From c290d0663ac6d605879018fd5d7c014eb7836fda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Sun, 25 Jan 2026 14:27:29 +0100
Subject: [PATCH 1/8] feat: S3/GCS data export integration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Export a project's analytics events to the user's own S3 or GCS bucket.

ClickHouse is the single source of truth for the export — there is no Redis
buffer and no per-event ingestion hook, so a stalled/failing bucket can never
touch the ingestion path (in either the Kafka or GroupMQ mode).

How it works:
- A new `inserted_at DateTime64(3)` column on the events table records ingestion
  time. It DEFAULTs to `created_at` (deterministic for pre-migration parts — a
  DEFAULT now() would be evaluated lazily at read time and never settle) and is
  set explicitly at insert time (createEvent + the import production-move), so
  backdated events (server-side, offline, imports) still get a real insert time.
  A minmax skip index keeps the windowed scan cheap since inserted_at isn't in
  the primary key.
- The flushExports cron job (every 60s) windows the events table by inserted_at
  for each (project, integration), batches rows into gzipped JSONL + a manifest,
  and uploads them. A per-(project, integration) ExportWatermark (Postgres) tracks
  progress with a composite (inserted_at, id) cursor — the id tie-breaker is
  required because an import stamps one inserted_at across its whole batch. A
  safety lag behind now() avoids reading in-flight inserts; the watermark only
  advances after a successful upload (at-least-once; the manifest is the commit
  marker). First run starts from now(), so connecting an export doesn't dump all
  history (historical backfill = reset the watermark).

Integrations are organization-scoped, so every active project in the org exports
independently and gets its own watermark + object path (layout keyed by
project_id). Destinations are a pluggable object-store sink (S3 + GCS adapters)
so future targets are small additions.

Credentials (S3 secret keys, GCS service-account keys) are encrypted at rest with
CREDENTIALS_ENCRYPTION_KEY and decrypted inside the adapters. Export batching and
the safety lag are tunable via EXPORT_* env vars.

Rebased onto main after the Redpanda/Kafka migration.

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 .env.example                                  |  15 +
 apps/api/package.json                         |   5 +
 apps/api/tsdown.config.ts                     |   4 +
 .../forms/gcs-export-integration.tsx          | 185 +++++++
 .../forms/s3-export-integration.tsx           | 325 +++++++++++
 .../components/integrations/integrations.tsx  |  24 +-
 apps/start/src/modals/add-integration.tsx     |  16 +
 apps/worker/package.json                      |   6 +
 apps/worker/src/boot-cron.ts                  |   5 +
 apps/worker/src/boot-debug.ts                 |   1 +
 apps/worker/src/jobs/cron.flush-exports.ts    | 290 ++++++++++
 apps/worker/src/jobs/cron.ts                  |   4 +
 apps/worker/tsdown.config.ts                  |   4 +
 packages/common/server/encryption.ts          | 123 +++++
 packages/common/server/index.ts               |   1 +
 .../18-add-events-inserted-at.ts              |  56 ++
 packages/db/index.ts                          |   1 +
 .../migration.sql                             |  24 +
 packages/db/prisma/schema.prisma              |  22 +
 packages/db/src/exports/batch-creator.ts      | 219 ++++++++
 packages/db/src/exports/export-event.ts       |  72 +++
 packages/db/src/exports/index.ts              |  25 +
 packages/db/src/exports/manifest.ts           |  70 +++
 packages/db/src/services/event.service.ts     |   9 +
 packages/db/src/services/import.service.ts    |   6 +-
 packages/integrations/package.json            |   7 +-
 .../src/object-store/gcs-adapter.ts           | 165 ++++++
 .../integrations/src/object-store/index.ts    |   7 +
 .../src/object-store/s3-adapter.ts            | 293 ++++++++++
 .../integrations/src/object-store/types.ts    |  45 ++
 packages/queue/src/queues.ts                  |   5 +
 packages/trpc/src/routers/integration.ts      |  80 +++
 packages/validation/src/index.ts              |  69 ++-
 pnpm-lock.yaml                                | 512 +++++++++++++++++-
 34 files changed, 2682 insertions(+), 13 deletions(-)
 create mode 100644 apps/start/src/components/integrations/forms/gcs-export-integration.tsx
 create mode 100644 apps/start/src/components/integrations/forms/s3-export-integration.tsx
 create mode 100644 apps/worker/src/jobs/cron.flush-exports.ts
 create mode 100644 packages/common/server/encryption.ts
 create mode 100644 packages/db/code-migrations/18-add-events-inserted-at.ts
 create mode 100644 packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql
 create mode 100644 packages/db/src/exports/batch-creator.ts
 create mode 100644 packages/db/src/exports/export-event.ts
 create mode 100644 packages/db/src/exports/index.ts
 create mode 100644 packages/db/src/exports/manifest.ts
 create mode 100644 packages/integrations/src/object-store/gcs-adapter.ts
 create mode 100644 packages/integrations/src/object-store/index.ts
 create mode 100644 packages/integrations/src/object-store/s3-adapter.ts
 create mode 100644 packages/integrations/src/object-store/types.ts

diff --git a/.env.example b/.env.example
index eea0d9bde..48e75ae5a 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,21 @@ CLICKHOUSE_URL="http://localhost:8123/openpanel"
 # Generate with: openssl rand -hex 32
 ENCRYPTION_KEY=""
 
+# Symmetric key used to encrypt object-store export credentials (S3 secret
+# access keys, GCS service-account keys) at rest. Only required if you configure
+# an S3/GCS data-export integration. Generate with: openssl rand -hex 32
+# CREDENTIALS_ENCRYPTION_KEY=""
+
+# OBJECT-STORE EXPORT (S3/GCS) tuning — optional, sensible defaults shown.
+# The flushExports cron job windows ClickHouse by inserted_at and uploads
+# batched files. LAG keeps a safety gap behind now() for in-flight inserts;
+# BATCH_SIZE is rows per file; MAX_BATCHES_PER_RUN bounds backlog drain per
+# tick; CONCURRENCY is parallel (project,integration) uploads.
+# EXPORT_LAG_SECONDS="60"
+# EXPORT_BATCH_SIZE="50000"
+# EXPORT_MAX_BATCHES_PER_RUN="20"
+# EXPORT_CONCURRENCY="4"
+
 # REST
 BATCH_SIZE="5000"
 BATCH_INTERVAL="10000"
diff --git a/apps/api/package.json b/apps/api/package.json
index 3b845cc46..fa42287e6 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -77,5 +77,10 @@
     "tsdown": "0.14.2",
     "typescript": "catalog:",
     "vitest": "^1.0.0"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0"
   }
 }
\ No newline at end of file
diff --git a/apps/api/tsdown.config.ts b/apps/api/tsdown.config.ts
index c41662a85..fcc2fd9a2 100644
--- a/apps/api/tsdown.config.ts
+++ b/apps/api/tsdown.config.ts
@@ -10,6 +10,10 @@ const options: Options = {
     'pino',
     'pino-pretty',
     '@node-rs/argon2',
+    // integrations package
+    '@aws-sdk/client-s3',
+    '@aws-sdk/client-sts',
+    '@google-cloud/storage',
   ],
   sourcemap: true,
   platform: 'node',
diff --git a/apps/start/src/components/integrations/forms/gcs-export-integration.tsx b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
new file mode 100644
index 000000000..a2bb17cca
--- /dev/null
+++ b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
@@ -0,0 +1,185 @@
+import { InputWithLabel } from '@/components/forms/input-with-label';
+import { Button } from '@/components/ui/button';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { useAppParams } from '@/hooks/use-app-params';
+import { useTRPC } from '@/integrations/trpc/react';
+import type { RouterOutputs } from '@/trpc/client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { zCreateGCSExportIntegration } from '@openpanel/validation';
+import { useMutation } from '@tanstack/react-query';
+import { path, mergeDeepRight } from 'ramda';
+import { Controller, useForm } from 'react-hook-form';
+import { toast } from 'sonner';
+import type { z } from 'zod';
+
+type IForm = z.infer<typeof zCreateGCSExportIntegration>;
+
+export function GCSExportIntegrationForm({
+  defaultValues,
+  onSuccess,
+}: {
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}) {
+  const { organizationId } = useAppParams();
+  const form = useForm<IForm>({
+    defaultValues: mergeDeepRight(
+      {
+        id: defaultValues?.id,
+        organizationId,
+        name: '',
+        config: {
+          type: 'gcs_export' as const,
+          bucket: '',
+          prefix: 'openpanel-exports',
+          format: 'jsonl_gzip' as const,
+          serviceAccountKey: '',
+        },
+      },
+      defaultValues ?? {},
+    ),
+    resolver: zodResolver(zCreateGCSExportIntegration),
+  });
+  const trpc = useTRPC();
+  const mutation = useMutation(
+    trpc.integration.createOrUpdateExport.mutationOptions({
+      onSuccess,
+      onError(error) {
+        toast.error(error.message || 'Failed to create integration');
+      },
+    }),
+  );
+
+  const testMutation = useMutation(
+    trpc.integration.testExportConnection.mutationOptions({
+      onSuccess(data) {
+        if (data.success) {
+          toast.success('Connection successful! Bucket is accessible.');
+        } else {
+          toast.error(`Connection failed: ${data.error}`);
+        }
+      },
+      onError(error) {
+        toast.error(error.message || 'Failed to test connection');
+      },
+    }),
+  );
+
+  const handleSubmit = (values: IForm) => {
+    mutation.mutate(values);
+  };
+
+  const handleError = () => {
+    toast.error('Please fix validation errors');
+  };
+
+  const handleTest = () => {
+    const values = form.getValues();
+    if (!values.config.bucket || !values.config.serviceAccountKey) {
+      return toast.error('Bucket and Service Account Key are required');
+    }
+    testMutation.mutate(values);
+  };
+
+  return (
+    <form
+      onSubmit={form.handleSubmit(handleSubmit, handleError)}
+      className="col gap-4"
+    >
+      <InputWithLabel
+        label="Name"
+        placeholder="Eg. Production GCS Export"
+        {...form.register('name')}
+        error={form.formState.errors.name?.message}
+      />
+
+      <div className="grid grid-cols-2 gap-4">
+        <InputWithLabel
+          label="GCS Bucket"
+          placeholder="my-analytics-bucket"
+          {...form.register('config.bucket')}
+          error={path(['config', 'bucket', 'message'], form.formState.errors)}
+        />
+        <InputWithLabel
+          label="Prefix"
+          placeholder="openpanel-exports"
+          {...form.register('config.prefix')}
+          error={path(['config', 'prefix', 'message'], form.formState.errors)}
+        />
+      </div>
+
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">Format</label>
+        <Controller
+          name="config.format"
+          control={form.control}
+          render={({ field }) => (
+            <Select onValueChange={field.onChange} value={field.value}>
+              <SelectTrigger className="w-48">
+                <SelectValue placeholder="Select format" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="jsonl_gzip">JSONL (gzip)</SelectItem>
+                <SelectItem value="parquet" disabled>
+                  Parquet (coming soon)
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          )}
+        />
+      </div>
+
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">
+          Service Account Key (JSON)
+        </label>
+        <textarea
+          className="border-input bg-background ring-offset-background placeholder:text-muted-foreground focus-visible:ring-ring min-h-32 w-full rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50"
+          placeholder='{"type": "service_account", "project_id": "...", ...}'
+          {...form.register('config.serviceAccountKey')}
+        />
+        {!!path(
+          ['config', 'serviceAccountKey', 'message'],
+          form.formState.errors,
+        ) && (
+          <p className="text-destructive text-xs">
+            {
+              path(
+                ['config', 'serviceAccountKey', 'message'],
+                form.formState.errors,
+              ) as any
+            }
+          </p>
+        )}
+        <p className="text-muted-foreground text-xs">
+          Paste the contents of your GCS service account JSON key file. The
+          service account needs write access to the specified bucket.
+        </p>
+      </div>
+
+      <div className="row gap-4">
+        <Button
+          type="button"
+          variant="outline"
+          onClick={handleTest}
+          disabled={testMutation.isPending}
+        >
+          {testMutation.isPending ? 'Testing...' : 'Test connection'}
+        </Button>
+        <Button type="submit" className="flex-1" disabled={mutation.isPending}>
+          {mutation.isPending
+            ? 'Saving...'
+            : defaultValues?.id
+              ? 'Update'
+              : 'Create'}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/start/src/components/integrations/forms/s3-export-integration.tsx b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
new file mode 100644
index 000000000..c9d27a1f6
--- /dev/null
+++ b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
@@ -0,0 +1,325 @@
+import { InputWithLabel } from '@/components/forms/input-with-label';
+import { Button } from '@/components/ui/button';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { useAppParams } from '@/hooks/use-app-params';
+import { useTRPC } from '@/integrations/trpc/react';
+import type { RouterOutputs } from '@/trpc/client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { zCreateS3ExportIntegration } from '@openpanel/validation';
+import { useMutation } from '@tanstack/react-query';
+import { path, mergeDeepRight } from 'ramda';
+import { Controller, useForm, useWatch } from 'react-hook-form';
+import { toast } from 'sonner';
+import type { z } from 'zod';
+
+type IForm = z.infer<typeof zCreateS3ExportIntegration>;
+
+const AWS_REGIONS = [
+  'auto',
+  'us-east-1',
+  'us-east-2',
+  'us-west-1',
+  'us-west-2',
+  'eu-west-1',
+  'eu-west-2',
+  'eu-west-3',
+  'eu-central-1',
+  'eu-north-1',
+  'ap-southeast-1',
+  'ap-southeast-2',
+  'ap-northeast-1',
+  'ap-northeast-2',
+  'ap-south-1',
+  'sa-east-1',
+];
+
+export function S3ExportIntegrationForm({
+  defaultValues,
+  onSuccess,
+}: {
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}) {
+  const { organizationId } = useAppParams();
+  const form = useForm<IForm>({
+    defaultValues: mergeDeepRight(
+      {
+        id: defaultValues?.id,
+        organizationId,
+        name: '',
+        config: {
+          type: 's3_export' as const,
+          bucket: '',
+          prefix: 'openpanel-exports',
+          region: 'us-east-1',
+          format: 'jsonl_gzip' as const,
+          authMode: 'iam_role' as const,
+          roleArn: '',
+          externalId: '',
+          encryption: 'SSE-S3' as const,
+          kmsKeyId: '',
+        },
+      },
+      defaultValues ?? {},
+    ),
+    resolver: zodResolver(zCreateS3ExportIntegration),
+  });
+  const trpc = useTRPC();
+  const mutation = useMutation(
+    trpc.integration.createOrUpdateExport.mutationOptions({
+      onSuccess,
+      onError(error) {
+        toast.error(error.message || 'Failed to create integration');
+      },
+    }),
+  );
+
+  const testMutation = useMutation(
+    trpc.integration.testExportConnection.mutationOptions({
+      onSuccess(data) {
+        if (data.success) {
+          toast.success('Connection successful! Bucket is accessible.');
+        } else {
+          toast.error(`Connection failed: ${data.error}`);
+        }
+      },
+      onError(error) {
+        toast.error(error.message || 'Failed to test connection');
+      },
+    }),
+  );
+
+  const authMode = useWatch({ control: form.control, name: 'config.authMode' });
+  const encryption = useWatch({ control: form.control, name: 'config.encryption' });
+
+  const handleSubmit = (values: IForm) => {
+    mutation.mutate(values);
+  };
+
+  const handleError = () => {
+    toast.error('Please fix validation errors');
+  };
+
+  const handleTest = () => {
+    const values = form.getValues();
+    if (!values.config.bucket || !values.config.region) {
+      return toast.error('Bucket and Region are required');
+    }
+    if (values.config.authMode === 'iam_role' && !values.config.roleArn) {
+      return toast.error('IAM Role ARN is required');
+    }
+    if (values.config.authMode === 'access_key') {
+      if (!values.config.accessKeyId || !values.config.secretAccessKey) {
+        return toast.error('Access Key ID and Secret Access Key are required');
+      }
+    }
+    testMutation.mutate(values);
+  };
+
+  return (
+    <form
+      onSubmit={form.handleSubmit(handleSubmit, handleError)}
+      className="col gap-4"
+    >
+      <InputWithLabel
+        label="Name"
+        placeholder="Eg. Production S3 Export"
+        {...form.register('name')}
+        error={form.formState.errors.name?.message}
+      />
+
+      <div className="grid grid-cols-2 gap-4">
+        <InputWithLabel
+          label="S3 Bucket"
+          placeholder="my-analytics-bucket"
+          {...form.register('config.bucket')}
+          error={path(['config', 'bucket', 'message'], form.formState.errors)}
+        />
+        <InputWithLabel
+          label="Prefix"
+          placeholder="openpanel-exports"
+          {...form.register('config.prefix')}
+          error={path(['config', 'prefix', 'message'], form.formState.errors)}
+        />
+      </div>
+
+      <div className="grid grid-cols-2 gap-4">
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Region</label>
+          <Controller
+            name="config.region"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select region" />
+                </SelectTrigger>
+                <SelectContent>
+                  {AWS_REGIONS.map((region) => (
+                    <SelectItem key={region} value={region}>
+                      {region}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Format</label>
+          <Controller
+            name="config.format"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select format" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="jsonl_gzip">JSONL (gzip)</SelectItem>
+                  <SelectItem value="parquet" disabled>
+                    Parquet (coming soon)
+                  </SelectItem>
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+      </div>
+
+      {/* Auth Mode Selector */}
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">Authentication Mode</label>
+        <Controller
+          name="config.authMode"
+          control={form.control}
+          render={({ field }) => (
+            <Select onValueChange={field.onChange} value={field.value}>
+              <SelectTrigger>
+                <SelectValue placeholder="Select authentication mode" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="iam_role">IAM Role (AWS)</SelectItem>
+                <SelectItem value="access_key">Access Keys (R2, MinIO, Spaces)</SelectItem>
+              </SelectContent>
+            </Select>
+          )}
+        />
+        <p className="text-muted-foreground text-xs">
+          {authMode === 'iam_role'
+            ? 'Recommended for AWS S3. Create an IAM role that grants OpenPanel access.'
+            : 'Use access keys for Cloudflare R2, MinIO, DigitalOcean Spaces, or other S3-compatible storage.'}
+        </p>
+      </div>
+
+      {/* IAM Role fields */}
+      {authMode === 'iam_role' && (
+        <>
+          <InputWithLabel
+            label="IAM Role ARN"
+            placeholder="arn:aws:iam::123456789012:role/OpenPanelExportRole"
+            {...form.register('config.roleArn')}
+            error={path(['config', 'roleArn', 'message'], form.formState.errors)}
+          />
+
+          <InputWithLabel
+            label="External ID (optional)"
+            placeholder="Optional external ID for cross-account access"
+            {...form.register('config.externalId')}
+            error={path(['config', 'externalId', 'message'], form.formState.errors)}
+          />
+        </>
+      )}
+
+      {/* Access Key fields */}
+      {authMode === 'access_key' && (
+        <>
+          <InputWithLabel
+            label="Endpoint URL (optional)"
+            placeholder="https://your-account-id.r2.cloudflarestorage.com"
+            {...form.register('config.endpoint')}
+            error={path(['config', 'endpoint', 'message'], form.formState.errors)}
+          />
+          <p className="text-muted-foreground -mt-2 text-xs">
+            Required for R2, MinIO, etc. Leave empty for AWS S3.
+          </p>
+
+          <div className="grid grid-cols-2 gap-4">
+            <InputWithLabel
+              label="Access Key ID"
+              placeholder="AKIAIOSFODNN7EXAMPLE"
+              {...form.register('config.accessKeyId')}
+              error={path(['config', 'accessKeyId', 'message'], form.formState.errors)}
+            />
+            <InputWithLabel
+              label="Secret Access Key"
+              type="password"
+              placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+              {...form.register('config.secretAccessKey')}
+              error={path(['config', 'secretAccessKey', 'message'], form.formState.errors)}
+            />
+          </div>
+        </>
+      )}
+
+      <div className="grid grid-cols-2 gap-4">
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Encryption</label>
+          <Controller
+            name="config.encryption"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select encryption" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="SSE-S3">SSE-S3 (AES-256)</SelectItem>
+                  <SelectItem value="SSE-KMS">SSE-KMS</SelectItem>
+                  <SelectItem value="none">None</SelectItem>
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+
+        {encryption === 'SSE-KMS' && (
+          <InputWithLabel
+            label="KMS Key ID"
+            placeholder="arn:aws:kms:us-east-1:..."
+            {...form.register('config.kmsKeyId')}
+            error={path(
+              ['config', 'kmsKeyId', 'message'],
+              form.formState.errors,
+            )}
+          />
+        )}
+      </div>
+
+      <div className="row gap-4">
+        <Button
+          type="button"
+          variant="outline"
+          onClick={handleTest}
+          disabled={testMutation.isPending}
+        >
+          {testMutation.isPending ? 'Testing...' : 'Test connection'}
+        </Button>
+        <Button type="submit" className="flex-1" disabled={mutation.isPending}>
+          {mutation.isPending
+            ? 'Saving...'
+            : defaultValues?.id
+              ? 'Update'
+              : 'Create'}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/start/src/components/integrations/integrations.tsx b/apps/start/src/components/integrations/integrations.tsx
index 2edd94215..62649658f 100644
--- a/apps/start/src/components/integrations/integrations.tsx
+++ b/apps/start/src/components/integrations/integrations.tsx
@@ -1,5 +1,5 @@
 import type { IIntegrationConfig } from '@openpanel/validation';
-import { WebhookIcon } from 'lucide-react';
+import { CloudIcon, DatabaseIcon, WebhookIcon } from 'lucide-react';
 import {
   IntegrationCardLogo,
   IntegrationCardLogoImage,
@@ -46,4 +46,26 @@ export const INTEGRATIONS: {
       </IntegrationCardLogo>
     ),
   },
+  {
+    type: 's3_export',
+    name: 'S3 Export',
+    description:
+      'Export events to Amazon S3 for loading into Redshift, Snowflake, Athena, or other data warehouses.',
+    icon: (
+      <IntegrationCardLogo className="bg-[#FF9900] text-white">
+        <CloudIcon className="size-10" />
+      </IntegrationCardLogo>
+    ),
+  },
+  {
+    type: 'gcs_export',
+    name: 'GCS Export',
+    description:
+      'Export events to Google Cloud Storage for loading into BigQuery or other data warehouses.',
+    icon: (
+      <IntegrationCardLogo className="bg-[#4285F4] text-white">
+        <DatabaseIcon className="size-10" />
+      </IntegrationCardLogo>
+    ),
+  },
 ];
diff --git a/apps/start/src/modals/add-integration.tsx b/apps/start/src/modals/add-integration.tsx
index 24fda47ee..de11cd3b3 100644
--- a/apps/start/src/modals/add-integration.tsx
+++ b/apps/start/src/modals/add-integration.tsx
@@ -1,6 +1,8 @@
 import { useTRPC } from '@/integrations/trpc/react';
 
 import { DiscordIntegrationForm } from '@/components/integrations/forms/discord-integration';
+import { GCSExportIntegrationForm } from '@/components/integrations/forms/gcs-export-integration';
+import { S3ExportIntegrationForm } from '@/components/integrations/forms/s3-export-integration';
 import { SlackIntegrationForm } from '@/components/integrations/forms/slack-integration';
 import { WebhookIntegrationForm } from '@/components/integrations/forms/webhook-integration';
 import { IntegrationCardContent } from '@/components/integrations/integration-card';
@@ -90,6 +92,20 @@ export default function AddIntegration(props: Props) {
             onSuccess={handleSuccess}
           />
         );
+      case 's3_export':
+        return (
+          <S3ExportIntegrationForm
+            defaultValues={query.data}
+            onSuccess={handleSuccess}
+          />
+        );
+      case 'gcs_export':
+        return (
+          <GCSExportIntegrationForm
+            defaultValues={query.data}
+            onSuccess={handleSuccess}
+          />
+        );
       default:
         return null;
     }
diff --git a/apps/worker/package.json b/apps/worker/package.json
index 494824189..2ef4d6ee4 100644
--- a/apps/worker/package.json
+++ b/apps/worker/package.json
@@ -26,6 +26,7 @@
     "@openpanel/payments": "workspace:*",
     "@openpanel/queue": "workspace:*",
     "@openpanel/redis": "workspace:*",
+    "@openpanel/validation": "workspace:*",
     "bullmq": "^5.63.0",
     "date-fns": "^3.3.1",
     "express": "^4.18.2",
@@ -47,5 +48,10 @@
     "@types/uuid": "^9.0.8",
     "tsdown": "0.14.2",
     "typescript": "catalog:"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0"
   }
 }
\ No newline at end of file
diff --git a/apps/worker/src/boot-cron.ts b/apps/worker/src/boot-cron.ts
index 9e17b845e..d88cce2ed 100644
--- a/apps/worker/src/boot-cron.ts
+++ b/apps/worker/src/boot-cron.ts
@@ -113,6 +113,11 @@ export async function bootCron() {
       type: 'weeklyDigest',
       pattern: '0 8 * * 1', // Mondays 08:00 UTC — weekly analytics digest email
     },
+    {
+      name: 'flushExports',
+      type: 'flushExports',
+      pattern: 1000 * 60, // Every 1 minute — drains export buffers to S3/GCS
+    },
   ];
 
   if (process.env.SELF_HOSTED && process.env.NODE_ENV === 'production') {
diff --git a/apps/worker/src/boot-debug.ts b/apps/worker/src/boot-debug.ts
index 28bb2dd1e..27bc0a46f 100644
--- a/apps/worker/src/boot-debug.ts
+++ b/apps/worker/src/boot-debug.ts
@@ -30,6 +30,7 @@ const CRON_TYPES = [
   'sessionVacuum',
   'insightCleanup',
   'weeklyDigest',
+  'flushExports',
 ] as const satisfies readonly CronQueueType[];
 
 function escapeHtml(value: string) {
diff --git a/apps/worker/src/jobs/cron.flush-exports.ts b/apps/worker/src/jobs/cron.flush-exports.ts
new file mode 100644
index 000000000..a3a45f502
--- /dev/null
+++ b/apps/worker/src/jobs/cron.flush-exports.ts
@@ -0,0 +1,290 @@
+import { DateTime } from '@openpanel/common';
+import {
+  ch,
+  clickhouseEventToExportEvent,
+  convertClickhouseDateToJs,
+  createBatch,
+  createManifest,
+  db,
+  generateBatchPath,
+  type IClickhouseEvent,
+  MANIFEST_CONTENT_TYPE,
+  MANIFEST_FILENAME,
+  serializeManifest,
+  TABLE_NAMES,
+} from '@openpanel/db';
+import {
+  createGCSAdapter,
+  createS3Adapter,
+  type IObjectStoreAdapter,
+} from '@openpanel/integrations/src/object-store';
+import { createLogger } from '@openpanel/logger';
+import type { CronQueuePayload } from '@openpanel/queue';
+import type {
+  IGCSExportConfig,
+  IIntegrationConfig,
+  IS3ExportConfig,
+} from '@openpanel/validation';
+import type { Job } from 'bullmq';
+
+const logger = createLogger({ name: 'flush-exports' });
+
+// Safety lag: never export events whose inserted_at is within this window of
+// now(), so an in-flight CH insert batch (or replica lag) can't be half-read at
+// the boundary. Evaluated server-side via CH now64() to avoid worker/CH clock skew.
+const LAG_SECONDS = Number.parseInt(process.env.EXPORT_LAG_SECONDS || '60', 10);
+// Max rows per object/batch and max batches drained per (project, integration)
+// per run. A backlog drains over subsequent ticks rather than in one giant pass.
+const BATCH_SIZE = Number.parseInt(process.env.EXPORT_BATCH_SIZE || '50000', 10);
+const MAX_BATCHES_PER_RUN = Number.parseInt(
+  process.env.EXPORT_MAX_BATCHES_PER_RUN || '20',
+  10
+);
+const CONCURRENCY = Number.parseInt(process.env.EXPORT_CONCURRENCY || '4', 10);
+
+// Sentinel cursor id for the first window of a (project, integration). The
+// events `id` column is a UUID, so the tie-breaker must compare as UUID — an
+// empty string fails to parse. The id tie-breaker is load-bearing: an import
+// stamps the same inserted_at across its whole batch, so a timestamp-only cursor
+// would skip all but one row.
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+
+const EXPORT_COLUMNS = `
+  id, name, sdk_name, sdk_version, device_id, profile_id, project_id,
+  session_id, path, origin, referrer, referrer_name, referrer_type,
+  duration, properties, created_at, country, city, region,
+  longitude, latitude, os, os_version, browser, browser_version,
+  device, brand, model, imported_at, inserted_at, revenue
+`;
+
+type ExportConfig = IS3ExportConfig | IGCSExportConfig;
+
+interface Cursor {
+  // CH datetime string 'yyyy-MM-dd HH:mm:ss.SSS' + last event id, a composite
+  // cursor so rows sharing an inserted_at aren't skipped or duplicated.
+  insertedAt: string;
+  eventId: string;
+}
+
+function isExportConfig(config: IIntegrationConfig): config is ExportConfig {
+  return config.type === 's3_export' || config.type === 'gcs_export';
+}
+
+const formatCh = (date: Date): string =>
+  DateTime.fromJSDate(date).setZone('UTC').toFormat('yyyy-MM-dd HH:mm:ss.SSS');
+
+/**
+ * Drain new ClickHouse events into each configured object-store export.
+ *
+ * The Redis buffer + per-event hook are gone: ClickHouse is the single source of
+ * truth, so this job windows the events table by `inserted_at` and uploads
+ * batched files. Export never touches the ingestion path.
+ */
+export async function flushExportsJob(_job: Job<CronQueuePayload>) {
+  const integrations = await db.integration.findMany();
+  const exportIntegrations = integrations.filter((i) =>
+    isExportConfig(i.config)
+  );
+
+  if (exportIntegrations.length === 0) {
+    return;
+  }
+
+  // Integrations are org-scoped, so every active project in the org exports
+  // independently (each gets its own watermark + object path).
+  const items: Array<{
+    projectId: string;
+    integrationId: string;
+    config: ExportConfig;
+  }> = [];
+  for (const integration of exportIntegrations) {
+    const projects = await db.project.findMany({
+      where: { organizationId: integration.organizationId, deleteAt: null },
+      select: { id: true },
+    });
+    for (const project of projects) {
+      items.push({
+        projectId: project.id,
+        integrationId: integration.id,
+        config: integration.config as ExportConfig,
+      });
+    }
+  }
+
+  await runWithConcurrency(items, CONCURRENCY, (item) =>
+    processExport(item.projectId, item.integrationId, item.config).catch(
+      (error) => {
+        logger.error(
+          {
+            err: error,
+            projectId: item.projectId,
+            integrationId: item.integrationId,
+          },
+          'Export failed for project'
+        );
+      }
+    )
+  );
+}
+
+async function processExport(
+  projectId: string,
+  integrationId: string,
+  config: ExportConfig
+): Promise<void> {
+  let cursor = await loadCursor(projectId, integrationId);
+  const adapter: IObjectStoreAdapter =
+    config.type === 's3_export'
+      ? createS3Adapter(config)
+      : createGCSAdapter(config);
+  const prefix = config.prefix || 'openpanel-exports';
+  const format = config.format || 'jsonl_gzip';
+
+  for (let i = 0; i < MAX_BATCHES_PER_RUN; i++) {
+    const rows = await queryWindow(projectId, cursor);
+    if (rows.length === 0) {
+      break;
+    }
+
+    const events = rows.map(clickhouseEventToExportEvent);
+    const batch = await createBatch(projectId, integrationId, events, format);
+    const basePath = generateBatchPath(
+      prefix,
+      projectId,
+      integrationId,
+      batch.info.batchId,
+      new Date(batch.info.minEventTime)
+    );
+
+    // Upload data files first, then the manifest last as the commit marker.
+    for (const file of batch.files) {
+      await adapter.upload({
+        bucket: config.bucket,
+        key: `${basePath}/${file.filename}`,
+        content: file.content,
+        contentType: file.contentType,
+      });
+    }
+    const manifest = createManifest(
+      batch.info,
+      batch.files.map((f) => f.filename)
+    );
+    await adapter.upload({
+      bucket: config.bucket,
+      key: `${basePath}/${MANIFEST_FILENAME}`,
+      content: serializeManifest(manifest),
+      contentType: MANIFEST_CONTENT_TYPE,
+    });
+
+    // Advance the watermark only after a successful upload. A crash mid-run
+    // re-exports the un-acked batch next tick (at-least-once); the manifest is
+    // the consumer's signal that a batch is complete.
+    const last = rows[rows.length - 1]!;
+    cursor = { insertedAt: last.inserted_at!, eventId: last.id };
+    await saveCursor(projectId, integrationId, cursor);
+
+    logger.info(
+      {
+        projectId,
+        integrationId,
+        batchId: batch.info.batchId,
+        recordCount: batch.info.recordCount,
+        format,
+      },
+      'Export batch uploaded'
+    );
+
+    if (rows.length < BATCH_SIZE) {
+      break;
+    }
+  }
+}
+
+async function queryWindow(
+  projectId: string,
+  cursor: Cursor
+): Promise<IClickhouseEvent[]> {
+  const result = await ch.query({
+    query: `
+      SELECT ${EXPORT_COLUMNS}
+      FROM ${TABLE_NAMES.events}
+      WHERE project_id = {projectId:String}
+        AND inserted_at <= now64(3) - INTERVAL {lag:UInt32} SECOND
+        AND (
+          inserted_at > {wTs:DateTime64(3)}
+          OR (inserted_at = {wTs:DateTime64(3)} AND id > {wId:UUID})
+        )
+      ORDER BY inserted_at, id
+      LIMIT {limit:UInt32}
+    `,
+    query_params: {
+      projectId,
+      lag: LAG_SECONDS,
+      wTs: cursor.insertedAt,
+      wId: cursor.eventId || NIL_UUID,
+      limit: BATCH_SIZE,
+    },
+    format: 'JSONEachRow',
+  });
+
+  return (await result.json()) as IClickhouseEvent[];
+}
+
+async function loadCursor(
+  projectId: string,
+  integrationId: string
+): Promise<Cursor> {
+  const existing = await db.exportWatermark.findUnique({
+    where: { projectId_integrationId: { projectId, integrationId } },
+  });
+  if (existing) {
+    return {
+      insertedAt: formatCh(existing.lastInsertedAt),
+      eventId: existing.lastEventId,
+    };
+  }
+
+  // First run for this pair: start from now, so connecting an export doesn't
+  // dump the project's entire history. Historical backfill is a separate,
+  // explicit operation (reset the watermark).
+  const now = new Date();
+  await db.exportWatermark.create({
+    data: { projectId, integrationId, lastInsertedAt: now, lastEventId: NIL_UUID },
+  });
+  return { insertedAt: formatCh(now), eventId: NIL_UUID };
+}
+
+async function saveCursor(
+  projectId: string,
+  integrationId: string,
+  cursor: Cursor
+): Promise<void> {
+  await db.exportWatermark.update({
+    where: { projectId_integrationId: { projectId, integrationId } },
+    data: {
+      lastInsertedAt: convertClickhouseDateToJs(cursor.insertedAt),
+      lastEventId: cursor.eventId,
+    },
+  });
+}
+
+async function runWithConcurrency<T>(
+  items: T[],
+  limit: number,
+  fn: (item: T) => Promise<void>
+): Promise<void> {
+  const queue = [...items];
+  const workers = Array.from(
+    { length: Math.max(1, Math.min(limit, queue.length)) },
+    async () => {
+      while (queue.length > 0) {
+        const item = queue.shift();
+        if (item === undefined) {
+          break;
+        }
+        await fn(item);
+      }
+    }
+  );
+  await Promise.all(workers);
+}
diff --git a/apps/worker/src/jobs/cron.ts b/apps/worker/src/jobs/cron.ts
index 008d2dbd5..5c70fa120 100644
--- a/apps/worker/src/jobs/cron.ts
+++ b/apps/worker/src/jobs/cron.ts
@@ -10,6 +10,7 @@ import type { CronQueuePayload } from '@openpanel/queue';
 import type { Job } from 'bullmq';
 import { cohortRefreshCronJob } from './cron.cohort-refresh';
 import { jobDelete } from './cron.delete';
+import { flushExportsJob } from './cron.flush-exports';
 import { insightCleanupCronJob } from './cron.insight-cleanup';
 import { weeklyDigestCronJob } from './cron.weekly-digest';
 import { onboardingJob } from './cron.onboarding';
@@ -75,5 +76,8 @@ export async function cronJob(job: Job<CronQueuePayload>) {
     case 'weeklyDigest': {
       return await weeklyDigestCronJob();
     }
+    case 'flushExports': {
+      return await flushExportsJob(job);
+    }
   }
 }
diff --git a/apps/worker/tsdown.config.ts b/apps/worker/tsdown.config.ts
index c41662a85..fcc2fd9a2 100644
--- a/apps/worker/tsdown.config.ts
+++ b/apps/worker/tsdown.config.ts
@@ -10,6 +10,10 @@ const options: Options = {
     'pino',
     'pino-pretty',
     '@node-rs/argon2',
+    // integrations package
+    '@aws-sdk/client-s3',
+    '@aws-sdk/client-sts',
+    '@google-cloud/storage',
   ],
   sourcemap: true,
   platform: 'node',
diff --git a/packages/common/server/encryption.ts b/packages/common/server/encryption.ts
new file mode 100644
index 000000000..c4390f4a9
--- /dev/null
+++ b/packages/common/server/encryption.ts
@@ -0,0 +1,123 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from 'node:crypto';
+
+const ENCRYPTION_PREFIX = 'enc:';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+
+/**
+ * Get the encryption key from environment variable
+ * Key must be 32 bytes (64 hex characters)
+ */
+function getEncryptionKey(): Buffer {
+  const keyHex = process.env.CREDENTIALS_ENCRYPTION_KEY;
+  
+  if (!keyHex) {
+    throw new Error(
+      'CREDENTIALS_ENCRYPTION_KEY environment variable is required for credential encryption. ' +
+      'Generate with: openssl rand -hex 32'
+    );
+  }
+  
+  if (keyHex.length !== 64) {
+    throw new Error(
+      'CREDENTIALS_ENCRYPTION_KEY must be 32 bytes (64 hex characters). ' +
+      'Generate with: openssl rand -hex 32'
+    );
+  }
+  
+  return Buffer.from(keyHex, 'hex');
+}
+
+/**
+ * Check if a value is already encrypted (has the enc: prefix)
+ */
+export function isEncrypted(value: string): boolean {
+  return value.startsWith(ENCRYPTION_PREFIX);
+}
+
+/**
+ * Encrypt a credential using AES-256-GCM
+ * Returns: enc:<base64(iv + ciphertext + authTag)>
+ */
+export function encryptCredential(plaintext: string): string {
+  if (!plaintext) {
+    return plaintext;
+  }
+  
+  // Don't double-encrypt
+  if (isEncrypted(plaintext)) {
+    return plaintext;
+  }
+  
+  const key = getEncryptionKey();
+  const iv = randomBytes(IV_LENGTH);
+  
+  const cipher = createCipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+  
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ]);
+  
+  const authTag = cipher.getAuthTag();
+  
+  // Combine: IV (12 bytes) + ciphertext (variable) + authTag (16 bytes)
+  const combined = Buffer.concat([iv, ciphertext, authTag]);
+  
+  return ENCRYPTION_PREFIX + combined.toString('base64');
+}
+
+/**
+ * Decrypt a credential that was encrypted with encryptCredential
+ * Expects: enc:<base64(iv + ciphertext + authTag)>
+ */
+export function decryptCredential(ciphertext: string): string {
+  if (!ciphertext) {
+    return ciphertext;
+  }
+  
+  // If not encrypted, return as-is (allows for graceful migration)
+  if (!isEncrypted(ciphertext)) {
+    return ciphertext;
+  }
+  
+  const key = getEncryptionKey();
+  
+  // Remove prefix and decode base64
+  const combined = Buffer.from(
+    ciphertext.slice(ENCRYPTION_PREFIX.length),
+    'base64'
+  );
+  
+  if (combined.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+    throw new Error('Invalid encrypted credential: too short');
+  }
+  
+  // Extract components
+  const iv = combined.subarray(0, IV_LENGTH);
+  const authTag = combined.subarray(combined.length - AUTH_TAG_LENGTH);
+  const encryptedData = combined.subarray(
+    IV_LENGTH,
+    combined.length - AUTH_TAG_LENGTH
+  );
+  
+  const decipher = createDecipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+  
+  decipher.setAuthTag(authTag);
+  
+  const decrypted = Buffer.concat([
+    decipher.update(encryptedData),
+    decipher.final(),
+  ]);
+  
+  return decrypted.toString('utf8');
+}
diff --git a/packages/common/server/index.ts b/packages/common/server/index.ts
index cb5409062..78490c5a3 100644
--- a/packages/common/server/index.ts
+++ b/packages/common/server/index.ts
@@ -1,4 +1,5 @@
 export * from './crypto';
+export * from './encryption';
 export * from './profileId';
 export * from './parser-user-agent';
 export * from './parse-referrer';
diff --git a/packages/db/code-migrations/18-add-events-inserted-at.ts b/packages/db/code-migrations/18-add-events-inserted-at.ts
new file mode 100644
index 000000000..c7964fff2
--- /dev/null
+++ b/packages/db/code-migrations/18-add-events-inserted-at.ts
@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  addColumns,
+  runClickhouseMigrationCommands,
+} from '../src/clickhouse/migration';
+import { getIsCluster } from './helpers';
+
+export async function up() {
+  const isClustered = getIsCluster();
+
+  // `inserted_at` is the ingestion (CH-insert) time, used as the cursor for the
+  // object-store export job. New rows set it explicitly at insert time (see
+  // createEvent / moveImportsToProduction). The DEFAULT is `created_at` — NOT
+  // `now()` — on purpose: a DEFAULT now() on a column added to an existing
+  // MergeTree is evaluated lazily at read time for pre-migration parts, so old
+  // rows would read as "just inserted" on every scan and never settle. Defaulting
+  // to the existing `created_at` column is deterministic and needs no part
+  // rewrite, so historical rows keep a stable, in-the-past inserted_at.
+  // `inserted_at` is not part of the table's ORDER BY, so the windowed export
+  // query (WHERE inserted_at > cursor) can't use the primary index. A minmax
+  // skip index lets ClickHouse skip granules whose inserted_at range is entirely
+  // below the cursor. It only needs to exist on the local MergeTree (the
+  // `_replicated` table when clustered); the distributed table has no data.
+  const indexName = 'idx_inserted_at';
+  const indexExpr = `ADD INDEX IF NOT EXISTS ${indexName} inserted_at TYPE minmax GRANULARITY 1`;
+  const indexSql = isClustered
+    ? `ALTER TABLE events_replicated ON CLUSTER '{cluster}' ${indexExpr}`
+    : `ALTER TABLE events ${indexExpr}`;
+
+  const sqls: string[] = [
+    ...addColumns(
+      'events',
+      ['`inserted_at` DateTime64(3) DEFAULT created_at AFTER `imported_at`'],
+      isClustered,
+    ),
+    indexSql,
+  ];
+
+  fs.writeFileSync(
+    path.join(__filename.replace('.ts', '.sql')),
+    sqls
+      .map((sql) =>
+        sql
+          .trim()
+          .replace(/;$/, '')
+          .replace(/\n{2,}/g, '\n')
+          .concat(';'),
+      )
+      .join('\n\n---\n\n'),
+  );
+
+  if (!process.argv.includes('--dry')) {
+    await runClickhouseMigrationCommands(sqls);
+  }
+}
diff --git a/packages/db/index.ts b/packages/db/index.ts
index 727ea5663..bc4413572 100644
--- a/packages/db/index.ts
+++ b/packages/db/index.ts
@@ -4,6 +4,7 @@ export * from './src/clickhouse/query-builder';
 export * from './src/encryption';
 export * from './src/engine';
 export * from './src/engine';
+export * from './src/exports';
 export * from './src/gsc';
 export * from './src/prisma-client';
 export * from './src/services/access.service';
diff --git a/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql b/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql
new file mode 100644
index 000000000..5df01e977
--- /dev/null
+++ b/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql
@@ -0,0 +1,24 @@
+-- CreateTable
+CREATE TABLE "public"."export_watermarks" (
+    "id" UUID NOT NULL DEFAULT gen_random_uuid(),
+    "projectId" TEXT NOT NULL,
+    "integrationId" UUID NOT NULL,
+    "lastInsertedAt" TIMESTAMP(3) NOT NULL,
+    "lastEventId" TEXT NOT NULL DEFAULT '',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "export_watermarks_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "export_watermarks_integrationId_idx" ON "public"."export_watermarks"("integrationId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "export_watermarks_projectId_integrationId_key" ON "public"."export_watermarks"("projectId", "integrationId");
+
+-- AddForeignKey
+ALTER TABLE "public"."export_watermarks" ADD CONSTRAINT "export_watermarks_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "public"."projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "public"."export_watermarks" ADD CONSTRAINT "export_watermarks_integrationId_fkey" FOREIGN KEY ("integrationId") REFERENCES "public"."integrations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index 8e9fe979d..1838722a5 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -253,6 +253,7 @@ model Project {
   imports           Import[]
   gscConnection     GscConnection?
   cohorts           Cohort[]
+  exportWatermarks  ExportWatermark[]
 
   // When deleteAt > now(), the project will be deleted
   deleteAt DateTime?
@@ -584,12 +585,33 @@ model Integration {
   organizationId    String
   notificationRules NotificationRule[]
   notifications     Notification[]
+  exportWatermarks  ExportWatermark[]
   createdAt         DateTime           @default(now())
   updatedAt         DateTime           @default(now()) @updatedAt
 
   @@map("integrations")
 }
 
+// Tracks how far the object-store export (S3/GCS) has progressed for a given
+// (project, integration) pair. The cursor is ClickHouse `inserted_at` plus the
+// last event id to break ties within the same millisecond, so windowed reads
+// are exactly-once across runs.
+model ExportWatermark {
+  id             String      @id @default(dbgenerated("gen_random_uuid()")) @db.Uuid
+  project        Project     @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  projectId      String
+  integration    Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade)
+  integrationId  String      @db.Uuid
+  lastInsertedAt DateTime
+  lastEventId    String      @default("")
+  createdAt      DateTime    @default(now())
+  updatedAt      DateTime    @default(now()) @updatedAt
+
+  @@unique([projectId, integrationId])
+  @@index([integrationId])
+  @@map("export_watermarks")
+}
+
 model ResetPassword {
   id        String   @id
   accountId String
diff --git a/packages/db/src/exports/batch-creator.ts b/packages/db/src/exports/batch-creator.ts
new file mode 100644
index 000000000..3880c35ec
--- /dev/null
+++ b/packages/db/src/exports/batch-creator.ts
@@ -0,0 +1,219 @@
+import { createGzip } from 'node:zlib';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { generateSecureId } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+
+import type { IExportEvent } from './export-event';
+
+const logger = createLogger({ name: 'batch-creator' });
+
+/**
+ * Supported export formats
+ */
+export type ExportFormat = 'jsonl_gzip' | 'parquet';
+
+/**
+ * Batch metadata for tracking
+ */
+export interface IBatchInfo {
+  batchId: string;
+  projectId: string;
+  integrationId: string;
+  format: ExportFormat;
+  recordCount: number;
+  minEventTime: string;
+  maxEventTime: string;
+  createdAt: string;
+  // Partition info
+  partitionDate: string; // YYYY-MM-DD
+  partitionHour: string; // HH
+}
+
+/**
+ * Created batch file info
+ */
+export interface IBatchFile {
+  filename: string;
+  content: Buffer;
+  contentType: string;
+}
+
+/**
+ * Result of creating a batch
+ */
+export interface IBatchResult {
+  info: IBatchInfo;
+  files: IBatchFile[];
+}
+
+/**
+ * Generate the object path for a batch
+ * Layout: {prefix}/project_id={projectId}/integration_id={integrationId}/dt=YYYY-MM-DD/hour=HH/batch_id={batchId}/
+ */
+export function generateBatchPath(
+  prefix: string,
+  projectId: string,
+  integrationId: string,
+  batchId: string,
+  date: Date,
+): string {
+  const dt = date.toISOString().split('T')[0]; // YYYY-MM-DD
+  const hour = date.getUTCHours().toString().padStart(2, '0'); // HH
+
+  return [
+    prefix,
+    `project_id=${projectId}`,
+    `integration_id=${integrationId}`,
+    `dt=${dt}`,
+    `hour=${hour}`,
+    `batch_id=${batchId}`,
+  ].join('/');
+}
+
+/**
+ * Get file extension for format
+ */
+export function getFileExtension(format: ExportFormat): string {
+  switch (format) {
+    case 'jsonl_gzip':
+      return 'jsonl.gz';
+    case 'parquet':
+      return 'parquet';
+  }
+}
+
+/**
+ * Get content type for format
+ */
+export function getContentType(format: ExportFormat): string {
+  switch (format) {
+    case 'jsonl_gzip':
+      return 'application/gzip';
+    case 'parquet':
+      return 'application/vnd.apache.parquet';
+  }
+}
+
+/**
+ * Extract the min/max event time across a batch (used for partitioning + the
+ * manifest time range).
+ */
+function eventTimeRange(events: IExportEvent[]): {
+  minEventTime: string;
+  maxEventTime: string;
+} {
+  let minTime: Date | null = null;
+  let maxTime: Date | null = null;
+
+  for (const event of events) {
+    const eventTime = new Date(event.event_time);
+    if (!minTime || eventTime < minTime) {
+      minTime = eventTime;
+    }
+    if (!maxTime || eventTime > maxTime) {
+      maxTime = eventTime;
+    }
+  }
+
+  return {
+    minEventTime: minTime?.toISOString() || new Date().toISOString(),
+    maxEventTime: maxTime?.toISOString() || new Date().toISOString(),
+  };
+}
+
+/**
+ * Create JSONL content from events
+ */
+function createJsonlContent(events: IExportEvent[]): string {
+  return events.map((event) => JSON.stringify(event)).join('\n') + '\n';
+}
+
+/**
+ * Gzip compress content
+ */
+async function gzipCompress(content: string): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  const gzip = createGzip({ level: 6 });
+  const source = Readable.from([content]);
+
+  await pipeline(source, gzip, async function* (source) {
+    for await (const chunk of source) {
+      chunks.push(chunk as Buffer);
+    }
+  });
+
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Create a batch of events in the specified format
+ */
+export async function createBatch(
+  projectId: string,
+  integrationId: string,
+  events: IExportEvent[],
+  format: ExportFormat = 'jsonl_gzip',
+): Promise<IBatchResult> {
+  const batchId = generateSecureId('batch');
+  const now = new Date();
+
+  if (events.length === 0) {
+    throw new Error('No valid events to create batch');
+  }
+
+  const { minEventTime, maxEventTime } = eventTimeRange(events);
+
+  // Determine partition based on min event time
+  const partitionDate = new Date(minEventTime);
+  const dt = partitionDate.toISOString().split('T')[0]!;
+  const hour = partitionDate.getUTCHours().toString().padStart(2, '0');
+
+  const info: IBatchInfo = {
+    batchId,
+    projectId,
+    integrationId,
+    format,
+    recordCount: events.length,
+    minEventTime,
+    maxEventTime,
+    createdAt: now.toISOString(),
+    partitionDate: dt,
+    partitionHour: hour,
+  };
+
+  const files: IBatchFile[] = [];
+
+  switch (format) {
+    case 'jsonl_gzip': {
+      const jsonlContent = createJsonlContent(events);
+      const gzippedContent = await gzipCompress(jsonlContent);
+
+      files.push({
+        filename: `part-0000.${getFileExtension(format)}`,
+        content: gzippedContent,
+        contentType: getContentType(format),
+      });
+      break;
+    }
+    case 'parquet': {
+      // Parquet support to be implemented later
+      throw new Error('Parquet format not yet implemented');
+    }
+  }
+
+  logger.info(
+    {
+      batchId,
+      projectId,
+      integrationId,
+      format,
+      recordCount: events.length,
+      partitionDate: dt,
+      partitionHour: hour,
+    },
+    'Batch created',
+  );
+
+  return { info, files };
+}
diff --git a/packages/db/src/exports/export-event.ts b/packages/db/src/exports/export-event.ts
new file mode 100644
index 000000000..3a440799a
--- /dev/null
+++ b/packages/db/src/exports/export-event.ts
@@ -0,0 +1,72 @@
+import { convertClickhouseDateToJs } from '../clickhouse/client';
+import type { IClickhouseEvent } from '../services/event.service';
+
+/**
+ * Stable, versioned export schema written to the object store (JSONL/Parquet).
+ * Decoupled from the ClickHouse row shape so the export format can evolve
+ * independently of the internal column layout.
+ */
+export interface IExportEvent {
+  event_id: string;
+  project_id: string;
+  event_name: string;
+  event_time: string; // ISO 8601 (the event's created_at)
+  user_id: string | null;
+  session_id: string | null;
+  device_id: string | null;
+  properties: Record<string, unknown>;
+  // Geo data
+  country: string | null;
+  city: string | null;
+  region: string | null;
+  // Device data
+  os: string | null;
+  browser: string | null;
+  device: string | null;
+  // Page data
+  path: string | null;
+  origin: string | null;
+  referrer: string | null;
+  // Metadata
+  ingested_at: string; // ISO 8601 (ClickHouse inserted_at)
+  schema_version: number;
+}
+
+export const EXPORT_SCHEMA_VERSION = 1;
+
+const toIso = (chDate: string): string =>
+  convertClickhouseDateToJs(chDate).toISOString();
+
+/**
+ * Map a ClickHouse event row to the stable export schema.
+ */
+export function clickhouseEventToExportEvent(
+  event: IClickhouseEvent,
+): IExportEvent {
+  return {
+    event_id: event.id,
+    project_id: event.project_id,
+    event_name: event.name,
+    event_time: toIso(event.created_at),
+    // device_id doubles as the anonymous profile id; only surface a real,
+    // external user id.
+    user_id:
+      event.profile_id && event.profile_id !== event.device_id
+        ? event.profile_id
+        : null,
+    session_id: event.session_id || null,
+    device_id: event.device_id || null,
+    properties: event.properties ?? {},
+    country: event.country || null,
+    city: event.city || null,
+    region: event.region || null,
+    os: event.os || null,
+    browser: event.browser || null,
+    device: event.device || null,
+    path: event.path || null,
+    origin: event.origin || null,
+    referrer: event.referrer || null,
+    ingested_at: toIso(event.inserted_at || event.created_at),
+    schema_version: EXPORT_SCHEMA_VERSION,
+  };
+}
diff --git a/packages/db/src/exports/index.ts b/packages/db/src/exports/index.ts
new file mode 100644
index 000000000..0aed4a1a7
--- /dev/null
+++ b/packages/db/src/exports/index.ts
@@ -0,0 +1,25 @@
+export {
+  createBatch,
+  generateBatchPath,
+  getFileExtension,
+  getContentType,
+  type ExportFormat,
+  type IBatchInfo,
+  type IBatchFile,
+  type IBatchResult,
+} from './batch-creator';
+
+export {
+  createManifest,
+  serializeManifest,
+  parseManifest,
+  MANIFEST_FILENAME,
+  MANIFEST_CONTENT_TYPE,
+  type IManifest,
+} from './manifest';
+
+export {
+  clickhouseEventToExportEvent,
+  EXPORT_SCHEMA_VERSION,
+  type IExportEvent,
+} from './export-event';
diff --git a/packages/db/src/exports/manifest.ts b/packages/db/src/exports/manifest.ts
new file mode 100644
index 000000000..529614c5a
--- /dev/null
+++ b/packages/db/src/exports/manifest.ts
@@ -0,0 +1,70 @@
+import type { ExportFormat, IBatchInfo } from './batch-creator';
+
+/**
+ * Manifest file structure
+ * This file is uploaded LAST to signal that the batch is complete and ready for loading
+ */
+export interface IManifest {
+  batch_id: string;
+  project_id: string;
+  integration_id: string;
+  format: ExportFormat;
+  files: string[];
+  record_count: number;
+  min_event_time: string;
+  max_event_time: string;
+  schema_version: number;
+  created_at: string;
+  // Partition info for easy discovery
+  partition_date: string; // YYYY-MM-DD
+  partition_hour: string; // HH
+}
+
+const CURRENT_SCHEMA_VERSION = 1;
+
+/**
+ * Create a manifest for a batch
+ */
+export function createManifest(
+  batchInfo: IBatchInfo,
+  fileNames: string[],
+): IManifest {
+  return {
+    batch_id: batchInfo.batchId,
+    project_id: batchInfo.projectId,
+    integration_id: batchInfo.integrationId,
+    format: batchInfo.format,
+    files: fileNames,
+    record_count: batchInfo.recordCount,
+    min_event_time: batchInfo.minEventTime,
+    max_event_time: batchInfo.maxEventTime,
+    schema_version: CURRENT_SCHEMA_VERSION,
+    created_at: batchInfo.createdAt,
+    partition_date: batchInfo.partitionDate,
+    partition_hour: batchInfo.partitionHour,
+  };
+}
+
+/**
+ * Serialize manifest to JSON
+ */
+export function serializeManifest(manifest: IManifest): string {
+  return JSON.stringify(manifest, null, 2);
+}
+
+/**
+ * Parse a manifest from JSON
+ */
+export function parseManifest(json: string): IManifest {
+  return JSON.parse(json) as IManifest;
+}
+
+/**
+ * Manifest filename (always the same)
+ */
+export const MANIFEST_FILENAME = 'manifest.json';
+
+/**
+ * Manifest content type
+ */
+export const MANIFEST_CONTENT_TYPE = 'application/json';
diff --git a/packages/db/src/services/event.service.ts b/packages/db/src/services/event.service.ts
index 981c17f1d..c3167f294 100644
--- a/packages/db/src/services/event.service.ts
+++ b/packages/db/src/services/event.service.ts
@@ -90,6 +90,11 @@ export interface IClickhouseEvent {
   brand: string;
   model: string;
   imported_at: string | null;
+  // Ingestion (ClickHouse-insert) time. Set explicitly at insert time; the
+  // column DEFAULTs to created_at for rows that omit it. Used as the cursor for
+  // object-store exports. Optional here because most read queries don't select
+  // it.
+  inserted_at?: string;
   sdk_name: string;
   sdk_version: string;
   revenue?: number;
@@ -400,6 +405,10 @@ export async function createEvent(payload: IServiceCreateEventPayload) {
     referrer_name: payload.referrerName ?? '',
     referrer_type: payload.referrerType ?? '',
     imported_at: null,
+    // Ingestion time, used as the export cursor. Stamped here rather than via the
+    // column DEFAULT so backdated events (server-side, offline, past timestamps)
+    // still get a real, monotonic-ish insert time instead of their event time.
+    inserted_at: DateTime.utc().toFormat('yyyy-MM-dd HH:mm:ss.SSS'),
     sdk_name: payload.sdkName ?? '',
     sdk_version: payload.sdkVersion ?? '',
     revenue: payload.revenue,
diff --git a/packages/db/src/services/import.service.ts b/packages/db/src/services/import.service.ts
index 66a04222a..dc4b3b622 100644
--- a/packages/db/src/services/import.service.ts
+++ b/packages/db/src/services/import.service.ts
@@ -453,14 +453,14 @@ export async function moveImportsToProduction(
       session_id, path, origin, referrer, referrer_name, referrer_type,
       duration, properties, created_at, country, city, region,
       longitude, latitude, os, os_version, browser, browser_version,
-      device, brand, model, imported_at
+      device, brand, model, imported_at, inserted_at
     )
-    SELECT 
+    SELECT
       id, name, sdk_name, sdk_version, device_id, profile_id, project_id,
       session_id, path, origin, referrer, referrer_name, referrer_type,
       duration, properties, created_at, country, city, region,
       longitude, latitude, os, os_version, browser, browser_version,
-      device, brand, model, imported_at
+      device, brand, model, imported_at, now64(3) AS inserted_at
     FROM ${TABLE_NAMES.events_imports}
     WHERE ${whereClause}
     ORDER BY created_at ASC
diff --git a/packages/integrations/package.json b/packages/integrations/package.json
index 59acc578f..6dcd4f516 100644
--- a/packages/integrations/package.json
+++ b/packages/integrations/package.json
@@ -7,13 +7,18 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0",
+    "@openpanel/common": "workspace:*",
     "@slack/bolt": "^3.18.0",
     "@slack/oauth": "^3.0.0"
   },
   "devDependencies": {
+    "@openpanel/logger": "workspace:*",
     "@openpanel/tsconfig": "workspace:*",
     "@openpanel/validation": "workspace:*",
     "@types/node": "catalog:",
     "typescript": "catalog:"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/integrations/src/object-store/gcs-adapter.ts b/packages/integrations/src/object-store/gcs-adapter.ts
new file mode 100644
index 000000000..ebfa035a0
--- /dev/null
+++ b/packages/integrations/src/object-store/gcs-adapter.ts
@@ -0,0 +1,165 @@
+import { Storage } from '@google-cloud/storage';
+import { decryptCredential } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+import type { IGCSExportConfig } from '@openpanel/validation';
+
+import type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
+
+const logger = createLogger({ name: 'gcs-adapter' });
+
+/**
+ * GCS Adapter for uploading export batches to Google Cloud Storage
+ * Uses service account credentials for authentication
+ */
+export class GCSAdapter implements IObjectStoreAdapter {
+  private config: IGCSExportConfig;
+  private storage: Storage | null = null;
+
+  constructor(config: IGCSExportConfig) {
+    // Decrypt the service account key if encrypted
+    this.config = {
+      ...config,
+      serviceAccountKey: decryptCredential(config.serviceAccountKey),
+    };
+  }
+
+  /**
+   * Get or create a GCS Storage client
+   */
+  private getStorage(): Storage {
+    if (this.storage) {
+      return this.storage;
+    }
+
+    try {
+      // Parse the service account key JSON
+      const credentials = JSON.parse(this.config.serviceAccountKey);
+
+      this.storage = new Storage({
+        credentials,
+        projectId: credentials.project_id,
+      });
+
+      logger.debug(
+        {
+          projectId: credentials.project_id,
+        },
+        'GCS client created',
+      );
+
+      return this.storage;
+    } catch (error) {
+      logger.error({ error }, 'Failed to create GCS client');
+      throw new Error('Invalid service account key JSON');
+    }
+  }
+
+  /**
+   * Upload a single file to GCS
+   */
+  async upload(options: IUploadOptions): Promise<IUploadResult> {
+    const storage = this.getStorage();
+    const bucket = storage.bucket(options.bucket);
+    const file = bucket.file(options.key);
+
+    try {
+      const content =
+        typeof options.content === 'string'
+          ? Buffer.from(options.content)
+          : options.content;
+
+      await file.save(content, {
+        contentType: options.contentType,
+        resumable: false, // For small files, non-resumable is faster
+        metadata: {
+          contentType: options.contentType,
+        },
+      });
+
+      // Get file metadata to retrieve the generation (similar to etag)
+      const [metadata] = await file.getMetadata();
+
+      logger.debug(
+        {
+          bucket: options.bucket,
+          key: options.key,
+          generation: metadata.generation,
+        },
+        'File uploaded to GCS',
+      );
+
+      return {
+        bucket: options.bucket,
+        key: options.key,
+        etag: metadata.etag || undefined,
+        location: `gs://${options.bucket}/${options.key}`,
+      };
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          bucket: options.bucket,
+          key: options.key,
+        },
+        'Failed to upload file to GCS',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Upload multiple files to GCS
+   */
+  async uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>> {
+    const results = await Promise.allSettled(
+      options.map((opt) => this.upload(opt)),
+    );
+
+    return results.map((result) => {
+      if (result.status === 'fulfilled') {
+        return result.value;
+      }
+      return result.reason instanceof Error
+        ? result.reason
+        : new Error(String(result.reason));
+    });
+  }
+
+  /**
+   * Test the connection to GCS bucket
+   */
+  async testConnection(): Promise<{ success: boolean; error?: string }> {
+    try {
+      const storage = this.getStorage();
+      const bucket = storage.bucket(this.config.bucket);
+
+      // Check if bucket exists and we have access
+      const [exists] = await bucket.exists();
+
+      if (!exists) {
+        return {
+          success: false,
+          error: `Bucket '${this.config.bucket}' does not exist or is not accessible`,
+        };
+      }
+
+      return { success: true };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      return { success: false, error: message };
+    }
+  }
+}
+
+/**
+ * Create a GCS adapter from integration config
+ */
+export function createGCSAdapter(config: IGCSExportConfig): GCSAdapter {
+  return new GCSAdapter(config);
+}
diff --git a/packages/integrations/src/object-store/index.ts b/packages/integrations/src/object-store/index.ts
new file mode 100644
index 000000000..dbfd87e7a
--- /dev/null
+++ b/packages/integrations/src/object-store/index.ts
@@ -0,0 +1,7 @@
+export { S3Adapter, createS3Adapter } from './s3-adapter';
+export { GCSAdapter, createGCSAdapter } from './gcs-adapter';
+export type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
diff --git a/packages/integrations/src/object-store/s3-adapter.ts b/packages/integrations/src/object-store/s3-adapter.ts
new file mode 100644
index 000000000..2db5e4c4e
--- /dev/null
+++ b/packages/integrations/src/object-store/s3-adapter.ts
@@ -0,0 +1,293 @@
+import {
+  HeadBucketCommand,
+  PutObjectCommand,
+  type PutObjectCommandInput,
+  S3Client,
+} from '@aws-sdk/client-s3';
+import { AssumeRoleCommand, STSClient } from '@aws-sdk/client-sts';
+import { decryptCredential } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+import type { IS3ExportConfig } from '@openpanel/validation';
+
+import type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
+
+const logger = createLogger({ name: 's3-adapter' });
+
+/**
+ * S3 Adapter for uploading export batches to AWS S3 or S3-compatible storage
+ * Supports two authentication modes:
+ * - IAM role assumption (AWS best practice)
+ * - Access keys (for R2, MinIO, DigitalOcean Spaces, etc.)
+ */
+export class S3Adapter implements IObjectStoreAdapter {
+  private config: IS3ExportConfig;
+  private clientPromise: Promise<S3Client> | null = null;
+  private clientExpiresAt = 0;
+
+  constructor(config: IS3ExportConfig) {
+    // Decrypt secretAccessKey if present and encrypted
+    if (config.authMode === 'access_key') {
+      this.config = {
+        ...config,
+        secretAccessKey: decryptCredential(config.secretAccessKey),
+      };
+    } else {
+      this.config = config;
+    }
+  }
+
+  /**
+   * Get or create an S3 client based on auth mode
+   */
+  private async getClient(): Promise<S3Client> {
+    if (this.config.authMode === 'iam_role') {
+      return this.getClientWithAssumedRole();
+    }
+    return this.getClientWithAccessKeys();
+  }
+
+  /**
+   * Get or create an S3 client using static access keys
+   * For R2, MinIO, DigitalOcean Spaces, etc.
+   */
+  private getClientWithAccessKeys(): S3Client {
+    // Access key clients don't expire, reuse if available
+    if (this.clientPromise && this.clientExpiresAt === 0) {
+      return this.clientPromise as unknown as S3Client;
+    }
+
+    if (this.config.authMode !== 'access_key') {
+      throw new Error('Access key auth mode required but IAM role config provided');
+    }
+
+    const client = new S3Client({
+      region: this.config.region,
+      endpoint: this.config.endpoint,
+      credentials: {
+        accessKeyId: this.config.accessKeyId,
+        secretAccessKey: this.config.secretAccessKey,
+      },
+      // For R2, MinIO, etc.: force path-style addressing
+      forcePathStyle: !!this.config.endpoint,
+    });
+
+    logger.debug(
+      {
+        region: this.config.region,
+        endpoint: this.config.endpoint || 'default',
+      },
+      'S3 client created with access keys',
+    );
+
+    // Mark as non-expiring
+    this.clientExpiresAt = 0;
+    this.clientPromise = Promise.resolve(client);
+
+    return client;
+  }
+
+  /**
+   * Get or create an S3 client with assumed role credentials
+   */
+  private async getClientWithAssumedRole(): Promise<S3Client> {
+    const now = Date.now();
+
+    // Reuse client if credentials haven't expired (with 5 min buffer)
+    if (this.clientPromise && this.clientExpiresAt > now + 5 * 60 * 1000) {
+      return this.clientPromise;
+    }
+
+    this.clientPromise = this.createClientWithAssumedRole();
+    return this.clientPromise;
+  }
+
+  /**
+   * Create an S3 client by assuming the customer's IAM role
+   */
+  private async createClientWithAssumedRole(): Promise<S3Client> {
+    if (this.config.authMode !== 'iam_role') {
+      throw new Error('IAM role auth mode required but access key config provided');
+    }
+
+    const stsClient = new STSClient({ region: this.config.region });
+
+    const assumeRoleParams: {
+      RoleArn: string;
+      RoleSessionName: string;
+      DurationSeconds: number;
+      ExternalId?: string;
+    } = {
+      RoleArn: this.config.roleArn,
+      RoleSessionName: 'OpenPanelExport',
+      DurationSeconds: 3600, // 1 hour
+    };
+
+    if (this.config.externalId) {
+      assumeRoleParams.ExternalId = this.config.externalId;
+    }
+
+    try {
+      const assumeRoleCommand = new AssumeRoleCommand(assumeRoleParams);
+      const assumeRoleResponse = await stsClient.send(assumeRoleCommand);
+
+      const credentials = assumeRoleResponse.Credentials;
+      if (!credentials) {
+        throw new Error('Failed to assume role: no credentials returned');
+      }
+
+      // Track when credentials expire
+      this.clientExpiresAt =
+        credentials.Expiration?.getTime() || Date.now() + 3600 * 1000;
+
+      const s3Client = new S3Client({
+        region: this.config.region,
+        credentials: {
+          accessKeyId: credentials.AccessKeyId!,
+          secretAccessKey: credentials.SecretAccessKey!,
+          sessionToken: credentials.SessionToken,
+        },
+      });
+
+      logger.debug(
+        {
+          roleArn: this.config.roleArn,
+          expiresAt: new Date(this.clientExpiresAt).toISOString(),
+        },
+        'S3 client created with assumed role',
+      );
+
+      return s3Client;
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          roleArn: this.config.roleArn,
+        },
+        'Failed to assume role for S3 access',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Get encryption parameters based on config
+   */
+  private getEncryptionParams(): Partial<PutObjectCommandInput> {
+    const encryption = this.config.encryption || 'SSE-S3';
+
+    switch (encryption) {
+      case 'SSE-S3':
+        return {
+          ServerSideEncryption: 'AES256',
+        };
+      case 'SSE-KMS':
+        return {
+          ServerSideEncryption: 'aws:kms',
+          SSEKMSKeyId: this.config.kmsKeyId,
+        };
+      case 'none':
+        return {};
+      default:
+        return {
+          ServerSideEncryption: 'AES256',
+        };
+    }
+  }
+
+  /**
+   * Upload a single file to S3
+   */
+  async upload(options: IUploadOptions): Promise<IUploadResult> {
+    const client = await this.getClient();
+
+    const putParams: PutObjectCommandInput = {
+      Bucket: options.bucket,
+      Key: options.key,
+      Body: options.content,
+      ContentType: options.contentType,
+      ...this.getEncryptionParams(),
+    };
+
+    try {
+      const command = new PutObjectCommand(putParams);
+      const response = await client.send(command);
+
+      logger.debug(
+        {
+          bucket: options.bucket,
+          key: options.key,
+          etag: response.ETag,
+        },
+        'File uploaded to S3',
+      );
+
+      return {
+        bucket: options.bucket,
+        key: options.key,
+        etag: response.ETag,
+        location: `s3://${options.bucket}/${options.key}`,
+      };
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          bucket: options.bucket,
+          key: options.key,
+        },
+        'Failed to upload file to S3',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Upload multiple files to S3
+   */
+  async uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>> {
+    const results = await Promise.allSettled(
+      options.map((opt) => this.upload(opt)),
+    );
+
+    return results.map((result) => {
+      if (result.status === 'fulfilled') {
+        return result.value;
+      }
+      return result.reason instanceof Error
+        ? result.reason
+        : new Error(String(result.reason));
+    });
+  }
+
+  /**
+   * Test the connection to S3 bucket
+   */
+  async testConnection(): Promise<{ success: boolean; error?: string }> {
+    try {
+      const client = await this.getClient();
+
+      const command = new HeadBucketCommand({
+        Bucket: this.config.bucket,
+      });
+
+      await client.send(command);
+
+      return { success: true };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      return { success: false, error: message };
+    }
+  }
+}
+
+/**
+ * Create an S3 adapter from integration config
+ */
+export function createS3Adapter(config: IS3ExportConfig): S3Adapter {
+  return new S3Adapter(config);
+}
diff --git a/packages/integrations/src/object-store/types.ts b/packages/integrations/src/object-store/types.ts
new file mode 100644
index 000000000..b28c86fc5
--- /dev/null
+++ b/packages/integrations/src/object-store/types.ts
@@ -0,0 +1,45 @@
+/**
+ * Common types for object store adapters
+ */
+
+/**
+ * Upload options for object store adapters
+ */
+export interface IUploadOptions {
+  bucket: string;
+  key: string;
+  content: Buffer | string;
+  contentType: string;
+}
+
+/**
+ * Result of an upload operation
+ */
+export interface IUploadResult {
+  bucket: string;
+  key: string;
+  etag?: string;
+  location?: string;
+}
+
+/**
+ * Object store adapter interface
+ */
+export interface IObjectStoreAdapter {
+  /**
+   * Upload a file to object storage
+   */
+  upload(options: IUploadOptions): Promise<IUploadResult>;
+
+  /**
+   * Upload multiple files to object storage
+   */
+  uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>>;
+
+  /**
+   * Check if the adapter is properly configured and can connect
+   */
+  testConnection(): Promise<{ success: boolean; error?: string }>;
+}
diff --git a/packages/queue/src/queues.ts b/packages/queue/src/queues.ts
index 9683374ac..7592591f3 100644
--- a/packages/queue/src/queues.ts
+++ b/packages/queue/src/queues.ts
@@ -160,6 +160,10 @@ export type CronQueuePayloadWeeklyDigest = {
   type: 'weeklyDigest';
   payload: undefined;
 };
+export type CronQueuePayloadFlushExports = {
+  type: 'flushExports';
+  payload: undefined;
+};
 export type CronQueuePayload =
   | CronQueuePayloadSalt
   | CronQueuePayloadFlushEvents
@@ -168,6 +172,7 @@ export type CronQueuePayload =
   | CronQueuePayloadFlushProfileBackfill
   | CronQueuePayloadFlushReplay
   | CronQueuePayloadFlushGroups
+  | CronQueuePayloadFlushExports
   | CronQueuePayloadPing
   | CronQueuePayloadDelete
   | CronQueuePayloadInsightsDaily
diff --git a/packages/trpc/src/routers/integration.ts b/packages/trpc/src/routers/integration.ts
index 3efbd063b..dadc8112e 100644
--- a/packages/trpc/src/routers/integration.ts
+++ b/packages/trpc/src/routers/integration.ts
@@ -1,11 +1,18 @@
 import { z } from 'zod';
 
 import { BASE_INTEGRATIONS, db } from '@openpanel/db';
+import { encryptCredential } from '@openpanel/common/server';
 
+import {
+  createS3Adapter,
+  createGCSAdapter,
+} from '@openpanel/integrations/src/object-store';
 import { getSlackInstallUrl } from '@openpanel/integrations/src/slack';
 import {
   type ISlackConfig,
   zCreateDiscordIntegration,
+  zCreateGCSExportIntegration,
+  zCreateS3ExportIntegration,
   zCreateSlackIntegration,
   zCreateWebhookIntegration,
 } from '@openpanel/validation';
@@ -130,6 +137,79 @@ export const integrationRouter = createTRPCRouter({
         },
       });
     }),
+  createOrUpdateExport: protectedProcedure
+    .input(
+      z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]),
+    )
+    .mutation(async ({ input }) => {
+      // Test connection before saving (using unencrypted credentials)
+      if (input.config.type === 's3_export') {
+        const adapter = createS3Adapter(input.config);
+        const testResult = await adapter.testConnection();
+        if (!testResult.success) {
+          throw new TRPCBadRequestError(
+            `Failed to connect to S3: ${testResult.error}`,
+          );
+        }
+      } else if (input.config.type === 'gcs_export') {
+        const adapter = createGCSAdapter(input.config);
+        const testResult = await adapter.testConnection();
+        if (!testResult.success) {
+          throw new TRPCBadRequestError(
+            `Failed to connect to GCS: ${testResult.error}`,
+          );
+        }
+      }
+
+      // Encrypt sensitive credentials before storing
+      let configToSave = input.config;
+      if (input.config.type === 's3_export' && input.config.authMode === 'access_key') {
+        configToSave = {
+          ...input.config,
+          secretAccessKey: encryptCredential(input.config.secretAccessKey),
+        };
+      } else if (input.config.type === 'gcs_export') {
+        configToSave = {
+          ...input.config,
+          serviceAccountKey: encryptCredential(input.config.serviceAccountKey),
+        };
+      }
+
+      if (input.id) {
+        return db.integration.update({
+          where: {
+            id: input.id,
+            organizationId: input.organizationId,
+          },
+          data: {
+            name: input.name,
+            config: configToSave,
+          },
+        });
+      }
+      return db.integration.create({
+        data: {
+          name: input.name,
+          organizationId: input.organizationId,
+          config: configToSave,
+        },
+      });
+    }),
+  testExportConnection: protectedProcedure
+    .input(
+      z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]),
+    )
+    .mutation(async ({ input }) => {
+      if (input.config.type === 's3_export') {
+        const adapter = createS3Adapter(input.config);
+        return adapter.testConnection();
+      }
+      if (input.config.type === 'gcs_export') {
+        const adapter = createGCSAdapter(input.config);
+        return adapter.testConnection();
+      }
+      return { success: false, error: 'Unknown export type' };
+    }),
   delete: protectedProcedure
     .input(z.object({ id: z.string() }))
     .mutation(async ({ input: { id }, ctx }) => {
diff --git a/packages/validation/src/index.ts b/packages/validation/src/index.ts
index bd1c7a45e..31483aeb4 100644
--- a/packages/validation/src/index.ts
+++ b/packages/validation/src/index.ts
@@ -449,12 +449,67 @@ export const zEmailConfig = z.object({
 });
 export type IEmailConfig = z.infer<typeof zEmailConfig>;
 
+// S3 Export Integration Config - Base fields shared by both auth modes
+const zS3ExportConfigBase = z.object({
+  type: z.literal('s3_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  region: z.string().min(1, 'Region is required'),
+  endpoint: z.string().url().optional(), // For R2, MinIO, etc.
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Optional encryption settings (S3-side encryption)
+  encryption: z.enum(['SSE-S3', 'SSE-KMS', 'none']).default('SSE-S3'),
+  kmsKeyId: z.string().optional(),
+});
+
+// Auth mode: IAM Role assumption (AWS best practice)
+const zS3AuthIamRole = z.object({
+  authMode: z.literal('iam_role'),
+  roleArn: z.string().min(1, 'IAM Role ARN is required'),
+  externalId: z.string().optional(),
+});
+
+// Auth mode: Access Keys (for R2, MinIO, DigitalOcean Spaces, etc.)
+const zS3AuthAccessKey = z.object({
+  authMode: z.literal('access_key'),
+  accessKeyId: z.string().min(1, 'Access Key ID is required'),
+  secretAccessKey: z.string().min(1, 'Secret Access Key is required'),
+});
+
+// S3 config with IAM role auth
+export const zS3ExportConfigIamRole = zS3ExportConfigBase.merge(zS3AuthIamRole);
+export type IS3ExportConfigIamRole = z.infer<typeof zS3ExportConfigIamRole>;
+
+// S3 config with access key auth
+export const zS3ExportConfigAccessKey = zS3ExportConfigBase.merge(zS3AuthAccessKey);
+export type IS3ExportConfigAccessKey = z.infer<typeof zS3ExportConfigAccessKey>;
+
+// Combined discriminated union
+export const zS3ExportConfig = z.discriminatedUnion('authMode', [
+  zS3ExportConfigIamRole,
+  zS3ExportConfigAccessKey,
+]);
+export type IS3ExportConfig = z.infer<typeof zS3ExportConfig>;
+
+// GCS Export Integration Config
+export const zGCSExportConfig = z.object({
+  type: z.literal('gcs_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Service account credentials (JSON key as string)
+  serviceAccountKey: z.string().min(1, 'Service account key is required'),
+});
+export type IGCSExportConfig = z.infer<typeof zGCSExportConfig>;
+
 export type IIntegrationConfig =
   | ISlackConfig
   | IDiscordConfig
   | IWebhookConfig
   | IAppConfig
-  | IEmailConfig;
+  | IEmailConfig
+  | IS3ExportConfig
+  | IGCSExportConfig;
 
 const zCreateIntegration = z.object({
   id: z.string().optional(),
@@ -472,6 +527,18 @@ export const zCreateDiscordIntegration = zCreateIntegration.extend({
   config: zDiscordConfig,
 });
 
+export const zCreateS3ExportIntegration = zCreateIntegration.merge(
+  z.object({
+    config: zS3ExportConfig,
+  }),
+);
+
+export const zCreateGCSExportIntegration = zCreateIntegration.merge(
+  z.object({
+    config: zGCSExportConfig,
+  }),
+);
+
 export const zNotificationRuleEventConfig = z.object({
   type: z.literal('events'),
   events: z.array(zChartEvent),
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d0048263b..5a7004473 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -121,6 +121,12 @@ importers:
 
   apps/api:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
       '@better-agent/adapters':
         specifier: ^0.1.0-beta.3
         version: 0.1.0-beta.3(@better-agent/core@0.1.0-beta.3)
@@ -148,6 +154,9 @@ importers:
       '@fastify/websocket':
         specifier: ^11.2.0
         version: 11.2.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
       '@hyperdx/node-opentelemetry':
         specifier: 'catalog:'
         version: 0.10.3
@@ -986,12 +995,21 @@ importers:
 
   apps/worker:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
       '@bull-board/api':
         specifier: 6.14.0
         version: 6.14.0(@bull-board/ui@6.14.0)
       '@bull-board/express':
         specifier: 6.14.0
         version: 6.14.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
       '@hyperdx/node-opentelemetry':
         specifier: 'catalog:'
         version: 0.10.3
@@ -1031,6 +1049,9 @@ importers:
       '@openpanel/redis':
         specifier: workspace:*
         version: link:../../packages/redis
+      '@openpanel/validation':
+        specifier: workspace:*
+        version: link:../../packages/validation
       bullmq:
         specifier: ^5.63.0
         version: 5.63.0
@@ -1456,6 +1477,18 @@ importers:
 
   packages/integrations:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
+      '@openpanel/common':
+        specifier: workspace:*
+        version: link:../common
       '@slack/bolt':
         specifier: ^3.18.0
         version: 3.21.4
@@ -1463,6 +1496,9 @@ importers:
         specifier: ^3.0.0
         version: 3.0.1
     devDependencies:
+      '@openpanel/logger':
+        specifier: workspace:*
+        version: link:../logger
       '@openpanel/tsconfig':
         specifier: workspace:*
         version: link:../../tooling/typescript
@@ -2144,14 +2180,26 @@ packages:
     resolution: {integrity: sha512-xTEaPjZwOqVjGbLOP7qzwbdOWJOo1ne2mUhTZwEBBkPvNk4aXB/vcYwWwrjoSWUqtit4+GDbO75ePc/S6TUJYQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-sts@3.1073.0':
+    resolution: {integrity: sha512-ZJTSvyXOcufw8zpj0+IgzFhz81DcA8OpFpfdaNP7aDY8YFsWp5e5J5l1TLQbr+EfH+sSjgvkU2mP14ceqK6lCA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/core@3.973.10':
     resolution: {integrity: sha512-4u/FbyyT3JqzfsESI70iFg6e2yp87MB5kS2qcxIA66m52VSTN1fvuvbCY1h/LKq1LvuxIrlJ1ItcyjvcKoaPLg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/core@3.974.23':
+    resolution: {integrity: sha512-MiWR/uWjxjFXGzrE0Ghc5lWxUxzHsUWFhV+OX7M4cR9SrmrnZs6TXavnCWnzzdwJeFri34xQo81rvGNzK3c4BQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/crc64-nvme@3.972.0':
     resolution: {integrity: sha512-ThlLhTqX68jvoIVv+pryOdb5coP1cX1/MaTbB9xkGDCbWbsqQcLqzPxuSoW1DCnAAIacmXCWpzUNOB9pv+xXQw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-env@3.972.49':
+    resolution: {integrity: sha512-liB3yQNHCM9k/gu/w36XHMKPluT7HTlnGUhRbBGSISDQkcr/Sy1zsZabiuvQj8WG5yW573u9RehrBvvnIQ9OEQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-env@3.972.8':
     resolution: {integrity: sha512-r91OOPAcHnLCSxaeu/lzZAVRCZ/CtTNuwmJkUwpwSDshUrP7bkX1OmFn2nUMWd9kN53Q4cEo8b7226G4olt2Mg==}
     engines: {node: '>=20.0.0'}
@@ -2160,26 +2208,54 @@ packages:
     resolution: {integrity: sha512-DTtuyXSWB+KetzLcWaSahLJCtTUe/3SXtlGp4ik9PCe9xD6swHEkG8n8/BNsQ9dsihb9nhFvuUB4DpdBGDcvVg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-http@3.972.51':
+    resolution: {integrity: sha512-XET0H2oofciJ5lMRWNIvRjAP7Q3wv2XT+JtJJEdhPWUMwe3TvQ9qcxonpu7vXmNngncvFpi4E2It+Tamas/naA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-ini@3.972.56':
+    resolution: {integrity: sha512-IAmc61hbgQiHht9U3x0tnRwz0lzdwOwD/i9voRgdJrKamF+JtmrBOsW9GwB7mfFonNWOWL4qARWYrF8veEMe3w==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-ini@3.972.8':
     resolution: {integrity: sha512-n2dMn21gvbBIEh00E8Nb+j01U/9rSqFIamWRdGm/mE5e+vHQ9g0cBNdrYFlM6AAiryKVHZmShWT9D1JAWJ3ISw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-login@3.972.55':
+    resolution: {integrity: sha512-hBBkANo3cDn+h2qxxzER4a+J8JCO9o9Z/YYmU7iky6AcaarX5RRdRcHNC6SLdwY0vAXQygn6soUbDqPn3GghaA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-login@3.972.8':
     resolution: {integrity: sha512-rMFuVids8ICge/X9DF5pRdGMIvkVhDV9IQFQ8aTYk6iF0rl9jOUa1C3kjepxiXUlpgJQT++sLZkT9n0TMLHhQw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-node@3.972.58':
+    resolution: {integrity: sha512-OyCLVmSI7pZO8hxwNVX6pXhTVlJqRBTp+ijdEfJSUj0RyjHnF602OfAarOzGq6wkGodeFkYBt8MmJ6A6ycRgWw==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-node@3.972.9':
     resolution: {integrity: sha512-LfJfO0ClRAq2WsSnA9JuUsNyIicD2eyputxSlSL0EiMrtxOxELLRG6ZVYDf/a1HCepaYPXeakH4y8D5OLCauag==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-process@3.972.49':
+    resolution: {integrity: sha512-C8h36lBuC/RnBSsjlO+dn6xZm3KbAl5vpJaVPAfQnMmz2/OISmKOc8XZcqMQgO2ADwBYNRMM6Kf3vz9G/TulMQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-process@3.972.8':
     resolution: {integrity: sha512-6cg26ffFltxM51OOS8NH7oE41EccaYiNlbd5VgUYwhiGCySLfHoGuGrLm2rMB4zhy+IO5nWIIG0HiodX8zdvHA==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-sso@3.972.55':
+    resolution: {integrity: sha512-1FkOz74Ea5QGS9jtIoXp55T/IkSS3spv+nLTT07fRY/+T5xmEOqaYBVIaEmX4zTNvbV6g2lrtlaVKWEoNyJt3w==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-sso@3.972.8':
     resolution: {integrity: sha512-35kqmFOVU1n26SNv+U37sM8b2TzG8LyqAcd6iM9gprqxyHEh/8IM3gzN4Jzufs3qM6IrH8e43ryZWYdvfVzzKQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-web-identity@3.972.55':
+    resolution: {integrity: sha512-g2BoECD1q01kTPByi56+VLVvdWDzMkKIcr77qixpqH0okw2t0U5CoPv+6S8v/D1Y2Wa6QKKtn6XAtDzP+Kfpvg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-web-identity@3.972.8':
     resolution: {integrity: sha512-CZhN1bOc1J3ubQPqbmr5b4KaMJBgdDvYsmEIZuX++wFlzmZsKj1bwkaiTEb5U2V7kXuzLlpF5HJSOM9eY/6nGA==}
     engines: {node: '>=20.0.0'}
@@ -2244,6 +2320,10 @@ packages:
     resolution: {integrity: sha512-3NA0s66vsy8g7hPh36ZsUgO4SiMyrhwcYvuuNK1PezO52vX3hXDW4pQrC6OQLGKGJV0o6tbEyQtXb/mPs8zg8w==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/nested-clients@3.997.23':
+    resolution: {integrity: sha512-gO93ZPsI2bxeFZD42f1/qjDw6FAZkNZcKRO94LIiT03fzOmcJ9e/tunxjVjA1Rl69ClmVJzz8H3G9CdKef10PA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/region-config-resolver@3.972.3':
     resolution: {integrity: sha512-v4J8qYAWfOMcZ4MJUyatntOicTzEMaU7j3OpkRCGGFSL2NgXQ5VbxauIyORA+pxdKZ0qQG2tCQjQjZDlXEC3Ow==}
     engines: {node: '>=20.0.0'}
@@ -2252,6 +2332,14 @@ packages:
     resolution: {integrity: sha512-TaWbfYCwnuOSvDSrgs7QgoaoXse49E7LzUkVOUhoezwB7bkmhp+iojADm7UepCEu4021SquD7NG1xA+WCvmldA==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/signature-v4-multi-region@3.996.35':
+    resolution: {integrity: sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/token-providers@3.1074.0':
+    resolution: {integrity: sha512-pv80IzgGW4RnXWtft692chZOM9i6PhebVsLCcnaM4dBEPZva2fE6FXAHs76G7Rc7s3yGyX/68G0nZMrUy+Vmpg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/token-providers@3.990.0':
     resolution: {integrity: sha512-L3BtUb2v9XmYgQdfGBzbBtKMXaP5fV973y3Qdxeevs6oUTVXFmi/mV1+LnScA/1wVPJC9/hlK+1o5vbt7cG7EQ==}
     engines: {node: '>=20.0.0'}
@@ -2260,6 +2348,10 @@ packages:
     resolution: {integrity: sha512-DwHBiMNOB468JiX6+i34c+THsKHErYUdNQ3HexeXZvVn4zouLjgaS4FejiGSi2HyBuzuyHg7SuOPmjSvoU9NRg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/types@3.973.13':
+    resolution: {integrity: sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/util-arn-parser@3.972.2':
     resolution: {integrity: sha512-VkykWbqMjlSgBFDyrY3nOSqupMc6ivXuGmvci6Q3NnLq5kC+mKQe2QBZ4nrWRE/jqOxeFP2uYzLtwncYYcvQDg==}
     engines: {node: '>=20.0.0'}
@@ -2288,6 +2380,10 @@ packages:
       aws-crt:
         optional: true
 
+  '@aws-sdk/xml-builder@3.972.31':
+    resolution: {integrity: sha512-SzE4Pgyl+hDF+BuyuzxUSpwnuUu9lJuO1YGgteG89/4Qv0+2IQiVQqdbPV32IozLvXWQChPQcdkk/sKvb1QHiQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/xml-builder@3.972.4':
     resolution: {integrity: sha512-0zJ05ANfYqI6+rGqj8samZBFod0dPPousBjLEqg8WdxSgbMAkRgLyn81lP215Do0rFJ/17LIXwr7q0yK24mP6Q==}
     engines: {node: '>=20.0.0'}
@@ -4867,6 +4963,22 @@ packages:
   '@gar/promisify@1.1.3':
     resolution: {integrity: sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==}
 
+  '@google-cloud/paginator@5.0.2':
+    resolution: {integrity: sha512-DJS3s0OVH4zFDB1PzjxAsHqJT6sKVbRwwML0ZBP9PbU7Yebtu/7SWMRzvO2J3nUi9pRNITCfu4LJeooM2w4pjg==}
+    engines: {node: '>=14.0.0'}
+
+  '@google-cloud/projectify@4.0.0':
+    resolution: {integrity: sha512-MmaX6HeSvyPbWGwFq7mXdo0uQZLGBYCwziiLIGq5JVX+/bdI3SAq6bP98trV5eTWfLuvsMcIC1YJOF2vfteLFA==}
+    engines: {node: '>=14.0.0'}
+
+  '@google-cloud/promisify@4.0.0':
+    resolution: {integrity: sha512-Orxzlfb9c67A15cq2JQEyVc7wEsmFBmHjZWZYQMUyJ1qivXyMwdyNOs9odi79hze+2zqdTtu1E19IM/FtqZ10g==}
+    engines: {node: '>=14'}
+
+  '@google-cloud/storage@7.21.0':
+    resolution: {integrity: sha512-l+IFTkd+6Y5LoAuXyYCKNAKtw/Ci+rAMqgdTB1jv4iZiLhw0rtq+0qjIRbBizXkNzEFmXiXUW0H7sZQQvk1ffA==}
+    engines: {node: '>=14'}
+
   '@graphql-typed-document-node/core@3.2.0':
     resolution: {integrity: sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==}
     peerDependencies:
@@ -8728,10 +8840,18 @@ packages:
     resolution: {integrity: sha512-Yq4UPVoQICM9zHnByLmG8632t2M0+yap4T7ANVw482J0W7HW0pOuxwVmeOwzJqX2Q89fkXz0Vybz55Wj2Xzrsg==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/core@3.26.0':
+    resolution: {integrity: sha512-mLUktFAn+Pa2agl1J7VgtYNFWCX8/b4GMJSK1hCu4YCvtBfM6F8Os3EP4ry+DFFlXOf3wyvlgXhuUdFoy52D3g==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/credential-provider-imds@4.2.8':
     resolution: {integrity: sha512-FNT0xHS1c/CPN8upqbMFP83+ul5YgdisfCfkZ86Jh2NSmnqw/AJ6x5pEogVCTVvSm7j9MopRU89bmDelxuDMYw==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/credential-provider-imds@4.4.2':
+    resolution: {integrity: sha512-18UMDMyrAbDcpmL1gLUA7ww0fRTcdCrSjSJOi2Sbld+tVjwD/pW+OAwjlScFLR7vvBnhZrIPQ7kVuTf1mnJLug==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/eventstream-codec@4.2.8':
     resolution: {integrity: sha512-jS/O5Q14UsufqoGhov7dHLOPCzkYJl9QDzusI2Psh4wyYx/izhzvX9P4D69aTxcdfVhEPhjK+wYyn/PzLjKbbw==}
     engines: {node: '>=18.0.0'}
@@ -8756,6 +8876,10 @@ packages:
     resolution: {integrity: sha512-I4UhmcTYXBrct03rwzQX1Y/iqQlzVQaPxWjCjula++5EmWq9YGBrx6bbGqluGc1f0XEfhSkiY4jhLgbsJUMKRA==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/fetch-http-handler@5.5.2':
+    resolution: {integrity: sha512-Ei/UK/QMhq0rKaMqGPlOAkE2yS9DZeYmZdk1RAKc3vp3zxgleZHZyBLlZv8yLsxljX4svCRuMTD6u3LLIcU4Bg==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/hash-blob-browser@4.2.9':
     resolution: {integrity: sha512-m80d/iicI7DlBDxyQP6Th7BW/ejDGiF0bgI754+tiwK0lgMkcaIBgvwwVc7OFbY4eUzpGtnig52MhPAEJ7iNYg==}
     engines: {node: '>=18.0.0'}
@@ -8812,6 +8936,10 @@ packages:
     resolution: {integrity: sha512-u4YeUwOWRZaHbWaebvrs3UhwQwj+2VNmcVCwXcYTvPIuVyM7Ex1ftAj+fdbG/P4AkBwLq/+SKn+ydOI4ZJE9PA==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/node-http-handler@4.8.2':
+    resolution: {integrity: sha512-wfl1uwrAqMH9/pi4kqBo5LBcFwrJLxuDLqL7p7qNcJIFcyZDUc6pzhYk4CYv+DP7fIUpQCZumwNnkhPKS52osQ==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/property-provider@4.2.8':
     resolution: {integrity: sha512-EtCTbyIveCKeOXDSWSdze3k612yCPq1YbXsbqX3UHhkOSW8zKsM9NOJG5gTIya0vbY2DIaieG8pKo1rITHYL0w==}
     engines: {node: '>=18.0.0'}
@@ -8840,6 +8968,10 @@ packages:
     resolution: {integrity: sha512-6A4vdGj7qKNRF16UIcO8HhHjKW27thsxYci+5r/uVRkdcBEkOEiY8OMPuydLX4QHSrJqGHPJzPRwwVTqbLZJhg==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/signature-v4@5.5.2':
+    resolution: {integrity: sha512-7xHpmPY4rt0IOmeAA8EfjgEH8isT+587TCdy9H6a7d4OMi5CQ0oEHhWllunvPu4j4Cq0vTFwdxXN/kABWPjdyA==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/smithy-client@4.11.3':
     resolution: {integrity: sha512-Q7kY5sDau8OoE6Y9zJoRGgje8P4/UY0WzH8R2ok0PDh+iJ+ZnEKowhjEqYafVcubkbYxQVaqwm3iufktzhprGg==}
     engines: {node: '>=18.0.0'}
@@ -8848,6 +8980,10 @@ packages:
     resolution: {integrity: sha512-9YcuJVTOBDjg9LWo23Qp0lTQ3D7fQsQtwle0jVfpbUHy9qBwCEgKuVH4FqFB3VYu0nwdHKiEMA+oXz7oV8X1kw==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/types@4.15.0':
+    resolution: {integrity: sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/url-parser@4.2.8':
     resolution: {integrity: sha512-NQho9U68TGMEU639YkXnVMV3GEFFULmmaWdlu1E9qzyIePOHsoSnagTGSDv1Zi8DCNN6btxOSdgmy5E/hsZwhA==}
     engines: {node: '>=18.0.0'}
@@ -9410,6 +9546,10 @@ packages:
       '@types/react-dom':
         optional: true
 
+  '@tootallnate/once@2.0.1':
+    resolution: {integrity: sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==}
+    engines: {node: '>= 10'}
+
   '@trpc-limiter/core@1.0.0':
     resolution: {integrity: sha512-Wjq2oTCmCdwNbZKRfKpzpl1Um9QXGE8OHXOab+EUSj5Wk+26I/V6Vs2p0VBFAz6eEsBn36982cCC/vaaznA8+Q==}
     engines: {node: '>=16'}
@@ -9506,6 +9646,9 @@ packages:
   '@types/bunyan@1.8.11':
     resolution: {integrity: sha512-758fRH7umIMk5qt5ELmRMff4mLDlN+xyYzC+dkPTdKwbSkJFvz6xwyScrytPU0QIBbRRwbiE8/BIg8bpajerNQ==}
 
+  '@types/caseless@0.12.5':
+    resolution: {integrity: sha512-hWtVTC2q7hc7xZ/RLbxapMvDMgUnDvKvMOpKal4DrMyfGBUfB1oKaZlIRr6mJL+If3bAP6sV/QneGzF6tJjZDg==}
+
   '@types/compression@1.7.5':
     resolution: {integrity: sha512-AAQvK5pxMpaT+nDvhHrsBhLSYG5yQdtkaJE1WYieSNY2mVFKAgmU4ks65rkZD5oqnGCFLyQpUr1CqI4DmUMyDg==}
 
@@ -9884,6 +10027,9 @@ packages:
   '@types/request-ip@0.0.41':
     resolution: {integrity: sha512-Qzz0PM2nSZej4lsLzzNfADIORZhhxO7PED0fXpg4FjXiHuJ/lMyUg+YFF5q8x9HPZH3Gl6N+NOM8QZjItNgGKg==}
 
+  '@types/request@2.48.13':
+    resolution: {integrity: sha512-FGJ6udDNUCjd19pp0Q3iTiDkwhYup7J8hpMW9c4k53NrccQFFWKRho6hvtPPEhnXWKvukfwAlB6DbDz4yhH5Gg==}
+
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
@@ -9929,6 +10075,9 @@ packages:
   '@types/through@0.0.33':
     resolution: {integrity: sha512-HsJ+z3QuETzP3cswwtzt2vEIiHBk/dCcHGhbmG5X3ecnwFD/lPrMpliGXxSCg03L9AhrdwA4Oz/qfspkDW+xGQ==}
 
+  '@types/tough-cookie@4.0.5':
+    resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==}
+
   '@types/triple-beam@1.3.5':
     resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
 
@@ -10529,6 +10678,9 @@ packages:
   async-limiter@1.0.1:
     resolution: {integrity: sha512-csOlWGAcRFJaI6m+F2WKdnMKr4HhdhFVBk0H/QbJFMCr+uO2kwohwXQPxw/9OCxp05r5ghVBFSyioixx3gfkNQ==}
 
+  async-retry@1.3.3:
+    resolution: {integrity: sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==}
+
   async-sema@3.1.1:
     resolution: {integrity: sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg==}
 
@@ -12746,6 +12898,10 @@ packages:
     resolution: {integrity: sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==}
     engines: {node: '>= 0.12'}
 
+  form-data@2.5.6:
+    resolution: {integrity: sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA==}
+    engines: {node: '>= 0.12'}
+
   form-data@3.0.4:
     resolution: {integrity: sha512-f0cRzm6dkyVYV3nPoooP8XlccPQukegwhAnpoLcXy+X+A8KfpGOoXwDr9FLZd3wzgLaBGQBE3lY93Zm/i1JvIQ==}
     engines: {node: '>= 6'}
@@ -13213,6 +13369,10 @@ packages:
     peerDependencies:
       csstype: ^3.0.10
 
+  google-auth-library@9.15.1:
+    resolution: {integrity: sha512-Jb6Z0+nvECVz+2lzSMt9u98UsoakXxA2HGHMCxh+so3n90XgYWkq5dur19JAJV7ONiJY22yBTyJB1TSkvPq9Ng==}
+    engines: {node: '>=14'}
+
   gopd@1.2.0:
     resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
     engines: {node: '>= 0.4'}
@@ -13236,6 +13396,10 @@ packages:
     peerDependencies:
       ioredis: '>=5'
 
+  gtoken@7.1.0:
+    resolution: {integrity: sha512-pCcEwRi+TKpMlxAQObHDQ56KawURgyAf6jtIY046fJ5tIv3zDe/LEIubckAO8fj6JnAxLdmWkUfNyulQ2iKdEw==}
+    engines: {node: '>=14.0.0'}
+
   gzip-size@6.0.0:
     resolution: {integrity: sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==}
     engines: {node: '>=10'}
@@ -13309,6 +13473,10 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   hast-util-from-dom@5.0.1:
     resolution: {integrity: sha512-N+LqofjR2zuzTjCPzyDUdSshy4Ma6li7p/c3pA78uTwzFgENbgbUrm2ugwsOdcjI1muO+o6Dgzp9p8WHtn/39Q==}
 
@@ -13408,6 +13576,9 @@ packages:
     resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==}
     engines: {node: '>=18'}
 
+  html-entities@2.6.0:
+    resolution: {integrity: sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==}
+
   html-escaper@3.0.3:
     resolution: {integrity: sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ==}
 
@@ -13438,6 +13609,10 @@ packages:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
 
+  http-proxy-agent@5.0.0:
+    resolution: {integrity: sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==}
+    engines: {node: '>= 6'}
+
   http-proxy-agent@7.0.2:
     resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
     engines: {node: '>= 14'}
@@ -14211,9 +14386,15 @@ packages:
   jwa@1.4.1:
     resolution: {integrity: sha512-qiLX/xhEEFKUAJ6FiBMbes3w9ATzyk5W7Hvzpa/SLYdxNtng+gcurvrI7TbACjIXlsJyr05/S1oUhZrc63evQA==}
 
+  jwa@2.0.1:
+    resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
+
   jws@3.2.2:
     resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==}
 
+  jws@4.0.1:
+    resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
+
   kafkajs@2.2.4:
     resolution: {integrity: sha512-j/YeapB1vfPT2iOIUn/vxdyKEuhuY2PxMBvf5JWux6iSaukAccrMtXEY/Lb7OvavDhOWME589bpLrEdnVHjfjA==}
     engines: {node: '>=14.0.0'}
@@ -17149,6 +17330,10 @@ packages:
   retext@9.0.0:
     resolution: {integrity: sha512-sbMDcpHCNjvlheSgMfEcVrZko3cDzdbe1x/e7G66dFp0Ff7Mldvi2uv6JkJQzdRcvLYE8CA8Oe8siQx8ZOgTcA==}
 
+  retry-request@7.0.2:
+    resolution: {integrity: sha512-dUOvLMJ0/JJYEn8NrpOaGNE7X3vpI5XlZS/u0ANjqtcZVKnIxP7IgCFwrKTxENw29emmwug53awKtaMm4i9g5w==}
+    engines: {node: '>=14'}
+
   retry@0.13.1:
     resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
     engines: {node: '>= 4'}
@@ -17767,6 +17952,9 @@ packages:
     resolution: {integrity: sha512-uyQK/mx5QjHun80FLJTfaWE7JtwfRMKBLkMne6udYOmvH0CawotVa7TfgYHzAnpphn4+TweIx1QKMnRIbipmUg==}
     engines: {node: '>= 0.10.0'}
 
+  stream-events@1.0.5:
+    resolution: {integrity: sha512-E1GUzBSgvct8Jsb3v2X15pjzN1tYebtbLaMg+eBOUOAxgbLoSbT2NS91ckc5lJD1KfLjId+jXJRgo0qnV5Nerg==}
+
   stream-shift@1.0.3:
     resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==}
 
@@ -17868,9 +18056,6 @@ packages:
   strnum@1.0.5:
     resolution: {integrity: sha512-J8bbNyKKXl5qYcR36TIO8W3mVGVHrmmxsd5PAItGkmyzwJvybiw2IVq5nqd0i4LSNSkB/sx9VHllbfFdr9k1JA==}
 
-  strnum@2.1.2:
-    resolution: {integrity: sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ==}
-
   strnum@2.2.3:
     resolution: {integrity: sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==}
 
@@ -17880,6 +18065,9 @@ packages:
   structured-headers@0.4.1:
     resolution: {integrity: sha512-0MP/Cxx5SzeeZ10p/bZI0S6MpgD+yxAhi1BOQ34jgnMXsCq3j1t6tQnZu+KdlL7dvJTLT3g9xN8tl10TqgFMcg==}
 
+  stubs@3.0.0:
+    resolution: {integrity: sha512-PdHt7hHUJKxvTCgbKX9C1V/ftOcjJQgz8BZwNfV5c4B6dcGqlpelTbJ999jBGZ2jYiPAwcX5dP6oBwVlBlUbxw==}
+
   style-mod@4.1.3:
     resolution: {integrity: sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==}
 
@@ -18029,6 +18217,10 @@ packages:
   tdigest@0.1.2:
     resolution: {integrity: sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==}
 
+  teeny-request@9.0.0:
+    resolution: {integrity: sha512-resvxdc6Mgb7YEThw6G6bExlXKkv6+YbuzGg9xuXxSgxJF7Ozs+o8Y9+2R3sArdWdW8nOokoQb1yrpFB0pQK2g==}
+    engines: {node: '>=14'}
+
   temp-dir@1.0.0:
     resolution: {integrity: sha512-xZFXEGbG7SNC3itwBzI3RYjq/cEhBkx2hJuKGIUOcEULmkQExXiHat2z/qkISYsuR+IKumhEfKKbV5qXmhICFQ==}
     engines: {node: '>=4'}
@@ -19892,7 +20084,7 @@ snapshots:
   '@aws-crypto/crc32@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.1
+      '@aws-sdk/types': 3.973.13
       tslib: 2.8.1
 
   '@aws-crypto/crc32c@5.2.0':
@@ -20227,6 +20419,20 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/client-sts@3.1073.0':
+    dependencies:
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/credential-provider-node': 3.972.58
+      '@aws-sdk/signature-v4-multi-region': 3.996.35
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/core@3.973.10':
     dependencies:
       '@aws-sdk/types': 3.973.1
@@ -20243,11 +20449,30 @@ snapshots:
       '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
+  '@aws-sdk/core@3.974.23':
+    dependencies:
+      '@aws-sdk/types': 3.973.13
+      '@aws-sdk/xml-builder': 3.972.31
+      '@aws/lambda-invoke-store': 0.2.3
+      '@smithy/core': 3.26.0
+      '@smithy/signature-v4': 5.5.2
+      '@smithy/types': 4.15.0
+      bowser: 2.14.1
+      tslib: 2.8.1
+
   '@aws-sdk/crc64-nvme@3.972.0':
     dependencies:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-env@3.972.49':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-env@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20269,6 +20494,32 @@ snapshots:
       '@smithy/util-stream': 4.5.12
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-http@3.972.51':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-ini@3.972.56':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/credential-provider-env': 3.972.49
+      '@aws-sdk/credential-provider-http': 3.972.51
+      '@aws-sdk/credential-provider-login': 3.972.55
+      '@aws-sdk/credential-provider-process': 3.972.49
+      '@aws-sdk/credential-provider-sso': 3.972.55
+      '@aws-sdk/credential-provider-web-identity': 3.972.55
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/credential-provider-imds': 4.4.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-ini@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20288,6 +20539,15 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-login@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-login@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20301,6 +20561,20 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-node@3.972.58':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.49
+      '@aws-sdk/credential-provider-http': 3.972.51
+      '@aws-sdk/credential-provider-ini': 3.972.56
+      '@aws-sdk/credential-provider-process': 3.972.49
+      '@aws-sdk/credential-provider-sso': 3.972.55
+      '@aws-sdk/credential-provider-web-identity': 3.972.55
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/credential-provider-imds': 4.4.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-node@3.972.9':
     dependencies:
       '@aws-sdk/credential-provider-env': 3.972.8
@@ -20318,6 +20592,14 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-process@3.972.49':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-process@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20327,6 +20609,16 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-sso@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/token-providers': 3.1074.0
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-sso@3.972.8':
     dependencies:
       '@aws-sdk/client-sso': 3.990.0
@@ -20340,6 +20632,15 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-web-identity@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-web-identity@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20521,6 +20822,19 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/nested-clients@3.997.23':
+    dependencies:
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/signature-v4-multi-region': 3.996.35
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/region-config-resolver@3.972.3':
     dependencies:
       '@aws-sdk/types': 3.973.1
@@ -20538,6 +20852,22 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/signature-v4-multi-region@3.996.35':
+    dependencies:
+      '@aws-sdk/types': 3.973.13
+      '@smithy/signature-v4': 5.5.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
+  '@aws-sdk/token-providers@3.1074.0':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/token-providers@3.990.0':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20555,6 +20885,11 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/types@3.973.13':
+    dependencies:
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/util-arn-parser@3.972.2':
     dependencies:
       tslib: 2.8.1
@@ -20594,6 +20929,11 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/xml-builder@3.972.31':
+    dependencies:
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/xml-builder@3.972.4':
     dependencies:
       '@smithy/types': 4.12.0
@@ -24540,6 +24880,35 @@ snapshots:
 
   '@gar/promisify@1.1.3': {}
 
+  '@google-cloud/paginator@5.0.2':
+    dependencies:
+      arrify: 2.0.1
+      extend: 3.0.2
+
+  '@google-cloud/projectify@4.0.0': {}
+
+  '@google-cloud/promisify@4.0.0': {}
+
+  '@google-cloud/storage@7.21.0':
+    dependencies:
+      '@google-cloud/paginator': 5.0.2
+      '@google-cloud/projectify': 4.0.0
+      '@google-cloud/promisify': 4.0.0
+      abort-controller: 3.0.0
+      async-retry: 1.3.3
+      duplexify: 4.1.3
+      fast-xml-parser: 5.5.10
+      gaxios: 6.7.1
+      google-auth-library: 9.15.1
+      html-entities: 2.6.0
+      mime: 3.0.0
+      p-limit: 3.1.0
+      retry-request: 7.0.2
+      teeny-request: 9.0.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   '@graphql-typed-document-node/core@3.2.0(graphql@15.8.0)':
     dependencies:
       graphql: 15.8.0
@@ -29054,6 +29423,12 @@ snapshots:
       '@smithy/uuid': 1.1.0
       tslib: 2.8.1
 
+  '@smithy/core@3.26.0':
+    dependencies:
+      '@aws-crypto/crc32': 5.2.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/credential-provider-imds@4.2.8':
     dependencies:
       '@smithy/node-config-provider': 4.3.8
@@ -29062,6 +29437,12 @@ snapshots:
       '@smithy/url-parser': 4.2.8
       tslib: 2.8.1
 
+  '@smithy/credential-provider-imds@4.4.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/eventstream-codec@4.2.8':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
@@ -29100,6 +29481,12 @@ snapshots:
       '@smithy/util-base64': 4.3.0
       tslib: 2.8.1
 
+  '@smithy/fetch-http-handler@5.5.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/hash-blob-browser@4.2.9':
     dependencies:
       '@smithy/chunked-blob-reader': 5.2.0
@@ -29194,6 +29581,12 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@smithy/node-http-handler@4.8.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/property-provider@4.2.8':
     dependencies:
       '@smithy/types': 4.12.0
@@ -29235,6 +29628,12 @@ snapshots:
       '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
+  '@smithy/signature-v4@5.5.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/smithy-client@4.11.3':
     dependencies:
       '@smithy/core': 3.23.0
@@ -29249,6 +29648,10 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  '@smithy/types@4.15.0':
+    dependencies:
+      tslib: 2.8.1
+
   '@smithy/url-parser@4.2.8':
     dependencies:
       '@smithy/querystring-parser': 4.2.8
@@ -29970,6 +30373,8 @@ snapshots:
       '@types/react': 19.2.7
       '@types/react-dom': 19.2.3(@types/react@19.2.7)
 
+  '@tootallnate/once@2.0.1': {}
+
   '@trpc-limiter/core@1.0.0(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.17.0(typescript@5.9.3))':
     dependencies:
       '@trpc/client': 11.17.0(@trpc/server@11.17.0(typescript@5.9.3))(typescript@5.9.3)
@@ -30073,6 +30478,8 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/caseless@0.12.5': {}
+
   '@types/compression@1.7.5':
     dependencies:
       '@types/express': 5.0.3
@@ -30517,6 +30924,13 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/request@2.48.13':
+    dependencies:
+      '@types/caseless': 0.12.5
+      '@types/node': 20.19.24
+      '@types/tough-cookie': 4.0.5
+      form-data: 2.5.6
+
   '@types/resolve@1.20.2': {}
 
   '@types/retry@0.12.0': {}
@@ -30567,6 +30981,8 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/tough-cookie@4.0.5': {}
+
   '@types/triple-beam@1.3.5': {}
 
   '@types/tsscmp@1.0.2': {}
@@ -31435,6 +31851,10 @@ snapshots:
 
   async-limiter@1.0.1: {}
 
+  async-retry@1.3.3:
+    dependencies:
+      retry: 0.13.1
+
   async-sema@3.1.1: {}
 
   async@3.2.5: {}
@@ -34135,7 +34555,7 @@ snapshots:
 
   fast-xml-parser@5.3.4:
     dependencies:
-      strnum: 2.1.2
+      strnum: 2.2.3
 
   fast-xml-parser@5.5.10:
     dependencies:
@@ -34401,6 +34821,15 @@ snapshots:
       combined-stream: 1.0.8
       mime-types: 2.1.35
 
+  form-data@2.5.6:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+      safe-buffer: 5.2.1
+
   form-data@3.0.4:
     dependencies:
       asynckit: 0.4.0
@@ -34935,6 +35364,18 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
+  google-auth-library@9.15.1:
+    dependencies:
+      base64-js: 1.5.1
+      ecdsa-sig-formatter: 1.0.11
+      gaxios: 6.7.1
+      gcp-metadata: 6.1.0
+      gtoken: 7.1.0
+      jws: 4.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   gopd@1.2.0: {}
 
   graceful-fs@4.2.11: {}
@@ -34951,6 +35392,14 @@ snapshots:
       cron-parser: 4.9.0
       ioredis: 5.8.2
 
+  gtoken@7.1.0:
+    dependencies:
+      gaxios: 6.7.1
+      jws: 4.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   gzip-size@6.0.0:
     dependencies:
       duplexer: 0.1.2
@@ -35026,6 +35475,10 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   hast-util-from-dom@5.0.1:
     dependencies:
       '@types/hast': 3.0.4
@@ -35225,6 +35678,8 @@ snapshots:
     dependencies:
       whatwg-encoding: 3.1.1
 
+  html-entities@2.6.0: {}
+
   html-escaper@3.0.3: {}
 
   html-to-text@9.0.5:
@@ -35271,6 +35726,14 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
+  http-proxy-agent@5.0.0:
+    dependencies:
+      '@tootallnate/once': 2.0.1
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   http-proxy-agent@7.0.2:
     dependencies:
       agent-base: 7.1.4
@@ -36112,11 +36575,22 @@ snapshots:
       ecdsa-sig-formatter: 1.0.11
       safe-buffer: 5.2.1
 
+  jwa@2.0.1:
+    dependencies:
+      buffer-equal-constant-time: 1.0.1
+      ecdsa-sig-formatter: 1.0.11
+      safe-buffer: 5.2.1
+
   jws@3.2.2:
     dependencies:
       jwa: 1.4.1
       safe-buffer: 5.2.1
 
+  jws@4.0.1:
+    dependencies:
+      jwa: 2.0.1
+      safe-buffer: 5.2.1
+
   kafkajs@2.2.4: {}
 
   katex@0.16.21:
@@ -40014,6 +40488,15 @@ snapshots:
       retext-stringify: 4.0.0
       unified: 11.0.5
 
+  retry-request@7.0.2:
+    dependencies:
+      '@types/request': 2.48.13
+      extend: 3.0.2
+      teeny-request: 9.0.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   retry@0.13.1: {}
 
   reusify@1.0.4: {}
@@ -40771,6 +41254,10 @@ snapshots:
 
   stream-buffers@2.2.0: {}
 
+  stream-events@1.0.5:
+    dependencies:
+      stubs: 3.0.0
+
   stream-shift@1.0.3: {}
 
   streamsearch@1.1.0: {}
@@ -40901,14 +41388,14 @@ snapshots:
 
   strnum@1.0.5: {}
 
-  strnum@2.1.2: {}
-
   strnum@2.2.3: {}
 
   structured-clone-es@1.0.0: {}
 
   structured-headers@0.4.1: {}
 
+  stubs@3.0.0: {}
+
   style-mod@4.1.3: {}
 
   style-to-js@1.1.21:
@@ -41117,6 +41604,17 @@ snapshots:
     dependencies:
       bintrees: 1.0.2
 
+  teeny-request@9.0.0:
+    dependencies:
+      http-proxy-agent: 5.0.0
+      https-proxy-agent: 5.0.1
+      node-fetch: 2.7.0
+      stream-events: 1.0.5
+      uuid: 9.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   temp-dir@1.0.0: {}
 
   temp-dir@2.0.0: {}

From 2c6815f5b132d3efa1e24858e1e88fbd5f56d856 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Tue, 23 Jun 2026 11:41:06 +0200
Subject: [PATCH 2/8] feat: scope integrations to projects (dual-scope)

Phase 1 of the integrations rework. Adds a nullable Integration.projectId:
set = project-scoped, null = legacy org-wide. Existing org integrations keep
working untouched (additive migration, no backfill).

- schema: Integration.projectId (nullable FK) + indexes; Project reverse relation.
- export cron: project-scoped integrations export only their project; legacy
  org-wide rows still fan out across the org's projects.
- validation/tRPC: create inputs take projectId (org derived from project);
  added in-handler getProjectAccess to list + createOrUpdate* (closing a
  pre-existing authz gap that trusted client-supplied scope); get/delete use
  project-or-org access by scope. list also surfaces legacy org-wide rows.
- notification rules: connected integrations must belong to the same project
  (or be org-wide in the same org); also added the missing access check on the
  rule create branch.
- Slack OAuth carries projectId through install metadata + callback redirect.
- dashboard: integrations moved to project-scoped routes + sidebar; org route
  and org-level "add integration" CTA removed.

typecheck + tests green (657).

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 .../api/src/controllers/webhook.controller.ts |  11 +-
 .../integrations/active-integrations.tsx      |   6 +-
 .../forms/discord-integration.tsx             |   4 +-
 .../forms/gcs-export-integration.tsx          |   4 +-
 .../forms/s3-export-integration.tsx           |   4 +-
 .../integrations/forms/slack-integration.tsx  |   4 +-
 .../forms/webhook-integration.tsx             |   4 +-
 .../components/sidebar-organization-menu.tsx  |  23 +-
 .../src/components/sidebar-project-menu.tsx   |   7 +
 apps/start/src/modals/add-integration.tsx     |   5 +-
 .../src/modals/add-notification-rule.tsx      |   4 +-
 apps/start/src/routeTree.gen.ts               | 268 +++++++++---------
 ...rojectId.integrations._tabs.available.tsx} |   2 +-
 ...Id.$projectId.integrations._tabs.index.tsx |  17 ++
 ...rojectId.integrations._tabs.installed.tsx} |   2 +-
 ...ationId.$projectId.integrations._tabs.tsx} |  21 +-
 ...rganizationId.integrations._tabs.index.tsx |  18 --
 apps/worker/src/jobs/cron.flush-exports.ts    |  19 +-
 .../migration.sql                             |  11 +
 packages/db/prisma/schema.prisma              |   8 +
 .../db/src/services/notification.service.ts   |   1 +
 packages/integrations/src/slack.ts            |   5 +-
 packages/trpc/src/routers/integration.ts      | 151 ++++++----
 packages/trpc/src/routers/notification.ts     |  44 ++-
 packages/validation/src/index.ts              |   2 +-
 25 files changed, 369 insertions(+), 276 deletions(-)
 rename apps/start/src/routes/{_app.$organizationId.integrations._tabs.available.tsx => _app.$organizationId.$projectId.integrations._tabs.available.tsx} (79%)
 create mode 100644 apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx
 rename apps/start/src/routes/{_app.$organizationId.integrations._tabs.installed.tsx => _app.$organizationId.$projectId.integrations._tabs.installed.tsx} (80%)
 rename apps/start/src/routes/{_app.$organizationId.integrations._tabs.tsx => _app.$organizationId.$projectId.integrations._tabs.tsx} (65%)
 delete mode 100644 apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx
 create mode 100644 packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql

diff --git a/apps/api/src/controllers/webhook.controller.ts b/apps/api/src/controllers/webhook.controller.ts
index 38c30bfa1..595a3fd59 100644
--- a/apps/api/src/controllers/webhook.controller.ts
+++ b/apps/api/src/controllers/webhook.controller.ts
@@ -25,6 +25,9 @@ const paramsSchema = z.object({
 const metadataSchema = z.object({
   organizationId: z.string(),
   integrationId: z.string(),
+  // Optional for back-compat with install URLs generated before integrations
+  // became project-scoped; the post-install redirect falls back to the org page.
+  projectId: z.string().optional(),
 });
 
 export async function slackWebhook(
@@ -85,7 +88,7 @@ export async function slackWebhook(
         '👋 Hello. You have successfully connected OpenPanel.dev to your Slack workspace.',
     });
 
-    const { organizationId, integrationId } = parsedMetadata.data;
+    const { organizationId, integrationId, projectId } = parsedMetadata.data;
 
     await db.integration.update({
       where: {
@@ -100,8 +103,12 @@ export async function slackWebhook(
       },
     });
 
+    const dashboardUrl =
+      process.env.DASHBOARD_URL || process.env.NEXT_PUBLIC_DASHBOARD_URL;
     return reply.redirect(
-      `${process.env.DASHBOARD_URL || process.env.NEXT_PUBLIC_DASHBOARD_URL}/${organizationId}/integrations/installed`
+      projectId
+        ? `${dashboardUrl}/${organizationId}/${projectId}/integrations/installed`
+        : `${dashboardUrl}/${organizationId}/integrations/installed`
     );
   } catch (err) {
     request.log.error(err);
diff --git a/apps/start/src/components/integrations/active-integrations.tsx b/apps/start/src/components/integrations/active-integrations.tsx
index f4db1f9f4..e1858f6dc 100644
--- a/apps/start/src/components/integrations/active-integrations.tsx
+++ b/apps/start/src/components/integrations/active-integrations.tsx
@@ -17,11 +17,11 @@ import {
 import { INTEGRATIONS } from './integrations';
 
 export function ActiveIntegrations() {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const trpc = useTRPC();
   const query = useQuery(
     trpc.integration.list.queryOptions({
-      organizationId: organizationId!,
+      projectId: projectId!,
     }),
   );
   const client = useQueryClient();
@@ -30,7 +30,7 @@ export function ActiveIntegrations() {
       onSuccess() {
         client.refetchQueries(
           trpc.integration.list.queryFilter({
-            organizationId,
+            projectId,
           }),
         );
       },
diff --git a/apps/start/src/components/integrations/forms/discord-integration.tsx b/apps/start/src/components/integrations/forms/discord-integration.tsx
index 4dd722c3c..2823c6d63 100644
--- a/apps/start/src/components/integrations/forms/discord-integration.tsx
+++ b/apps/start/src/components/integrations/forms/discord-integration.tsx
@@ -21,12 +21,12 @@ export function DiscordIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         config: {
           type: 'discord' as const,
           url: '',
diff --git a/apps/start/src/components/integrations/forms/gcs-export-integration.tsx b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
index a2bb17cca..ea23b31db 100644
--- a/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
+++ b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
@@ -27,12 +27,12 @@ export function GCSExportIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         name: '',
         config: {
           type: 'gcs_export' as const,
diff --git a/apps/start/src/components/integrations/forms/s3-export-integration.tsx b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
index c9d27a1f6..816dd78be 100644
--- a/apps/start/src/components/integrations/forms/s3-export-integration.tsx
+++ b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
@@ -46,12 +46,12 @@ export function S3ExportIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         name: '',
         config: {
           type: 's3_export' as const,
diff --git a/apps/start/src/components/integrations/forms/slack-integration.tsx b/apps/start/src/components/integrations/forms/slack-integration.tsx
index f7a8c3bb8..17d3c3687 100644
--- a/apps/start/src/components/integrations/forms/slack-integration.tsx
+++ b/apps/start/src/components/integrations/forms/slack-integration.tsx
@@ -19,12 +19,12 @@ export function SlackIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
 
   const form = useForm<IForm>({
     defaultValues: {
       id: defaultValues?.id,
-      organizationId,
+      projectId,
       name: defaultValues?.name ?? '',
     },
     resolver: zodResolver(zCreateSlackIntegration),
diff --git a/apps/start/src/components/integrations/forms/webhook-integration.tsx b/apps/start/src/components/integrations/forms/webhook-integration.tsx
index ca39b686b..cc891dd61 100644
--- a/apps/start/src/components/integrations/forms/webhook-integration.tsx
+++ b/apps/start/src/components/integrations/forms/webhook-integration.tsx
@@ -55,7 +55,7 @@ export function WebhookIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
 
   // Convert headers from Record to array format for form UI
   const defaultHeaders =
@@ -67,7 +67,7 @@ export function WebhookIntegrationForm({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         config: {
           type: 'webhook' as const,
           url: '',
diff --git a/apps/start/src/components/sidebar-organization-menu.tsx b/apps/start/src/components/sidebar-organization-menu.tsx
index 964b5f6ae..b4551fe2f 100644
--- a/apps/start/src/components/sidebar-organization-menu.tsx
+++ b/apps/start/src/components/sidebar-organization-menu.tsx
@@ -1,4 +1,4 @@
-import { Link, useNavigate } from '@tanstack/react-router';
+import { Link } from '@tanstack/react-router';
 import { AnimatePresence, motion } from 'framer-motion';
 import {
   ChevronDownIcon,
@@ -7,7 +7,6 @@ import {
   LayoutListIcon,
   PlusIcon,
   UsersIcon,
-  WorkflowIcon,
 } from 'lucide-react';
 import { useEffect, useState } from 'react';
 import { Badge } from './ui/badge';
@@ -98,22 +97,11 @@ export default function SidebarOrganizationMenu({
           <div className="flex-1">Members</div>
         </Link>
       )}
-      <Link
-        className={cn(
-          'flex items-center gap-2 rounded-md px-3 py-2 font-medium text-[13px] transition-all hover:bg-def-200'
-        )}
-        from="/$organizationId"
-        to="/$organizationId/integrations"
-      >
-        <WorkflowIcon size={20} />
-        <div className="flex-1">Integrations</div>
-      </Link>
     </>
   );
 }
 
 export function ActionCTAButton() {
-  const navigate = useNavigate();
   const { organizationId } = useParams({ strict: false });
   const { isAdmin } = useOrganizationAccess(organizationId);
 
@@ -132,15 +120,6 @@ export function ActionCTAButton() {
           },
         ]
       : []),
-    {
-      label: 'Add integration',
-      icon: WorkflowIcon,
-      onClick: () =>
-        navigate({
-          to: '/$organizationId/integrations',
-          from: '/$organizationId',
-        }),
-    },
   ];
 
   const [currentActionIndex, setCurrentActionIndex] = useState(0);
diff --git a/apps/start/src/components/sidebar-project-menu.tsx b/apps/start/src/components/sidebar-project-menu.tsx
index e78ae4f3e..8738bc72b 100644
--- a/apps/start/src/components/sidebar-project-menu.tsx
+++ b/apps/start/src/components/sidebar-project-menu.tsx
@@ -3,6 +3,7 @@ import { useNavigate } from '@tanstack/react-router';
 import { AnimatePresence, motion } from 'framer-motion';
 import {
   BellIcon,
+  WorkflowIcon,
   BookOpenIcon,
   Building2Icon,
   ChartLineIcon,
@@ -85,6 +86,12 @@ export default function SidebarProjectMenu({
         icon={BellIcon}
         label="Notifications"
       />
+      <SidebarLink
+        exact={false}
+        href={'/integrations'}
+        icon={WorkflowIcon}
+        label="Integrations"
+      />
       <SidebarLink href={'..'} icon={UndoDotIcon} label="Back to workspace" />
     </>
   );
diff --git a/apps/start/src/modals/add-integration.tsx b/apps/start/src/modals/add-integration.tsx
index de11cd3b3..7dea1bb25 100644
--- a/apps/start/src/modals/add-integration.tsx
+++ b/apps/start/src/modals/add-integration.tsx
@@ -22,7 +22,7 @@ interface Props {
   type: IIntegrationConfig['type'];
 }
 export default function AddIntegration(props: Props) {
-  const { organizationId } = useAppParams();
+  const { organizationId, projectId } = useAppParams();
   const trpc = useTRPC();
   const query = useQuery(
     trpc.integration.get.queryOptions(
@@ -58,9 +58,10 @@ export default function AddIntegration(props: Props) {
       trpc.integration.get.queryFilter({ id: props.id }),
     );
     navigate({
-      to: '/$organizationId/integrations/installed',
+      to: '/$organizationId/$projectId/integrations/installed',
       params: {
         organizationId,
+        projectId,
       },
     });
   };
diff --git a/apps/start/src/modals/add-notification-rule.tsx b/apps/start/src/modals/add-notification-rule.tsx
index 5f3c351fa..d9e83a575 100644
--- a/apps/start/src/modals/add-notification-rule.tsx
+++ b/apps/start/src/modals/add-notification-rule.tsx
@@ -38,7 +38,7 @@ type IForm = z.infer<typeof zCreateNotificationRule>;
 
 export default function AddNotificationRule({ rule }: Props) {
   const client = useQueryClient();
-  const { organizationId, projectId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     resolver: zodResolver(zCreateNotificationRule),
     defaultValues: {
@@ -80,7 +80,7 @@ export default function AddNotificationRule({ rule }: Props) {
   );
   const integrationsQuery = useQuery(
     trpc.integration.list.queryOptions({
-      organizationId: organizationId!,
+      projectId: projectId!,
     })
   );
 
diff --git a/apps/start/src/routeTree.gen.ts b/apps/start/src/routeTree.gen.ts
index 558fcbee0..81b0a9d63 100644
--- a/apps/start/src/routeTree.gen.ts
+++ b/apps/start/src/routeTree.gen.ts
@@ -41,7 +41,6 @@ import { Route as AppOrganizationIdProjectIdIndexRouteImport } from './routes/_a
 import { Route as StepsOnboardingProjectIdVerifyRouteImport } from './routes/_steps.onboarding.$projectId.verify'
 import { Route as StepsOnboardingProjectIdConnectRouteImport } from './routes/_steps.onboarding.$projectId.connect'
 import { Route as AppOrganizationIdMembersTabsRouteImport } from './routes/_app.$organizationId.members._tabs'
-import { Route as AppOrganizationIdIntegrationsTabsRouteImport } from './routes/_app.$organizationId.integrations._tabs'
 import { Route as AppOrganizationIdAccountTabsRouteImport } from './routes/_app.$organizationId.account._tabs'
 import { Route as AppOrganizationIdProjectIdSessionsRouteImport } from './routes/_app.$organizationId.$projectId.sessions'
 import { Route as AppOrganizationIdProjectIdSeoRouteImport } from './routes/_app.$organizationId.$projectId.seo'
@@ -54,12 +53,9 @@ import { Route as AppOrganizationIdProjectIdGroupsRouteImport } from './routes/_
 import { Route as AppOrganizationIdProjectIdDashboardsRouteImport } from './routes/_app.$organizationId.$projectId.dashboards'
 import { Route as AppOrganizationIdProjectIdCohortsRouteImport } from './routes/_app.$organizationId.$projectId.cohorts'
 import { Route as AppOrganizationIdMembersTabsIndexRouteImport } from './routes/_app.$organizationId.members._tabs.index'
-import { Route as AppOrganizationIdIntegrationsTabsIndexRouteImport } from './routes/_app.$organizationId.integrations._tabs.index'
 import { Route as AppOrganizationIdAccountTabsIndexRouteImport } from './routes/_app.$organizationId.account._tabs.index'
 import { Route as AppOrganizationIdMembersTabsMembersRouteImport } from './routes/_app.$organizationId.members._tabs.members'
 import { Route as AppOrganizationIdMembersTabsInvitationsRouteImport } from './routes/_app.$organizationId.members._tabs.invitations'
-import { Route as AppOrganizationIdIntegrationsTabsInstalledRouteImport } from './routes/_app.$organizationId.integrations._tabs.installed'
-import { Route as AppOrganizationIdIntegrationsTabsAvailableRouteImport } from './routes/_app.$organizationId.integrations._tabs.available'
 import { Route as AppOrganizationIdAccountTabsTwoFactorRouteImport } from './routes/_app.$organizationId.account._tabs.two-factor'
 import { Route as AppOrganizationIdAccountTabsEmailPreferencesRouteImport } from './routes/_app.$organizationId.account._tabs.email-preferences'
 import { Route as AppOrganizationIdProjectIdSettingsTabsRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs'
@@ -67,11 +63,13 @@ import { Route as AppOrganizationIdProjectIdSessionsSessionIdRouteImport } from
 import { Route as AppOrganizationIdProjectIdReportsReportIdRouteImport } from './routes/_app.$organizationId.$projectId.reports_.$reportId'
 import { Route as AppOrganizationIdProjectIdProfilesTabsRouteImport } from './routes/_app.$organizationId.$projectId.profiles._tabs'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs'
 import { Route as AppOrganizationIdProjectIdEventsTabsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs'
 import { Route as AppOrganizationIdProjectIdDashboardsDashboardIdRouteImport } from './routes/_app.$organizationId.$projectId.dashboards_.$dashboardId'
 import { Route as AppOrganizationIdProjectIdSettingsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.index'
 import { Route as AppOrganizationIdProjectIdProfilesTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.profiles._tabs.index'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.index'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.index'
 import { Route as AppOrganizationIdProjectIdEventsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.index'
 import { Route as AppOrganizationIdProjectIdSettingsTabsWidgetsRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.widgets'
 import { Route as AppOrganizationIdProjectIdSettingsTabsTrackingRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.tracking'
@@ -87,6 +85,8 @@ import { Route as AppOrganizationIdProjectIdProfilesTabsAnonymousRouteImport } f
 import { Route as AppOrganizationIdProjectIdProfilesProfileIdTabsRouteImport } from './routes/_app.$organizationId.$projectId.profiles.$profileId._tabs'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsRulesRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.rules'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsNotificationsRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.notifications'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.installed'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.available'
 import { Route as AppOrganizationIdProjectIdGroupsGroupIdTabsRouteImport } from './routes/_app.$organizationId.$projectId.groups_.$groupId._tabs'
 import { Route as AppOrganizationIdProjectIdEventsTabsStatsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.stats'
 import { Route as AppOrganizationIdProjectIdEventsTabsEventsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.events'
@@ -105,9 +105,6 @@ import { Route as AppOrganizationIdProjectIdCohortsCohortIdTabsEventsRouteImport
 const AppOrganizationIdMembersRouteImport = createFileRoute(
   '/_app/$organizationId/members',
 )()
-const AppOrganizationIdIntegrationsRouteImport = createFileRoute(
-  '/_app/$organizationId/integrations',
-)()
 const AppOrganizationIdAccountRouteImport = createFileRoute(
   '/_app/$organizationId/account',
 )()
@@ -120,6 +117,9 @@ const AppOrganizationIdProjectIdProfilesRouteImport = createFileRoute(
 const AppOrganizationIdProjectIdNotificationsRouteImport = createFileRoute(
   '/_app/$organizationId/$projectId/notifications',
 )()
+const AppOrganizationIdProjectIdIntegrationsRouteImport = createFileRoute(
+  '/_app/$organizationId/$projectId/integrations',
+)()
 const AppOrganizationIdProjectIdEventsRouteImport = createFileRoute(
   '/_app/$organizationId/$projectId/events',
 )()
@@ -225,12 +225,6 @@ const AppOrganizationIdMembersRoute =
     path: '/members',
     getParentRoute: () => AppOrganizationIdRoute,
   } as any)
-const AppOrganizationIdIntegrationsRoute =
-  AppOrganizationIdIntegrationsRouteImport.update({
-    id: '/integrations',
-    path: '/integrations',
-    getParentRoute: () => AppOrganizationIdRoute,
-  } as any)
 const AppOrganizationIdAccountRoute =
   AppOrganizationIdAccountRouteImport.update({
     id: '/account',
@@ -298,6 +292,12 @@ const AppOrganizationIdProjectIdNotificationsRoute =
     path: '/notifications',
     getParentRoute: () => AppOrganizationIdProjectIdRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsRoute =
+  AppOrganizationIdProjectIdIntegrationsRouteImport.update({
+    id: '/integrations',
+    path: '/integrations',
+    getParentRoute: () => AppOrganizationIdProjectIdRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsRoute =
   AppOrganizationIdProjectIdEventsRouteImport.update({
     id: '/events',
@@ -327,11 +327,6 @@ const AppOrganizationIdMembersTabsRoute =
     id: '/_tabs',
     getParentRoute: () => AppOrganizationIdMembersRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsRoute =
-  AppOrganizationIdIntegrationsTabsRouteImport.update({
-    id: '/_tabs',
-    getParentRoute: () => AppOrganizationIdIntegrationsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsRoute =
   AppOrganizationIdAccountTabsRouteImport.update({
     id: '/_tabs',
@@ -421,12 +416,6 @@ const AppOrganizationIdMembersTabsIndexRoute =
     path: '/',
     getParentRoute: () => AppOrganizationIdMembersTabsRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsIndexRoute =
-  AppOrganizationIdIntegrationsTabsIndexRouteImport.update({
-    id: '/',
-    path: '/',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsIndexRoute =
   AppOrganizationIdAccountTabsIndexRouteImport.update({
     id: '/',
@@ -445,18 +434,6 @@ const AppOrganizationIdMembersTabsInvitationsRoute =
     path: '/invitations',
     getParentRoute: () => AppOrganizationIdMembersTabsRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsInstalledRoute =
-  AppOrganizationIdIntegrationsTabsInstalledRouteImport.update({
-    id: '/installed',
-    path: '/installed',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
-const AppOrganizationIdIntegrationsTabsAvailableRoute =
-  AppOrganizationIdIntegrationsTabsAvailableRouteImport.update({
-    id: '/available',
-    path: '/available',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsTwoFactorRoute =
   AppOrganizationIdAccountTabsTwoFactorRouteImport.update({
     id: '/two-factor',
@@ -496,6 +473,11 @@ const AppOrganizationIdProjectIdNotificationsTabsRoute =
     id: '/_tabs',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsRouteImport.update({
+    id: '/_tabs',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsTabsRoute =
   AppOrganizationIdProjectIdEventsTabsRouteImport.update({
     id: '/_tabs',
@@ -525,6 +507,12 @@ const AppOrganizationIdProjectIdNotificationsTabsIndexRoute =
     path: '/',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsTabsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsIndexRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsTabsIndexRoute =
   AppOrganizationIdProjectIdEventsTabsIndexRouteImport.update({
     id: '/',
@@ -614,6 +602,18 @@ const AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute =
     path: '/notifications',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsTabsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport.update({
+    id: '/installed',
+    path: '/installed',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport.update({
+    id: '/available',
+    path: '/available',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
 const AppOrganizationIdProjectIdGroupsGroupIdTabsRoute =
   AppOrganizationIdProjectIdGroupsGroupIdTabsRouteImport.update({
     id: '/_tabs',
@@ -731,13 +731,13 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/seo': typeof AppOrganizationIdProjectIdSeoRoute
   '/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/$organizationId/account': typeof AppOrganizationIdAccountTabsRouteWithChildren
-  '/$organizationId/integrations': typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
   '/$organizationId/members': typeof AppOrganizationIdMembersTabsRouteWithChildren
   '/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
   '/onboarding/$projectId/verify': typeof StepsOnboardingProjectIdVerifyRoute
   '/$organizationId/$projectId/': typeof AppOrganizationIdProjectIdIndexRoute
   '/$organizationId/$projectId/dashboards/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsTabsRouteWithChildren
+  '/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
   '/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsRouteWithChildren
   '/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesTabsRouteWithChildren
   '/$organizationId/$projectId/reports/$reportId': typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -745,18 +745,17 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/settings': typeof AppOrganizationIdProjectIdSettingsTabsRouteWithChildren
   '/$organizationId/account/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/$organizationId/account/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/$organizationId/integrations/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/$organizationId/integrations/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/$organizationId/members/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/$organizationId/members/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/$organizationId/account/': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/$organizationId/integrations/': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/$organizationId/members/': typeof AppOrganizationIdMembersTabsIndexRoute
   '/$organizationId/$projectId/cohorts/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsRouteWithChildren
   '/$organizationId/$projectId/events/conversions': typeof AppOrganizationIdProjectIdEventsTabsConversionsRoute
   '/$organizationId/$projectId/events/events': typeof AppOrganizationIdProjectIdEventsTabsEventsRoute
   '/$organizationId/$projectId/events/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/$organizationId/$projectId/groups/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsRouteWithChildren
+  '/$organizationId/$projectId/integrations/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/$organizationId/$projectId/integrations/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/$organizationId/$projectId/notifications/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/$organizationId/$projectId/notifications/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdTabsRouteWithChildren
@@ -772,6 +771,7 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/settings/tracking': typeof AppOrganizationIdProjectIdSettingsTabsTrackingRoute
   '/$organizationId/$projectId/settings/widgets': typeof AppOrganizationIdProjectIdSettingsTabsWidgetsRoute
   '/$organizationId/$projectId/events/': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/$organizationId/$projectId/integrations/': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/$organizationId/$projectId/notifications/': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/$organizationId/$projectId/profiles/': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/$organizationId/$projectId/settings/': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
@@ -817,13 +817,13 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/seo': typeof AppOrganizationIdProjectIdSeoRoute
   '/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/$organizationId/account': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/$organizationId/integrations': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/$organizationId/members': typeof AppOrganizationIdMembersTabsIndexRoute
   '/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
   '/onboarding/$projectId/verify': typeof StepsOnboardingProjectIdVerifyRoute
   '/$organizationId/$projectId': typeof AppOrganizationIdProjectIdIndexRoute
   '/$organizationId/$projectId/dashboards/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/$organizationId/$projectId/reports/$reportId': typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -831,8 +831,6 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/settings': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
   '/$organizationId/account/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/$organizationId/account/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/$organizationId/integrations/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/$organizationId/integrations/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/$organizationId/members/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/$organizationId/members/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/$organizationId/$projectId/cohorts/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsIndexRoute
@@ -840,6 +838,8 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/events/events': typeof AppOrganizationIdProjectIdEventsTabsEventsRoute
   '/$organizationId/$projectId/events/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/$organizationId/$projectId/groups/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsIndexRoute
+  '/$organizationId/$projectId/integrations/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/$organizationId/$projectId/integrations/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/$organizationId/$projectId/notifications/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/$organizationId/$projectId/notifications/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdTabsIndexRoute
@@ -901,8 +901,6 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/_app/$organizationId/account': typeof AppOrganizationIdAccountRouteWithChildren
   '/_app/$organizationId/account/_tabs': typeof AppOrganizationIdAccountTabsRouteWithChildren
-  '/_app/$organizationId/integrations': typeof AppOrganizationIdIntegrationsRouteWithChildren
-  '/_app/$organizationId/integrations/_tabs': typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
   '/_app/$organizationId/members': typeof AppOrganizationIdMembersRouteWithChildren
   '/_app/$organizationId/members/_tabs': typeof AppOrganizationIdMembersTabsRouteWithChildren
   '/_steps/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
@@ -911,6 +909,8 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/dashboards_/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/_app/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsRouteWithChildren
   '/_app/$organizationId/$projectId/events/_tabs': typeof AppOrganizationIdProjectIdEventsTabsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations/_tabs': typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
   '/_app/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsRouteWithChildren
   '/_app/$organizationId/$projectId/notifications/_tabs': typeof AppOrganizationIdProjectIdNotificationsTabsRouteWithChildren
   '/_app/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesRouteWithChildren
@@ -921,12 +921,9 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/settings/_tabs': typeof AppOrganizationIdProjectIdSettingsTabsRouteWithChildren
   '/_app/$organizationId/account/_tabs/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/_app/$organizationId/account/_tabs/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/_app/$organizationId/integrations/_tabs/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/_app/$organizationId/integrations/_tabs/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/_app/$organizationId/members/_tabs/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/_app/$organizationId/members/_tabs/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/_app/$organizationId/account/_tabs/': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/_app/$organizationId/integrations/_tabs/': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/_app/$organizationId/members/_tabs/': typeof AppOrganizationIdMembersTabsIndexRoute
   '/_app/$organizationId/$projectId/cohorts_/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdRouteWithChildren
   '/_app/$organizationId/$projectId/cohorts_/$cohortId/_tabs': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsRouteWithChildren
@@ -935,6 +932,8 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/events/_tabs/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/_app/$organizationId/$projectId/groups_/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdRouteWithChildren
   '/_app/$organizationId/$projectId/groups_/$groupId/_tabs': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations/_tabs/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/_app/$organizationId/$projectId/integrations/_tabs/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/_app/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdRouteWithChildren
@@ -951,6 +950,7 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/settings/_tabs/tracking': typeof AppOrganizationIdProjectIdSettingsTabsTrackingRoute
   '/_app/$organizationId/$projectId/settings/_tabs/widgets': typeof AppOrganizationIdProjectIdSettingsTabsWidgetsRoute
   '/_app/$organizationId/$projectId/events/_tabs/': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/_app/$organizationId/$projectId/integrations/_tabs/': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/_app/$organizationId/$projectId/profiles/_tabs/': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/_app/$organizationId/$projectId/settings/_tabs/': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
@@ -1000,13 +1000,13 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/seo'
     | '/$organizationId/$projectId/sessions'
     | '/$organizationId/account'
-    | '/$organizationId/integrations'
     | '/$organizationId/members'
     | '/onboarding/$projectId/connect'
     | '/onboarding/$projectId/verify'
     | '/$organizationId/$projectId/'
     | '/$organizationId/$projectId/dashboards/$dashboardId'
     | '/$organizationId/$projectId/events'
+    | '/$organizationId/$projectId/integrations'
     | '/$organizationId/$projectId/notifications'
     | '/$organizationId/$projectId/profiles'
     | '/$organizationId/$projectId/reports/$reportId'
@@ -1014,18 +1014,17 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings'
     | '/$organizationId/account/email-preferences'
     | '/$organizationId/account/two-factor'
-    | '/$organizationId/integrations/available'
-    | '/$organizationId/integrations/installed'
     | '/$organizationId/members/invitations'
     | '/$organizationId/members/members'
     | '/$organizationId/account/'
-    | '/$organizationId/integrations/'
     | '/$organizationId/members/'
     | '/$organizationId/$projectId/cohorts/$cohortId'
     | '/$organizationId/$projectId/events/conversions'
     | '/$organizationId/$projectId/events/events'
     | '/$organizationId/$projectId/events/stats'
     | '/$organizationId/$projectId/groups/$groupId'
+    | '/$organizationId/$projectId/integrations/available'
+    | '/$organizationId/$projectId/integrations/installed'
     | '/$organizationId/$projectId/notifications/notifications'
     | '/$organizationId/$projectId/notifications/rules'
     | '/$organizationId/$projectId/profiles/$profileId'
@@ -1041,6 +1040,7 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings/tracking'
     | '/$organizationId/$projectId/settings/widgets'
     | '/$organizationId/$projectId/events/'
+    | '/$organizationId/$projectId/integrations/'
     | '/$organizationId/$projectId/notifications/'
     | '/$organizationId/$projectId/profiles/'
     | '/$organizationId/$projectId/settings/'
@@ -1086,13 +1086,13 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/seo'
     | '/$organizationId/$projectId/sessions'
     | '/$organizationId/account'
-    | '/$organizationId/integrations'
     | '/$organizationId/members'
     | '/onboarding/$projectId/connect'
     | '/onboarding/$projectId/verify'
     | '/$organizationId/$projectId'
     | '/$organizationId/$projectId/dashboards/$dashboardId'
     | '/$organizationId/$projectId/events'
+    | '/$organizationId/$projectId/integrations'
     | '/$organizationId/$projectId/notifications'
     | '/$organizationId/$projectId/profiles'
     | '/$organizationId/$projectId/reports/$reportId'
@@ -1100,8 +1100,6 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings'
     | '/$organizationId/account/email-preferences'
     | '/$organizationId/account/two-factor'
-    | '/$organizationId/integrations/available'
-    | '/$organizationId/integrations/installed'
     | '/$organizationId/members/invitations'
     | '/$organizationId/members/members'
     | '/$organizationId/$projectId/cohorts/$cohortId'
@@ -1109,6 +1107,8 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/events/events'
     | '/$organizationId/$projectId/events/stats'
     | '/$organizationId/$projectId/groups/$groupId'
+    | '/$organizationId/$projectId/integrations/available'
+    | '/$organizationId/$projectId/integrations/installed'
     | '/$organizationId/$projectId/notifications/notifications'
     | '/$organizationId/$projectId/notifications/rules'
     | '/$organizationId/$projectId/profiles/$profileId'
@@ -1169,8 +1169,6 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/sessions'
     | '/_app/$organizationId/account'
     | '/_app/$organizationId/account/_tabs'
-    | '/_app/$organizationId/integrations'
-    | '/_app/$organizationId/integrations/_tabs'
     | '/_app/$organizationId/members'
     | '/_app/$organizationId/members/_tabs'
     | '/_steps/onboarding/$projectId/connect'
@@ -1179,6 +1177,8 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/dashboards_/$dashboardId'
     | '/_app/$organizationId/$projectId/events'
     | '/_app/$organizationId/$projectId/events/_tabs'
+    | '/_app/$organizationId/$projectId/integrations'
+    | '/_app/$organizationId/$projectId/integrations/_tabs'
     | '/_app/$organizationId/$projectId/notifications'
     | '/_app/$organizationId/$projectId/notifications/_tabs'
     | '/_app/$organizationId/$projectId/profiles'
@@ -1189,12 +1189,9 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/settings/_tabs'
     | '/_app/$organizationId/account/_tabs/email-preferences'
     | '/_app/$organizationId/account/_tabs/two-factor'
-    | '/_app/$organizationId/integrations/_tabs/available'
-    | '/_app/$organizationId/integrations/_tabs/installed'
     | '/_app/$organizationId/members/_tabs/invitations'
     | '/_app/$organizationId/members/_tabs/members'
     | '/_app/$organizationId/account/_tabs/'
-    | '/_app/$organizationId/integrations/_tabs/'
     | '/_app/$organizationId/members/_tabs/'
     | '/_app/$organizationId/$projectId/cohorts_/$cohortId'
     | '/_app/$organizationId/$projectId/cohorts_/$cohortId/_tabs'
@@ -1203,6 +1200,8 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/events/_tabs/stats'
     | '/_app/$organizationId/$projectId/groups_/$groupId'
     | '/_app/$organizationId/$projectId/groups_/$groupId/_tabs'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/available'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/installed'
     | '/_app/$organizationId/$projectId/notifications/_tabs/notifications'
     | '/_app/$organizationId/$projectId/notifications/_tabs/rules'
     | '/_app/$organizationId/$projectId/profiles/$profileId'
@@ -1219,6 +1218,7 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/settings/_tabs/tracking'
     | '/_app/$organizationId/$projectId/settings/_tabs/widgets'
     | '/_app/$organizationId/$projectId/events/_tabs/'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/'
     | '/_app/$organizationId/$projectId/notifications/_tabs/'
     | '/_app/$organizationId/$projectId/profiles/_tabs/'
     | '/_app/$organizationId/$projectId/settings/_tabs/'
@@ -1386,13 +1386,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersRouteImport
       parentRoute: typeof AppOrganizationIdRoute
     }
-    '/_app/$organizationId/integrations': {
-      id: '/_app/$organizationId/integrations'
-      path: '/integrations'
-      fullPath: '/$organizationId/integrations'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsRouteImport
-      parentRoute: typeof AppOrganizationIdRoute
-    }
     '/_app/$organizationId/account': {
       id: '/_app/$organizationId/account'
       path: '/account'
@@ -1477,6 +1470,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdRoute
     }
+    '/_app/$organizationId/$projectId/integrations': {
+      id: '/_app/$organizationId/$projectId/integrations'
+      path: '/integrations'
+      fullPath: '/$organizationId/$projectId/integrations'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdRoute
+    }
     '/_app/$organizationId/$projectId/events': {
       id: '/_app/$organizationId/$projectId/events'
       path: '/events'
@@ -1512,13 +1512,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsRouteImport
       parentRoute: typeof AppOrganizationIdMembersRoute
     }
-    '/_app/$organizationId/integrations/_tabs': {
-      id: '/_app/$organizationId/integrations/_tabs'
-      path: '/integrations'
-      fullPath: '/$organizationId/integrations'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsRoute
-    }
     '/_app/$organizationId/account/_tabs': {
       id: '/_app/$organizationId/account/_tabs'
       path: '/account'
@@ -1624,13 +1617,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsIndexRouteImport
       parentRoute: typeof AppOrganizationIdMembersTabsRoute
     }
-    '/_app/$organizationId/integrations/_tabs/': {
-      id: '/_app/$organizationId/integrations/_tabs/'
-      path: '/'
-      fullPath: '/$organizationId/integrations/'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsIndexRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
     '/_app/$organizationId/account/_tabs/': {
       id: '/_app/$organizationId/account/_tabs/'
       path: '/'
@@ -1652,20 +1638,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsInvitationsRouteImport
       parentRoute: typeof AppOrganizationIdMembersTabsRoute
     }
-    '/_app/$organizationId/integrations/_tabs/installed': {
-      id: '/_app/$organizationId/integrations/_tabs/installed'
-      path: '/installed'
-      fullPath: '/$organizationId/integrations/installed'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsInstalledRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
-    '/_app/$organizationId/integrations/_tabs/available': {
-      id: '/_app/$organizationId/integrations/_tabs/available'
-      path: '/available'
-      fullPath: '/$organizationId/integrations/available'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsAvailableRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
     '/_app/$organizationId/account/_tabs/two-factor': {
       id: '/_app/$organizationId/account/_tabs/two-factor'
       path: '/two-factor'
@@ -1715,6 +1687,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs'
+      path: '/integrations'
+      fullPath: '/$organizationId/$projectId/integrations'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsRoute
+    }
     '/_app/$organizationId/$projectId/events/_tabs': {
       id: '/_app/$organizationId/$projectId/events/_tabs'
       path: '/events'
@@ -1750,6 +1729,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsIndexRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs/': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/'
+      path: '/'
+      fullPath: '/$organizationId/$projectId/integrations/'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
     '/_app/$organizationId/$projectId/events/_tabs/': {
       id: '/_app/$organizationId/$projectId/events/_tabs/'
       path: '/'
@@ -1855,6 +1841,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs/installed': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/installed'
+      path: '/installed'
+      fullPath: '/$organizationId/$projectId/integrations/installed'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
+    '/_app/$organizationId/$projectId/integrations/_tabs/available': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/available'
+      path: '/available'
+      fullPath: '/$organizationId/$projectId/integrations/available'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
     '/_app/$organizationId/$projectId/groups_/$groupId/_tabs': {
       id: '/_app/$organizationId/$projectId/groups_/$groupId/_tabs'
       path: '/groups/$groupId'
@@ -1995,6 +1995,42 @@ const AppOrganizationIdProjectIdEventsRouteWithChildren =
     AppOrganizationIdProjectIdEventsRouteChildren,
   )
 
+interface AppOrganizationIdProjectIdIntegrationsTabsRouteChildren {
+  AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
+  AppOrganizationIdProjectIdIntegrationsTabsIndexRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
+}
+
+const AppOrganizationIdProjectIdIntegrationsTabsRouteChildren: AppOrganizationIdProjectIdIntegrationsTabsRouteChildren =
+  {
+    AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute,
+    AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute,
+    AppOrganizationIdProjectIdIntegrationsTabsIndexRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsIndexRoute,
+  }
+
+const AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren =
+  AppOrganizationIdProjectIdIntegrationsTabsRoute._addFileChildren(
+    AppOrganizationIdProjectIdIntegrationsTabsRouteChildren,
+  )
+
+interface AppOrganizationIdProjectIdIntegrationsRouteChildren {
+  AppOrganizationIdProjectIdIntegrationsTabsRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
+}
+
+const AppOrganizationIdProjectIdIntegrationsRouteChildren: AppOrganizationIdProjectIdIntegrationsRouteChildren =
+  {
+    AppOrganizationIdProjectIdIntegrationsTabsRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren,
+  }
+
+const AppOrganizationIdProjectIdIntegrationsRouteWithChildren =
+  AppOrganizationIdProjectIdIntegrationsRoute._addFileChildren(
+    AppOrganizationIdProjectIdIntegrationsRouteChildren,
+  )
+
 interface AppOrganizationIdProjectIdNotificationsTabsRouteChildren {
   AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute: typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   AppOrganizationIdProjectIdNotificationsTabsRulesRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
@@ -2249,6 +2285,7 @@ interface AppOrganizationIdProjectIdRouteChildren {
   AppOrganizationIdProjectIdIndexRoute: typeof AppOrganizationIdProjectIdIndexRoute
   AppOrganizationIdProjectIdDashboardsDashboardIdRoute: typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   AppOrganizationIdProjectIdEventsRoute: typeof AppOrganizationIdProjectIdEventsRouteWithChildren
+  AppOrganizationIdProjectIdIntegrationsRoute: typeof AppOrganizationIdProjectIdIntegrationsRouteWithChildren
   AppOrganizationIdProjectIdNotificationsRoute: typeof AppOrganizationIdProjectIdNotificationsRouteWithChildren
   AppOrganizationIdProjectIdProfilesRoute: typeof AppOrganizationIdProjectIdProfilesRouteWithChildren
   AppOrganizationIdProjectIdReportsReportIdRoute: typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -2283,6 +2320,8 @@ const AppOrganizationIdProjectIdRouteChildren: AppOrganizationIdProjectIdRouteCh
       AppOrganizationIdProjectIdDashboardsDashboardIdRoute,
     AppOrganizationIdProjectIdEventsRoute:
       AppOrganizationIdProjectIdEventsRouteWithChildren,
+    AppOrganizationIdProjectIdIntegrationsRoute:
+      AppOrganizationIdProjectIdIntegrationsRouteWithChildren,
     AppOrganizationIdProjectIdNotificationsRoute:
       AppOrganizationIdProjectIdNotificationsRouteWithChildren,
     AppOrganizationIdProjectIdProfilesRoute:
@@ -2340,42 +2379,6 @@ const AppOrganizationIdAccountRouteWithChildren =
     AppOrganizationIdAccountRouteChildren,
   )
 
-interface AppOrganizationIdIntegrationsTabsRouteChildren {
-  AppOrganizationIdIntegrationsTabsAvailableRoute: typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  AppOrganizationIdIntegrationsTabsInstalledRoute: typeof AppOrganizationIdIntegrationsTabsInstalledRoute
-  AppOrganizationIdIntegrationsTabsIndexRoute: typeof AppOrganizationIdIntegrationsTabsIndexRoute
-}
-
-const AppOrganizationIdIntegrationsTabsRouteChildren: AppOrganizationIdIntegrationsTabsRouteChildren =
-  {
-    AppOrganizationIdIntegrationsTabsAvailableRoute:
-      AppOrganizationIdIntegrationsTabsAvailableRoute,
-    AppOrganizationIdIntegrationsTabsInstalledRoute:
-      AppOrganizationIdIntegrationsTabsInstalledRoute,
-    AppOrganizationIdIntegrationsTabsIndexRoute:
-      AppOrganizationIdIntegrationsTabsIndexRoute,
-  }
-
-const AppOrganizationIdIntegrationsTabsRouteWithChildren =
-  AppOrganizationIdIntegrationsTabsRoute._addFileChildren(
-    AppOrganizationIdIntegrationsTabsRouteChildren,
-  )
-
-interface AppOrganizationIdIntegrationsRouteChildren {
-  AppOrganizationIdIntegrationsTabsRoute: typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
-}
-
-const AppOrganizationIdIntegrationsRouteChildren: AppOrganizationIdIntegrationsRouteChildren =
-  {
-    AppOrganizationIdIntegrationsTabsRoute:
-      AppOrganizationIdIntegrationsTabsRouteWithChildren,
-  }
-
-const AppOrganizationIdIntegrationsRouteWithChildren =
-  AppOrganizationIdIntegrationsRoute._addFileChildren(
-    AppOrganizationIdIntegrationsRouteChildren,
-  )
-
 interface AppOrganizationIdMembersTabsRouteChildren {
   AppOrganizationIdMembersTabsInvitationsRoute: typeof AppOrganizationIdMembersTabsInvitationsRoute
   AppOrganizationIdMembersTabsMembersRoute: typeof AppOrganizationIdMembersTabsMembersRoute
@@ -2418,7 +2421,6 @@ interface AppOrganizationIdRouteChildren {
   AppOrganizationIdSettingsRoute: typeof AppOrganizationIdSettingsRoute
   AppOrganizationIdIndexRoute: typeof AppOrganizationIdIndexRoute
   AppOrganizationIdAccountRoute: typeof AppOrganizationIdAccountRouteWithChildren
-  AppOrganizationIdIntegrationsRoute: typeof AppOrganizationIdIntegrationsRouteWithChildren
   AppOrganizationIdMembersRoute: typeof AppOrganizationIdMembersRouteWithChildren
 }
 
@@ -2428,8 +2430,6 @@ const AppOrganizationIdRouteChildren: AppOrganizationIdRouteChildren = {
   AppOrganizationIdSettingsRoute: AppOrganizationIdSettingsRoute,
   AppOrganizationIdIndexRoute: AppOrganizationIdIndexRoute,
   AppOrganizationIdAccountRoute: AppOrganizationIdAccountRouteWithChildren,
-  AppOrganizationIdIntegrationsRoute:
-    AppOrganizationIdIntegrationsRouteWithChildren,
   AppOrganizationIdMembersRoute: AppOrganizationIdMembersRouteWithChildren,
 }
 
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
similarity index 79%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
index d9c66d13a..71f94be10 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
@@ -2,7 +2,7 @@ import { AllIntegrations } from '@/components/integrations/all-integrations';
 import { createFileRoute } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/available',
+  '/_app/$organizationId/$projectId/integrations/_tabs/available',
 )({
   component: Component,
 });
diff --git a/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx
new file mode 100644
index 000000000..132dd083f
--- /dev/null
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx
@@ -0,0 +1,17 @@
+import { createFileRoute, redirect } from '@tanstack/react-router';
+
+export const Route = createFileRoute(
+  '/_app/$organizationId/$projectId/integrations/_tabs/',
+)({
+  component: Component,
+  beforeLoad({ params }) {
+    throw redirect({
+      to: '/$organizationId/$projectId/integrations/installed',
+      params,
+    });
+  },
+});
+
+function Component() {
+  return null;
+}
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
similarity index 80%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
index f55928297..796905da3 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
@@ -2,7 +2,7 @@ import { ActiveIntegrations } from '@/components/integrations/active-integration
 import { createFileRoute } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/installed',
+  '/_app/$organizationId/$projectId/integrations/_tabs/installed',
 )({
   component: Component,
 });
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
similarity index 65%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
index 27ea87a54..f652542f1 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
@@ -1,35 +1,22 @@
-import FullPageLoadingState from '@/components/full-page-loading-state';
 import { PageHeader } from '@/components/page-header';
 import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { usePageTabs } from '@/hooks/use-page-tabs';
-import { PAGE_TITLES, createOrganizationTitle } from '@/utils/title';
+import { PAGE_TITLES, createProjectTitle } from '@/utils/title';
 import { Outlet, createFileRoute, useRouter } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs',
+  '/_app/$organizationId/$projectId/integrations/_tabs',
 )({
   component: Component,
-  loader: async ({ context, params }) => {
-    const organization = await context.queryClient.fetchQuery(
-      context.trpc.organization.get.queryOptions({
-        organizationId: params.organizationId,
-      }),
-    );
-    return { organization };
-  },
-  head: ({ loaderData }) => {
+  head: () => {
     return {
       meta: [
         {
-          title: createOrganizationTitle(
-            PAGE_TITLES.INTEGRATIONS,
-            loaderData?.organization?.name,
-          ),
+          title: createProjectTitle(PAGE_TITLES.INTEGRATIONS),
         },
       ],
     };
   },
-  pendingComponent: FullPageLoadingState,
 });
 
 function Component() {
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx b/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx
deleted file mode 100644
index 7e2ed4a51..000000000
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-import { redirect } from '@tanstack/react-router';
-import { createFileRoute } from '@tanstack/react-router';
-
-export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/',
-)({
-  component: Component,
-  beforeLoad: ({ params }) => {
-    throw redirect({
-      to: '/$organizationId/integrations/installed',
-      params,
-    });
-  },
-});
-
-function Component() {
-  return null;
-}
diff --git a/apps/worker/src/jobs/cron.flush-exports.ts b/apps/worker/src/jobs/cron.flush-exports.ts
index a3a45f502..ddfa535f7 100644
--- a/apps/worker/src/jobs/cron.flush-exports.ts
+++ b/apps/worker/src/jobs/cron.flush-exports.ts
@@ -90,14 +90,27 @@ export async function flushExportsJob(_job: Job<CronQueuePayload>) {
     return;
   }
 
-  // Integrations are org-scoped, so every active project in the org exports
-  // independently (each gets its own watermark + object path).
+  // Project-scoped integrations export exactly their one project. Legacy
+  // org-wide integrations (projectId == null) still fan out across every active
+  // project in the org. Either way each (project, integration) pair gets its own
+  // watermark + object path.
   const items: Array<{
     projectId: string;
     integrationId: string;
     config: ExportConfig;
   }> = [];
   for (const integration of exportIntegrations) {
+    const config = integration.config as ExportConfig;
+
+    if (integration.projectId) {
+      items.push({
+        projectId: integration.projectId,
+        integrationId: integration.id,
+        config,
+      });
+      continue;
+    }
+
     const projects = await db.project.findMany({
       where: { organizationId: integration.organizationId, deleteAt: null },
       select: { id: true },
@@ -106,7 +119,7 @@ export async function flushExportsJob(_job: Job<CronQueuePayload>) {
       items.push({
         projectId: project.id,
         integrationId: integration.id,
-        config: integration.config as ExportConfig,
+        config,
       });
     }
   }
diff --git a/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql b/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql
new file mode 100644
index 000000000..37c33032e
--- /dev/null
+++ b/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "public"."integrations" ADD COLUMN     "projectId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "integrations_organizationId_idx" ON "public"."integrations"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "integrations_projectId_idx" ON "public"."integrations"("projectId");
+
+-- AddForeignKey
+ALTER TABLE "public"."integrations" ADD CONSTRAINT "integrations_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "public"."projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index 1838722a5..8dfb8900a 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -254,6 +254,7 @@ model Project {
   gscConnection     GscConnection?
   cohorts           Cohort[]
   exportWatermarks  ExportWatermark[]
+  integrations      Integration[]
 
   // When deleteAt > now(), the project will be deleted
   deleteAt DateTime?
@@ -583,12 +584,19 @@ model Integration {
   config            Json
   organization      Organization       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   organizationId    String
+  // When set, the integration is scoped to a single project; null = legacy
+  // org-wide (applies to every project in the org). organizationId is kept
+  // (derived from the project on create) so org-level queries/cascades still work.
+  project           Project?           @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  projectId         String?
   notificationRules NotificationRule[]
   notifications     Notification[]
   exportWatermarks  ExportWatermark[]
   createdAt         DateTime           @default(now())
   updatedAt         DateTime           @default(now()) @updatedAt
 
+  @@index([organizationId])
+  @@index([projectId])
   @@map("integrations")
 }
 
diff --git a/packages/db/src/services/notification.service.ts b/packages/db/src/services/notification.service.ts
index 5b357151a..9ed70b592 100644
--- a/packages/db/src/services/notification.service.ts
+++ b/packages/db/src/services/notification.service.ts
@@ -49,6 +49,7 @@ export const BASE_INTEGRATIONS: Integration[] = [
       type: APP_NOTIFICATION_INTEGRATION_ID,
     },
     organizationId: '',
+    projectId: null,
   },
   // {
   //   id: EMAIL_NOTIFICATION_INTEGRATION_ID,
diff --git a/packages/integrations/src/slack.ts b/packages/integrations/src/slack.ts
index 893751510..2f6de644c 100644
--- a/packages/integrations/src/slack.ts
+++ b/packages/integrations/src/slack.ts
@@ -25,7 +25,8 @@ export const slackInstaller = SLACK_CLIENT_ID
 export const getSlackInstallUrl = ({
   integrationId,
   organizationId,
-}: { integrationId: string; organizationId: string }) => {
+  projectId,
+}: { integrationId: string; organizationId: string; projectId: string }) => {
   if (!SLACK_CLIENT_ID) {
     throw new Error('SLACK_CLIENT_ID is not set (slack.ts)');
   }
@@ -37,7 +38,7 @@ export const getSlackInstallUrl = ({
       'team:read',
     ],
     redirectUri: SLACK_OAUTH_REDIRECT_URL,
-    metadata: JSON.stringify({ integrationId, organizationId }),
+    metadata: JSON.stringify({ integrationId, organizationId, projectId }),
   });
 };
 
diff --git a/packages/trpc/src/routers/integration.ts b/packages/trpc/src/routers/integration.ts
index dadc8112e..804993f41 100644
--- a/packages/trpc/src/routers/integration.ts
+++ b/packages/trpc/src/routers/integration.ts
@@ -16,11 +16,42 @@ import {
   zCreateSlackIntegration,
   zCreateWebhookIntegration,
 } from '@openpanel/validation';
-import { getOrganizationAccess } from '../access';
+import { getOrganizationAccess, getProjectAccess } from '../access';
 import { TRPCForbiddenError, TRPCBadRequestError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
 import { validate as validateJavaScriptTemplate } from '@openpanel/js-runtime';
 
+// Assert the user can access the project, and return the project's
+// organizationId (still stored on the integration for org-level queries/cascades).
+async function assertProjectAccessAndGetOrg(userId: string, projectId: string) {
+  const access = await getProjectAccess({ userId, projectId });
+  if (!access) {
+    throw new TRPCForbiddenError('You do not have access to this project');
+  }
+  const project = await db.project.findUniqueOrThrow({
+    where: { id: projectId },
+    select: { organizationId: true },
+  });
+  return project.organizationId;
+}
+
+// Access check for an existing integration of either scope: project-scoped rows
+// check project access; legacy org-wide rows (projectId null) check org access.
+async function assertIntegrationAccess(
+  userId: string,
+  integration: { projectId: string | null; organizationId: string },
+) {
+  const access = integration.projectId
+    ? await getProjectAccess({ userId, projectId: integration.projectId })
+    : await getOrganizationAccess({
+        userId,
+        organizationId: integration.organizationId,
+      });
+  if (!access) {
+    throw new TRPCForbiddenError('You do not have access to this integration');
+  }
+}
+
 export const integrationRouter = createTRPCRouter({
   get: protectedProcedure
     .input(z.object({ id: z.string() }))
@@ -31,23 +62,27 @@ export const integrationRouter = createTRPCRouter({
         },
       });
 
-      const access = await getOrganizationAccess({
-        userId: ctx.session.userId,
-        organizationId: integration.organizationId,
-      });
-
-      if (!access) {
-        throw new TRPCForbiddenError('You do not have access to this project');
-      }
+      await assertIntegrationAccess(ctx.session.userId, integration);
 
       return integration;
     }),
   list: protectedProcedure
-    .input(z.object({ organizationId: z.string() }))
-    .query(async ({ input }) => {
+    .input(z.object({ projectId: z.string() }))
+    .query(async ({ input, ctx }) => {
+      const organizationId = await assertProjectAccessAndGetOrg(
+        ctx.session.userId,
+        input.projectId,
+      );
+
       const integrations = await db.integration.findMany({
         where: {
-          organizationId: input.organizationId,
+          // The project's own integrations, plus legacy org-wide integrations
+          // (projectId null) so they stay visible/selectable during the
+          // transition off org-scoping.
+          OR: [
+            { projectId: input.projectId },
+            { projectId: null, organizationId },
+          ],
           config: {
             not: {},
           },
@@ -58,49 +93,51 @@ export const integrationRouter = createTRPCRouter({
     }),
   createOrUpdateSlack: protectedProcedure
     .input(zCreateSlackIntegration)
-    .mutation(async ({ input }) => {
-      if (input.id) {
-        const res = await db.integration.update({
-          where: {
-            id: input.id,
-            organizationId: input.organizationId,
-          },
-          data: {
-            name: input.name,
-            // This is empty and will be filled by the webhook
-            config: {} as ISlackConfig,
-          },
-        });
-
-        return {
-          ...res,
-          slackInstallUrl: await getSlackInstallUrl({
-            integrationId: res.id,
-            organizationId: input.organizationId,
-          }),
-        };
-      }
+    .mutation(async ({ input, ctx }) => {
+      const organizationId = await assertProjectAccessAndGetOrg(
+        ctx.session.userId,
+        input.projectId,
+      );
 
-      const res = await db.integration.create({
-        data: {
-          name: input.name,
-          organizationId: input.organizationId,
-          // This is empty and will be filled by the webhook
-          config: {} as ISlackConfig,
-        },
-      });
+      const res = input.id
+        ? await db.integration.update({
+            where: {
+              id: input.id,
+              organizationId,
+            },
+            data: {
+              name: input.name,
+              // This is empty and will be filled by the webhook
+              config: {} as ISlackConfig,
+            },
+          })
+        : await db.integration.create({
+            data: {
+              name: input.name,
+              organizationId,
+              projectId: input.projectId,
+              // This is empty and will be filled by the webhook
+              config: {} as ISlackConfig,
+            },
+          });
 
       return {
         ...res,
         slackInstallUrl: await getSlackInstallUrl({
           integrationId: res.id,
-          organizationId: input.organizationId,
+          organizationId,
+          projectId: input.projectId,
         }),
       };
     }),
   createOrUpdate: protectedProcedure
     .input(z.union([zCreateDiscordIntegration, zCreateWebhookIntegration]))
-    .mutation(async ({ input }) => {
+    .mutation(async ({ input, ctx }) => {
+      const organizationId = await assertProjectAccessAndGetOrg(
+        ctx.session.userId,
+        input.projectId,
+      );
+
       // Validate JavaScript template if mode is javascript
       if (
         input.config.type === 'webhook' &&
@@ -121,7 +158,7 @@ export const integrationRouter = createTRPCRouter({
         return db.integration.update({
           where: {
             id: input.id,
-            organizationId: input.organizationId,
+            organizationId,
           },
           data: {
             name: input.name,
@@ -132,7 +169,8 @@ export const integrationRouter = createTRPCRouter({
       return db.integration.create({
         data: {
           name: input.name,
-          organizationId: input.organizationId,
+          organizationId,
+          projectId: input.projectId,
           config: input.config,
         },
       });
@@ -141,7 +179,12 @@ export const integrationRouter = createTRPCRouter({
     .input(
       z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]),
     )
-    .mutation(async ({ input }) => {
+    .mutation(async ({ input, ctx }) => {
+      const organizationId = await assertProjectAccessAndGetOrg(
+        ctx.session.userId,
+        input.projectId,
+      );
+
       // Test connection before saving (using unencrypted credentials)
       if (input.config.type === 's3_export') {
         const adapter = createS3Adapter(input.config);
@@ -179,7 +222,7 @@ export const integrationRouter = createTRPCRouter({
         return db.integration.update({
           where: {
             id: input.id,
-            organizationId: input.organizationId,
+            organizationId,
           },
           data: {
             name: input.name,
@@ -190,7 +233,8 @@ export const integrationRouter = createTRPCRouter({
       return db.integration.create({
         data: {
           name: input.name,
-          organizationId: input.organizationId,
+          organizationId,
+          projectId: input.projectId,
           config: configToSave,
         },
       });
@@ -219,14 +263,7 @@ export const integrationRouter = createTRPCRouter({
         },
       });
 
-      const access = await getOrganizationAccess({
-        userId: ctx.session.userId,
-        organizationId: integration.organizationId,
-      });
-
-      if (!access) {
-        throw new TRPCForbiddenError('You do not have access to this project');
-      }
+      await assertIntegrationAccess(ctx.session.userId, integration);
 
       return db.integration.delete({
         where: {
diff --git a/packages/trpc/src/routers/notification.ts b/packages/trpc/src/routers/notification.ts
index ec74d2de5..1d78d6113 100644
--- a/packages/trpc/src/routers/notification.ts
+++ b/packages/trpc/src/routers/notification.ts
@@ -11,7 +11,7 @@ import {
 import { zCreateNotificationRule } from '@openpanel/validation';
 
 import { getProjectAccess } from '../access';
-import { TRPCForbiddenError } from '../errors';
+import { TRPCBadRequestError, TRPCForbiddenError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
 
 export const notificationRouter = createTRPCRouter({
@@ -80,6 +80,48 @@ export const notificationRouter = createTRPCRouter({
       // Clear the cache for the project
       await getNotificationRulesByProjectId.clear(input.projectId);
 
+      // Authorize the target project (covers both create and update; the create
+      // branch previously had no access check) and verify every connected
+      // integration belongs to this project or is a legacy org-wide one in the
+      // same org — never another project's.
+      const project = await db.project.findUniqueOrThrow({
+        where: { id: input.projectId },
+        select: { organizationId: true },
+      });
+      const access = await getProjectAccess({
+        userId: ctx.session.userId,
+        projectId: input.projectId,
+      });
+      if (!access) {
+        throw new TRPCForbiddenError('You do not have access to this project');
+      }
+
+      const integrationIds = input.integrations.filter(
+        (id) => !isBaseIntegration(id),
+      );
+      if (integrationIds.length > 0) {
+        const integrations = await db.integration.findMany({
+          where: { id: { in: integrationIds } },
+          select: { id: true, projectId: true, organizationId: true },
+        });
+        if (integrations.length !== integrationIds.length) {
+          throw new TRPCBadRequestError(
+            'One or more integrations were not found',
+          );
+        }
+        for (const integration of integrations) {
+          const sameProject = integration.projectId === input.projectId;
+          const orgWideSameOrg =
+            integration.projectId === null &&
+            integration.organizationId === project.organizationId;
+          if (!sameProject && !orgWideSameOrg) {
+            throw new TRPCForbiddenError(
+              'Integration does not belong to this project',
+            );
+          }
+        }
+      }
+
       if (input.id) {
         const existing = await db.notificationRule.findUniqueOrThrow({
           where: {
diff --git a/packages/validation/src/index.ts b/packages/validation/src/index.ts
index 31483aeb4..34edb45a5 100644
--- a/packages/validation/src/index.ts
+++ b/packages/validation/src/index.ts
@@ -514,7 +514,7 @@ export type IIntegrationConfig =
 const zCreateIntegration = z.object({
   id: z.string().optional(),
   name: z.string().min(1),
-  organizationId: z.string().min(1),
+  projectId: z.string().min(1),
 });
 
 export const zCreateSlackIntegration = zCreateIntegration;

From 20e32fc1526ae71c9d6e7a1072f9be4e7e890351 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Tue, 23 Jun 2026 12:23:02 +0200
Subject: [PATCH 3/8] refactor: integration plugin registry (generic dispatch)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase 2 of the integrations rework. Restructures integrations as three
registries keyed by the same `type` literal so adding one is additive — no
edits to central switches — while keeping types bulletproof.

Type safety (the priority): IIntegrationConfig stays the explicit, hand-written
discriminated union (source of truth, feeds Prisma's IPrismaIntegrationConfig).
It is NOT derived from the registry. The registries are forced to MATCH it via
`satisfies Record<IIntegrationConfig['type'], …>`, and two compile-time guards
in validation fail the build if any union member loses its literal `type`
discriminant or if the descriptor set drifts from the union.

- core (packages/validation/src/integrations.ts): per-type zod schemas + an
  INTEGRATION_DESCRIPTORS registry (kinds/setup/configSchema/catalog),
  getDescriptor/isKind, a runtime zIntegrationConfig, a generic
  zCreateIntegration, and the type-level guards.
- server (packages/integrations/src/registry.ts): IServerIntegration<T> +
  SERVER_INTEGRATIONS with notification.deliver / export.createAdapter /
  validateConfig / testConnection / encryptCredentials hooks. The bespoke
  slack/discord/webhook send bodies and s3/gcs adapter+encrypt logic moved here.
  getServerIntegration<T> holds the one contained cast.
- client (apps/start integrations.tsx): CLIENT_INTEGRATIONS (icon + Form) keyed
  by type; the catalog is derived from descriptors. add-integration.tsx renders
  via registry lookup instead of a switch.
- dispatch made generic: worker notification.ts and cron.flush-exports.ts look
  up the plugin; the tRPC router collapses to a generic createOrUpdate +
  testConnection delegating to plugin hooks (export/slack procedures kept as
  thin aliases for one release).
- fixed the discord form's server value-import (browser-bundle leak) by routing
  its test through trpc.integration.testConnection.

Deferred (demand-driven): the generic /oauth/:type route only benefits a second
OAuth integration and carries external Slack-redirect-URI risk, so slack OAuth
is unchanged. Legacy zCreate* schemas + tRPC aliases kept until the dashboard
drops them.

typecheck + tests green (657).

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 .../forms/discord-integration.tsx             |  15 +-
 .../components/integrations/integrations.tsx  |  98 +++--
 apps/start/src/modals/add-integration.tsx     |  52 +--
 apps/worker/src/jobs/cron.flush-exports.ts    |  29 +-
 apps/worker/src/jobs/notification.ts          |  73 +---
 packages/integrations/package.json            |   3 +-
 packages/integrations/src/registry.ts         | 195 ++++++++++
 packages/trpc/src/routers/integration.ts      | 210 ++++------
 packages/validation/src/index.ts              | 145 +------
 packages/validation/src/integrations.ts       | 361 ++++++++++++++++++
 pnpm-lock.yaml                                |  19 +-
 11 files changed, 774 insertions(+), 426 deletions(-)
 create mode 100644 packages/integrations/src/registry.ts
 create mode 100644 packages/validation/src/integrations.ts

diff --git a/apps/start/src/components/integrations/forms/discord-integration.tsx b/apps/start/src/components/integrations/forms/discord-integration.tsx
index 2823c6d63..985253d96 100644
--- a/apps/start/src/components/integrations/forms/discord-integration.tsx
+++ b/apps/start/src/components/integrations/forms/discord-integration.tsx
@@ -4,7 +4,6 @@ import { useAppParams } from '@/hooks/use-app-params';
 import { useTRPC } from '@/integrations/trpc/react';
 import type { RouterOutputs } from '@/trpc/client';
 import { zodResolver } from '@hookform/resolvers/zod';
-import { sendTestDiscordNotification } from '@openpanel/integrations/src/discord';
 import { zCreateDiscordIntegration } from '@openpanel/validation';
 import { useMutation } from '@tanstack/react-query';
 import { path, mergeDeepRight } from 'ramda';
@@ -55,13 +54,19 @@ export function DiscordIntegrationForm({
     toast.error('Validation error');
   };
 
+  const testMutation = useMutation(
+    trpc.integration.testConnection.mutationOptions(),
+  );
+
   const handleTest = async () => {
-    const webhookUrl = form.getValues('config.url');
-    if (!webhookUrl) {
+    const url = form.getValues('config.url');
+    if (!url) {
       return toast.error('Webhook URL is required');
     }
-    const res = await sendTestDiscordNotification(webhookUrl);
-    if (res.ok) {
+    const res = await testMutation.mutateAsync({
+      config: { type: 'discord', url },
+    });
+    if (res.success) {
       toast.success('Test notification sent');
     } else {
       toast.error('Failed to send test notification');
diff --git a/apps/start/src/components/integrations/integrations.tsx b/apps/start/src/components/integrations/integrations.tsx
index 62649658f..f48265fd1 100644
--- a/apps/start/src/components/integrations/integrations.tsx
+++ b/apps/start/src/components/integrations/integrations.tsx
@@ -1,71 +1,115 @@
-import type { IIntegrationConfig } from '@openpanel/validation';
-import { CloudIcon, DatabaseIcon, WebhookIcon } from 'lucide-react';
+import type { RouterOutputs } from '@/trpc/client';
+import {
+  INTEGRATION_DESCRIPTORS,
+  type IIntegrationType,
+} from '@openpanel/validation';
+import { BoxIcon, CloudIcon, DatabaseIcon, WebhookIcon } from 'lucide-react';
+import { DiscordIntegrationForm } from './forms/discord-integration';
+import { GCSExportIntegrationForm } from './forms/gcs-export-integration';
+import { S3ExportIntegrationForm } from './forms/s3-export-integration';
+import { SlackIntegrationForm } from './forms/slack-integration';
+import { WebhookIntegrationForm } from './forms/webhook-integration';
 import {
   IntegrationCardLogo,
   IntegrationCardLogoImage,
 } from './integration-card';
 
-export const INTEGRATIONS: {
-  type: IIntegrationConfig['type'];
-  name: string;
-  description: string;
+type IntegrationFormComponent = React.ComponentType<{
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}>;
+
+interface IClientIntegration {
+  type: IIntegrationType;
+  // React-only bits that can't live in the validation/server registries.
   icon: React.ReactNode;
-}[] = [
+  // Omitted for pseudo-integrations (app/email) that aren't user-configured.
+  Form?: IntegrationFormComponent;
+}
+
+const placeholderIcon = (
+  <IntegrationCardLogo className="bg-def-200 text-foreground">
+    <BoxIcon className="size-10" strokeWidth={1} />
+  </IntegrationCardLogo>
+);
+
+/**
+ * Client registry — the per-integration UI. Keyed by the same `type` literal as
+ * the core (validation) and server (integrations) registries and forced to
+ * cover every type via `satisfies Record<IIntegrationType, …>`, so a new
+ * integration that forgets its UI entry is a compile error. Catalog strings
+ * (name/description) come from the core descriptors, declared once.
+ */
+export const CLIENT_INTEGRATIONS: Record<IIntegrationType, IClientIntegration> =
   {
+  slack: {
     type: 'slack',
-    name: 'Slack',
-    description:
-      'Connect your Slack workspace to get notified when new issues are created.',
     icon: (
       <IntegrationCardLogoImage
         src="https://play-lh.googleusercontent.com/mzJpTCsTW_FuR6YqOPaLHrSEVCSJuXzCljdxnCKhVZMcu6EESZBQTCHxMh8slVtnKqo"
         backgroundColor="#481449"
       />
     ),
+    Form: SlackIntegrationForm,
   },
-  {
+  discord: {
     type: 'discord',
-    name: 'Discord',
-    description:
-      'Connect your Discord server to get notified when new issues are created.',
     icon: (
       <IntegrationCardLogoImage
         src="https://static.vecteezy.com/system/resources/previews/006/892/625/non_2x/discord-logo-icon-editorial-free-vector.jpg"
         backgroundColor="#5864F2"
       />
     ),
+    Form: DiscordIntegrationForm,
   },
-  {
+  webhook: {
     type: 'webhook',
-    name: 'Webhook',
-    description:
-      'Create a webhook to take actions in your own systems when new events are created.',
     icon: (
       <IntegrationCardLogo className="bg-foreground text-background">
         <WebhookIcon className="size-10" />
       </IntegrationCardLogo>
     ),
+    Form: WebhookIntegrationForm,
   },
-  {
+  app: { type: 'app', icon: placeholderIcon },
+  email: { type: 'email', icon: placeholderIcon },
+  s3_export: {
     type: 's3_export',
-    name: 'S3 Export',
-    description:
-      'Export events to Amazon S3 for loading into Redshift, Snowflake, Athena, or other data warehouses.',
     icon: (
       <IntegrationCardLogo className="bg-[#FF9900] text-white">
         <CloudIcon className="size-10" />
       </IntegrationCardLogo>
     ),
+    Form: S3ExportIntegrationForm,
   },
-  {
+  gcs_export: {
     type: 'gcs_export',
-    name: 'GCS Export',
-    description:
-      'Export events to Google Cloud Storage for loading into BigQuery or other data warehouses.',
     icon: (
       <IntegrationCardLogo className="bg-[#4285F4] text-white">
         <DatabaseIcon className="size-10" />
       </IntegrationCardLogo>
     ),
+    Form: GCSExportIntegrationForm,
   },
-];
+  };
+
+export interface IIntegrationCatalogEntry {
+  type: IIntegrationType;
+  name: string;
+  description: string;
+  icon: React.ReactNode;
+}
+
+/**
+ * The "available integrations" catalog, derived from the core descriptors
+ * (visible ones) joined with each integration's client icon.
+ */
+export const INTEGRATIONS: IIntegrationCatalogEntry[] =
+  INTEGRATION_DESCRIPTORS.filter(
+    (d) => !('hidden' in d.catalog && d.catalog.hidden),
+  ).map((d) => ({
+    type: d.type,
+    name: d.catalog.name,
+    description: d.catalog.description,
+    icon: CLIENT_INTEGRATIONS[d.type].icon,
+  }));
diff --git a/apps/start/src/modals/add-integration.tsx b/apps/start/src/modals/add-integration.tsx
index 7dea1bb25..2aec336ff 100644
--- a/apps/start/src/modals/add-integration.tsx
+++ b/apps/start/src/modals/add-integration.tsx
@@ -1,12 +1,10 @@
 import { useTRPC } from '@/integrations/trpc/react';
 
-import { DiscordIntegrationForm } from '@/components/integrations/forms/discord-integration';
-import { GCSExportIntegrationForm } from '@/components/integrations/forms/gcs-export-integration';
-import { S3ExportIntegrationForm } from '@/components/integrations/forms/s3-export-integration';
-import { SlackIntegrationForm } from '@/components/integrations/forms/slack-integration';
-import { WebhookIntegrationForm } from '@/components/integrations/forms/webhook-integration';
 import { IntegrationCardContent } from '@/components/integrations/integration-card';
-import { INTEGRATIONS } from '@/components/integrations/integrations';
+import {
+  CLIENT_INTEGRATIONS,
+  INTEGRATIONS,
+} from '@/components/integrations/integrations';
 import { SheetContent } from '@/components/ui/sheet';
 import { useAppParams } from '@/hooks/use-app-params';
 import type { IIntegrationConfig } from '@openpanel/validation';
@@ -71,45 +69,11 @@ export default function AddIntegration(props: Props) {
       return null;
     }
 
-    switch (integration?.type) {
-      case 'webhook':
-        return (
-          <WebhookIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 'discord':
-        return (
-          <DiscordIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 'slack':
-        return (
-          <SlackIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 's3_export':
-        return (
-          <S3ExportIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 'gcs_export':
-        return (
-          <GCSExportIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      default:
-        return null;
+    const Form = CLIENT_INTEGRATIONS[props.type]?.Form;
+    if (!Form) {
+      return null;
     }
+    return <Form defaultValues={query.data} onSuccess={handleSuccess} />;
   };
 
   return (
diff --git a/apps/worker/src/jobs/cron.flush-exports.ts b/apps/worker/src/jobs/cron.flush-exports.ts
index ddfa535f7..77b6037ca 100644
--- a/apps/worker/src/jobs/cron.flush-exports.ts
+++ b/apps/worker/src/jobs/cron.flush-exports.ts
@@ -13,17 +13,15 @@ import {
   serializeManifest,
   TABLE_NAMES,
 } from '@openpanel/db';
-import {
-  createGCSAdapter,
-  createS3Adapter,
-  type IObjectStoreAdapter,
-} from '@openpanel/integrations/src/object-store';
+import type { IObjectStoreAdapter } from '@openpanel/integrations/src/object-store';
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
 import { createLogger } from '@openpanel/logger';
 import type { CronQueuePayload } from '@openpanel/queue';
-import type {
-  IGCSExportConfig,
-  IIntegrationConfig,
-  IS3ExportConfig,
+import {
+  type IGCSExportConfig,
+  type IIntegrationConfig,
+  type IS3ExportConfig,
+  isKind,
 } from '@openpanel/validation';
 import type { Job } from 'bullmq';
 
@@ -67,7 +65,8 @@ interface Cursor {
 }
 
 function isExportConfig(config: IIntegrationConfig): config is ExportConfig {
-  return config.type === 's3_export' || config.type === 'gcs_export';
+  // Capability comes from the integration registry, not a hardcoded type list.
+  return isKind(config, 'export');
 }
 
 const formatCh = (date: Date): string =>
@@ -146,10 +145,12 @@ async function processExport(
   config: ExportConfig
 ): Promise<void> {
   let cursor = await loadCursor(projectId, integrationId);
-  const adapter: IObjectStoreAdapter =
-    config.type === 's3_export'
-      ? createS3Adapter(config)
-      : createGCSAdapter(config);
+  const adapter: IObjectStoreAdapter | undefined = getServerIntegration(
+    config.type
+  ).export?.createAdapter(config);
+  if (!adapter) {
+    throw new Error(`Integration ${config.type} has no export adapter`);
+  }
   const prefix = config.prefix || 'openpanel-exports';
   const format = config.format || 'jsonl_gzip';
 
diff --git a/apps/worker/src/jobs/notification.ts b/apps/worker/src/jobs/notification.ts
index 702fa93e3..e011cba4c 100644
--- a/apps/worker/src/jobs/notification.ts
+++ b/apps/worker/src/jobs/notification.ts
@@ -1,9 +1,7 @@
 import type { Job } from 'bullmq';
 
 import { Prisma, db } from '@openpanel/db';
-import { sendDiscordNotification } from '@openpanel/integrations/src/discord';
-import { sendSlackNotification } from '@openpanel/integrations/src/slack';
-import { execute as executeJavaScriptTemplate } from '@openpanel/js-runtime';
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
 import type { NotificationQueuePayload } from '@openpanel/queue';
 import { publishEvent } from '@openpanel/redis';
 
@@ -23,6 +21,7 @@ export async function notificationJob(job: Job<NotificationQueuePayload>) {
     case 'sendNotification': {
       const { notification } = job.data.payload;
 
+      // App + email are pseudo-integrations dispatched by flags, not real rows.
       if (notification.sendToApp) {
         publishEvent('notification', 'created', notification);
         return;
@@ -48,59 +47,23 @@ export async function notificationJob(job: Job<NotificationQueuePayload>) {
         return new Error('Invalid payload');
       }
 
-      switch (integration.config.type) {
-        case 'webhook': {
-          let body: unknown;
-
-          if (integration.config.mode === 'javascript') {
-            // We only transform event payloads for now (not funnel)
-            if (
-              integration.config.javascriptTemplate &&
-              payload.type === 'event'
-            ) {
-              const result = executeJavaScriptTemplate(
-                integration.config.javascriptTemplate,
-                payload.event,
-              );
-              body = result;
-            } else {
-              body = payload;
-            }
-          } else {
-            body = {
-              title: notification.title,
-              message: notification.message,
-            };
-          }
-
-          return fetch(integration.config.url, {
-            method: 'POST',
-            headers: {
-              ...(integration.config.headers ?? {}),
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(body),
-          });
-        }
-        case 'discord': {
-          return sendDiscordNotification({
-            webhookUrl: integration.config.url,
-            message: [
-              `🔔 **${notification.title}**`,
-              notification.message,
-            ].join('\n'),
-          });
-        }
-
-        case 'slack': {
-          return sendSlackNotification({
-            webhookUrl: integration.config.incoming_webhook.url,
-            message: [`🔔 *${notification.title}*`, notification.message].join(
-              '\n',
-            ),
-          });
-        }
+      // Generic registry dispatch — no per-type switch. A new notification
+      // integration just registers a `notification.deliver` plugin.
+      const plugin = getServerIntegration(integration.config.type);
+      if (!plugin.notification) {
+        throw new Error(
+          `Integration ${integration.config.type} is not a notification sink`,
+        );
       }
+
+      return plugin.notification.deliver({
+        config: integration.config,
+        notification: {
+          title: notification.title,
+          message: notification.message,
+        },
+        payload,
+      });
     }
   }
 }
diff --git a/packages/integrations/package.json b/packages/integrations/package.json
index 6dcd4f516..cca334e6f 100644
--- a/packages/integrations/package.json
+++ b/packages/integrations/package.json
@@ -11,13 +11,14 @@
     "@aws-sdk/client-sts": "^3.974.0",
     "@google-cloud/storage": "^7.18.0",
     "@openpanel/common": "workspace:*",
+    "@openpanel/js-runtime": "workspace:*",
+    "@openpanel/validation": "workspace:*",
     "@slack/bolt": "^3.18.0",
     "@slack/oauth": "^3.0.0"
   },
   "devDependencies": {
     "@openpanel/logger": "workspace:*",
     "@openpanel/tsconfig": "workspace:*",
-    "@openpanel/validation": "workspace:*",
     "@types/node": "catalog:",
     "typescript": "catalog:"
   }
diff --git a/packages/integrations/src/registry.ts b/packages/integrations/src/registry.ts
new file mode 100644
index 000000000..b0ab126c8
--- /dev/null
+++ b/packages/integrations/src/registry.ts
@@ -0,0 +1,195 @@
+import { encryptCredential } from '@openpanel/common/server';
+import {
+  execute as executeJavaScriptTemplate,
+  validate as validateJavaScriptTemplate,
+} from '@openpanel/js-runtime';
+import type { IIntegrationConfig } from '@openpanel/validation';
+import {
+  sendDiscordNotification,
+  sendTestDiscordNotification,
+} from './discord';
+import {
+  createGCSAdapter,
+  createS3Adapter,
+  type IObjectStoreAdapter,
+} from './object-store';
+import { sendSlackNotification } from './slack';
+
+/** Narrow the integration config union to one `type`. */
+export type ConfigOf<T extends IIntegrationConfig['type']> = Extract<
+  IIntegrationConfig,
+  { type: T }
+>;
+
+/**
+ * Structural mirror of @openpanel/db `INotificationPayload`, kept local so the
+ * integrations package needn't depend on db. The worker passes the real,
+ * fully-typed payload — it's assignable to this looser shape.
+ */
+export type INotificationDeliverPayload =
+  | { type: 'event'; event: unknown }
+  | { type: 'funnel'; funnel: unknown };
+
+export interface INotificationDeliverArgs<
+  T extends IIntegrationConfig['type'],
+> {
+  config: ConfigOf<T>;
+  notification: { title: string; message: string };
+  payload: INotificationDeliverPayload;
+}
+
+/**
+ * Server-side behavior for one integration type. Capability slots are optional;
+ * which ones are present is declared by the core descriptor's `kinds`. A new
+ * integration adds one entry to SERVER_INTEGRATIONS — the `satisfies Record`
+ * below forces an entry for every union member (a missing one is a compile
+ * error, not a silent runtime gap).
+ *
+ * The notification capability is added in a later step (it needs the db payload
+ * type + js-runtime); export-only for now.
+ */
+export interface IServerIntegration<T extends IIntegrationConfig['type']> {
+  type: T;
+  // Notification sink (delivered when a notification rule matches).
+  notification?: {
+    deliver(args: INotificationDeliverArgs<T>): Promise<unknown> | unknown;
+  };
+  // Object-store export sink.
+  export?: {
+    createAdapter(config: ConfigOf<T>): IObjectStoreAdapter;
+  };
+  // Optional synchronous config validation run before persisting (e.g. webhook
+  // JS template). Returning invalid rejects the create/update.
+  validateConfig?(config: ConfigOf<T>): { valid: boolean; error?: string };
+  // Optional pre-save connection test (used by the generic tRPC procedure).
+  testConnection?(
+    config: ConfigOf<T>,
+  ): Promise<{ success: boolean; error?: string }>;
+  // Optional at-rest credential encryption applied before persisting config.
+  encryptCredentials?(config: ConfigOf<T>): ConfigOf<T>;
+}
+
+const slackServer: IServerIntegration<'slack'> = {
+  type: 'slack',
+  notification: {
+    deliver: ({ config, notification }) =>
+      sendSlackNotification({
+        webhookUrl: config.incoming_webhook.url,
+        message: [`🔔 *${notification.title}*`, notification.message].join('\n'),
+      }),
+  },
+};
+
+const discordServer: IServerIntegration<'discord'> = {
+  type: 'discord',
+  testConnection: async (config) => {
+    const res = await sendTestDiscordNotification(config.url);
+    return res.ok
+      ? { success: true }
+      : { success: false, error: 'Failed to send test notification' };
+  },
+  notification: {
+    deliver: ({ config, notification }) =>
+      sendDiscordNotification({
+        webhookUrl: config.url,
+        message: [`🔔 **${notification.title}**`, notification.message].join(
+          '\n'
+        ),
+      }),
+  },
+};
+
+const webhookServer: IServerIntegration<'webhook'> = {
+  type: 'webhook',
+  validateConfig: (config) => {
+    if (config.mode === 'javascript' && config.javascriptTemplate) {
+      const result = validateJavaScriptTemplate(config.javascriptTemplate);
+      if (!result.valid) {
+        return { valid: false, error: result.error };
+      }
+    }
+    return { valid: true };
+  },
+  notification: {
+    deliver: ({ config, notification, payload }) => {
+      let body: unknown;
+      if (config.mode === 'javascript') {
+        // We only transform event payloads for now (not funnel)
+        if (config.javascriptTemplate && payload.type === 'event') {
+          body = executeJavaScriptTemplate(
+            config.javascriptTemplate,
+            payload.event as Record<string, unknown>
+          );
+        } else {
+          body = payload;
+        }
+      } else {
+        body = {
+          title: notification.title,
+          message: notification.message,
+        };
+      }
+
+      return fetch(config.url, {
+        method: 'POST',
+        headers: {
+          ...(config.headers ?? {}),
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      });
+    },
+  },
+};
+
+const s3Server: IServerIntegration<'s3_export'> = {
+  type: 's3_export',
+  export: {
+    createAdapter: (config) => createS3Adapter(config),
+  },
+  testConnection: (config) => createS3Adapter(config).testConnection(),
+  encryptCredentials: (config) =>
+    config.authMode === 'access_key'
+      ? {
+          ...config,
+          secretAccessKey: encryptCredential(config.secretAccessKey),
+        }
+      : config,
+};
+
+const gcsServer: IServerIntegration<'gcs_export'> = {
+  type: 'gcs_export',
+  export: {
+    createAdapter: (config) => createGCSAdapter(config),
+  },
+  testConnection: (config) => createGCSAdapter(config).testConnection(),
+  encryptCredentials: (config) => ({
+    ...config,
+    serviceAccountKey: encryptCredential(config.serviceAccountKey),
+  }),
+};
+
+export const SERVER_INTEGRATIONS = {
+  slack: slackServer,
+  discord: discordServer,
+  webhook: webhookServer,
+  // Pseudo-integrations dispatched by sendToApp/sendToEmail flags before the
+  // registry lookup; no server delivery handler of their own.
+  app: { type: 'app' },
+  email: { type: 'email' },
+  s3_export: s3Server,
+  gcs_export: gcsServer,
+} satisfies {
+  [T in IIntegrationConfig['type']]: IServerIntegration<T>;
+};
+
+/**
+ * Look up a server integration by type. Indexing the record by a union-typed
+ * key widens the handler params, so the one unavoidable cast in the whole
+ * dispatch path lives here; call sites get a correctly-typed IServerIntegration<T>.
+ */
+export function getServerIntegration<T extends IIntegrationConfig['type']>(
+  type: T,
+): IServerIntegration<T> {
+  return SERVER_INTEGRATIONS[type] as unknown as IServerIntegration<T>;
+}
diff --git a/packages/trpc/src/routers/integration.ts b/packages/trpc/src/routers/integration.ts
index 804993f41..c0ff06c4e 100644
--- a/packages/trpc/src/routers/integration.ts
+++ b/packages/trpc/src/routers/integration.ts
@@ -1,25 +1,20 @@
 import { z } from 'zod';
 
 import { BASE_INTEGRATIONS, db } from '@openpanel/db';
-import { encryptCredential } from '@openpanel/common/server';
 
-import {
-  createS3Adapter,
-  createGCSAdapter,
-} from '@openpanel/integrations/src/object-store';
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
 import { getSlackInstallUrl } from '@openpanel/integrations/src/slack';
 import {
+  type IIntegrationConfig,
   type ISlackConfig,
-  zCreateDiscordIntegration,
   zCreateGCSExportIntegration,
   zCreateS3ExportIntegration,
   zCreateSlackIntegration,
-  zCreateWebhookIntegration,
+  zIntegrationConfig,
 } from '@openpanel/validation';
 import { getOrganizationAccess, getProjectAccess } from '../access';
 import { TRPCForbiddenError, TRPCBadRequestError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
-import { validate as validateJavaScriptTemplate } from '@openpanel/js-runtime';
 
 // Assert the user can access the project, and return the project's
 // organizationId (still stored on the integration for org-level queries/cascades).
@@ -35,6 +30,53 @@ async function assertProjectAccessAndGetOrg(userId: string, projectId: string) {
   return project.organizationId;
 }
 
+// Shared create/update path for any form-configured integration. All per-type
+// behavior (validation, connection test, credential encryption) is delegated to
+// the integration's server plugin — adding a new integration needs no change here.
+async function upsertIntegration(
+  userId: string,
+  input: {
+    id?: string;
+    name: string;
+    projectId: string;
+    config: IIntegrationConfig;
+  },
+) {
+  const organizationId = await assertProjectAccessAndGetOrg(
+    userId,
+    input.projectId,
+  );
+  const plugin = getServerIntegration(input.config.type);
+
+  const validation = plugin.validateConfig?.(input.config);
+  if (validation && !validation.valid) {
+    throw new TRPCBadRequestError(`Invalid config: ${validation.error}`);
+  }
+
+  // Test the connection with the unencrypted credentials before saving.
+  const testResult = await plugin.testConnection?.(input.config);
+  if (testResult && !testResult.success) {
+    throw new TRPCBadRequestError(`Failed to connect: ${testResult.error}`);
+  }
+
+  const config = plugin.encryptCredentials?.(input.config) ?? input.config;
+
+  if (input.id) {
+    return db.integration.update({
+      where: { id: input.id, organizationId },
+      data: { name: input.name, config },
+    });
+  }
+  return db.integration.create({
+    data: {
+      name: input.name,
+      organizationId,
+      projectId: input.projectId,
+      config,
+    },
+  });
+}
+
 // Access check for an existing integration of either scope: project-scoped rows
 // check project access; legacy org-wide rows (projectId null) check org access.
 async function assertIntegrationAccess(
@@ -130,130 +172,42 @@ export const integrationRouter = createTRPCRouter({
         }),
       };
     }),
+  // Generic create/update for any form-configured integration. Per-type
+  // behavior lives in the server plugin; no switch here.
   createOrUpdate: protectedProcedure
-    .input(z.union([zCreateDiscordIntegration, zCreateWebhookIntegration]))
-    .mutation(async ({ input, ctx }) => {
-      const organizationId = await assertProjectAccessAndGetOrg(
-        ctx.session.userId,
-        input.projectId,
-      );
-
-      // Validate JavaScript template if mode is javascript
-      if (
-        input.config.type === 'webhook' &&
-        input.config.mode === 'javascript' &&
-        input.config.javascriptTemplate
-      ) {
-        const validation = validateJavaScriptTemplate(
-          input.config.javascriptTemplate,
-        );
-        if (!validation.valid) {
-          throw new TRPCBadRequestError(
-            `Invalid JavaScript template: ${validation.error}`,
-          );
-        }
-      }
-
-      if (input.id) {
-        return db.integration.update({
-          where: {
-            id: input.id,
-            organizationId,
-          },
-          data: {
-            name: input.name,
-            config: input.config,
-          },
-        });
-      }
-      return db.integration.create({
-        data: {
-          name: input.name,
-          organizationId,
-          projectId: input.projectId,
-          config: input.config,
-        },
-      });
-    }),
-  createOrUpdateExport: protectedProcedure
     .input(
-      z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]),
+      z.object({
+        id: z.string().optional(),
+        name: z.string().min(1),
+        projectId: z.string().min(1),
+        config: zIntegrationConfig,
+      }),
     )
-    .mutation(async ({ input, ctx }) => {
-      const organizationId = await assertProjectAccessAndGetOrg(
-        ctx.session.userId,
-        input.projectId,
-      );
-
-      // Test connection before saving (using unencrypted credentials)
-      if (input.config.type === 's3_export') {
-        const adapter = createS3Adapter(input.config);
-        const testResult = await adapter.testConnection();
-        if (!testResult.success) {
-          throw new TRPCBadRequestError(
-            `Failed to connect to S3: ${testResult.error}`,
-          );
-        }
-      } else if (input.config.type === 'gcs_export') {
-        const adapter = createGCSAdapter(input.config);
-        const testResult = await adapter.testConnection();
-        if (!testResult.success) {
-          throw new TRPCBadRequestError(
-            `Failed to connect to GCS: ${testResult.error}`,
-          );
-        }
-      }
-
-      // Encrypt sensitive credentials before storing
-      let configToSave = input.config;
-      if (input.config.type === 's3_export' && input.config.authMode === 'access_key') {
-        configToSave = {
-          ...input.config,
-          secretAccessKey: encryptCredential(input.config.secretAccessKey),
-        };
-      } else if (input.config.type === 'gcs_export') {
-        configToSave = {
-          ...input.config,
-          serviceAccountKey: encryptCredential(input.config.serviceAccountKey),
-        };
-      }
-
-      if (input.id) {
-        return db.integration.update({
-          where: {
-            id: input.id,
-            organizationId,
-          },
-          data: {
-            name: input.name,
-            config: configToSave,
-          },
-        });
-      }
-      return db.integration.create({
-        data: {
-          name: input.name,
-          organizationId,
-          projectId: input.projectId,
-          config: configToSave,
-        },
-      });
-    }),
+    .mutation(({ input, ctx }) => upsertIntegration(ctx.session.userId, input)),
+  // Back-compat alias for the export forms; delegates to the same generic path.
+  // TODO: remove once the dashboard calls `createOrUpdate` directly.
+  createOrUpdateExport: protectedProcedure
+    .input(z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]))
+    .mutation(({ input, ctx }) => upsertIntegration(ctx.session.userId, input)),
+  // Generic, registry-driven connection test.
+  testConnection: protectedProcedure
+    .input(z.object({ config: zIntegrationConfig }))
+    .mutation(
+      async ({ input }) =>
+        (await getServerIntegration(input.config.type).testConnection?.(
+          input.config,
+        )) ?? { success: true },
+    ),
+  // Back-compat alias for the export forms.
+  // TODO: remove once the dashboard calls `testConnection` directly.
   testExportConnection: protectedProcedure
-    .input(
-      z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]),
-    )
-    .mutation(async ({ input }) => {
-      if (input.config.type === 's3_export') {
-        const adapter = createS3Adapter(input.config);
-        return adapter.testConnection();
-      }
-      if (input.config.type === 'gcs_export') {
-        const adapter = createGCSAdapter(input.config);
-        return adapter.testConnection();
-      }
-      return { success: false, error: 'Unknown export type' };
-    }),
+    .input(z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]))
+    .mutation(
+      async ({ input }) =>
+        (await getServerIntegration(input.config.type).testConnection?.(
+          input.config,
+        )) ?? { success: false, error: 'Unknown export type' },
+    ),
   delete: protectedProcedure
     .input(z.object({ id: z.string() }))
     .mutation(async ({ input: { id }, ctx }) => {
diff --git a/packages/validation/src/index.ts b/packages/validation/src/index.ts
index 34edb45a5..a21e05840 100644
--- a/packages/validation/src/index.ts
+++ b/packages/validation/src/index.ts
@@ -393,151 +393,8 @@ export const zOnboardingProject = z
     }
   });
 
-export const zSlackAuthResponse = z.object({
-  ok: z.literal(true),
-  app_id: z.string(),
-  authed_user: z.object({
-    id: z.string(),
-  }),
-  scope: z.string(),
-  token_type: z.literal('bot'),
-  access_token: z.string(),
-  bot_user_id: z.string(),
-  team: z.object({
-    id: z.string(),
-    name: z.string(),
-  }),
-  incoming_webhook: z.object({
-    channel: z.string(),
-    channel_id: z.string(),
-    configuration_url: z.string().url(),
-    url: z.string().url(),
-  }),
-});
-
-export const zSlackConfig = z
-  .object({
-    type: z.literal('slack'),
-  })
-  .extend(zSlackAuthResponse.shape);
-
-export type ISlackConfig = z.infer<typeof zSlackConfig>;
-
-export const zWebhookConfig = z.object({
-  type: z.literal('webhook'),
-  url: z.string().url(),
-  headers: z.record(z.string(), z.string()),
-  payload: z.record(z.string(), z.unknown()).optional(),
-  mode: z.enum(['message', 'javascript']).default('message'),
-  javascriptTemplate: z.string().optional(),
-});
-export type IWebhookConfig = z.infer<typeof zWebhookConfig>;
-
-export const zDiscordConfig = z.object({
-  type: z.literal('discord'),
-  url: z.string().url(),
-});
-export type IDiscordConfig = z.infer<typeof zDiscordConfig>;
-
-export const zAppConfig = z.object({
-  type: z.literal('app'),
-});
-export type IAppConfig = z.infer<typeof zAppConfig>;
-
-export const zEmailConfig = z.object({
-  type: z.literal('email'),
-});
-export type IEmailConfig = z.infer<typeof zEmailConfig>;
-
-// S3 Export Integration Config - Base fields shared by both auth modes
-const zS3ExportConfigBase = z.object({
-  type: z.literal('s3_export'),
-  bucket: z.string().min(1, 'Bucket name is required'),
-  prefix: z.string().default('openpanel-exports'),
-  region: z.string().min(1, 'Region is required'),
-  endpoint: z.string().url().optional(), // For R2, MinIO, etc.
-  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
-  // Optional encryption settings (S3-side encryption)
-  encryption: z.enum(['SSE-S3', 'SSE-KMS', 'none']).default('SSE-S3'),
-  kmsKeyId: z.string().optional(),
-});
-
-// Auth mode: IAM Role assumption (AWS best practice)
-const zS3AuthIamRole = z.object({
-  authMode: z.literal('iam_role'),
-  roleArn: z.string().min(1, 'IAM Role ARN is required'),
-  externalId: z.string().optional(),
-});
-
-// Auth mode: Access Keys (for R2, MinIO, DigitalOcean Spaces, etc.)
-const zS3AuthAccessKey = z.object({
-  authMode: z.literal('access_key'),
-  accessKeyId: z.string().min(1, 'Access Key ID is required'),
-  secretAccessKey: z.string().min(1, 'Secret Access Key is required'),
-});
 
-// S3 config with IAM role auth
-export const zS3ExportConfigIamRole = zS3ExportConfigBase.merge(zS3AuthIamRole);
-export type IS3ExportConfigIamRole = z.infer<typeof zS3ExportConfigIamRole>;
-
-// S3 config with access key auth
-export const zS3ExportConfigAccessKey = zS3ExportConfigBase.merge(zS3AuthAccessKey);
-export type IS3ExportConfigAccessKey = z.infer<typeof zS3ExportConfigAccessKey>;
-
-// Combined discriminated union
-export const zS3ExportConfig = z.discriminatedUnion('authMode', [
-  zS3ExportConfigIamRole,
-  zS3ExportConfigAccessKey,
-]);
-export type IS3ExportConfig = z.infer<typeof zS3ExportConfig>;
-
-// GCS Export Integration Config
-export const zGCSExportConfig = z.object({
-  type: z.literal('gcs_export'),
-  bucket: z.string().min(1, 'Bucket name is required'),
-  prefix: z.string().default('openpanel-exports'),
-  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
-  // Service account credentials (JSON key as string)
-  serviceAccountKey: z.string().min(1, 'Service account key is required'),
-});
-export type IGCSExportConfig = z.infer<typeof zGCSExportConfig>;
-
-export type IIntegrationConfig =
-  | ISlackConfig
-  | IDiscordConfig
-  | IWebhookConfig
-  | IAppConfig
-  | IEmailConfig
-  | IS3ExportConfig
-  | IGCSExportConfig;
-
-const zCreateIntegration = z.object({
-  id: z.string().optional(),
-  name: z.string().min(1),
-  projectId: z.string().min(1),
-});
-
-export const zCreateSlackIntegration = zCreateIntegration;
-
-export const zCreateWebhookIntegration = zCreateIntegration.extend({
-  config: zWebhookConfig,
-});
-
-export const zCreateDiscordIntegration = zCreateIntegration.extend({
-  config: zDiscordConfig,
-});
-
-export const zCreateS3ExportIntegration = zCreateIntegration.merge(
-  z.object({
-    config: zS3ExportConfig,
-  }),
-);
-
-export const zCreateGCSExportIntegration = zCreateIntegration.merge(
-  z.object({
-    config: zGCSExportConfig,
-  }),
-);
+export * from './integrations';
 
 export const zNotificationRuleEventConfig = z.object({
   type: z.literal('events'),
diff --git a/packages/validation/src/integrations.ts b/packages/validation/src/integrations.ts
new file mode 100644
index 000000000..9a8be4759
--- /dev/null
+++ b/packages/validation/src/integrations.ts
@@ -0,0 +1,361 @@
+import { z } from 'zod';
+
+// ---------------------------------------------------------------------------
+// Per-type config schemas
+// ---------------------------------------------------------------------------
+
+export const zSlackAuthResponse = z.object({
+  ok: z.literal(true),
+  app_id: z.string(),
+  authed_user: z.object({
+    id: z.string(),
+  }),
+  scope: z.string(),
+  token_type: z.literal('bot'),
+  access_token: z.string(),
+  bot_user_id: z.string(),
+  team: z.object({
+    id: z.string(),
+    name: z.string(),
+  }),
+  incoming_webhook: z.object({
+    channel: z.string(),
+    channel_id: z.string(),
+    configuration_url: z.string().url(),
+    url: z.string().url(),
+  }),
+});
+
+export const zSlackConfig = z
+  .object({
+    type: z.literal('slack'),
+  })
+  .extend(zSlackAuthResponse.shape);
+export type ISlackConfig = z.infer<typeof zSlackConfig>;
+
+export const zWebhookConfig = z.object({
+  type: z.literal('webhook'),
+  url: z.string().url(),
+  headers: z.record(z.string(), z.string()),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  mode: z.enum(['message', 'javascript']).default('message'),
+  javascriptTemplate: z.string().optional(),
+});
+export type IWebhookConfig = z.infer<typeof zWebhookConfig>;
+
+export const zDiscordConfig = z.object({
+  type: z.literal('discord'),
+  url: z.string().url(),
+});
+export type IDiscordConfig = z.infer<typeof zDiscordConfig>;
+
+export const zAppConfig = z.object({
+  type: z.literal('app'),
+});
+export type IAppConfig = z.infer<typeof zAppConfig>;
+
+export const zEmailConfig = z.object({
+  type: z.literal('email'),
+});
+export type IEmailConfig = z.infer<typeof zEmailConfig>;
+
+// S3 Export Integration Config - Base fields shared by both auth modes
+const zS3ExportConfigBase = z.object({
+  type: z.literal('s3_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  region: z.string().min(1, 'Region is required'),
+  endpoint: z.string().url().optional(), // For R2, MinIO, etc.
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Optional encryption settings (S3-side encryption)
+  encryption: z.enum(['SSE-S3', 'SSE-KMS', 'none']).default('SSE-S3'),
+  kmsKeyId: z.string().optional(),
+});
+
+// Auth mode: IAM Role assumption (AWS best practice)
+const zS3AuthIamRole = z.object({
+  authMode: z.literal('iam_role'),
+  roleArn: z.string().min(1, 'IAM Role ARN is required'),
+  externalId: z.string().optional(),
+});
+
+// Auth mode: Access Keys (for R2, MinIO, DigitalOcean Spaces, etc.)
+const zS3AuthAccessKey = z.object({
+  authMode: z.literal('access_key'),
+  accessKeyId: z.string().min(1, 'Access Key ID is required'),
+  secretAccessKey: z.string().min(1, 'Secret Access Key is required'),
+});
+
+// S3 config with IAM role auth
+export const zS3ExportConfigIamRole = zS3ExportConfigBase.merge(zS3AuthIamRole);
+export type IS3ExportConfigIamRole = z.infer<typeof zS3ExportConfigIamRole>;
+
+// S3 config with access key auth
+export const zS3ExportConfigAccessKey =
+  zS3ExportConfigBase.merge(zS3AuthAccessKey);
+export type IS3ExportConfigAccessKey = z.infer<typeof zS3ExportConfigAccessKey>;
+
+// Combined discriminated union
+export const zS3ExportConfig = z.discriminatedUnion('authMode', [
+  zS3ExportConfigIamRole,
+  zS3ExportConfigAccessKey,
+]);
+export type IS3ExportConfig = z.infer<typeof zS3ExportConfig>;
+
+// GCS Export Integration Config
+export const zGCSExportConfig = z.object({
+  type: z.literal('gcs_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Service account credentials (JSON key as string)
+  serviceAccountKey: z.string().min(1, 'Service account key is required'),
+});
+export type IGCSExportConfig = z.infer<typeof zGCSExportConfig>;
+
+// ---------------------------------------------------------------------------
+// The explicit discriminated union — the SOURCE OF TRUTH for narrowing.
+// Do NOT derive this from the registry: deriving via z.infer over a registry
+// array can silently widen a member to { type: string } and break every
+// config.type narrow downstream (incl. Prisma's IPrismaIntegrationConfig).
+// The registry below is forced to MATCH this union via `satisfies`, never the
+// other way round.
+// ---------------------------------------------------------------------------
+
+export type IIntegrationConfig =
+  | ISlackConfig
+  | IDiscordConfig
+  | IWebhookConfig
+  | IAppConfig
+  | IEmailConfig
+  | IS3ExportConfig
+  | IGCSExportConfig;
+
+export type IIntegrationType = IIntegrationConfig['type'];
+
+// ---------------------------------------------------------------------------
+// Plugin descriptor registry (core layer). Each integration declares its
+// capabilities, setup style, config schema and catalog metadata once. The
+// server (packages/integrations) and client (apps/start) registries are keyed
+// by the same `type` literal and are forced to cover this union.
+// ---------------------------------------------------------------------------
+
+export type IIntegrationKind = 'notification' | 'export';
+
+export interface IIntegrationDescriptor<
+  TType extends IIntegrationType = IIntegrationType,
+  TSchema extends z.ZodTypeAny = z.ZodTypeAny,
+> {
+  type: TType;
+  kinds: readonly IIntegrationKind[];
+  // 'form' renders a config form; 'oauth' renders an install button and fills
+  // the config via an OAuth callback.
+  setup: 'form' | 'oauth';
+  configSchema: TSchema;
+  catalog: {
+    name: string;
+    description: string;
+    // Pseudo-integrations (app/email) are dispatched by flags, not user-added.
+    hidden?: boolean;
+  };
+}
+
+export const slackDescriptor = {
+  type: 'slack',
+  kinds: ['notification'],
+  setup: 'oauth',
+  configSchema: zSlackConfig,
+  catalog: {
+    name: 'Slack',
+    description:
+      'Connect your Slack workspace to get notified when new issues are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'slack', typeof zSlackConfig>;
+
+export const discordDescriptor = {
+  type: 'discord',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zDiscordConfig,
+  catalog: {
+    name: 'Discord',
+    description:
+      'Connect your Discord server to get notified when new issues are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'discord', typeof zDiscordConfig>;
+
+export const webhookDescriptor = {
+  type: 'webhook',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zWebhookConfig,
+  catalog: {
+    name: 'Webhook',
+    description:
+      'Create a webhook to take actions in your own systems when new events are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'webhook', typeof zWebhookConfig>;
+
+export const appDescriptor = {
+  type: 'app',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zAppConfig,
+  catalog: { name: 'Website', description: 'In-app notifications', hidden: true },
+} as const satisfies IIntegrationDescriptor<'app', typeof zAppConfig>;
+
+export const emailDescriptor = {
+  type: 'email',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zEmailConfig,
+  catalog: { name: 'Email', description: 'Email notifications', hidden: true },
+} as const satisfies IIntegrationDescriptor<'email', typeof zEmailConfig>;
+
+export const s3ExportDescriptor = {
+  type: 's3_export',
+  kinds: ['export'],
+  setup: 'form',
+  configSchema: zS3ExportConfig,
+  catalog: {
+    name: 'S3 Export',
+    description:
+      'Export events to Amazon S3 for loading into Redshift, Snowflake, Athena, or other data warehouses.',
+  },
+} as const satisfies IIntegrationDescriptor<'s3_export', typeof zS3ExportConfig>;
+
+export const gcsExportDescriptor = {
+  type: 'gcs_export',
+  kinds: ['export'],
+  setup: 'form',
+  configSchema: zGCSExportConfig,
+  catalog: {
+    name: 'GCS Export',
+    description:
+      'Export events to Google Cloud Storage for loading into BigQuery or other data warehouses.',
+  },
+} as const satisfies IIntegrationDescriptor<
+  'gcs_export',
+  typeof zGCSExportConfig
+>;
+
+export const INTEGRATION_DESCRIPTORS = [
+  slackDescriptor,
+  discordDescriptor,
+  webhookDescriptor,
+  appDescriptor,
+  emailDescriptor,
+  s3ExportDescriptor,
+  gcsExportDescriptor,
+] as const;
+
+const descriptorByType = new Map(
+  INTEGRATION_DESCRIPTORS.map((d) => [d.type, d] as const),
+);
+
+export function getDescriptor(type: IIntegrationType): IIntegrationDescriptor {
+  const descriptor = descriptorByType.get(type);
+  if (!descriptor) {
+    throw new Error(`Unknown integration type: ${type}`);
+  }
+  return descriptor;
+}
+
+export function descriptorsByKind(kind: IIntegrationKind) {
+  // kinds is a readonly literal tuple per descriptor; widen for `.includes`
+  // (the union of literal tuples otherwise narrows the arg type to never).
+  return INTEGRATION_DESCRIPTORS.filter((d) =>
+    (d.kinds as readonly IIntegrationKind[]).includes(kind),
+  );
+}
+
+export function isKind(
+  config: Pick<IIntegrationConfig, 'type'>,
+  kind: IIntegrationKind,
+): boolean {
+  return getDescriptor(config.type).kinds.includes(kind);
+}
+
+// Runtime parser for any integration config. A plain union (not
+// discriminatedUnion) because the s3 schema is itself a union on `authMode`.
+// Static narrowing always comes from the explicit IIntegrationConfig above.
+export const zIntegrationConfig = z.union([
+  zSlackConfig,
+  zWebhookConfig,
+  zDiscordConfig,
+  zAppConfig,
+  zEmailConfig,
+  zS3ExportConfig,
+  zGCSExportConfig,
+]);
+
+// ---------------------------------------------------------------------------
+// Create-integration input schemas
+// ---------------------------------------------------------------------------
+
+const zCreateIntegrationBase = z.object({
+  id: z.string().optional(),
+  name: z.string().min(1),
+  projectId: z.string().min(1),
+});
+
+// Generic create input used by the registry-driven tRPC procedure. oauth
+// integrations (slack) create with no config (filled by the callback), so
+// config is optional here and narrowed/validated per-plugin server-side.
+export const zCreateIntegration = zCreateIntegrationBase.extend({
+  config: zIntegrationConfig.optional(),
+});
+export type ICreateIntegration = z.infer<typeof zCreateIntegration>;
+
+export const zCreateSlackIntegration = zCreateIntegrationBase;
+
+export const zCreateWebhookIntegration = zCreateIntegrationBase.extend({
+  config: zWebhookConfig,
+});
+
+export const zCreateDiscordIntegration = zCreateIntegrationBase.extend({
+  config: zDiscordConfig,
+});
+
+export const zCreateS3ExportIntegration = zCreateIntegrationBase.merge(
+  z.object({
+    config: zS3ExportConfig,
+  }),
+);
+
+export const zCreateGCSExportIntegration = zCreateIntegrationBase.merge(
+  z.object({
+    config: zGCSExportConfig,
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Compile-time guards (the type-safety gate). These are type aliases, so they
+// add no runtime and don't trip unused-locals, but they fail `tsc` if the
+// invariant breaks.
+// ---------------------------------------------------------------------------
+
+type Assert<T extends true> = T;
+type Equal<A, B> = [A] extends [B]
+  ? [B] extends [A]
+    ? true
+    : false
+  : false;
+
+// Every member of the union must keep a *literal* `type` discriminant. If any
+// widens to { type: string }, this drops it and the equality fails.
+type LiteralDiscriminant<U> = U extends { type: infer T }
+  ? string extends T
+    ? never
+    : U
+  : never;
+type _AssertLiteralDiscriminant = Assert<
+  Equal<IIntegrationConfig, LiteralDiscriminant<IIntegrationConfig>>
+>;
+
+// The descriptor registry must cover exactly the union's types — no missing,
+// no extra. Add a config variant but forget its descriptor → compile error.
+type _DescriptorTypes = (typeof INTEGRATION_DESCRIPTORS)[number]['type'];
+type _AssertDescriptorCoverage = Assert<
+  Equal<IIntegrationType, _DescriptorTypes>
+>;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 5a7004473..8c3e83c97 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1489,6 +1489,12 @@ importers:
       '@openpanel/common':
         specifier: workspace:*
         version: link:../common
+      '@openpanel/js-runtime':
+        specifier: workspace:*
+        version: link:../js-runtime
+      '@openpanel/validation':
+        specifier: workspace:*
+        version: link:../validation
       '@slack/bolt':
         specifier: ^3.18.0
         version: 3.21.4
@@ -1502,9 +1508,6 @@ importers:
       '@openpanel/tsconfig':
         specifier: workspace:*
         version: link:../../tooling/typescript
-      '@openpanel/validation':
-        specifier: workspace:*
-        version: link:../validation
       '@types/node':
         specifier: 'catalog:'
         version: 24.10.1
@@ -33803,7 +33806,7 @@ snapshots:
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       internal-slot: 1.1.0
       is-array-buffer: 3.0.5
       is-callable: 1.2.7
@@ -34835,7 +34838,7 @@ snapshots:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   form-data@4.0.0:
@@ -35126,7 +35129,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.2
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -35891,7 +35894,7 @@ snapshots:
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       side-channel: 1.1.0
 
   internmap@1.0.1: {}
@@ -36142,7 +36145,7 @@ snapshots:
       call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.2
+      hasown: 2.0.4
 
   is-relative@1.0.0:
     dependencies:

From a4cbe85da29fdd589ef125650834190ff502a1d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Tue, 23 Jun 2026 14:37:28 +0200
Subject: [PATCH 4/8] fix: make isKind lenient for empty/unknown integration
 config

The flushExports cron lists every integration and filters by
isKind(config, 'export'). A Slack integration that hasn't completed OAuth has
an empty config ({} with no type), and the registry refactor made isKind throw
"Unknown integration type: undefined" on it, failing the whole cron run.

isKind now returns false for unknown/undefined types instead of throwing (it's
a filter predicate, not a guaranteed-known lookup). Also guard the notification
worker against delivering to an unconfigured integration. Adds an isKind
regression test.

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 apps/worker/src/jobs/notification.ts         |  7 ++++++
 packages/validation/src/integrations.test.ts | 24 ++++++++++++++++++++
 packages/validation/src/integrations.ts      | 10 ++++++--
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 packages/validation/src/integrations.test.ts

diff --git a/apps/worker/src/jobs/notification.ts b/apps/worker/src/jobs/notification.ts
index e011cba4c..f47e9d995 100644
--- a/apps/worker/src/jobs/notification.ts
+++ b/apps/worker/src/jobs/notification.ts
@@ -47,6 +47,13 @@ export async function notificationJob(job: Job<NotificationQueuePayload>) {
         return new Error('Invalid payload');
       }
 
+      // An integration whose config is still empty (e.g. a Slack integration
+      // before its OAuth callback fills the config) has no type yet — nothing
+      // to deliver to.
+      if (!integration.config?.type) {
+        return;
+      }
+
       // Generic registry dispatch — no per-type switch. A new notification
       // integration just registers a `notification.deliver` plugin.
       const plugin = getServerIntegration(integration.config.type);
diff --git a/packages/validation/src/integrations.test.ts b/packages/validation/src/integrations.test.ts
new file mode 100644
index 000000000..7311ff43f
--- /dev/null
+++ b/packages/validation/src/integrations.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { isKind } from './integrations';
+
+describe('isKind', () => {
+  it('matches a declared capability', () => {
+    expect(isKind({ type: 's3_export' }, 'export')).toBe(true);
+    expect(isKind({ type: 'gcs_export' }, 'export')).toBe(true);
+    expect(isKind({ type: 'slack' }, 'notification')).toBe(true);
+    expect(isKind({ type: 'webhook' }, 'notification')).toBe(true);
+  });
+
+  it('returns false for a capability the integration does not have', () => {
+    expect(isKind({ type: 's3_export' }, 'notification')).toBe(false);
+    expect(isKind({ type: 'slack' }, 'export')).toBe(false);
+  });
+
+  it('is lenient for empty/unknown config (does not throw)', () => {
+    // A Slack integration before its OAuth callback has config {} with no type;
+    // the export cron filters over every integration, so this must not throw.
+    expect(isKind({}, 'export')).toBe(false);
+    expect(isKind({ type: undefined }, 'export')).toBe(false);
+    expect(isKind({ type: 'something-unknown' }, 'export')).toBe(false);
+  });
+});
diff --git a/packages/validation/src/integrations.ts b/packages/validation/src/integrations.ts
index 9a8be4759..063ebb037 100644
--- a/packages/validation/src/integrations.ts
+++ b/packages/validation/src/integrations.ts
@@ -270,10 +270,16 @@ export function descriptorsByKind(kind: IIntegrationKind) {
 }
 
 export function isKind(
-  config: Pick<IIntegrationConfig, 'type'>,
+  config: Pick<IIntegrationConfig, 'type'> | { type?: string },
   kind: IIntegrationKind,
 ): boolean {
-  return getDescriptor(config.type).kinds.includes(kind);
+  // Lenient lookup: used as a filter predicate over all integrations, including
+  // rows whose config is still empty (e.g. a Slack integration before its OAuth
+  // callback fills the config). Unknown/undefined types are simply not of `kind`.
+  const descriptor = descriptorByType.get(config.type as IIntegrationType);
+  return descriptor
+    ? (descriptor.kinds as readonly IIntegrationKind[]).includes(kind)
+    : false;
 }
 
 // Runtime parser for any integration config. A plain union (not

From e3ccf887b90f9c2c626feabb2496f2c6f45e2f1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Tue, 23 Jun 2026 14:44:13 +0200
Subject: [PATCH 5/8] refactor: one encryption key for all at-rest secrets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There were two AES-256-GCM modules with two env keys for the same purpose:
db/src/encryption.ts (ENCRYPTION_KEY, for TOTP/GSC) and
common/server/encryption.ts (CREDENTIALS_ENCRYPTION_KEY, for integration creds,
needed in @openpanel/integrations which can't import db).

Consolidate to one implementation in @openpanel/common/server keyed solely by
ENCRYPTION_KEY. It hosts both the plain encrypt/decrypt (unchanged format, so
existing TOTP/GSC ciphertext still decrypts) and the prefixed
encryptCredential/decryptCredential (idempotent, plaintext-passthrough for the
test-connection flow). db/src/encryption.ts now re-exports encrypt/decrypt, so
@openpanel/db importers are unchanged.

Drops CREDENTIALS_ENCRYPTION_KEY from .env.example. Adds an encryption
round-trip test. Note: any integration credentials encrypted on this branch
with the old key must be re-saved (no prod data — feature is unmerged).

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 .env.example                              |   8 +-
 packages/common/server/encryption.test.ts |  39 ++++++++
 packages/common/server/encryption.ts      | 109 +++++++++++++---------
 packages/db/src/encryption.ts             |  49 +---------
 4 files changed, 109 insertions(+), 96 deletions(-)
 create mode 100644 packages/common/server/encryption.test.ts

diff --git a/.env.example b/.env.example
index 48e75ae5a..639f2d023 100644
--- a/.env.example
+++ b/.env.example
@@ -4,15 +4,11 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres?schema=publ
 DATABASE_URL_DIRECT="$DATABASE_URL"
 CLICKHOUSE_URL="http://localhost:8123/openpanel"
 
-# Symmetric key used to encrypt TOTP secrets and other sensitive data at rest.
+# Symmetric key for all at-rest encryption: TOTP secrets, GSC tokens, and
+# object-store export credentials (S3 secret keys, GCS service-account keys).
 # Generate with: openssl rand -hex 32
 ENCRYPTION_KEY=""
 
-# Symmetric key used to encrypt object-store export credentials (S3 secret
-# access keys, GCS service-account keys) at rest. Only required if you configure
-# an S3/GCS data-export integration. Generate with: openssl rand -hex 32
-# CREDENTIALS_ENCRYPTION_KEY=""
-
 # OBJECT-STORE EXPORT (S3/GCS) tuning — optional, sensible defaults shown.
 # The flushExports cron job windows ClickHouse by inserted_at and uploads
 # batched files. LAG keeps a safety gap behind now() for in-flight inserts;
diff --git a/packages/common/server/encryption.test.ts b/packages/common/server/encryption.test.ts
new file mode 100644
index 000000000..d2fe657fd
--- /dev/null
+++ b/packages/common/server/encryption.test.ts
@@ -0,0 +1,39 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+import {
+  decrypt,
+  decryptCredential,
+  encrypt,
+  encryptCredential,
+  isEncrypted,
+} from './encryption';
+
+beforeAll(() => {
+  // Deterministic key for the round-trips (overrides any ambient value).
+  process.env.ENCRYPTION_KEY = 'a'.repeat(64);
+});
+
+describe('encryption (single ENCRYPTION_KEY)', () => {
+  it('encrypt/decrypt round-trips without a prefix (TOTP/GSC format)', () => {
+    const secret = 'totp-or-gsc-secret';
+    const enc = encrypt(secret);
+    expect(isEncrypted(enc)).toBe(false);
+    expect(enc).not.toBe(secret);
+    expect(decrypt(enc)).toBe(secret);
+  });
+
+  it('encryptCredential/decryptCredential round-trips with the enc: prefix', () => {
+    const secret = 'aws-secret-access-key';
+    const enc = encryptCredential(secret);
+    expect(isEncrypted(enc)).toBe(true);
+    expect(decryptCredential(enc)).toBe(secret);
+  });
+
+  it('encryptCredential is idempotent (never double-encrypts)', () => {
+    const enc = encryptCredential('x');
+    expect(encryptCredential(enc)).toBe(enc);
+  });
+
+  it('decryptCredential passes plaintext through (test-connection flow)', () => {
+    expect(decryptCredential('plaintext')).toBe('plaintext');
+  });
+});
diff --git a/packages/common/server/encryption.ts b/packages/common/server/encryption.ts
index c4390f4a9..39f7c385a 100644
--- a/packages/common/server/encryption.ts
+++ b/packages/common/server/encryption.ts
@@ -1,123 +1,140 @@
-import {
-  createCipheriv,
-  createDecipheriv,
-  randomBytes,
-} from 'node:crypto';
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
 
 const ENCRYPTION_PREFIX = 'enc:';
 const ALGORITHM = 'aes-256-gcm';
 const IV_LENGTH = 12; // 96 bits for GCM
 const AUTH_TAG_LENGTH = 16; // 128 bits
+const ENCODING = 'base64';
 
 /**
- * Get the encryption key from environment variable
- * Key must be 32 bytes (64 hex characters)
+ * Single symmetric key for all at-rest encryption (TOTP secrets, GSC tokens,
+ * integration credentials). Must be 32 bytes (64 hex characters).
+ * Generate with: openssl rand -hex 32
  */
 function getEncryptionKey(): Buffer {
-  const keyHex = process.env.CREDENTIALS_ENCRYPTION_KEY;
-  
+  const keyHex = process.env.ENCRYPTION_KEY;
+
   if (!keyHex) {
-    throw new Error(
-      'CREDENTIALS_ENCRYPTION_KEY environment variable is required for credential encryption. ' +
-      'Generate with: openssl rand -hex 32'
-    );
+    throw new Error('ENCRYPTION_KEY environment variable is not set');
   }
-  
+
   if (keyHex.length !== 64) {
     throw new Error(
-      'CREDENTIALS_ENCRYPTION_KEY must be 32 bytes (64 hex characters). ' +
-      'Generate with: openssl rand -hex 32'
+      'ENCRYPTION_KEY must be 32 bytes (64 hex characters). Generate with: openssl rand -hex 32',
     );
   }
-  
+
   return Buffer.from(keyHex, 'hex');
 }
 
-/**
- * Check if a value is already encrypted (has the enc: prefix)
- */
+// ---------------------------------------------------------------------------
+// Plain encrypt/decrypt — base64(iv + authTag + ciphertext), no prefix.
+// Used for TOTP secrets and GSC tokens. (Kept format-stable so existing
+// ciphertext keeps decrypting; this is the implementation db re-exports.)
+// ---------------------------------------------------------------------------
+
+export function encrypt(plaintext: string): string {
+  const key = getEncryptionKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, encrypted]).toString(ENCODING);
+}
+
+export function decrypt(ciphertext: string): string {
+  const key = getEncryptionKey();
+  const buf = Buffer.from(ciphertext, ENCODING);
+  const iv = buf.subarray(0, IV_LENGTH);
+  const tag = buf.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+  const encrypted = buf.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(encrypted) + decipher.final('utf8');
+}
+
+// ---------------------------------------------------------------------------
+// Credential variant — enc:base64(iv + ciphertext + authTag). The enc: prefix
+// makes it idempotent (skip already-encrypted values) and lets a plaintext
+// value pass through unchanged, which the integration test-connection flow
+// relies on (it builds adapters from the raw, unsaved config).
+// ---------------------------------------------------------------------------
+
 export function isEncrypted(value: string): boolean {
   return value.startsWith(ENCRYPTION_PREFIX);
 }
 
-/**
- * Encrypt a credential using AES-256-GCM
- * Returns: enc:<base64(iv + ciphertext + authTag)>
- */
 export function encryptCredential(plaintext: string): string {
   if (!plaintext) {
     return plaintext;
   }
-  
   // Don't double-encrypt
   if (isEncrypted(plaintext)) {
     return plaintext;
   }
-  
+
   const key = getEncryptionKey();
   const iv = randomBytes(IV_LENGTH);
-  
+
   const cipher = createCipheriv(ALGORITHM, key, iv, {
     authTagLength: AUTH_TAG_LENGTH,
   });
-  
+
   const ciphertext = Buffer.concat([
     cipher.update(plaintext, 'utf8'),
     cipher.final(),
   ]);
-  
+
   const authTag = cipher.getAuthTag();
-  
+
   // Combine: IV (12 bytes) + ciphertext (variable) + authTag (16 bytes)
   const combined = Buffer.concat([iv, ciphertext, authTag]);
-  
+
   return ENCRYPTION_PREFIX + combined.toString('base64');
 }
 
-/**
- * Decrypt a credential that was encrypted with encryptCredential
- * Expects: enc:<base64(iv + ciphertext + authTag)>
- */
 export function decryptCredential(ciphertext: string): string {
   if (!ciphertext) {
     return ciphertext;
   }
-  
   // If not encrypted, return as-is (allows for graceful migration)
   if (!isEncrypted(ciphertext)) {
     return ciphertext;
   }
-  
+
   const key = getEncryptionKey();
-  
+
   // Remove prefix and decode base64
   const combined = Buffer.from(
     ciphertext.slice(ENCRYPTION_PREFIX.length),
-    'base64'
+    'base64',
   );
-  
+
   if (combined.length < IV_LENGTH + AUTH_TAG_LENGTH) {
     throw new Error('Invalid encrypted credential: too short');
   }
-  
+
   // Extract components
   const iv = combined.subarray(0, IV_LENGTH);
   const authTag = combined.subarray(combined.length - AUTH_TAG_LENGTH);
   const encryptedData = combined.subarray(
     IV_LENGTH,
-    combined.length - AUTH_TAG_LENGTH
+    combined.length - AUTH_TAG_LENGTH,
   );
-  
+
   const decipher = createDecipheriv(ALGORITHM, key, iv, {
     authTagLength: AUTH_TAG_LENGTH,
   });
-  
+
   decipher.setAuthTag(authTag);
-  
+
   const decrypted = Buffer.concat([
     decipher.update(encryptedData),
     decipher.final(),
   ]);
-  
+
   return decrypted.toString('utf8');
 }
diff --git a/packages/db/src/encryption.ts b/packages/db/src/encryption.ts
index b0835ec06..86e19e0a1 100644
--- a/packages/db/src/encryption.ts
+++ b/packages/db/src/encryption.ts
@@ -1,44 +1,5 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12;
-const TAG_LENGTH = 16;
-const ENCODING = 'base64';
-
-function getKey(): Buffer {
-  const raw = process.env.ENCRYPTION_KEY;
-  if (!raw) {
-    throw new Error('ENCRYPTION_KEY environment variable is not set');
-  }
-  const buf = Buffer.from(raw, 'hex');
-  if (buf.length !== 32) {
-    throw new Error(
-      'ENCRYPTION_KEY must be a 64-character hex string (32 bytes)'
-    );
-  }
-  return buf;
-}
-
-export function encrypt(plaintext: string): string {
-  const key = getKey();
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([
-    cipher.update(plaintext, 'utf8'),
-    cipher.final(),
-  ]);
-  const tag = cipher.getAuthTag();
-  // Format: base64(iv + tag + ciphertext)
-  return Buffer.concat([iv, tag, encrypted]).toString(ENCODING);
-}
-
-export function decrypt(ciphertext: string): string {
-  const key = getKey();
-  const buf = Buffer.from(ciphertext, ENCODING);
-  const iv = buf.subarray(0, IV_LENGTH);
-  const tag = buf.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
-  const encrypted = buf.subarray(IV_LENGTH + TAG_LENGTH);
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted) + decipher.final('utf8');
-}
+// At-rest encryption lives in @openpanel/common/server so it can be shared by
+// packages that can't depend on db (e.g. @openpanel/integrations). Re-exported
+// here for existing `@openpanel/db` importers (GSC tokens, TOTP). Same key
+// (ENCRYPTION_KEY) and same format as before — no data migration.
+export { encrypt, decrypt } from '@openpanel/common/server';

From 8c1de48ab192055b51a7af73c9777901d5878860 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Thu, 25 Jun 2026 22:23:24 +0200
Subject: [PATCH 6/8] chore: remove dead integration-registry exports

PR-review cleanup: getDescriptor, descriptorsByKind, zCreateIntegration and
ICreateIntegration in validation/src/integrations.ts had zero callers (the
client derives the catalog from INTEGRATION_DESCRIPTORS directly, isKind uses
the type map directly, and the tRPC create procedure inlines its own
config-required input). The type-safety guards and isKind are unaffected.

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 packages/validation/src/integrations.ts | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/packages/validation/src/integrations.ts b/packages/validation/src/integrations.ts
index 063ebb037..1d6f63e9b 100644
--- a/packages/validation/src/integrations.ts
+++ b/packages/validation/src/integrations.ts
@@ -253,22 +253,6 @@ const descriptorByType = new Map(
   INTEGRATION_DESCRIPTORS.map((d) => [d.type, d] as const),
 );
 
-export function getDescriptor(type: IIntegrationType): IIntegrationDescriptor {
-  const descriptor = descriptorByType.get(type);
-  if (!descriptor) {
-    throw new Error(`Unknown integration type: ${type}`);
-  }
-  return descriptor;
-}
-
-export function descriptorsByKind(kind: IIntegrationKind) {
-  // kinds is a readonly literal tuple per descriptor; widen for `.includes`
-  // (the union of literal tuples otherwise narrows the arg type to never).
-  return INTEGRATION_DESCRIPTORS.filter((d) =>
-    (d.kinds as readonly IIntegrationKind[]).includes(kind),
-  );
-}
-
 export function isKind(
   config: Pick<IIntegrationConfig, 'type'> | { type?: string },
   kind: IIntegrationKind,
@@ -305,14 +289,6 @@ const zCreateIntegrationBase = z.object({
   projectId: z.string().min(1),
 });
 
-// Generic create input used by the registry-driven tRPC procedure. oauth
-// integrations (slack) create with no config (filled by the callback), so
-// config is optional here and narrowed/validated per-plugin server-side.
-export const zCreateIntegration = zCreateIntegrationBase.extend({
-  config: zIntegrationConfig.optional(),
-});
-export type ICreateIntegration = z.infer<typeof zCreateIntegration>;
-
 export const zCreateSlackIntegration = zCreateIntegrationBase;
 
 export const zCreateWebhookIntegration = zCreateIntegrationBase.extend({

From 80c00a78b44571f19f9e53fda519c286ceb2c618 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Thu, 25 Jun 2026 23:05:53 +0200
Subject: [PATCH 7/8] fix: slack OAuth callback no longer redirects to a
 deleted route

Integrations became project-scoped, so the org-level
/$organizationId/integrations/installed route was removed. The slack callback's
projectId-absent fallback still pointed there, 404-ing older in-flight installs
(metadata without projectId). Fall back to the org landing page instead.

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 apps/api/src/controllers/webhook.controller.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/apps/api/src/controllers/webhook.controller.ts b/apps/api/src/controllers/webhook.controller.ts
index 595a3fd59..03f792c2e 100644
--- a/apps/api/src/controllers/webhook.controller.ts
+++ b/apps/api/src/controllers/webhook.controller.ts
@@ -105,10 +105,14 @@ export async function slackWebhook(
 
     const dashboardUrl =
       process.env.DASHBOARD_URL || process.env.NEXT_PUBLIC_DASHBOARD_URL;
+    // Integrations are project-scoped; the org-level integrations route no longer
+    // exists. Newer installs carry projectId in their metadata. Older in-flight
+    // installs (started before the project-scoped routes shipped) may lack it —
+    // fall back to the org landing page rather than a now-404 integrations URL.
     return reply.redirect(
       projectId
         ? `${dashboardUrl}/${organizationId}/${projectId}/integrations/installed`
-        : `${dashboardUrl}/${organizationId}/integrations/installed`
+        : `${dashboardUrl}/${organizationId}`
     );
   } catch (err) {
     request.log.error(err);

From f8ea00dd75e0b7fce7882ae625e79a1d9d7a670b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carl-Gerhard=20Lindesva=CC=88rd?= <lindesvard@gmail.com>
Date: Thu, 25 Jun 2026 23:16:37 +0200
Subject: [PATCH 8/8] fix: SSRF guards + cross-project integration update authz
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security-review findings (all verified against current code):

- Cross-project update (integration.ts): the generic upsert and the Slack
  create/update authorized against the client-supplied input.projectId, so a
  user with access to one project could update another project's integration in
  the same org. Updates now load the existing row and authorize against ITS
  scope via assertIntegrationAccess (project access, or org access for legacy
  org-wide rows).

- Webhook SSRF (registry.ts): user-configured webhook URLs were fetched
  directly. Now guarded by assertSafeUrl before dispatch.

- S3 custom-endpoint SSRF (s3-adapter.ts): a tenant-controlled endpoint could
  point at internal services. The resolved host is now SSRF-checked in
  getClient() before connecting (covers upload + testConnection).

assertSafeUrl is a new shared helper in @openpanel/common/server: rejects
non-http(s) schemes and hosts resolving to loopback/private/CGNAT/link-local
(incl. 169.254.169.254 metadata). Skipped on SELF_HOSTED, where the single
operator already controls the network and internal targets are legitimate
(blocking them would regress existing behavior). Adds unit tests.

Skipped: tightening the S3 endpoint zod to https-only — it would break
legitimate self-hosted http MinIO/internal stores, and the runtime guard
(scheme + resolved-IP, cloud-gated) is the actual SSRF protection.

Claude-Session: https://claude.ai/code/session_01AWucrxmRqWqgWBvr8cC5cj
---
 packages/common/server/index.ts               |  1 +
 packages/common/server/ssrf.test.ts           | 49 ++++++++++
 packages/common/server/ssrf.ts                | 92 +++++++++++++++++++
 .../src/object-store/s3-adapter.ts            |  7 +-
 packages/integrations/src/registry.ts         |  7 +-
 packages/trpc/src/routers/integration.ts      | 39 ++++++--
 6 files changed, 184 insertions(+), 11 deletions(-)
 create mode 100644 packages/common/server/ssrf.test.ts
 create mode 100644 packages/common/server/ssrf.ts

diff --git a/packages/common/server/index.ts b/packages/common/server/index.ts
index 78490c5a3..9a2343cd1 100644
--- a/packages/common/server/index.ts
+++ b/packages/common/server/index.ts
@@ -4,3 +4,4 @@ export * from './profileId';
 export * from './parser-user-agent';
 export * from './parse-referrer';
 export * from './id';
+export * from './ssrf';
diff --git a/packages/common/server/ssrf.test.ts b/packages/common/server/ssrf.test.ts
new file mode 100644
index 000000000..d6d052f42
--- /dev/null
+++ b/packages/common/server/ssrf.test.ts
@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { assertSafeUrl, isBlockedAddress } from './ssrf';
+
+describe('isBlockedAddress', () => {
+  it('blocks private / loopback / link-local / metadata', () => {
+    expect(isBlockedAddress('127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('10.0.0.5')).toBe(true);
+    expect(isBlockedAddress('172.16.0.1')).toBe(true);
+    expect(isBlockedAddress('192.168.1.1')).toBe(true);
+    expect(isBlockedAddress('169.254.169.254')).toBe(true); // cloud metadata
+    expect(isBlockedAddress('100.64.0.1')).toBe(true); // CGNAT
+    expect(isBlockedAddress('::1')).toBe(true);
+    expect(isBlockedAddress('fd00::1')).toBe(true);
+    expect(isBlockedAddress('fe80::1')).toBe(true);
+    expect(isBlockedAddress('::ffff:127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('not-an-ip')).toBe(true);
+  });
+
+  it('allows public addresses', () => {
+    expect(isBlockedAddress('1.1.1.1')).toBe(false);
+    expect(isBlockedAddress('8.8.8.8')).toBe(false);
+    expect(isBlockedAddress('2606:4700:4700::1111')).toBe(false);
+  });
+});
+
+describe('assertSafeUrl', () => {
+  const original = process.env.SELF_HOSTED;
+  afterEach(() => {
+    process.env.SELF_HOSTED = original;
+  });
+
+  it('rejects non-http(s) schemes on the cloud', async () => {
+    process.env.SELF_HOSTED = '';
+    await expect(assertSafeUrl('ftp://example.com')).rejects.toThrow();
+  });
+
+  it('rejects literal private / metadata hosts on the cloud', async () => {
+    process.env.SELF_HOSTED = '';
+    await expect(assertSafeUrl('http://127.0.0.1/x')).rejects.toThrow();
+    await expect(
+      assertSafeUrl('http://169.254.169.254/latest/meta-data/'),
+    ).rejects.toThrow();
+  });
+
+  it('is a no-op on self-hosted (operator controls the network)', async () => {
+    process.env.SELF_HOSTED = 'true';
+    await expect(assertSafeUrl('http://127.0.0.1/x')).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/common/server/ssrf.ts b/packages/common/server/ssrf.ts
new file mode 100644
index 000000000..8cae43b03
--- /dev/null
+++ b/packages/common/server/ssrf.ts
@@ -0,0 +1,92 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/**
+ * Block a resolved IP that targets internal/reserved space — loopback, private
+ * ranges, CGNAT, and link-local (which includes the cloud metadata endpoint
+ * 169.254.169.254). Anything that isn't a valid public IP is blocked.
+ */
+function isBlockedIpv4(ip: string): boolean {
+  const parts = ip.split('.').map(Number);
+  if (
+    parts.length !== 4 ||
+    parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)
+  ) {
+    return true;
+  }
+  const [a, b] = parts as [number, number, number, number];
+  return (
+    a === 0 || // "this" network
+    a === 10 || // private
+    a === 127 || // loopback
+    (a === 100 && b >= 64 && b <= 127) || // CGNAT
+    (a === 169 && b === 254) || // link-local + cloud metadata
+    (a === 172 && b >= 16 && b <= 31) || // private
+    (a === 192 && b === 168) // private
+  );
+}
+
+function isBlockedIpv6(ip: string): boolean {
+  const lower = ip.toLowerCase();
+  if (lower === '::1' || lower === '::') {
+    return true; // loopback / unspecified
+  }
+  const mapped = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) {
+    return isBlockedIpv4(mapped[1]!); // IPv4-mapped
+  }
+  return (
+    lower.startsWith('fc') || // unique-local fc00::/7
+    lower.startsWith('fd') ||
+    /^fe[89ab]/.test(lower) // link-local fe80::/10
+  );
+}
+
+export function isBlockedAddress(ip: string): boolean {
+  const family = isIP(ip);
+  if (family === 4) {
+    return isBlockedIpv4(ip);
+  }
+  if (family === 6) {
+    return isBlockedIpv6(ip);
+  }
+  return true; // not a parseable IP → block
+}
+
+/**
+ * SSRF guard for tenant-controlled URLs (webhooks, custom S3 endpoints). Rejects
+ * non-HTTP(S) schemes and any host that resolves to internal/reserved address
+ * space, before a connection is made.
+ *
+ * Skipped on self-hosted deployments: there's a single tenant who already
+ * controls the network, and reaching internal services (e.g. an internal MinIO
+ * or webhook receiver) is a legitimate, pre-existing use. The guard exists to
+ * stop cross-tenant SSRF on the managed/multi-tenant cloud.
+ *
+ * Note: DNS is resolved here and again by the client, so a deliberate DNS-rebind
+ * between the two is not covered; this stops the common cases (literal
+ * private/metadata URLs and hostnames pointing at internal IPs).
+ */
+export async function assertSafeUrl(rawUrl: string): Promise<void> {
+  if (process.env.SELF_HOSTED) {
+    return;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error('Invalid URL');
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error('URL must use http or https');
+  }
+
+  const resolved = await lookup(url.hostname, { all: true });
+  if (
+    resolved.length === 0 ||
+    resolved.some((r) => isBlockedAddress(r.address))
+  ) {
+    throw new Error('URL resolves to a disallowed address');
+  }
+}
diff --git a/packages/integrations/src/object-store/s3-adapter.ts b/packages/integrations/src/object-store/s3-adapter.ts
index 2db5e4c4e..edb372253 100644
--- a/packages/integrations/src/object-store/s3-adapter.ts
+++ b/packages/integrations/src/object-store/s3-adapter.ts
@@ -5,7 +5,7 @@ import {
   S3Client,
 } from '@aws-sdk/client-s3';
 import { AssumeRoleCommand, STSClient } from '@aws-sdk/client-sts';
-import { decryptCredential } from '@openpanel/common/server';
+import { assertSafeUrl, decryptCredential } from '@openpanel/common/server';
 import { createLogger } from '@openpanel/logger';
 import type { IS3ExportConfig } from '@openpanel/validation';
 
@@ -44,6 +44,11 @@ export class S3Adapter implements IObjectStoreAdapter {
    * Get or create an S3 client based on auth mode
    */
   private async getClient(): Promise<S3Client> {
+    // A custom endpoint is tenant-controlled; SSRF-guard the resolved host
+    // before connecting (no-op on self-hosted). Default AWS endpoints are safe.
+    if (this.config.endpoint) {
+      await assertSafeUrl(this.config.endpoint);
+    }
     if (this.config.authMode === 'iam_role') {
       return this.getClientWithAssumedRole();
     }
diff --git a/packages/integrations/src/registry.ts b/packages/integrations/src/registry.ts
index b0ab126c8..90bc1370c 100644
--- a/packages/integrations/src/registry.ts
+++ b/packages/integrations/src/registry.ts
@@ -1,4 +1,4 @@
-import { encryptCredential } from '@openpanel/common/server';
+import { assertSafeUrl, encryptCredential } from '@openpanel/common/server';
 import {
   execute as executeJavaScriptTemplate,
   validate as validateJavaScriptTemplate,
@@ -111,7 +111,10 @@ const webhookServer: IServerIntegration<'webhook'> = {
     return { valid: true };
   },
   notification: {
-    deliver: ({ config, notification, payload }) => {
+    deliver: async ({ config, notification, payload }) => {
+      // SSRF guard before any outbound request.
+      await assertSafeUrl(config.url);
+
       let body: unknown;
       if (config.mode === 'javascript') {
         // We only transform event payloads for now (not funnel)
diff --git a/packages/trpc/src/routers/integration.ts b/packages/trpc/src/routers/integration.ts
index c0ff06c4e..9f30e21bc 100644
--- a/packages/trpc/src/routers/integration.ts
+++ b/packages/trpc/src/routers/integration.ts
@@ -42,10 +42,21 @@ async function upsertIntegration(
     config: IIntegrationConfig;
   },
 ) {
-  const organizationId = await assertProjectAccessAndGetOrg(
-    userId,
-    input.projectId,
-  );
+  // Authorize first. For an update, authorize against the EXISTING integration's
+  // scope — not the attacker-controlled input.projectId — so a user with access
+  // to one project can't update another project's integration in the same org.
+  let organizationId: string;
+  if (input.id) {
+    const existing = await db.integration.findUniqueOrThrow({
+      where: { id: input.id },
+      select: { projectId: true, organizationId: true },
+    });
+    await assertIntegrationAccess(userId, existing);
+    organizationId = existing.organizationId;
+  } else {
+    organizationId = await assertProjectAccessAndGetOrg(userId, input.projectId);
+  }
+
   const plugin = getServerIntegration(input.config.type);
 
   const validation = plugin.validateConfig?.(input.config);
@@ -136,10 +147,22 @@ export const integrationRouter = createTRPCRouter({
   createOrUpdateSlack: protectedProcedure
     .input(zCreateSlackIntegration)
     .mutation(async ({ input, ctx }) => {
-      const organizationId = await assertProjectAccessAndGetOrg(
-        ctx.session.userId,
-        input.projectId,
-      );
+      // For an update, authorize against the existing integration's scope so a
+      // user can't clear/re-install another project's Slack integration.
+      let organizationId: string;
+      if (input.id) {
+        const existing = await db.integration.findUniqueOrThrow({
+          where: { id: input.id },
+          select: { projectId: true, organizationId: true },
+        });
+        await assertIntegrationAccess(ctx.session.userId, existing);
+        organizationId = existing.organizationId;
+      } else {
+        organizationId = await assertProjectAccessAndGetOrg(
+          ctx.session.userId,
+          input.projectId,
+        );
+      }
 
       const res = input.id
         ? await db.integration.update({