@easy-cms/core 1.32.0 → 1.33.0

package/dist/{chunk-J4NASOMO.js → chunk-KUEGUD2X.js}

@@ -50,100 +50,6 @@ var isStaff = ({ user }) => user !== null && user.member !== true;
 var isSignedIn = ({ user }) => user !== null;
 var isAdmin = ({ user }) => user?.role === "admin" && user.scoped !== true;
 
-// src/auth/tokens.ts
-import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
-function newToken() {
-  return randomBytes(32).toString("base64url");
-}
-function hashToken(token) {
-  return createHash("sha256").update(token).digest("hex");
-}
-function hmac(secret, value) {
-  return createHmac("sha256", secret).update(value).digest("base64url");
-}
-var signValue = (secret, value) => hmac(secret, value);
-function secretsOf(config) {
-  return [config.secret, ...config.previousSecrets ?? []];
-}
-function signedWith(secrets, value, signature) {
-  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
-}
-function signToken(secret, token) {
-  return `${token}.${hmac(secret, `session:${token}`)}`;
-}
-function unsignToken(secrets, value) {
-  const dot = value.lastIndexOf(".");
-  if (dot <= 0) return void 0;
-  const token = value.slice(0, dot);
-  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
-}
-function csrfToken(secret, token) {
-  return hmac(secret, `csrf:${token}`);
-}
-function csrfMatches(secrets, token, given) {
-  return signedWith(secrets, `csrf:${token}`, given);
-}
-function safeEqual(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  return left.length === right.length && timingSafeEqual(left, right);
-}
-function signPreviewToken(secret, target, expiresAt, user) {
-  const payload = Buffer.from(
-    JSON.stringify({
-      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
-      e: expiresAt,
-      ...user !== void 0 ? { u: user } : {}
-    })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
-}
-function verifyPreviewToken(secrets, token, now = Date.now()) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.e !== "number" || data.e <= now) return null;
-    const user = typeof data.u === "string" ? { user: data.u } : {};
-    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
-    if (typeof data.c === "string" && typeof data.i === "string")
-      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
-    return null;
-  } catch {
-    return null;
-  }
-}
-function passwordFingerprint(passwordHash) {
-  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
-}
-function signPasswordToken(secret, args) {
-  const payload = Buffer.from(
-    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
-  ).toString("base64url");
-  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
-}
-function readPasswordToken(token) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const payload = token.slice(0, dot);
-  try {
-    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
-    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
-    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
-  } catch {
-    return null;
-  }
-}
-function passwordTokenMatches(secrets, token, fingerprint) {
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return false;
-  const payload = token.slice(0, dot);
-  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
-}
-
 // src/builtins.ts
 var USERS = "users";
 var MEDIA = "media";
@@ -164,6 +70,7 @@ var RATE_LIMITS = "rate-limits";
 var BULK_OPERATIONS = "bulk-operations";
 var SAVED_VIEWS = "saved-views";
 var CONNECTIONS = "connections";
+var AI_USAGE = "ai-usage";
 var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   SESSIONS,
   LOGIN_ATTEMPTS,
@@ -180,7 +87,8 @@ var INTERNAL_COLLECTIONS = /* @__PURE__ */ new Set([
   RATE_LIMITS,
   BULK_OPERATIONS,
   SAVED_VIEWS,
-  CONNECTIONS
+  CONNECTIONS,
+  AI_USAGE
 ]);
 var DEFAULT_ROLES = ["admin", "editor"];
 var CREATED_BY_FIELD = {
@@ -602,6 +510,22 @@ var connectionsCollection = {
     { name: "enabled", type: "boolean" }
   ]
 };
+var aiUsageCollection = {
+  slug: AI_USAGE,
+  access: { read: nobody, create: nobody, update: nobody, delete: nobody },
+  fields: [
+    { name: "user", type: "text", index: true },
+    { name: "feature", type: "text", required: true },
+    { name: "integration", type: "text", required: true },
+    { name: "connection", type: "text" },
+    { name: "input", type: "number" },
+    { name: "output", type: "number" },
+    { name: "ok", type: "boolean" },
+    { name: "error", type: "text" },
+    // The document it was for, e.g. the image of alt text.
+    { name: "about", type: "text" }
+  ]
+};
 var webhookDeliveriesCollection = {
   slug: WEBHOOK_DELIVERIES,
   access: { read: nobody, create: nobody, update: nobody, delete: nobody },
@@ -741,6 +665,602 @@ var emailDeliveriesCollection = {
   ]
 };
 
+// src/time-of-day.ts
+var DAY = 864e5;
+function isTimeZone(zone) {
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: zone });
+    return true;
+  } catch {
+    return false;
+  }
+}
+var formatters = /* @__PURE__ */ new Map();
+function wallClock(instant, zone) {
+  let format = formatters.get(zone);
+  if (!format) {
+    format = new Intl.DateTimeFormat("en-US", {
+      timeZone: zone,
+      hourCycle: "h23",
+      year: "numeric",
+      month: "numeric",
+      day: "numeric",
+      hour: "numeric",
+      minute: "numeric",
+      second: "numeric"
+    });
+    formatters.set(zone, format);
+  }
+  const parts = {};
+  for (const part of format.formatToParts(instant))
+    if (part.type !== "literal") parts[part.type] = Number(part.value);
+  return Date.UTC(
+    parts.year,
+    parts.month - 1,
+    parts.day,
+    parts.hour,
+    parts.minute,
+    parts.second
+  );
+}
+function instantOf(wall, zone) {
+  let instant = wall - (wallClock(wall, zone) - wall);
+  instant = wall - (wallClock(instant, zone) - instant);
+  return instant;
+}
+var parse = (at) => at.split(":").map(Number);
+function lastSlot(now, at, zone) {
+  const [hours2, minutes] = parse(at);
+  if (!zone) {
+    const slot2 = new Date(now);
+    slot2.setHours(hours2, minutes, 0, 0);
+    if (slot2.getTime() > now.getTime()) slot2.setDate(slot2.getDate() - 1);
+    return slot2;
+  }
+  const today = wallClock(now.getTime(), zone);
+  const midnight = today - today % DAY;
+  let slot = instantOf(midnight + hours2 * 36e5 + minutes * 6e4, zone);
+  if (slot > now.getTime())
+    slot = instantOf(midnight - DAY + hours2 * 36e5 + minutes * 6e4, zone);
+  return new Date(slot);
+}
+function nextSlot(after, at, zone) {
+  const last = lastSlot(after, at, zone);
+  return lastSlot(new Date(last.getTime() + DAY + 2 * 36e5), at, zone);
+}
+function dueAt(now, at, every, lastRun, zone) {
+  if (lastRun === void 0) return true;
+  const last = Date.parse(lastRun);
+  if (Number.isNaN(last)) return true;
+  const slot = lastSlot(now, at, zone).getTime();
+  return last < slot - (every * 1e3 - DAY);
+}
+function nextAt(at, every, lastRun, zone) {
+  return nextSlot(new Date(Date.parse(lastRun) + (every * 1e3 - DAY)), at, zone);
+}
+
+// src/ai.ts
+var AiProviderError = class extends Error {
+  status;
+  constructor(message2, status) {
+    super(message2);
+    this.name = "AiProviderError";
+    this.status = status;
+  }
+};
+var SETTINGS = "ai";
+var DEFAULT_LIMIT = 100;
+var TIMEOUT = 6e4;
+var MAX_IMAGE = 4 * 1024 * 1024;
+var KEEP = 90 * 24 * 36e5;
+var IMAGE_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/webp", "image/gif"]);
+var AI_TEST_FEATURE = "test";
+var ref = (integration, name) => `${integration}:${name}`;
+var Ai = class {
+  constructor(cms, ai) {
+    this.cms = cms;
+    this.ai = ai;
+  }
+  cms;
+  ai;
+  get config() {
+    return this.cms.config;
+  }
+  get defaultLimit() {
+    return this.ai.limits?.perUserPerDay ?? DEFAULT_LIMIT;
+  }
+  /** The features of the config. */
+  get features() {
+    return this.config.aiFeatures;
+  }
+  async settingsRow() {
+    const found = await this.cms.db.find({
+      collection: CONNECTIONS,
+      where: { and: [{ kind: { equals: "settings" } }, { integration: { equals: SETTINGS } }] },
+      sort: ["id"],
+      limit: 1,
+      page: 1
+    });
+    return found.docs[0];
+  }
+  async settings() {
+    return (await this.settingsRow())?.values ?? {};
+  }
+  /** Every connection of every provider, in the providers' order. */
+  async connections() {
+    const out = [];
+    for (const provider of this.ai.providers)
+      for (const conn of await this.cms.integrations.all(provider.integration))
+        out.push({ ...conn, integration: provider.integration });
+    return out;
+  }
+  /** Whether a feature is on: admins' choice, else its `default`. */
+  async enabled(feature) {
+    const def = this.features.find((f) => f.id === feature);
+    if (!def) return false;
+    return (await this.settings()).features?.[feature]?.enabled ?? def.default ?? true;
+  }
+  /** Requests a user may make today: their role's, else everyone's. */
+  async limitFor(user) {
+    const role = typeof user.role === "string" ? user.role : void 0;
+    if (role) {
+      const fromRoles = await this.cms.roles.aiLimit(role);
+      if (fromRoles !== void 0) return fromRoles;
+      const fromConfig = this.ai.limits?.roles?.[role];
+      if (fromConfig !== void 0) return fromConfig;
+    }
+    return (await this.settings()).perUserPerDay ?? this.defaultLimit;
+  }
+  /** Requests the user made today (in `timeZone`) and how many are left. */
+  async remaining(user, now = /* @__PURE__ */ new Date()) {
+    const since = lastSlot(now, "00:00", this.config.timeZone).toISOString();
+    const used = await this.cms.db.count({
+      collection: AI_USAGE,
+      where: {
+        and: [
+          { user: { equals: String(user.id) } },
+          { ok: { equals: true } },
+          { createdAt: { gte: since } }
+        ]
+      }
+    });
+    return { used, limit: await this.limitFor(user) };
+  }
+  /**
+   * Asks the feature's connection (or the main one). With `user`, the request counts toward their
+   * daily limit; it is refused once they reach it. Usage is recorded, never the prompt.
+   */
+  async generate(request, options = {}) {
+    const feature = this.features.find((f) => f.id === request.feature);
+    if (!feature)
+      throw new QueryError(
+        `Unknown AI feature "${request.feature}": add it to \`aiFeatures\` in the config`
+      );
+    if (!await this.enabled(feature.id))
+      throw new QueryError(`The AI feature "${feature.id}" is turned off`);
+    const user = options.user ?? null;
+    if (user) {
+      const { used, limit } = await this.remaining(user);
+      if (used >= limit)
+        throw new TooManyRequestsError(
+          limit === 0 ? "Your role may not use AI" : `You used AI ${limit} times today, the most allowed`
+        );
+    }
+    const conn = await this.connectionFor(feature.id);
+    const images = await Promise.all((request.images ?? []).map((i) => this.image(i)));
+    return this.ask(conn, {
+      feature: feature.id,
+      user,
+      about: options.about,
+      request: {
+        ...request.system ? { system: request.system } : {},
+        prompt: request.prompt,
+        images,
+        ...request.json ? { json: request.json } : {},
+        maxTokens: request.maxTokens ?? 1024
+      }
+    });
+  }
+  /**
+   * The Test button of a provider's connection: a short prompt; its tokens count on the card,
+   * not toward anyone's limit.
+   */
+  async test(integration, values, name) {
+    try {
+      await this.ask(
+        { integration, name: name ?? "", values, env: false },
+        {
+          feature: AI_TEST_FEATURE,
+          user: null,
+          markConnection: false,
+          request: { prompt: "Reply with the word OK.", images: [], maxTokens: 16 }
+        }
+      );
+      return { ok: true, ...values.model ? { account: values.model } : {} };
+    } catch (error) {
+      return { ok: false, message: error.message };
+    }
+  }
+  async connectionFor(feature) {
+    const settings = await this.settings();
+    const wanted = settings.features?.[feature]?.connection ?? settings.main;
+    const all = await this.connections();
+    const conn = wanted && all.find((c) => ref(c.integration, c.name) === wanted) || all[0];
+    if (!conn)
+      throw new QueryError("No AI provider is connected: connect one in Settings \u2192 Integrations");
+    return conn;
+  }
+  async ask(conn, args) {
+    const provider = this.ai.providers.find((p) => p.integration === conn.integration);
+    if (!provider) throw new QueryError(`No AI provider answers for "${conn.integration}"`);
+    const record = (data) => this.cms.db.create({
+      collection: AI_USAGE,
+      data: {
+        user: args.user ? String(args.user.id) : null,
+        feature: args.feature,
+        integration: conn.integration,
+        connection: conn.name || null,
+        input: 0,
+        output: 0,
+        error: null,
+        about: args.about ? `${args.about.collection}:${args.about.id}` : null,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        ...data
+      }
+    });
+    let result;
+    try {
+      result = await this.call(provider, conn.values, args.request);
+    } catch (error) {
+      const status = error instanceof AiProviderError ? error.status : void 0;
+      const message2 = error.message;
+      await record({ ok: false, error: message2.slice(0, 500) });
+      if ((status === 401 || status === 403) && args.markConnection !== false && conn.name)
+        await this.cms.integrations.markError(conn.integration, message2, conn.name);
+      throw new QueryError(message2);
+    }
+    await record({ ok: true, input: result.usage.input, output: result.usage.output });
+    if (args.markConnection !== false && conn.name)
+      await this.cms.integrations.markUsed(conn.integration, conn.name);
+    let json2;
+    if (args.request.json) {
+      try {
+        json2 = JSON.parse(stripFence(result.text));
+      } catch {
+        throw new QueryError("The AI answered with something other than JSON; try again");
+      }
+    }
+    return {
+      text: result.text,
+      ...args.request.json ? { json: json2 } : {},
+      usage: result.usage,
+      connection: ref(conn.integration, conn.name)
+    };
+  }
+  /** One try, and another after a second when the provider is busy or failing (429, 5xx). */
+  async call(provider, values, request) {
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return await provider.generate(values, { ...request, signal: AbortSignal.timeout(TIMEOUT) });
+      } catch (error) {
+        const status = error instanceof AiProviderError ? error.status : void 0;
+        const busy = status === 429 || status !== void 0 && status >= 500;
+        if (!busy || attempt > 0) {
+          if (error.name === "TimeoutError")
+            throw new AiProviderError("The AI provider took longer than 60 seconds");
+          throw error;
+        }
+        await new Promise((resolve3) => setTimeout(resolve3, 1e3));
+      }
+    }
+  }
+  /** An image as base64: given, or read from a media document. */
+  async image(image) {
+    if (image.data !== void 0) {
+      if (!image.mediaType || !IMAGE_TYPES.has(image.mediaType))
+        throw new ValidationError(AI_USAGE, [
+          { field: "images", message: "must be JPEG, PNG, WebP or GIF" }
+        ]);
+      return { data: image.data, mediaType: image.mediaType };
+    }
+    if (image.media === void 0)
+      throw new ValidationError(AI_USAGE, [{ field: "images", message: "needs media or data" }]);
+    const doc = await this.cms.db.findById({ collection: MEDIA, id: image.media });
+    if (!doc) throw new ValidationError(AI_USAGE, [{ field: "images", message: "media not found" }]);
+    const sizes = Object.values(doc.sizes ?? {}).filter((s) => typeof s?.filename === "string" && Number(s.width) >= 1024).sort((a, b) => Number(a.width) - Number(b.width));
+    const filename = String(sizes[0]?.filename ?? doc.filename);
+    const mediaType = String(doc.mimeType ?? "");
+    if (!IMAGE_TYPES.has(mediaType))
+      throw new ValidationError(AI_USAGE, [
+        { field: "images", message: `${mediaType || "this file"} is not an image AI can read` }
+      ]);
+    const file = await this.cms.storageFor(doc.private === true).get(filename);
+    if (!file) throw new ValidationError(AI_USAGE, [{ field: "images", message: "file not found" }]);
+    if (file.body.byteLength > MAX_IMAGE)
+      throw new ValidationError(AI_USAGE, [
+        { field: "images", message: "is larger than 4 MB; add an image size of about 1024 pixels" }
+      ]);
+    return { data: Buffer.from(file.body).toString("base64"), mediaType };
+  }
+  // --- Admins ----------------------------------------------------------------------------------
+  /** Settings → Integrations, AI: the main connection, the features, the limit and this month. */
+  async overview(now = /* @__PURE__ */ new Date()) {
+    const settings = await this.settings();
+    const conns = await this.connections();
+    const labels = new Map(this.config.integrations.map((i) => [i.id, i.label]));
+    const month = monthStart(now, this.config.timeZone).toISOString();
+    const rows2 = (await this.cms.db.find({
+      collection: AI_USAGE,
+      where: { createdAt: { gte: month } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    })).docs;
+    const sum = (key) => {
+      const totals = /* @__PURE__ */ new Map();
+      for (const row of rows2) {
+        if (key === "user" && !row.user) continue;
+        const k = String(row[key]);
+        const t = totals.get(k) ?? { requests: 0, input: 0, output: 0 };
+        t.requests++;
+        t.input += Number(row.input ?? 0);
+        t.output += Number(row.output ?? 0);
+        totals.set(k, t);
+      }
+      return [...totals].sort((a, b) => b[1].requests - a[1].requests);
+    };
+    const users = sum("user");
+    const emails = /* @__PURE__ */ new Map();
+    if (users.length > 0) {
+      const found = await this.cms.db.findByIds({
+        collection: "users",
+        ids: users.map(([id]) => /^\d+$/.test(id) ? Number(id) : id)
+      });
+      for (const u of found) emails.set(String(u.id), String(u.email ?? u.id));
+    }
+    return {
+      main: settings.main ?? null,
+      perUserPerDay: settings.perUserPerDay ?? this.defaultLimit,
+      defaultPerUserPerDay: this.defaultLimit,
+      connections: conns.map((c) => ({
+        id: ref(c.integration, c.name),
+        integration: c.integration,
+        name: c.name,
+        label: labels.get(c.integration) ?? c.integration
+      })),
+      features: await Promise.all(
+        this.features.map(async (f) => ({
+          id: f.id,
+          label: f.label,
+          ...f.description ? { description: f.description } : {},
+          enabled: await this.enabled(f.id),
+          connection: settings.features?.[f.id]?.connection ?? null
+        }))
+      ),
+      usage: {
+        byUser: users.map(([id, t]) => ({ user: emails.get(id) ?? id, ...t })),
+        byFeature: sum("feature").map(([feature, t]) => ({ feature, ...t }))
+      }
+    };
+  }
+  /** Tokens and requests of each connection this month, for the cards. */
+  async usageByConnection(now = /* @__PURE__ */ new Date()) {
+    const month = monthStart(now, this.config.timeZone).toISOString();
+    const rows2 = (await this.cms.db.find({
+      collection: AI_USAGE,
+      where: { createdAt: { gte: month } },
+      sort: ["id"],
+      limit: 0,
+      page: 1
+    })).docs;
+    const out = /* @__PURE__ */ new Map();
+    for (const row of rows2) {
+      const k = ref(String(row.integration), String(row.connection ?? ""));
+      const t = out.get(k) ?? { requests: 0, input: 0, output: 0 };
+      t.requests++;
+      t.input += Number(row.input ?? 0);
+      t.output += Number(row.output ?? 0);
+      out.set(k, t);
+    }
+    return out;
+  }
+  /** Saves admins' choices; audit-logged. */
+  async update(body, user) {
+    const input = body ?? {};
+    const current = await this.settings();
+    const conns = new Set((await this.connections()).map((c) => ref(c.integration, c.name)));
+    const next = { ...current };
+    const fail = (field, message2) => {
+      throw new ValidationError(AI_USAGE, [{ field, message: message2 }]);
+    };
+    if (input.main !== void 0) {
+      if (input.main === null) delete next.main;
+      else if (typeof input.main === "string" && conns.has(input.main)) next.main = input.main;
+      else fail("main", "is not a connection");
+    }
+    if (input.perUserPerDay !== void 0) {
+      if (input.perUserPerDay === null) delete next.perUserPerDay;
+      else if (Number.isInteger(input.perUserPerDay) && input.perUserPerDay >= 0)
+        next.perUserPerDay = input.perUserPerDay;
+      else fail("perUserPerDay", "must be a whole number, 0 or more");
+    }
+    if (input.features !== void 0) {
+      if (typeof input.features !== "object" || input.features === null)
+        fail("features", "must be an object");
+      const features = { ...current.features ?? {} };
+      for (const [id, raw] of Object.entries(input.features)) {
+        if (!this.features.some((f) => f.id === id)) fail("features", `unknown feature "${id}"`);
+        const change = raw ?? {};
+        const entry = { ...features[id] ?? {} };
+        if (typeof change.enabled === "boolean") entry.enabled = change.enabled;
+        if (change.connection === null) delete entry.connection;
+        else if (change.connection !== void 0) {
+          if (typeof change.connection !== "string" || !conns.has(change.connection))
+            fail("features", "connection is not a connection");
+          entry.connection = change.connection;
+        }
+        features[id] = entry;
+      }
+      next.features = features;
+    }
+    const row = await this.settingsRow();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    if (row)
+      await this.cms.db.update({
+        collection: CONNECTIONS,
+        id: row.id,
+        data: { ...row, values: next, updatedAt: now }
+      });
+    else
+      await this.cms.db.create({
+        collection: CONNECTIONS,
+        data: {
+          kind: "settings",
+          integration: SETTINGS,
+          name: null,
+          isDefault: false,
+          values: next,
+          secret: null,
+          account: null,
+          lastUsedAt: null,
+          lastError: null,
+          enabled: null,
+          createdAt: now,
+          updatedAt: now
+        }
+      });
+    await this.cms.audit.record({
+      action: "integration.ai",
+      target: SETTINGS,
+      user,
+      detail: { ...next }
+    });
+    return this.overview();
+  }
+  /** Forgets usage older than 90 days (with the scheduled jobs). */
+  async upkeep(now = /* @__PURE__ */ new Date()) {
+    const before = new Date(now.getTime() - KEEP).toISOString();
+    for (; ; ) {
+      const old = await this.cms.db.find({
+        collection: AI_USAGE,
+        where: { createdAt: { lt: before } },
+        sort: ["id"],
+        limit: 500,
+        page: 1
+      });
+      for (const row of old.docs) await this.cms.db.delete({ collection: AI_USAGE, id: row.id });
+      if (old.docs.length < 500) return;
+    }
+  }
+};
+function stripFence(text4) {
+  const trimmed = text4.trim();
+  const match = /^```(?:json)?\s*\n([\s\S]*?)\n?```$/.exec(trimmed);
+  return match ? match[1] : trimmed;
+}
+function monthStart(now, zone) {
+  let day = lastSlot(now, "00:00", zone);
+  const dayOf = (d) => Number(new Intl.DateTimeFormat("en-US", { day: "numeric", timeZone: zone }).format(d));
+  for (let i = 0; i < 31 && dayOf(day) > 1; i++)
+    day = lastSlot(new Date(day.getTime() - 1), "00:00", zone);
+  return day;
+}
+
+// src/auth/tokens.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+function newToken() {
+  return randomBytes(32).toString("base64url");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+function hmac(secret, value) {
+  return createHmac("sha256", secret).update(value).digest("base64url");
+}
+var signValue = (secret, value) => hmac(secret, value);
+function secretsOf(config) {
+  return [config.secret, ...config.previousSecrets ?? []];
+}
+function signedWith(secrets, value, signature) {
+  return [secrets].flat().some((secret) => safeEqual(signature, hmac(secret, value)));
+}
+function signToken(secret, token) {
+  return `${token}.${hmac(secret, `session:${token}`)}`;
+}
+function unsignToken(secrets, value) {
+  const dot = value.lastIndexOf(".");
+  if (dot <= 0) return void 0;
+  const token = value.slice(0, dot);
+  return signedWith(secrets, `session:${token}`, value.slice(dot + 1)) ? token : void 0;
+}
+function csrfToken(secret, token) {
+  return hmac(secret, `csrf:${token}`);
+}
+function csrfMatches(secrets, token, given) {
+  return signedWith(secrets, `csrf:${token}`, given);
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function signPreviewToken(secret, target, expiresAt, user) {
+  const payload = Buffer.from(
+    JSON.stringify({
+      ..."global" in target ? { g: target.global } : { c: target.collection, i: target.id },
+      e: expiresAt,
+      ...user !== void 0 ? { u: user } : {}
+    })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `preview:${payload}`)}`;
+}
+function verifyPreviewToken(secrets, token, now = Date.now()) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  if (!signedWith(secrets, `preview:${payload}`, token.slice(dot + 1))) return null;
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.e !== "number" || data.e <= now) return null;
+    const user = typeof data.u === "string" ? { user: data.u } : {};
+    if (typeof data.g === "string") return { global: data.g, expiresAt: data.e, ...user };
+    if (typeof data.c === "string" && typeof data.i === "string")
+      return { collection: data.c, id: data.i, expiresAt: data.e, ...user };
+    return null;
+  } catch {
+    return null;
+  }
+}
+function passwordFingerprint(passwordHash) {
+  return createHash("sha256").update(typeof passwordHash === "string" ? passwordHash : "no-password").digest("base64url").slice(0, 22);
+}
+function signPasswordToken(secret, args) {
+  const payload = Buffer.from(
+    JSON.stringify({ u: args.userId, p: args.purpose, e: args.expiresAt })
+  ).toString("base64url");
+  return `${payload}.${hmac(secret, `password:${payload}:${args.fingerprint}`)}`;
+}
+function readPasswordToken(token) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = token.slice(0, dot);
+  try {
+    const data = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+    if (typeof data.u !== "string" || typeof data.e !== "number") return null;
+    if (data.p !== "reset" && data.p !== "invite" && data.p !== "verify") return null;
+    return { userId: data.u, purpose: data.p, expiresAt: data.e, payload };
+  } catch {
+    return null;
+  }
+}
+function passwordTokenMatches(secrets, token, fingerprint) {
+  const dot = token.lastIndexOf(".");
+  if (dot <= 0) return false;
+  const payload = token.slice(0, dot);
+  return signedWith(secrets, `password:${payload}:${fingerprint}`, token.slice(dot + 1));
+}
+
 // src/audit.ts
 import { AsyncLocalStorage } from "async_hooks";
 import { createHmac as createHmac2 } from "crypto";
@@ -758,7 +1278,7 @@ var DEFAULT_FAILED_LOGINS = 20;
 var MAX_VALUE = 500;
 var PAGE = 50;
 var CSV_LIMIT = 1e4;
-var DAY = 864e5;
+var DAY2 = 864e5;
 var BULKY = /* @__PURE__ */ new Set(["richText", "blocks", "array", "json"]);
 var auditContext = new AsyncLocalStorage();
 var SIGN_IN_FAILURES = /* @__PURE__ */ new Set(["login.failed", "login.locked", "sso.failed"]);
@@ -1033,10 +1553,10 @@ var AuditLog = class {
   async upkeep(now = /* @__PURE__ */ new Date()) {
     if (!this.enabled) return;
     const last = await this.lastVerification();
-    if (last && now.getTime() - Date.parse(last.at) < DAY) return;
+    if (last && now.getTime() - Date.parse(last.at) < DAY2) return;
     const keep = this.settings.keepDays;
     if (keep > 0) {
-      const before = new Date(now.getTime() - keep * DAY).toISOString();
+      const before = new Date(now.getTime() - keep * DAY2).toISOString();
       for (; ; ) {
         const { docs } = await this.cms.db.find({
           collection: AUDIT_LOGS,
@@ -3311,82 +3831,6 @@ import { tmpdir } from "os";
 import { join as join2 } from "path";
 import { promisify } from "util";
 import { gzip } from "zlib";
-
-// src/time-of-day.ts
-var DAY2 = 864e5;
-function isTimeZone(zone) {
-  try {
-    new Intl.DateTimeFormat("en-US", { timeZone: zone });
-    return true;
-  } catch {
-    return false;
-  }
-}
-var formatters = /* @__PURE__ */ new Map();
-function wallClock(instant, zone) {
-  let format = formatters.get(zone);
-  if (!format) {
-    format = new Intl.DateTimeFormat("en-US", {
-      timeZone: zone,
-      hourCycle: "h23",
-      year: "numeric",
-      month: "numeric",
-      day: "numeric",
-      hour: "numeric",
-      minute: "numeric",
-      second: "numeric"
-    });
-    formatters.set(zone, format);
-  }
-  const parts = {};
-  for (const part of format.formatToParts(instant))
-    if (part.type !== "literal") parts[part.type] = Number(part.value);
-  return Date.UTC(
-    parts.year,
-    parts.month - 1,
-    parts.day,
-    parts.hour,
-    parts.minute,
-    parts.second
-  );
-}
-function instantOf(wall, zone) {
-  let instant = wall - (wallClock(wall, zone) - wall);
-  instant = wall - (wallClock(instant, zone) - instant);
-  return instant;
-}
-var parse = (at) => at.split(":").map(Number);
-function lastSlot(now, at, zone) {
-  const [hours2, minutes] = parse(at);
-  if (!zone) {
-    const slot2 = new Date(now);
-    slot2.setHours(hours2, minutes, 0, 0);
-    if (slot2.getTime() > now.getTime()) slot2.setDate(slot2.getDate() - 1);
-    return slot2;
-  }
-  const today = wallClock(now.getTime(), zone);
-  const midnight = today - today % DAY2;
-  let slot = instantOf(midnight + hours2 * 36e5 + minutes * 6e4, zone);
-  if (slot > now.getTime())
-    slot = instantOf(midnight - DAY2 + hours2 * 36e5 + minutes * 6e4, zone);
-  return new Date(slot);
-}
-function nextSlot(after, at, zone) {
-  const last = lastSlot(after, at, zone);
-  return lastSlot(new Date(last.getTime() + DAY2 + 2 * 36e5), at, zone);
-}
-function dueAt(now, at, every, lastRun, zone) {
-  if (lastRun === void 0) return true;
-  const last = Date.parse(lastRun);
-  if (Number.isNaN(last)) return true;
-  const slot = lastSlot(now, at, zone).getTime();
-  return last < slot - (every * 1e3 - DAY2);
-}
-function nextAt(at, every, lastRun, zone) {
-  return nextSlot(new Date(Date.parse(lastRun) + (every * 1e3 - DAY2)), at, zone);
-}
-
-// src/backups.ts
 var gzipAsync = promisify(gzip);
 var MAGIC = Buffer.from("ECMSBAK1");
 var IV_BYTES = 12;
@@ -4927,7 +5371,7 @@ var OFFICIAL_PLUGINS = [
       en: "Claude, GPT and Gemini for alt text, SEO and translation",
       th: "Claude, GPT \u0E41\u0E25\u0E30 Gemini \u0E2A\u0E33\u0E2B\u0E23\u0E31\u0E1A alt text, SEO \u0E41\u0E25\u0E30\u0E41\u0E1B\u0E25\u0E20\u0E32\u0E29\u0E32"
     },
-    docs: "https://easycms.dev/docs/integrations"
+    docs: "https://easycms.dev/docs/ai"
   },
   {
     name: "@easy-cms/plugin-ecommerce",
@@ -5066,6 +5510,8 @@ var Integrations = class {
   // --- The admin's page ------------------------------------------------------------------------
   async overview() {
     const integrations = [];
+    const usage = await this.cms.ai?.usageByConnection() ?? /* @__PURE__ */ new Map();
+    const aiProviders = new Set(this.config.ai?.providers.map((p) => p.integration) ?? []);
     const current = keyId(keyOf2(this.config.secret));
     let stale = 0;
     for (const def of this.definitions) {
@@ -5126,7 +5572,11 @@ var Integrations = class {
         enabled: await this.enabled(def.id),
         envFields: Object.keys(env),
         testable: typeof def.test === "function",
-        connections
+        connections: aiProviders.has(def.id) ? connections.map((c) => ({
+          ...c,
+          usage: usage.get(`${def.id}:${c.name}`) ?? { requests: 0, input: 0, output: 0 }
+        })) : connections,
+        ...def.consent ? { consent: def.consent, consented: await this.consented(def.id) } : {}
       });
     }
     const installed = new Set(this.config.installedPlugins.map((p) => p.name));
@@ -5204,11 +5654,12 @@ var Integrations = class {
   async connect(id, body, user) {
     const def = this.definition(id);
     if (def.kind !== "fields") throw new QueryError(`${id} connects with its Connect button`);
+    await this.checkConsent(def);
     const input = body ?? {};
     const name = await this.uniqueName(id, String(input.name ?? ""));
     const values = this.cleanValues(def, input.values);
     this.checkFields(def, values, false);
-    const result = def.test ? await def.test(values, { cms: this.cms }) : null;
+    const result = def.test ? await def.test(values, { cms: this.cms, name }) : null;
     if (result && !result.ok)
       throw new ValidationError(CONNECTIONS, [
         { field: "values", message: result.message ?? "the provider refused these values" }
@@ -5268,13 +5719,41 @@ var Integrations = class {
   /** Turns the integration on or off; its connections are kept. */
   async setEnabled(id, enabled, user) {
     this.definition(id);
+    await this.saveIntegration(id, { enabled });
+    await this.audit(user, enabled ? "enable" : "disable", id);
+    return { enabled };
+  }
+  /** Who accepted the integration's `consent`, and when; `null` before anyone did. */
+  async consented(id) {
+    const [row] = await this.rows(id, "integration");
+    const consent = (row?.values ?? {}).consent;
+    return consent ?? null;
+  }
+  async checkConsent(def) {
+    if (def.consent && !await this.consented(def.id))
+      throw new ValidationError(CONNECTIONS, [
+        { field: "consent", message: "must be accepted before connecting" }
+      ]);
+  }
+  /** An admin accepts the integration's `consent`; audit-logged. */
+  async consent(id, user) {
+    const def = this.definition(id);
+    if (!def.consent) throw new QueryError(`${id} asks for no consent`);
+    const [row] = await this.rows(id, "integration");
+    const consent = { at: (/* @__PURE__ */ new Date()).toISOString(), by: String(user.email ?? user.id) };
+    await this.saveIntegration(id, { values: { ...row?.values ?? {}, consent } });
+    await this.audit(user, "consent", id);
+    return { consented: consent };
+  }
+  /** The integration's own row (on or off, consent), made when first needed. */
+  async saveIntegration(id, patch) {
     const [row] = await this.rows(id, "integration");
     const now = (/* @__PURE__ */ new Date()).toISOString();
     if (row)
       await this.cms.db.update({
         collection: CONNECTIONS,
         id: row.id,
-        data: { ...row, enabled, updatedAt: now }
+        data: { ...row, ...patch, updatedAt: now }
       });
     else
       await this.cms.db.create({
@@ -5289,22 +5768,22 @@ var Integrations = class {
           account: null,
           lastUsedAt: null,
           lastError: null,
-          enabled,
+          enabled: null,
           createdAt: now,
-          updatedAt: now
+          updatedAt: now,
+          ...patch
         }
       });
-    await this.audit(user, enabled ? "enable" : "disable", id);
-    return { enabled };
   }
   /** Checks a connection's values with the provider; the card shows the result. */
   async test(id, cid) {
     const def = this.definition(id);
     if (!def.test) throw new QueryError(`${id} can't be tested`);
     const values = cid === "env" ? this.envValues(def) : { ...this.decrypt(await this.row(id, cid)), ...this.envValues(def) };
+    const name = cid === "env" ? ENV_NAME : String((await this.row(id, cid)).name);
     let result;
     try {
-      result = await def.test(values, { cms: this.cms });
+      result = await def.test(values, { cms: this.cms, name });
     } catch (error) {
       result = { ok: false, message: error.message };
     }
@@ -5349,10 +5828,11 @@ var Integrations = class {
   }
   // --- OAuth -----------------------------------------------------------------------------------
   /** The provider's sign-in page to send the admin to. */
-  authorize(id, user, redirectUri, name) {
+  async authorize(id, user, redirectUri, name) {
     const def = this.definition(id);
     if (def.kind !== "oauth" || !def.oauth)
       throw new QueryError(`${id} connects with pasted values`);
+    await this.checkConsent(def);
     const state = signState(this.config.secret, {
       i: id,
       u: String(user.id),
@@ -6150,7 +6630,7 @@ function read(response, maxBytes, deadline) {
 
 // src/config-keys.ts
 var keys = (list) => new Set(list.split(/\s+/).filter(Boolean));
-var CONFIG = keys(`secret previousSecrets integrations listeners db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
+var CONFIG = keys(`secret previousSecrets integrations listeners ai aiFeatures db serverURL cors cronSecret timeZone webhooks events jobs localization routes admin
   upload auth collections globals endpoints cliCommands onRequest fieldTypes apiKeys email backups
   audit logs countCacheSeconds maxPage httpCache outbox rateLimit search telemetry plugins`);
 var ADMIN = keys("path locale brand siteURL nav commands modules pages dashboard switcher");
@@ -6704,7 +7184,7 @@ var WEBHOOK_EVENTS = [
 var RETRY_DELAYS = [1e3, 5e3];
 var QUEUE_DELAYS2 = [6e4, 5 * 6e4, 30 * 6e4, 2 * 36e5, 6 * 36e5, 12 * 36e5];
 var CLAIM2 = 5 * 6e4;
-var TIMEOUT = 1e4;
+var TIMEOUT2 = 1e4;
 var Webhooks = class {
   constructor(hooks, logger, queue, fetcher = (...args) => fetch(...args), retryDelays = RETRY_DELAYS) {
     this.hooks = hooks;
@@ -6872,7 +7352,7 @@ var Webhooks = class {
         method: "POST",
         headers,
         body,
-        signal: AbortSignal.timeout(TIMEOUT)
+        signal: AbortSignal.timeout(TIMEOUT2)
       });
       if (response.ok || response.status < 500 && response.status !== 429) {
         if (!response.ok)
@@ -6981,6 +7461,7 @@ function validateConfig(config) {
   validateJobs(config, add);
   validateIntegrations(config, add);
   validateListeners(config, add);
+  validateAi(config, add);
   validateTimeZone(config, add);
   validateEvents(config, add);
   const apiKeys = config.apiKeys;
@@ -8626,6 +9107,22 @@ function validateIntegrations(config, add) {
     } else add(`${at}.kind`, "must be 'fields' or 'oauth'");
     if (item.test !== void 0 && typeof item.test !== "function")
       add(`${at}.test`, "must be a function");
+    if (item.icon !== void 0 && typeof item.icon !== "string") {
+      const logo = item.icon ?? {};
+      const hex = (v) => typeof v === "string" && /^#[0-9a-f]{6}$/i.test(v);
+      const paths = Array.isArray(logo.paths) ? logo.paths : [];
+      if (paths.length === 0 || paths.some((p) => {
+        const path = p ?? {};
+        return typeof path.d !== "string" || !/^[MmLlHhVvCcSsQqTtAaZzEe0-9.,\s+-]+$/.test(path.d) || path.fill !== void 0 && !hex(path.fill);
+      }))
+        add(
+          `${at}.icon`,
+          "must be an admin icon name, or { paths: [{ d, fill? }], color? } with SVG path data"
+        );
+      if (logo.color !== void 0 && !hex(logo.color)) add(`${at}.icon.color`, "must be #rrggbb");
+      if (logo.viewBox !== void 0 && !(typeof logo.viewBox === "string" && /^-?[\d.]+( -?[\d.]+){3}$/.test(logo.viewBox)))
+        add(`${at}.icon.viewBox`, "must be four numbers, e.g. '0 0 24 24'");
+    }
     for (const [f, field] of (Array.isArray(item.fields) ? item.fields : []).entries()) {
       const fieldItem = field ?? {};
       if (fieldItem.lookup !== void 0 && typeof fieldItem.lookup !== "function")
@@ -8648,6 +9145,45 @@ function validateListeners(config, add) {
     if (typeof item.handler !== "function") add(`listeners[${i}].handler`, "must be a function");
   }
 }
+function validateAi(config, add) {
+  const ai = config.ai;
+  if (ai !== void 0) {
+    const providers = ai?.providers;
+    if (!Array.isArray(providers)) add("ai.providers", "must be an array");
+    else {
+      const ids = new Set((config.integrations ?? []).map((i) => i?.id));
+      for (const [i, raw] of providers.entries()) {
+        const provider = raw ?? {};
+        if (typeof provider.integration !== "string" || !ids.has(provider.integration))
+          add(`ai.providers[${i}].integration`, "must be the id of an integration");
+        if (typeof provider.generate !== "function")
+          add(`ai.providers[${i}].generate`, "must be a function");
+      }
+    }
+    const limits = ai?.limits;
+    const whole = (v) => Number.isInteger(v) && v >= 0;
+    if (limits?.perUserPerDay !== void 0 && !whole(limits.perUserPerDay))
+      add("ai.limits.perUserPerDay", "must be a whole number, 0 or more");
+    for (const [role, value] of Object.entries(limits?.roles ?? {}))
+      if (!whole(value)) add(`ai.limits.roles.${role}`, "must be a whole number, 0 or more");
+  }
+  const features = config.aiFeatures;
+  if (features === void 0) return;
+  if (!Array.isArray(features)) {
+    add("aiFeatures", "must be an array");
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const [i, raw] of features.entries()) {
+    const feature = raw ?? {};
+    if (typeof feature.id !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(feature.id))
+      add(`aiFeatures[${i}].id`, 'must be lowercase letters, digits and "-"', "e.g. id: 'alt-text'");
+    else if (seen.has(feature.id) || feature.id === "test")
+      add(`aiFeatures[${i}].id`, `"${feature.id}" is taken`);
+    else seen.add(feature.id);
+    if (!isLabel(feature.label)) add(`aiFeatures[${i}].label`, "must be a string or { en, th }");
+  }
+}
 
 // src/resolve-config.ts
 var DEFAULT_ADMIN_PATH = "/admin";
@@ -8759,6 +9295,7 @@ async function resolveConfig(input) {
       bulkOperationsCollection,
       savedViewsCollection,
       ...resolvedIntegrations(config).length > 0 ? [connectionsCollection] : [],
+      ...config.ai ? [aiUsageCollection] : [],
       ...config.auth?.rbac ? [rolesCollection] : [],
       ...(config.auth?.providers?.length ?? 0) > 0 ? [userIdentitiesCollection] : [],
       ...config.audit ? [auditLogsCollection] : []
@@ -8766,6 +9303,7 @@ async function resolveConfig(input) {
     globals: config.globals ?? [],
     endpoints: config.endpoints ?? [],
     integrations: resolvedIntegrations(config),
+    aiFeatures: config.ai ? config.aiFeatures ?? [] : [],
     cliCommands: config.cliCommands ?? [],
     // Easy CMS's own events (#356), for webhooks and `cms.on`.
     events: [.../* @__PURE__ */ new Set([...config.events ?? [], ...SYSTEM_EVENTS])],
@@ -8884,7 +9422,7 @@ function cacheableResponse(request, body, status, headers, times, tags) {
 }
 
 // src/version.ts
-var VERSION = true ? "1.32.0" : "0.0.0-dev";
+var VERSION = true ? "1.33.0" : "0.0.0-dev";
 
 // src/telemetry.ts
 var DB_CALLS = /* @__PURE__ */ new Set([
@@ -9163,6 +9701,8 @@ var EasyCMS = class {
   folders;
   /** Accounts connected to plugins' integrations (`integrations`, Settings → Integrations). */
   integrations;
+  /** AI for the admin's features (#357): `null` without an AI plugin (`ai` in the config). */
+  ai;
   versions;
   webhooks;
   mailer;
@@ -9191,6 +9731,7 @@ var EasyCMS = class {
     );
     this.audit = new AuditLog(this);
     this.integrations = new Integrations(this);
+    this.ai = config.ai ? new Ai(this, config.ai) : null;
     for (const listener of config.listeners ?? []) {
       const run = (message2) => listener.handler(message2, { cms: this });
       if (listener.events === "*") this.anyListeners.add(run);
@@ -10718,6 +11259,7 @@ var EasyCMS = class {
         (error) => this.logger.error(`Backups: ${error.message}`, { error })
       );
       await this.audit.upkeep(now).catch((error) => this.logger.error(`Audit log: ${error.message}`, { error }));
+      await this.ai?.upkeep(now).catch((error) => this.logger.error(`AI usage: ${error.message}`, { error }));
       await this.rateLimiter?.clear(now).catch((error) => this.logger.error(`Rate limits: ${error.message}`, { error }));
       const result = {
         scheduled,
@@ -12049,51 +12591,51 @@ var EasyCMS = class {
     const cms = this;
     const { user, context } = guard;
     const allowed2 = /* @__PURE__ */ new Map();
-    for (const ref of references2) {
-      const filter = ref.filterOptions;
+    for (const ref2 of references2) {
+      const filter = ref2.filterOptions;
       if (!filter) continue;
       const byCollection = allowed2.get(filter) ?? /* @__PURE__ */ new Map();
       allowed2.set(filter, byCollection);
-      if (!byCollection.has(ref.collection))
+      if (!byCollection.has(ref2.collection))
         byCollection.set(
-          ref.collection,
-          await filter({ id: selfId, relationTo: ref.collection, user, cms, context })
+          ref2.collection,
+          await filter({ id: selfId, relationTo: ref2.collection, user, cms, context })
         );
-      const where = byCollection.get(ref.collection);
+      const where = byCollection.get(ref2.collection);
       if (where === true) continue;
-      const target = this.config.collections.find((c) => c.slug === ref.collection);
+      const target = this.config.collections.find((c) => c.slug === ref2.collection);
       const localization = this.config.localization;
       const scoped = target ? this.whereFor(target, where, localization ? { locale: localization.defaultLocale } : {}) : where;
       const count = await this.db.count({
-        collection: ref.collection,
-        where: { and: [{ id: { equals: ref.id } }, ...scoped ? [scoped] : []] }
+        collection: ref2.collection,
+        where: { and: [{ id: { equals: ref2.id } }, ...scoped ? [scoped] : []] }
       });
       if (count === 0)
-        errors.push({ field: ref.field, message: "is not one of the allowed choices" });
+        errors.push({ field: ref2.field, message: "is not one of the allowed choices" });
     }
     return errors;
   }
   async checkReferences(references2, guard) {
     const byCollection = /* @__PURE__ */ new Map();
     const errors = [];
-    for (const ref of references2) {
-      const target = this.config.collections.find((c) => c.slug === ref.collection);
-      if (ref.link && (!target || INTERNAL_COLLECTIONS.has(ref.collection))) {
+    for (const ref2 of references2) {
+      const target = this.config.collections.find((c) => c.slug === ref2.collection);
+      if (ref2.link && (!target || INTERNAL_COLLECTIONS.has(ref2.collection))) {
         errors.push({
-          field: ref.field,
-          message: `links to "${ref.collection}", which is not a collection`
+          field: ref2.field,
+          message: `links to "${ref2.collection}", which is not a collection`
         });
         continue;
       }
-      if (ref.link && typeof target?.preview !== "function") {
+      if (ref2.link && typeof target?.preview !== "function") {
         errors.push({
-          field: ref.field,
-          message: `links to "${ref.collection}", whose documents have no URL (set its preview)`
+          field: ref2.field,
+          message: `links to "${ref2.collection}", whose documents have no URL (set its preview)`
         });
         continue;
       }
       if (!target) continue;
-      byCollection.set(ref.collection, [...byCollection.get(ref.collection) ?? [], ref]);
+      byCollection.set(ref2.collection, [...byCollection.get(ref2.collection) ?? [], ref2]);
     }
     for (const [collection2, refs] of byCollection) {
       const found = await this.db.findByIds({
@@ -12101,28 +12643,28 @@ var EasyCMS = class {
         ids: [...new Set(refs.map((r) => r.id))]
       });
       const byId = new Map(found.map((d) => [d.id, d]));
-      for (const ref of refs) {
-        const doc = byId.get(ref.id);
+      for (const ref2 of refs) {
+        const doc = byId.get(ref2.id);
         if (!doc) {
-          errors.push({ field: ref.field, message: `${collection2} ${ref.id} does not exist` });
+          errors.push({ field: ref2.field, message: `${collection2} ${ref2.id} does not exist` });
           continue;
         }
         const type = typeof doc.mimeType === "string" ? doc.mimeType : "";
-        if (ref.mimeTypes && !mimeAllowedBy(type, ref.mimeTypes)) {
-          const images = ref.mimeTypes.every((t) => t.toLowerCase() === "image/*");
+        if (ref2.mimeTypes && !mimeAllowedBy(type, ref2.mimeTypes)) {
+          const images = ref2.mimeTypes.every((t) => t.toLowerCase() === "image/*");
           errors.push({
-            field: ref.field,
-            message: images ? `must be an image (${doc.filename ?? ref.id} is ${type || "not one"})` : `must be ${ref.mimeTypes.join(", ")} (${doc.filename ?? ref.id} is ${type || "unknown"})`
+            field: ref2.field,
+            message: images ? `must be an image (${doc.filename ?? ref2.id} is ${type || "not one"})` : `must be ${ref2.mimeTypes.join(", ")} (${doc.filename ?? ref2.id} is ${type || "unknown"})`
           });
         }
-        if (ref.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
-          ref.folderOnly,
+        if (ref2.folderOnly && this.folders.enabled && !await this.folders.inKeyed(
+          ref2.folderOnly,
           doc.folder ?? null,
           await this.folderScope(guard)
         ))
           errors.push({
-            field: ref.field,
-            message: `must be a file from the "${ref.folderOnly}" folder (${doc.filename ?? ref.id} is not)`
+            field: ref2.field,
+            message: `must be a file from the "${ref2.folderOnly}" folder (${doc.filename ?? ref2.id} is not)`
           });
       }
     }
@@ -12744,7 +13286,8 @@ var Roles = class {
         new: !seen("globals", g.slug),
         fields: adminFields(g.fields, void 0)
       })),
-      views: this.views()
+      views: this.views(),
+      ai: Boolean(this.config.ai)
     };
   }
   async create(input, author) {
@@ -12923,7 +13466,8 @@ var Roles = class {
         void 0
       )
     };
-    return { ...picked, admin, own, fields };
+    const aiPerDay = this.config.ai && Number.isInteger(input.aiPerDay) && input.aiPerDay >= 0 ? { aiPerDay: input.aiPerDay } : {};
+    return { ...picked, admin, own, fields, ...aiPerDay };
   }
   /**
    * Keeps rules for known top-level fields. A field that must be filled in (required, without a
@@ -12972,6 +13516,11 @@ var Roles = class {
       ]);
     return value.trim();
   }
+  /** The role's daily AI limit set in Settings → Roles, if any (`auth.rbac`). */
+  async aiLimit(key) {
+    if (!this.enabled) return void 0;
+    return (await this.permissionsOf(key)).aiPerDay;
+  }
   async permissionsOf(key) {
     return (await this.load()).get(key) ?? {};
   }
@@ -13628,10 +14177,10 @@ function folderIds(cms, user, context) {
   return cms.folders.enabled ? (key) => cms.keyedFolder(key, { user, context }) : void 0;
 }
 function panelRef(panel) {
-  const ref = componentRef(panel);
+  const ref2 = componentRef(panel);
   if (typeof panel === "object" && "position" in panel && panel.position === "top")
-    ref.position = "top";
-  return ref;
+    ref2.position = "top";
+  return ref2;
 }
 function layoutOf(layout, fields) {
   const shown2 = new Set(fields.filter((f) => f.position !== "sidebar").map((f) => f.name));
@@ -15097,6 +15646,15 @@ async function route(cms, ctx, method, path, options) {
     }
     throw methodNotAllowed(ctx, "PATCH, DELETE");
   }
+  if (first === "admin" && second === "ai" && segments.length === 2) {
+    if (!ctx.user) throw new UnauthorizedError();
+    if (!cms.ai) throw new HttpError("Not found", 404);
+    if (!await cms.roles.canView(ctx.user, "integrations")) throw new ForbiddenError();
+    if (method === "GET") return { body: await cms.ai.overview() };
+    if (method === "PUT")
+      return { body: await cms.ai.update(await readJson(ctx.request), ctx.user) };
+    throw methodNotAllowed(ctx, "GET, PUT");
+  }
   if (first === "admin" && second === "integrations") {
     if (!ctx.user) throw new UnauthorizedError();
     if (cms.config.integrations.length === 0) throw new HttpError("Not found", 404);
@@ -15117,7 +15675,9 @@ async function route(cms, ctx, method, path, options) {
     if (part === "authorize" && cid === void 0) {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
       const body = await readJson(ctx.request);
-      return { body: integrations.authorize(id2, user, callbackUrl, String(body.name ?? "")) };
+      return {
+        body: await integrations.authorize(id2, user, callbackUrl, String(body.name ?? ""))
+      };
     }
     if (part === "callback" && cid === void 0) {
       if (method !== "GET") throw methodNotAllowed(ctx, "GET");
@@ -15140,6 +15700,10 @@ async function route(cms, ctx, method, path, options) {
       }
       return { body: new Response(null, { status: 302, headers: { location: page.toString() } }) };
     }
+    if (part === "consent" && cid === void 0) {
+      if (method !== "POST") throw methodNotAllowed(ctx, "POST");
+      return { body: await integrations.consent(id2, user) };
+    }
     if (part === "lookup" && cid !== void 0 && action === void 0) {
       if (method !== "POST") throw methodNotAllowed(ctx, "POST");
       return { body: await integrations.lookup(id2, cid, await readJson(ctx.request)) };
@@ -16201,10 +16765,11 @@ export {
   isStaff,
   isSignedIn,
   isAdmin,
-  secretsOf,
   MEDIA,
   MEDIA_FOLDERS,
   INTERNAL_COLLECTIONS,
+  AiProviderError,
+  secretsOf,
   AuditLog,
   API_KEYS,
   API_KEY_OPERATIONS,