@acms-subir/core 0.3.0 → 0.3.1

package/src/lib/webhooks.ts

@@ -50,6 +50,7 @@ export interface EmitOptions {
   fetcher?: Fetcher;
   // Workers: ctx.waitUntil, so the response isn't held for delivery
   waitUntil?: (p: Promise<unknown>) => void;
+  limit?: number;
 }
 
 export async function emitWebhook(
@@ -76,8 +77,11 @@ export async function emitWebhook(
   return rows;
 }
 
-export async function attemptDelivery(repo: ContentRepository, d: WebhookDelivery, hook: Webhook, opts: EmitOptions = {}): Promise<void> {
+export async function attemptDelivery(repo: ContentRepository, d: WebhookDelivery, hook: Webhook, opts: EmitOptions = {}): Promise<boolean> {
   const now = opts.now ?? Date.now();
+  const claimed = await repo.claimDelivery(d.id, now);
+  if (!claimed) return false;
+  d = claimed;
   const fetcher: Fetcher = opts.fetcher ?? ((url, init) => fetch(url, init));
   const ts = Math.floor(now / 1000);
   let code: number | null = null;
@@ -111,24 +115,28 @@ export async function attemptDelivery(repo: ContentRepository, d: WebhookDeliver
     responseCode: code,
     deliveredAt: ok ? now : null,
   });
+  return true;
 }
 
 // retry sweep: due pending deliveries, oldest first, bounded per run
 export async function processDueDeliveries(repo: ContentRepository, opts: EmitOptions = {}): Promise<number> {
   const now = opts.now ?? Date.now();
-  const due = await repo.listDueDeliveries(now, 25);
+  const due = await repo.listDueDeliveries(now, opts.limit ?? 25);
   if (!due.length) return 0;
   const hooks = new Map((await repo.listWebhooks()).map((h) => [h.id, h]));
   let n = 0;
-  for (const d of due) {
+  const deliver = async (d: WebhookDelivery) => {
     const hook = hooks.get(d.webhookId);
     if (!hook || !hook.active) {
       await repo.recordDelivery(d.id, { status: 'failed', attempts: d.attempts, nextAt: null, responseCode: null, deliveredAt: null });
-      continue;
+      return;
     }
-    await attemptDelivery(repo, d, hook, { ...opts, now });
-    n++;
-  }
+    // Each claim gets a fresh clock, even after earlier batches time out.
+    if (await attemptDelivery(repo, d, hook, opts)) n++;
+  };
+  // Bound network concurrency, while avoiding a string of eight-second
+  // endpoint timeouts holding up a request or exhausting waitUntil time.
+  for (let i = 0; i < due.length; i += 5) await Promise.all(due.slice(i, i + 5).map(deliver));
   return n;
 }
 

package/src/lib/widgets.ts

@@ -13,6 +13,7 @@ export interface WidgetMeta {
 }
 
 export const widgetMeta: Record<WidgetType, WidgetMeta> = {
+  live: { label: 'Live video', description: 'Your shared live broadcast (set up in Integrations)', group: 'Content', icon: 'M3 5h12v14H3zM15 10l6-4v12l-6-4' },
   hero: {
     label: 'Hero',
     description: 'Headline, subtitle + CTA',

package/src/middleware.ts

@@ -85,7 +85,7 @@ export const onRequest = defineMiddleware(async (context, next) => {
       const emails = dispatchEmail(repo, context.locals, 2).catch(() => 0);
       const wait = waitUntilFrom(context.locals);
       if (wait) wait(emails); else await emails;
-      const retries = processDueDeliveries(repo, { now }).catch(() => {});
+      const retries = processDueDeliveries(repo).catch(() => {});
       if (wait) wait(retries); else await retries;
       // booking reminders (Node has no cron): site URL, else this request's origin
       const reminders = repo.getSettings()
@@ -99,6 +99,15 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
   const response = await next();
 
+  // Database writes enqueue publication/media notifications atomically.
+  // Flush after mutations (including Astro actions), once their transaction
+  // has committed. The scheduler remains the durable fallback on failure.
+  if (!['GET', 'HEAD', 'OPTIONS'].includes(context.request.method)) {
+    const deliveries = getRepo(context.locals).then(repo => processDueDeliveries(repo, { limit: 5 })).catch(() => 0);
+    const wait = waitUntilFrom(context.locals);
+    if (wait) wait(deliveries); else await deliveries;
+  }
+
   // a preview render must never be cached where a visitor could get it
   if (hasPreviewCookie(context.cookies)) {
     try {

package/src/pages/[...slug].astro

@@ -21,6 +21,12 @@ if (!page || (page.status !== 'published' && !isAdmin)) {
 const bodyHtml = page.bodyHtml ? highlightCodeHtml(await expandDynamicBlocks(page.bodyHtml, repo)) : '';
 // ?designPreview=1 (admin-only) renders the staged Design-screen changes
 const settings = await effectiveSettings(await repo.getSettings(), Astro.url, Astro.cookies, Astro.locals);
+// Live state must not survive in a cached page after its snapshot expires.
+if (settings.live.mode !== 'off' || page?.blocks.some(block => block.type === 'live') ||
+    (page && settings.sectionPages?.[page.id]?.sections.some(section => section.type === 'live'))) {
+  Astro.response.headers.set('Cache-Control', 'no-store');
+}
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const PageTemplate = (page.template && settings.sectionPages?.[page.id]?.mode !== 'content' ? resolveDesign(settings).theme.pageTemplates[page.template] : null) as any;
 ---

package/src/pages/admin/calendar/integrations.astro

@@ -1,221 +1,4 @@
 ---
-import Admin from '../../../layouts/Admin.astro';
-import Modal from '../../../components/Modal.astro';
-import { getRepo } from '../../../lib/repo';
-import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../../lib/schema';
-import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../../lib/auth';
-import { CALENDAR, bookingsEnabled, calendarFeedUrl } from '../../../lib/calendar/config';
-import { issueApiKey } from '../../../lib/api-keys';
-import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../../lib/webhooks';
-import { resolveConfig } from '../../../lib/email/config';
-import { env } from '../../../lib/env';
-import { siteOrigin } from '../../../lib/seo';
-
-// Settings → Calendar & integrations (mockup J): subscribe feeds, scoped API
-// keys (shown once), signed webhooks with a delivery log and a test button,
-// and the email setup status. Owner-only: keys and webhooks reach private data.
-if (!CALENDAR.enabled) return new Response(null, { status: 404 });
-const repo = await getRepo(Astro.locals);
-const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
-const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
-const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
-const settings = await repo.getSettings();
-const origin = siteOrigin(settings, Astro.url);
-let notice = '';
-let error = '';
-let newKey = '';
-let newSecret = '';
-const dev = import.meta.env.DEV;
-
-if (Astro.request.method === 'POST') {
-  if (!isOwner) return new Response('Owners only', { status: 403 });
-  const form = await Astro.request.formData();
-  const op = String(form.get('op'));
-  try {
-    if (op === 'key') {
-      const scopes = form.getAll('scopes').map(String).filter((s): s is ApiScope => (API_SCOPES as readonly string[]).includes(s));
-      if (!scopes.length) throw new Error('Pick at least one permission.');
-      const { key } = await issueApiKey(repo, String(form.get('name') || 'API key').slice(0, 80), scopes);
-      newKey = key;
-    } else if (op === 'revoke') {
-      await repo.deleteApiKey(String(form.get('id')));
-      notice = 'Key revoked — anything using it stops working now.';
-    } else if (op === 'hook') {
-      const url = validateWebhookUrl(String(form.get('url') || ''), dev);
-      const events = form.getAll('events').map(String).filter((e) => (WEBHOOK_EVENTS as readonly string[]).includes(e));
-      if (!events.length) throw new Error('Pick at least one event.');
-      const secret = generateWebhookSecret();
-      await repo.createWebhook({ url, secret, events });
-      newSecret = secret;
-    } else if (op === 'toggle') {
-      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
-      if (h) await repo.updateWebhook(h.id, { active: !h.active });
-    } else if (op === 'delhook') {
-      await repo.deleteWebhook(String(form.get('id')));
-      notice = 'Webhook removed.';
-    } else if (op === 'test') {
-      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
-      if (h) {
-        const now = Date.now();
-        const d = { id: crypto.randomUUID(), webhookId: h.id, event: 'ping', payload: JSON.stringify({ type: 'ping', createdAt: new Date(now).toISOString(), data: { message: 'Test delivery from acms' } }), status: 'pending' as const, attempts: 0, nextAt: now, responseCode: null, createdAt: now, deliveredAt: null };
-        await repo.createDeliveries([d]);
-        await attemptDelivery(repo, { ...d, attempts: 3 }, h);
-        const last = (await repo.listDeliveries(h.id, 1))[0];
-        notice = last?.responseCode ? `Test sent — the endpoint answered ${last.responseCode}.` : 'Test sent — the endpoint didn’t answer.';
-      }
-    }
-  } catch (err) {
-    error = err instanceof Error ? err.message : 'Something went wrong.';
-  }
-}
-
-const [keys, hooks, calendars] = await Promise.all([repo.listApiKeys(), repo.listWebhooks(), repo.listCalendars()]);
-const logs = new Map(await Promise.all(hooks.map(async (h) => [h.id, await repo.listDeliveries(h.id, 5)] as const)));
-const emailConfig = resolveConfig(await repo.email.config(), Astro.locals);
-const provider = emailConfig.error ? 'none' : emailConfig.provider;
-const ago = (ts: number | null) => {
-  if (!ts) return 'never';
-  const s = Math.floor((Date.now() - ts) / 1000);
-  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`;
-};
-const SCOPE_LABEL: Record<string, string> = {
-  'events:read': 'Read events (incl. private calendars)', 'events:write': 'Create and edit events',
-  'bookings:read': 'Read bookings and guest details', 'bookings:write': 'Create, confirm and cancel bookings',
-  'resources:read': 'Read resources and links', 'resources:write': 'Edit resources and links',
-};
-const feeds = [
-  { label: 'Everything public', url: origin + calendarFeedUrl() },
-  ...calendars.filter((c) => c.kind === 'native' && c.visibility !== 'private').map((c) => ({ label: c.name, url: origin + calendarFeedUrl(c.slug) })),
-];
+// Preserve old bookmarks and form submissions after moving integrations.
+return Astro.redirect('/admin/integrations', 307);
 ---
-
-<Admin title="API & webhooks" section="calendar:integrations">
-  <div class="page-head">
-    <div>
-      <h1>API &amp; webhooks</h1>
-      <p class="sub">Connect the calendar{bookingsEnabled() ? ' and bookings' : ''} to Zapier, Make, Slack, a lobby screen or your own code. <a href="/api/calendar/docs" target="_blank" rel="noopener">API reference ↗</a></p>
-    </div>
-  </div>
-  {notice && <p class="notice" role="status">{notice}</p>}
-  {error && <p class="notice warn" role="alert">{error}</p>}
-  {!isOwner && <p class="notice">Only owners can create keys or webhooks.</p>}
-  {newKey && (
-    <div class="notice reveal">
-      <b>Copy this key now — it won’t be shown again.</b>
-      <div class="cal-feed"><input type="text" class="mono" readonly value={newKey} /><button class="btn sm" type="button" data-copy={newKey}>Copy</button></div>
-      <span class="hint">Send it as <code>Authorization: Bearer {newKey.slice(0, 14)}…</code></span>
-    </div>
-  )}
-  {newSecret && (
-    <div class="notice reveal">
-      <b>Signing secret — copy it into the receiver now.</b>
-      <div class="cal-feed"><input type="text" class="mono" readonly value={newSecret} /><button class="btn sm" type="button" data-copy={newSecret}>Copy</button></div>
-      <span class="hint">Verify <code>X-Acms-Signature</code> = <code>sha256=</code>HMAC-SHA256(secret, <code>{'{X-Acms-Timestamp}.{body}'}</code>).</span>
-    </div>
-  )}
-
-  <div class="res-grid">
-    <div>
-      <section class="card card-pad">
-        <div class="card-head"><b>API keys</b>{isOwner && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
-        {keys.length === 0 && <p class="hint">No keys yet. Public calendars and bookings don’t need one — keys unlock private data and changes.</p>}
-        {keys.map((k) => (
-          <div class="int-row">
-            <div><b>{k.name}</b> <code>{k.prefix}…</code><div class="int-scopes">{k.scopes.map((s) => <span class="pill lang">{s}</span>)}</div></div>
-            <span class="hint">used {ago(k.lastUsedAt)}</span>
-            {isOwner && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
-          </div>
-        ))}
-        <p class="hint">The agent key from Settings → AI &amp; agents also works here, with every permission.</p>
-      </section>
-
-      <section class="card card-pad">
-        <div class="card-head"><b>Webhooks</b>{isOwner && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
-        {hooks.length === 0 && <p class="hint">Get a signed POST the moment something happens — a booking comes in, an event goes live.</p>}
-        {hooks.map((h) => {
-          const log = logs.get(h.id) ?? [];
-          const ok = h.lastStatus !== null && h.lastStatus >= 200 && h.lastStatus < 300;
-          return (
-            <div class="int-hook">
-              <div class="int-row">
-                <div><b class="mono">{h.url.replace(/^https?:\/\//, '').slice(0, 60)}</b><div class="int-scopes">{h.events.map((e) => <span class="pill lang">{e}</span>)}</div></div>
-                <span class={`int-status ${h.lastStatus === null ? '' : ok ? 'ok' : 'bad'}`}>{h.lastStatus === null ? 'no deliveries yet' : `${h.lastStatus || 'no answer'} · ${ago(h.lastAt)}`}</span>
-                {isOwner && (
-                  <form method="post" class="int-acts">
-                    <input type="hidden" name="id" value={h.id} />
-                    <button class="btn sm" name="op" value="test">Send test</button>
-                    <button class="btn sm ghost" name="op" value="toggle">{h.active ? 'Pause' : 'Resume'}</button>
-                    <button class="btn sm ghost danger" name="op" value="delhook" data-confirm="Remove this webhook?">Remove</button>
-                  </form>
-                )}
-              </div>
-              {log.length > 0 && (
-                <details class="int-log"><summary>Last {log.length} deliveries</summary>
-                  {log.map((d) => <div><span class={`status ${d.status === 'delivered' ? 'published' : d.status === 'failed' ? 'archived' : 'scheduled'}`}>{d.status}</span> <code>{d.event}</code> <span class="hint">{d.responseCode ?? '—'} · {d.attempts} attempt{d.attempts === 1 ? '' : 's'} · {ago(d.createdAt)}</span></div>)}
-                </details>
-              )}
-              {!h.active && <p class="hint">Paused — nothing is sent.</p>}
-            </div>
-          );
-        })}
-      </section>
-    </div>
-
-    <div class="res-side">
-      <section class="card card-pad">
-        <div class="card-head"><b>Email</b><span class={`int-status ${provider === 'none' ? 'bad' : 'ok'}`}>{provider === 'none' ? 'Not set up' : ({cloudflare:'Cloudflare Email',resend:'Resend',mailgun:'Mailgun',ses:'Amazon SES'})[provider]}</span></div>
-        {provider === 'none' ? (
-          <p class="hint">Choose Resend, Mailgun, Amazon SES or Cloudflare in <a href="/admin/email">Email settings</a>. Configure a sender and review delivery activity there.</p>
-        ) : <p class="hint">Sending as <code>{emailConfig.config.from}</code>. Guests get confirmations, updates and a reminder the day before.</p>}
-      </section>
-      <section class="card card-pad">
-        <div class="card-head"><b>Subscribe feeds</b></div>
-        {feeds.map((f) => <div class="int-feed"><span>{f.label}</span><div class="cal-feed"><input type="text" class="mono" readonly value={f.url} /><button class="btn sm" type="button" data-copy={f.url}>Copy</button></div></div>)}
-        <p class="hint">Private calendars and resource staff feeds have secret links on their own screens.</p>
-      </section>
-      <section class="card card-pad">
-        <div class="card-head"><b>Quick start</b></div>
-        <pre class="int-code">{`curl ${origin}/api/calendar/events?from=2026-10-01
-
-curl -H "Authorization: Bearer <key>" \\
-  ${origin}/api/calendar/bookings?status=pending`}</pre>
-      </section>
-    </div>
-  </div>
-
-  <Modal id="new-key" title="New API key">
-    <form method="post">
-      <input type="hidden" name="op" value="key" />
-      <label class="field"><span>Name</span><input type="text" name="name" placeholder="Zapier, lobby screen…" required /></label>
-      <div class="field"><span>Permissions</span>
-        {API_SCOPES.filter((s) => bookingsEnabled() || !s.startsWith('bookings') && !s.startsWith('resources')).map((s) => (
-          <label class="check-row"><input type="checkbox" name="scopes" value={s} checked={s.endsWith(':read')} /> {SCOPE_LABEL[s]} <code>{s}</code></label>
-        ))}
-      </div>
-      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Create key</button></div>
-    </form>
-  </Modal>
-  <Modal id="new-hook" title="Add webhook endpoint">
-    <form method="post">
-      <input type="hidden" name="op" value="hook" />
-      <label class="field"><span>Endpoint URL</span><input type="url" class="mono" name="url" placeholder="https://hooks.zapier.com/…" required /></label>
-      <div class="field"><span>Send these events</span>
-        {WEBHOOK_EVENTS.filter((e) => bookingsEnabled() || !e.startsWith('booking')).map((e) => <label class="check-row"><input type="checkbox" name="events" value={e} checked={e === 'booking.created' || e === 'event.published'} /> <code>{e}</code></label>)}
-      </div>
-      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Add endpoint</button></div>
-      <p class="hint modal-note">Deliveries are signed and retried 3 times over about an hour.</p>
-    </form>
-  </Modal>
-</Admin>
-
-<script>
-  document.addEventListener('click', async (e) => {
-    const c = e.target instanceof Element ? e.target.closest<HTMLElement>('[data-confirm]') : null;
-    if (c && !confirm(c.dataset.confirm)) { e.preventDefault(); return; }
-    const b = e.target instanceof Element ? e.target.closest<HTMLButtonElement>('[data-copy]') : null;
-    if (!b) return;
-    await navigator.clipboard.writeText(b.dataset.copy ?? '');
-    b.textContent = 'Copied';
-    setTimeout(() => (b.textContent = 'Copy'), 1200);
-  });
-</script>

package/src/pages/admin/integrations.astro

@@ -0,0 +1,237 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import Modal from '../../components/Modal.astro';
+import { getRepo } from '../../lib/repo';
+import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
+import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../lib/auth';
+import { CALENDAR, bookingsEnabled, calendarFeedUrl } from '../../lib/calendar/config';
+import { issueApiKey } from '../../lib/api-keys';
+import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
+import { resolveConfig } from '../../lib/email/config';
+import { env } from '../../lib/env';
+import { siteOrigin } from '../../lib/seo';
+
+// Site-wide integrations. Owners manage keys and webhook subscriptions;
+// calendar-specific feeds and API help appear only when enabled.
+const repo = await getRepo(Astro.locals);
+const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
+const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
+const settings = await repo.getSettings();
+const origin = siteOrigin(settings, Astro.url);
+let notice = '';
+let error = '';
+let newKey = '';
+let newSecret = '';
+const dev = import.meta.env.DEV;
+
+if (Astro.request.method === 'POST') {
+  if (!isOwner) return new Response('Owners only', { status: 403 });
+  const form = await Astro.request.formData();
+  const op = String(form.get('op'));
+  try {
+    if (op === 'key') {
+      const scopes = form.getAll('scopes').map(String).filter((s): s is ApiScope => (API_SCOPES as readonly string[]).includes(s));
+      if (!scopes.length) throw new Error('Pick at least one permission.');
+      const { key } = await issueApiKey(repo, String(form.get('name') || 'API key').slice(0, 80), scopes);
+      newKey = key;
+    } else if (op === 'revoke') {
+      await repo.deleteApiKey(String(form.get('id')));
+      notice = 'Key revoked — anything using it stops working now.';
+    } else if (op === 'hook') {
+      const url = validateWebhookUrl(String(form.get('url') || ''), dev);
+      const events = form.getAll('events').map(String).filter((e) => (WEBHOOK_EVENTS as readonly string[]).includes(e));
+      if (!events.length) throw new Error('Pick at least one event.');
+      const secret = generateWebhookSecret();
+      await repo.createWebhook({ url, secret, events });
+      newSecret = secret;
+    } else if (op === 'subscriptions') {
+      const events = form.getAll('events').map(String).filter(e => (WEBHOOK_EVENTS as readonly string[]).includes(e));
+      if (!events.length) throw new Error('Pick at least one event.');
+      await repo.updateWebhook(String(form.get('id')), { events });
+      notice = 'Event subscriptions saved.';
+    } else if (op === 'toggle') {
+      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
+      if (h) await repo.updateWebhook(h.id, { active: !h.active });
+    } else if (op === 'delhook') {
+      await repo.deleteWebhook(String(form.get('id')));
+      notice = 'Webhook removed.';
+    } else if (op === 'test') {
+      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
+      if (h) {
+        const now = Date.now();
+        const d = { id: crypto.randomUUID(), webhookId: h.id, event: 'ping', payload: JSON.stringify({ type: 'ping', createdAt: new Date(now).toISOString(), data: { message: 'Test delivery from acms' } }), status: 'pending' as const, attempts: 0, nextAt: now, responseCode: null, createdAt: now, deliveredAt: null };
+        await repo.createDeliveries([d]);
+        await attemptDelivery(repo, d, h);
+        const last = (await repo.listDeliveries(h.id, 1))[0];
+        notice = last?.responseCode ? `Test sent — the endpoint answered ${last.responseCode}.` : 'Test sent — the endpoint didn’t answer.';
+      }
+    }
+  } catch (err) {
+    error = err instanceof Error ? err.message : 'Something went wrong.';
+  }
+}
+
+const [keys, hooks, calendars] = await Promise.all([repo.listApiKeys(), repo.listWebhooks(), repo.listCalendars()]);
+const logs = new Map(await Promise.all(hooks.map(async (h) => [h.id, await repo.listDeliveries(h.id, 5)] as const)));
+const emailConfig = resolveConfig(await repo.email.config(), Astro.locals);
+const provider = emailConfig.error ? 'none' : emailConfig.provider;
+const ago = (ts: number | null) => {
+  if (!ts) return 'never';
+  const s = Math.floor((Date.now() - ts) / 1000);
+  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`;
+};
+const SCOPE_LABEL: Record<string, string> = {
+  'events:read': 'Read events (incl. private calendars)', 'events:write': 'Create and edit events',
+  'bookings:read': 'Read bookings and guest details', 'bookings:write': 'Create, confirm and cancel bookings',
+  'resources:read': 'Read resources and links', 'resources:write': 'Edit resources and links',
+};
+const feeds = [
+  { label: 'Everything public', url: origin + calendarFeedUrl() },
+  ...calendars.filter((c) => c.kind === 'native' && c.visibility !== 'private').map((c) => ({ label: c.name, url: origin + calendarFeedUrl(c.slug) })),
+];
+---
+
+<Admin title="API & webhooks" section="integrations">
+  <div class="card" style="padding:20px;margin-bottom:20px">
+    <h2>Live video</h2><p>Connect your own Twitch or YouTube app to discover broadcasts automatically on your homepage and links page.</p>
+    <a class="btn" href="/admin/live">Set up live video →</a>
+  </div>
+
+  <div class="page-head">
+    <div>
+      <h1>API &amp; webhooks</h1>
+      <p class="sub">Connect content, design, media{CALENDAR.enabled ? ', calendars' : ''}{bookingsEnabled() ? ' and bookings' : ''} to your automations. <a href="/api/webhooks/docs" target="_blank" rel="noopener">API reference ↗</a></p>
+    </div>
+  </div>
+  {notice && <p class="notice" role="status">{notice}</p>}
+  {error && <p class="notice warn" role="alert">{error}</p>}
+  {!isOwner && <p class="notice">Only owners can create keys or webhooks.</p>}
+  {newKey && (
+    <div class="notice reveal">
+      <b>Copy this key now — it won’t be shown again.</b>
+      <div class="cal-feed"><input type="text" class="mono" readonly value={newKey} /><button class="btn sm" type="button" data-copy={newKey}>Copy</button></div>
+      <span class="hint">Send it as <code>Authorization: Bearer {newKey.slice(0, 14)}…</code></span>
+    </div>
+  )}
+  {newSecret && (
+    <div class="notice reveal">
+      <b>Signing secret — copy it into the receiver now.</b>
+      <div class="cal-feed"><input type="text" class="mono" readonly value={newSecret} /><button class="btn sm" type="button" data-copy={newSecret}>Copy</button></div>
+      <span class="hint">Verify <code>X-Acms-Signature</code> = <code>sha256=</code>HMAC-SHA256(secret, <code>{'{X-Acms-Timestamp}.{body}'}</code>).</span>
+    </div>
+  )}
+
+  <div class="res-grid">
+    <div>
+      <section class="card card-pad">
+        <div class="card-head"><b>API keys</b>{isOwner && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
+        {keys.length === 0 && <p class="hint">No keys yet. Public calendars and bookings don’t need one — keys unlock private data and changes.</p>}
+        {keys.map((k) => (
+          <div class="int-row">
+            <div><b>{k.name}</b> <code>{k.prefix}…</code><div class="int-scopes">{k.scopes.map((s) => <span class="pill lang">{s}</span>)}</div></div>
+            <span class="hint">used {ago(k.lastUsedAt)}</span>
+            {isOwner && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
+          </div>
+        ))}
+        <p class="hint">Content-agent keys can access calendar integrations. Design and media APIs require explicitly scoped keys.</p>
+      </section>
+
+      <section class="card card-pad">
+        <div class="card-head"><b>Webhooks</b>{isOwner && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
+        {hooks.length === 0 && <p class="hint">Get a signed POST when content goes live, a design is published, media changes or a booking comes in.</p>}
+        {hooks.map((h) => {
+          const log = logs.get(h.id) ?? [];
+          const ok = h.lastStatus !== null && h.lastStatus >= 200 && h.lastStatus < 300;
+          return (
+            <div class="int-hook">
+              <div class="int-row">
+                <div><b class="mono">{h.url.replace(/^https?:\/\//, '').slice(0, 60)}</b><div class="int-scopes">{h.events.map((e) => <span class="pill lang">{e}</span>)}</div></div>
+                <span class={`int-status ${h.lastStatus === null ? '' : ok ? 'ok' : 'bad'}`}>{h.lastStatus === null ? 'no deliveries yet' : `${h.lastStatus || 'no answer'} · ${ago(h.lastAt)}`}</span>
+                {isOwner && (
+                  <form method="post" class="int-acts">
+                    <input type="hidden" name="id" value={h.id} />
+                    <button class="btn sm" name="op" value="test">Send test</button>
+                    <button class="btn sm ghost" name="op" value="toggle">{h.active ? 'Pause' : 'Resume'}</button>
+                    <button class="btn sm ghost danger" name="op" value="delhook" data-confirm="Remove this webhook?">Remove</button>
+                  </form>
+                )}
+              </div>
+              {isOwner && <details class="int-log">
+                <summary>Edit event subscriptions</summary>
+                <form method="post">
+                  <input type="hidden" name="op" value="subscriptions" />
+                  <input type="hidden" name="id" value={h.id} />
+                  {WEBHOOK_EVENTS.map(e => <label class="check-row"><input type="checkbox" name="events" value={e} checked={h.events.includes(e) || h.events.includes('*')} /> <code>{e}</code></label>)}
+                  <button class="btn sm" type="submit">Save events</button>
+                </form>
+              </details>}
+              {log.length > 0 && (
+                <details class="int-log"><summary>Last {log.length} deliveries</summary>
+                  {log.map((d) => <div><span class={`status ${d.status === 'delivered' ? 'published' : d.status === 'failed' ? 'archived' : 'scheduled'}`}>{d.status}</span> <code>{d.event}</code> <span class="hint">{d.responseCode ?? '—'} · {d.attempts} attempt{d.attempts === 1 ? '' : 's'} · {ago(d.createdAt)}</span></div>)}
+                </details>
+              )}
+              {!h.active && <p class="hint">Paused — nothing is sent.</p>}
+            </div>
+          );
+        })}
+      </section>
+    </div>
+
+    <div class="res-side">
+      <section class="card card-pad">
+        <div class="card-head"><b>Email</b><span class={`int-status ${provider === 'none' ? 'bad' : 'ok'}`}>{provider === 'none' ? 'Not set up' : ({cloudflare:'Cloudflare Email',resend:'Resend',mailgun:'Mailgun',ses:'Amazon SES'})[provider]}</span></div>
+        {provider === 'none' ? (
+          <p class="hint">Choose Resend, Mailgun, Amazon SES or Cloudflare in <a href="/admin/email">Email settings</a>. Configure a sender and review delivery activity there.</p>
+        ) : <p class="hint">Sending as <code>{emailConfig.config.from}</code>. Guests get confirmations, updates and a reminder the day before.</p>}
+      </section>
+      {CALENDAR.enabled && <section class="card card-pad">
+        <div class="card-head"><b>Subscribe feeds</b></div>
+        {feeds.map((f) => <div class="int-feed"><span>{f.label}</span><div class="cal-feed"><input type="text" class="mono" readonly value={f.url} /><button class="btn sm" type="button" data-copy={f.url}>Copy</button></div></div>)}
+        <p class="hint">Private calendars and resource staff feeds have secret links on their own screens.</p>
+      </section>}
+      <section class="card card-pad">
+        <div class="card-head"><b>Quick start</b></div>
+        <p class="hint">Use publication events to refresh search indexes, clear caches or trigger builds. Media events can start asset processing. A restore event tells consumers to resync.</p>
+        <p><a href="/api/webhooks/docs" target="_blank" rel="noopener">Webhook events and payloads ↗</a></p>
+        {CALENDAR.enabled && <p><a href="/api/calendar/docs" target="_blank" rel="noopener">Calendar API reference ↗</a></p>}
+      </section>
+    </div>
+  </div>
+
+  <Modal id="new-key" title="New API key">
+    <form method="post">
+      <input type="hidden" name="op" value="key" />
+      <label class="field"><span>Name</span><input type="text" name="name" placeholder="Zapier, lobby screen…" required /></label>
+      <div class="field"><span>Permissions</span>
+        {API_SCOPES.filter((s) => (CALENDAR.enabled || !s.startsWith('events:')) && (bookingsEnabled() || !s.startsWith('bookings:') && !s.startsWith('resources:'))).map((s) => (
+          <label class="check-row"><input type="checkbox" name="scopes" value={s} checked={s.endsWith(':read')} /> {SCOPE_LABEL[s] ?? s} <code>{s}</code></label>
+        ))}
+      </div>
+      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Create key</button></div>
+    </form>
+  </Modal>
+  <Modal id="new-hook" title="Add webhook endpoint">
+    <form method="post">
+      <input type="hidden" name="op" value="hook" />
+      <label class="field"><span>Endpoint URL</span><input type="url" class="mono" name="url" placeholder="https://hooks.zapier.com/…" required /></label>
+      <div class="field"><span>Send these events</span>
+        {WEBHOOK_EVENTS.filter((e) => (CALENDAR.enabled || !e.startsWith('event.')) && (bookingsEnabled() || !e.startsWith('booking.'))).map((e) => <label class="check-row"><input type="checkbox" name="events" value={e} checked={e === 'post.published' || e === 'page.published'} /> <code>{e}</code></label>)}
+      </div>
+      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Add endpoint</button></div>
+      <p class="hint modal-note">Deliveries are signed and retried 3 times over about an hour.</p>
+    </form>
+  </Modal>
+</Admin>
+
+<script>
+  document.addEventListener('click', async (e) => {
+    const c = e.target instanceof Element ? e.target.closest<HTMLElement>('[data-confirm]') : null;
+    if (c && !confirm(c.dataset.confirm)) { e.preventDefault(); return; }
+    const b = e.target instanceof Element ? e.target.closest<HTMLButtonElement>('[data-copy]') : null;
+    if (!b) return;
+    await navigator.clipboard.writeText(b.dataset.copy ?? '');
+    b.textContent = 'Copied';
+    setTimeout(() => (b.textContent = 'Copy'), 1200);
+  });
+</script>

package/src/pages/admin/live.astro

@@ -0,0 +1,12 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import LiveManager from '../../components/LiveManager';
+import { getRepo } from '../../lib/repo';
+import { requireSession } from '../../lib/api';
+const repo = await getRepo(Astro.locals);
+try { await requireSession(Astro.request, Astro.cookies, repo, true); }
+catch { return new Response('Owner access is required.', { status: 403 }); }
+---
+<Admin title="Live video" section="integrations">
+  <LiveManager client:only="react" />
+</Admin>

package/src/pages/api/calendar/docs.ts

@@ -10,7 +10,7 @@ export const GET: APIRoute = ({ url }) => {
 
 Base: ${o}
 Auth: public reads need no key. Everything else: Authorization: Bearer <key>
-Create keys in the admin: Calendar → API & webhooks. The agent key works too (all permissions).
+Create keys in the admin: Team → API & webhooks. The agent key works too (all permissions).
 All endpoints send CORS headers, so browsers on other sites can call them.
 Times: ISO 8601. Event fields start/end are wall-clock in the event timezone ("2026-10-03T11:00", or "2026-10-03" when allDay).
 Errors: { "error": "message" } with 400 invalid · 401 no/invalid key · 403 missing permission · 404 not found · 409 conflict (slot taken).
@@ -51,7 +51,9 @@ Guests manage their own booking at ${o}${CALENDAR.bookBase}/manage/<manageToken>
 ` : ''}
 ## Webhooks
 
-Add endpoints in Calendar → API & webhooks. Events: event.published, event.updated, event.unpublished, event.deleted${b ? ', booking.created, booking.confirmed, booking.declined, booking.cancelled, booking.rescheduled' : ''}.
+Full webhook reference (including posts, pages, design, media and restores): /api/webhooks/docs
+
+Add endpoints in Team → API & webhooks. Events: event.published, event.updated, event.unpublished, event.deleted${b ? ', booking.created, booking.confirmed, booking.declined, booking.cancelled, booking.rescheduled' : ''}.
 Each POST has headers X-Acms-Event, X-Acms-Delivery, X-Acms-Timestamp and
 X-Acms-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>.
 Body: { "id", "type", "createdAt", "data": { ... } }. Failed deliveries retry after 1, 10 and 60 minutes.

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -0,0 +1,19 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../../lib/repo';
+import { ApiError } from '../../../../../lib/api';
+import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../../../../lib/auth';
+import { finishOAuth } from '../../../../../lib/live/service';
+export const GET:APIRoute=async({cookies,locals,url})=>{
+  const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
+  try{
+    const repo=await getRepo(locals),session=cookies.get(SESSION_COOKIE)?.value;
+    // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
+    const user=await validateSession(session,repo);
+    if(!session||!user||user!==OWNER_ENV&&(await repo.getUser(user))?.role!=='owner')throw new ApiError(403,'Sign in as the site owner and start authorization again.');
+    await finishOAuth(repo,session,url,locals);
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});
+  }catch{
+    // Never reflect callback codes, tokens or provider error bodies into an HTML page or URL.
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=error'}});
+  }
+};