@acms-subir/core 0.3.0 → 0.3.2

package/src/pages/admin/calendar/integrations.astro

@@ -1,221 +1,4 @@
 ---
-import Admin from '../../../layouts/Admin.astro';
-import Modal from '../../../components/Modal.astro';
-import { getRepo } from '../../../lib/repo';
-import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../../lib/schema';
-import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../../lib/auth';
-import { CALENDAR, bookingsEnabled, calendarFeedUrl } from '../../../lib/calendar/config';
-import { issueApiKey } from '../../../lib/api-keys';
-import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../../lib/webhooks';
-import { resolveConfig } from '../../../lib/email/config';
-import { env } from '../../../lib/env';
-import { siteOrigin } from '../../../lib/seo';
-
-// Settings → Calendar & integrations (mockup J): subscribe feeds, scoped API
-// keys (shown once), signed webhooks with a delivery log and a test button,
-// and the email setup status. Owner-only: keys and webhooks reach private data.
-if (!CALENDAR.enabled) return new Response(null, { status: 404 });
-const repo = await getRepo(Astro.locals);
-const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
-const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
-const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
-const settings = await repo.getSettings();
-const origin = siteOrigin(settings, Astro.url);
-let notice = '';
-let error = '';
-let newKey = '';
-let newSecret = '';
-const dev = import.meta.env.DEV;
-
-if (Astro.request.method === 'POST') {
-  if (!isOwner) return new Response('Owners only', { status: 403 });
-  const form = await Astro.request.formData();
-  const op = String(form.get('op'));
-  try {
-    if (op === 'key') {
-      const scopes = form.getAll('scopes').map(String).filter((s): s is ApiScope => (API_SCOPES as readonly string[]).includes(s));
-      if (!scopes.length) throw new Error('Pick at least one permission.');
-      const { key } = await issueApiKey(repo, String(form.get('name') || 'API key').slice(0, 80), scopes);
-      newKey = key;
-    } else if (op === 'revoke') {
-      await repo.deleteApiKey(String(form.get('id')));
-      notice = 'Key revoked — anything using it stops working now.';
-    } else if (op === 'hook') {
-      const url = validateWebhookUrl(String(form.get('url') || ''), dev);
-      const events = form.getAll('events').map(String).filter((e) => (WEBHOOK_EVENTS as readonly string[]).includes(e));
-      if (!events.length) throw new Error('Pick at least one event.');
-      const secret = generateWebhookSecret();
-      await repo.createWebhook({ url, secret, events });
-      newSecret = secret;
-    } else if (op === 'toggle') {
-      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
-      if (h) await repo.updateWebhook(h.id, { active: !h.active });
-    } else if (op === 'delhook') {
-      await repo.deleteWebhook(String(form.get('id')));
-      notice = 'Webhook removed.';
-    } else if (op === 'test') {
-      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
-      if (h) {
-        const now = Date.now();
-        const d = { id: crypto.randomUUID(), webhookId: h.id, event: 'ping', payload: JSON.stringify({ type: 'ping', createdAt: new Date(now).toISOString(), data: { message: 'Test delivery from acms' } }), status: 'pending' as const, attempts: 0, nextAt: now, responseCode: null, createdAt: now, deliveredAt: null };
-        await repo.createDeliveries([d]);
-        await attemptDelivery(repo, { ...d, attempts: 3 }, h);
-        const last = (await repo.listDeliveries(h.id, 1))[0];
-        notice = last?.responseCode ? `Test sent — the endpoint answered ${last.responseCode}.` : 'Test sent — the endpoint didn’t answer.';
-      }
-    }
-  } catch (err) {
-    error = err instanceof Error ? err.message : 'Something went wrong.';
-  }
-}
-
-const [keys, hooks, calendars] = await Promise.all([repo.listApiKeys(), repo.listWebhooks(), repo.listCalendars()]);
-const logs = new Map(await Promise.all(hooks.map(async (h) => [h.id, await repo.listDeliveries(h.id, 5)] as const)));
-const emailConfig = resolveConfig(await repo.email.config(), Astro.locals);
-const provider = emailConfig.error ? 'none' : emailConfig.provider;
-const ago = (ts: number | null) => {
-  if (!ts) return 'never';
-  const s = Math.floor((Date.now() - ts) / 1000);
-  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`;
-};
-const SCOPE_LABEL: Record<string, string> = {
-  'events:read': 'Read events (incl. private calendars)', 'events:write': 'Create and edit events',
-  'bookings:read': 'Read bookings and guest details', 'bookings:write': 'Create, confirm and cancel bookings',
-  'resources:read': 'Read resources and links', 'resources:write': 'Edit resources and links',
-};
-const feeds = [
-  { label: 'Everything public', url: origin + calendarFeedUrl() },
-  ...calendars.filter((c) => c.kind === 'native' && c.visibility !== 'private').map((c) => ({ label: c.name, url: origin + calendarFeedUrl(c.slug) })),
-];
+// Preserve old bookmarks and form submissions after moving integrations.
+return Astro.redirect('/admin/integrations', 307);
 ---
-
-<Admin title="API & webhooks" section="calendar:integrations">
-  <div class="page-head">
-    <div>
-      <h1>API &amp; webhooks</h1>
-      <p class="sub">Connect the calendar{bookingsEnabled() ? ' and bookings' : ''} to Zapier, Make, Slack, a lobby screen or your own code. <a href="/api/calendar/docs" target="_blank" rel="noopener">API reference ↗</a></p>
-    </div>
-  </div>
-  {notice && <p class="notice" role="status">{notice}</p>}
-  {error && <p class="notice warn" role="alert">{error}</p>}
-  {!isOwner && <p class="notice">Only owners can create keys or webhooks.</p>}
-  {newKey && (
-    <div class="notice reveal">
-      <b>Copy this key now — it won’t be shown again.</b>
-      <div class="cal-feed"><input type="text" class="mono" readonly value={newKey} /><button class="btn sm" type="button" data-copy={newKey}>Copy</button></div>
-      <span class="hint">Send it as <code>Authorization: Bearer {newKey.slice(0, 14)}…</code></span>
-    </div>
-  )}
-  {newSecret && (
-    <div class="notice reveal">
-      <b>Signing secret — copy it into the receiver now.</b>
-      <div class="cal-feed"><input type="text" class="mono" readonly value={newSecret} /><button class="btn sm" type="button" data-copy={newSecret}>Copy</button></div>
-      <span class="hint">Verify <code>X-Acms-Signature</code> = <code>sha256=</code>HMAC-SHA256(secret, <code>{'{X-Acms-Timestamp}.{body}'}</code>).</span>
-    </div>
-  )}
-
-  <div class="res-grid">
-    <div>
-      <section class="card card-pad">
-        <div class="card-head"><b>API keys</b>{isOwner && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
-        {keys.length === 0 && <p class="hint">No keys yet. Public calendars and bookings don’t need one — keys unlock private data and changes.</p>}
-        {keys.map((k) => (
-          <div class="int-row">
-            <div><b>{k.name}</b> <code>{k.prefix}…</code><div class="int-scopes">{k.scopes.map((s) => <span class="pill lang">{s}</span>)}</div></div>
-            <span class="hint">used {ago(k.lastUsedAt)}</span>
-            {isOwner && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
-          </div>
-        ))}
-        <p class="hint">The agent key from Settings → AI &amp; agents also works here, with every permission.</p>
-      </section>
-
-      <section class="card card-pad">
-        <div class="card-head"><b>Webhooks</b>{isOwner && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
-        {hooks.length === 0 && <p class="hint">Get a signed POST the moment something happens — a booking comes in, an event goes live.</p>}
-        {hooks.map((h) => {
-          const log = logs.get(h.id) ?? [];
-          const ok = h.lastStatus !== null && h.lastStatus >= 200 && h.lastStatus < 300;
-          return (
-            <div class="int-hook">
-              <div class="int-row">
-                <div><b class="mono">{h.url.replace(/^https?:\/\//, '').slice(0, 60)}</b><div class="int-scopes">{h.events.map((e) => <span class="pill lang">{e}</span>)}</div></div>
-                <span class={`int-status ${h.lastStatus === null ? '' : ok ? 'ok' : 'bad'}`}>{h.lastStatus === null ? 'no deliveries yet' : `${h.lastStatus || 'no answer'} · ${ago(h.lastAt)}`}</span>
-                {isOwner && (
-                  <form method="post" class="int-acts">
-                    <input type="hidden" name="id" value={h.id} />
-                    <button class="btn sm" name="op" value="test">Send test</button>
-                    <button class="btn sm ghost" name="op" value="toggle">{h.active ? 'Pause' : 'Resume'}</button>
-                    <button class="btn sm ghost danger" name="op" value="delhook" data-confirm="Remove this webhook?">Remove</button>
-                  </form>
-                )}
-              </div>
-              {log.length > 0 && (
-                <details class="int-log"><summary>Last {log.length} deliveries</summary>
-                  {log.map((d) => <div><span class={`status ${d.status === 'delivered' ? 'published' : d.status === 'failed' ? 'archived' : 'scheduled'}`}>{d.status}</span> <code>{d.event}</code> <span class="hint">{d.responseCode ?? '—'} · {d.attempts} attempt{d.attempts === 1 ? '' : 's'} · {ago(d.createdAt)}</span></div>)}
-                </details>
-              )}
-              {!h.active && <p class="hint">Paused — nothing is sent.</p>}
-            </div>
-          );
-        })}
-      </section>
-    </div>
-
-    <div class="res-side">
-      <section class="card card-pad">
-        <div class="card-head"><b>Email</b><span class={`int-status ${provider === 'none' ? 'bad' : 'ok'}`}>{provider === 'none' ? 'Not set up' : ({cloudflare:'Cloudflare Email',resend:'Resend',mailgun:'Mailgun',ses:'Amazon SES'})[provider]}</span></div>
-        {provider === 'none' ? (
-          <p class="hint">Choose Resend, Mailgun, Amazon SES or Cloudflare in <a href="/admin/email">Email settings</a>. Configure a sender and review delivery activity there.</p>
-        ) : <p class="hint">Sending as <code>{emailConfig.config.from}</code>. Guests get confirmations, updates and a reminder the day before.</p>}
-      </section>
-      <section class="card card-pad">
-        <div class="card-head"><b>Subscribe feeds</b></div>
-        {feeds.map((f) => <div class="int-feed"><span>{f.label}</span><div class="cal-feed"><input type="text" class="mono" readonly value={f.url} /><button class="btn sm" type="button" data-copy={f.url}>Copy</button></div></div>)}
-        <p class="hint">Private calendars and resource staff feeds have secret links on their own screens.</p>
-      </section>
-      <section class="card card-pad">
-        <div class="card-head"><b>Quick start</b></div>
-        <pre class="int-code">{`curl ${origin}/api/calendar/events?from=2026-10-01
-
-curl -H "Authorization: Bearer <key>" \\
-  ${origin}/api/calendar/bookings?status=pending`}</pre>
-      </section>
-    </div>
-  </div>
-
-  <Modal id="new-key" title="New API key">
-    <form method="post">
-      <input type="hidden" name="op" value="key" />
-      <label class="field"><span>Name</span><input type="text" name="name" placeholder="Zapier, lobby screen…" required /></label>
-      <div class="field"><span>Permissions</span>
-        {API_SCOPES.filter((s) => bookingsEnabled() || !s.startsWith('bookings') && !s.startsWith('resources')).map((s) => (
-          <label class="check-row"><input type="checkbox" name="scopes" value={s} checked={s.endsWith(':read')} /> {SCOPE_LABEL[s]} <code>{s}</code></label>
-        ))}
-      </div>
-      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Create key</button></div>
-    </form>
-  </Modal>
-  <Modal id="new-hook" title="Add webhook endpoint">
-    <form method="post">
-      <input type="hidden" name="op" value="hook" />
-      <label class="field"><span>Endpoint URL</span><input type="url" class="mono" name="url" placeholder="https://hooks.zapier.com/…" required /></label>
-      <div class="field"><span>Send these events</span>
-        {WEBHOOK_EVENTS.filter((e) => bookingsEnabled() || !e.startsWith('booking')).map((e) => <label class="check-row"><input type="checkbox" name="events" value={e} checked={e === 'booking.created' || e === 'event.published'} /> <code>{e}</code></label>)}
-      </div>
-      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Add endpoint</button></div>
-      <p class="hint modal-note">Deliveries are signed and retried 3 times over about an hour.</p>
-    </form>
-  </Modal>
-</Admin>
-
-<script>
-  document.addEventListener('click', async (e) => {
-    const c = e.target instanceof Element ? e.target.closest<HTMLElement>('[data-confirm]') : null;
-    if (c && !confirm(c.dataset.confirm)) { e.preventDefault(); return; }
-    const b = e.target instanceof Element ? e.target.closest<HTMLButtonElement>('[data-copy]') : null;
-    if (!b) return;
-    await navigator.clipboard.writeText(b.dataset.copy ?? '');
-    b.textContent = 'Copied';
-    setTimeout(() => (b.textContent = 'Copy'), 1200);
-  });
-</script>

package/src/pages/admin/integrations.astro

@@ -0,0 +1,237 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import Modal from '../../components/Modal.astro';
+import { getRepo } from '../../lib/repo';
+import { API_SCOPES, WEBHOOK_EVENTS, type ApiScope } from '../../lib/schema';
+import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../lib/auth';
+import { CALENDAR, bookingsEnabled, calendarFeedUrl } from '../../lib/calendar/config';
+import { issueApiKey } from '../../lib/api-keys';
+import { attemptDelivery, generateWebhookSecret, validateWebhookUrl } from '../../lib/webhooks';
+import { resolveConfig } from '../../lib/email/config';
+import { env } from '../../lib/env';
+import { siteOrigin } from '../../lib/seo';
+
+// Site-wide integrations. Owners manage keys and webhook subscriptions;
+// calendar-specific feeds and API help appear only when enabled.
+const repo = await getRepo(Astro.locals);
+const sessionId = (await validateSession(Astro.cookies.get(SESSION_COOKIE)?.value, Astro.locals));
+const me = sessionId && sessionId !== OWNER_ENV ? await repo.getUser(sessionId) : null;
+const isOwner = sessionId === OWNER_ENV || me?.role === 'owner';
+const settings = await repo.getSettings();
+const origin = siteOrigin(settings, Astro.url);
+let notice = '';
+let error = '';
+let newKey = '';
+let newSecret = '';
+const dev = import.meta.env.DEV;
+
+if (Astro.request.method === 'POST') {
+  if (!isOwner) return new Response('Owners only', { status: 403 });
+  const form = await Astro.request.formData();
+  const op = String(form.get('op'));
+  try {
+    if (op === 'key') {
+      const scopes = form.getAll('scopes').map(String).filter((s): s is ApiScope => (API_SCOPES as readonly string[]).includes(s));
+      if (!scopes.length) throw new Error('Pick at least one permission.');
+      const { key } = await issueApiKey(repo, String(form.get('name') || 'API key').slice(0, 80), scopes);
+      newKey = key;
+    } else if (op === 'revoke') {
+      await repo.deleteApiKey(String(form.get('id')));
+      notice = 'Key revoked — anything using it stops working now.';
+    } else if (op === 'hook') {
+      const url = validateWebhookUrl(String(form.get('url') || ''), dev);
+      const events = form.getAll('events').map(String).filter((e) => (WEBHOOK_EVENTS as readonly string[]).includes(e));
+      if (!events.length) throw new Error('Pick at least one event.');
+      const secret = generateWebhookSecret();
+      await repo.createWebhook({ url, secret, events });
+      newSecret = secret;
+    } else if (op === 'subscriptions') {
+      const events = form.getAll('events').map(String).filter(e => (WEBHOOK_EVENTS as readonly string[]).includes(e));
+      if (!events.length) throw new Error('Pick at least one event.');
+      await repo.updateWebhook(String(form.get('id')), { events });
+      notice = 'Event subscriptions saved.';
+    } else if (op === 'toggle') {
+      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
+      if (h) await repo.updateWebhook(h.id, { active: !h.active });
+    } else if (op === 'delhook') {
+      await repo.deleteWebhook(String(form.get('id')));
+      notice = 'Webhook removed.';
+    } else if (op === 'test') {
+      const h = (await repo.listWebhooks()).find((w) => w.id === form.get('id'));
+      if (h) {
+        const now = Date.now();
+        const d = { id: crypto.randomUUID(), webhookId: h.id, event: 'ping', payload: JSON.stringify({ type: 'ping', createdAt: new Date(now).toISOString(), data: { message: 'Test delivery from acms' } }), status: 'pending' as const, attempts: 0, nextAt: now, responseCode: null, createdAt: now, deliveredAt: null };
+        await repo.createDeliveries([d]);
+        await attemptDelivery(repo, d, h);
+        const last = (await repo.listDeliveries(h.id, 1))[0];
+        notice = last?.responseCode ? `Test sent — the endpoint answered ${last.responseCode}.` : 'Test sent — the endpoint didn’t answer.';
+      }
+    }
+  } catch (err) {
+    error = err instanceof Error ? err.message : 'Something went wrong.';
+  }
+}
+
+const [keys, hooks, calendars] = await Promise.all([repo.listApiKeys(), repo.listWebhooks(), repo.listCalendars()]);
+const logs = new Map(await Promise.all(hooks.map(async (h) => [h.id, await repo.listDeliveries(h.id, 5)] as const)));
+const emailConfig = resolveConfig(await repo.email.config(), Astro.locals);
+const provider = emailConfig.error ? 'none' : emailConfig.provider;
+const ago = (ts: number | null) => {
+  if (!ts) return 'never';
+  const s = Math.floor((Date.now() - ts) / 1000);
+  return s < 60 ? 'just now' : s < 3600 ? `${Math.floor(s / 60)} min ago` : s < 86400 ? `${Math.floor(s / 3600)} h ago` : `${Math.floor(s / 86400)} d ago`;
+};
+const SCOPE_LABEL: Record<string, string> = {
+  'events:read': 'Read events (incl. private calendars)', 'events:write': 'Create and edit events',
+  'bookings:read': 'Read bookings and guest details', 'bookings:write': 'Create, confirm and cancel bookings',
+  'resources:read': 'Read resources and links', 'resources:write': 'Edit resources and links',
+};
+const feeds = [
+  { label: 'Everything public', url: origin + calendarFeedUrl() },
+  ...calendars.filter((c) => c.kind === 'native' && c.visibility !== 'private').map((c) => ({ label: c.name, url: origin + calendarFeedUrl(c.slug) })),
+];
+---
+
+<Admin title="API & webhooks" section="integrations">
+  <div class="card" style="padding:20px;margin-bottom:20px">
+    <h2>Live video</h2><p>Connect your own Twitch or YouTube app to discover broadcasts automatically on your homepage and links page.</p>
+    <a class="btn" href="/admin/live">Set up live video →</a>
+  </div>
+
+  <div class="page-head">
+    <div>
+      <h1>API &amp; webhooks</h1>
+      <p class="sub">Connect content, design, media{CALENDAR.enabled ? ', calendars' : ''}{bookingsEnabled() ? ' and bookings' : ''} to your automations. <a href="/api/webhooks/docs" target="_blank" rel="noopener">API reference ↗</a></p>
+    </div>
+  </div>
+  {notice && <p class="notice" role="status">{notice}</p>}
+  {error && <p class="notice warn" role="alert">{error}</p>}
+  {!isOwner && <p class="notice">Only owners can create keys or webhooks.</p>}
+  {newKey && (
+    <div class="notice reveal">
+      <b>Copy this key now — it won’t be shown again.</b>
+      <div class="cal-feed"><input type="text" class="mono" readonly value={newKey} /><button class="btn sm" type="button" data-copy={newKey}>Copy</button></div>
+      <span class="hint">Send it as <code>Authorization: Bearer {newKey.slice(0, 14)}…</code></span>
+    </div>
+  )}
+  {newSecret && (
+    <div class="notice reveal">
+      <b>Signing secret — copy it into the receiver now.</b>
+      <div class="cal-feed"><input type="text" class="mono" readonly value={newSecret} /><button class="btn sm" type="button" data-copy={newSecret}>Copy</button></div>
+      <span class="hint">Verify <code>X-Acms-Signature</code> = <code>sha256=</code>HMAC-SHA256(secret, <code>{'{X-Acms-Timestamp}.{body}'}</code>).</span>
+    </div>
+  )}
+
+  <div class="res-grid">
+    <div>
+      <section class="card card-pad">
+        <div class="card-head"><b>API keys</b>{isOwner && <button class="btn sm" type="button" data-modal="new-key">New key</button>}</div>
+        {keys.length === 0 && <p class="hint">No keys yet. Public calendars and bookings don’t need one — keys unlock private data and changes.</p>}
+        {keys.map((k) => (
+          <div class="int-row">
+            <div><b>{k.name}</b> <code>{k.prefix}…</code><div class="int-scopes">{k.scopes.map((s) => <span class="pill lang">{s}</span>)}</div></div>
+            <span class="hint">used {ago(k.lastUsedAt)}</span>
+            {isOwner && <form method="post"><input type="hidden" name="op" value="revoke" /><input type="hidden" name="id" value={k.id} /><button class="btn sm ghost danger" data-confirm={`Revoke “${k.name}”?`}>Revoke</button></form>}
+          </div>
+        ))}
+        <p class="hint">Content-agent keys can access calendar integrations. Design and media APIs require explicitly scoped keys.</p>
+      </section>
+
+      <section class="card card-pad">
+        <div class="card-head"><b>Webhooks</b>{isOwner && <button class="btn sm" type="button" data-modal="new-hook">Add endpoint</button>}</div>
+        {hooks.length === 0 && <p class="hint">Get a signed POST when content goes live, a design is published, media changes or a booking comes in.</p>}
+        {hooks.map((h) => {
+          const log = logs.get(h.id) ?? [];
+          const ok = h.lastStatus !== null && h.lastStatus >= 200 && h.lastStatus < 300;
+          return (
+            <div class="int-hook">
+              <div class="int-row">
+                <div><b class="mono">{h.url.replace(/^https?:\/\//, '').slice(0, 60)}</b><div class="int-scopes">{h.events.map((e) => <span class="pill lang">{e}</span>)}</div></div>
+                <span class={`int-status ${h.lastStatus === null ? '' : ok ? 'ok' : 'bad'}`}>{h.lastStatus === null ? 'no deliveries yet' : `${h.lastStatus || 'no answer'} · ${ago(h.lastAt)}`}</span>
+                {isOwner && (
+                  <form method="post" class="int-acts">
+                    <input type="hidden" name="id" value={h.id} />
+                    <button class="btn sm" name="op" value="test">Send test</button>
+                    <button class="btn sm ghost" name="op" value="toggle">{h.active ? 'Pause' : 'Resume'}</button>
+                    <button class="btn sm ghost danger" name="op" value="delhook" data-confirm="Remove this webhook?">Remove</button>
+                  </form>
+                )}
+              </div>
+              {isOwner && <details class="int-log">
+                <summary>Edit event subscriptions</summary>
+                <form method="post">
+                  <input type="hidden" name="op" value="subscriptions" />
+                  <input type="hidden" name="id" value={h.id} />
+                  {WEBHOOK_EVENTS.map(e => <label class="check-row"><input type="checkbox" name="events" value={e} checked={h.events.includes(e) || h.events.includes('*')} /> <code>{e}</code></label>)}
+                  <button class="btn sm" type="submit">Save events</button>
+                </form>
+              </details>}
+              {log.length > 0 && (
+                <details class="int-log"><summary>Last {log.length} deliveries</summary>
+                  {log.map((d) => <div><span class={`status ${d.status === 'delivered' ? 'published' : d.status === 'failed' ? 'archived' : 'scheduled'}`}>{d.status}</span> <code>{d.event}</code> <span class="hint">{d.responseCode ?? '—'} · {d.attempts} attempt{d.attempts === 1 ? '' : 's'} · {ago(d.createdAt)}</span></div>)}
+                </details>
+              )}
+              {!h.active && <p class="hint">Paused — nothing is sent.</p>}
+            </div>
+          );
+        })}
+      </section>
+    </div>
+
+    <div class="res-side">
+      <section class="card card-pad">
+        <div class="card-head"><b>Email</b><span class={`int-status ${provider === 'none' ? 'bad' : 'ok'}`}>{provider === 'none' ? 'Not set up' : ({cloudflare:'Cloudflare Email',resend:'Resend',mailgun:'Mailgun',ses:'Amazon SES'})[provider]}</span></div>
+        {provider === 'none' ? (
+          <p class="hint">Choose Resend, Mailgun, Amazon SES or Cloudflare in <a href="/admin/email">Email settings</a>. Configure a sender and review delivery activity there.</p>
+        ) : <p class="hint">Sending as <code>{emailConfig.config.from}</code>. Guests get confirmations, updates and a reminder the day before.</p>}
+      </section>
+      {CALENDAR.enabled && <section class="card card-pad">
+        <div class="card-head"><b>Subscribe feeds</b></div>
+        {feeds.map((f) => <div class="int-feed"><span>{f.label}</span><div class="cal-feed"><input type="text" class="mono" readonly value={f.url} /><button class="btn sm" type="button" data-copy={f.url}>Copy</button></div></div>)}
+        <p class="hint">Private calendars and resource staff feeds have secret links on their own screens.</p>
+      </section>}
+      <section class="card card-pad">
+        <div class="card-head"><b>Quick start</b></div>
+        <p class="hint">Use publication events to refresh search indexes, clear caches or trigger builds. Media events can start asset processing. A restore event tells consumers to resync.</p>
+        <p><a href="/api/webhooks/docs" target="_blank" rel="noopener">Webhook events and payloads ↗</a></p>
+        {CALENDAR.enabled && <p><a href="/api/calendar/docs" target="_blank" rel="noopener">Calendar API reference ↗</a></p>}
+      </section>
+    </div>
+  </div>
+
+  <Modal id="new-key" title="New API key">
+    <form method="post">
+      <input type="hidden" name="op" value="key" />
+      <label class="field"><span>Name</span><input type="text" name="name" placeholder="Zapier, lobby screen…" required /></label>
+      <div class="field"><span>Permissions</span>
+        {API_SCOPES.filter((s) => (CALENDAR.enabled || !s.startsWith('events:')) && (bookingsEnabled() || !s.startsWith('bookings:') && !s.startsWith('resources:'))).map((s) => (
+          <label class="check-row"><input type="checkbox" name="scopes" value={s} checked={s.endsWith(':read')} /> {SCOPE_LABEL[s] ?? s} <code>{s}</code></label>
+        ))}
+      </div>
+      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Create key</button></div>
+    </form>
+  </Modal>
+  <Modal id="new-hook" title="Add webhook endpoint">
+    <form method="post">
+      <input type="hidden" name="op" value="hook" />
+      <label class="field"><span>Endpoint URL</span><input type="url" class="mono" name="url" placeholder="https://hooks.zapier.com/…" required /></label>
+      <div class="field"><span>Send these events</span>
+        {WEBHOOK_EVENTS.filter((e) => (CALENDAR.enabled || !e.startsWith('event.')) && (bookingsEnabled() || !e.startsWith('booking.'))).map((e) => <label class="check-row"><input type="checkbox" name="events" value={e} checked={e === 'post.published' || e === 'page.published'} /> <code>{e}</code></label>)}
+      </div>
+      <div class="modal-foot"><button class="btn ghost" type="button" data-close>Cancel</button><button class="btn primary" type="submit">Add endpoint</button></div>
+      <p class="hint modal-note">Deliveries are signed and retried 3 times over about an hour.</p>
+    </form>
+  </Modal>
+</Admin>
+
+<script>
+  document.addEventListener('click', async (e) => {
+    const c = e.target instanceof Element ? e.target.closest<HTMLElement>('[data-confirm]') : null;
+    if (c && !confirm(c.dataset.confirm)) { e.preventDefault(); return; }
+    const b = e.target instanceof Element ? e.target.closest<HTMLButtonElement>('[data-copy]') : null;
+    if (!b) return;
+    await navigator.clipboard.writeText(b.dataset.copy ?? '');
+    b.textContent = 'Copied';
+    setTimeout(() => (b.textContent = 'Copy'), 1200);
+  });
+</script>

package/src/pages/admin/live.astro

@@ -0,0 +1,12 @@
+---
+import Admin from '../../layouts/Admin.astro';
+import LiveManager from '../../components/LiveManager';
+import { getRepo } from '../../lib/repo';
+import { requireSession } from '../../lib/api';
+const repo = await getRepo(Astro.locals);
+try { await requireSession(Astro.request, Astro.cookies, repo, true); }
+catch { return new Response('Owner access is required.', { status: 403 }); }
+---
+<Admin title="Live video" section="integrations">
+  <LiveManager client:only="react" />
+</Admin>

package/src/pages/api/calendar/docs.ts

@@ -10,7 +10,7 @@ export const GET: APIRoute = ({ url }) => {
 
 Base: ${o}
 Auth: public reads need no key. Everything else: Authorization: Bearer <key>
-Create keys in the admin: Calendar → API & webhooks. The agent key works too (all permissions).
+Create keys in the admin: Team → API & webhooks. The agent key works too (all permissions).
 All endpoints send CORS headers, so browsers on other sites can call them.
 Times: ISO 8601. Event fields start/end are wall-clock in the event timezone ("2026-10-03T11:00", or "2026-10-03" when allDay).
 Errors: { "error": "message" } with 400 invalid · 401 no/invalid key · 403 missing permission · 404 not found · 409 conflict (slot taken).
@@ -51,7 +51,9 @@ Guests manage their own booking at ${o}${CALENDAR.bookBase}/manage/<manageToken>
 ` : ''}
 ## Webhooks
 
-Add endpoints in Calendar → API & webhooks. Events: event.published, event.updated, event.unpublished, event.deleted${b ? ', booking.created, booking.confirmed, booking.declined, booking.cancelled, booking.rescheduled' : ''}.
+Full webhook reference (including posts, pages, design, media and restores): /api/webhooks/docs
+
+Add endpoints in Team → API & webhooks. Events: event.published, event.updated, event.unpublished, event.deleted${b ? ', booking.created, booking.confirmed, booking.declined, booking.cancelled, booking.rescheduled' : ''}.
 Each POST has headers X-Acms-Event, X-Acms-Delivery, X-Acms-Timestamp and
 X-Acms-Signature: sha256=<hex HMAC-SHA256(secret, "<timestamp>.<raw body>")>.
 Body: { "id", "type", "createdAt", "data": { ... } }. Failed deliveries retry after 1, 10 and 60 minutes.

package/src/pages/api/live/oauth/youtube/callback.ts

@@ -0,0 +1,19 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../../../lib/repo';
+import { ApiError } from '../../../../../lib/api';
+import { validateSession, SESSION_COOKIE, OWNER_ENV } from '../../../../../lib/auth';
+import { finishOAuth } from '../../../../../lib/live/service';
+export const GET:APIRoute=async({cookies,locals,url})=>{
+  const headers={'Cache-Control':'no-store','Referrer-Policy':'no-referrer'};
+  try{
+    const repo=await getRepo(locals),session=cookies.get(SESSION_COOKIE)?.value;
+    // OAuth is intentionally a cross-site GET. Session-bound, one-use state provides CSRF protection.
+    const user=await validateSession(session,repo);
+    if(!session||!user||user!==OWNER_ENV&&(await repo.getUser(user))?.role!=='owner')throw new ApiError(403,'Sign in as the site owner and start authorization again.');
+    await finishOAuth(repo,session,url,locals);
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=connected'}});
+  }catch{
+    // Never reflect callback codes, tokens or provider error bodies into an HTML page or URL.
+    return new Response(null,{status:303,headers:{...headers,Location:'/admin/live?live=error'}});
+  }
+};

package/src/pages/api/live/settings.ts

@@ -0,0 +1,45 @@
+import type { APIRoute } from 'astro';
+import { z } from 'zod';
+import { getRepo } from '../../../lib/repo';
+import { ApiError, apiError, json, readJson, requireSession } from '../../../lib/api';
+import { SESSION_COOKIE } from '../../../lib/auth';
+import { Provider } from '../../../lib/live/types';
+import { adminState, beginOAuth, disconnect, saveConnection, syncConnection, validateConfig } from '../../../lib/live/service';
+const Input=z.discriminatedUnion('action',[
+  z.object({action:z.literal('saveConnection'),provider:Provider,clientId:z.string().trim().min(1).max(200),clientSecret:z.string().trim().max(8192).default(''),channelInput:z.string().trim().max(2048).default(''),googleStatus:z.enum(['testing','production']).default('testing')}).strict(),
+  z.object({action:z.literal('test'),provider:Provider}).strict(),
+  z.object({action:z.literal('selectChannel'),provider:z.literal('youtube'),channelId:z.string().min(1).max(200)}).strict(),
+  z.object({action:z.literal('enable'),provider:Provider,enabled:z.boolean()}).strict(),
+  z.object({action:z.literal('authorize'),provider:z.literal('youtube')}).strict(),
+  z.object({action:z.literal('disconnect'),provider:Provider}).strict(),
+  z.object({action:z.literal('saveConfig'),config:z.unknown()}).strict(),
+]);
+export const GET:APIRoute=async({request,cookies,locals,url})=>{
+  try{const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);return json(await adminState(repo,url,locals));}catch(e){return apiError(e);}
+};
+export const POST:APIRoute=async({request,cookies,locals,url})=>{
+  try{
+    const repo=await getRepo(locals);await requireSession(request,cookies,repo,true);
+    // Browser-based credential changes must originate at this site.
+    if(request.headers.get('origin')!==url.origin)throw new ApiError(403,'Submit changes from this site’s admin.');
+    const input=Input.parse(await readJson(request,24_000));
+    switch(input.action){
+      case 'saveConnection':await saveConnection(repo,input,locals);break;
+      case 'test':await syncConnection(repo,input.provider,locals,true);break;
+      case 'authorize':return json({authorizationUrl:await beginOAuth(repo,cookies.get(SESSION_COOKIE)!.value,url,locals)});
+      case 'disconnect':await disconnect(repo,input.provider,locals);break;
+      case 'saveConfig':await repo.updateSettings({live:validateConfig(input.config)});break;
+      case 'selectChannel':{
+        const conn=await repo.live.get(input.provider);const selected=conn?.channels.find(c=>c.id===input.channelId);
+        if(!conn||!selected)throw new ApiError(400,'Choose a channel from the authorized account.');
+        if(!await repo.live.patch(input.provider,{channelId:selected.id,channelName:selected.name,snapshot:null,upcoming:null,upcomingCheckedAt:0,testedAt:0,enabled:false,lastAttemptAt:0},conn.revision))throw new ApiError(409,'Connection changed; reload and try again.');break;
+      }
+      case 'enable':{
+        const conn=await repo.live.get(input.provider);if(!conn)throw new ApiError(404,'Connection not found.');
+        if(input.enabled&&(!conn.testedAt||conn.testedAt<Date.now()-600_000||conn.error||!conn.channelId))throw new ApiError(400,'Run a successful connection test before enabling automatic checks.');
+        if(!await repo.live.patch(input.provider,{enabled:input.enabled,nextAt:0,...(!input.enabled?{snapshot:null,upcoming:null,upcomingCheckedAt:0}:{})},conn.revision))throw new ApiError(409,'Connection changed; reload and try again.');break;
+      }
+    }
+    return json(await adminState(repo,url,locals));
+  }catch(e){return apiError(e);}
+};

package/src/pages/api/live/status.ts

@@ -0,0 +1,7 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../lib/repo';
+import { json, apiError } from '../../../lib/api';
+import { publicState } from '../../../lib/live/service';
+export const GET:APIRoute=async({locals})=>{
+  try{return json({snapshot:await publicState(await getRepo(locals)),serverNow:Date.now()});}catch(e){return apiError(e);}
+};

package/src/pages/api/live/thumb.ts

@@ -0,0 +1,48 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../../lib/repo';
+import { readResponseBytes } from '../../../lib/api';
+import { liveState, thumbSource } from '../../../lib/live/service';
+
+// Same-site proxy for the current broadcast's preview image, so visitors
+// never contact YouTube or Twitch until they choose to play. The upstream URL
+// comes only from the current snapshot (fixed hosts, validated ids); the
+// query string is just a cache version.
+const MAX_BYTES = 1_500_000;
+const TYPES = new Set(['image/jpeg', 'image/png', 'image/webp']);
+let cached: { src: string; at: number; type: string; body: Uint8Array } | null = null;
+
+const missing = () => new Response(null, { status: 404, headers: { 'Cache-Control': 'public, max-age=30' } });
+
+export const GET: APIRoute = async ({ locals }) => {
+  try {
+    const { config, snapshot } = await liveState(await getRepo(locals));
+    const src = config.mode !== 'off' && config.display.thumbnail ? thumbSource(snapshot) : '';
+    if (!src) return missing();
+    if (cached?.src !== src || cached.at < Date.now() - 60_000) {
+      // YouTube serves _live stills only while broadcasting; fall back to the
+      // regular still (e.g. manual links to an ended stream).
+      const candidates = [src, src.replace('hqdefault_live', 'hqdefault')].filter((v, i, a) => a.indexOf(v) === i);
+      let found: typeof cached = null;
+      for (const url of candidates) {
+        // Twitch redirects to a placeholder when offline; treat that as missing.
+        const r = await fetch(url, { redirect: 'manual', signal: AbortSignal.timeout(8_000) });
+        const type = (r.headers.get('content-type') ?? '').split(';')[0].trim();
+        if (r.status !== 200 || !TYPES.has(type)) { await r.body?.cancel(); continue; }
+        found = { src, at: Date.now(), type, body: await readResponseBytes(r, MAX_BYTES) };
+        break;
+      }
+      if (!found) return missing();
+      cached = found;
+    }
+    return new Response(cached.body, {
+      headers: {
+        'Content-Type': cached.type,
+        'Cache-Control': 'public, max-age=60',
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Security-Policy': "default-src 'none'",
+      },
+    });
+  } catch {
+    return missing();
+  }
+};