@easy-cms/core 1.30.1 → 1.32.0

package/dist/{chunk-W3FVQ2CA.js → chunk-J4NASOMO.js}

@@ -61,6 +61,7 @@ function hashToken(token) {
 function hmac(secret, value) {
   return createHmac("sha256", secret).update(value).digest("base64url");
 }
+var signValue = (secret, value) => hmac(secret, value);
 function secretsOf(config) {
   return [config.secret, ...config.previousSecrets ?? []];
 }
@@ -161,6 +162,8 @@ var AUDIT_LOGS = "audit-logs";
 var OUTBOX = "outbox";
 var RATE_LIMITS = "rate-limits";
 var BULK_OPERATIONS = "bulk-operations";
+var SAVED_VIEWS = "saved-views";
+var CONNECTIONS = "connections";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -175,7 +178,9 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   AUDIT_LOGS,
   OUTBOX,
   RATE_LIMITS,
-  BULK_OPERATIONS
+  BULK_OPERATIONS,
+  SAVED_VIEWS,
+  CONNECTIONS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -563,6 +568,40 @@ var bulkOperationsCollection = {
     { name: "finishedAt", type: "text" }
   ]
 };
+var savedViewsCollection = {
+  slug: SAVED_VIEWS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "collection", type: "text", required: true, index: true },
+    { name: "user", type: "text", required: true, index: true },
+    // view | default
+    { name: "kind", type: "text", required: true },
+    { name: "name", type: "text" },
+    { name: "shared", type: "boolean" },
+    // `{ query, columns?, pageSize?, density? }`: the list's URL query, and what the browser kept.
+    { name: "state", type: "json" },
+    // For `default`: a view's id, or `config:<id>` for one of `admin.views`.
+    { name: "target", type: "text" }
+  ]
+};
+var connectionsCollection = {
+  slug: CONNECTIONS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // connection | integration | pending
+    { name: "kind", type: "text", required: true },
+    { name: "integration", type: "text", required: true, index: true },
+    { name: "name", type: "text" },
+    { name: "isDefault", type: "boolean" },
+    { name: "values", type: "json" },
+    // AES-256-GCM, with a key derived from the secret (see integrations.ts).
+    { name: "secret", type: "text" },
+    { name: "account", type: "text" },
+    { name: "lastUsedAt", type: "text" },
+    { name: "lastError", type: "text" },
+    { name: "enabled", type: "boolean" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -705,6 +744,15 @@ var emailDeliveriesCollection = {
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { createHmac as createHmac2 } from "crypto";
+
+// src/csv.ts
+function csvCell(value) {
+  const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
+  const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
+  return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
+}
+
+// src/audit.ts
 var DEFAULT_AUDIT_KEEP = 365;
 var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
@@ -877,11 +925,7 @@ var AuditLog = class {
       limit: CSV_LIMIT,
       page: 1
     });
-    const cell = (value) => {
-      const s = value === null || value === void 0 ? "" : typeof value === "string" ? value : JSON.stringify(value);
-      const safe = /^[=+\-@\t\r]/.test(s) ? `'${s}` : s;
-      return /[",\n\r]/.test(safe) ? `"${safe.replaceAll('"', '""')}"` : safe;
-    };
+    const cell = csvCell;
     const lines = [
       ["at", "action", "target", "doc", "title", "actor", "via", "ip", "changes", "detail"].join(
         ","
@@ -1304,9 +1348,9 @@ var esc = (value) => value.replace(
   (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]
 );
 function email(subject, lines, button) {
-  const text3 = [...lines, ...button ? ["", button.url] : []].join("\n");
+  const text4 = [...lines, ...button ? ["", button.url] : []].join("\n");
   const html = `<div style="font-family:system-ui,sans-serif;font-size:15px;line-height:1.5;color:#1f2328">${lines.map((line) => `<p>${esc(line)}</p>`).join("")}${button ? `<p><a href="${esc(button.url)}" style="display:inline-block;padding:10px 18px;border-radius:8px;background:#2f6f5e;color:#fff;text-decoration:none;font-weight:600">${esc(button.label)}</a></p><p style="font-size:13px;color:#656d76">${esc(button.url)}</p>` : ""}</div>`;
-  return { subject, text: text3, html };
+  return { subject, text: text4, html };
 }
 var hours = (expiresAt) => Math.max(1, Math.round(((expiresAt?.getTime() ?? Date.now()) - Date.now()) / 36e5));
 var days = (expiresAt) => Math.max(1, Math.round(hours(expiresAt) / 24));
@@ -2597,8 +2641,8 @@ function itemsOf(field, n) {
   return `${n} ${unit}${n === 1 ? "" : "s"}`;
 }
 var isEmpty = (value) => value === void 0 || value === null || value === "";
-function slugify(text3) {
-  return text3.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
+function slugify(text4) {
+  return text4.normalize("NFKC").toLowerCase().replace(/[^\p{L}\p{M}\p{N}]+/gu, "-").replace(/^-+|-+$/g, "");
 }
 function applyDefaults(fields, data, localization = null) {
   const result = { ...data };
@@ -2907,7 +2951,7 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         return fail(`must have at least ${field.minRows} rows`);
       if (field.maxRows !== void 0 && raw.length > field.maxRows)
         return fail(`must have at most ${field.maxRows} rows`);
-      const rows = [];
+      const rows2 = [];
       for (const [i, row] of raw.entries()) {
         if (!isPlainObject(row)) {
           errors.push({ field: `${path}.${i}`, message: "must be an object" });
@@ -2917,9 +2961,9 @@ async function normalizeValue(field, raw, path, options, fail, errors, reference
         errors.push(...sub.errors);
         references2.push(...sub.references);
         const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
-        rows.push({ id, ...sub.data });
+        rows2.push({ id, ...sub.data });
       }
-      return rows;
+      return rows2;
     }
     case "blocks":
       return normalizeBlocks(field, raw, path, options, fail, errors, references2);
@@ -2933,7 +2977,7 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     return fail(`must have at least ${field.minRows} blocks`);
   if (field.maxRows !== void 0 && raw.length > field.maxRows)
     return fail(`must have at most ${field.maxRows} blocks`);
-  const rows = [];
+  const rows2 = [];
   for (const [i, row] of raw.entries()) {
     const fields = rowFields(field, row);
     if (!isPlainObject(row) || !fields) {
@@ -2947,9 +2991,9 @@ async function normalizeBlocks(field, raw, path, options, fail, errors, referenc
     errors.push(...sub.errors);
     references2.push(...sub.references);
     const id = typeof row.id === "string" && row.id !== "" ? row.id : randomUUID();
-    rows.push({ id, blockType: row.blockType, ...sub.data });
+    rows2.push({ id, blockType: row.blockType, ...sub.data });
   }
-  return rows;
+  return rows2;
 }
 function normalizeSelect(field, raw, fail) {
   const allowed2 = field.options.map((o) => typeof o === "string" ? o : o.value);
@@ -3000,6 +3044,8 @@ var Mailer = class {
   logger;
   queue;
   pending = /* @__PURE__ */ new Set();
+  /** Told when an email is given up on (`delivery.failed`). */
+  onGiveUp;
   get configured() {
     return this.adapter !== void 0;
   }
@@ -3057,6 +3103,8 @@ var Mailer = class {
       if (delay === void 0) {
         failed++;
         this.logger.error(`Email gave up after ${attempts} attempts: ${error}`);
+        const sent2 = JSON.parse(queued.message);
+        this.onGiveUp?.({ to: [sent2.to].flat().join(", "), error, attempts });
       }
       await this.queue.update(id, {
         ...queued,
@@ -3198,11 +3246,11 @@ async function copyDatabase(source, target, options = {}) {
   for (const table of tables) {
     let copied = 0;
     for (; ; ) {
-      const rows = await from.read(table, copied, BATCH);
-      if (rows.length === 0) break;
-      await to.write(table, rows);
-      copied += rows.length;
-      if (rows.length < BATCH) break;
+      const rows2 = await from.read(table, copied, BATCH);
+      if (rows2.length === 0) break;
+      await to.write(table, rows2);
+      copied += rows2.length;
+      if (rows2.length < BATCH) break;
     }
     total += copied;
     options.onTable?.({ table, rows: copied });
@@ -3413,26 +3461,26 @@ async function writeBackupFile(cms, file) {
       });
   }
 }
-var slug = (text3) => text3.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
+var slug = (text4) => text4.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "easy-cms";
 function filenameFor(cms, date) {
   const pad = (n) => String(n).padStart(2, "0");
   const stamp = `${date.getFullYear()}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}-${pad(date.getHours())}${pad(date.getMinutes())}`;
   return `${slug(cms.config.admin.brand.name || "easy-cms")}-${stamp}.db.gz`;
 }
 function toAdmin(row) {
-  const text3 = (value) => typeof value === "string" && value !== "" ? value : null;
+  const text4 = (value) => typeof value === "string" && value !== "" ? value : null;
   return {
     id: row.id,
     state: ["pending", "running", "done", "failed"].includes(row.state) ? row.state : "failed",
     trigger: row.trigger === "scheduled" ? "scheduled" : "manual",
-    filename: text3(row.filename),
+    filename: text4(row.filename),
     size: typeof row.size === "number" ? row.size : null,
-    startedAt: text3(row.startedAt),
-    finishedAt: text3(row.finishedAt),
-    error: text3(row.error),
-    author: text3(row.author),
-    downloadedBy: text3(row.downloadedBy),
-    downloadedAt: text3(row.downloadedAt)
+    startedAt: text4(row.startedAt),
+    finishedAt: text4(row.finishedAt),
+    error: text4(row.error),
+    author: text4(row.author),
+    downloadedBy: text4(row.downloadedBy),
+    downloadedAt: text4(row.downloadedAt)
   };
 }
 async function update(cms, row, data) {
@@ -3536,11 +3584,13 @@ async function runBackup(cms, record) {
     });
     cms.logger.info(`Backup ${key} written (${data.byteLength} bytes)`);
   } catch (error) {
+    const message2 = (error.message || String(error)).slice(0, 500);
     await update(cms, row, {
       state: "failed",
-      error: (error.message || String(error)).slice(0, 500),
+      error: message2,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
+    cms.systemEvent("backup.failed", { backup: row.id, error: message2 });
     throw error;
   } finally {
     await rm2(dir, { recursive: true, force: true });
@@ -3771,10 +3821,10 @@ var MediaFolders = class {
   async rows() {
     if (this.cache && Date.now() - this.cache.at < TTL) return this.cache.rows;
     const found = await this.db.find({ collection: MEDIA_FOLDERS, sort: [], limit: 0, page: 1 });
-    const rows = /* @__PURE__ */ new Map();
+    const rows2 = /* @__PURE__ */ new Map();
     for (const doc of found.docs) {
       const permissions = doc.permissions;
-      rows.set(String(doc.id), {
+      rows2.set(String(doc.id), {
         id: doc.id,
         parent: doc.parent ?? null,
         name: String(doc.name ?? ""),
@@ -3784,31 +3834,31 @@ var MediaFolders = class {
         doc
       });
     }
-    this.cache = { at: Date.now(), rows };
-    return rows;
+    this.cache = { at: Date.now(), rows: rows2 };
+    return rows2;
   }
   /** A role's level in a folder (`null`: the top level): the nearest permissions up the tree. */
-  levelIn(rows, role, id) {
+  levelIn(rows2, role, id) {
     const seen = /* @__PURE__ */ new Set();
-    let current = id === null ? void 0 : rows.get(String(id));
+    let current = id === null ? void 0 : rows2.get(String(id));
     while (current && !seen.has(String(current.id))) {
       seen.add(String(current.id));
       if (current.permissions) {
         const level = current.permissions[role];
         return level && level in RANK ? level : "none";
       }
-      current = current.parent === null ? void 0 : rows.get(String(current.parent));
+      current = current.parent === null ? void 0 : rows2.get(String(current.parent));
     }
     return "manage";
   }
   /** Whether files in a folder (`null`: the top level) are private: it or a folder above is. */
-  privateIn(rows, id) {
+  privateIn(rows2, id) {
     const seen = /* @__PURE__ */ new Set();
-    let current = id === null ? void 0 : rows.get(String(id));
+    let current = id === null ? void 0 : rows2.get(String(id));
     while (current && !seen.has(String(current.id))) {
       if (current.private) return true;
       seen.add(String(current.id));
-      current = current.parent === null ? void 0 : rows.get(String(current.parent));
+      current = current.parent === null ? void 0 : rows2.get(String(current.parent));
     }
     return false;
   }
@@ -3818,26 +3868,26 @@ var MediaFolders = class {
     return this.privateIn(await this.rows(), id);
   }
   /** The folder and every folder inside it. */
-  within(rows, ids) {
+  within(rows2, ids) {
     const out = new Set(ids.map(String));
     let grew = true;
     while (grew) {
       grew = false;
-      for (const row of rows.values())
+      for (const row of rows2.values())
         if (row.parent !== null && out.has(String(row.parent)) && !out.has(String(row.id))) {
           out.add(String(row.id));
           grew = true;
         }
     }
-    return [...rows.values()].filter((r) => out.has(String(r.id))).map((r) => r.id);
+    return [...rows2.values()].filter((r) => out.has(String(r.id))).map((r) => r.id);
   }
   /**
    * Folders whose privacy follows this one: it and those inside, with their privacy now.
    * @internal
    */
   async subtree(id) {
-    const rows = await this.fresh();
-    return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
+    const rows2 = await this.fresh();
+    return this.within(rows2, [id]).map((f) => ({ id: f, private: this.privateIn(rows2, f) }));
   }
   /**
    * The privacy each folder of a subtree would have after a change to its top folder: made
@@ -3845,15 +3895,15 @@ var MediaFolders = class {
    * @internal
    */
   async privacyAfter(id, change) {
-    const rows = new Map(await this.fresh());
-    const row = rows.get(String(id));
+    const rows2 = new Map(await this.fresh());
+    const row = rows2.get(String(id));
     if (!row) return [];
-    rows.set(String(id), {
+    rows2.set(String(id), {
       ...row,
       ...change.private !== void 0 ? { private: change.private } : {},
       ...change.parent !== void 0 ? { parent: change.parent } : {}
     });
-    return this.within(rows, [id]).map((f) => ({ id: f, private: this.privateIn(rows, f) }));
+    return this.within(rows2, [id]).map((f) => ({ id: f, private: this.privateIn(rows2, f) }));
   }
   async keyed(key, scope = {}, create = true) {
     const find = async () => [...(await this.rows()).values()].find((r) => r.key === key && inScope(r.doc, scope));
@@ -3891,9 +3941,9 @@ var MediaFolders = class {
   /** Whether a file in `folder` is in the folder with this key, or below it. @internal */
   async inKeyed(key, folder, scope = {}) {
     if (folder === null) return false;
-    const rows = await this.rows();
-    const root = [...rows.values()].find((r) => r.key === key && inScope(r.doc, scope));
-    return !!root && this.within(rows, [root.id]).some((id) => String(id) === String(folder));
+    const rows2 = await this.rows();
+    const root = [...rows2.values()].find((r) => r.key === key && inScope(r.doc, scope));
+    return !!root && this.within(rows2, [root.id]).some((id) => String(id) === String(folder));
   }
   /** The user's level in a folder (`null`: the top level). */
   async level(user, id) {
@@ -3916,11 +3966,11 @@ var MediaFolders = class {
     if (!this.applies(user)) return true;
     if (operation === "create") return true;
     const need = RANK[needed(collection2, operation)];
-    const rows = await this.rows();
+    const rows2 = await this.rows();
     const allowed2 = [];
     let all = true;
-    for (const row of rows.values()) {
-      if (RANK[this.levelIn(rows, user.role, row.id)] >= need) allowed2.push(row.id);
+    for (const row of rows2.values()) {
+      if (RANK[this.levelIn(rows2, user.role, row.id)] >= need) allowed2.push(row.id);
       else all = false;
     }
     if (all) return true;
@@ -3948,12 +3998,12 @@ var MediaFolders = class {
    * @internal
    */
   async validate(data, self) {
-    const rows = await this.fresh();
+    const rows2 = await this.fresh();
     const name = typeof data.name === "string" ? data.name.trim() : "";
     const parent = data.parent ?? null;
     const errors = [];
     if (parent !== null && self !== void 0) {
-      let current = rows.get(String(parent));
+      let current = rows2.get(String(parent));
       const seen = /* @__PURE__ */ new Set();
       while (current && !seen.has(String(current.id))) {
         if (String(current.id) === String(self)) {
@@ -3961,10 +4011,10 @@ var MediaFolders = class {
           break;
         }
         seen.add(String(current.id));
-        current = current.parent === null ? void 0 : rows.get(String(current.parent));
+        current = current.parent === null ? void 0 : rows2.get(String(current.parent));
       }
     }
-    const taken = [...rows.values()].some(
+    const taken = [...rows2.values()].some(
       (row) => String(row.id) !== String(self) && String(row.parent) === String(parent) && row.name.trim().toLocaleLowerCase() === name.toLocaleLowerCase()
     );
     if (name && taken) errors.push({ field: "name", message: "is already used in this folder" });
@@ -4218,7 +4268,7 @@ var VersionStore = class {
   async latest(parent, docs) {
     const result = /* @__PURE__ */ new Map();
     if (docs.length === 0) return result;
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: {
         and: [
@@ -4231,7 +4281,7 @@ var VersionStore = class {
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs) result.set(String(row.doc), this.toVersion(row));
+    for (const row of rows2.docs) result.set(String(row.doc), this.toVersion(row));
     return result;
   }
   async list(parent, doc, limit, page) {
@@ -4256,24 +4306,24 @@ var VersionStore = class {
     return row ? this.toVersion(row) : null;
   }
   async deleteAll(parent, doc) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: { and: this.of(parent, doc) },
       sort: [],
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
+    for (const row of rows2.docs) await this.db.delete({ collection: VERSIONS, id: row.id });
   }
   async prune(parent, doc, max) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: VERSIONS,
       where: { and: this.of(parent, doc) },
       sort: ["-id"],
       limit: 0,
       page: 1
     });
-    for (const row of rows.docs.slice(max)) {
+    for (const row of rows2.docs.slice(max)) {
       await this.db.delete({ collection: VERSIONS, id: row.id });
     }
   }
@@ -4286,7 +4336,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac8, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash6, createHmac as createHmac8, randomBytes as randomBytes7, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4803,6 +4853,649 @@ function toOperation(row) {
   };
 }
 
+// src/integrations.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync, randomBytes as randomBytes6 } from "crypto";
+var ENV_NAME = "Environment";
+var PENDING_MS = 10 * 60 * 1e3;
+var keyOf2 = (secret) => Buffer.from(hkdfSync("sha256", secret, "", "easy-cms:connections", 32));
+var keyId = (key) => createHash4("sha256").update(key).digest("hex").slice(0, 12);
+function encryptValues(secret, values) {
+  const key = keyOf2(secret);
+  const iv = randomBytes6(12);
+  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const data = Buffer.concat([cipher.update(JSON.stringify(values), "utf8"), cipher.final()]);
+  const box = {
+    k: keyId(key),
+    iv: iv.toString("base64"),
+    t: cipher.getAuthTag().toString("base64"),
+    d: data.toString("base64")
+  };
+  return Buffer.from(JSON.stringify(box)).toString("base64url");
+}
+function decryptValues(secrets, sealed) {
+  const box = JSON.parse(Buffer.from(sealed, "base64url").toString("utf8"));
+  for (const [i, secret] of secrets.entries()) {
+    const key = keyOf2(secret);
+    if (keyId(key) !== box.k) continue;
+    const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(String(box.iv), "base64"));
+    decipher.setAuthTag(Buffer.from(String(box.t), "base64"));
+    const text4 = Buffer.concat([
+      decipher.update(Buffer.from(String(box.d), "base64")),
+      decipher.final()
+    ]).toString("utf8");
+    return { values: JSON.parse(text4), old: i > 0 };
+  }
+  throw new Error("A connection was encrypted with a secret that is no longer configured");
+}
+var keyIdOf = (sealed) => {
+  try {
+    return JSON.parse(Buffer.from(String(sealed), "base64url").toString("utf8")).k;
+  } catch {
+    return void 0;
+  }
+};
+function signState(secret, payload) {
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${body}.${signValue(secret, `integration:${body}`)}`;
+}
+function readState(secrets, state) {
+  const [body, signature] = state.split(".");
+  if (!body || !signature || !signedWith(secrets, `integration:${body}`, signature)) return null;
+  const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  return typeof payload.exp === "number" && payload.exp > Date.now() ? payload : null;
+}
+var OFFICIAL_PLUGINS = [
+  {
+    name: "@easy-cms/plugin-social",
+    category: "social",
+    description: {
+      en: "Post to Facebook, LINE and webhooks from the admin",
+      th: "\u0E42\u0E1E\u0E2A\u0E15\u0E4C\u0E44\u0E1B Facebook, LINE \u0E41\u0E25\u0E30 webhook \u0E08\u0E32\u0E01 admin"
+    },
+    docs: "https://easycms.dev/docs/integrations"
+  },
+  {
+    name: "@easy-cms/plugin-notify",
+    category: "notifications",
+    description: { en: "Telegram notifications for admins", th: "\u0E41\u0E08\u0E49\u0E07\u0E40\u0E15\u0E37\u0E2D\u0E19\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E17\u0E32\u0E07 Telegram" },
+    docs: "https://easycms.dev/docs/notifications"
+  },
+  {
+    name: "@easy-cms/plugin-ai",
+    category: "ai",
+    description: {
+      en: "Claude, GPT and Gemini for alt text, SEO and translation",
+      th: "Claude, GPT \u0E41\u0E25\u0E30 Gemini \u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A alt text, SEO \u0E41\u0E25\u0E30\u0E41\u0E1B\u0E25\u0E20\u0E32\u0E29\u0E32"
+    },
+    docs: "https://easycms.dev/docs/integrations"
+  },
+  {
+    name: "@easy-cms/plugin-ecommerce",
+    category: "payments",
+    description: { en: "A shop with Stripe payments", th: "\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32\u0E1E\u0E23\u0E49\u0E2D\u0E21\u0E0A\u0E33\u0E23\u0E30\u0E40\u0E07\u0E34\u0E19\u0E1C\u0E48\u0E32\u0E19 Stripe" },
+    docs: "https://easycms.dev/docs/ecommerce"
+  }
+];
+var mask = (value) => value.length > 4 ? `\u2022\u2022\u2022\u2022${value.slice(-4)}` : "\u2022\u2022\u2022\u2022";
+var Integrations = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get config() {
+    return this.cms.config;
+  }
+  get secrets() {
+    return secretsOf(this.config);
+  }
+  /** The integrations plugins declared. */
+  get definitions() {
+    return this.config.integrations;
+  }
+  definition(id) {
+    const found = this.definitions.find((d) => d.id === id);
+    if (!found) throw new NotFoundError("integrations", id);
+    return found;
+  }
+  async rows(id, kind) {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ integration: { equals: id } }, { kind: { equals: kind } }] },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    });
+    return found.docs;
+  }
+  /** The values of the fields set in the environment. */
+  envValues(def) {
+    const out = {};
+    for (const [field, name] of Object.entries(def.env ?? {})) {
+      const value = process.env[name];
+      if (value) out[field] = value;
+    }
+    return out;
+  }
+  /** Every field is in the environment: an "Environment" connection. */
+  envComplete(def) {
+    const env = this.envValues(def);
+    const fields = def.fields ?? [];
+    return fields.length > 0 && fields.every((f) => env[f.name] || !f.required) && Object.keys(env).length > 0;
+  }
+  async enabled(id) {
+    const [row] = await this.rows(id, "integration");
+    return row ? row.enabled !== false : true;
+  }
+  decrypt(row) {
+    const plain = row.values ?? {};
+    if (!row.secret) return { ...plain };
+    const { values, old } = decryptValues(this.secrets, String(row.secret));
+    if (old) void this.reseal(row, values);
+    return { ...plain, ...values };
+  }
+  async reseal(row, secrets) {
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, secret: encryptValues(this.config.secret, secrets) }
+    });
+  }
+  /** Splits values into the plain ones and the secret ones (encrypted). */
+  seal(def, values) {
+    const secretNames = new Set((def.fields ?? []).filter((f) => f.secret).map((f) => f.name));
+    const plain = {};
+    const secret = {};
+    for (const [name, value] of Object.entries(values))
+      (secretNames.has(name) || def.kind === "oauth" ? secret : plain)[name] = value;
+    return {
+      values: plain,
+      secret: Object.keys(secret).length ? encryptValues(this.config.secret, secret) : null
+    };
+  }
+  /**
+   * A connection for a plugin: the default one, or the one named; `null` when there is none
+   * or the integration is turned off. Values from the environment win.
+   */
+  async get(id, options = {}) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return null;
+    const env = this.envValues(def);
+    if (this.envComplete(def) && (!options.name || options.name === ENV_NAME))
+      return { name: ENV_NAME, values: env, env: true };
+    const rows2 = await this.rows(id, "connection");
+    const row = options.name ? rows2.find((r) => r.name === options.name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return null;
+    return { name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false };
+  }
+  /**
+   * Every connection of an integration (the environment's first), e.g. to notify each chat;
+   * none when it is turned off.
+   */
+  async all(id) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return [];
+    const env = this.envValues(def);
+    const out = this.envComplete(def) ? [{ name: ENV_NAME, values: env, env: true }] : [];
+    for (const row of await this.rows(id, "connection"))
+      out.push({ name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false });
+    return out;
+  }
+  /** The connection was used: its card says when, and an earlier error is gone. */
+  async markUsed(id, name) {
+    await this.mark(id, name, { lastUsedAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null });
+  }
+  /** It failed: the card and the dashboard's "needs attention" say why. */
+  async markError(id, message2, name) {
+    await this.mark(id, name, { lastError: message2.slice(0, 500) });
+    this.cms.systemEvent("integration.failed", {
+      integration: id,
+      name: name ?? null,
+      error: message2
+    });
+  }
+  async mark(id, name, patch) {
+    const rows2 = await this.rows(id, "connection");
+    const row = name ? rows2.find((r) => r.name === name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return;
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, ...patch, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  // --- The admin's page ------------------------------------------------------------------------
+  async overview() {
+    const integrations = [];
+    const current = keyId(keyOf2(this.config.secret));
+    let stale = 0;
+    for (const def of this.definitions) {
+      const rows2 = await this.rows(def.id, "connection");
+      const env = this.envValues(def);
+      const connections = rows2.map((row) => {
+        if (row.secret && keyIdOf(row.secret) !== current) stale++;
+        const secretNames = (def.fields ?? []).filter((f) => f.secret).map((f) => f.name);
+        let values = { ...row.values ?? {} };
+        try {
+          const all = this.decrypt(row);
+          for (const name of secretNames) if (all[name]) values[name] = mask(all[name]);
+        } catch {
+          values = { ...values };
+        }
+        return {
+          id: row.id,
+          name: String(row.name),
+          isDefault: row.isDefault === true,
+          env: false,
+          account: row.account ?? null,
+          lastUsedAt: row.lastUsedAt ?? null,
+          lastError: row.lastError ?? null,
+          values
+        };
+      });
+      if (this.envComplete(def)) {
+        for (const c of connections) c.isDefault = false;
+        connections.unshift({
+          id: "env",
+          name: ENV_NAME,
+          isDefault: true,
+          env: true,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          values: Object.fromEntries(
+            Object.entries(env).map(
+              ([k, v]) => (def.fields ?? []).find((f) => f.name === k)?.secret ? [k, mask(v)] : [k, v]
+            )
+          )
+        });
+      }
+      integrations.push({
+        id: def.id,
+        label: def.label,
+        category: def.category,
+        ...def.description ? { description: def.description } : {},
+        ...def.icon ? { icon: def.icon } : {},
+        ...def.docs ? { docs: def.docs } : {},
+        ...def.plugin ? { plugin: def.plugin } : {},
+        kind: def.kind,
+        // Functions don't travel: `findable` says a field has a Find button.
+        fields: (def.fields ?? []).map(({ lookup, ...field }) => ({
+          ...field,
+          ...lookup ? { findable: true } : {}
+        })),
+        enabled: await this.enabled(def.id),
+        envFields: Object.keys(env),
+        testable: typeof def.test === "function",
+        connections
+      });
+    }
+    const installed = new Set(this.config.installedPlugins.map((p) => p.name));
+    return {
+      integrations,
+      configured: this.configured(),
+      catalog: OFFICIAL_PLUGINS.filter((p) => !installed.has(p.name)),
+      staleSecrets: stale
+    };
+  }
+  /** The adapters the config sets: email, storage, search, sign-in, payments. */
+  configured() {
+    const out = [];
+    const { config } = this;
+    if (config.email) out.push({ id: "email", kind: "email", name: config.email.name ?? "email" });
+    out.push({ id: "storage", kind: "storage", name: config.upload.storage?.name ?? "disk" });
+    if (config.search)
+      out.push({ id: "search", kind: "search", name: config.search.name ?? "search" });
+    for (const provider of config.auth.providers ?? [])
+      out.push({ id: `sign-in:${provider.id}`, kind: "sign-in", name: provider.id });
+    if (config.installedPlugins.some((p) => p.name === "@easy-cms/plugin-ecommerce"))
+      out.push({ id: "payments", kind: "payments", name: "Stripe" });
+    return out;
+  }
+  async audit(user, action, id, detail = {}) {
+    await this.cms.audit.record({ action: `integration.${action}`, target: id, user, detail });
+  }
+  checkFields(def, values, partial) {
+    const errors = (def.fields ?? []).filter((f) => f.required && !partial && !values[f.name]).map((f) => ({ field: f.name, message: "is required" }));
+    if (errors.length) throw new ValidationError(CONNECTIONS, errors);
+  }
+  cleanValues(def, raw) {
+    const input = raw && typeof raw === "object" ? raw : {};
+    const out = {};
+    for (const field of def.fields ?? []) {
+      const raw2 = input[field.name];
+      const value = Array.isArray(raw2) ? raw2.filter((v) => typeof v === "string").join(",") : raw2;
+      if (typeof value === "string" && value.trim() !== "") out[field.name] = value.trim();
+    }
+    return out;
+  }
+  async uniqueName(id, name, self) {
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > 60)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: "must be 1 to 60 characters" }
+      ]);
+    if (trimmed === ENV_NAME || (await this.rows(id, "connection")).some((r) => r.name === trimmed && r.id !== self))
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: `there is already a connection named "${trimmed}"` }
+      ]);
+    return trimmed;
+  }
+  async create(def, name, values, account) {
+    const existing = await this.rows(def.id, "connection");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return await this.cms.db.create({
+      collection: CONNECTIONS,
+      data: {
+        kind: "connection",
+        integration: def.id,
+        name,
+        isDefault: existing.length === 0,
+        ...this.seal(def, values),
+        account,
+        lastUsedAt: null,
+        lastError: null,
+        enabled: null,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+  }
+  /** Connects with pasted values (`kind: 'fields'`); tested first when the plugin can. */
+  async connect(id, body, user) {
+    const def = this.definition(id);
+    if (def.kind !== "fields") throw new QueryError(`${id} connects with its Connect button`);
+    const input = body ?? {};
+    const name = await this.uniqueName(id, String(input.name ?? ""));
+    const values = this.cleanValues(def, input.values);
+    this.checkFields(def, values, false);
+    const result = def.test ? await def.test(values, { cms: this.cms }) : null;
+    if (result && !result.ok)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "values", message: result.message ?? "the provider refused these values" }
+      ]);
+    const row = await this.create(def, name, values, result?.account ?? null);
+    await this.audit(user, "connect", id, { name });
+    return { id: row.id };
+  }
+  async row(id, cid) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: cid });
+    if (!row || row.integration !== id || row.kind !== "connection")
+      throw new NotFoundError(CONNECTIONS, cid);
+    return row;
+  }
+  /** A new name or values (secrets left empty are kept), or the default. */
+  async update(id, cid, body, user) {
+    const def = this.definition(id);
+    const row = await this.row(id, cid);
+    const input = body ?? {};
+    const next = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) next.name = await this.uniqueName(id, String(input.name), cid);
+    if (input.values !== void 0) {
+      const values = { ...this.decrypt(row), ...this.cleanValues(def, input.values) };
+      this.checkFields(def, values, false);
+      Object.assign(next, this.seal(def, values), { lastError: null });
+    }
+    if (input.isDefault === true) {
+      for (const other of await this.rows(id, "connection"))
+        if (other.id !== cid && other.isDefault === true)
+          await this.cms.db.update({
+            collection: CONNECTIONS,
+            id: other.id,
+            data: { ...other, isDefault: false }
+          });
+      next.isDefault = true;
+    }
+    await this.cms.db.update({ collection: CONNECTIONS, id: cid, data: next });
+    await this.audit(user, input.isDefault === true ? "default" : "update", id, { name: next.name });
+    return { ok: true };
+  }
+  /** Removes the connection and its secrets; the oldest left becomes the default. */
+  async disconnect(id, cid, user) {
+    const row = await this.row(id, cid);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: cid });
+    if (row.isDefault === true) {
+      const [oldest] = await this.rows(id, "connection");
+      if (oldest)
+        await this.cms.db.update({
+          collection: CONNECTIONS,
+          id: oldest.id,
+          data: { ...oldest, isDefault: true }
+        });
+    }
+    await this.audit(user, "disconnect", id, { name: row.name });
+    return { deleted: 1 };
+  }
+  /** Turns the integration on or off; its connections are kept. */
+  async setEnabled(id, enabled, user) {
+    this.definition(id);
+    const [row] = await this.rows(id, "integration");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (row)
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: row.id,
+        data: { ...row, enabled, updatedAt: now }
+      });
+    else
+      await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "integration",
+          integration: id,
+          name: null,
+          isDefault: false,
+          values: null,
+          secret: null,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+    await this.audit(user, enabled ? "enable" : "disable", id);
+    return { enabled };
+  }
+  /** Checks a connection's values with the provider; the card shows the result. */
+  async test(id, cid) {
+    const def = this.definition(id);
+    if (!def.test) throw new QueryError(`${id} can't be tested`);
+    const values = cid === "env" ? this.envValues(def) : { ...this.decrypt(await this.row(id, cid)), ...this.envValues(def) };
+    let result;
+    try {
+      result = await def.test(values, { cms: this.cms });
+    } catch (error) {
+      result = { ok: false, message: error.message };
+    }
+    if (cid !== "env") {
+      const row = await this.row(id, cid);
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: cid,
+        data: {
+          ...row,
+          ...result.ok ? { lastError: null, ...result.account ? { account: result.account } : {} } : { lastError: result.message ?? "Test failed" },
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      if (!result.ok)
+        this.cms.systemEvent("integration.failed", {
+          integration: id,
+          name: row.name ?? null,
+          error: result.message ?? "Test failed"
+        });
+    }
+    return result;
+  }
+  /**
+   * A field's choices from the provider, with the values typed (and, editing a connection, its
+   * stored secrets for the fields left empty).
+   */
+  async lookup(id, fieldName, body) {
+    const def = this.definition(id);
+    const field = (def.fields ?? []).find((f) => f.name === fieldName);
+    if (!field?.lookup) throw new QueryError(`${id}.${fieldName} has nothing to look up`);
+    const input = body ?? {};
+    const stored = input.connection !== void 0 && input.connection !== null ? this.decrypt(await this.row(id, input.connection)) : {};
+    const values = { ...stored, ...this.envValues(def), ...this.cleanValues(def, input.values) };
+    try {
+      return { choices: [...await field.lookup(values, { cms: this.cms })].slice(0, 100) };
+    } catch (error) {
+      throw new ValidationError(CONNECTIONS, [
+        { field: fieldName, message: error.message }
+      ]);
+    }
+  }
+  // --- OAuth -----------------------------------------------------------------------------------
+  /** The provider's sign-in page to send the admin to. */
+  authorize(id, user, redirectUri, name) {
+    const def = this.definition(id);
+    if (def.kind !== "oauth" || !def.oauth)
+      throw new QueryError(`${id} connects with pasted values`);
+    const state = signState(this.config.secret, {
+      i: id,
+      u: String(user.id),
+      n: name,
+      exp: Date.now() + PENDING_MS
+    });
+    return { url: def.oauth.authorizeUrl({ redirectUri, state }) };
+  }
+  /**
+   * Back from the provider: one account is connected at once; several wait (encrypted, 10
+   * minutes) for the admin to choose. Returns where the admin goes next.
+   */
+  async callback(id, code, stateText, redirectUri, user) {
+    const def = this.definition(id);
+    const state = readState(this.secrets, stateText);
+    if (!state || state.i !== id || state.u !== String(user.id) || !def.oauth)
+      throw new ForbiddenError(
+        "This connection link has expired: start again from the Integrations page"
+      );
+    const result = await def.oauth.exchange({ code, redirectUri });
+    const name = typeof state.n === "string" && state.n ? state.n : String(def.label);
+    if (result.accounts && result.accounts.length > 0) {
+      if (result.accounts.length === 1) {
+        const [account] = result.accounts;
+        await this.create(
+          def,
+          await this.uniqueName(id, name),
+          { ...account.values },
+          account.name
+        );
+        await this.audit(user, "connect", id, { name });
+        return { connected: true };
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const pending = await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "pending",
+          integration: id,
+          name,
+          isDefault: false,
+          values: {
+            user: String(user.id),
+            expires: String(Date.now() + PENDING_MS),
+            accounts: JSON.stringify(result.accounts.map((a) => ({ id: a.id, name: a.name })))
+          },
+          secret: encryptValues(
+            this.config.secret,
+            Object.fromEntries(result.accounts.map((a) => [a.id, JSON.stringify(a.values)]))
+          ),
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+      return { pending: pending.id };
+    }
+    await this.create(
+      def,
+      await this.uniqueName(id, name),
+      { ...result.values ?? {} },
+      result.account ?? null
+    );
+    await this.audit(user, "connect", id, { name });
+    return { connected: true };
+  }
+  /** The accounts waiting to be chosen from, by name only. */
+  async pending(id, pid, user) {
+    const row = await this.pendingRow(id, pid, user);
+    const values = row.values;
+    return {
+      name: String(row.name),
+      accounts: JSON.parse(values.accounts ?? "[]")
+    };
+  }
+  async pendingRow(id, pid, user) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: pid });
+    const values = row?.values ?? {};
+    if (!row || row.kind !== "pending" || row.integration !== id || values.user !== String(user.id) || Number(values.expires) < Date.now())
+      throw new NotFoundError(CONNECTIONS, pid);
+    return row;
+  }
+  /** Connects the account chosen. */
+  async choose(id, pid, accountId, user) {
+    const def = this.definition(id);
+    const row = await this.pendingRow(id, pid, user);
+    const secrets = decryptValues(this.secrets, String(row.secret)).values;
+    const chosen = secrets[accountId];
+    const accounts = JSON.parse(
+      String(row.values.accounts ?? "[]")
+    );
+    const account = accounts.find((a) => a.id === accountId);
+    if (!chosen || !account) throw new NotFoundError("accounts", accountId);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: pid });
+    const name = await this.uniqueName(id, String(row.name));
+    const created = await this.create(
+      def,
+      name,
+      JSON.parse(chosen),
+      account.name
+    );
+    await this.audit(user, "connect", id, { name });
+    return { id: created.id };
+  }
+  // --- Rotating the secret ---------------------------------------------------------------------
+  /** Encrypts again, with the current secret, every connection still on an older one. */
+  async rotate() {
+    const current = keyId(keyOf2(this.config.secret));
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    let resealed = 0;
+    for (const row of found.docs) {
+      if (!row.secret || keyIdOf(row.secret) === current) continue;
+      const { values } = decryptValues(this.secrets, String(row.secret));
+      await this.reseal(row, values);
+      resealed++;
+    }
+    return { resealed };
+  }
+  /** Connections whose test or last use failed, for the dashboard's "needs attention". */
+  async broken() {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ kind: { equals: "connection" } }, { lastError: { exists: true } }] },
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    return found.docs.filter((r) => this.definitions.some((d) => d.id === r.integration)).map((r) => ({
+      integration: String(r.integration),
+      name: String(r.name),
+      error: String(r.lastError)
+    }));
+  }
+};
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4847,12 +5540,12 @@ function toLocaleMaps(fields, input, current, locale) {
         locale
       );
     } else if (hasRows(field) && Array.isArray(value)) {
-      const rows = new Map(
+      const rows2 = new Map(
         (Array.isArray(previous) ? previous : []).filter(isPlainObject2).map((row) => [String(row.id), row])
       );
       result[field.name] = value.map((row) => {
         const fields2 = rowFields(field, row);
-        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows.get(String(row.id)) ?? {}, locale) : row;
+        return fields2 && isPlainObject2(row) ? toLocaleMaps(fields2, row, rows2.get(String(row.id)) ?? {}, locale) : row;
       });
     }
   }
@@ -5272,13 +5965,13 @@ function embeddedIPv4(address) {
   return bytes ? bytes.slice(12).join(".") : void 0;
 }
 function ipv6Bytes(address) {
-  let text3 = address;
-  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text3);
+  let text4 = address;
+  const tail = /(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(text4);
   if (tail) {
     const [a, b, c, d] = tail.slice(1).map(Number);
-    text3 = `${text3.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
+    text4 = `${text4.slice(0, tail.index)}${(a << 8 | b).toString(16)}:${(c << 8 | d).toString(16)}`;
   }
-  const [head = "", rest] = text3.split("::");
+  const [head = "", rest] = text4.split("::");
   const left = head ? head.split(":") : [];
   const right = rest === void 0 ? [] : rest ? rest.split(":") : [];
   const groups = rest === void 0 ? left : [...left, ...Array(8 - left.length - right.length).fill("0"), ...right];
@@ -5457,7 +6150,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets integrations listeners db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -5476,7 +6169,7 @@ var GLOBAL = keys(
 );
 var CONTAINER_ADMIN = keys("icon order sidebar layout group");
 var COLLECTION_ADMIN = keys(
-  "icon order sidebar layout group editIn badge count empty list calendar ownerField confirmDelete"
+  "icon order sidebar layout group editIn badge count empty list calendar ownerField confirmDelete views export"
 );
 var FIELD_ADMIN = keys(
   "description width condition component after cell column allowCreate initialValue position filter"
@@ -5640,7 +6333,8 @@ var BUILTIN_NAV = [
     children: [
       { id: "site", label: { en: "Site", th: "\u0E40\u0E27\u0E47\u0E1A\u0E44\u0E0B\u0E15\u0E4C" }, icon: "globe" },
       { id: "people", label: { en: "Users & access", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49\u0E41\u0E25\u0E30\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C" }, icon: "users" },
-      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" }
+      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" },
+      { id: "integrations", label: { en: "Integrations", th: "\u0E01\u0E32\u0E23\u0E40\u0E0A\u0E37\u0E48\u0E2D\u0E21\u0E15\u0E48\u0E2D" }, icon: "link" }
     ]
   }
 ];
@@ -5747,26 +6441,26 @@ function fieldsText(fields, data) {
 }
 function richText(node) {
   if (!node || typeof node !== "object") return "";
-  const { text: text3, content } = node;
-  if (typeof text3 === "string") return text3;
+  const { text: text4, content } = node;
+  if (typeof text4 === "string") return text4;
   if (!Array.isArray(content)) return "";
   const inline = content.some((child) => typeof child?.text === "string");
   return content.map(richText).filter(Boolean).join(inline ? "" : "\n");
 }
 function searchText(fields, doc, paths) {
-  const text3 = {};
+  const text4 = {};
   for (const path of paths) {
     const field = fieldAt(fields, path);
     let value = doc;
     for (const name of path.split("."))
       value = value && typeof value === "object" ? value[name] : void 0;
-    text3[path] = field ? textOf(field, value) : "";
+    text4[path] = field ? textOf(field, value) : "";
   }
-  return text3;
+  return text4;
 }
 var segmenter = new Intl.Segmenter(void 0, { granularity: "word" });
-function words(text3) {
-  return [...segmenter.segment(text3.normalize("NFC").toLowerCase())].filter((s) => s.isWordLike).map((s) => s.segment);
+function words(text4) {
+  return [...segmenter.segment(text4.normalize("NFC").toLowerCase())].filter((s) => s.isWordLike).map((s) => s.segment);
 }
 function memorySearch() {
   const entries = /* @__PURE__ */ new Map();
@@ -5993,6 +6687,12 @@ function verifyWebhook(body, headers, secret, options = {}) {
 }
 
 // src/webhooks.ts
+var SYSTEM_EVENTS = [
+  "scheduled.failed",
+  "delivery.failed",
+  "backup.failed",
+  "integration.failed"
+];
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -6184,10 +6884,13 @@ var Webhooks = class {
       return { ok: false, error: error.message };
     }
   }
+  /** Told when a delivery is given up on (`delivery.failed`). */
+  onGiveUp;
   giveUp(hook, event, error, attempts) {
     this.logger.error(
       `Webhook ${hook.url} failed for ${event} after ${attempts} attempts: ${error}`
     );
+    this.onGiveUp?.({ url: hook.url, event, error, attempts });
   }
 };
 var later4 = (from, ms) => new Date(from.getTime() + ms).toISOString();
@@ -6276,6 +6979,8 @@ function validateConfig(config) {
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
   validateJobs(config, add);
+  validateIntegrations(config, add);
+  validateListeners(config, add);
   validateTimeZone(config, add);
   validateEvents(config, add);
   const apiKeys = config.apiKeys;
@@ -6803,7 +7508,7 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
-  const custom = new Set(config.events ?? []);
+  const custom = /* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS]);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
@@ -7207,7 +7912,26 @@ function validateLayout(layout, container, path, add) {
   nodes(layout, path, true);
 }
 function validateCollectionAdmin(admin, path, add) {
-  const { badge, count, empty } = admin;
+  const { badge, count, empty, views } = admin;
+  if (views !== void 0) {
+    if (!Array.isArray(views)) add(`${path}.views`, "must be an array");
+    const ids = /* @__PURE__ */ new Set();
+    for (const [i, raw] of (Array.isArray(views) ? views : []).entries()) {
+      const view = raw ?? {};
+      const at = `${path}.views[${i}]`;
+      if (typeof view.id !== "string" || !/^[a-z0-9][a-z0-9_-]*$/.test(view.id))
+        add(`${at}.id`, 'must be lowercase letters, digits, "-" or "_"', "e.g. id: 'to-review'");
+      else if (ids.has(view.id)) add(`${at}.id`, `duplicate view "${view.id}"`);
+      else ids.add(view.id);
+      if (!isLabel(view.label)) add(`${at}.label`, "must be a string or { en, th }");
+      if (view.where !== void 0 && (typeof view.where !== "object" || view.where === null || Array.isArray(view.where)))
+        add(`${at}.where`, "must be a where query", "e.g. { status: { equals: 'draft' } }");
+      if (view.pageSize !== void 0 && ![10, 25, 50, 100].includes(view.pageSize))
+        add(`${at}.pageSize`, "must be 10, 25, 50 or 100");
+      if (view.density !== void 0 && !["comfortable", "compact"].includes(view.density))
+        add(`${at}.density`, "must be 'comfortable' or 'compact'");
+    }
+  }
   if (badge !== void 0) {
     const b = badge ?? {};
     if (typeof b.where !== "object" || b.where === null || Array.isArray(b.where))
@@ -7217,6 +7941,8 @@ function validateCollectionAdmin(admin, path, add) {
   }
   if (count !== void 0 && typeof count !== "boolean")
     add(`${path}.count`, "must be true or false");
+  if (admin.export !== void 0 && typeof admin.export !== "boolean")
+    add(`${path}.export`, "must be true or false");
   if (empty !== void 0) {
     const e = empty ?? {};
     if (e.description !== void 0 && !isLabel(e.description))
@@ -7872,6 +8598,56 @@ function validateAdapterVersions(config, add) {
       );
   }
 }
+function validateIntegrations(config, add) {
+  const list = config.integrations;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("integrations", "must be an array");
+    return;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const [i, raw] of list.entries()) {
+    const at = `integrations[${i}]`;
+    const item = raw ?? {};
+    if (typeof item.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(item.id))
+      add(`${at}.id`, 'must be lowercase letters, digits and "-"', "e.g. id: 'telegram'");
+    else if (ids.has(item.id)) add(`${at}.id`, `two integrations are named "${item.id}"`);
+    else ids.add(item.id);
+    if (!isLabel(item.label)) add(`${at}.label`, "must be a string or { en, th }");
+    if (!["social", "ai", "notifications", "automation"].includes(item.category))
+      add(`${at}.category`, "must be 'social', 'ai', 'notifications' or 'automation'");
+    if (item.kind === "fields") {
+      if (!Array.isArray(item.fields) || item.fields.length === 0)
+        add(`${at}.fields`, "needs at least one field to fill");
+    } else if (item.kind === "oauth") {
+      const oauth = item.oauth ?? {};
+      if (typeof oauth.authorizeUrl !== "function" || typeof oauth.exchange !== "function")
+        add(`${at}.oauth`, "needs authorizeUrl and exchange functions");
+    } else add(`${at}.kind`, "must be 'fields' or 'oauth'");
+    if (item.test !== void 0 && typeof item.test !== "function")
+      add(`${at}.test`, "must be a function");
+    for (const [f, field] of (Array.isArray(item.fields) ? item.fields : []).entries()) {
+      const fieldItem = field ?? {};
+      if (fieldItem.lookup !== void 0 && typeof fieldItem.lookup !== "function")
+        add(`${at}.fields[${f}].lookup`, "must be a function");
+    }
+  }
+}
+function validateListeners(config, add) {
+  const list = config.listeners;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("listeners", "must be an array");
+    return;
+  }
+  for (const [i, raw] of list.entries()) {
+    const item = raw ?? {};
+    const events = item.events;
+    if (events !== "*" && !(Array.isArray(events) && events.every((e) => typeof e === "string" && e.length > 0)))
+      add(`listeners[${i}].events`, "must be event names or '*'", "e.g. events: ['order.created']");
+    if (typeof item.handler !== "function") add(`listeners[${i}].handler`, "must be a function");
+  }
+}
 
 // src/resolve-config.ts
 var DEFAULT_ADMIN_PATH = "/admin";
@@ -7981,14 +8757,18 @@ async function resolveConfig(input) {
       ...config.rateLimit ? [rateLimitsCollection] : [],
       databaseBackupsCollection,
       bulkOperationsCollection,
+      savedViewsCollection,
+      ...resolvedIntegrations(config).length > 0 ? [connectionsCollection] : [],
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
+    integrations: resolvedIntegrations(config),
     cliCommands: config.cliCommands ?? [],
-    events: config.events ?? [],
+    // Easy CMS's own events (#356), for webhooks and `cms.on`.
+    events: [.../* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS])],
     jobs: config.jobs ?? [],
     warnings,
     installedPlugins: (plugins ?? []).map(
@@ -8064,9 +8844,12 @@ function resolveAudit(audit) {
     scope: audit.scope ?? false
   };
 }
+function resolvedIntegrations(config) {
+  return config.integrations ?? [];
+}
 
 // src/rest/http-cache.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var cacheTags = {
   collection: (slug2) => ["ecms", `ecms:${slug2}`],
   document: (slug2, id) => ["ecms", `ecms:${slug2}`, `ecms:${slug2}:${id}`],
@@ -8093,7 +8876,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
   );
   headers.set("cache-tag", tags.join(","));
   headers.set("surrogate-key", tags.join(" "));
-  const etag = `W/"${createHash4("sha1").update(body).digest("base64url")}"`;
+  const etag = `W/"${createHash5("sha1").update(body).digest("base64url")}"`;
   headers.set("etag", etag);
   if (matches2(request.headers.get("if-none-match"), etag))
     return new Response(null, { status: 304, headers });
@@ -8101,7 +8884,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.30.1" : "0.0.0-dev";
+var VERSION = true ? "1.32.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -8378,6 +9161,8 @@ var EasyCMS = class {
   audit;
   /** Folders of the media library and their permissions (`upload.folders`). */
   folders;
+  /** Accounts connected to plugins' integrations (`integrations`, Settings → Integrations). */
+  integrations;
   versions;
   webhooks;
   mailer;
@@ -8405,6 +9190,12 @@ var EasyCMS = class {
       (entry) => this.audit.record(entry)
     );
     this.audit = new AuditLog(this);
+    this.integrations = new Integrations(this);
+    for (const listener of config.listeners ?? []) {
+      const run = (message2) => listener.handler(message2, { cms: this });
+      if (listener.events === "*") this.anyListeners.add(run);
+      else for (const event of listener.events) this.on(event, run);
+    }
     this.folders = new MediaFolders(config, db, this.roles);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
@@ -8416,6 +9207,8 @@ var EasyCMS = class {
       logger,
       config.collections.some((c) => c.slug === EMAIL_DELIVERIES) ? this.emailQueue() : void 0
     );
+    this.webhooks.onGiveUp = ({ url, event, error, attempts }) => this.systemEvent("delivery.failed", { kind: "webhook", url, event, error, attempts });
+    this.mailer.onGiveUp = ({ to, error, attempts }) => this.systemEvent("delivery.failed", { kind: "email", to, error, attempts });
     this.outbox = config.collections.some((c) => c.slug === OUTBOX) ? new Outbox(
       db,
       logger,
@@ -8608,7 +9401,7 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random2 = randomBytes6(4).toString("hex");
+    const random2 = randomBytes7(4).toString("hex");
     const isPrivate = await this.folders.isPrivate(folderOf(MEDIA, data));
     const storage = this.storageFor(isPrivate);
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
@@ -8676,7 +9469,7 @@ var EasyCMS = class {
       ]);
     const isPrivate = await this.folders.isPrivate(folder);
     const storage = this.storageFor(isPrivate);
-    const key = withPrivacy(storageKey(name, type, randomBytes6(4).toString("hex")), isPrivate);
+    const key = withPrivacy(storageKey(name, type, randomBytes7(4).toString("hex")), isPrivate);
     const upload = storage.uploadURL ? await storage.uploadURL(key, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
     const ticket = this.sign("upload", {
       key,
@@ -9801,12 +10594,12 @@ var EasyCMS = class {
       if (asked !== void 0 && localization && !localization.locales.includes(asked))
         throw new QueryError(`Unknown locale "${asked}"`);
       const locale = localization ? asked ?? localization.defaultLocale ?? null : null;
-      const text3 = query.trim().slice(0, 200);
+      const text4 = query.trim().slice(0, 200);
       const empty = { hits: [], total: 0, page, limit, hasNextPage: false };
-      if (!text3 || collections.length === 0) return empty;
+      if (!text4 || collections.length === 0) return empty;
       const { collections: _, limit: __, page: ___, ...read2 } = options;
       const { hits, total } = await index.search(
-        { query: text3, collections, locale, limit, offset: (page - 1) * limit },
+        { query: text4, collections, locale, limit, offset: (page - 1) * limit },
         async (collection2, ids) => (await this.find(collection2, {
           ...read2,
           ...locale ? { locale } : {},
@@ -9960,13 +10753,13 @@ var EasyCMS = class {
     const { jobs } = this.config;
     if (jobs.length === 0) return { ran: 0, failed: 0 };
     const { docs } = await this.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 });
-    const rows = new Map(docs.map((row) => [String(row.name), row]));
+    const rows2 = new Map(docs.map((row) => [String(row.name), row]));
     let legacy;
     const stamp = now.toISOString();
     let ran = 0;
     let failed = 0;
     for (const job of jobs) {
-      const fresh = rows.has(job.name) ? await this.db.findById({ collection: JOB_RUNS, id: rows.get(job.name)?.id }) : null;
+      const fresh = rows2.has(job.name) ? await this.db.findById({ collection: JOB_RUNS, id: rows2.get(job.name)?.id }) : null;
       const row = fresh ?? void 0;
       if (row?.pausedAt) continue;
       const schedule = jobSchedule(job, row);
@@ -10080,6 +10873,37 @@ var EasyCMS = class {
     if (!this.config.events.includes(event))
       throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
     this.webhooks.emit(event, about ?? {}, data);
+    this.dispatch(event, data, about);
+  }
+  listeners = /* @__PURE__ */ new Map();
+  /** Listeners of every event (`events: '*'` in the config's `listeners`). */
+  anyListeners = /* @__PURE__ */ new Set();
+  /**
+   * Runs `handler` after each `event` on this server (#356): the config's and plugins' events, the
+   * content changes webhooks get (`create`, `publish`…), and Easy CMS's own (`scheduled.failed`,
+   * `delivery.failed`, `backup.failed`, `integration.failed`). It runs after the change, without
+   * being waited for; its errors are logged. Returns a function that stops it.
+   */
+  on(event, handler) {
+    const set = this.listeners.get(event) ?? /* @__PURE__ */ new Set();
+    set.add(handler);
+    this.listeners.set(event, set);
+    return () => set.delete(handler);
+  }
+  dispatch(event, data, about) {
+    const set = [...this.listeners.get(event) ?? [], ...this.anyListeners];
+    if (set.length === 0) return;
+    for (const handler of set)
+      queueMicrotask(() => {
+        Promise.resolve().then(() => handler({ event, data, ...about ? { about } : {} })).catch(
+          (error) => this.logger.error(`A listener of ${event} failed: ${errorText(error)}`, { error })
+        );
+      });
+  }
+  /** @internal Easy CMS's own events (`SYSTEM_EVENTS`): to webhooks that list them and `cms.on`. */
+  systemEvent(event, data) {
+    this.webhooks.emit(event, {}, data);
+    this.dispatch(event, data);
   }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
@@ -10238,6 +11062,13 @@ var EasyCMS = class {
             updatedAt: (/* @__PURE__ */ new Date()).toISOString()
           }
         });
+        this.systemEvent("scheduled.failed", {
+          job: row.id,
+          action,
+          ...row.collection ? { collection: row.collection } : { global: row.global },
+          doc: row.doc ?? null,
+          error: message2
+        });
       }
     }
     return { ran, failed };
@@ -10350,7 +11181,7 @@ var EasyCMS = class {
       ...options.from !== void 0 ? { gte: options.from } : {},
       ...options.to !== void 0 ? { lt: options.to } : {}
     };
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: SCHEDULED_JOBS,
       where: {
         and: [
@@ -10385,7 +11216,7 @@ var EasyCMS = class {
       return result;
     };
     const jobs = [];
-    for (const row of rows.docs) {
+    for (const row of rows2.docs) {
       const parent = String(row.parent);
       if (!await may2(parent)) continue;
       const target = parent.startsWith("global:") ? { global: splitGlobalKey(parent.slice("global:".length)).slug } : { collection: parent };
@@ -10395,7 +11226,7 @@ var EasyCMS = class {
     return jobs;
   }
   async pendingJobs(parent, doc) {
-    const rows = await this.db.find({
+    const rows2 = await this.db.find({
       collection: SCHEDULED_JOBS,
       where: {
         and: [
@@ -10408,7 +11239,7 @@ var EasyCMS = class {
       limit: 0,
       page: 1
     });
-    return rows.docs.map(toJob);
+    return rows2.docs.map(toJob);
   }
   async removeJob(parent, doc, jobId) {
     const job = (await this.pendingJobs(parent, doc)).find((j) => String(j.id) === String(jobId));
@@ -10866,8 +11697,10 @@ var EasyCMS = class {
    * are logged.
    */
   emitChange(config, event, doc, before) {
-    for (const change of this.changeEvents(config, event, doc, before))
+    for (const change of this.changeEvents(config, event, doc, before)) {
       this.webhooks.emit(change.event, change.target, change.body);
+      this.dispatch(change.event, change.body, change.target);
+    }
     if (this.searches(config, event)) this.searchIndex?.syncLater(config.slug, doc.id);
     const purge = this.config.httpCache?.purge;
     const tags = this.purgeTags(config, event, doc, before);
@@ -10917,8 +11750,10 @@ var EasyCMS = class {
     }
     if (!done.has("webhooks")) {
       const changes = this.changeEvents(config, event, doc, entry.before);
-      for (const change of changes)
+      for (const change of changes) {
         await this.webhooks.emitSaved(change.event, change.target, change.body);
+        this.dispatch(change.event, change.body, change.target);
+      }
       if (changes.length > 0 && (this.config.webhooks?.length ?? 0) > 0) await mark("webhooks");
     }
     if (!done.has("search") && this.searchIndex && this.searches(config, event)) {
@@ -11409,7 +12244,7 @@ function durationSeconds(value) {
 }
 function cursorQuery(collection2, where, sort, locale, draft) {
   const key = JSON.stringify([collection2, where ?? null, sort, locale ?? null, draft]);
-  return createHash5("sha256").update(key).digest("base64url").slice(0, 16);
+  return createHash6("sha256").update(key).digest("base64url").slice(0, 16);
 }
 function writeCursor(keys2, query) {
   return Buffer.from(JSON.stringify({ k: keys2, q: query })).toString("base64url");
@@ -11441,8 +12276,8 @@ function hasCalendarPage(config) {
 var text2 = (value) => typeof value === "string" && value !== "" ? value : null;
 async function adminJobs(cms, user) {
   const { config } = cms;
-  const rows = has(config, JOB_RUNS) ? (await cms.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 })).docs : [];
-  const byName = new Map(rows.map((row) => [String(row.name), row]));
+  const rows2 = has(config, JOB_RUNS) ? (await cms.db.find({ collection: JOB_RUNS, sort: ["name"], limit: 0, page: 1 })).docs : [];
+  const byName = new Map(rows2.map((row) => [String(row.name), row]));
   const jobs = config.jobs.map((job) => {
     const row = byName.get(job.name);
     const lastRunAt = text2(row?.lastRunAt);
@@ -11719,7 +12554,8 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
-    if ((id === "deliveries" || id === "jobs") && user.scoped === true) return false;
+    if ((id === "deliveries" || id === "jobs" || id === "integrations") && user.scoped === true)
+      return false;
     if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
       return true;
     if (!this.enabled)
@@ -11816,9 +12652,9 @@ var Roles = class {
   }
   async addMissing() {
     if (!this.enabled) return;
-    const rows = await this.rows();
-    const first = rows.length === 0;
-    const known = new Set(rows.map((r) => String(r.key)));
+    const rows2 = await this.rows();
+    const first = rows2.length === 0;
+    const known = new Set(rows2.map((r) => String(r.key)));
     for (const key of this.config.auth.roles) {
       if (known.has(key)) continue;
       try {
@@ -11876,15 +12712,15 @@ var Roles = class {
   // --- Settings → Roles ----------------------------------------------------
   async list() {
     await this.sync();
-    const rows = await this.rows();
+    const rows2 = await this.rows();
     const counts = /* @__PURE__ */ new Map();
-    for (const row of rows) {
+    for (const row of rows2) {
       counts.set(
         String(row.key),
         await this.db.count({ collection: USERS, where: { role: { equals: row.key } } })
       );
     }
-    const roles = rows.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
+    const roles = rows2.map((row) => this.toRole(row, counts.get(String(row.key)) ?? 0)).sort((a, b) => rank(a, this.config) - rank(b, this.config) || a.key.localeCompare(b.key));
     const decided = roles.filter((r) => r.key !== "admin").map((r) => r.permissions);
     const seen = (group, slug2) => decided.some((p) => p[group]?.[slug2] !== void 0);
     return {
@@ -12007,6 +12843,7 @@ var Roles = class {
         (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
       ) ? [{ id: "deliveries" }] : [],
       ...hasJobsPage(this.config) ? [{ id: "jobs" }] : [],
+      ...this.config.integrations.length > 0 ? [{ id: "integrations" }] : [],
       ...hasCalendarPage(this.config) ? [{ id: "calendar" }] : [],
       ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
       ...this.config.admin.dashboard.map((widget) => ({
@@ -12209,7 +13046,7 @@ function rank(role, config) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -12250,7 +13087,7 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash6("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash7("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/rest/handler.ts
@@ -12261,9 +13098,9 @@ var PER_PAGE = 50;
 var collectionOf = (kind) => kind === "webhook" ? WEBHOOK_DELIVERIES : EMAIL_DELIVERIES;
 var exists = (cms, kind) => cms.config.collections.some((c) => c.slug === collectionOf(kind));
 var isDeliveryKind = (value) => value === "webhook" || value === "email";
-function parse3(text3) {
+function parse3(text4) {
   try {
-    const value = JSON.parse(String(text3 ?? ""));
+    const value = JSON.parse(String(text4 ?? ""));
     return typeof value === "object" && value !== null ? value : {};
   } catch {
     return {};
@@ -12445,7 +13282,7 @@ async function sendTestEmail(cms, user, to, locale) {
   const th = locale === "th" || locale !== "en" && cms.config.admin.locale === "th";
   const time = (/* @__PURE__ */ new Date()).toISOString();
   const subject = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E08\u0E32\u0E01 ${site}` : `Test email from ${site}`;
-  const text3 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
+  const text4 = th ? `\u0E2D\u0E35\u0E40\u0E21\u0E25\u0E19\u0E35\u0E49\u0E2A\u0E48\u0E07\u0E08\u0E32\u0E01\u0E2B\u0E19\u0E49\u0E32 \u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32 \u2192 \u0E2D\u0E35\u0E40\u0E21\u0E25 \u0E02\u0E2D\u0E07 ${site} \u0E40\u0E1E\u0E37\u0E48\u0E2D\u0E17\u0E14\u0E2A\u0E2D\u0E1A\u0E01\u0E32\u0E23\u0E15\u0E31\u0E49\u0E07\u0E04\u0E48\u0E32
 
 \u0E2A\u0E48\u0E07\u0E42\u0E14\u0E22: ${user.email}
 Adapter: ${adapter.name ?? "custom"}
@@ -12457,7 +13294,7 @@ Adapter: ${adapter.name ?? "custom"}
 From: ${from}
 Time: ${time}`;
   try {
-    await adapter.send({ to: address, subject, text: text3, from });
+    await adapter.send({ to: address, subject, text: text4, from });
     return logsOnly(cms) ? { ok: true, logged: true } : { ok: true };
   } catch (error) {
     return { ok: false, error: message(error) };
@@ -12647,6 +13484,8 @@ async function collection(cms, config, user, localized, roles, context) {
   if (config.admin?.empty) result.empty = JSON.parse(JSON.stringify(config.admin.empty));
   if (config.admin?.list?.tree) result.tree = config.admin.list.tree;
   if (config.admin?.list?.sort) result.defaultSort = config.admin.list.sort;
+  if (config.admin?.views?.length) result.views = JSON.parse(JSON.stringify(config.admin.views));
+  if (config.admin?.export === false) result.noExport = true;
   if (config.admin?.calendar) result.calendar = { ...config.admin.calendar };
   if (config.admin?.confirmDelete) result.confirmDelete = { ...config.admin.confirmDelete };
   const owner = cms.roles.ownerOf(config.slug);
@@ -12703,7 +13542,8 @@ async function adminSchema(cms, user, origin, context = {}) {
     roles: admin && cms.roles.enabled,
     sso: admin && cms.auth.sso.enabled,
     audit: cms.audit.enabled && await cms.roles.canView(user, "audit"),
-    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar")
+    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar"),
+    integrations: cms.config.integrations.length > 0 && await cms.roles.canView(user, "integrations")
   };
   const roles = await cms.roles.options();
   const adminCollections = await Promise.all(
@@ -12843,7 +13683,8 @@ var VIEW_GROUPS = [
   ["email", "settings.system"],
   ["deliveries", "settings.system"],
   ["jobs", "settings.system"],
-  ["audit", "settings.system"]
+  ["audit", "settings.system"],
+  ["integrations", "settings.integrations"]
 ];
 function buildNav(cms, collections, globals, pageRefs, views) {
   const groups = navGroups(cms.config.admin.nav);
@@ -13076,6 +13917,15 @@ async function adminStatus(cms) {
   if (failed.length > 0) attention.push({ id: "jobs", count: failed.length, names: failed });
   const paused = await pausedJobs(cms);
   if (paused.length > 0) attention.push({ id: "jobs-paused", count: paused.length, names: paused });
+  if (config.integrations.length > 0) {
+    const broken = await cms.integrations.broken();
+    if (broken.length > 0)
+      attention.push({
+        id: "integrations",
+        count: broken.length,
+        names: broken.map((b) => `${b.integration}: ${b.name}`)
+      });
+  }
   const backups = await backupAttention(cms);
   if (backups) attention.push(backups);
   attention.push(...await cms.audit.attention());
@@ -13097,6 +13947,182 @@ async function adminStatus(cms) {
   };
 }
 
+// src/rest/export-csv.ts
+var EXPORT_MAX = 1e5;
+var STEP = 500;
+var SYSTEM = {
+  id: "ID",
+  status: { en: "Status", th: "\u0E2A\u0E16\u0E32\u0E19\u0E30" },
+  createdAt: { en: "Created", th: "\u0E2A\u0E23\u0E49\u0E32\u0E07\u0E40\u0E21\u0E37\u0E48\u0E2D" },
+  updatedAt: { en: "Updated", th: "\u0E41\u0E01\u0E49\u0E44\u0E02\u0E40\u0E21\u0E37\u0E48\u0E2D" }
+};
+var text3 = (label, fallback, lang) => label === void 0 ? fallback : typeof label === "string" ? label : label[lang] ?? label.en ?? Object.values(label)[0] ?? fallback;
+function isoInZone(value, timeZone) {
+  const date = new Date(value);
+  if (!timeZone || Number.isNaN(date.getTime())) return value;
+  const parts = Object.fromEntries(
+    new Intl.DateTimeFormat("en-CA", {
+      timeZone,
+      year: "numeric",
+      month: "2-digit",
+      day: "2-digit",
+      hour: "2-digit",
+      minute: "2-digit",
+      second: "2-digit",
+      hourCycle: "h23"
+    }).formatToParts(date).map((p) => [p.type, p.value])
+  );
+  const local = `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}`;
+  const offset = Math.round((Date.parse(`${local}Z`) - date.getTime()) / 6e4);
+  const sign3 = offset < 0 ? "-" : "+";
+  const abs = Math.abs(offset);
+  return `${local}${sign3}${String(Math.floor(abs / 60)).padStart(2, "0")}:${String(abs % 60).padStart(2, "0")}`;
+}
+function cellOf(cms, field, value, key, lang) {
+  if (value === null || value === void 0) return "";
+  const timeZone = cms.config.timeZone;
+  if (!field)
+    return key === "createdAt" || key === "updatedAt" ? isoInZone(String(value), timeZone) : value;
+  const titleOf = (slug2, doc) => {
+    if (!doc || typeof doc !== "object") return String(doc);
+    const d = doc;
+    if (slug2 === "media" && typeof d.url === "string") return d.url;
+    const collection2 = cms.config.collections.find((c) => c.slug === slug2);
+    const title = collection2?.useAsTitle ? d[collection2.useAsTitle] : void 0;
+    return typeof title === "string" && title !== "" ? title : String(d.id ?? "");
+  };
+  switch (field.type) {
+    case "date":
+      return isoInZone(String(value), timeZone);
+    case "boolean":
+      return value ? "true" : "false";
+    case "select": {
+      const label = (v) => {
+        const option = field.options.find((o) => (typeof o === "string" ? o : o.value) === v);
+        return option === void 0 || typeof option === "string" ? String(v) : text3(option.label, String(v), lang);
+      };
+      return Array.isArray(value) ? value.map(label).join("; ") : label(value);
+    }
+    case "richText":
+      return richText(value);
+    case "relationship":
+    case "upload": {
+      const one = (item) => {
+        if (isPolymorphic(field)) {
+          const pair = polymorphicValue(item);
+          if (!pair) return "";
+          const collection2 = cms.config.collections.find((c) => c.slug === pair.relationTo);
+          const name = text3(collection2?.labels?.singular, pair.relationTo, lang);
+          return `${name} \xB7 ${titleOf(pair.relationTo, pair.value)}`;
+        }
+        return titleOf(relationTargets(field)[0], item);
+      };
+      return Array.isArray(value) ? value.map(one).join("; ") : one(value);
+    }
+    default:
+      return value;
+  }
+}
+async function columnsOf(cms, config, asked, options) {
+  const rules = await cms.roles.fieldRules(options.user);
+  const read2 = new FieldAccessChecker(
+    "read",
+    { user: options.user, context: options.context },
+    rules
+  );
+  const readable3 = [];
+  for (const field of config.fields)
+    if (!field.hidden && field.name !== "password" && await read2.allows(field))
+      readable3.push(field);
+  const system2 = [...config.drafts ? ["status"] : [], "createdAt", "updatedAt"];
+  const of = (key) => {
+    const field = readable3.find((f) => f.name === key);
+    if (field) return { key, label: field.label ?? key, field };
+    return key in SYSTEM && (key !== "status" || config.drafts) ? { key, label: SYSTEM[key] } : void 0;
+  };
+  const keys2 = asked ?? [...readable3.map((f) => f.name), ...system2];
+  const columns = keys2.filter((k) => k !== "id").map(of).filter((c) => c !== void 0);
+  return [{ key: "id", label: SYSTEM.id }, ...columns];
+}
+async function exportCsv(cms, slug2, url, options) {
+  const config = cms.collection(slug2);
+  if (config.admin?.export === false)
+    throw new ForbiddenError("Export is turned off for this collection");
+  const q = url.searchParams;
+  const lang = q.get("lang") ?? "en";
+  const names = q.get("headers") === "names";
+  const columnsParam = q.get("columns");
+  const asked = columnsParam && columnsParam !== "all" ? columnsParam.split(",").filter(Boolean) : null;
+  const ids = q.get("ids")?.split(",").filter(Boolean);
+  const where = ids?.length ? { and: [...options.where ? [options.where] : [], { id: { in: ids } }] } : options.where;
+  const read2 = {
+    user: options.user,
+    context: options.context,
+    overrideAccess: false,
+    draft: options.draft,
+    ...options.locale ? { locale: options.locale } : {},
+    ...options.fallbackLocale === false ? { fallbackLocale: false } : {}
+  };
+  const total = await cms.count(slug2, { ...read2, ...where ? { where } : {}, max: EXPORT_MAX });
+  if (total > EXPORT_MAX)
+    throw new QueryError(
+      `More than ${EXPORT_MAX.toLocaleString("en")} documents match: filter the list further`
+    );
+  const columns = await columnsOf(cms, config, asked, options);
+  const header2 = columns.map((c) => names ? c.key : text3(c.label, c.key, lang));
+  await cms.audit.record({
+    action: "export",
+    target: slug2,
+    user: options.user,
+    detail: { rows: total, columns: columns.map((c) => c.key) }
+  });
+  const encoder = new TextEncoder();
+  let cursor = "";
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(`\uFEFF${header2.map(csvCell).join(",")}\r
+`));
+    },
+    async pull(controller) {
+      if (cursor === null) {
+        controller.close();
+        return;
+      }
+      try {
+        const page = await cms.find(
+          slug2,
+          {
+            ...read2,
+            ...where ? { where } : {},
+            ...options.sort?.length ? { sort: options.sort } : {},
+            limit: STEP,
+            depth: 1,
+            cursor
+          }
+        );
+        const lines = page.docs.map(
+          (doc) => columns.map((c) => csvCell(cellOf(cms, c.field, doc[c.key], c.key, lang))).join(",")
+        );
+        if (lines.length) controller.enqueue(encoder.encode(`${lines.join("\r\n")}\r
+`));
+        cursor = page.nextCursor ?? null;
+        if (cursor === null) controller.close();
+      } catch (error) {
+        controller.error(error);
+      }
+    }
+  });
+  const day = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  return new Response(stream, {
+    headers: {
+      "content-type": "text/csv; charset=utf-8",
+      "content-disposition": `attachment; filename="${slug2}-${day}.csv"`,
+      "cache-control": "no-store",
+      "x-content-type-options": "nosniff"
+    }
+  });
+}
+
 // src/rest/filter-options.ts
 function fieldAt2(fields, path) {
   let current = fields;
@@ -13138,12 +14164,12 @@ async function blockSummaries(cms, user, body) {
     const summary = field.blocks.find((b) => b.slug === blockType)?.admin?.summary;
     if (typeof id !== "string" || typeof summary !== "function") continue;
     try {
-      const text3 = await summary({
+      const text4 = await summary({
         fields: fields && typeof fields === "object" ? fields : {},
         user,
         cms
       });
-      if (typeof text3 === "string") summaries[id] = text3;
+      if (typeof text4 === "string") summaries[id] = text4;
     } catch (error) {
       cms.logger.warn(`admin.summary of block "${String(blockType)}" failed: ${String(error)}`);
     }
@@ -13252,6 +14278,191 @@ function parseDepth(url) {
   return depth === void 0 ? {} : { depth };
 }
 
+// src/rest/saved-views.ts
+var MAX_OWN_VIEWS = 50;
+var MAX_STATE = 1e4;
+var QUERY_KEY = /^(where\[and\]\[\d+\]\[[^\]]+\]\[[a-z_]+\]|q|sort|scheduled|type|calendar)$/;
+var userKey = (user) => String(user.id);
+var stamps = () => {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return { createdAt: now, updatedAt: now };
+};
+async function readable2(cms, slug2, who) {
+  if (INTERNAL_COLLECTIONS.has(slug2) || !cms.config.collections.some((c) => c.slug === slug2))
+    throw new NotFoundError("collections", slug2);
+  try {
+    await cms.count(slug2, { ...who, overrideAccess: false, where: { id: { exists: false } } });
+  } catch {
+    throw new ForbiddenError();
+  }
+}
+function cleanState(raw) {
+  const input = raw && typeof raw === "object" ? raw : {};
+  const query = {};
+  const rawQuery = input.query && typeof input.query === "object" ? input.query : {};
+  for (const [key, value] of Object.entries(rawQuery))
+    if (QUERY_KEY.test(key) && typeof value === "string") query[key] = value;
+  const columns = Array.isArray(input.columns) ? input.columns.filter((c) => typeof c === "string").slice(0, 50) : void 0;
+  const pageSize = [10, 25, 50, 100].includes(input.pageSize) ? input.pageSize : void 0;
+  const density = input.density === "compact" || input.density === "comfortable" ? input.density : void 0;
+  const state = {
+    query,
+    ...columns ? { columns } : {},
+    ...pageSize ? { pageSize } : {},
+    ...density ? { density } : {}
+  };
+  if (JSON.stringify(state).length > MAX_STATE)
+    throw new ValidationError(SAVED_VIEWS, [{ field: "state", message: "is too large" }]);
+  return state;
+}
+function toView(row, user) {
+  const mine2 = row.user === userKey(user);
+  return {
+    id: row.id,
+    name: String(row.name ?? ""),
+    shared: row.shared === true,
+    mine: mine2,
+    editable: mine2 || row.shared === true && isSystemAdmin(user),
+    state: cleanState(row.state)
+  };
+}
+async function rows(cms, slug2, where) {
+  const found = await cms.db.find({
+    collection: SAVED_VIEWS,
+    where: { and: [{ collection: { equals: slug2 } }, where] },
+    sort: ["id"],
+    limit: 0,
+    page: 1
+  });
+  return found.docs;
+}
+async function listViews(cms, slug2, who) {
+  await readable2(cms, slug2, who);
+  const key = userKey(who.user);
+  const found = await rows(cms, slug2, {
+    or: [
+      { and: [{ kind: { equals: "view" } }, { shared: { equals: true } }] },
+      { user: { equals: key } }
+    ]
+  });
+  const views = found.filter((r) => r.kind === "view").map((r) => toView(r, who.user));
+  const preference = found.find((r) => r.kind === "default" && r.user === key);
+  return {
+    views: [...views.filter((v) => v.shared), ...views.filter((v) => !v.shared)],
+    default: typeof preference?.target === "string" ? preference.target : null
+  };
+}
+function checkName(name) {
+  const trimmed = typeof name === "string" ? name.trim() : "";
+  if (trimmed === "" || trimmed.length > 60)
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: "must be 1 to 60 characters" }
+    ]);
+  return trimmed;
+}
+async function checkUnique(cms, slug2, who, name, shared, self) {
+  const same = await rows(cms, slug2, {
+    and: [
+      { kind: { equals: "view" } },
+      { name: { equals: name } },
+      shared ? { shared: { equals: true } } : { user: { equals: userKey(who.user) } }
+    ]
+  });
+  if (same.some((r) => r.id !== self && (shared || r.shared !== true)))
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: `there is already a view named "${name}"` }
+    ]);
+}
+async function createView(cms, slug2, who, body) {
+  await readable2(cms, slug2, who);
+  const input = body ?? {};
+  const name = checkName(input.name);
+  const shared = input.shared === true;
+  await checkUnique(cms, slug2, who, name, shared);
+  const own = await rows(cms, slug2, {
+    and: [{ kind: { equals: "view" } }, { user: { equals: userKey(who.user) } }]
+  });
+  if (own.length >= MAX_OWN_VIEWS)
+    throw new ValidationError(SAVED_VIEWS, [
+      { field: "name", message: `at most ${MAX_OWN_VIEWS} views per list` }
+    ]);
+  const row = await cms.db.create({
+    collection: SAVED_VIEWS,
+    data: {
+      collection: slug2,
+      user: userKey(who.user),
+      kind: "view",
+      name,
+      shared,
+      state: cleanState(input.state),
+      target: null,
+      ...stamps()
+    }
+  });
+  return toView(row, who.user);
+}
+async function editable(cms, slug2, who, id) {
+  await readable2(cms, slug2, who);
+  const row = await cms.db.findById({ collection: SAVED_VIEWS, id });
+  if (!row || row.collection !== slug2 || row.kind !== "view")
+    throw new NotFoundError(SAVED_VIEWS, id);
+  const view = toView(row, who.user);
+  if (!view.mine && !view.shared) throw new NotFoundError(SAVED_VIEWS, id);
+  if (!view.editable) throw new ForbiddenError("Only its owner or an admin can change this view");
+  return row;
+}
+async function updateView(cms, slug2, who, id, body) {
+  const row = await editable(cms, slug2, who, id);
+  const input = body ?? {};
+  const name = input.name === void 0 ? String(row.name) : checkName(input.name);
+  const shared = input.shared === void 0 ? row.shared === true : input.shared === true;
+  if (name !== row.name || shared !== (row.shared === true))
+    await checkUnique(cms, slug2, who, name, shared, id);
+  const updated = await cms.db.update({
+    collection: SAVED_VIEWS,
+    id,
+    // The whole row, as the adapter writes it.
+    data: {
+      ...row,
+      name,
+      shared,
+      ...input.state !== void 0 ? { state: cleanState(input.state) } : {},
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    }
+  });
+  return toView(updated, who.user);
+}
+async function deleteView(cms, slug2, who, id) {
+  await editable(cms, slug2, who, id);
+  await cms.db.delete({ collection: SAVED_VIEWS, id });
+  return { deleted: 1 };
+}
+async function setDefaultView(cms, slug2, who, body) {
+  await readable2(cms, slug2, who);
+  const raw = body ?? {};
+  const target = raw.view === null || raw.view === void 0 ? null : String(raw.view);
+  const key = userKey(who.user);
+  const current = await rows(cms, slug2, {
+    and: [{ kind: { equals: "default" } }, { user: { equals: key } }]
+  });
+  for (const row of current) await cms.db.delete({ collection: SAVED_VIEWS, id: row.id });
+  if (target !== null)
+    await cms.db.create({
+      collection: SAVED_VIEWS,
+      data: {
+        collection: slug2,
+        user: key,
+        kind: "default",
+        name: null,
+        shared: false,
+        state: null,
+        target,
+        ...stamps()
+      }
+    });
+  return { default: target };
+}
+
 // src/rest/handler.ts
 var SCHEDULED_RANGE_LIMIT = 500;
 var CSRF_COOKIE = "ecms-csrf";
@@ -13443,7 +14654,8 @@ var ADMIN_UI_ROUTES = /* @__PURE__ */ new Set([
   "media-usage",
   "owned",
   "sso",
-  "block-summaries"
+  "block-summaries",
+  "views"
 ]);
 var CORS_METHODS = "GET, HEAD, POST, PATCH, PUT, DELETE";
 var CORS_HEADERS = `authorization, content-type, ${CSRF_HEADER}`;
@@ -13820,6 +15032,27 @@ async function route(cms, ctx, method, path, options) {
     if (parsed === void 0) throw new HttpError("Not found", 404);
     return { body: await cms.roles.owned(parsed) };
   }
+  if (first === "admin" && second === "views" && third !== void 0 && segments.length <= 4) {
+    if (!ctx.user || ctx.user.apiKey) throw new UnauthorizedError();
+    const who = { user: ctx.user, context: ctx.context };
+    const fourth = segments[3];
+    if (fourth === void 0) {
+      if (method === "GET") return { body: await listViews(cms, third, who) };
+      if (method === "POST")
+        return { status: 201, body: await createView(cms, third, who, await readJson(ctx.request)) };
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    if (fourth === "default") {
+      if (method !== "PUT") throw methodNotAllowed(ctx, "PUT");
+      return { body: await setDefaultView(cms, third, who, await readJson(ctx.request)) };
+    }
+    const id2 = parseId(fourth);
+    if (id2 === void 0) throw new HttpError("Not found", 404);
+    if (method === "PATCH")
+      return { body: await updateView(cms, third, who, id2, await readJson(ctx.request)) };
+    if (method === "DELETE") return { body: await deleteView(cms, third, who, id2) };
+    throw methodNotAllowed(ctx, "PATCH, DELETE");
+  }
   if (first === "admin" && second === "block-summaries" && third === void 0) {
     if (!ctx.user) throw new UnauthorizedError();
     if (method !== "POST") throw methodNotAllowed(ctx, "POST");
@@ -13864,6 +15097,91 @@ async function route(cms, ctx, method, path, options) {
     }
     throw methodNotAllowed(ctx, "PATCH, DELETE");
   }
+  if (first === "admin" && second === "integrations") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (cms.config.integrations.length === 0) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "integrations")) throw new ForbiddenError();
+    const user = ctx.user;
+    const [, , id2, part, cid, action, extra] = segments;
+    const integrations = cms.integrations;
+    if (id2 === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await integrations.overview() };
+    }
+    const callbackUrl = `${cms.config.serverURL ?? ctx.url.origin}${cms.config.routes.api}/admin/integrations/${id2}/callback`;
+    if (part === void 0) {
+      if (method !== "PUT") throw methodNotAllowed(ctx, "PUT");
+      const body = await readJson(ctx.request);
+      return { body: await integrations.setEnabled(id2, body.enabled !== false, user) };
+    }
+    if (part === "authorize" && cid === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      const body = await readJson(ctx.request);
+      return { body: integrations.authorize(id2, user, callbackUrl, String(body.name ?? "")) };
+    }
+    if (part === "callback" && cid === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const page = new URL(`${cms.config.admin.path}/integrations`, ctx.url.origin);
+      page.searchParams.set("integration", id2);
+      try {
+        const error = ctx.url.searchParams.get("error_description") ?? ctx.url.searchParams.get("error");
+        if (error) throw new Error(error);
+        const result = await integrations.callback(
+          id2,
+          ctx.url.searchParams.get("code") ?? "",
+          ctx.url.searchParams.get("state") ?? "",
+          callbackUrl,
+          user
+        );
+        if ("pending" in result) page.searchParams.set("pending", String(result.pending));
+        else page.searchParams.set("connected", "1");
+      } catch (error) {
+        page.searchParams.set("error", error.message.slice(0, 300));
+      }
+      return { body: new Response(null, { status: 302, headers: { location: page.toString() } }) };
+    }
+    if (part === "lookup" && cid !== void 0 && action === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await integrations.lookup(id2, cid, await readJson(ctx.request)) };
+    }
+    if (part === "pending" && cid !== void 0 && action === void 0) {
+      const pid = parseId(cid);
+      if (pid === void 0) throw new HttpError("Not found", 404);
+      if (method === "GET") return { body: await integrations.pending(id2, pid, user) };
+      if (method === "POST") {
+        const body = await readJson(ctx.request);
+        return {
+          status: 201,
+          body: await integrations.choose(id2, pid, String(body.account ?? ""), user)
+        };
+      }
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    if (part === "connections" && extra === void 0) {
+      if (cid === void 0) {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        return {
+          status: 201,
+          body: await integrations.connect(id2, await readJson(ctx.request), user)
+        };
+      }
+      if (action === "test") {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        const target = cid === "env" ? "env" : parseId(cid);
+        if (target === void 0) throw new HttpError("Not found", 404);
+        return { body: await integrations.test(id2, target) };
+      }
+      const connection = parseId(cid);
+      if (connection === void 0 || action !== void 0) throw new HttpError("Not found", 404);
+      if (method === "PATCH")
+        return {
+          body: await integrations.update(id2, connection, await readJson(ctx.request), user)
+        };
+      if (method === "DELETE") return { body: await integrations.disconnect(id2, connection, user) };
+      throw methodNotAllowed(ctx, "PATCH, DELETE");
+    }
+    throw new HttpError("Not found", 404);
+  }
   if (first === "admin" && second === "deliveries") {
     if (!ctx.user) throw new UnauthorizedError();
     if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();
@@ -14166,6 +15484,21 @@ async function route(cms, ctx, method, path, options) {
   if (INTERNAL_COLLECTIONS.has(collection2) || !cms.config.collections.some((c) => c.slug === collection2)) {
     throw new HttpError(`Unknown collection "${collection2}"`, 404);
   }
+  if (second === "export.csv" && third === void 0) {
+    if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+    if (!ctx.user) throw new UnauthorizedError();
+    const { where, sort } = parseListQuery(ctx.url);
+    return {
+      body: await exportCsv(cms, collection2, ctx.url, {
+        user: ctx.user,
+        context: ctx.context,
+        ...parseLocale(ctx.url),
+        draft,
+        ...where ? { where } : {},
+        ...sort ? { sort } : {}
+      })
+    };
+  }
   if (second === "bulk") return bulkRoute(cms, ctx, method, collection2, segments.slice(2), access);
   if (second !== void 0 && third !== void 0) {
     return documentAction(cms, ctx, method, collection2, second, segments.slice(2));
@@ -14623,10 +15956,10 @@ async function readJson(request) {
   if (!type.toLowerCase().startsWith("application/json")) {
     throw new HttpError("Content-Type must be application/json", 415);
   }
-  const text3 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
+  const text4 = new TextDecoder().decode(await readBody(request, MAX_BODY_BYTES));
   let body;
   try {
-    body = JSON.parse(text3);
+    body = JSON.parse(text4);
   } catch {
     throw new HttpError("Request body is not valid JSON", 400);
   }