@easy-cms/core 1.31.0 → 1.33.0

package/dist/{chunk-ZA5KIRYX.js → chunk-KUEGUD2X.js}

@@ -50,99 +50,6 @@ var isStaff = ({ user }) => user !== null && user.member !== true;
 var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin" && user.scoped !== true;
 
-// src/auth/tokens.ts
-import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
-function newToken() {
-  return randomBytes(32).toString("base64url");
-}
-function hashToken(token) {
-  return createHash("sha256").update(token).digest("hex");
-}
-function hmac(secret, value) {
-  return createHmac("sha256", secret).update(value).digest("base64url");
-}
-function secretsOf(config) {
-  return [config.secret, ...config.previousSecrets ?? []];
-}
-function signedWith(secrets, value, signature) {
-  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
-}
-function signToken(secret, token) {
-  return `${token}.${hmac(secret, `session:${token}`)}`;
-}
-function unsignToken(secrets, value) {
-  const dot = value.lastIndexOf(".");
-  if (dot <= 0) return void 0;
-  const token = value.slice(0, dot);
-  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
-}
-function csrfToken(secret, token) {
-  return hmac(secret, `csrf:${token}`);
-}
-function csrfMatches(secrets, token, given) {
-  return signedWith(secrets, `csrf:${token}`, given);
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function signPreviewToken(secret, target, expiresAt, user) {
-  const payload = Buffer.from(
-    JSON.stringify({
-      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
-      e: expiresAt,
-      ...user !== void 0 ? { u: user } : {}
-    })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
-}
-function verifyPreviewToken(secrets, token, now = Date.now()) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.e !== "number" || data.e <= now) return null;
-    const user = typeof data.u === "string" ? { user: data.u } : {};
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
-    if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
-    return null;
-  } catch {
-    return null;
-  }
-}
-function passwordFingerprint(passwordHash) {
-  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
-}
-function signPasswordToken(secret, args) {
-  const payload = Buffer.from(
-    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
-}
-function readPasswordToken(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
-    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
-  } catch {
-    return null;
-  }
-}
-function passwordTokenMatches(secrets, token, fingerprint) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return false;
-  const payload = token.slice(0, dot);
-  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
-}
-
 // src/builtins.ts
 var USERS = "users";
 var MEDIA = "media";
@@ -162,6 +69,8 @@ var OUTBOX = "outbox";
 var RATE_LIMITS = "rate-limits";
 var BULK_OPERATIONS = "bulk-operations";
 var SAVED_VIEWS = "saved-views";
+var CONNECTIONS = "connections";
+var AI_USAGE = "ai-usage";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -177,7 +86,9 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   OUTBOX,
   RATE_LIMITS,
   BULK_OPERATIONS,
-  SAVED_VIEWS
+  SAVED_VIEWS,
+  CONNECTIONS,
+  AI_USAGE
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -581,6 +492,40 @@ var savedViewsCollection = {
     { name: "target", type: "text" }
   ]
 };
+var connectionsCollection = {
+  slug: CONNECTIONS,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    // connection | integration | pending
+    { name: "kind", type: "text", required: true },
+    { name: "integration", type: "text", required: true, index: true },
+    { name: "name", type: "text" },
+    { name: "isDefault", type: "boolean" },
+    { name: "values", type: "json" },
+    // AES-256-GCM, with a key derived from the secret (see integrations.ts).
+    { name: "secret", type: "text" },
+    { name: "account", type: "text" },
+    { name: "lastUsedAt", type: "text" },
+    { name: "lastError", type: "text" },
+    { name: "enabled", type: "boolean" }
+  ]
+};
+var aiUsageCollection = {
+  slug: AI_USAGE,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "user", type: "text", index: true },
+    { name: "feature", type: "text", required: true },
+    { name: "integration", type: "text", required: true },
+    { name: "connection", type: "text" },
+    { name: "input", type: "number" },
+    { name: "output", type: "number" },
+    { name: "ok", type: "boolean" },
+    { name: "error", type: "text" },
+    // The document it was for, e.g. the image of alt text.
+    { name: "about", type: "text" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -720,6 +665,602 @@ var emailDeliveriesCollection = {
   ]
 };
 
+// src/time-of-day.ts
+var DAY = 864e5;
+function isTimeZone(zone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var formatters = /* @__PURE__ */ new Map();
+function wallClock(instant, zone) {
+  let format = formatters.get(zone);
+  if (!format) {
+    format = new Intl.DateTimeFormat("en-US", {
+      timeZone: zone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "numeric",
+      day: "numeric",
+      hour: "numeric",
+      minute: "numeric",
+      second: "numeric"
+    });
+    formatters.set(zone, format);
+  }
+  const parts = {};
+  for (const part of format.formatToParts(instant))
+    if (part.type !== "literal") parts[part.type] = Number(part.value);
+  return Date.UTC(
+    parts.year,
+    parts.month - 1,
+    parts.day,
+    parts.hour,
+    parts.minute,
+    parts.second
+  );
+}
+function instantOf(wall, zone) {
+  let instant = wall - (wallClock(wall, zone) - wall);
+  instant = wall - (wallClock(instant, zone) - instant);
+  return instant;
+}
+var parse = (at) => at.split(":").map(Number);
+function lastSlot(now, at, zone) {
+  const [hours2, minutes] = parse(at);
+  if (!zone) {
+    const slot2 = new Date(now);
+    slot2.setHours(hours2, minutes, 0, 0);
+    if (slot2.getTime() > now.getTime()) slot2.setDate(slot2.getDate() - 1);
+    return slot2;
+  }
+  const today = wallClock(now.getTime(), zone);
+  const midnight = today - today % DAY;
+  let slot = instantOf(midnight + hours2 * 36e5 + minutes * 6e4, zone);
+  if (slot > now.getTime())
+    slot = instantOf(midnight - DAY + hours2 * 36e5 + minutes * 6e4, zone);
+  return new Date(slot);
+}
+function nextSlot(after, at, zone) {
+  const last = lastSlot(after, at, zone);
+  return lastSlot(new Date(last.getTime() + DAY + 2 * 36e5), at, zone);
+}
+function dueAt(now, at, every, lastRun, zone) {
+  if (lastRun === void 0) return true;
+  const last = Date.parse(lastRun);
+  if (Number.isNaN(last)) return true;
+  const slot = lastSlot(now, at, zone).getTime();
+  return last < slot - (every * 1e3 - DAY);
+}
+function nextAt(at, every, lastRun, zone) {
+  return nextSlot(new Date(Date.parse(lastRun) + (every * 1e3 - DAY)), at, zone);
+}
+
+// src/ai.ts
+var AiProviderError = class extends Error {
+  status;
+  constructor(message2, status) {
+    super(message2);
+    this.name = "AiProviderError";
+    this.status = status;
+  }
+};
+var SETTINGS = "ai";
+var DEFAULT_LIMIT = 100;
+var TIMEOUT = 6e4;
+var MAX_IMAGE = 4 * 1024 * 1024;
+var KEEP = 90 * 24 * 36e5;
+var IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/webp", "image/gif"]);
+var AI_TEST_FEATURE = "test";
+var ref = (integration, name) => `${integration}:${name}`;
+var Ai = class {
+  constructor(cms, ai) {
+    this.cms = cms;
+    this.ai = ai;
+  }
+  cms;
+  ai;
+  get config() {
+    return this.cms.config;
+  }
+  get defaultLimit() {
+    return this.ai.limits?.perUserPerDay ?? DEFAULT_LIMIT;
+  }
+  /** The features of the config. */
+  get features() {
+    return this.config.aiFeatures;
+  }
+  async settingsRow() {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ kind: { equals: "settings" } }, { integration: { equals: SETTINGS } }] },
+      sort: ["id"],
+      limit: 1,
+      page: 1
+    });
+    return found.docs[0];
+  }
+  async settings() {
+    return (await this.settingsRow())?.values ?? {};
+  }
+  /** Every connection of every provider, in the providers' order. */
+  async connections() {
+    const out = [];
+    for (const provider of this.ai.providers)
+      for (const conn of await this.cms.integrations.all(provider.integration))
+        out.push({ ...conn, integration: provider.integration });
+    return out;
+  }
+  /** Whether a feature is on: admins' choice, else its `default`. */
+  async enabled(feature) {
+    const def = this.features.find((f) => f.id === feature);
+    if (!def) return false;
+    return (await this.settings()).features?.[feature]?.enabled ?? def.default ?? true;
+  }
+  /** Requests a user may make today: their role's, else everyone's. */
+  async limitFor(user) {
+    const role = typeof user.role === "string" ? user.role : void 0;
+    if (role) {
+      const fromRoles = await this.cms.roles.aiLimit(role);
+      if (fromRoles !== void 0) return fromRoles;
+      const fromConfig = this.ai.limits?.roles?.[role];
+      if (fromConfig !== void 0) return fromConfig;
+    }
+    return (await this.settings()).perUserPerDay ?? this.defaultLimit;
+  }
+  /** Requests the user made today (in `timeZone`) and how many are left. */
+  async remaining(user, now = /* @__PURE__ */ new Date()) {
+    const since = lastSlot(now, "00:00", this.config.timeZone).toISOString();
+    const used = await this.cms.db.count({
+      collection: AI_USAGE,
+      where: {
+        and: [
+          { user: { equals: String(user.id) } },
+          { ok: { equals: true } },
+          { createdAt: { gte: since } }
+        ]
+      }
+    });
+    return { used, limit: await this.limitFor(user) };
+  }
+  /**
+   * Asks the feature's connection (or the main one). With `user`, the request counts toward their
+   * daily limit; it is refused once they reach it. Usage is recorded, never the prompt.
+   */
+  async generate(request, options = {}) {
+    const feature = this.features.find((f) => f.id === request.feature);
+    if (!feature)
+      throw new QueryError(
+        `Unknown AI feature "${request.feature}": add it to \`aiFeatures\` in the config`
+      );
+    if (!await this.enabled(feature.id))
+      throw new QueryError(`The AI feature "${feature.id}" is turned off`);
+    const user = options.user ?? null;
+    if (user) {
+      const { used, limit } = await this.remaining(user);
+      if (used >= limit)
+        throw new TooManyRequestsError(
+          limit === 0 ? "Your role may not use AI" : `You used AI ${limit} times today, the most allowed`
+        );
+    }
+    const conn = await this.connectionFor(feature.id);
+    const images = await Promise.all((request.images ?? []).map((i) => this.image(i)));
+    return this.ask(conn, {
+      feature: feature.id,
+      user,
+      about: options.about,
+      request: {
+        ...request.system ? { system: request.system } : {},
+        prompt: request.prompt,
+        images,
+        ...request.json ? { json: request.json } : {},
+        maxTokens: request.maxTokens ?? 1024
+      }
+    });
+  }
+  /**
+   * The Test button of a provider's connection: a short prompt; its tokens count on the card,
+   * not toward anyone's limit.
+   */
+  async test(integration, values, name) {
+    try {
+      await this.ask(
+        { integration, name: name ?? "", values, env: false },
+        {
+          feature: AI_TEST_FEATURE,
+          user: null,
+          markConnection: false,
+          request: { prompt: "Reply with the word OK.", images: [], maxTokens: 16 }
+        }
+      );
+      return { ok: true, ...values.model ? { account: values.model } : {} };
+    } catch (error) {
+      return { ok: false, message: error.message };
+    }
+  }
+  async connectionFor(feature) {
+    const settings = await this.settings();
+    const wanted = settings.features?.[feature]?.connection ?? settings.main;
+    const all = await this.connections();
+    const conn = wanted && all.find((c) => ref(c.integration, c.name) === wanted) || all[0];
+    if (!conn)
+      throw new QueryError("No AI provider is connected: connect one in Settings \u2192 Integrations");
+    return conn;
+  }
+  async ask(conn, args) {
+    const provider = this.ai.providers.find((p) => p.integration === conn.integration);
+    if (!provider) throw new QueryError(`No AI provider answers for "${conn.integration}"`);
+    const record = (data) => this.cms.db.create({
+      collection: AI_USAGE,
+      data: {
+        user: args.user ? String(args.user.id) : null,
+        feature: args.feature,
+        integration: conn.integration,
+        connection: conn.name || null,
+        input: 0,
+        output: 0,
+        error: null,
+        about: args.about ? `${args.about.collection}:${args.about.id}` : null,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...data
+      }
+    });
+    let result;
+    try {
+      result = await this.call(provider, conn.values, args.request);
+    } catch (error) {
+      const status = error instanceof AiProviderError ? error.status : void 0;
+      const message2 = error.message;
+      await record({ ok: false, error: message2.slice(0, 500) });
+      if ((status === 401 || status === 403) && args.markConnection !== false && conn.name)
+        await this.cms.integrations.markError(conn.integration, message2, conn.name);
+      throw new QueryError(message2);
+    }
+    await record({ ok: true, input: result.usage.input, output: result.usage.output });
+    if (args.markConnection !== false && conn.name)
+      await this.cms.integrations.markUsed(conn.integration, conn.name);
+    let json2;
+    if (args.request.json) {
+      try {
+        json2 = JSON.parse(stripFence(result.text));
+      } catch {
+        throw new QueryError("The AI answered with something other than JSON; try again");
+      }
+    }
+    return {
+      text: result.text,
+      ...args.request.json ? { json: json2 } : {},
+      usage: result.usage,
+      connection: ref(conn.integration, conn.name)
+    };
+  }
+  /** One try, and another after a second when the provider is busy or failing (429, 5xx). */
+  async call(provider, values, request) {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return await provider.generate(values, { ...request, signal: AbortSignal.timeout(TIMEOUT) });
+      } catch (error) {
+        const status = error instanceof AiProviderError ? error.status : void 0;
+        const busy = status === 429 || status !== void 0 && status >= 500;
+        if (!busy || attempt > 0) {
+          if (error.name === "TimeoutError")
+            throw new AiProviderError("The AI provider took longer than 60 seconds");
+          throw error;
+        }
+        await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+      }
+    }
+  }
+  /** An image as base64: given, or read from a media document. */
+  async image(image) {
+    if (image.data !== void 0) {
+      if (!image.mediaType || !IMAGE_TYPES.has(image.mediaType))
+        throw new ValidationError(AI_USAGE, [
+          { field: "images", message: "must be JPEG, PNG, WebP or GIF" }
+        ]);
+      return { data: image.data, mediaType: image.mediaType };
+    }
+    if (image.media === void 0)
+      throw new ValidationError(AI_USAGE, [{ field: "images", message: "needs media or data" }]);
+    const doc = await this.cms.db.findById({ collection: MEDIA, id: image.media });
+    if (!doc) throw new ValidationError(AI_USAGE, [{ field: "images", message: "media not found" }]);
+    const sizes = Object.values(doc.sizes ?? {}).filter((s) => typeof s?.filename === "string" && Number(s.width) >= 1024).sort((a, b) => Number(a.width) - Number(b.width));
+    const filename = String(sizes[0]?.filename ?? doc.filename);
+    const mediaType = String(doc.mimeType ?? "");
+    if (!IMAGE_TYPES.has(mediaType))
+      throw new ValidationError(AI_USAGE, [
+        { field: "images", message: `${mediaType || "this file"} is not an image AI can read` }
+      ]);
+    const file = await this.cms.storageFor(doc.private === true).get(filename);
+    if (!file) throw new ValidationError(AI_USAGE, [{ field: "images", message: "file not found" }]);
+    if (file.body.byteLength > MAX_IMAGE)
+      throw new ValidationError(AI_USAGE, [
+        { field: "images", message: "is larger than 4 MB; add an image size of about 1024 pixels" }
+      ]);
+    return { data: Buffer.from(file.body).toString("base64"), mediaType };
+  }
+  // --- Admins ----------------------------------------------------------------------------------
+  /** Settings → Integrations, AI: the main connection, the features, the limit and this month. */
+  async overview(now = /* @__PURE__ */ new Date()) {
+    const settings = await this.settings();
+    const conns = await this.connections();
+    const labels = new Map(this.config.integrations.map((i) => [i.id, i.label]));
+    const month = monthStart(now, this.config.timeZone).toISOString();
+    const rows2 = (await this.cms.db.find({
+      collection: AI_USAGE,
+      where: { createdAt: { gte: month } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    })).docs;
+    const sum = (key) => {
+      const totals = /* @__PURE__ */ new Map();
+      for (const row of rows2) {
+        if (key === "user" && !row.user) continue;
+        const k = String(row[key]);
+        const t = totals.get(k) ?? { requests: 0, input: 0, output: 0 };
+        t.requests++;
+        t.input += Number(row.input ?? 0);
+        t.output += Number(row.output ?? 0);
+        totals.set(k, t);
+      }
+      return [...totals].sort((a, b) => b[1].requests - a[1].requests);
+    };
+    const users = sum("user");
+    const emails = /* @__PURE__ */ new Map();
+    if (users.length > 0) {
+      const found = await this.cms.db.findByIds({
+        collection: "users",
+        ids: users.map(([id]) => /^\d+$/.test(id) ? Number(id) : id)
+      });
+      for (const u of found) emails.set(String(u.id), String(u.email ?? u.id));
+    }
+    return {
+      main: settings.main ?? null,
+      perUserPerDay: settings.perUserPerDay ?? this.defaultLimit,
+      defaultPerUserPerDay: this.defaultLimit,
+      connections: conns.map((c) => ({
+        id: ref(c.integration, c.name),
+        integration: c.integration,
+        name: c.name,
+        label: labels.get(c.integration) ?? c.integration
+      })),
+      features: await Promise.all(
+        this.features.map(async (f) => ({
+          id: f.id,
+          label: f.label,
+          ...f.description ? { description: f.description } : {},
+          enabled: await this.enabled(f.id),
+          connection: settings.features?.[f.id]?.connection ?? null
+        }))
+      ),
+      usage: {
+        byUser: users.map(([id, t]) => ({ user: emails.get(id) ?? id, ...t })),
+        byFeature: sum("feature").map(([feature, t]) => ({ feature, ...t }))
+      }
+    };
+  }
+  /** Tokens and requests of each connection this month, for the cards. */
+  async usageByConnection(now = /* @__PURE__ */ new Date()) {
+    const month = monthStart(now, this.config.timeZone).toISOString();
+    const rows2 = (await this.cms.db.find({
+      collection: AI_USAGE,
+      where: { createdAt: { gte: month } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    })).docs;
+    const out = /* @__PURE__ */ new Map();
+    for (const row of rows2) {
+      const k = ref(String(row.integration), String(row.connection ?? ""));
+      const t = out.get(k) ?? { requests: 0, input: 0, output: 0 };
+      t.requests++;
+      t.input += Number(row.input ?? 0);
+      t.output += Number(row.output ?? 0);
+      out.set(k, t);
+    }
+    return out;
+  }
+  /** Saves admins' choices; audit-logged. */
+  async update(body, user) {
+    const input = body ?? {};
+    const current = await this.settings();
+    const conns = new Set((await this.connections()).map((c) => ref(c.integration, c.name)));
+    const next = { ...current };
+    const fail = (field, message2) => {
+      throw new ValidationError(AI_USAGE, [{ field, message: message2 }]);
+    };
+    if (input.main !== void 0) {
+      if (input.main === null) delete next.main;
+      else if (typeof input.main === "string" && conns.has(input.main)) next.main = input.main;
+      else fail("main", "is not a connection");
+    }
+    if (input.perUserPerDay !== void 0) {
+      if (input.perUserPerDay === null) delete next.perUserPerDay;
+      else if (Number.isInteger(input.perUserPerDay) && input.perUserPerDay >= 0)
+        next.perUserPerDay = input.perUserPerDay;
+      else fail("perUserPerDay", "must be a whole number, 0 or more");
+    }
+    if (input.features !== void 0) {
+      if (typeof input.features !== "object" || input.features === null)
+        fail("features", "must be an object");
+      const features = { ...current.features ?? {} };
+      for (const [id, raw] of Object.entries(input.features)) {
+        if (!this.features.some((f) => f.id === id)) fail("features", `unknown feature "${id}"`);
+        const change = raw ?? {};
+        const entry = { ...features[id] ?? {} };
+        if (typeof change.enabled === "boolean") entry.enabled = change.enabled;
+        if (change.connection === null) delete entry.connection;
+        else if (change.connection !== void 0) {
+          if (typeof change.connection !== "string" || !conns.has(change.connection))
+            fail("features", "connection is not a connection");
+          entry.connection = change.connection;
+        }
+        features[id] = entry;
+      }
+      next.features = features;
+    }
+    const row = await this.settingsRow();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (row)
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: row.id,
+        data: { ...row, values: next, updatedAt: now }
+      });
+    else
+      await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "settings",
+          integration: SETTINGS,
+          name: null,
+          isDefault: false,
+          values: next,
+          secret: null,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+    await this.cms.audit.record({
+      action: "integration.ai",
+      target: SETTINGS,
+      user,
+      detail: { ...next }
+    });
+    return this.overview();
+  }
+  /** Forgets usage older than 90 days (with the scheduled jobs). */
+  async upkeep(now = /* @__PURE__ */ new Date()) {
+    const before = new Date(now.getTime() - KEEP).toISOString();
+    for (; ; ) {
+      const old = await this.cms.db.find({
+        collection: AI_USAGE,
+        where: { createdAt: { lt: before } },
+        sort: ["id"],
+        limit: 500,
+        page: 1
+      });
+      for (const row of old.docs) await this.cms.db.delete({ collection: AI_USAGE, id: row.id });
+      if (old.docs.length < 500) return;
+    }
+  }
+};
+function stripFence(text4) {
+  const trimmed = text4.trim();
+  const match = /^```(?:json)?\s*\n([\s\S]*?)\n?```$/.exec(trimmed);
+  return match ? match[1] : trimmed;
+}
+function monthStart(now, zone) {
+  let day = lastSlot(now, "00:00", zone);
+  const dayOf = (d) => Number(new Intl.DateTimeFormat("en-US", { day: "numeric", timeZone: zone }).format(d));
+  for (let i = 0; i < 31 && dayOf(day) > 1; i++)
+    day = lastSlot(new Date(day.getTime() - 1), "00:00", zone);
+  return day;
+}
+
+// src/auth/tokens.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+function newToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function hmac(secret, value) {
+  return createHmac("sha256", secret).update(value).digest("base64url");
+}
+var signValue = (secret, value) => hmac(secret, value);
+function secretsOf(config) {
+  return [config.secret, ...config.previousSecrets ?? []];
+}
+function signedWith(secrets, value, signature) {
+  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
+}
+function signToken(secret, token) {
+  return `${token}.${hmac(secret, `session:${token}`)}`;
+}
+function unsignToken(secrets, value) {
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return void 0;
+  const token = value.slice(0, dot);
+  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
+}
+function csrfToken(secret, token) {
+  return hmac(secret, `csrf:${token}`);
+}
+function csrfMatches(secrets, token, given) {
+  return signedWith(secrets, `csrf:${token}`, given);
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function signPreviewToken(secret, target, expiresAt, user) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
+}
+function verifyPreviewToken(secrets, token, now = Date.now()) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.e !== "number" || data.e <= now) return null;
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
+    if (typeof data.c === "string" && typeof data.i === "string")
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
+    return null;
+  } catch {
+    return null;
+  }
+}
+function passwordFingerprint(passwordHash) {
+  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
+}
+function signPasswordToken(secret, args) {
+  const payload = Buffer.from(
+    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
+}
+function readPasswordToken(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
+    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
+  } catch {
+    return null;
+  }
+}
+function passwordTokenMatches(secrets, token, fingerprint) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return false;
+  const payload = token.slice(0, dot);
+  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
+}
+
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { createHmac as createHmac2 } from "crypto";
@@ -737,7 +1278,7 @@ var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
 var PAGE = 50;
 var CSV_LIMIT = 1e4;
-var DAY = 864e5;
+var DAY2 = 864e5;
 var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
 var auditContext = new AsyncLocalStorage();
 var SIGN_IN_FAILURES = /* @__PURE__ */ new Set(["login.failed", "login.locked", "sso.failed"]);
@@ -1012,10 +1553,10 @@ var AuditLog = class {
   async upkeep(now = /* @__PURE__ */ new Date()) {
     if (!this.enabled) return;
     const last = await this.lastVerification();
-    if (last && now.getTime() - Date.parse(last.at) < DAY) return;
+    if (last && now.getTime() - Date.parse(last.at) < DAY2) return;
     const keep = this.settings.keepDays;
     if (keep > 0) {
-      const before = new Date(now.getTime() - keep * DAY).toISOString();
+      const before = new Date(now.getTime() - keep * DAY2).toISOString();
       for (; ; ) {
         const { docs } = await this.cms.db.find({
           collection: AUDIT_LOGS,
@@ -3023,6 +3564,8 @@ var Mailer = class {
   logger;
   queue;
   pending = /* @__PURE__ */ new Set();
+  /** Told when an email is given up on (`delivery.failed`). */
+  onGiveUp;
   get configured() {
     return this.adapter !== void 0;
   }
@@ -3080,6 +3623,8 @@ var Mailer = class {
       if (delay === void 0) {
         failed++;
         this.logger.error(`Email gave up after ${attempts} attempts: ${error}`);
+        const sent2 = JSON.parse(queued.message);
+        this.onGiveUp?.({ to: [sent2.to].flat().join(", "), error, attempts });
       }
       await this.queue.update(id, {
         ...queued,
@@ -3276,92 +3821,16 @@ function diskStorage(options = {}) {
     async delete(key) {
       await rm(pathOf(key), { force: true });
     }
-  };
-}
-
-// src/backups.ts
-import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
-import { mkdtemp, readFile as readFile2, rm as rm2 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join2 } from "path";
-import { promisify } from "util";
-import { gzip } from "zlib";
-
-// src/time-of-day.ts
-var DAY2 = 864e5;
-function isTimeZone(zone) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: zone });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var formatters = /* @__PURE__ */ new Map();
-function wallClock(instant, zone) {
-  let format = formatters.get(zone);
-  if (!format) {
-    format = new Intl.DateTimeFormat("en-US", {
-      timeZone: zone,
-      hourCycle: "h23",
-      year: "numeric",
-      month: "numeric",
-      day: "numeric",
-      hour: "numeric",
-      minute: "numeric",
-      second: "numeric"
-    });
-    formatters.set(zone, format);
-  }
-  const parts = {};
-  for (const part of format.formatToParts(instant))
-    if (part.type !== "literal") parts[part.type] = Number(part.value);
-  return Date.UTC(
-    parts.year,
-    parts.month - 1,
-    parts.day,
-    parts.hour,
-    parts.minute,
-    parts.second
-  );
-}
-function instantOf(wall, zone) {
-  let instant = wall - (wallClock(wall, zone) - wall);
-  instant = wall - (wallClock(instant, zone) - instant);
-  return instant;
-}
-var parse = (at) => at.split(":").map(Number);
-function lastSlot(now, at, zone) {
-  const [hours2, minutes] = parse(at);
-  if (!zone) {
-    const slot2 = new Date(now);
-    slot2.setHours(hours2, minutes, 0, 0);
-    if (slot2.getTime() > now.getTime()) slot2.setDate(slot2.getDate() - 1);
-    return slot2;
-  }
-  const today = wallClock(now.getTime(), zone);
-  const midnight = today - today % DAY2;
-  let slot = instantOf(midnight + hours2 * 36e5 + minutes * 6e4, zone);
-  if (slot > now.getTime())
-    slot = instantOf(midnight - DAY2 + hours2 * 36e5 + minutes * 6e4, zone);
-  return new Date(slot);
-}
-function nextSlot(after, at, zone) {
-  const last = lastSlot(after, at, zone);
-  return lastSlot(new Date(last.getTime() + DAY2 + 2 * 36e5), at, zone);
-}
-function dueAt(now, at, every, lastRun, zone) {
-  if (lastRun === void 0) return true;
-  const last = Date.parse(lastRun);
-  if (Number.isNaN(last)) return true;
-  const slot = lastSlot(now, at, zone).getTime();
-  return last < slot - (every * 1e3 - DAY2);
-}
-function nextAt(at, every, lastRun, zone) {
-  return nextSlot(new Date(Date.parse(lastRun) + (every * 1e3 - DAY2)), at, zone);
+  };
 }
 
 // src/backups.ts
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
+import { mkdtemp, readFile as readFile2, rm as rm2 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join2 } from "path";
+import { promisify } from "util";
+import { gzip } from "zlib";
 var gzipAsync = promisify(gzip);
 var MAGIC = Buffer.from("ECMSBAK1");
 var IV_BYTES = 12;
@@ -3559,11 +4028,13 @@ async function runBackup(cms, record) {
     });
     cms.logger.info(`Backup ${key} written (${data.byteLength} bytes)`);
   } catch (error) {
+    const message2 = (error.message || String(error)).slice(0, 500);
     await update(cms, row, {
       state: "failed",
-      error: (error.message || String(error)).slice(0, 500),
+      error: message2,
       finishedAt: (/* @__PURE__ */ new Date()).toISOString()
     });
+    cms.systemEvent("backup.failed", { backup: row.id, error: message2 });
     throw error;
   } finally {
     await rm2(dir, { recursive: true, force: true });
@@ -4309,7 +4780,7 @@ var VersionStore = class {
 };
 
 // src/local-api.ts
-import { createHash as createHash5, createHmac as createHmac8, randomBytes as randomBytes6, randomUUID as randomUUID3 } from "crypto";
+import { createHash as createHash6, createHmac as createHmac8, randomBytes as randomBytes7, randomUUID as randomUUID3 } from "crypto";
 
 // src/auth/common-passwords.ts
 var LIST = `
@@ -4826,6 +5297,685 @@ function toOperation(row) {
   };
 }
 
+// src/integrations.ts
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, createHash as createHash4, hkdfSync, randomBytes as randomBytes6 } from "crypto";
+var ENV_NAME = "Environment";
+var PENDING_MS = 10 * 60 * 1e3;
+var keyOf2 = (secret) => Buffer.from(hkdfSync("sha256", secret, "", "easy-cms:connections", 32));
+var keyId = (key) => createHash4("sha256").update(key).digest("hex").slice(0, 12);
+function encryptValues(secret, values) {
+  const key = keyOf2(secret);
+  const iv = randomBytes6(12);
+  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const data = Buffer.concat([cipher.update(JSON.stringify(values), "utf8"), cipher.final()]);
+  const box = {
+    k: keyId(key),
+    iv: iv.toString("base64"),
+    t: cipher.getAuthTag().toString("base64"),
+    d: data.toString("base64")
+  };
+  return Buffer.from(JSON.stringify(box)).toString("base64url");
+}
+function decryptValues(secrets, sealed) {
+  const box = JSON.parse(Buffer.from(sealed, "base64url").toString("utf8"));
+  for (const [i, secret] of secrets.entries()) {
+    const key = keyOf2(secret);
+    if (keyId(key) !== box.k) continue;
+    const decipher = createDecipheriv2("aes-256-gcm", key, Buffer.from(String(box.iv), "base64"));
+    decipher.setAuthTag(Buffer.from(String(box.t), "base64"));
+    const text4 = Buffer.concat([
+      decipher.update(Buffer.from(String(box.d), "base64")),
+      decipher.final()
+    ]).toString("utf8");
+    return { values: JSON.parse(text4), old: i > 0 };
+  }
+  throw new Error("A connection was encrypted with a secret that is no longer configured");
+}
+var keyIdOf = (sealed) => {
+  try {
+    return JSON.parse(Buffer.from(String(sealed), "base64url").toString("utf8")).k;
+  } catch {
+    return void 0;
+  }
+};
+function signState(secret, payload) {
+  const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  return `${body}.${signValue(secret, `integration:${body}`)}`;
+}
+function readState(secrets, state) {
+  const [body, signature] = state.split(".");
+  if (!body || !signature || !signedWith(secrets, `integration:${body}`, signature)) return null;
+  const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  return typeof payload.exp === "number" && payload.exp > Date.now() ? payload : null;
+}
+var OFFICIAL_PLUGINS = [
+  {
+    name: "@easy-cms/plugin-social",
+    category: "social",
+    description: {
+      en: "Post to Facebook, LINE and webhooks from the admin",
+      th: "\u0E42\u0E1E\u0E2A\u0E15\u0E4C\u0E44\u0E1B Facebook, LINE \u0E41\u0E25\u0E30 webhook \u0E08\u0E32\u0E01 admin"
+    },
+    docs: "https://easycms.dev/docs/integrations"
+  },
+  {
+    name: "@easy-cms/plugin-notify",
+    category: "notifications",
+    description: { en: "Telegram notifications for admins", th: "\u0E41\u0E08\u0E49\u0E07\u0E40\u0E15\u0E37\u0E2D\u0E19\u0E1C\u0E39\u0E49\u0E14\u0E39\u0E41\u0E25\u0E17\u0E32\u0E07 Telegram" },
+    docs: "https://easycms.dev/docs/notifications"
+  },
+  {
+    name: "@easy-cms/plugin-ai",
+    category: "ai",
+    description: {
+      en: "Claude, GPT and Gemini for alt text, SEO and translation",
+      th: "Claude, GPT \u0E41\u0E25\u0E30 Gemini \u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A alt text, SEO \u0E41\u0E25\u0E30\u0E41\u0E1B\u0E25\u0E20\u0E32\u0E29\u0E32"
+    },
+    docs: "https://easycms.dev/docs/ai"
+  },
+  {
+    name: "@easy-cms/plugin-ecommerce",
+    category: "payments",
+    description: { en: "A shop with Stripe payments", th: "\u0E23\u0E49\u0E32\u0E19\u0E04\u0E49\u0E32\u0E1E\u0E23\u0E49\u0E2D\u0E21\u0E0A\u0E33\u0E23\u0E30\u0E40\u0E07\u0E34\u0E19\u0E1C\u0E48\u0E32\u0E19 Stripe" },
+    docs: "https://easycms.dev/docs/ecommerce"
+  }
+];
+var mask = (value) => value.length > 4 ? `\u2022\u2022\u2022\u2022${value.slice(-4)}` : "\u2022\u2022\u2022\u2022";
+var Integrations = class {
+  constructor(cms) {
+    this.cms = cms;
+  }
+  cms;
+  get config() {
+    return this.cms.config;
+  }
+  get secrets() {
+    return secretsOf(this.config);
+  }
+  /** The integrations plugins declared. */
+  get definitions() {
+    return this.config.integrations;
+  }
+  definition(id) {
+    const found = this.definitions.find((d) => d.id === id);
+    if (!found) throw new NotFoundError("integrations", id);
+    return found;
+  }
+  async rows(id, kind) {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ integration: { equals: id } }, { kind: { equals: kind } }] },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    });
+    return found.docs;
+  }
+  /** The values of the fields set in the environment. */
+  envValues(def) {
+    const out = {};
+    for (const [field, name] of Object.entries(def.env ?? {})) {
+      const value = process.env[name];
+      if (value) out[field] = value;
+    }
+    return out;
+  }
+  /** Every field is in the environment: an "Environment" connection. */
+  envComplete(def) {
+    const env = this.envValues(def);
+    const fields = def.fields ?? [];
+    return fields.length > 0 && fields.every((f) => env[f.name] || !f.required) && Object.keys(env).length > 0;
+  }
+  async enabled(id) {
+    const [row] = await this.rows(id, "integration");
+    return row ? row.enabled !== false : true;
+  }
+  decrypt(row) {
+    const plain = row.values ?? {};
+    if (!row.secret) return { ...plain };
+    const { values, old } = decryptValues(this.secrets, String(row.secret));
+    if (old) void this.reseal(row, values);
+    return { ...plain, ...values };
+  }
+  async reseal(row, secrets) {
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, secret: encryptValues(this.config.secret, secrets) }
+    });
+  }
+  /** Splits values into the plain ones and the secret ones (encrypted). */
+  seal(def, values) {
+    const secretNames = new Set((def.fields ?? []).filter((f) => f.secret).map((f) => f.name));
+    const plain = {};
+    const secret = {};
+    for (const [name, value] of Object.entries(values))
+      (secretNames.has(name) || def.kind === "oauth" ? secret : plain)[name] = value;
+    return {
+      values: plain,
+      secret: Object.keys(secret).length ? encryptValues(this.config.secret, secret) : null
+    };
+  }
+  /**
+   * A connection for a plugin: the default one, or the one named; `null` when there is none
+   * or the integration is turned off. Values from the environment win.
+   */
+  async get(id, options = {}) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return null;
+    const env = this.envValues(def);
+    if (this.envComplete(def) && (!options.name || options.name === ENV_NAME))
+      return { name: ENV_NAME, values: env, env: true };
+    const rows2 = await this.rows(id, "connection");
+    const row = options.name ? rows2.find((r) => r.name === options.name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return null;
+    return { name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false };
+  }
+  /**
+   * Every connection of an integration (the environment's first), e.g. to notify each chat;
+   * none when it is turned off.
+   */
+  async all(id) {
+    const def = this.definition(id);
+    if (!await this.enabled(id)) return [];
+    const env = this.envValues(def);
+    const out = this.envComplete(def) ? [{ name: ENV_NAME, values: env, env: true }] : [];
+    for (const row of await this.rows(id, "connection"))
+      out.push({ name: String(row.name), values: { ...this.decrypt(row), ...env }, env: false });
+    return out;
+  }
+  /** The connection was used: its card says when, and an earlier error is gone. */
+  async markUsed(id, name) {
+    await this.mark(id, name, { lastUsedAt: (/* @__PURE__ */ new Date()).toISOString(), lastError: null });
+  }
+  /** It failed: the card and the dashboard's "needs attention" say why. */
+  async markError(id, message2, name) {
+    await this.mark(id, name, { lastError: message2.slice(0, 500) });
+    this.cms.systemEvent("integration.failed", {
+      integration: id,
+      name: name ?? null,
+      error: message2
+    });
+  }
+  async mark(id, name, patch) {
+    const rows2 = await this.rows(id, "connection");
+    const row = name ? rows2.find((r) => r.name === name) : rows2.find((r) => r.isDefault === true) ?? rows2[0];
+    if (!row) return;
+    await this.cms.db.update({
+      collection: CONNECTIONS,
+      id: row.id,
+      data: { ...row, ...patch, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    });
+  }
+  // --- The admin's page ------------------------------------------------------------------------
+  async overview() {
+    const integrations = [];
+    const usage = await this.cms.ai?.usageByConnection() ?? /* @__PURE__ */ new Map();
+    const aiProviders = new Set(this.config.ai?.providers.map((p) => p.integration) ?? []);
+    const current = keyId(keyOf2(this.config.secret));
+    let stale = 0;
+    for (const def of this.definitions) {
+      const rows2 = await this.rows(def.id, "connection");
+      const env = this.envValues(def);
+      const connections = rows2.map((row) => {
+        if (row.secret && keyIdOf(row.secret) !== current) stale++;
+        const secretNames = (def.fields ?? []).filter((f) => f.secret).map((f) => f.name);
+        let values = { ...row.values ?? {} };
+        try {
+          const all = this.decrypt(row);
+          for (const name of secretNames) if (all[name]) values[name] = mask(all[name]);
+        } catch {
+          values = { ...values };
+        }
+        return {
+          id: row.id,
+          name: String(row.name),
+          isDefault: row.isDefault === true,
+          env: false,
+          account: row.account ?? null,
+          lastUsedAt: row.lastUsedAt ?? null,
+          lastError: row.lastError ?? null,
+          values
+        };
+      });
+      if (this.envComplete(def)) {
+        for (const c of connections) c.isDefault = false;
+        connections.unshift({
+          id: "env",
+          name: ENV_NAME,
+          isDefault: true,
+          env: true,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          values: Object.fromEntries(
+            Object.entries(env).map(
+              ([k, v]) => (def.fields ?? []).find((f) => f.name === k)?.secret ? [k, mask(v)] : [k, v]
+            )
+          )
+        });
+      }
+      integrations.push({
+        id: def.id,
+        label: def.label,
+        category: def.category,
+        ...def.description ? { description: def.description } : {},
+        ...def.icon ? { icon: def.icon } : {},
+        ...def.docs ? { docs: def.docs } : {},
+        ...def.plugin ? { plugin: def.plugin } : {},
+        kind: def.kind,
+        // Functions don't travel: `findable` says a field has a Find button.
+        fields: (def.fields ?? []).map(({ lookup, ...field }) => ({
+          ...field,
+          ...lookup ? { findable: true } : {}
+        })),
+        enabled: await this.enabled(def.id),
+        envFields: Object.keys(env),
+        testable: typeof def.test === "function",
+        connections: aiProviders.has(def.id) ? connections.map((c) => ({
+          ...c,
+          usage: usage.get(`${def.id}:${c.name}`) ?? { requests: 0, input: 0, output: 0 }
+        })) : connections,
+        ...def.consent ? { consent: def.consent, consented: await this.consented(def.id) } : {}
+      });
+    }
+    const installed = new Set(this.config.installedPlugins.map((p) => p.name));
+    return {
+      integrations,
+      configured: this.configured(),
+      catalog: OFFICIAL_PLUGINS.filter((p) => !installed.has(p.name)),
+      staleSecrets: stale
+    };
+  }
+  /** The adapters the config sets: email, storage, search, sign-in, payments. */
+  configured() {
+    const out = [];
+    const { config } = this;
+    if (config.email) out.push({ id: "email", kind: "email", name: config.email.name ?? "email" });
+    out.push({ id: "storage", kind: "storage", name: config.upload.storage?.name ?? "disk" });
+    if (config.search)
+      out.push({ id: "search", kind: "search", name: config.search.name ?? "search" });
+    for (const provider of config.auth.providers ?? [])
+      out.push({ id: `sign-in:${provider.id}`, kind: "sign-in", name: provider.id });
+    if (config.installedPlugins.some((p) => p.name === "@easy-cms/plugin-ecommerce"))
+      out.push({ id: "payments", kind: "payments", name: "Stripe" });
+    return out;
+  }
+  async audit(user, action, id, detail = {}) {
+    await this.cms.audit.record({ action: `integration.${action}`, target: id, user, detail });
+  }
+  checkFields(def, values, partial) {
+    const errors = (def.fields ?? []).filter((f) => f.required && !partial && !values[f.name]).map((f) => ({ field: f.name, message: "is required" }));
+    if (errors.length) throw new ValidationError(CONNECTIONS, errors);
+  }
+  cleanValues(def, raw) {
+    const input = raw && typeof raw === "object" ? raw : {};
+    const out = {};
+    for (const field of def.fields ?? []) {
+      const raw2 = input[field.name];
+      const value = Array.isArray(raw2) ? raw2.filter((v) => typeof v === "string").join(",") : raw2;
+      if (typeof value === "string" && value.trim() !== "") out[field.name] = value.trim();
+    }
+    return out;
+  }
+  async uniqueName(id, name, self) {
+    const trimmed = name.trim();
+    if (!trimmed || trimmed.length > 60)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: "must be 1 to 60 characters" }
+      ]);
+    if (trimmed === ENV_NAME || (await this.rows(id, "connection")).some((r) => r.name === trimmed && r.id !== self))
+      throw new ValidationError(CONNECTIONS, [
+        { field: "name", message: `there is already a connection named "${trimmed}"` }
+      ]);
+    return trimmed;
+  }
+  async create(def, name, values, account) {
+    const existing = await this.rows(def.id, "connection");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return await this.cms.db.create({
+      collection: CONNECTIONS,
+      data: {
+        kind: "connection",
+        integration: def.id,
+        name,
+        isDefault: existing.length === 0,
+        ...this.seal(def, values),
+        account,
+        lastUsedAt: null,
+        lastError: null,
+        enabled: null,
+        createdAt: now,
+        updatedAt: now
+      }
+    });
+  }
+  /** Connects with pasted values (`kind: 'fields'`); tested first when the plugin can. */
+  async connect(id, body, user) {
+    const def = this.definition(id);
+    if (def.kind !== "fields") throw new QueryError(`${id} connects with its Connect button`);
+    await this.checkConsent(def);
+    const input = body ?? {};
+    const name = await this.uniqueName(id, String(input.name ?? ""));
+    const values = this.cleanValues(def, input.values);
+    this.checkFields(def, values, false);
+    const result = def.test ? await def.test(values, { cms: this.cms, name }) : null;
+    if (result && !result.ok)
+      throw new ValidationError(CONNECTIONS, [
+        { field: "values", message: result.message ?? "the provider refused these values" }
+      ]);
+    const row = await this.create(def, name, values, result?.account ?? null);
+    await this.audit(user, "connect", id, { name });
+    return { id: row.id };
+  }
+  async row(id, cid) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: cid });
+    if (!row || row.integration !== id || row.kind !== "connection")
+      throw new NotFoundError(CONNECTIONS, cid);
+    return row;
+  }
+  /** A new name or values (secrets left empty are kept), or the default. */
+  async update(id, cid, body, user) {
+    const def = this.definition(id);
+    const row = await this.row(id, cid);
+    const input = body ?? {};
+    const next = { ...row, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (input.name !== void 0) next.name = await this.uniqueName(id, String(input.name), cid);
+    if (input.values !== void 0) {
+      const values = { ...this.decrypt(row), ...this.cleanValues(def, input.values) };
+      this.checkFields(def, values, false);
+      Object.assign(next, this.seal(def, values), { lastError: null });
+    }
+    if (input.isDefault === true) {
+      for (const other of await this.rows(id, "connection"))
+        if (other.id !== cid && other.isDefault === true)
+          await this.cms.db.update({
+            collection: CONNECTIONS,
+            id: other.id,
+            data: { ...other, isDefault: false }
+          });
+      next.isDefault = true;
+    }
+    await this.cms.db.update({ collection: CONNECTIONS, id: cid, data: next });
+    await this.audit(user, input.isDefault === true ? "default" : "update", id, { name: next.name });
+    return { ok: true };
+  }
+  /** Removes the connection and its secrets; the oldest left becomes the default. */
+  async disconnect(id, cid, user) {
+    const row = await this.row(id, cid);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: cid });
+    if (row.isDefault === true) {
+      const [oldest] = await this.rows(id, "connection");
+      if (oldest)
+        await this.cms.db.update({
+          collection: CONNECTIONS,
+          id: oldest.id,
+          data: { ...oldest, isDefault: true }
+        });
+    }
+    await this.audit(user, "disconnect", id, { name: row.name });
+    return { deleted: 1 };
+  }
+  /** Turns the integration on or off; its connections are kept. */
+  async setEnabled(id, enabled, user) {
+    this.definition(id);
+    await this.saveIntegration(id, { enabled });
+    await this.audit(user, enabled ? "enable" : "disable", id);
+    return { enabled };
+  }
+  /** Who accepted the integration's `consent`, and when; `null` before anyone did. */
+  async consented(id) {
+    const [row] = await this.rows(id, "integration");
+    const consent = (row?.values ?? {}).consent;
+    return consent ?? null;
+  }
+  async checkConsent(def) {
+    if (def.consent && !await this.consented(def.id))
+      throw new ValidationError(CONNECTIONS, [
+        { field: "consent", message: "must be accepted before connecting" }
+      ]);
+  }
+  /** An admin accepts the integration's `consent`; audit-logged. */
+  async consent(id, user) {
+    const def = this.definition(id);
+    if (!def.consent) throw new QueryError(`${id} asks for no consent`);
+    const [row] = await this.rows(id, "integration");
+    const consent = { at: (/* @__PURE__ */ new Date()).toISOString(), by: String(user.email ?? user.id) };
+    await this.saveIntegration(id, { values: { ...row?.values ?? {}, consent } });
+    await this.audit(user, "consent", id);
+    return { consented: consent };
+  }
+  /** The integration's own row (on or off, consent), made when first needed. */
+  async saveIntegration(id, patch) {
+    const [row] = await this.rows(id, "integration");
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (row)
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: row.id,
+        data: { ...row, ...patch, updatedAt: now }
+      });
+    else
+      await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "integration",
+          integration: id,
+          name: null,
+          isDefault: false,
+          values: null,
+          secret: null,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now,
+          ...patch
+        }
+      });
+  }
+  /** Checks a connection's values with the provider; the card shows the result. */
+  async test(id, cid) {
+    const def = this.definition(id);
+    if (!def.test) throw new QueryError(`${id} can't be tested`);
+    const values = cid === "env" ? this.envValues(def) : { ...this.decrypt(await this.row(id, cid)), ...this.envValues(def) };
+    const name = cid === "env" ? ENV_NAME : String((await this.row(id, cid)).name);
+    let result;
+    try {
+      result = await def.test(values, { cms: this.cms, name });
+    } catch (error) {
+      result = { ok: false, message: error.message };
+    }
+    if (cid !== "env") {
+      const row = await this.row(id, cid);
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: cid,
+        data: {
+          ...row,
+          ...result.ok ? { lastError: null, ...result.account ? { account: result.account } : {} } : { lastError: result.message ?? "Test failed" },
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+      if (!result.ok)
+        this.cms.systemEvent("integration.failed", {
+          integration: id,
+          name: row.name ?? null,
+          error: result.message ?? "Test failed"
+        });
+    }
+    return result;
+  }
+  /**
+   * A field's choices from the provider, with the values typed (and, editing a connection, its
+   * stored secrets for the fields left empty).
+   */
+  async lookup(id, fieldName, body) {
+    const def = this.definition(id);
+    const field = (def.fields ?? []).find((f) => f.name === fieldName);
+    if (!field?.lookup) throw new QueryError(`${id}.${fieldName} has nothing to look up`);
+    const input = body ?? {};
+    const stored = input.connection !== void 0 && input.connection !== null ? this.decrypt(await this.row(id, input.connection)) : {};
+    const values = { ...stored, ...this.envValues(def), ...this.cleanValues(def, input.values) };
+    try {
+      return { choices: [...await field.lookup(values, { cms: this.cms })].slice(0, 100) };
+    } catch (error) {
+      throw new ValidationError(CONNECTIONS, [
+        { field: fieldName, message: error.message }
+      ]);
+    }
+  }
+  // --- OAuth -----------------------------------------------------------------------------------
+  /** The provider's sign-in page to send the admin to. */
+  async authorize(id, user, redirectUri, name) {
+    const def = this.definition(id);
+    if (def.kind !== "oauth" || !def.oauth)
+      throw new QueryError(`${id} connects with pasted values`);
+    await this.checkConsent(def);
+    const state = signState(this.config.secret, {
+      i: id,
+      u: String(user.id),
+      n: name,
+      exp: Date.now() + PENDING_MS
+    });
+    return { url: def.oauth.authorizeUrl({ redirectUri, state }) };
+  }
+  /**
+   * Back from the provider: one account is connected at once; several wait (encrypted, 10
+   * minutes) for the admin to choose. Returns where the admin goes next.
+   */
+  async callback(id, code, stateText, redirectUri, user) {
+    const def = this.definition(id);
+    const state = readState(this.secrets, stateText);
+    if (!state || state.i !== id || state.u !== String(user.id) || !def.oauth)
+      throw new ForbiddenError(
+        "This connection link has expired: start again from the Integrations page"
+      );
+    const result = await def.oauth.exchange({ code, redirectUri });
+    const name = typeof state.n === "string" && state.n ? state.n : String(def.label);
+    if (result.accounts && result.accounts.length > 0) {
+      if (result.accounts.length === 1) {
+        const [account] = result.accounts;
+        await this.create(
+          def,
+          await this.uniqueName(id, name),
+          { ...account.values },
+          account.name
+        );
+        await this.audit(user, "connect", id, { name });
+        return { connected: true };
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const pending = await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "pending",
+          integration: id,
+          name,
+          isDefault: false,
+          values: {
+            user: String(user.id),
+            expires: String(Date.now() + PENDING_MS),
+            accounts: JSON.stringify(result.accounts.map((a) => ({ id: a.id, name: a.name })))
+          },
+          secret: encryptValues(
+            this.config.secret,
+            Object.fromEntries(result.accounts.map((a) => [a.id, JSON.stringify(a.values)]))
+          ),
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+      return { pending: pending.id };
+    }
+    await this.create(
+      def,
+      await this.uniqueName(id, name),
+      { ...result.values ?? {} },
+      result.account ?? null
+    );
+    await this.audit(user, "connect", id, { name });
+    return { connected: true };
+  }
+  /** The accounts waiting to be chosen from, by name only. */
+  async pending(id, pid, user) {
+    const row = await this.pendingRow(id, pid, user);
+    const values = row.values;
+    return {
+      name: String(row.name),
+      accounts: JSON.parse(values.accounts ?? "[]")
+    };
+  }
+  async pendingRow(id, pid, user) {
+    const row = await this.cms.db.findById({ collection: CONNECTIONS, id: pid });
+    const values = row?.values ?? {};
+    if (!row || row.kind !== "pending" || row.integration !== id || values.user !== String(user.id) || Number(values.expires) < Date.now())
+      throw new NotFoundError(CONNECTIONS, pid);
+    return row;
+  }
+  /** Connects the account chosen. */
+  async choose(id, pid, accountId, user) {
+    const def = this.definition(id);
+    const row = await this.pendingRow(id, pid, user);
+    const secrets = decryptValues(this.secrets, String(row.secret)).values;
+    const chosen = secrets[accountId];
+    const accounts = JSON.parse(
+      String(row.values.accounts ?? "[]")
+    );
+    const account = accounts.find((a) => a.id === accountId);
+    if (!chosen || !account) throw new NotFoundError("accounts", accountId);
+    await this.cms.db.delete({ collection: CONNECTIONS, id: pid });
+    const name = await this.uniqueName(id, String(row.name));
+    const created = await this.create(
+      def,
+      name,
+      JSON.parse(chosen),
+      account.name
+    );
+    await this.audit(user, "connect", id, { name });
+    return { id: created.id };
+  }
+  // --- Rotating the secret ---------------------------------------------------------------------
+  /** Encrypts again, with the current secret, every connection still on an older one. */
+  async rotate() {
+    const current = keyId(keyOf2(this.config.secret));
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    let resealed = 0;
+    for (const row of found.docs) {
+      if (!row.secret || keyIdOf(row.secret) === current) continue;
+      const { values } = decryptValues(this.secrets, String(row.secret));
+      await this.reseal(row, values);
+      resealed++;
+    }
+    return { resealed };
+  }
+  /** Connections whose test or last use failed, for the dashboard's "needs attention". */
+  async broken() {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ kind: { equals: "connection" } }, { lastError: { exists: true } }] },
+      limit: 0,
+      page: 1,
+      sort: ["id"]
+    });
+    return found.docs.filter((r) => this.definitions.some((d) => d.id === r.integration)).map((r) => ({
+      integration: String(r.integration),
+      name: String(r.name),
+      error: String(r.lastError)
+    }));
+  }
+};
+
 // src/localization.ts
 var ALL_LOCALES = "all";
 var isPlainObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -5480,7 +6630,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret previousSecrets db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets integrations listeners ai aiFeatures db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -5663,7 +6813,8 @@ var BUILTIN_NAV = [
     children: [
       { id: "site", label: { en: "Site", th: "\u0E40\u0E27\u0E47\u0E1A\u0E44\u0E0B\u0E15\u0E4C" }, icon: "globe" },
       { id: "people", label: { en: "Users & access", th: "\u0E1C\u0E39\u0E49\u0E43\u0E0A\u0E49\u0E41\u0E25\u0E30\u0E2A\u0E34\u0E17\u0E18\u0E34\u0E4C" }, icon: "users" },
-      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" }
+      { id: "system", label: { en: "System", th: "\u0E23\u0E30\u0E1A\u0E1A" }, icon: "sliders-horizontal" },
+      { id: "integrations", label: { en: "Integrations", th: "\u0E01\u0E32\u0E23\u0E40\u0E0A\u0E37\u0E48\u0E2D\u0E21\u0E15\u0E48\u0E2D" }, icon: "link" }
     ]
   }
 ];
@@ -6016,6 +7167,12 @@ function verifyWebhook(body, headers, secret, options = {}) {
 }
 
 // src/webhooks.ts
+var SYSTEM_EVENTS = [
+  "scheduled.failed",
+  "delivery.failed",
+  "backup.failed",
+  "integration.failed"
+];
 var WEBHOOK_EVENTS = [
   "create",
   "update",
@@ -6027,7 +7184,7 @@ var WEBHOOK_EVENTS = [
 var RETRY_DELAYS = [1e3, 5e3];
 var QUEUE_DELAYS2 = [6e4, 5 * 6e4, 30 * 6e4, 2 * 36e5, 6 * 36e5, 12 * 36e5];
 var CLAIM2 = 5 * 6e4;
-var TIMEOUT = 1e4;
+var TIMEOUT2 = 1e4;
 var Webhooks = class {
   constructor(hooks, logger, queue, fetcher = (...args) => fetch(...args), retryDelays = RETRY_DELAYS) {
     this.hooks = hooks;
@@ -6195,7 +7352,7 @@ var Webhooks = class {
         method: "POST",
         headers,
         body,
-        signal: AbortSignal.timeout(TIMEOUT)
+        signal: AbortSignal.timeout(TIMEOUT2)
       });
       if (response.ok || response.status < 500 && response.status !== 429) {
         if (!response.ok)
@@ -6207,10 +7364,13 @@ var Webhooks = class {
       return { ok: false, error: error.message };
     }
   }
+  /** Told when a delivery is given up on (`delivery.failed`). */
+  onGiveUp;
   giveUp(hook, event, error, attempts) {
     this.logger.error(
       `Webhook ${hook.url} failed for ${event} after ${attempts} attempts: ${error}`
     );
+    this.onGiveUp?.({ url: hook.url, event, error, attempts });
   }
 };
 var later4 = (from, ms) => new Date(from.getTime() + ms).toISOString();
@@ -6299,6 +7459,9 @@ function validateConfig(config) {
   validateEndpoints(config, collectionSlugs, add);
   validateCommands(config, add);
   validateJobs(config, add);
+  validateIntegrations(config, add);
+  validateListeners(config, add);
+  validateAi(config, add);
   validateTimeZone(config, add);
   validateEvents(config, add);
   const apiKeys = config.apiKeys;
@@ -6826,7 +7989,7 @@ function validateWebhooks(config, add) {
     ...(config.collections ?? []).map((c) => c?.slug)
   ]);
   const globals = new Set((config.globals ?? []).map((g) => g?.slug));
-  const custom = new Set(config.events ?? []);
+  const custom = /* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS]);
   for (const [i, hook] of hooks.entries()) {
     const path = `webhooks[${i}]`;
     if (typeof hook?.url !== "string" || !/^https?:\/\/\S+$/.test(hook.url)) {
@@ -7916,6 +9079,111 @@ function validateAdapterVersions(config, add) {
       );
   }
 }
+function validateIntegrations(config, add) {
+  const list = config.integrations;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("integrations", "must be an array");
+    return;
+  }
+  const ids = /* @__PURE__ */ new Set();
+  for (const [i, raw] of list.entries()) {
+    const at = `integrations[${i}]`;
+    const item = raw ?? {};
+    if (typeof item.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(item.id))
+      add(`${at}.id`, 'must be lowercase letters, digits and "-"', "e.g. id: 'telegram'");
+    else if (ids.has(item.id)) add(`${at}.id`, `two integrations are named "${item.id}"`);
+    else ids.add(item.id);
+    if (!isLabel(item.label)) add(`${at}.label`, "must be a string or { en, th }");
+    if (!["social", "ai", "notifications", "automation"].includes(item.category))
+      add(`${at}.category`, "must be 'social', 'ai', 'notifications' or 'automation'");
+    if (item.kind === "fields") {
+      if (!Array.isArray(item.fields) || item.fields.length === 0)
+        add(`${at}.fields`, "needs at least one field to fill");
+    } else if (item.kind === "oauth") {
+      const oauth = item.oauth ?? {};
+      if (typeof oauth.authorizeUrl !== "function" || typeof oauth.exchange !== "function")
+        add(`${at}.oauth`, "needs authorizeUrl and exchange functions");
+    } else add(`${at}.kind`, "must be 'fields' or 'oauth'");
+    if (item.test !== void 0 && typeof item.test !== "function")
+      add(`${at}.test`, "must be a function");
+    if (item.icon !== void 0 && typeof item.icon !== "string") {
+      const logo = item.icon ?? {};
+      const hex = (v) => typeof v === "string" && /^#[0-9a-f]{6}$/i.test(v);
+      const paths = Array.isArray(logo.paths) ? logo.paths : [];
+      if (paths.length === 0 || paths.some((p) => {
+        const path = p ?? {};
+        return typeof path.d !== "string" || !/^[MmLlHhVvCcSsQqTtAaZzEe0-9.,\s+-]+$/.test(path.d) || path.fill !== void 0 && !hex(path.fill);
+      }))
+        add(
+          `${at}.icon`,
+          "must be an admin icon name, or { paths: [{ d, fill? }], color? } with SVG path data"
+        );
+      if (logo.color !== void 0 && !hex(logo.color)) add(`${at}.icon.color`, "must be #rrggbb");
+      if (logo.viewBox !== void 0 && !(typeof logo.viewBox === "string" && /^-?[\d.]+( -?[\d.]+){3}$/.test(logo.viewBox)))
+        add(`${at}.icon.viewBox`, "must be four numbers, e.g. '0 0 24 24'");
+    }
+    for (const [f, field] of (Array.isArray(item.fields) ? item.fields : []).entries()) {
+      const fieldItem = field ?? {};
+      if (fieldItem.lookup !== void 0 && typeof fieldItem.lookup !== "function")
+        add(`${at}.fields[${f}].lookup`, "must be a function");
+    }
+  }
+}
+function validateListeners(config, add) {
+  const list = config.listeners;
+  if (list === void 0) return;
+  if (!Array.isArray(list)) {
+    add("listeners", "must be an array");
+    return;
+  }
+  for (const [i, raw] of list.entries()) {
+    const item = raw ?? {};
+    const events = item.events;
+    if (events !== "*" && !(Array.isArray(events) && events.every((e) => typeof e === "string" && e.length > 0)))
+      add(`listeners[${i}].events`, "must be event names or '*'", "e.g. events: ['order.created']");
+    if (typeof item.handler !== "function") add(`listeners[${i}].handler`, "must be a function");
+  }
+}
+function validateAi(config, add) {
+  const ai = config.ai;
+  if (ai !== void 0) {
+    const providers = ai?.providers;
+    if (!Array.isArray(providers)) add("ai.providers", "must be an array");
+    else {
+      const ids = new Set((config.integrations ?? []).map((i) => i?.id));
+      for (const [i, raw] of providers.entries()) {
+        const provider = raw ?? {};
+        if (typeof provider.integration !== "string" || !ids.has(provider.integration))
+          add(`ai.providers[${i}].integration`, "must be the id of an integration");
+        if (typeof provider.generate !== "function")
+          add(`ai.providers[${i}].generate`, "must be a function");
+      }
+    }
+    const limits = ai?.limits;
+    const whole = (v) => Number.isInteger(v) && v >= 0;
+    if (limits?.perUserPerDay !== void 0 && !whole(limits.perUserPerDay))
+      add("ai.limits.perUserPerDay", "must be a whole number, 0 or more");
+    for (const [role, value] of Object.entries(limits?.roles ?? {}))
+      if (!whole(value)) add(`ai.limits.roles.${role}`, "must be a whole number, 0 or more");
+  }
+  const features = config.aiFeatures;
+  if (features === void 0) return;
+  if (!Array.isArray(features)) {
+    add("aiFeatures", "must be an array");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [i, raw] of features.entries()) {
+    const feature = raw ?? {};
+    if (typeof feature.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(feature.id))
+      add(`aiFeatures[${i}].id`, 'must be lowercase letters, digits and "-"', "e.g. id: 'alt-text'");
+    else if (seen.has(feature.id) || feature.id === "test")
+      add(`aiFeatures[${i}].id`, `"${feature.id}" is taken`);
+    else seen.add(feature.id);
+    if (!isLabel(feature.label)) add(`aiFeatures[${i}].label`, "must be a string or { en, th }");
+  }
+}
 
 // src/resolve-config.ts
 var DEFAULT_ADMIN_PATH = "/admin";
@@ -8026,14 +9294,19 @@ async function resolveConfig(input) {
       databaseBackupsCollection,
       bulkOperationsCollection,
       savedViewsCollection,
+      ...resolvedIntegrations(config).length > 0 ? [connectionsCollection] : [],
+      ...config.ai ? [aiUsageCollection] : [],
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
     ],
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
+    integrations: resolvedIntegrations(config),
+    aiFeatures: config.ai ? config.aiFeatures ?? [] : [],
     cliCommands: config.cliCommands ?? [],
-    events: config.events ?? [],
+    // Easy CMS's own events (#356), for webhooks and `cms.on`.
+    events: [.../* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS])],
     jobs: config.jobs ?? [],
     warnings,
     installedPlugins: (plugins ?? []).map(
@@ -8109,9 +9382,12 @@ function resolveAudit(audit) {
     scope: audit.scope ?? false
   };
 }
+function resolvedIntegrations(config) {
+  return config.integrations ?? [];
+}
 
 // src/rest/http-cache.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var cacheTags = {
   collection: (slug2) => ["ecms", `ecms:${slug2}`],
   document: (slug2, id) => ["ecms", `ecms:${slug2}`, `ecms:${slug2}:${id}`],
@@ -8138,7 +9414,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
   );
   headers.set("cache-tag", tags.join(","));
   headers.set("surrogate-key", tags.join(" "));
-  const etag = `W/"${createHash4("sha1").update(body).digest("base64url")}"`;
+  const etag = `W/"${createHash5("sha1").update(body).digest("base64url")}"`;
   headers.set("etag", etag);
   if (matches2(request.headers.get("if-none-match"), etag))
     return new Response(null, { status: 304, headers });
@@ -8146,7 +9422,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.31.0" : "0.0.0-dev";
+var VERSION = true ? "1.33.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -8423,6 +9699,10 @@ var EasyCMS = class {
   audit;
   /** Folders of the media library and their permissions (`upload.folders`). */
   folders;
+  /** Accounts connected to plugins' integrations (`integrations`, Settings → Integrations). */
+  integrations;
+  /** AI for the admin's features (#357): `null` without an AI plugin (`ai` in the config). */
+  ai;
   versions;
   webhooks;
   mailer;
@@ -8450,6 +9730,13 @@ var EasyCMS = class {
       (entry) => this.audit.record(entry)
     );
     this.audit = new AuditLog(this);
+    this.integrations = new Integrations(this);
+    this.ai = config.ai ? new Ai(this, config.ai) : null;
+    for (const listener of config.listeners ?? []) {
+      const run = (message2) => listener.handler(message2, { cms: this });
+      if (listener.events === "*") this.anyListeners.add(run);
+      else for (const event of listener.events) this.on(event, run);
+    }
     this.folders = new MediaFolders(config, db, this.roles);
     this.webhooks = new Webhooks(
       config.webhooks ?? [],
@@ -8461,6 +9748,8 @@ var EasyCMS = class {
       logger,
       config.collections.some((c) => c.slug === EMAIL_DELIVERIES) ? this.emailQueue() : void 0
     );
+    this.webhooks.onGiveUp = ({ url, event, error, attempts }) => this.systemEvent("delivery.failed", { kind: "webhook", url, event, error, attempts });
+    this.mailer.onGiveUp = ({ to, error, attempts }) => this.systemEvent("delivery.failed", { kind: "email", to, error, attempts });
     this.outbox = config.collections.some((c) => c.slug === OUTBOX) ? new Outbox(
       db,
       logger,
@@ -8653,7 +9942,7 @@ var EasyCMS = class {
         }
       ]);
     }
-    const random2 = randomBytes6(4).toString("hex");
+    const random2 = randomBytes7(4).toString("hex");
     const isPrivate = await this.folders.isPrivate(folderOf(MEDIA, data));
     const storage = this.storageFor(isPrivate);
     const filename = withPrivacy(storageKey(file.name, mimeType, random2), isPrivate);
@@ -8721,7 +10010,7 @@ var EasyCMS = class {
       ]);
     const isPrivate = await this.folders.isPrivate(folder);
     const storage = this.storageFor(isPrivate);
-    const key = withPrivacy(storageKey(name, type, randomBytes6(4).toString("hex")), isPrivate);
+    const key = withPrivacy(storageKey(name, type, randomBytes7(4).toString("hex")), isPrivate);
     const upload = storage.uploadURL ? await storage.uploadURL(key, { contentType: type, size, expiresIn: UPLOAD_URL_SECONDS }) : null;
     const ticket = this.sign("upload", {
       key,
@@ -9970,6 +11259,7 @@ var EasyCMS = class {
         (error) => this.logger.error(`Backups: ${error.message}`, { error })
       );
       await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`, { error }));
+      await this.ai?.upkeep(now).catch((error) => this.logger.error(`AI usage: ${error.message}`, { error }));
       await this.rateLimiter?.clear(now).catch((error) => this.logger.error(`Rate limits: ${error.message}`, { error }));
       const result = {
         scheduled,
@@ -10125,6 +11415,37 @@ var EasyCMS = class {
     if (!this.config.events.includes(event))
       throw new QueryError(`Unknown event "${event}": add it to \`events\` in the config`);
     this.webhooks.emit(event, about ?? {}, data);
+    this.dispatch(event, data, about);
+  }
+  listeners = /* @__PURE__ */ new Map();
+  /** Listeners of every event (`events: '*'` in the config's `listeners`). */
+  anyListeners = /* @__PURE__ */ new Set();
+  /**
+   * Runs `handler` after each `event` on this server (#356): the config's and plugins' events, the
+   * content changes webhooks get (`create`, `publish`…), and Easy CMS's own (`scheduled.failed`,
+   * `delivery.failed`, `backup.failed`, `integration.failed`). It runs after the change, without
+   * being waited for; its errors are logged. Returns a function that stops it.
+   */
+  on(event, handler) {
+    const set = this.listeners.get(event) ?? /* @__PURE__ */ new Set();
+    set.add(handler);
+    this.listeners.set(event, set);
+    return () => set.delete(handler);
+  }
+  dispatch(event, data, about) {
+    const set = [...this.listeners.get(event) ?? [], ...this.anyListeners];
+    if (set.length === 0) return;
+    for (const handler of set)
+      queueMicrotask(() => {
+        Promise.resolve().then(() => handler({ event, data, ...about ? { about } : {} })).catch(
+          (error) => this.logger.error(`A listener of ${event} failed: ${errorText(error)}`, { error })
+        );
+      });
+  }
+  /** @internal Easy CMS's own events (`SYSTEM_EVENTS`): to webhooks that list them and `cms.on`. */
+  systemEvent(event, data) {
+    this.webhooks.emit(event, {}, data);
+    this.dispatch(event, data);
   }
   /**
    * Tries webhook deliveries that are due for another attempt. Deliveries are kept in the
@@ -10283,6 +11604,13 @@ var EasyCMS = class {
             updatedAt: (/* @__PURE__ */ new Date()).toISOString()
           }
         });
+        this.systemEvent("scheduled.failed", {
+          job: row.id,
+          action,
+          ...row.collection ? { collection: row.collection } : { global: row.global },
+          doc: row.doc ?? null,
+          error: message2
+        });
       }
     }
     return { ran, failed };
@@ -10911,8 +12239,10 @@ var EasyCMS = class {
    * are logged.
    */
   emitChange(config, event, doc, before) {
-    for (const change of this.changeEvents(config, event, doc, before))
+    for (const change of this.changeEvents(config, event, doc, before)) {
       this.webhooks.emit(change.event, change.target, change.body);
+      this.dispatch(change.event, change.body, change.target);
+    }
     if (this.searches(config, event)) this.searchIndex?.syncLater(config.slug, doc.id);
     const purge = this.config.httpCache?.purge;
     const tags = this.purgeTags(config, event, doc, before);
@@ -10962,8 +12292,10 @@ var EasyCMS = class {
     }
     if (!done.has("webhooks")) {
       const changes = this.changeEvents(config, event, doc, entry.before);
-      for (const change of changes)
+      for (const change of changes) {
         await this.webhooks.emitSaved(change.event, change.target, change.body);
+        this.dispatch(change.event, change.body, change.target);
+      }
       if (changes.length > 0 && (this.config.webhooks?.length ?? 0) > 0) await mark("webhooks");
     }
     if (!done.has("search") && this.searchIndex && this.searches(config, event)) {
@@ -11259,51 +12591,51 @@ var EasyCMS = class {
     const cms = this;
     const { user, context } = guard;
     const allowed2 = /* @__PURE__ */ new Map();
-    for (const ref of references2) {
-      const filter = ref.filterOptions;
+    for (const ref2 of references2) {
+      const filter = ref2.filterOptions;
       if (!filter) continue;
       const byCollection = allowed2.get(filter) ?? /* @__PURE__ */ new Map();
       allowed2.set(filter, byCollection);
-      if (!byCollection.has(ref.collection))
+      if (!byCollection.has(ref2.collection))
         byCollection.set(
-          ref.collection,
-          await filter({ id: selfId, relationTo: ref.collection, user, cms, context })
+          ref2.collection,
+          await filter({ id: selfId, relationTo: ref2.collection, user, cms, context })
         );
-      const where = byCollection.get(ref.collection);
+      const where = byCollection.get(ref2.collection);
       if (where === true) continue;
-      const target = this.config.collections.find((c) => c.slug === ref.collection);
+      const target = this.config.collections.find((c) => c.slug === ref2.collection);
       const localization = this.config.localization;
       const scoped = target ? this.whereFor(target, where, localization ? { locale: localization.defaultLocale } : {}) : where;
       const count = await this.db.count({
-        collection: ref.collection,
-        where: { and: [{ id: { equals: ref.id } }, ...scoped ? [scoped] : []] }
+        collection: ref2.collection,
+        where: { and: [{ id: { equals: ref2.id } }, ...scoped ? [scoped] : []] }
       });
       if (count === 0)
-        errors.push({ field: ref.field, message: "is not one of the allowed choices" });
+        errors.push({ field: ref2.field, message: "is not one of the allowed choices" });
     }
     return errors;
   }
   async checkReferences(references2, guard) {
     const byCollection = /* @__PURE__ */ new Map();
     const errors = [];
-    for (const ref of references2) {
-      const target = this.config.collections.find((c) => c.slug === ref.collection);
-      if (ref.link && (!target || INTERNAL_COLLECTIONS.has(ref.collection))) {
+    for (const ref2 of references2) {
+      const target = this.config.collections.find((c) => c.slug === ref2.collection);
+      if (ref2.link && (!target || INTERNAL_COLLECTIONS.has(ref2.collection))) {
         errors.push({
-          field: ref.field,
-          message: `links to "${ref.collection}", which is not a collection`
+          field: ref2.field,
+          message: `links to "${ref2.collection}", which is not a collection`
         });
         continue;
       }
-      if (ref.link && typeof target?.preview !== "function") {
+      if (ref2.link && typeof target?.preview !== "function") {
         errors.push({
-          field: ref.field,
-          message: `links to "${ref.collection}", whose documents have no URL (set its preview)`
+          field: ref2.field,
+          message: `links to "${ref2.collection}", whose documents have no URL (set its preview)`
         });
         continue;
       }
       if (!target) continue;
-      byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
+      byCollection.set(ref2.collection, [...byCollection.get(ref2.collection) ?? [], ref2]);
     }
     for (const [collection2, refs] of byCollection) {
       const found = await this.db.findByIds({
@@ -11311,28 +12643,28 @@ var EasyCMS = class {
         ids: [...new Set(refs.map((r) => r.id))]
       });
       const byId = new Map(found.map((d) => [d.id, d]));
-      for (const ref of refs) {
-        const doc = byId.get(ref.id);
+      for (const ref2 of refs) {
+        const doc = byId.get(ref2.id);
         if (!doc) {
-          errors.push({ field: ref.field, message: `${collection2} ${ref.id} does not exist` });
+          errors.push({ field: ref2.field, message: `${collection2} ${ref2.id} does not exist` });
           continue;
         }
         const type = typeof doc.mimeType === "string" ? doc.mimeType : "";
-        if (ref.mimeTypes && !mimeAllowedBy(type, ref.mimeTypes)) {
-          const images = ref.mimeTypes.every((t) => t.toLowerCase() === "image/*");
+        if (ref2.mimeTypes && !mimeAllowedBy(type, ref2.mimeTypes)) {
+          const images = ref2.mimeTypes.every((t) => t.toLowerCase() === "image/*");
           errors.push({
-            field: ref.field,
-            message: images ? `must be an image (${doc.filename ?? ref.id} is ${type || "not one"})` : `must be ${ref.mimeTypes.join(", ")} (${doc.filename ?? ref.id} is ${type || "unknown"})`
+            field: ref2.field,
+            message: images ? `must be an image (${doc.filename ?? ref2.id} is ${type || "not one"})` : `must be ${ref2.mimeTypes.join(", ")} (${doc.filename ?? ref2.id} is ${type || "unknown"})`
           });
         }
-        if (ref.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
-          ref.folderOnly,
+        if (ref2.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
+          ref2.folderOnly,
           doc.folder ?? null,
           await this.folderScope(guard)
         ))
           errors.push({
-            field: ref.field,
-            message: `must be a file from the "${ref.folderOnly}" folder (${doc.filename ?? ref.id} is not)`
+            field: ref2.field,
+            message: `must be a file from the "${ref2.folderOnly}" folder (${doc.filename ?? ref2.id} is not)`
           });
       }
     }
@@ -11454,7 +12786,7 @@ function durationSeconds(value) {
 }
 function cursorQuery(collection2, where, sort, locale, draft) {
   const key = JSON.stringify([collection2, where ?? null, sort, locale ?? null, draft]);
-  return createHash5("sha256").update(key).digest("base64url").slice(0, 16);
+  return createHash6("sha256").update(key).digest("base64url").slice(0, 16);
 }
 function writeCursor(keys2, query) {
   return Buffer.from(JSON.stringify({ k: keys2, q: query })).toString("base64url");
@@ -11764,7 +13096,8 @@ var Roles = class {
   async canView(user, id) {
     if (isSystemAdmin(user)) return true;
     if (user.apiKey) return false;
-    if ((id === "deliveries" || id === "jobs") && user.scoped === true) return false;
+    if ((id === "deliveries" || id === "jobs" || id === "integrations") && user.scoped === true)
+      return false;
     if (id === "audit" && user.role === "admin" && user.scoped === true && this.config.audit !== false && typeof this.config.audit.scope === "function")
       return true;
     if (!this.enabled)
@@ -11953,7 +13286,8 @@ var Roles = class {
         new: !seen("globals", g.slug),
         fields: adminFields(g.fields, void 0)
       })),
-      views: this.views()
+      views: this.views(),
+      ai: Boolean(this.config.ai)
     };
   }
   async create(input, author) {
@@ -12052,6 +13386,7 @@ var Roles = class {
         (c) => c.slug === WEBHOOK_DELIVERIES || c.slug === EMAIL_DELIVERIES
       ) ? [{ id: "deliveries" }] : [],
       ...hasJobsPage(this.config) ? [{ id: "jobs" }] : [],
+      ...this.config.integrations.length > 0 ? [{ id: "integrations" }] : [],
       ...hasCalendarPage(this.config) ? [{ id: "calendar" }] : [],
       ...this.config.admin.pages.map((page) => ({ id: viewId.page(page.path), label: page.label })),
       ...this.config.admin.dashboard.map((widget) => ({
@@ -12131,7 +13466,8 @@ var Roles = class {
         void 0
       )
     };
-    return { ...picked, admin, own, fields };
+    const aiPerDay = this.config.ai && Number.isInteger(input.aiPerDay) && input.aiPerDay >= 0 ? { aiPerDay: input.aiPerDay } : {};
+    return { ...picked, admin, own, fields, ...aiPerDay };
   }
   /**
    * Keeps rules for known top-level fields. A field that must be filled in (required, without a
@@ -12180,6 +13516,11 @@ var Roles = class {
       ]);
     return value.trim();
   }
+  /** The role's daily AI limit set in Settings → Roles, if any (`auth.rbac`). */
+  async aiLimit(key) {
+    if (!this.enabled) return void 0;
+    return (await this.permissionsOf(key)).aiPerDay;
+  }
   async permissionsOf(key) {
     return (await this.load()).get(key) ?? {};
   }
@@ -12254,7 +13595,7 @@ function rank(role, config) {
 }
 
 // src/rest/admin-modules.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { readFile as readFile3 } from "fs/promises";
 import { createRequire } from "module";
 import { join as join3 } from "path";
@@ -12295,7 +13636,7 @@ async function readAdminModule(cms, index) {
   if (!file) return void 0;
   const body = await readFile3(file, "utf8").catch(() => void 0);
   if (body === void 0) return void 0;
-  return { body, etag: `"${createHash6("sha1").update(body).digest("base64url")}"` };
+  return { body, etag: `"${createHash7("sha1").update(body).digest("base64url")}"` };
 }
 
 // src/rest/handler.ts
@@ -12750,7 +14091,8 @@ async function adminSchema(cms, user, origin, context = {}) {
     roles: admin && cms.roles.enabled,
     sso: admin && cms.auth.sso.enabled,
     audit: cms.audit.enabled && await cms.roles.canView(user, "audit"),
-    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar")
+    calendar: hasCalendarPage(cms.config) && await cms.roles.canView(user, "calendar"),
+    integrations: cms.config.integrations.length > 0 && await cms.roles.canView(user, "integrations")
   };
   const roles = await cms.roles.options();
   const adminCollections = await Promise.all(
@@ -12835,10 +14177,10 @@ function folderIds(cms, user, context) {
   return cms.folders.enabled ? (key) => cms.keyedFolder(key, { user, context }) : void 0;
 }
 function panelRef(panel) {
-  const ref = componentRef(panel);
+  const ref2 = componentRef(panel);
   if (typeof panel === "object" && "position" in panel && panel.position === "top")
-    ref.position = "top";
-  return ref;
+    ref2.position = "top";
+  return ref2;
 }
 function layoutOf(layout, fields) {
   const shown2 = new Set(fields.filter((f) => f.position !== "sidebar").map((f) => f.name));
@@ -12890,7 +14232,8 @@ var VIEW_GROUPS = [
   ["email", "settings.system"],
   ["deliveries", "settings.system"],
   ["jobs", "settings.system"],
-  ["audit", "settings.system"]
+  ["audit", "settings.system"],
+  ["integrations", "settings.integrations"]
 ];
 function buildNav(cms, collections, globals, pageRefs, views) {
   const groups = navGroups(cms.config.admin.nav);
@@ -13123,6 +14466,15 @@ async function adminStatus(cms) {
   if (failed.length > 0) attention.push({ id: "jobs", count: failed.length, names: failed });
   const paused = await pausedJobs(cms);
   if (paused.length > 0) attention.push({ id: "jobs-paused", count: paused.length, names: paused });
+  if (config.integrations.length > 0) {
+    const broken = await cms.integrations.broken();
+    if (broken.length > 0)
+      attention.push({
+        id: "integrations",
+        count: broken.length,
+        names: broken.map((b) => `${b.integration}: ${b.name}`)
+      });
+  }
   const backups = await backupAttention(cms);
   if (backups) attention.push(backups);
   attention.push(...await cms.audit.attention());
@@ -14294,6 +15646,106 @@ async function route(cms, ctx, method, path, options) {
     }
     throw methodNotAllowed(ctx, "PATCH, DELETE");
   }
+  if (first === "admin" && second === "ai" && segments.length === 2) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!cms.ai) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "integrations")) throw new ForbiddenError();
+    if (method === "GET") return { body: await cms.ai.overview() };
+    if (method === "PUT")
+      return { body: await cms.ai.update(await readJson(ctx.request), ctx.user) };
+    throw methodNotAllowed(ctx, "GET, PUT");
+  }
+  if (first === "admin" && second === "integrations") {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (cms.config.integrations.length === 0) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "integrations")) throw new ForbiddenError();
+    const user = ctx.user;
+    const [, , id2, part, cid, action, extra] = segments;
+    const integrations = cms.integrations;
+    if (id2 === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      return { body: await integrations.overview() };
+    }
+    const callbackUrl = `${cms.config.serverURL ?? ctx.url.origin}${cms.config.routes.api}/admin/integrations/${id2}/callback`;
+    if (part === void 0) {
+      if (method !== "PUT") throw methodNotAllowed(ctx, "PUT");
+      const body = await readJson(ctx.request);
+      return { body: await integrations.setEnabled(id2, body.enabled !== false, user) };
+    }
+    if (part === "authorize" && cid === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      const body = await readJson(ctx.request);
+      return {
+        body: await integrations.authorize(id2, user, callbackUrl, String(body.name ?? ""))
+      };
+    }
+    if (part === "callback" && cid === void 0) {
+      if (method !== "GET") throw methodNotAllowed(ctx, "GET");
+      const page = new URL(`${cms.config.admin.path}/integrations`, ctx.url.origin);
+      page.searchParams.set("integration", id2);
+      try {
+        const error = ctx.url.searchParams.get("error_description") ?? ctx.url.searchParams.get("error");
+        if (error) throw new Error(error);
+        const result = await integrations.callback(
+          id2,
+          ctx.url.searchParams.get("code") ?? "",
+          ctx.url.searchParams.get("state") ?? "",
+          callbackUrl,
+          user
+        );
+        if ("pending" in result) page.searchParams.set("pending", String(result.pending));
+        else page.searchParams.set("connected", "1");
+      } catch (error) {
+        page.searchParams.set("error", error.message.slice(0, 300));
+      }
+      return { body: new Response(null, { status: 302, headers: { location: page.toString() } }) };
+    }
+    if (part === "consent" && cid === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await integrations.consent(id2, user) };
+    }
+    if (part === "lookup" && cid !== void 0 && action === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await integrations.lookup(id2, cid, await readJson(ctx.request)) };
+    }
+    if (part === "pending" && cid !== void 0 && action === void 0) {
+      const pid = parseId(cid);
+      if (pid === void 0) throw new HttpError("Not found", 404);
+      if (method === "GET") return { body: await integrations.pending(id2, pid, user) };
+      if (method === "POST") {
+        const body = await readJson(ctx.request);
+        return {
+          status: 201,
+          body: await integrations.choose(id2, pid, String(body.account ?? ""), user)
+        };
+      }
+      throw methodNotAllowed(ctx, "GET, POST");
+    }
+    if (part === "connections" && extra === void 0) {
+      if (cid === void 0) {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        return {
+          status: 201,
+          body: await integrations.connect(id2, await readJson(ctx.request), user)
+        };
+      }
+      if (action === "test") {
+        if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+        const target = cid === "env" ? "env" : parseId(cid);
+        if (target === void 0) throw new HttpError("Not found", 404);
+        return { body: await integrations.test(id2, target) };
+      }
+      const connection = parseId(cid);
+      if (connection === void 0 || action !== void 0) throw new HttpError("Not found", 404);
+      if (method === "PATCH")
+        return {
+          body: await integrations.update(id2, connection, await readJson(ctx.request), user)
+        };
+      if (method === "DELETE") return { body: await integrations.disconnect(id2, connection, user) };
+      throw methodNotAllowed(ctx, "PATCH, DELETE");
+    }
+    throw new HttpError("Not found", 404);
+  }
   if (first === "admin" && second === "deliveries") {
     if (!ctx.user) throw new UnauthorizedError();
     if (!await cms.roles.canView(ctx.user, "deliveries")) throw new ForbiddenError();
@@ -15313,10 +16765,11 @@ export {
   isStaff,
   isSignedIn,
   isAdmin,
-  secretsOf,
   MEDIA,
   MEDIA_FOLDERS,
   INTERNAL_COLLECTIONS,
+  AiProviderError,
+  secretsOf,
   AuditLog,
   API_KEYS,
   API_KEY_OPERATIONS,