@easy-cms/core 1.31.0 → 1.32.0

package/dist/{chunk-ZA5KIRYX.js → chunk-J4NASOMO.js}

@@ -61,6 +61,7 @@ function hashToken(token) {
 function hmac(secret, value) {
   return createHmac("sha256", secret).update(value).digest("base64url");
 }
+var signValue = (secret, value) => hmac(secret, value);
 function secretsOf(config) {
   return [config.secret, ...config.previousSecrets ?? []];
 }
@@ -162,6 +163,7 @@ var OUTBOX = "outbox";
 var RATE_LIMITS = "rate-limits";
 var BULK_OPERATIONS = "bulk-operations";
 var SAVED_VIEWS = "saved-views";
+var CONNECTIONS = "connections";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -177,7 +179,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   OUTBOX,
   RATE_LIMITS,
   BULK_OPERATIONS,
-  SAVED_VIEWS
+  SAVED_VIEWS,
+  CONNECTIONS
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -581,6 +584,24 @@ var savedViewsCollection = {
     { name: "target", type: "text" }
   ]
 };
+var connectionsCollection = {
+  slug: CONNECTIONS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // connection | integration | pending
+    { name: "kind", type: "text", required: true },
+    { name: "integration", type: "text", required: true, index: true },
+    { name: "name", type: "text" },
+    { name: "isDefault", type: "boolean" },
+    { name: "values", type: "json" },
+    // AES-256-GCM, with a key derived from the secret (see integrations.ts).
+    { name: "secret", type: "text" },
+    { name: "account", type: "text" },
+    { name: "lastUsedAt", type: "text" },
+    { name: "lastError", type: "text" },
+    { name: "enabled", type: "boolean" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -3023,6 +3044,8 @@ var Mailer = class {
   logger;
   queue;
   pending = /* @__PURE__ */ new Set();
+  /** Told when an email is given up on (`delivery.failed`). */
+  onGiveUp;
   get configured() {
     return this.adapter !== void 0;
   }
@@ -3080,6 +3103,8 @@ var Mailer = class {
       if (delay === void 0) {
         failed++;
         this.logger.error(`Email gave up after ${attempts} attempts: ${error}`);
+        const sent2 = JSON.parse(queued.message);
+        this.onGiveUp?.({ to: [sent2.to].flat().join(", "), error, attempts });
       }
       await this.queue.update(id, {
         ...queued,
@@ -3559,11 +3584,13 @@ async function runBackup(cms, record) {
     });
     cms.logger.info(`Backup ${key} written (${data.byteLength} bytes)`);
   } catch (error) {
+    const message2 = (error.message || String(error)).slice(0, 500);
     await update(cms, row, {
       state: "failed",
-      error: (error.message || String(error)).slice(0, 500),
+      error: message2,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
+    cms.systemEvent("backup.failed", { backup: row.id, error: message2 });
     throw error;
   } finally {
     await rm2(dir, { recursive: true, force: true });
@@ -4309,7 +4336,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac8, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash6, createHmac as createHmac8, randomBytes as randomBytes7, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4826,6 +4853,649 @@ function toOperation(row) {
   };
 }
 
+// src/integrations.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync, randomBytes as randomBytes6 } from "crypto";
+var ENV_NAME = "Environment";
+var PENDING_MS = 10 * 60 * 1e3;
+var keyOf2 = (secret) => Buffer.from(hkdfSync("sha256", secret, "", "easy-cms:connections", 32));
+var keyId = (key) => createHash4("sha256").update(key).digest("hex").slice(0, 12);
+function encryptValues(secret, values) {
+  const key = keyOf2(secret);
+  const iv = randomBytes6(12);
+  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const data = Buffer.concat([cipher.update(JSON.stringify(values), "utf8"), cipher.final()]);
+  const box = {
+    k: keyId(key),
+    iv: iv.toString("base64"),
+    t: cipher.getAuthTag().toString("base64"),
+    d: data.toString("base64")
+  };
+  return Buffer.from(JSON.stringify(box)).toString("base64url");
+}
+function decryptValues(secrets, sealed) {
+  const box = JSON.parse(Buffer.from(sealed, "base64url").toString("utf8"));
+  for (const [i, secret] of secrets.entries()) {
+    const key = keyOf2(secret);
+    if (keyId(key) !== box.k) continue;
+    const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(String(box.iv), "base64"));
+    decipher.setAuthTag(Buffer.from(String(box.t), "base64"));
+    const text4 = Buffer.concat([
+      decipher.update(Buffer.from(String(box.d), "base64")),
+      decipher.final()
+    ]).toString("utf8");
+    return { values: JSON.parse(text4), old: i > 0 };
+  }
+  throw new Error("A connection was encrypted with a secret that is no longer configured");
+}
+var keyIdOf = (sealed) => {
+  try {
+    return JSON.parse(Buffer.from(String(sealed), "base64url").toString("utf8")).k;
+  } catch {
+    return void 0;
+  }
+};
+function signState(secret, payload) {
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${body}.${signValue(secret, `integration:${body}`)}`;
+}
+function readState(secrets, state) {
+  const [body, signature] = state.split(".");
+  if (!body || !signature || !signedWith(secrets, `integration:${body}`, signature)) return null;
+  const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  return typeof payload.exp === "number" && payload.exp > Date.now() ? payload : null;
+}
+var OFFICIAL_PLUGINS = [
+  {
+    name: "@easy-cms/plugin-social",
+    category: "social",
+    description: {
+      en: "Post to Facebook, LINE and webhooks from the admin",
+      th: "\u0E42\u0E1E\u0E2A\u0E15\u0E4C\u0E44\u0E1B Facebook, LINE \u0E41\u0E25\u0E30 webhook \u0E08\u0E32\u0E01 admin"
+    },
+    docs: "https://easycms.dev/docs/integrations"
+  },
+  {
+    name: "@easy-cms/plugin-notify",
+    category: "notifications",
+    description: { en: "Telegram notifications for admins", th: "\u0E41\u0E08\u0E49\u0E07\u0E40\u0E15\u0E37\u0E2D\u0E19\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E17\u0E32\u0E07 Telegram" },
+    docs: "https://easycms.dev/docs/notifications"
+  },
+  {
+    name: "@easy-cms/plugin-ai",
+    category: "ai",
+    description: {
+      en: "Claude, GPT and Gemini for alt text, SEO and translation",
+      th: "Claude, GPT \u0E41\u0E25\u0E30 Gemini \u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A alt text, SEO \u0E41\u0E25\u0E30\u0E41\u0E1B\u0E25\u0E20\u0E32\u0E29\u0E32"
+    },
+    docs: "https://easycms.dev/docs/integrations"
+  },
+  {
+    name: "@easy-cms/plugin-ecommerce",
+    category: "payments",
+    description: { en: "A shop with Stripe payments", th: "\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32\u0E1E\u0E23\u0E49\u0E2D\u0E21\u0E0A\u0E33\u0E23\u0E30\u0E40\u0E07\u0E34\u0E19\u0E1C\u0E48\u0E32\u0E19 Stripe" },
+    docs: "https://easycms.dev/docs/ecommerce"
+  }
+];
+var mask = (value) => value.length > 4 ? `\u2022\u2022\u2022\u2022${value.slice(-4)}` : "\u2022\u2022\u2022\u2022";
+var Integrations = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get config() {
+    return this.cms.config;
+  }
+  get secrets() {
+    return secretsOf(this.config);
+  }
+  /** The integrations plugins declared. */
+  get definitions() {
+    return this.config.integrations;
+  }
+  definition(id) {
+    const found = this.definitions.find((d) => d.id === id);
+    if (!found) throw new NotFoundError("integrations", id);
+    return found;
+  }
+  async rows(id, kind) {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ integration: { equals: id } }, { kind: { equals: kind } }] },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    });
+    return found.docs;
+  }
+  /** The values of the fields set in the environment. */
+  envValues(def) {
+    const out = {};
+    for (const [field, name] of Object.entries(def.env ?? {})) {
+      const value = process.env[name];
+      if (value) out[field] = value;
+    }
+    return out;
+  }
+  /** Every field is in the environment: an "Environment" connection. */
+  envComplete(def) {
+    const env = this.envValues(def);
+    const fields = def.fields ?? [];
+    return fields.length > 0 && fields.every((f) => env[f.name] || !f.required) && Object.keys(env).length > 0;
+  }
+  async enabled(id) {
+    const [row] = await this.rows(id, "integration");
+    return row ? row.enabled !== false : true;
+  }
+  decrypt(row) {
+    const plain = row.values ?? {};
+    if (!row.secret) return { ...plain };
+    const { values, old } = decryptValues(this.secrets, String(row.secret));
+    if (old) void this.reseal(row, values);
+    return { ...plain, ...values };
+  }
+  async reseal(row, secrets) {
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, secret: encryptValues(this.config.secret, secrets) }
+    });
+  }
+  /** Splits values into the plain ones and the secret ones (encrypted). */
+  seal(def, values) {
+    const secretNames = new Set((def.fields ?? []).filter((f) => f.secret).map((f) => f.name));
+    const plain = {};
+    const secret = {};
+    for (const [name, value] of Object.entries(values))
+      (secretNames.has(name) || def.kind === "oauth" ? secret : plain)[name] = value;
+    return {
+      values: plain,
+      secret: Object.keys(secret).length ? encryptValues(this.config.secret, secret) : null
+    };
+  }
+  /**
+   * A connection for a plugin: the default one, or the one named; `null` when there is none
+   * or the integration is turned off. Values from the environment win.
+   */
+  async get(id, options = {}) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return null;
+    const env = this.envValues(def);
+    if (this.envComplete(def) && (!options.name || options.name === ENV_NAME))
+      return { name: ENV_NAME, values: env, env: true };
+    const rows2 = await this.rows(id, "connection");
+    const row = options.name ? rows2.find((r) => r.name === options.name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return null;
+    return { name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false };
+  }
+  /**
+   * Every connection of an integration (the environment's first), e.g. to notify each chat;
+   * none when it is turned off.
+   */
+  async all(id) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return [];
+    const env = this.envValues(def);
+    const out = this.envComplete(def) ? [{ name: ENV_NAME, values: env, env: true }] : [];
+    for (const row of await this.rows(id, "connection"))
+      out.push({ name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false });
+    return out;
+  }
+  /** The connection was used: its card says when, and an earlier error is gone. */
+  async markUsed(id, name) {
+    await this.mark(id, name, { lastUsedAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null });
+  }
+  /** It failed: the card and the dashboard's "needs attention" say why. */
+  async markError(id, message2, name) {
+    await this.mark(id, name, { lastError: message2.slice(0, 500) });
+    this.cms.systemEvent("integration.failed", {
+      integration: id,
+      name: name ?? null,
+      error: message2
+    });
+  }
+  async mark(id, name, patch) {
+    const rows2 = await this.rows(id, "connection");
+    const row = name ? rows2.find((r) => r.name === name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return;
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, ...patch, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  // --- The admin's page ------------------------------------------------------------------------
+  async overview() {
+    const integrations = [];
+    const current = keyId(keyOf2(this.config.secret));
+    let stale = 0;
+    for (const def of this.definitions) {
+      const rows2 = await this.rows(def.id, "connection");
+      const env = this.envValues(def);
+      const connections = rows2.map((row) => {
+        if (row.secret && keyIdOf(row.secret) !== current) stale++;
+        const secretNames = (def.fields ?? []).filter((f) => f.secret).map((f) => f.name);
+        let values = { ...row.values ?? {} };
+        try {
+          const all = this.decrypt(row);
+          for (const name of secretNames) if (all[name]) values[name] = mask(all[name]);
+        } catch {
+          values = { ...values };
+        }
+        return {
+          id: row.id,
+          name: String(row.name),
+          isDefault: row.isDefault === true,
+          env: false,
+          account: row.account ?? null,
+          lastUsedAt: row.lastUsedAt ?? null,
+          lastError: row.lastError ?? null,
+          values
+        };
+      });
+      if (this.envComplete(def)) {
+        for (const c of connections) c.isDefault = false;
+        connections.unshift({
+          id: "env",
+          name: ENV_NAME,
+          isDefault: true,
+          env: true,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          values: Object.fromEntries(
+            Object.entries(env).map(
+              ([k, v]) => (def.fields ?? []).find((f) => f.name === k)?.secret ? [k, mask(v)] : [k, v]
+            )
+          )
+        });
+      }
+      integrations.push({
+        id: def.id,
+        label: def.label,
+        category: def.category,
+        ...def.description ? { description: def.description } : {},
+        ...def.icon ? { icon: def.icon } : {},
+        ...def.docs ? { docs: def.docs } : {},
+        ...def.plugin ? { plugin: def.plugin } : {},
+        kind: def.kind,
+        // Functions don't travel: `findable` says a field has a Find button.
+        fields: (def.fields ?? []).map(({ lookup, ...field }) => ({
+          ...field,
+          ...lookup ? { findable: true } : {}
+        })),
+        enabled: await this.enabled(def.id),
+        envFields: Object.keys(env),
+        testable: typeof def.test === "function",
+        connections
+      });
+    }
+    const installed = new Set(this.config.installedPlugins.map((p) => p.name));
+    return {
+      integrations,
+      configured: this.configured(),
+      catalog: OFFICIAL_PLUGINS.filter((p) => !installed.has(p.name)),
+      staleSecrets: stale
+    };
+  }
+  /** The adapters the config sets: email, storage, search, sign-in, payments. */
+  configured() {
+    const out = [];
+    const { config } = this;
+    if (config.email) out.push({ id: "email", kind: "email", name: config.email.name ?? "email" });
+    out.push({ id: "storage", kind: "storage", name: config.upload.storage?.name ?? "disk" });
+    if (config.search)
+      out.push({ id: "search", kind: "search", name: config.search.name ?? "search" });
+    for (const provider of config.auth.providers ?? [])
+      out.push({ id: `sign-in:${provider.id}`, kind: "sign-in", name: provider.id });
+    if (config.installedPlugins.some((p) => p.name === "@easy-cms/plugin-ecommerce"))
+      out.push({ id: "payments", kind: "payments", name: "Stripe" });
+    return out;
+  }
+  async audit(user, action, id, detail = {}) {
+    await this.cms.audit.record({ action: `integration.${action}`, target: id, user, detail });
+  }
+  checkFields(def, values, partial) {
+    const errors = (def.fields ?? []).filter((f) => f.required && !partial && !values[f.name]).map((f) => ({ field: f.name, message: "is required" }));
+    if (errors.length) throw new ValidationError(CONNECTIONS, errors);
+  }
+  cleanValues(def, raw) {
+    const input = raw && typeof raw === "object" ? raw : {};
+    const out = {};
+    for (const field of def.fields ?? []) {
+      const raw2 = input[field.name];
+      const value = Array.isArray(raw2) ? raw2.filter((v) => typeof v === "string").join(",") : raw2;
+      if (typeof value === "string" && value.trim() !== "") out[field.name] = value.trim();
+    }
+    return out;
+  }
+  async uniqueName(id, name, self) {
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > 60)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: "must be 1 to 60 characters" }
+      ]);
+    if (trimmed === ENV_NAME || (await this.rows(id, "connection")).some((r) => r.name === trimmed && r.id !== self))
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: `there is already a connection named "${trimmed}"` }
+      ]);
+    return trimmed;
+  }
+  async create(def, name, values, account) {
+    const existing = await this.rows(def.id, "connection");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return await this.cms.db.create({
+      collection: CONNECTIONS,
+      data: {
+        kind: "connection",
+        integration: def.id,
+        name,
+        isDefault: existing.length === 0,
+        ...this.seal(def, values),
+        account,
+        lastUsedAt: null,
+        lastError: null,
+        enabled: null,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+  }
+  /** Connects with pasted values (`kind: 'fields'`); tested first when the plugin can. */
+  async connect(id, body, user) {
+    const def = this.definition(id);
+    if (def.kind !== "fields") throw new QueryError(`${id} connects with its Connect button`);
+    const input = body ?? {};
+    const name = await this.uniqueName(id, String(input.name ?? ""));
+    const values = this.cleanValues(def, input.values);
+    this.checkFields(def, values, false);
+    const result = def.test ? await def.test(values, { cms: this.cms }) : null;
+    if (result && !result.ok)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "values", message: result.message ?? "the provider refused these values" }
+      ]);
+    const row = await this.create(def, name, values, result?.account ?? null);
+    await this.audit(user, "connect", id, { name });
+    return { id: row.id };
+  }
+  async row(id, cid) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: cid });
+    if (!row || row.integration !== id || row.kind !== "connection")
+      throw new NotFoundError(CONNECTIONS, cid);
+    return row;
+  }
+  /** A new name or values (secrets left empty are kept), or the default. */
+  async update(id, cid, body, user) {
+    const def = this.definition(id);
+    const row = await this.row(id, cid);
+    const input = body ?? {};
+    const next = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) next.name = await this.uniqueName(id, String(input.name), cid);
+    if (input.values !== void 0) {
+      const values = { ...this.decrypt(row), ...this.cleanValues(def, input.values) };
+      this.checkFields(def, values, false);
+      Object.assign(next, this.seal(def, values), { lastError: null });
+    }
+    if (input.isDefault === true) {
+      for (const other of await this.rows(id, "connection"))
+        if (other.id !== cid && other.isDefault === true)
+          await this.cms.db.update({
+            collection: CONNECTIONS,
+            id: other.id,
+            data: { ...other, isDefault: false }
+          });
+      next.isDefault = true;
+    }
+    await this.cms.db.update({ collection: CONNECTIONS, id: cid, data: next });
+    await this.audit(user, input.isDefault === true ? "default" : "update", id, { name: next.name });
+    return { ok: true };
+  }
+  /** Removes the connection and its secrets; the oldest left becomes the default. */
+  async disconnect(id, cid, user) {
+    const row = await this.row(id, cid);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: cid });
+    if (row.isDefault === true) {
+      const [oldest] = await this.rows(id, "connection");
+      if (oldest)
+        await this.cms.db.update({
+          collection: CONNECTIONS,
+          id: oldest.id,
+          data: { ...oldest, isDefault: true }
+        });
+    }
+    await this.audit(user, "disconnect", id, { name: row.name });
+    return { deleted: 1 };
+  }
+  /** Turns the integration on or off; its connections are kept. */
+  async setEnabled(id, enabled, user) {
+    this.definition(id);
+    const [row] = await this.rows(id, "integration");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (row)
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: row.id,
+        data: { ...row, enabled, updatedAt: now }
+      });
+    else
+      await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "integration",
+          integration: id,
+          name: null,
+          isDefault: false,
+          values: null,
+          secret: null,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+    await this.audit(user, enabled ? "enable" : "disable", id);
+    return { enabled };
+  }
+  /** Checks a connection's values with the provider; the card shows the result. */
+  async test(id, cid) {
+    const def = this.definition(id);
+    if (!def.test) throw new QueryError(`${id} can't be tested`);
+    const values = cid === "env" ? this.envValues(def) : { ...this.decrypt(await this.row(id, cid)), ...this.envValues(def) };
+    let result;
+    try {
+      result = await def.test(values, { cms: this.cms });
+    } catch (error) {
+      result = { ok: false, message: error.message };
+    }
+    if (cid !== "env") {
+      const row = await this.row(id, cid);
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: cid,
+        data: {
+          ...row,
+          ...result.ok ? { lastError: null, ...result.account ? { account: result.account } : {} } : { lastError: result.message ?? "Test failed" },
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      if (!result.ok)
+        this.cms.systemEvent("integration.failed", {
+          integration: id,
+          name: row.name ?? null,
+          error: result.message ?? "Test failed"
+        });
+    }
+    return result;
+  }
+  /**
+   * A field's choices from the provider, with the values typed (and, editing a connection, its
+   * stored secrets for the fields left empty).
+   */
+  async lookup(id, fieldName, body) {
+    const def = this.definition(id);
+    const field = (def.fields ?? []).find((f) => f.name === fieldName);
+    if (!field?.lookup) throw new QueryError(`${id}.${fieldName} has nothing to look up`);
+    const input = body ?? {};
+    const stored = input.connection !== void 0 && input.connection !== null ? this.decrypt(await this.row(id, input.connection)) : {};
+    const values = { ...stored, ...this.envValues(def), ...this.cleanValues(def, input.values) };
+    try {
+      return { choices: [...await field.lookup(values, { cms: this.cms })].slice(0, 100) };
+    } catch (error) {
+      throw new ValidationError(CONNECTIONS, [
+        { field: fieldName, message: error.message }
+      ]);
+    }
+  }
+  // --- OAuth -----------------------------------------------------------------------------------
+  /** The provider's sign-in page to send the admin to. */
+  authorize(id, user, redirectUri, name) {
+    const def = this.definition(id);
+    if (def.kind !== "oauth" || !def.oauth)
+      throw new QueryError(`${id} connects with pasted values`);
+    const state = signState(this.config.secret, {
+      i: id,
+      u: String(user.id),
+      n: name,
+      exp: Date.now() + PENDING_MS
+    });
+    return { url: def.oauth.authorizeUrl({ redirectUri, state }) };
+  }
+  /**
+   * Back from the provider: one account is connected at once; several wait (encrypted, 10
+   * minutes) for the admin to choose. Returns where the admin goes next.
+   */
+  async callback(id, code, stateText, redirectUri, user) {
+    const def = this.definition(id);
+    const state = readState(this.secrets, stateText);
+    if (!state || state.i !== id || state.u !== String(user.id) || !def.oauth)
+      throw new ForbiddenError(
+        "This connection link has expired: start again from the Integrations page"
+      );
+    const result = await def.oauth.exchange({ code, redirectUri });
+    const name = typeof state.n === "string" && state.n ? state.n : String(def.label);
+    if (result.accounts && result.accounts.length > 0) {
+      if (result.accounts.length === 1) {
+        const [account] = result.accounts;
+        await this.create(
+          def,
+          await this.uniqueName(id, name),
+          { ...account.values },
+          account.name
+        );
+        await this.audit(user, "connect", id, { name });
+        return { connected: true };
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const pending = await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "pending",
+          integration: id,
+          name,
+          isDefault: false,
+          values: {
+            user: String(user.id),
+            expires: String(Date.now() + PENDING_MS),
+            accounts: JSON.stringify(result.accounts.map((a) => ({ id: a.id, name: a.name })))
+          },
+          secret: encryptValues(
+            this.config.secret,
+            Object.fromEntries(result.accounts.map((a) => [a.id, JSON.stringify(a.values)]))
+          ),
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+      return { pending: pending.id };
+    }
+    await this.create(
+      def,
+      await this.uniqueName(id, name),
+      { ...result.values ?? {} },
+      result.account ?? null
+    );
+    await this.audit(user, "connect", id, { name });
+    return { connected: true };
+  }
+  /** The accounts waiting to be chosen from, by name only. */
+  async pending(id, pid, user) {
+    const row = await this.pendingRow(id, pid, user);
+    const values = row.values;
+    return {
+      name: String(row.name),
+      accounts: JSON.parse(values.accounts ?? "[]")
+    };
+  }
+  async pendingRow(id, pid, user) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: pid });
+    const values = row?.values ?? {};
+    if (!row || row.kind !== "pending" || row.integration !== id || values.user !== String(user.id) || Number(values.expires) < Date.now())
+      throw new NotFoundError(CONNECTIONS, pid);
+    return row;
+  }
+  /** Connects the account chosen. */
+  async choose(id, pid, accountId, user) {
+    const def = this.definition(id);
+    const row = await this.pendingRow(id, pid, user);
+    const secrets = decryptValues(this.secrets, String(row.secret)).values;
+    const chosen = secrets[accountId];
+    const accounts = JSON.parse(
+      String(row.values.accounts ?? "[]")
+    );
+    const account = accounts.find((a) => a.id === accountId);
+    if (!chosen || !account) throw new NotFoundError("accounts", accountId);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: pid });
+    const name = await this.uniqueName(id, String(row.name));
+    const created = await this.create(
+      def,
+      name,
+      JSON.parse(chosen),
+      account.name
+    );
+    await this.audit(user, "connect", id, { name });
+    return { id: created.id };
+  }
+  // --- Rotating the secret ---------------------------------------------------------------------
+  /** Encrypts again, with the current secret, every connection still on an older one. */
+  async rotate() {
+    const current = keyId(keyOf2(this.config.secret));
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    let resealed = 0;
+    for (const row of found.docs) {
+      if (!row.secret || keyIdOf(row.secret) === current) continue;
+      const { values } = decryptValues(this.secrets, String(row.secret));
+      await this.reseal(row, values);
+      resealed++;
+    }
+    return { resealed };
+  }
+  /** Connections whose test or last use failed, for the dashboard's "needs attention". */
+  async broken() {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ kind: { equals: "connection" } }, { lastError: { exists: true } }] },
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    return found.docs.filter((r) => this.definitions.some((d) => d.id === r.integration)).map((r) => ({
+      integration: String(r.integration),
+      name: String(r.name),
+      error: String(r.lastError)
+    }));
+  }
+};
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -5480,7 +6150,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets integrations listeners db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -5663,7 +6333,8 @@ var BUILTIN_NAV = [
     children: [
       { id: "site", label: { en: "Site", th: "\u0E40\u0E27\u0E47\u0E1A\u0E44\u0E0B\u0E15\u0E4C" }, icon: "globe" },
       { id: "people", label: { en: "Users & access", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49\u0E41\u0E25\u0E30\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C" }, icon: "users" },
-      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" }
+      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" },
+      { id: "integrations", label: { en: "Integrations", th: "\u0E01\u0E32\u0E23\u0E40\u0E0A\u0E37\u0E48\u0E2D\u0E21\u0E15\u0E48\u0E2D" }, icon: "link" }
     ]
   }
 ];
@@ -6016,6 +6687,12 @@ function verifyWebhook(body, headers, secret, options = {}) {
 }
 
 // src/webhooks.ts
+var SYSTEM_EVENTS = [
+  "scheduled.failed",
+  "delivery.failed",
+  "backup.failed",
+  "integration.failed"
+];
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -6207,10 +6884,13 @@ var Webhooks = class {
       return { ok: false, error: error.message };
     }
   }
+  /** Told when a delivery is given up on (`delivery.failed`). */
+  onGiveUp;
   giveUp(hook, event, error, attempts) {
     this.logger.error(
       `Webhook ${hook.url} failed for ${event} after ${attempts} attempts: ${error}`
     );
+    this.onGiveUp?.({ url: hook.url, event, error, attempts });
   }
 };
 var later4 = (from, ms) => new Date(from.getTime() + ms).toISOString();
@@ -6299,6 +6979,8 @@ function validateConfig(config) {
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
   validateJobs(config, add);
+  validateIntegrations(config, add);
+  validateListeners(config, add);
   validateTimeZone(config, add);
   validateEvents(config, add);
   const apiKeys = config.apiKeys;
@@ -6826,7 +7508,7 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
-  const custom = new Set(config.events ?? []);
+  const custom = /* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS]);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
@@ -7916,6 +8598,56 @@ function validateAdapterVersions(config, add) {
       );
   }
 }
+function validateIntegrations(config, add) {
+  const list = config.integrations;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("integrations", "must be an array");
+    return;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const [i, raw] of list.entries()) {
+    const at = `integrations[${i}]`;
+    const item = raw ?? {};
+    if (typeof item.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(item.id))
+      add(`${at}.id`, 'must be lowercase letters, digits and "-"', "e.g. id: 'telegram'");
+    else if (ids.has(item.id)) add(`${at}.id`, `two integrations are named "${item.id}"`);
+    else ids.add(item.id);
+    if (!isLabel(item.label)) add(`${at}.label`, "must be a string or { en, th }");
+    if (!["social", "ai", "notifications", "automation"].includes(item.category))
+      add(`${at}.category`, "must be 'social', 'ai', 'notifications' or 'automation'");
+    if (item.kind === "fields") {
+      if (!Array.isArray(item.fields) || item.fields.length === 0)
+        add(`${at}.fields`, "needs at least one field to fill");
+    } else if (item.kind === "oauth") {
+      const oauth = item.oauth ?? {};
+      if (typeof oauth.authorizeUrl !== "function" || typeof oauth.exchange !== "function")
+        add(`${at}.oauth`, "needs authorizeUrl and exchange functions");
+    } else add(`${at}.kind`, "must be 'fields' or 'oauth'");
+    if (item.test !== void 0 && typeof item.test !== "function")
+      add(`${at}.test`, "must be a function");
+    for (const [f, field] of (Array.isArray(item.fields) ? item.fields : []).entries()) {
+      const fieldItem = field ?? {};
+      if (fieldItem.lookup !== void 0 && typeof fieldItem.lookup !== "function")
+        add(`${at}.fields[${f}].lookup`, "must be a function");
+    }
+  }
+}
+function validateListeners(config, add) {
+  const list = config.listeners;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("listeners", "must be an array");
+    return;
+  }
+  for (const [i, raw] of list.entries()) {
+    const item = raw ?? {};
+    const events = item.events;
+    if (events !== "*" && !(Array.isArray(events) && events.every((e) => typeof e === "string" && e.length > 0)))
+      add(`listeners[${i}].events`, "must be event names or '*'", "e.g. events: ['order.created']");
+    if (typeof item.handler !== "function") add(`listeners[${i}].handler`, "must be a function");
+  }
+}
 
 // src/resolve-config.ts
 var DEFAULT_ADMIN_PATH = "/admin";
@@ -8026,14 +8758,17 @@ async function resolveConfig(input) {
       databaseBackupsCollection,
       bulkOperationsCollection,
       savedViewsCollection,
+      ...resolvedIntegrations(config).length > 0 ? [connectionsCollection] : [],
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
+    integrations: resolvedIntegrations(config),
     cliCommands: config.cliCommands ?? [],
-    events: config.events ?? [],
+    // Easy CMS's own events (#356), for webhooks and `cms.on`.
+    events: [.../* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS])],
     jobs: config.jobs ?? [],
     warnings,
     installedPlugins: (plugins ?? []).map(
@@ -8109,9 +8844,12 @@ function resolveAudit(audit) {
     scope: audit.scope ?? false
   };
 }
+function resolvedIntegrations(config) {
+  return config.integrations ?? [];
+}
 
 // src/rest/http-cache.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var cacheTags = {
   collection: (slug2) => ["ecms", `ecms:${slug2}`],
   document: (slug2, id) => ["ecms", `ecms:${slug2}`, `ecms:${slug2}:${id}`],
@@ -8138,7 +8876,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
   );
   headers.set("cache-tag", tags.join(","));
   headers.set("surrogate-key", tags.join(" "));
-  const etag = `W/"${createHash4("sha1").update(body).digest("base64url")}"`;
+  const etag = `W/"${createHash5("sha1").update(body).digest("base64url")}"`;
   headers.set("etag", etag);
   if (matches2(request.headers.get("if-none-match"), etag))
     return new Response(null, { status: 304, headers });
@@ -8146,7 +8884,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.31.0" : "0.0.0-dev";
+var VERSION = true ? "1.32.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -8423,6 +9161,8 @@ var EasyCMS = class {
   audit;
   /** Folders of the media library and their permissions (`upload.folders`). */
   folders;
+  /** Accounts connected to plugins' integrations (`integrations`, Settings → Integrations). */
+  integrations;
   versions;
   webhooks;
   mailer;
@@ -8450,6 +9190,12 @@ var EasyCMS = class {
       (entry) => this.audit.record(entry)
     );
     this.audit = new AuditLog(this);
+    this.integrations = new Integrations(this);
+    for (const listener of config.listeners ?? []) {
+      const run = (message2) => listener.handler(message2, { cms: this });
+      if (listener.events === "*") this.anyListeners.add(run);
+      else for (const event of listener.events) this.on(event, run);
+    }
     this.folders = new MediaFolders(config, db, this.roles);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
@@ -8461,6 +9207,8 @@ var EasyCMS = class {
       logger,
       config.collections.some((c) => c.slug === EMAIL_DELIVERIES) ? this.emailQueue() : void 0
     );
+    this.webhooks.onGiveUp = ({ url, event, error, attempts }) => this.systemEvent("delivery.failed", { kind: "webhook", url, event, error, attempts });
+    this.mailer.onGiveUp = ({ to, error, attempts }) => this.systemEvent("delivery.failed", { kind: "email", to, error, attempts });
     this.outbox = config.collections.some((c) => c.slug === OUTBOX) ? new Outbox(
       db,
       logger,
@@ -8653,7 +9401,7 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random2 = randomBytes6(4).toString("hex");
+    const random2 = randomBytes7(4).toString("hex");
     const isPrivate = await this.folders.isPrivate(folderOf(MEDIA, data));
     const storage = this.storageFor(isPrivate);
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
@@ -8721,7 +9469,7 @@ var EasyCMS = class {
       ]);
     const isPrivate = await this.folders.isPrivate(folder);
     const storage = this.storageFor(isPrivate);
-    const key = withPrivacy(storageKey(name, type, randomBytes6(4).toString("hex")), isPrivate);
+    const key = withPrivacy(storageKey(name, type, randomBytes7(4).toString("hex")), isPrivate);
     const upload = storage.uploadURL ? await storage.uploadURL(key, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
     const ticket = this.sign("upload", {
       key,
@@ -10125,6 +10873,37 @@ var EasyCMS = class {
     if (!this.config.events.includes(event))
       throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
     this.webhooks.emit(event, about ?? {}, data);
+    this.dispatch(event, data, about);
+  }
+  listeners = /* @__PURE__ */ new Map();
+  /** Listeners of every event (`events: '*'` in the config's `listeners`). */
+  anyListeners = /* @__PURE__ */ new Set();
+  /**
+   * Runs `handler` after each `event` on this server (#356): the config's and plugins' events, the
+   * content changes webhooks get (`create`, `publish`…), and Easy CMS's own (`scheduled.failed`,
+   * `delivery.failed`, `backup.failed`, `integration.failed`). It runs after the change, without
+   * being waited for; its errors are logged. Returns a function that stops it.
+   */
+  on(event, handler) {
+    const set = this.listeners.get(event) ?? /* @__PURE__ */ new Set();
+    set.add(handler);
+    this.listeners.set(event, set);
+    return () => set.delete(handler);
+  }
+  dispatch(event, data, about) {
+    const set = [...this.listeners.get(event) ?? [], ...this.anyListeners];
+    if (set.length === 0) return;
+    for (const handler of set)
+      queueMicrotask(() => {
+        Promise.resolve().then(() => handler({ event, data, ...about ? { about } : {} })).catch(
+          (error) => this.logger.error(`A listener of ${event} failed: ${errorText(error)}`, { error })
+        );
+      });
+  }
+  /** @internal Easy CMS's own events (`SYSTEM_EVENTS`): to webhooks that list them and `cms.on`. */
+  systemEvent(event, data) {
+    this.webhooks.emit(event, {}, data);
+    this.dispatch(event, data);
   }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
@@ -10283,6 +11062,13 @@ var EasyCMS = class {
             updatedAt: (/* @__PURE__ */ new Date()).toISOString()
           }
         });
+        this.systemEvent("scheduled.failed", {
+          job: row.id,
+          action,
+          ...row.collection ? { collection: row.collection } : { global: row.global },
+          doc: row.doc ?? null,
+          error: message2
+        });
       }
     }
     return { ran, failed };
@@ -10911,8 +11697,10 @@ var EasyCMS = class {
    * are logged.
    */
   emitChange(config, event, doc, before) {
-    for (const change of this.changeEvents(config, event, doc, before))
+    for (const change of this.changeEvents(config, event, doc, before)) {
       this.webhooks.emit(change.event, change.target, change.body);
+      this.dispatch(change.event, change.body, change.target);
+    }
     if (this.searches(config, event)) this.searchIndex?.syncLater(config.slug, doc.id);
     const purge = this.config.httpCache?.purge;
     const tags = this.purgeTags(config, event, doc, before);
@@ -10962,8 +11750,10 @@ var EasyCMS = class {
     }
     if (!done.has("webhooks")) {
       const changes = this.changeEvents(config, event, doc, entry.before);
-      for (const change of changes)
+      for (const change of changes) {
         await this.webhooks.emitSaved(change.event, change.target, change.body);
+        this.dispatch(change.event, change.body, change.target);
+      }
       if (changes.length > 0 && (this.config.webhooks?.length ?? 0) > 0) await mark("webhooks");
     }
     if (!done.has("search") && this.searchIndex && this.searches(config, event)) {
@@ -11454,7 +12244,7 @@ function durationSeconds(value) {
 }
 function cursorQuery(collection2, where, sort, locale, draft) {
   const key = JSON.stringify([collection2, where ?? null, sort, locale ?? null, draft]);
-  return createHash5("sha256").update(key).digest("base64url").slice(0, 16);
+  return createHash6("sha256").update(key).digest("base64url").slice(0, 16);
 }
 function writeCursor(keys2, query) {
   return Buffer.from(JSON.stringify({ k: keys2, q: query })).toString("base64url");
@@ -11764,7 +12554,8 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
-    if ((id === "deliveries" || id === "jobs") && user.scoped === true) return false;
+    if ((id === "deliveries" || id === "jobs" || id === "integrations") && user.scoped === true)
+      return false;
     if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
       return true;
     if (!this.enabled)
@@ -12052,6 +12843,7 @@ var Roles = class {
         (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
       ) ? [{ id: "deliveries" }] : [],
       ...hasJobsPage(this.config) ? [{ id: "jobs" }] : [],
+      ...this.config.integrations.length > 0 ? [{ id: "integrations" }] : [],
       ...hasCalendarPage(this.config) ? [{ id: "calendar" }] : [],
       ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
       ...this.config.admin.dashboard.map((widget) => ({
@@ -12254,7 +13046,7 @@ function rank(role, config) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -12295,7 +13087,7 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash6("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash7("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/rest/handler.ts
@@ -12750,7 +13542,8 @@ async function adminSchema(cms, user, origin, context = {}) {
     roles: admin && cms.roles.enabled,
     sso: admin && cms.auth.sso.enabled,
     audit: cms.audit.enabled && await cms.roles.canView(user, "audit"),
-    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar")
+    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar"),
+    integrations: cms.config.integrations.length > 0 && await cms.roles.canView(user, "integrations")
   };
   const roles = await cms.roles.options();
   const adminCollections = await Promise.all(
@@ -12890,7 +13683,8 @@ var VIEW_GROUPS = [
   ["email", "settings.system"],
   ["deliveries", "settings.system"],
   ["jobs", "settings.system"],
-  ["audit", "settings.system"]
+  ["audit", "settings.system"],
+  ["integrations", "settings.integrations"]
 ];
 function buildNav(cms, collections, globals, pageRefs, views) {
   const groups = navGroups(cms.config.admin.nav);
@@ -13123,6 +13917,15 @@ async function adminStatus(cms) {
   if (failed.length > 0) attention.push({ id: "jobs", count: failed.length, names: failed });
   const paused = await pausedJobs(cms);
   if (paused.length > 0) attention.push({ id: "jobs-paused", count: paused.length, names: paused });
+  if (config.integrations.length > 0) {
+    const broken = await cms.integrations.broken();
+    if (broken.length > 0)
+      attention.push({
+        id: "integrations",
+        count: broken.length,
+        names: broken.map((b) => `${b.integration}: ${b.name}`)
+      });
+  }
   const backups = await backupAttention(cms);
   if (backups) attention.push(backups);
   attention.push(...await cms.audit.attention());
@@ -14294,6 +15097,91 @@ async function route(cms, ctx, method, path, options) {
     }
     throw methodNotAllowed(ctx, "PATCH, DELETE");
   }
+  if (first === "admin" && second === "integrations") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (cms.config.integrations.length === 0) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "integrations")) throw new ForbiddenError();
+    const user = ctx.user;
+    const [, , id2, part, cid, action, extra] = segments;
+    const integrations = cms.integrations;
+    if (id2 === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await integrations.overview() };
+    }
+    const callbackUrl = `${cms.config.serverURL ?? ctx.url.origin}${cms.config.routes.api}/admin/integrations/${id2}/callback`;
+    if (part === void 0) {
+      if (method !== "PUT") throw methodNotAllowed(ctx, "PUT");
+      const body = await readJson(ctx.request);
+      return { body: await integrations.setEnabled(id2, body.enabled !== false, user) };
+    }
+    if (part === "authorize" && cid === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      const body = await readJson(ctx.request);
+      return { body: integrations.authorize(id2, user, callbackUrl, String(body.name ?? "")) };
+    }
+    if (part === "callback" && cid === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const page = new URL(`${cms.config.admin.path}/integrations`, ctx.url.origin);
+      page.searchParams.set("integration", id2);
+      try {
+        const error = ctx.url.searchParams.get("error_description") ?? ctx.url.searchParams.get("error");
+        if (error) throw new Error(error);
+        const result = await integrations.callback(
+          id2,
+          ctx.url.searchParams.get("code") ?? "",
+          ctx.url.searchParams.get("state") ?? "",
+          callbackUrl,
+          user
+        );
+        if ("pending" in result) page.searchParams.set("pending", String(result.pending));
+        else page.searchParams.set("connected", "1");
+      } catch (error) {
+        page.searchParams.set("error", error.message.slice(0, 300));
+      }
+      return { body: new Response(null, { status: 302, headers: { location: page.toString() } }) };
+    }
+    if (part === "lookup" && cid !== void 0 && action === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await integrations.lookup(id2, cid, await readJson(ctx.request)) };
+    }
+    if (part === "pending" && cid !== void 0 && action === void 0) {
+      const pid = parseId(cid);
+      if (pid === void 0) throw new HttpError("Not found", 404);
+      if (method === "GET") return { body: await integrations.pending(id2, pid, user) };
+      if (method === "POST") {
+        const body = await readJson(ctx.request);
+        return {
+          status: 201,
+          body: await integrations.choose(id2, pid, String(body.account ?? ""), user)
+        };
+      }
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    if (part === "connections" && extra === void 0) {
+      if (cid === void 0) {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        return {
+          status: 201,
+          body: await integrations.connect(id2, await readJson(ctx.request), user)
+        };
+      }
+      if (action === "test") {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        const target = cid === "env" ? "env" : parseId(cid);
+        if (target === void 0) throw new HttpError("Not found", 404);
+        return { body: await integrations.test(id2, target) };
+      }
+      const connection = parseId(cid);
+      if (connection === void 0 || action !== void 0) throw new HttpError("Not found", 404);
+      if (method === "PATCH")
+        return {
+          body: await integrations.update(id2, connection, await readJson(ctx.request), user)
+        };
+      if (method === "DELETE") return { body: await integrations.disconnect(id2, connection, user) };
+      throw methodNotAllowed(ctx, "PATCH, DELETE");
+    }
+    throw new HttpError("Not found", 404);
+  }
   if (first === "admin" && second === "deliveries") {
     if (!ctx.user) throw new UnauthorizedError();
     if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();