({ connected: false, error: sid.error.message });
    if (!sid.data) return success({ connected: false, error: 'Not connected to Synology' });
    try {
        const user = db.prepare('SELECT synology_username FROM users WHERE id = ?').get(userId) as { synology_username?: string } | undefined;
@@ -318,17 +410,25 @@ export async function getSynologyStatus(userId: number): Promise<ServiceResult<S
    }
 }

-export async function testSynologyConnection(synologyUrl: string, synologyUsername: string, synologyPassword: string): Promise<ServiceResult<StatusResult>> {
+export async function testSynologyConnection(userId: number, synologyUrl: string, synologyUsername: string, synologyPassword: string, synologyOtp?: string, synologySkipSsl = false): Promise<ServiceResult<StatusResult>> {

    const ssrf = await checkSsrf(synologyUrl);
    if (!ssrf.allowed) {
        return fail(ssrf.error, 400);
    }

-    const resp = await _loginToSynology(synologyUrl, synologyUsername, synologyPassword);
+    const resp = await _loginToSynology(synologyUrl, synologyUsername, synologyPassword, { otp: synologyOtp, skipSsl: synologySkipSsl });
    if ('error' in resp) {
-        return success({ connected: false, error: resp.error.status === 400 ? 'Invalid credentials' : resp.error.message });
+        return success({ connected: false, error: resp.error.message });
    }
+
+    // Persist the session so the OTP code is not required again on save.
+    // The did (device token) allows future re-logins without OTP.
+    db.prepare('UPDATE users SET synology_sid = ? WHERE id = ?').run(encrypt_api_key(resp.data.sid), userId);
+    if (resp.data.did) {
+        db.prepare('UPDATE users SET synology_did = ? WHERE id = ?').run(encrypt_api_key(resp.data.did), userId);
+    }
+
    return success({ connected: true, user: { name: synologyUsername } });
 }

@@ -13,7 +13,8 @@ export type NotifEventType =
  | 'photos_shared'
  | 'collab_message'
  | 'packing_tagged'
-  | 'version_available';
+  | 'version_available'
+  | 'synology_session_cleared';

 export interface AvailableChannels {
  email: boolean;
@@ -32,6 +33,7 @@ const IMPLEMENTED_COMBOS: Record<NotifEventType, NotifChannel[]> = {
  collab_message:    ['inapp', 'email', 'webhook'],
  packing_tagged:    ['inapp', 'email', 'webhook'],
  version_available: ['inapp', 'email', 'webhook'],
+  synology_session_cleared: ['inapp'],
 };

 /** Events that target admins only (shown in admin panel, not in user settings). */
@@ -112,6 +112,12 @@ const EVENT_NOTIFICATION_CONFIG: Record<string, EventNotifConfig> = {
    navigateTextKey: 'notif.action.view_admin',
    navigateTarget: () => '/admin',
  },
+  synology_session_cleared: {
+    inAppType: 'simple',
+    titleKey: 'notifications.synologySessionCleared.title',
+    textKey: 'notifications.synologySessionCleared.text',
+    navigateTarget: () => null,
+  },
 };

 // ── Fallback config for unknown event types ────────────────────────────────
@@ -104,6 +104,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `New message in "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Packing: ${p.category}`, body: `${p.actor} assigned you to the "${p.category}" packing category in "${p.trip}".` }),
    version_available: p => ({ title: 'New TREK version available', body: `TREK ${p.version} is now available. Visit the admin panel to update.` }),
+    synology_session_cleared: () => ({ title: 'Synology session cleared', body: 'Your Synology account or URL changed. You have been logged out of Synology Photos.' }),
  },
  de: {
    trip_invite: p => ({ title: `Einladung zu "${p.trip}"`, body: `${p.actor} hat ${p.invitee || 'ein Mitglied'} zur Reise "${p.trip}" eingeladen.` }),
@@ -114,6 +115,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Neue Nachricht in "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Packliste: ${p.category}`, body: `${p.actor} hat dich der Kategorie "${p.category}" in der Packliste von "${p.trip}" zugewiesen.` }),
    version_available: p => ({ title: 'Neue TREK-Version verfügbar', body: `TREK ${p.version} ist jetzt verfügbar. Besuche das Admin-Panel zum Aktualisieren.` }),
+    synology_session_cleared: () => ({ title: 'Synology-Sitzung beendet', body: 'Dein Synology-Konto oder die URL hat sich geändert. Du wurdest von Synology Photos abgemeldet.' }),
  },
  fr: {
    trip_invite: p => ({ title: `Invitation à "${p.trip}"`, body: `${p.actor} a invité ${p.invitee || 'un membre'} au voyage "${p.trip}".` }),
@@ -124,6 +126,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nouveau message dans "${p.trip}"`, body: `${p.actor} : ${p.preview}` }),
    packing_tagged: p => ({ title: `Bagages : ${p.category}`, body: `${p.actor} vous a assigné à la catégorie "${p.category}" dans "${p.trip}".` }),
    version_available: p => ({ title: 'Nouvelle version TREK disponible', body: `TREK ${p.version} est maintenant disponible. Rendez-vous dans le panneau d'administration pour mettre à jour.` }),
+    synology_session_cleared: () => ({ title: 'Session Synology effacée', body: 'Votre compte ou URL Synology a changé. Vous avez été déconnecté de Synology Photos.' }),
  },
  es: {
    trip_invite: p => ({ title: `Invitación a "${p.trip}"`, body: `${p.actor} invitó a ${p.invitee || 'un miembro'} al viaje "${p.trip}".` }),
@@ -134,6 +137,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nuevo mensaje en "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Equipaje: ${p.category}`, body: `${p.actor} te asignó a la categoría "${p.category}" en "${p.trip}".` }),
    version_available: p => ({ title: 'Nueva versión de TREK disponible', body: `TREK ${p.version} ya está disponible. Visita el panel de administración para actualizar.` }),
+    synology_session_cleared: () => ({ title: 'Sesión de Synology cerrada', body: 'Tu cuenta o URL de Synology ha cambiado. Has cerrado sesión en Synology Photos.' }),
  },
  nl: {
    trip_invite: p => ({ title: `Uitnodiging voor "${p.trip}"`, body: `${p.actor} heeft ${p.invitee || 'een lid'} uitgenodigd voor de reis "${p.trip}".` }),
@@ -144,6 +148,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nieuw bericht in "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Paklijst: ${p.category}`, body: `${p.actor} heeft je toegewezen aan de categorie "${p.category}" in "${p.trip}".` }),
    version_available: p => ({ title: 'Nieuwe TREK-versie beschikbaar', body: `TREK ${p.version} is nu beschikbaar. Bezoek het beheerderspaneel om bij te werken.` }),
+    synology_session_cleared: () => ({ title: 'Synology-sessie gewist', body: 'Je Synology-account of URL is gewijzigd. Je bent uitgelogd bij Synology Photos.' }),
  },
  ru: {
    trip_invite: p => ({ title: `Приглашение в "${p.trip}"`, body: `${p.actor} пригласил ${p.invitee || 'участника'} в поездку "${p.trip}".` }),
@@ -154,6 +159,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Новое сообщение в "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Список вещей: ${p.category}`, body: `${p.actor} назначил вас в категорию "${p.category}" в "${p.trip}".` }),
    version_available: p => ({ title: 'Доступна новая версия TREK', body: `TREK ${p.version} теперь доступен. Перейдите в панель администратора для обновления.` }),
+    synology_session_cleared: () => ({ title: 'Сессия Synology сброшена', body: 'Ваш аккаунт или URL Synology изменился. Вы вышли из Synology Photos.' }),
  },
  zh: {
    trip_invite: p => ({ title: `邀请加入"${p.trip}"`, body: `${p.actor} 邀请了 ${p.invitee || '成员'} 加入旅行"${p.trip}"。` }),
@@ -164,6 +170,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `"${p.trip}"中的新消息`, body: `${p.actor}：${p.preview}` }),
    packing_tagged: p => ({ title: `行李清单：${p.category}`, body: `${p.actor} 将你分配到"${p.trip}"中的"${p.category}"类别。` }),
    version_available: p => ({ title: '新版 TREK 可用', body: `TREK ${p.version} 现已可用。请前往管理面板进行更新。` }),
+    synology_session_cleared: () => ({ title: 'Synology 会话已清除', body: '您的 Synology 账户或 URL 已更改，您已退出 Synology Photos。' }),
  },
  'zh-TW': {
    trip_invite: p => ({ title: `邀請加入「${p.trip}」`, body: `${p.actor} 邀請了 ${p.invitee || '成員'} 加入行程「${p.trip}」。` }),
@@ -173,6 +180,8 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    photos_shared: p => ({ title: `已分享 ${p.count} 張照片`, body: `${p.actor} 在「${p.trip}」中分享了 ${p.count} 張照片。` }),
    collab_message: p => ({ title: `「${p.trip}」中的新訊息`, body: `${p.actor}：${p.preview}` }),
    packing_tagged: p => ({ title: `打包清單：${p.category}`, body: `${p.actor} 已將您指派到「${p.trip}」中的「${p.category}」分類。` }),
+    version_available: p => ({ title: '新版 TREK 可用', body: `TREK ${p.version} 現已可用。請前往管理面板進行更新。` }),
+    synology_session_cleared: () => ({ title: 'Synology 工作階段已清除', body: '您的 Synology 帳戶或 URL 已變更，您已登出 Synology Photos。' }),
  },
  ar: {
    trip_invite: p => ({ title: `دعوة إلى "${p.trip}"`, body: `${p.actor} دعا ${p.invitee || 'عضو'} إلى الرحلة "${p.trip}".` }),
@@ -183,6 +192,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `رسالة جديدة في "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `قائمة التعبئة: ${p.category}`, body: `${p.actor} عيّنك في فئة "${p.category}" في "${p.trip}".` }),
    version_available: p => ({ title: 'إصدار TREK جديد متاح', body: `TREK ${p.version} متاح الآن. تفضل بزيارة لوحة الإدارة للتحديث.` }),
+    synology_session_cleared: () => ({ title: 'تمت إعادة تعيين جلسة Synology', body: 'تغيّر حسابك أو رابط Synology. تم تسجيل خروجك من Synology Photos.' }),
  },
  br: {
    trip_invite: p => ({ title: `Convite para "${p.trip}"`, body: `${p.actor} convidou ${p.invitee || 'um membro'} para a viagem "${p.trip}".` }),
@@ -193,6 +203,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nova mensagem em "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Bagagem: ${p.category}`, body: `${p.actor} atribuiu você à categoria "${p.category}" em "${p.trip}".` }),
    version_available: p => ({ title: 'Nova versão do TREK disponível', body: `O TREK ${p.version} está disponível. Acesse o painel de administração para atualizar.` }),
+    synology_session_cleared: () => ({ title: 'Sessão Synology encerrada', body: 'Sua conta ou URL do Synology foi alterada. Você foi desconectado do Synology Photos.' }),
  },
  cs: {
    trip_invite: p => ({ title: `Pozvánka do "${p.trip}"`, body: `${p.actor} pozval ${p.invitee || 'člena'} na výlet "${p.trip}".` }),
@@ -203,6 +214,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nová zpráva v "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Balení: ${p.category}`, body: `${p.actor} vás přiřadil do kategorie "${p.category}" v "${p.trip}".` }),
    version_available: p => ({ title: 'Nová verze TREK dostupná', body: `TREK ${p.version} je nyní dostupný. Navštivte administrátorský panel pro aktualizaci.` }),
+    synology_session_cleared: () => ({ title: 'Relace Synology byla zrušena', body: 'Váš účet nebo URL Synology se změnil. Byli jste odhlášeni ze Synology Photos.' }),
  },
  hu: {
    trip_invite: p => ({ title: `Meghívó a(z) "${p.trip}" utazásra`, body: `${p.actor} meghívta ${p.invitee || 'egy tagot'} a(z) "${p.trip}" utazásra.` }),
@@ -213,6 +225,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Új üzenet a(z) "${p.trip}" utazásban`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Csomagolás: ${p.category}`, body: `${p.actor} hozzárendelte Önt a "${p.category}" csomagolási kategóriához a(z) "${p.trip}" utazásban.` }),
    version_available: p => ({ title: 'Új TREK verzió érhető el', body: `A TREK ${p.version} elérhető. Látogasson el az adminisztrációs panelre a frissítéshez.` }),
+    synology_session_cleared: () => ({ title: 'Synology munkamenet törölve', body: 'A Synology fiókja vagy URL-je megváltozott. Kijelentkeztek a Synology Photos-ból.' }),
  },
  it: {
    trip_invite: p => ({ title: `Invito a "${p.trip}"`, body: `${p.actor} ha invitato ${p.invitee || 'un membro'} al viaggio "${p.trip}".` }),
@@ -223,6 +236,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nuovo messaggio in "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Bagagli: ${p.category}`, body: `${p.actor} ti ha assegnato alla categoria "${p.category}" in "${p.trip}".` }),
    version_available: p => ({ title: 'Nuova versione TREK disponibile', body: `TREK ${p.version} è ora disponibile. Visita il pannello di amministrazione per aggiornare.` }),
+    synology_session_cleared: () => ({ title: 'Sessione Synology rimossa', body: 'Il tuo account o URL Synology è cambiato. Sei stato disconnesso da Synology Photos.' }),
  },
  pl: {
    trip_invite: p => ({ title: `Zaproszenie do "${p.trip}"`, body: `${p.actor} zaprosił ${p.invitee || 'członka'} do podróży "${p.trip}".` }),
@@ -233,6 +247,7 @@ const EVENT_TEXTS: Record<string, Record<NotifEventType, EventTextFn>> = {
    collab_message: p => ({ title: `Nowa wiadomość w "${p.trip}"`, body: `${p.actor}: ${p.preview}` }),
    packing_tagged: p => ({ title: `Pakowanie: ${p.category}`, body: `${p.actor} przypisał Cię do kategorii "${p.category}" w "${p.trip}".` }),
    version_available: p => ({ title: 'Nowa wersja TREK dostępna', body: `TREK ${p.version} jest teraz dostępny. Odwiedź panel administracyjny, aby zaktualizować.` }),
+    synology_session_cleared: () => ({ title: 'Sesja Synology wyczyszczona', body: 'Twoje konto lub URL Synology uległo zmianie. Zostałeś wylogowany z Synology Photos.' }),
  },
 };

@@ -0,0 +1,638 @@
+import crypto, { randomBytes, createHash, randomUUID } from 'crypto';
+import { db } from '../db/database';
+import { isAddonEnabled } from './adminService';
+import { validateScopes } from '../mcp/scopes';
+import { ADDON_IDS } from '../addons';
+import { User } from '../types';
+import { writeAudit, logWarn } from './auditLog';
+import { revokeUserSessionsForClient } from '../mcp/sessionManager';
+
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+
+const ACCESS_TOKEN_TTL_S   = 60 * 60;                          // 1 hour
+const REFRESH_TOKEN_TTL_MS = 30 * 24 * 60 * 60 * 1000;        // 30 days rolling
+const AUTH_CODE_TTL_MS     = 2 * 60 * 1000;                   // 2 minutes
+
+// PKCE format (RFC 7636)
+const CODE_CHALLENGE_RE = /^[A-Za-z0-9_-]{43}$/;
+const CODE_VERIFIER_RE  = /^[A-Za-z0-9\-._~]{43,128}$/;
+
+// ---------------------------------------------------------------------------
+// In-memory auth code store (short-lived, no need for DB persistence)
+// ---------------------------------------------------------------------------
+
+interface PendingCode {
+  clientId: string;
+  userId: number;
+  redirectUri: string;
+  scopes: string[];
+  codeChallenge: string;
+  codeChallengeMethod: 'S256';
+  expiresAt: number;
+}
+
+const MAX_PENDING_CODES = 500;
+const pendingCodes = new Map<string, PendingCode>();
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of pendingCodes) {
+    if (now > entry.expiresAt) pendingCodes.delete(key);
+  }
+}, 60_000).unref();
+
+// ---------------------------------------------------------------------------
+// DB row types
+// ---------------------------------------------------------------------------
+
+interface OAuthClientRow {
+  id: string;
+  user_id: number;
+  name: string;
+  client_id: string;
+  client_secret_hash: string;
+  redirect_uris: string;   // JSON array
+  allowed_scopes: string;  // JSON array
+  created_at: string;
+  is_public: number;       // 0 | 1 (SQLite boolean)
+  created_via: string;     // 'settings_ui' | 'browser-registration'
+}
+
+interface OAuthTokenRow {
+  id: number;
+  client_id: string;
+  user_id: number;
+  access_token_hash: string;
+  refresh_token_hash: string;
+  scopes: string;           // JSON array
+  access_token_expires_at: string;
+  refresh_token_expires_at: string;
+  revoked_at: string | null;
+  parent_token_id: number | null;
+}
+
+// ---------------------------------------------------------------------------
+// Token helpers
+// ---------------------------------------------------------------------------
+
+function hashToken(raw: string): string {
+  return createHash('sha256').update(raw).digest('hex');
+}
+
+/** Constant-time comparison of two hex-encoded SHA-256 hashes. */
+function timingSafeEqualHex(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  try {
+    return crypto.timingSafeEqual(Buffer.from(a, 'hex'), Buffer.from(b, 'hex'));
+  } catch { return false; }
+}
+
+function generateAccessToken(): string {
+  return 'trekoa_' + randomBytes(32).toString('hex');
+}
+
+function generateRefreshToken(): string {
+  return 'trekrf_' + randomBytes(32).toString('hex');
+}
+
+// ---------------------------------------------------------------------------
+// Client management (self-service, gated by MCP addon)
+// ---------------------------------------------------------------------------
+
+export function listOAuthClients(userId: number): Record<string, unknown>[] {
+  const rows = db.prepare(
+    'SELECT id, user_id, name, client_id, redirect_uris, allowed_scopes, created_at, is_public, created_via FROM oauth_clients WHERE user_id = ? ORDER BY created_at DESC'
+  ).all(userId) as OAuthClientRow[];
+  return rows.map(r => ({
+    ...r,
+    is_public: Boolean(r.is_public),
+    redirect_uris: JSON.parse(r.redirect_uris),
+    allowed_scopes: JSON.parse(r.allowed_scopes),
+  }));
+}
+
+/** Returns true if the URI is a valid OAuth redirect target (HTTPS or localhost). */
+export function isValidRedirectUri(uri: string): boolean {
+  try {
+    const url = new URL(uri);
+    return url.protocol === 'https:' || url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+  } catch {
+    return false;
+  }
+}
+
+export function createOAuthClient(
+  userId: number | null,
+  name: string,
+  redirectUris: string[],
+  allowedScopes: string[],
+  ip?: string | null,
+  options?: { isPublic?: boolean; createdVia?: string },
+): { error?: string; status?: number; client?: Record<string, unknown> } {
+  if (!name?.trim()) return { error: 'Name is required', status: 400 };
+  if (name.trim().length > 100) return { error: 'Name must be 100 characters or less', status: 400 };
+  if (!redirectUris || redirectUris.length === 0) return { error: 'At least one redirect URI is required', status: 400 };
+  if (redirectUris.length > 10) return { error: 'Maximum 10 redirect URIs per client', status: 400 };
+
+  for (const uri of redirectUris) {
+    let parsed: URL;
+    try {
+      parsed = new URL(uri);
+    } catch {
+      return { error: `Invalid redirect URI: ${uri}`, status: 400 };
+    }
+    if (parsed.protocol !== 'https:' && parsed.hostname !== 'localhost' && parsed.hostname !== '127.0.0.1') {
+      return { error: `Redirect URI must use HTTPS (localhost exempt): ${uri}`, status: 400 };
+    }
+  }
+
+  if (!allowedScopes || allowedScopes.length === 0) return { error: 'At least one scope is required', status: 400 };
+  const { valid, invalid } = validateScopes(allowedScopes);
+  if (!valid) return { error: `Invalid scopes: ${invalid.join(', ')}`, status: 400 };
+
+  if (userId !== null) {
+    const count = (db.prepare('SELECT COUNT(*) as count FROM oauth_clients WHERE user_id = ?').get(userId) as { count: number }).count;
+    if (count >= 10) return { error: 'Maximum of 10 OAuth clients per user', status: 400 };
+  } else {
+    // Anonymous DCR clients: enforce a global cap to prevent unbounded registration abuse
+    const count = (db.prepare('SELECT COUNT(*) as count FROM oauth_clients WHERE user_id IS NULL').get() as { count: number }).count;
+    if (count >= 500) return { error: 'server_error', status: 503 };
+  }
+
+  const isPublic    = options?.isPublic ?? false;
+  const createdVia  = options?.createdVia ?? 'settings_ui';
+  const id          = randomUUID();
+  const clientId    = randomUUID();
+  // Public clients have no usable secret; store an opaque random value to satisfy NOT NULL.
+  const rawSecret   = isPublic ? null : 'trekcs_' + randomBytes(24).toString('hex');
+  const secretHash  = rawSecret ? hashToken(rawSecret) : randomBytes(32).toString('hex');
+
+  db.prepare(
+    'INSERT INTO oauth_clients (id, user_id, name, client_id, client_secret_hash, redirect_uris, allowed_scopes, is_public, created_via) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)'
+  ).run(id, userId, name.trim(), clientId, secretHash, JSON.stringify(redirectUris), JSON.stringify(allowedScopes), isPublic ? 1 : 0, createdVia);
+
+  const row = db.prepare(
+    'SELECT id, user_id, name, client_id, redirect_uris, allowed_scopes, created_at, is_public, created_via FROM oauth_clients WHERE id = ?'
+  ).get(id) as OAuthClientRow;
+
+  writeAudit({ userId, action: 'oauth.client.create', details: { client_id: clientId, name: name.trim(), is_public: isPublic }, ip });
+
+  return {
+    client: {
+      id: row.id,
+      user_id: row.user_id,
+      name: row.name,
+      client_id: row.client_id,
+      redirect_uris: JSON.parse(row.redirect_uris),
+      allowed_scopes: JSON.parse(row.allowed_scopes),
+      created_at: row.created_at,
+      is_public: Boolean(row.is_public),
+      created_via: row.created_via,
+      // client_secret only present for confidential clients — shown once, not stored in plain text
+      ...(rawSecret ? { client_secret: rawSecret } : {}),
+    },
+  };
+}
+
+export function rotateOAuthClientSecret(
+  userId: number,
+  clientRowId: string,
+  ip?: string | null,
+): { error?: string; status?: number; client_secret?: string } {
+  const row = db.prepare('SELECT id, client_id, is_public FROM oauth_clients WHERE id = ? AND user_id = ?').get(clientRowId, userId) as OAuthClientRow | undefined;
+  if (!row) return { error: 'Client not found', status: 404 };
+  if (row.is_public) return { error: 'Public clients do not use a client secret', status: 400 };
+
+  const rawSecret  = 'trekcs_' + randomBytes(24).toString('hex');
+  const secretHash = hashToken(rawSecret);
+
+  db.prepare('UPDATE oauth_clients SET client_secret_hash = ? WHERE id = ?').run(secretHash, clientRowId);
+
+  // Revoke all existing tokens for this client so old sessions are invalidated
+  db.prepare("UPDATE oauth_tokens SET revoked_at = datetime('now') WHERE client_id = ? AND revoked_at IS NULL").run(row.client_id);
+
+  // Terminate active MCP sessions for this (user, client) pair
+
+  revokeUserSessionsForClient(userId, row.client_id);
+
+  writeAudit({ userId, action: 'oauth.client.rotate_secret', details: { client_id: row.client_id }, ip });
+
+  return { client_secret: rawSecret };
+}
+
+export function deleteOAuthClient(
+  userId: number,
+  clientRowId: string,
+  ip?: string | null,
+): { error?: string; status?: number; success?: boolean } {
+  const row = db.prepare('SELECT id, client_id FROM oauth_clients WHERE id = ? AND user_id = ?').get(clientRowId, userId) as OAuthClientRow | undefined;
+  if (!row) return { error: 'Client not found', status: 404 };
+  db.prepare('DELETE FROM oauth_clients WHERE id = ?').run(clientRowId);
+  writeAudit({ userId, action: 'oauth.client.delete', details: { client_id: row.client_id }, ip });
+  return { success: true };
+}
+
+// ---------------------------------------------------------------------------
+// Auth code (in-memory, 2-minute TTL)
+// ---------------------------------------------------------------------------
+
+export function createAuthCode(params: {
+  clientId: string;
+  userId: number;
+  redirectUri: string;
+  scopes: string[];
+  codeChallenge: string;
+  codeChallengeMethod: 'S256';
+}): string | null {
+  if (pendingCodes.size >= MAX_PENDING_CODES) return null;
+  const rawCode = randomBytes(32).toString('hex');
+  pendingCodes.set(rawCode, { ...params, expiresAt: Date.now() + AUTH_CODE_TTL_MS });
+  return rawCode;
+}
+
+export function consumeAuthCode(code: string): PendingCode | null {
+  const entry = pendingCodes.get(code);
+  if (!entry) return null;
+  pendingCodes.delete(code);
+  if (Date.now() > entry.expiresAt) return null;
+  return entry;
+}
+
+// ---------------------------------------------------------------------------
+// Consent management
+// ---------------------------------------------------------------------------
+
+export function getConsent(clientId: string, userId: number): string[] | null {
+  const row = db.prepare(
+    'SELECT scopes FROM oauth_consents WHERE client_id = ? AND user_id = ?'
+  ).get(clientId, userId) as { scopes: string } | undefined;
+  return row ? JSON.parse(row.scopes) : null;
+}
+
+export function saveConsent(clientId: string, userId: number, scopes: string[], ip?: string | null): void {
+  // Union existing consent with newly approved scopes (M5: never narrow stored consent)
+  const existing = getConsent(clientId, userId) ?? [];
+  const merged = Array.from(new Set([...existing, ...scopes]));
+  db.prepare(
+    'INSERT OR REPLACE INTO oauth_consents (client_id, user_id, scopes, updated_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)'
+  ).run(clientId, userId, JSON.stringify(merged));
+  writeAudit({ userId, action: 'oauth.consent.grant', details: { client_id: clientId, scopes: merged }, ip });
+}
+
+export function isConsentSufficient(existingScopes: string[], requestedScopes: string[]): boolean {
+  return requestedScopes.every(s => existingScopes.includes(s));
+}
+
+// ---------------------------------------------------------------------------
+// Token issuance
+// ---------------------------------------------------------------------------
+
+export function issueTokens(
+  clientId: string,
+  userId: number,
+  scopes: string[],
+  parentTokenId: number | null = null,
+): {
+  access_token: string;
+  refresh_token: string;
+  token_type: 'Bearer';
+  expires_in: number;
+  scope: string;
+} {
+  const rawAccess   = generateAccessToken();
+  const rawRefresh  = generateRefreshToken();
+  const accessHash  = hashToken(rawAccess);
+  const refreshHash = hashToken(rawRefresh);
+
+  const now           = new Date();
+  const accessExpiry  = new Date(now.getTime() + ACCESS_TOKEN_TTL_S * 1000);
+  const refreshExpiry = new Date(now.getTime() + REFRESH_TOKEN_TTL_MS);
+
+  db.prepare(`
+    INSERT INTO oauth_tokens
+      (client_id, user_id, access_token_hash, refresh_token_hash, scopes, access_token_expires_at, refresh_token_expires_at, parent_token_id)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(clientId, userId, accessHash, refreshHash, JSON.stringify(scopes), accessExpiry.toISOString(), refreshExpiry.toISOString(), parentTokenId);
+
+  return {
+    access_token:  rawAccess,
+    refresh_token: rawRefresh,
+    token_type:    'Bearer',
+    expires_in:    ACCESS_TOKEN_TTL_S,
+    scope:         scopes.join(' '),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Token verification (used by MCP handler on every request)
+// ---------------------------------------------------------------------------
+
+export interface OAuthTokenInfo {
+  user: User;
+  scopes: string[];
+  clientId: string;
+}
+
+export function getUserByAccessToken(rawToken: string): OAuthTokenInfo | null {
+  const hash = hashToken(rawToken);
+  const row = db.prepare(`
+    SELECT ot.scopes, ot.revoked_at, ot.access_token_expires_at,
+           ot.user_id, ot.client_id, u.username, u.email, u.role
+    FROM oauth_tokens ot
+    JOIN users u ON ot.user_id = u.id
+    WHERE ot.access_token_hash = ?
+  `).get(hash) as (OAuthTokenRow & { username: string; email: string; role: string }) | undefined;
+
+  if (!row) return null;
+  if (row.revoked_at) return null;
+  if (new Date(row.access_token_expires_at) < new Date()) return null;
+
+  return {
+    user: { id: row.user_id, username: row.username, email: row.email, role: row.role as 'admin' | 'user' },
+    scopes: JSON.parse(row.scopes),
+    clientId: row.client_id,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Token refresh (rotation + replay detection)
+// ---------------------------------------------------------------------------
+
+/** Walk parent_token_id upward to find the root token id of this rotation chain. */
+function findChainRoot(tokenId: number): number {
+  let current = tokenId;
+  for (let i = 0; i < 100; i++) {
+    const row = db.prepare('SELECT id, parent_token_id FROM oauth_tokens WHERE id = ?').get(current) as { id: number; parent_token_id: number | null } | undefined;
+    if (!row || row.parent_token_id === null) return current;
+    current = row.parent_token_id;
+  }
+  return current;
+}
+
+/** Revoke all tokens in the rotation chain rooted at rootId. Returns affected ids. */
+function revokeChain(rootId: number): number[] {
+  const rows = db.prepare(`
+    WITH RECURSIVE chain(id) AS (
+      SELECT id FROM oauth_tokens WHERE id = ?
+      UNION ALL
+      SELECT t.id FROM oauth_tokens t JOIN chain c ON t.parent_token_id = c.id
+    )
+    SELECT id FROM chain
+  `).all(rootId) as { id: number }[];
+  const ids = rows.map(r => r.id);
+  if (ids.length > 0) {
+    db.prepare(
+      `UPDATE oauth_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE id IN (${ids.map(() => '?').join(',')}) AND revoked_at IS NULL`
+    ).run(...ids);
+  }
+  return ids;
+}
+
+export function refreshTokens(
+  rawRefreshToken: string,
+  clientId: string,
+  clientSecret: string | undefined,
+  ip?: string | null,
+): { error?: string; status?: number; tokens?: ReturnType<typeof issueTokens> } {
+  const client = db.prepare('SELECT client_id, client_secret_hash, is_public FROM oauth_clients WHERE client_id = ?').get(clientId) as OAuthClientRow | undefined;
+  if (!client) return { error: 'invalid_client', status: 401 };
+  if (!client.is_public) {
+    if (!clientSecret || !timingSafeEqualHex(hashToken(clientSecret), client.client_secret_hash)) {
+      return { error: 'invalid_client', status: 401 };
+    }
+  }
+
+  const hash = hashToken(rawRefreshToken);
+  const row = db.prepare(`
+    SELECT id, client_id, user_id, scopes, refresh_token_expires_at, revoked_at, parent_token_id
+    FROM oauth_tokens WHERE refresh_token_hash = ?
+  `).get(hash) as OAuthTokenRow | undefined;
+
+  if (!row) return { error: 'invalid_grant', status: 400 };
+  if (row.client_id !== clientId) return { error: 'invalid_grant', status: 400 };
+
+  // ---- Replay detection (C3) ----
+  if (row.revoked_at) {
+    // A revoked refresh token was replayed — assume token theft. Cascade-revoke the chain.
+    const rootId = findChainRoot(row.id);
+    revokeChain(rootId);
+
+  
+    revokeUserSessionsForClient(row.user_id, clientId);
+
+    writeAudit({
+      userId: row.user_id,
+      action: 'oauth.token.replay_detected',
+      details: { client_id: clientId },
+      ip,
+    });
+    logWarn(`[OAuth] Refresh token replay detected for user=${row.user_id} client=${clientId} ip=${ip ?? '-'}`);
+
+    return { error: 'invalid_grant', status: 400 };
+  }
+
+  if (new Date(row.refresh_token_expires_at) < new Date()) return { error: 'invalid_grant', status: 400 };
+
+  // Revoke old pair immediately (rotation) and issue new pair linked to old row
+  db.prepare('UPDATE oauth_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE id = ?').run(row.id);
+
+  // Terminate active MCP sessions for the old token's client so client must re-authenticate
+
+  revokeUserSessionsForClient(row.user_id, clientId);
+
+  const tokens = issueTokens(clientId, row.user_id, JSON.parse(row.scopes), row.id);
+  writeAudit({ userId: row.user_id, action: 'oauth.token.refresh', details: { client_id: clientId }, ip });
+
+  return { tokens };
+}
+
+// ---------------------------------------------------------------------------
+// Token revocation
+// ---------------------------------------------------------------------------
+
+export function revokeToken(rawToken: string, clientId: string, userId?: number, ip?: string | null): void {
+  const hash = hashToken(rawToken);
+
+  // Get the user_id for the token so we can revoke its MCP sessions
+  const row = db.prepare(
+    'SELECT user_id FROM oauth_tokens WHERE (access_token_hash = ? OR refresh_token_hash = ?) AND client_id = ?'
+  ).get(hash, hash, clientId) as { user_id: number } | undefined;
+
+  db.prepare(`
+    UPDATE oauth_tokens
+    SET revoked_at = CURRENT_TIMESTAMP
+    WHERE (access_token_hash = ? OR refresh_token_hash = ?) AND client_id = ?
+  `).run(hash, hash, clientId);
+
+  const affectedUserId = row?.user_id ?? userId;
+  if (affectedUserId) {
+  
+    revokeUserSessionsForClient(affectedUserId, clientId);
+    writeAudit({ userId: affectedUserId, action: 'oauth.token.revoke', details: { client_id: clientId, method: 'token' }, ip });
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Active session listing (for user settings page)
+// ---------------------------------------------------------------------------
+
+export function listOAuthSessions(userId: number): Record<string, unknown>[] {
+  const rows = db.prepare(`
+    SELECT ot.id, ot.client_id, oc.name AS client_name, ot.scopes,
+           ot.access_token_expires_at, ot.refresh_token_expires_at, ot.created_at
+    FROM oauth_tokens ot
+    JOIN oauth_clients oc ON ot.client_id = oc.client_id
+    WHERE ot.user_id = ?
+      AND ot.revoked_at IS NULL
+      AND ot.refresh_token_expires_at > CURRENT_TIMESTAMP
+    ORDER BY ot.created_at DESC
+  `).all(userId) as Record<string, unknown>[];
+  return rows.map(r => ({ ...r, scopes: JSON.parse(r.scopes as string) }));
+}
+
+export function revokeSession(
+  userId: number,
+  sessionId: number,
+  ip?: string | null,
+): { error?: string; status?: number; success?: boolean } {
+  const row = db.prepare('SELECT id, client_id FROM oauth_tokens WHERE id = ? AND user_id = ?').get(sessionId, userId) as { id: number; client_id: string } | undefined;
+  if (!row) return { error: 'Session not found', status: 404 };
+
+  db.prepare('UPDATE oauth_tokens SET revoked_at = CURRENT_TIMESTAMP WHERE id = ?').run(sessionId);
+
+
+  revokeUserSessionsForClient(userId, row.client_id);
+
+  writeAudit({ userId, action: 'oauth.token.revoke', details: { client_id: row.client_id, method: 'session' }, ip });
+
+  return { success: true };
+}
+
+// ---------------------------------------------------------------------------
+// Authorize request validation (option A: called by SPA via GET /api/oauth/authorize/validate)
+// ---------------------------------------------------------------------------
+
+export interface AuthorizeParams {
+  response_type: string;
+  client_id: string;
+  redirect_uri: string;
+  scope: string;
+  state?: string;
+  code_challenge: string;
+  code_challenge_method: string;
+}
+
+export interface ValidateAuthorizeResult {
+  valid: boolean;
+  error?: string;
+  error_description?: string;
+  client?: { name: string; allowed_scopes: string[] };
+  scopes?: string[];
+  /** true when user is logged in but consent UI must be shown */
+  consentRequired?: boolean;
+  /** true when the request is valid but user is not authenticated */
+  loginRequired?: boolean;
+  /** true when the client was registered via machine DCR — user may adjust scopes on the consent screen */
+  scopeSelectable?: boolean;
+}
+
+export function validateAuthorizeRequest(
+  params: AuthorizeParams,
+  userId: number | null,
+): ValidateAuthorizeResult {
+  if (!isAddonEnabled(ADDON_IDS.MCP)) {
+    return { valid: false, error: 'mcp_disabled', error_description: 'MCP is not enabled on this server' };
+  }
+
+  if (params.response_type !== 'code') {
+    return { valid: false, error: 'unsupported_response_type', error_description: 'Only response_type=code is supported' };
+  }
+
+  if (!params.code_challenge || params.code_challenge_method !== 'S256') {
+    return { valid: false, error: 'invalid_request', error_description: 'PKCE with code_challenge_method=S256 is required (OAuth 2.1)' };
+  }
+
+  // H1: Enforce code_challenge format (RFC 7636 §4.2)
+  if (!CODE_CHALLENGE_RE.test(params.code_challenge)) {
+    return { valid: false, error: 'invalid_request', error_description: 'code_challenge must be 43 base64url characters (S256)' };
+  }
+
+  if (!params.client_id) {
+    return { valid: false, error: 'invalid_request', error_description: 'client_id is required' };
+  }
+
+  const client = db.prepare('SELECT * FROM oauth_clients WHERE client_id = ?').get(params.client_id) as OAuthClientRow | undefined;
+  if (!client) {
+    return { valid: false, error: 'invalid_client', error_description: 'Unknown client_id' };
+  }
+
+  const allowedUris: string[] = JSON.parse(client.redirect_uris);
+  if (!params.redirect_uri || !allowedUris.includes(params.redirect_uri)) {
+    return { valid: false, error: 'invalid_redirect_uri', error_description: 'redirect_uri does not match any registered URI' };
+  }
+
+  const requestedScopes = (params.scope || '').split(' ').filter(Boolean);
+  if (requestedScopes.length === 0) {
+    return { valid: false, error: 'invalid_scope', error_description: 'At least one scope is required' };
+  }
+
+  const allowedScopes: string[] = JSON.parse(client.allowed_scopes);
+  // Narrow to the intersection: drop scopes the client isn't permitted for rather
+  // than rejecting the whole request (per OAuth 2.0 §3.3 scope narrowing).
+  const grantedScopes = requestedScopes.filter(s => allowedScopes.includes(s));
+  if (grantedScopes.length === 0) {
+    return { valid: false, error: 'invalid_scope', error_description: 'None of the requested scopes are permitted for this client' };
+  }
+
+  if (userId === null) {
+    // H3: return only the minimum required fields — do NOT expose scopes, client.name, or
+    // allowed_scopes to unauthenticated callers to prevent client enumeration.
+    return { valid: true, loginRequired: true };
+  }
+
+  const existingConsent = getConsent(params.client_id, userId);
+  const consentRequired = !existingConsent || !isConsentSufficient(existingConsent, grantedScopes);
+
+  return {
+    valid: true,
+    client: { name: client.name, allowed_scopes: allowedScopes },
+    scopes: grantedScopes,
+    consentRequired,
+    scopeSelectable: client.created_via === 'dcr',
+  };
+}
+
+// ---------------------------------------------------------------------------
+// PKCE verification
+// ---------------------------------------------------------------------------
+
+export function verifyPKCE(codeVerifier: string, codeChallenge: string): boolean {
+  // H1: validate code_verifier format before hashing
+  if (!CODE_VERIFIER_RE.test(codeVerifier)) return false;
+
+  const expected = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+  // Constant-time compare (both are base64url strings of equal length for S256)
+  if (expected.length !== codeChallenge.length) return false;
+  try {
+    return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(codeChallenge));
+  } catch { return false; }
+}
+
+// ---------------------------------------------------------------------------
+// Client authentication (for token endpoint)
+// ---------------------------------------------------------------------------
+
+export function authenticateClient(clientId: string, clientSecret: string | undefined): OAuthClientRow | null {
+  const client = db.prepare('SELECT * FROM oauth_clients WHERE client_id = ?').get(clientId) as OAuthClientRow | undefined;
+  if (!client) return null;
+  if (client.is_public) {
+    // Public clients are identified by client_id alone — PKCE provides the security guarantee.
+    return client;
+  }
+  // H4: constant-time comparison to prevent timing side-channel
+  if (!clientSecret) return null;
+  if (!timingSafeEqualHex(hashToken(clientSecret), client.client_secret_hash)) return null;
+  return client;
+}
--- a/Show More
+++ b/Show More