diff --git a/.env.example b/.env.example
index eea0d9bde..639f2d023 100644
--- a/.env.example
+++ b/.env.example
@@ -4,10 +4,21 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres?schema=publ
 DATABASE_URL_DIRECT="$DATABASE_URL"
 CLICKHOUSE_URL="http://localhost:8123/openpanel"
 
-# Symmetric key used to encrypt TOTP secrets and other sensitive data at rest.
+# Symmetric key for all at-rest encryption: TOTP secrets, GSC tokens, and
+# object-store export credentials (S3 secret keys, GCS service-account keys).
 # Generate with: openssl rand -hex 32
 ENCRYPTION_KEY=""
 
+# OBJECT-STORE EXPORT (S3/GCS) tuning — optional, sensible defaults shown.
+# The flushExports cron job windows ClickHouse by inserted_at and uploads
+# batched files. LAG keeps a safety gap behind now() for in-flight inserts;
+# BATCH_SIZE is rows per file; MAX_BATCHES_PER_RUN bounds backlog drain per
+# tick; CONCURRENCY is parallel (project,integration) uploads.
+# EXPORT_LAG_SECONDS="60"
+# EXPORT_BATCH_SIZE="50000"
+# EXPORT_MAX_BATCHES_PER_RUN="20"
+# EXPORT_CONCURRENCY="4"
+
 # REST
 BATCH_SIZE="5000"
 BATCH_INTERVAL="10000"
diff --git a/apps/api/package.json b/apps/api/package.json
index 3b845cc46..fa42287e6 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -77,5 +77,10 @@
     "tsdown": "0.14.2",
     "typescript": "catalog:",
     "vitest": "^1.0.0"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0"
   }
 }
\ No newline at end of file
diff --git a/apps/api/src/controllers/webhook.controller.ts b/apps/api/src/controllers/webhook.controller.ts
index 38c30bfa1..03f792c2e 100644
--- a/apps/api/src/controllers/webhook.controller.ts
+++ b/apps/api/src/controllers/webhook.controller.ts
@@ -25,6 +25,9 @@ const paramsSchema = z.object({
 const metadataSchema = z.object({
   organizationId: z.string(),
   integrationId: z.string(),
+  // Optional for back-compat with install URLs generated before integrations
+  // became project-scoped; the post-install redirect falls back to the org page.
+  projectId: z.string().optional(),
 });
 
 export async function slackWebhook(
@@ -85,7 +88,7 @@ export async function slackWebhook(
         '👋 Hello. You have successfully connected OpenPanel.dev to your Slack workspace.',
     });
 
-    const { organizationId, integrationId } = parsedMetadata.data;
+    const { organizationId, integrationId, projectId } = parsedMetadata.data;
 
     await db.integration.update({
       where: {
@@ -100,8 +103,16 @@ export async function slackWebhook(
       },
     });
 
+    const dashboardUrl =
+      process.env.DASHBOARD_URL || process.env.NEXT_PUBLIC_DASHBOARD_URL;
+    // Integrations are project-scoped; the org-level integrations route no longer
+    // exists. Newer installs carry projectId in their metadata. Older in-flight
+    // installs (started before the project-scoped routes shipped) may lack it —
+    // fall back to the org landing page rather than a now-404 integrations URL.
     return reply.redirect(
-      `${process.env.DASHBOARD_URL || process.env.NEXT_PUBLIC_DASHBOARD_URL}/${organizationId}/integrations/installed`
+      projectId
+        ? `${dashboardUrl}/${organizationId}/${projectId}/integrations/installed`
+        : `${dashboardUrl}/${organizationId}`
     );
   } catch (err) {
     request.log.error(err);
diff --git a/apps/api/tsdown.config.ts b/apps/api/tsdown.config.ts
index c41662a85..fcc2fd9a2 100644
--- a/apps/api/tsdown.config.ts
+++ b/apps/api/tsdown.config.ts
@@ -10,6 +10,10 @@ const options: Options = {
     'pino',
     'pino-pretty',
     '@node-rs/argon2',
+    // integrations package
+    '@aws-sdk/client-s3',
+    '@aws-sdk/client-sts',
+    '@google-cloud/storage',
   ],
   sourcemap: true,
   platform: 'node',
diff --git a/apps/start/src/components/integrations/active-integrations.tsx b/apps/start/src/components/integrations/active-integrations.tsx
index f4db1f9f4..e1858f6dc 100644
--- a/apps/start/src/components/integrations/active-integrations.tsx
+++ b/apps/start/src/components/integrations/active-integrations.tsx
@@ -17,11 +17,11 @@ import {
 import { INTEGRATIONS } from './integrations';
 
 export function ActiveIntegrations() {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const trpc = useTRPC();
   const query = useQuery(
     trpc.integration.list.queryOptions({
-      organizationId: organizationId!,
+      projectId: projectId!,
     }),
   );
   const client = useQueryClient();
@@ -30,7 +30,7 @@ export function ActiveIntegrations() {
       onSuccess() {
         client.refetchQueries(
           trpc.integration.list.queryFilter({
-            organizationId,
+            projectId,
           }),
         );
       },
diff --git a/apps/start/src/components/integrations/forms/discord-integration.tsx b/apps/start/src/components/integrations/forms/discord-integration.tsx
index 4dd722c3c..985253d96 100644
--- a/apps/start/src/components/integrations/forms/discord-integration.tsx
+++ b/apps/start/src/components/integrations/forms/discord-integration.tsx
@@ -4,7 +4,6 @@ import { useAppParams } from '@/hooks/use-app-params';
 import { useTRPC } from '@/integrations/trpc/react';
 import type { RouterOutputs } from '@/trpc/client';
 import { zodResolver } from '@hookform/resolvers/zod';
-import { sendTestDiscordNotification } from '@openpanel/integrations/src/discord';
 import { zCreateDiscordIntegration } from '@openpanel/validation';
 import { useMutation } from '@tanstack/react-query';
 import { path, mergeDeepRight } from 'ramda';
@@ -21,12 +20,12 @@ export function DiscordIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         config: {
           type: 'discord' as const,
           url: '',
@@ -55,13 +54,19 @@ export function DiscordIntegrationForm({
     toast.error('Validation error');
   };
 
+  const testMutation = useMutation(
+    trpc.integration.testConnection.mutationOptions(),
+  );
+
   const handleTest = async () => {
-    const webhookUrl = form.getValues('config.url');
-    if (!webhookUrl) {
+    const url = form.getValues('config.url');
+    if (!url) {
       return toast.error('Webhook URL is required');
     }
-    const res = await sendTestDiscordNotification(webhookUrl);
-    if (res.ok) {
+    const res = await testMutation.mutateAsync({
+      config: { type: 'discord', url },
+    });
+    if (res.success) {
       toast.success('Test notification sent');
     } else {
       toast.error('Failed to send test notification');
diff --git a/apps/start/src/components/integrations/forms/gcs-export-integration.tsx b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
new file mode 100644
index 000000000..ea23b31db
--- /dev/null
+++ b/apps/start/src/components/integrations/forms/gcs-export-integration.tsx
@@ -0,0 +1,185 @@
+import { InputWithLabel } from '@/components/forms/input-with-label';
+import { Button } from '@/components/ui/button';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { useAppParams } from '@/hooks/use-app-params';
+import { useTRPC } from '@/integrations/trpc/react';
+import type { RouterOutputs } from '@/trpc/client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { zCreateGCSExportIntegration } from '@openpanel/validation';
+import { useMutation } from '@tanstack/react-query';
+import { path, mergeDeepRight } from 'ramda';
+import { Controller, useForm } from 'react-hook-form';
+import { toast } from 'sonner';
+import type { z } from 'zod';
+
+type IForm = z.infer<typeof zCreateGCSExportIntegration>;
+
+export function GCSExportIntegrationForm({
+  defaultValues,
+  onSuccess,
+}: {
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}) {
+  const { projectId } = useAppParams();
+  const form = useForm<IForm>({
+    defaultValues: mergeDeepRight(
+      {
+        id: defaultValues?.id,
+        projectId,
+        name: '',
+        config: {
+          type: 'gcs_export' as const,
+          bucket: '',
+          prefix: 'openpanel-exports',
+          format: 'jsonl_gzip' as const,
+          serviceAccountKey: '',
+        },
+      },
+      defaultValues ?? {},
+    ),
+    resolver: zodResolver(zCreateGCSExportIntegration),
+  });
+  const trpc = useTRPC();
+  const mutation = useMutation(
+    trpc.integration.createOrUpdateExport.mutationOptions({
+      onSuccess,
+      onError(error) {
+        toast.error(error.message || 'Failed to create integration');
+      },
+    }),
+  );
+
+  const testMutation = useMutation(
+    trpc.integration.testExportConnection.mutationOptions({
+      onSuccess(data) {
+        if (data.success) {
+          toast.success('Connection successful! Bucket is accessible.');
+        } else {
+          toast.error(`Connection failed: ${data.error}`);
+        }
+      },
+      onError(error) {
+        toast.error(error.message || 'Failed to test connection');
+      },
+    }),
+  );
+
+  const handleSubmit = (values: IForm) => {
+    mutation.mutate(values);
+  };
+
+  const handleError = () => {
+    toast.error('Please fix validation errors');
+  };
+
+  const handleTest = () => {
+    const values = form.getValues();
+    if (!values.config.bucket || !values.config.serviceAccountKey) {
+      return toast.error('Bucket and Service Account Key are required');
+    }
+    testMutation.mutate(values);
+  };
+
+  return (
+    <form
+      onSubmit={form.handleSubmit(handleSubmit, handleError)}
+      className="col gap-4"
+    >
+      <InputWithLabel
+        label="Name"
+        placeholder="Eg. Production GCS Export"
+        {...form.register('name')}
+        error={form.formState.errors.name?.message}
+      />
+
+      <div className="grid grid-cols-2 gap-4">
+        <InputWithLabel
+          label="GCS Bucket"
+          placeholder="my-analytics-bucket"
+          {...form.register('config.bucket')}
+          error={path(['config', 'bucket', 'message'], form.formState.errors)}
+        />
+        <InputWithLabel
+          label="Prefix"
+          placeholder="openpanel-exports"
+          {...form.register('config.prefix')}
+          error={path(['config', 'prefix', 'message'], form.formState.errors)}
+        />
+      </div>
+
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">Format</label>
+        <Controller
+          name="config.format"
+          control={form.control}
+          render={({ field }) => (
+            <Select onValueChange={field.onChange} value={field.value}>
+              <SelectTrigger className="w-48">
+                <SelectValue placeholder="Select format" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="jsonl_gzip">JSONL (gzip)</SelectItem>
+                <SelectItem value="parquet" disabled>
+                  Parquet (coming soon)
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          )}
+        />
+      </div>
+
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">
+          Service Account Key (JSON)
+        </label>
+        <textarea
+          className="border-input bg-background ring-offset-background placeholder:text-muted-foreground focus-visible:ring-ring min-h-32 w-full rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:ring-offset-2 focus-visible:outline-none disabled:cursor-not-allowed disabled:opacity-50"
+          placeholder='{"type": "service_account", "project_id": "...", ...}'
+          {...form.register('config.serviceAccountKey')}
+        />
+        {!!path(
+          ['config', 'serviceAccountKey', 'message'],
+          form.formState.errors,
+        ) && (
+          <p className="text-destructive text-xs">
+            {
+              path(
+                ['config', 'serviceAccountKey', 'message'],
+                form.formState.errors,
+              ) as any
+            }
+          </p>
+        )}
+        <p className="text-muted-foreground text-xs">
+          Paste the contents of your GCS service account JSON key file. The
+          service account needs write access to the specified bucket.
+        </p>
+      </div>
+
+      <div className="row gap-4">
+        <Button
+          type="button"
+          variant="outline"
+          onClick={handleTest}
+          disabled={testMutation.isPending}
+        >
+          {testMutation.isPending ? 'Testing...' : 'Test connection'}
+        </Button>
+        <Button type="submit" className="flex-1" disabled={mutation.isPending}>
+          {mutation.isPending
+            ? 'Saving...'
+            : defaultValues?.id
+              ? 'Update'
+              : 'Create'}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/start/src/components/integrations/forms/s3-export-integration.tsx b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
new file mode 100644
index 000000000..816dd78be
--- /dev/null
+++ b/apps/start/src/components/integrations/forms/s3-export-integration.tsx
@@ -0,0 +1,325 @@
+import { InputWithLabel } from '@/components/forms/input-with-label';
+import { Button } from '@/components/ui/button';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { useAppParams } from '@/hooks/use-app-params';
+import { useTRPC } from '@/integrations/trpc/react';
+import type { RouterOutputs } from '@/trpc/client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { zCreateS3ExportIntegration } from '@openpanel/validation';
+import { useMutation } from '@tanstack/react-query';
+import { path, mergeDeepRight } from 'ramda';
+import { Controller, useForm, useWatch } from 'react-hook-form';
+import { toast } from 'sonner';
+import type { z } from 'zod';
+
+type IForm = z.infer<typeof zCreateS3ExportIntegration>;
+
+const AWS_REGIONS = [
+  'auto',
+  'us-east-1',
+  'us-east-2',
+  'us-west-1',
+  'us-west-2',
+  'eu-west-1',
+  'eu-west-2',
+  'eu-west-3',
+  'eu-central-1',
+  'eu-north-1',
+  'ap-southeast-1',
+  'ap-southeast-2',
+  'ap-northeast-1',
+  'ap-northeast-2',
+  'ap-south-1',
+  'sa-east-1',
+];
+
+export function S3ExportIntegrationForm({
+  defaultValues,
+  onSuccess,
+}: {
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}) {
+  const { projectId } = useAppParams();
+  const form = useForm<IForm>({
+    defaultValues: mergeDeepRight(
+      {
+        id: defaultValues?.id,
+        projectId,
+        name: '',
+        config: {
+          type: 's3_export' as const,
+          bucket: '',
+          prefix: 'openpanel-exports',
+          region: 'us-east-1',
+          format: 'jsonl_gzip' as const,
+          authMode: 'iam_role' as const,
+          roleArn: '',
+          externalId: '',
+          encryption: 'SSE-S3' as const,
+          kmsKeyId: '',
+        },
+      },
+      defaultValues ?? {},
+    ),
+    resolver: zodResolver(zCreateS3ExportIntegration),
+  });
+  const trpc = useTRPC();
+  const mutation = useMutation(
+    trpc.integration.createOrUpdateExport.mutationOptions({
+      onSuccess,
+      onError(error) {
+        toast.error(error.message || 'Failed to create integration');
+      },
+    }),
+  );
+
+  const testMutation = useMutation(
+    trpc.integration.testExportConnection.mutationOptions({
+      onSuccess(data) {
+        if (data.success) {
+          toast.success('Connection successful! Bucket is accessible.');
+        } else {
+          toast.error(`Connection failed: ${data.error}`);
+        }
+      },
+      onError(error) {
+        toast.error(error.message || 'Failed to test connection');
+      },
+    }),
+  );
+
+  const authMode = useWatch({ control: form.control, name: 'config.authMode' });
+  const encryption = useWatch({ control: form.control, name: 'config.encryption' });
+
+  const handleSubmit = (values: IForm) => {
+    mutation.mutate(values);
+  };
+
+  const handleError = () => {
+    toast.error('Please fix validation errors');
+  };
+
+  const handleTest = () => {
+    const values = form.getValues();
+    if (!values.config.bucket || !values.config.region) {
+      return toast.error('Bucket and Region are required');
+    }
+    if (values.config.authMode === 'iam_role' && !values.config.roleArn) {
+      return toast.error('IAM Role ARN is required');
+    }
+    if (values.config.authMode === 'access_key') {
+      if (!values.config.accessKeyId || !values.config.secretAccessKey) {
+        return toast.error('Access Key ID and Secret Access Key are required');
+      }
+    }
+    testMutation.mutate(values);
+  };
+
+  return (
+    <form
+      onSubmit={form.handleSubmit(handleSubmit, handleError)}
+      className="col gap-4"
+    >
+      <InputWithLabel
+        label="Name"
+        placeholder="Eg. Production S3 Export"
+        {...form.register('name')}
+        error={form.formState.errors.name?.message}
+      />
+
+      <div className="grid grid-cols-2 gap-4">
+        <InputWithLabel
+          label="S3 Bucket"
+          placeholder="my-analytics-bucket"
+          {...form.register('config.bucket')}
+          error={path(['config', 'bucket', 'message'], form.formState.errors)}
+        />
+        <InputWithLabel
+          label="Prefix"
+          placeholder="openpanel-exports"
+          {...form.register('config.prefix')}
+          error={path(['config', 'prefix', 'message'], form.formState.errors)}
+        />
+      </div>
+
+      <div className="grid grid-cols-2 gap-4">
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Region</label>
+          <Controller
+            name="config.region"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select region" />
+                </SelectTrigger>
+                <SelectContent>
+                  {AWS_REGIONS.map((region) => (
+                    <SelectItem key={region} value={region}>
+                      {region}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Format</label>
+          <Controller
+            name="config.format"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select format" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="jsonl_gzip">JSONL (gzip)</SelectItem>
+                  <SelectItem value="parquet" disabled>
+                    Parquet (coming soon)
+                  </SelectItem>
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+      </div>
+
+      {/* Auth Mode Selector */}
+      <div className="col gap-1.5">
+        <label className="text-sm font-medium">Authentication Mode</label>
+        <Controller
+          name="config.authMode"
+          control={form.control}
+          render={({ field }) => (
+            <Select onValueChange={field.onChange} value={field.value}>
+              <SelectTrigger>
+                <SelectValue placeholder="Select authentication mode" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="iam_role">IAM Role (AWS)</SelectItem>
+                <SelectItem value="access_key">Access Keys (R2, MinIO, Spaces)</SelectItem>
+              </SelectContent>
+            </Select>
+          )}
+        />
+        <p className="text-muted-foreground text-xs">
+          {authMode === 'iam_role'
+            ? 'Recommended for AWS S3. Create an IAM role that grants OpenPanel access.'
+            : 'Use access keys for Cloudflare R2, MinIO, DigitalOcean Spaces, or other S3-compatible storage.'}
+        </p>
+      </div>
+
+      {/* IAM Role fields */}
+      {authMode === 'iam_role' && (
+        <>
+          <InputWithLabel
+            label="IAM Role ARN"
+            placeholder="arn:aws:iam::123456789012:role/OpenPanelExportRole"
+            {...form.register('config.roleArn')}
+            error={path(['config', 'roleArn', 'message'], form.formState.errors)}
+          />
+
+          <InputWithLabel
+            label="External ID (optional)"
+            placeholder="Optional external ID for cross-account access"
+            {...form.register('config.externalId')}
+            error={path(['config', 'externalId', 'message'], form.formState.errors)}
+          />
+        </>
+      )}
+
+      {/* Access Key fields */}
+      {authMode === 'access_key' && (
+        <>
+          <InputWithLabel
+            label="Endpoint URL (optional)"
+            placeholder="https://your-account-id.r2.cloudflarestorage.com"
+            {...form.register('config.endpoint')}
+            error={path(['config', 'endpoint', 'message'], form.formState.errors)}
+          />
+          <p className="text-muted-foreground -mt-2 text-xs">
+            Required for R2, MinIO, etc. Leave empty for AWS S3.
+          </p>
+
+          <div className="grid grid-cols-2 gap-4">
+            <InputWithLabel
+              label="Access Key ID"
+              placeholder="AKIAIOSFODNN7EXAMPLE"
+              {...form.register('config.accessKeyId')}
+              error={path(['config', 'accessKeyId', 'message'], form.formState.errors)}
+            />
+            <InputWithLabel
+              label="Secret Access Key"
+              type="password"
+              placeholder="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
+              {...form.register('config.secretAccessKey')}
+              error={path(['config', 'secretAccessKey', 'message'], form.formState.errors)}
+            />
+          </div>
+        </>
+      )}
+
+      <div className="grid grid-cols-2 gap-4">
+        <div className="col gap-1.5">
+          <label className="text-sm font-medium">Encryption</label>
+          <Controller
+            name="config.encryption"
+            control={form.control}
+            render={({ field }) => (
+              <Select onValueChange={field.onChange} value={field.value}>
+                <SelectTrigger>
+                  <SelectValue placeholder="Select encryption" />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="SSE-S3">SSE-S3 (AES-256)</SelectItem>
+                  <SelectItem value="SSE-KMS">SSE-KMS</SelectItem>
+                  <SelectItem value="none">None</SelectItem>
+                </SelectContent>
+              </Select>
+            )}
+          />
+        </div>
+
+        {encryption === 'SSE-KMS' && (
+          <InputWithLabel
+            label="KMS Key ID"
+            placeholder="arn:aws:kms:us-east-1:..."
+            {...form.register('config.kmsKeyId')}
+            error={path(
+              ['config', 'kmsKeyId', 'message'],
+              form.formState.errors,
+            )}
+          />
+        )}
+      </div>
+
+      <div className="row gap-4">
+        <Button
+          type="button"
+          variant="outline"
+          onClick={handleTest}
+          disabled={testMutation.isPending}
+        >
+          {testMutation.isPending ? 'Testing...' : 'Test connection'}
+        </Button>
+        <Button type="submit" className="flex-1" disabled={mutation.isPending}>
+          {mutation.isPending
+            ? 'Saving...'
+            : defaultValues?.id
+              ? 'Update'
+              : 'Create'}
+        </Button>
+      </div>
+    </form>
+  );
+}
diff --git a/apps/start/src/components/integrations/forms/slack-integration.tsx b/apps/start/src/components/integrations/forms/slack-integration.tsx
index f7a8c3bb8..17d3c3687 100644
--- a/apps/start/src/components/integrations/forms/slack-integration.tsx
+++ b/apps/start/src/components/integrations/forms/slack-integration.tsx
@@ -19,12 +19,12 @@ export function SlackIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
 
   const form = useForm<IForm>({
     defaultValues: {
       id: defaultValues?.id,
-      organizationId,
+      projectId,
       name: defaultValues?.name ?? '',
     },
     resolver: zodResolver(zCreateSlackIntegration),
diff --git a/apps/start/src/components/integrations/forms/webhook-integration.tsx b/apps/start/src/components/integrations/forms/webhook-integration.tsx
index ca39b686b..cc891dd61 100644
--- a/apps/start/src/components/integrations/forms/webhook-integration.tsx
+++ b/apps/start/src/components/integrations/forms/webhook-integration.tsx
@@ -55,7 +55,7 @@ export function WebhookIntegrationForm({
   defaultValues?: RouterOutputs['integration']['get'];
   onSuccess: () => void;
 }) {
-  const { organizationId } = useAppParams();
+  const { projectId } = useAppParams();
 
   // Convert headers from Record to array format for form UI
   const defaultHeaders =
@@ -67,7 +67,7 @@ export function WebhookIntegrationForm({
     defaultValues: mergeDeepRight(
       {
         id: defaultValues?.id,
-        organizationId,
+        projectId,
         config: {
           type: 'webhook' as const,
           url: '',
diff --git a/apps/start/src/components/integrations/integrations.tsx b/apps/start/src/components/integrations/integrations.tsx
index 2edd94215..f48265fd1 100644
--- a/apps/start/src/components/integrations/integrations.tsx
+++ b/apps/start/src/components/integrations/integrations.tsx
@@ -1,49 +1,115 @@
-import type { IIntegrationConfig } from '@openpanel/validation';
-import { WebhookIcon } from 'lucide-react';
+import type { RouterOutputs } from '@/trpc/client';
+import {
+  INTEGRATION_DESCRIPTORS,
+  type IIntegrationType,
+} from '@openpanel/validation';
+import { BoxIcon, CloudIcon, DatabaseIcon, WebhookIcon } from 'lucide-react';
+import { DiscordIntegrationForm } from './forms/discord-integration';
+import { GCSExportIntegrationForm } from './forms/gcs-export-integration';
+import { S3ExportIntegrationForm } from './forms/s3-export-integration';
+import { SlackIntegrationForm } from './forms/slack-integration';
+import { WebhookIntegrationForm } from './forms/webhook-integration';
 import {
   IntegrationCardLogo,
   IntegrationCardLogoImage,
 } from './integration-card';
 
-export const INTEGRATIONS: {
-  type: IIntegrationConfig['type'];
-  name: string;
-  description: string;
+type IntegrationFormComponent = React.ComponentType<{
+  defaultValues?: RouterOutputs['integration']['get'];
+  onSuccess: () => void;
+}>;
+
+interface IClientIntegration {
+  type: IIntegrationType;
+  // React-only bits that can't live in the validation/server registries.
   icon: React.ReactNode;
-}[] = [
+  // Omitted for pseudo-integrations (app/email) that aren't user-configured.
+  Form?: IntegrationFormComponent;
+}
+
+const placeholderIcon = (
+  <IntegrationCardLogo className="bg-def-200 text-foreground">
+    <BoxIcon className="size-10" strokeWidth={1} />
+  </IntegrationCardLogo>
+);
+
+/**
+ * Client registry — the per-integration UI. Keyed by the same `type` literal as
+ * the core (validation) and server (integrations) registries and forced to
+ * cover every type via `satisfies Record<IIntegrationType, …>`, so a new
+ * integration that forgets its UI entry is a compile error. Catalog strings
+ * (name/description) come from the core descriptors, declared once.
+ */
+export const CLIENT_INTEGRATIONS: Record<IIntegrationType, IClientIntegration> =
   {
+  slack: {
     type: 'slack',
-    name: 'Slack',
-    description:
-      'Connect your Slack workspace to get notified when new issues are created.',
     icon: (
       <IntegrationCardLogoImage
         src="https://play-lh.googleusercontent.com/mzJpTCsTW_FuR6YqOPaLHrSEVCSJuXzCljdxnCKhVZMcu6EESZBQTCHxMh8slVtnKqo"
         backgroundColor="#481449"
       />
     ),
+    Form: SlackIntegrationForm,
   },
-  {
+  discord: {
     type: 'discord',
-    name: 'Discord',
-    description:
-      'Connect your Discord server to get notified when new issues are created.',
     icon: (
       <IntegrationCardLogoImage
         src="https://static.vecteezy.com/system/resources/previews/006/892/625/non_2x/discord-logo-icon-editorial-free-vector.jpg"
         backgroundColor="#5864F2"
       />
     ),
+    Form: DiscordIntegrationForm,
   },
-  {
+  webhook: {
     type: 'webhook',
-    name: 'Webhook',
-    description:
-      'Create a webhook to take actions in your own systems when new events are created.',
     icon: (
       <IntegrationCardLogo className="bg-foreground text-background">
         <WebhookIcon className="size-10" />
       </IntegrationCardLogo>
     ),
+    Form: WebhookIntegrationForm,
   },
-];
+  app: { type: 'app', icon: placeholderIcon },
+  email: { type: 'email', icon: placeholderIcon },
+  s3_export: {
+    type: 's3_export',
+    icon: (
+      <IntegrationCardLogo className="bg-[#FF9900] text-white">
+        <CloudIcon className="size-10" />
+      </IntegrationCardLogo>
+    ),
+    Form: S3ExportIntegrationForm,
+  },
+  gcs_export: {
+    type: 'gcs_export',
+    icon: (
+      <IntegrationCardLogo className="bg-[#4285F4] text-white">
+        <DatabaseIcon className="size-10" />
+      </IntegrationCardLogo>
+    ),
+    Form: GCSExportIntegrationForm,
+  },
+  };
+
+export interface IIntegrationCatalogEntry {
+  type: IIntegrationType;
+  name: string;
+  description: string;
+  icon: React.ReactNode;
+}
+
+/**
+ * The "available integrations" catalog, derived from the core descriptors
+ * (visible ones) joined with each integration's client icon.
+ */
+export const INTEGRATIONS: IIntegrationCatalogEntry[] =
+  INTEGRATION_DESCRIPTORS.filter(
+    (d) => !('hidden' in d.catalog && d.catalog.hidden),
+  ).map((d) => ({
+    type: d.type,
+    name: d.catalog.name,
+    description: d.catalog.description,
+    icon: CLIENT_INTEGRATIONS[d.type].icon,
+  }));
diff --git a/apps/start/src/components/sidebar-organization-menu.tsx b/apps/start/src/components/sidebar-organization-menu.tsx
index 964b5f6ae..b4551fe2f 100644
--- a/apps/start/src/components/sidebar-organization-menu.tsx
+++ b/apps/start/src/components/sidebar-organization-menu.tsx
@@ -1,4 +1,4 @@
-import { Link, useNavigate } from '@tanstack/react-router';
+import { Link } from '@tanstack/react-router';
 import { AnimatePresence, motion } from 'framer-motion';
 import {
   ChevronDownIcon,
@@ -7,7 +7,6 @@ import {
   LayoutListIcon,
   PlusIcon,
   UsersIcon,
-  WorkflowIcon,
 } from 'lucide-react';
 import { useEffect, useState } from 'react';
 import { Badge } from './ui/badge';
@@ -98,22 +97,11 @@ export default function SidebarOrganizationMenu({
           <div className="flex-1">Members</div>
         </Link>
       )}
-      <Link
-        className={cn(
-          'flex items-center gap-2 rounded-md px-3 py-2 font-medium text-[13px] transition-all hover:bg-def-200'
-        )}
-        from="/$organizationId"
-        to="/$organizationId/integrations"
-      >
-        <WorkflowIcon size={20} />
-        <div className="flex-1">Integrations</div>
-      </Link>
     </>
   );
 }
 
 export function ActionCTAButton() {
-  const navigate = useNavigate();
   const { organizationId } = useParams({ strict: false });
   const { isAdmin } = useOrganizationAccess(organizationId);
 
@@ -132,15 +120,6 @@ export function ActionCTAButton() {
           },
         ]
       : []),
-    {
-      label: 'Add integration',
-      icon: WorkflowIcon,
-      onClick: () =>
-        navigate({
-          to: '/$organizationId/integrations',
-          from: '/$organizationId',
-        }),
-    },
   ];
 
   const [currentActionIndex, setCurrentActionIndex] = useState(0);
diff --git a/apps/start/src/components/sidebar-project-menu.tsx b/apps/start/src/components/sidebar-project-menu.tsx
index e78ae4f3e..8738bc72b 100644
--- a/apps/start/src/components/sidebar-project-menu.tsx
+++ b/apps/start/src/components/sidebar-project-menu.tsx
@@ -3,6 +3,7 @@ import { useNavigate } from '@tanstack/react-router';
 import { AnimatePresence, motion } from 'framer-motion';
 import {
   BellIcon,
+  WorkflowIcon,
   BookOpenIcon,
   Building2Icon,
   ChartLineIcon,
@@ -85,6 +86,12 @@ export default function SidebarProjectMenu({
         icon={BellIcon}
         label="Notifications"
       />
+      <SidebarLink
+        exact={false}
+        href={'/integrations'}
+        icon={WorkflowIcon}
+        label="Integrations"
+      />
       <SidebarLink href={'..'} icon={UndoDotIcon} label="Back to workspace" />
     </>
   );
diff --git a/apps/start/src/modals/add-integration.tsx b/apps/start/src/modals/add-integration.tsx
index 24fda47ee..2aec336ff 100644
--- a/apps/start/src/modals/add-integration.tsx
+++ b/apps/start/src/modals/add-integration.tsx
@@ -1,10 +1,10 @@
 import { useTRPC } from '@/integrations/trpc/react';
 
-import { DiscordIntegrationForm } from '@/components/integrations/forms/discord-integration';
-import { SlackIntegrationForm } from '@/components/integrations/forms/slack-integration';
-import { WebhookIntegrationForm } from '@/components/integrations/forms/webhook-integration';
 import { IntegrationCardContent } from '@/components/integrations/integration-card';
-import { INTEGRATIONS } from '@/components/integrations/integrations';
+import {
+  CLIENT_INTEGRATIONS,
+  INTEGRATIONS,
+} from '@/components/integrations/integrations';
 import { SheetContent } from '@/components/ui/sheet';
 import { useAppParams } from '@/hooks/use-app-params';
 import type { IIntegrationConfig } from '@openpanel/validation';
@@ -20,7 +20,7 @@ interface Props {
   type: IIntegrationConfig['type'];
 }
 export default function AddIntegration(props: Props) {
-  const { organizationId } = useAppParams();
+  const { organizationId, projectId } = useAppParams();
   const trpc = useTRPC();
   const query = useQuery(
     trpc.integration.get.queryOptions(
@@ -56,9 +56,10 @@ export default function AddIntegration(props: Props) {
       trpc.integration.get.queryFilter({ id: props.id }),
     );
     navigate({
-      to: '/$organizationId/integrations/installed',
+      to: '/$organizationId/$projectId/integrations/installed',
       params: {
         organizationId,
+        projectId,
       },
     });
   };
@@ -68,31 +69,11 @@ export default function AddIntegration(props: Props) {
       return null;
     }
 
-    switch (integration?.type) {
-      case 'webhook':
-        return (
-          <WebhookIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 'discord':
-        return (
-          <DiscordIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      case 'slack':
-        return (
-          <SlackIntegrationForm
-            defaultValues={query.data}
-            onSuccess={handleSuccess}
-          />
-        );
-      default:
-        return null;
+    const Form = CLIENT_INTEGRATIONS[props.type]?.Form;
+    if (!Form) {
+      return null;
     }
+    return <Form defaultValues={query.data} onSuccess={handleSuccess} />;
   };
 
   return (
diff --git a/apps/start/src/modals/add-notification-rule.tsx b/apps/start/src/modals/add-notification-rule.tsx
index 5f3c351fa..d9e83a575 100644
--- a/apps/start/src/modals/add-notification-rule.tsx
+++ b/apps/start/src/modals/add-notification-rule.tsx
@@ -38,7 +38,7 @@ type IForm = z.infer<typeof zCreateNotificationRule>;
 
 export default function AddNotificationRule({ rule }: Props) {
   const client = useQueryClient();
-  const { organizationId, projectId } = useAppParams();
+  const { projectId } = useAppParams();
   const form = useForm<IForm>({
     resolver: zodResolver(zCreateNotificationRule),
     defaultValues: {
@@ -80,7 +80,7 @@ export default function AddNotificationRule({ rule }: Props) {
   );
   const integrationsQuery = useQuery(
     trpc.integration.list.queryOptions({
-      organizationId: organizationId!,
+      projectId: projectId!,
     })
   );
 
diff --git a/apps/start/src/routeTree.gen.ts b/apps/start/src/routeTree.gen.ts
index 558fcbee0..81b0a9d63 100644
--- a/apps/start/src/routeTree.gen.ts
+++ b/apps/start/src/routeTree.gen.ts
@@ -41,7 +41,6 @@ import { Route as AppOrganizationIdProjectIdIndexRouteImport } from './routes/_a
 import { Route as StepsOnboardingProjectIdVerifyRouteImport } from './routes/_steps.onboarding.$projectId.verify'
 import { Route as StepsOnboardingProjectIdConnectRouteImport } from './routes/_steps.onboarding.$projectId.connect'
 import { Route as AppOrganizationIdMembersTabsRouteImport } from './routes/_app.$organizationId.members._tabs'
-import { Route as AppOrganizationIdIntegrationsTabsRouteImport } from './routes/_app.$organizationId.integrations._tabs'
 import { Route as AppOrganizationIdAccountTabsRouteImport } from './routes/_app.$organizationId.account._tabs'
 import { Route as AppOrganizationIdProjectIdSessionsRouteImport } from './routes/_app.$organizationId.$projectId.sessions'
 import { Route as AppOrganizationIdProjectIdSeoRouteImport } from './routes/_app.$organizationId.$projectId.seo'
@@ -54,12 +53,9 @@ import { Route as AppOrganizationIdProjectIdGroupsRouteImport } from './routes/_
 import { Route as AppOrganizationIdProjectIdDashboardsRouteImport } from './routes/_app.$organizationId.$projectId.dashboards'
 import { Route as AppOrganizationIdProjectIdCohortsRouteImport } from './routes/_app.$organizationId.$projectId.cohorts'
 import { Route as AppOrganizationIdMembersTabsIndexRouteImport } from './routes/_app.$organizationId.members._tabs.index'
-import { Route as AppOrganizationIdIntegrationsTabsIndexRouteImport } from './routes/_app.$organizationId.integrations._tabs.index'
 import { Route as AppOrganizationIdAccountTabsIndexRouteImport } from './routes/_app.$organizationId.account._tabs.index'
 import { Route as AppOrganizationIdMembersTabsMembersRouteImport } from './routes/_app.$organizationId.members._tabs.members'
 import { Route as AppOrganizationIdMembersTabsInvitationsRouteImport } from './routes/_app.$organizationId.members._tabs.invitations'
-import { Route as AppOrganizationIdIntegrationsTabsInstalledRouteImport } from './routes/_app.$organizationId.integrations._tabs.installed'
-import { Route as AppOrganizationIdIntegrationsTabsAvailableRouteImport } from './routes/_app.$organizationId.integrations._tabs.available'
 import { Route as AppOrganizationIdAccountTabsTwoFactorRouteImport } from './routes/_app.$organizationId.account._tabs.two-factor'
 import { Route as AppOrganizationIdAccountTabsEmailPreferencesRouteImport } from './routes/_app.$organizationId.account._tabs.email-preferences'
 import { Route as AppOrganizationIdProjectIdSettingsTabsRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs'
@@ -67,11 +63,13 @@ import { Route as AppOrganizationIdProjectIdSessionsSessionIdRouteImport } from
 import { Route as AppOrganizationIdProjectIdReportsReportIdRouteImport } from './routes/_app.$organizationId.$projectId.reports_.$reportId'
 import { Route as AppOrganizationIdProjectIdProfilesTabsRouteImport } from './routes/_app.$organizationId.$projectId.profiles._tabs'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs'
 import { Route as AppOrganizationIdProjectIdEventsTabsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs'
 import { Route as AppOrganizationIdProjectIdDashboardsDashboardIdRouteImport } from './routes/_app.$organizationId.$projectId.dashboards_.$dashboardId'
 import { Route as AppOrganizationIdProjectIdSettingsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.index'
 import { Route as AppOrganizationIdProjectIdProfilesTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.profiles._tabs.index'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.index'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.index'
 import { Route as AppOrganizationIdProjectIdEventsTabsIndexRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.index'
 import { Route as AppOrganizationIdProjectIdSettingsTabsWidgetsRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.widgets'
 import { Route as AppOrganizationIdProjectIdSettingsTabsTrackingRouteImport } from './routes/_app.$organizationId.$projectId.settings._tabs.tracking'
@@ -87,6 +85,8 @@ import { Route as AppOrganizationIdProjectIdProfilesTabsAnonymousRouteImport } f
 import { Route as AppOrganizationIdProjectIdProfilesProfileIdTabsRouteImport } from './routes/_app.$organizationId.$projectId.profiles.$profileId._tabs'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsRulesRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.rules'
 import { Route as AppOrganizationIdProjectIdNotificationsTabsNotificationsRouteImport } from './routes/_app.$organizationId.$projectId.notifications._tabs.notifications'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.installed'
+import { Route as AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport } from './routes/_app.$organizationId.$projectId.integrations._tabs.available'
 import { Route as AppOrganizationIdProjectIdGroupsGroupIdTabsRouteImport } from './routes/_app.$organizationId.$projectId.groups_.$groupId._tabs'
 import { Route as AppOrganizationIdProjectIdEventsTabsStatsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.stats'
 import { Route as AppOrganizationIdProjectIdEventsTabsEventsRouteImport } from './routes/_app.$organizationId.$projectId.events._tabs.events'
@@ -105,9 +105,6 @@ import { Route as AppOrganizationIdProjectIdCohortsCohortIdTabsEventsRouteImport
 const AppOrganizationIdMembersRouteImport = createFileRoute(
   '/_app/$organizationId/members',
 )()
-const AppOrganizationIdIntegrationsRouteImport = createFileRoute(
-  '/_app/$organizationId/integrations',
-)()
 const AppOrganizationIdAccountRouteImport = createFileRoute(
   '/_app/$organizationId/account',
 )()
@@ -120,6 +117,9 @@ const AppOrganizationIdProjectIdProfilesRouteImport = createFileRoute(
 const AppOrganizationIdProjectIdNotificationsRouteImport = createFileRoute(
   '/_app/$organizationId/$projectId/notifications',
 )()
+const AppOrganizationIdProjectIdIntegrationsRouteImport = createFileRoute(
+  '/_app/$organizationId/$projectId/integrations',
+)()
 const AppOrganizationIdProjectIdEventsRouteImport = createFileRoute(
   '/_app/$organizationId/$projectId/events',
 )()
@@ -225,12 +225,6 @@ const AppOrganizationIdMembersRoute =
     path: '/members',
     getParentRoute: () => AppOrganizationIdRoute,
   } as any)
-const AppOrganizationIdIntegrationsRoute =
-  AppOrganizationIdIntegrationsRouteImport.update({
-    id: '/integrations',
-    path: '/integrations',
-    getParentRoute: () => AppOrganizationIdRoute,
-  } as any)
 const AppOrganizationIdAccountRoute =
   AppOrganizationIdAccountRouteImport.update({
     id: '/account',
@@ -298,6 +292,12 @@ const AppOrganizationIdProjectIdNotificationsRoute =
     path: '/notifications',
     getParentRoute: () => AppOrganizationIdProjectIdRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsRoute =
+  AppOrganizationIdProjectIdIntegrationsRouteImport.update({
+    id: '/integrations',
+    path: '/integrations',
+    getParentRoute: () => AppOrganizationIdProjectIdRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsRoute =
   AppOrganizationIdProjectIdEventsRouteImport.update({
     id: '/events',
@@ -327,11 +327,6 @@ const AppOrganizationIdMembersTabsRoute =
     id: '/_tabs',
     getParentRoute: () => AppOrganizationIdMembersRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsRoute =
-  AppOrganizationIdIntegrationsTabsRouteImport.update({
-    id: '/_tabs',
-    getParentRoute: () => AppOrganizationIdIntegrationsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsRoute =
   AppOrganizationIdAccountTabsRouteImport.update({
     id: '/_tabs',
@@ -421,12 +416,6 @@ const AppOrganizationIdMembersTabsIndexRoute =
     path: '/',
     getParentRoute: () => AppOrganizationIdMembersTabsRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsIndexRoute =
-  AppOrganizationIdIntegrationsTabsIndexRouteImport.update({
-    id: '/',
-    path: '/',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsIndexRoute =
   AppOrganizationIdAccountTabsIndexRouteImport.update({
     id: '/',
@@ -445,18 +434,6 @@ const AppOrganizationIdMembersTabsInvitationsRoute =
     path: '/invitations',
     getParentRoute: () => AppOrganizationIdMembersTabsRoute,
   } as any)
-const AppOrganizationIdIntegrationsTabsInstalledRoute =
-  AppOrganizationIdIntegrationsTabsInstalledRouteImport.update({
-    id: '/installed',
-    path: '/installed',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
-const AppOrganizationIdIntegrationsTabsAvailableRoute =
-  AppOrganizationIdIntegrationsTabsAvailableRouteImport.update({
-    id: '/available',
-    path: '/available',
-    getParentRoute: () => AppOrganizationIdIntegrationsTabsRoute,
-  } as any)
 const AppOrganizationIdAccountTabsTwoFactorRoute =
   AppOrganizationIdAccountTabsTwoFactorRouteImport.update({
     id: '/two-factor',
@@ -496,6 +473,11 @@ const AppOrganizationIdProjectIdNotificationsTabsRoute =
     id: '/_tabs',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsRouteImport.update({
+    id: '/_tabs',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsTabsRoute =
   AppOrganizationIdProjectIdEventsTabsRouteImport.update({
     id: '/_tabs',
@@ -525,6 +507,12 @@ const AppOrganizationIdProjectIdNotificationsTabsIndexRoute =
     path: '/',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsTabsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsIndexRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
 const AppOrganizationIdProjectIdEventsTabsIndexRoute =
   AppOrganizationIdProjectIdEventsTabsIndexRouteImport.update({
     id: '/',
@@ -614,6 +602,18 @@ const AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute =
     path: '/notifications',
     getParentRoute: () => AppOrganizationIdProjectIdNotificationsTabsRoute,
   } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport.update({
+    id: '/installed',
+    path: '/installed',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
+const AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute =
+  AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport.update({
+    id: '/available',
+    path: '/available',
+    getParentRoute: () => AppOrganizationIdProjectIdIntegrationsTabsRoute,
+  } as any)
 const AppOrganizationIdProjectIdGroupsGroupIdTabsRoute =
   AppOrganizationIdProjectIdGroupsGroupIdTabsRouteImport.update({
     id: '/_tabs',
@@ -731,13 +731,13 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/seo': typeof AppOrganizationIdProjectIdSeoRoute
   '/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/$organizationId/account': typeof AppOrganizationIdAccountTabsRouteWithChildren
-  '/$organizationId/integrations': typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
   '/$organizationId/members': typeof AppOrganizationIdMembersTabsRouteWithChildren
   '/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
   '/onboarding/$projectId/verify': typeof StepsOnboardingProjectIdVerifyRoute
   '/$organizationId/$projectId/': typeof AppOrganizationIdProjectIdIndexRoute
   '/$organizationId/$projectId/dashboards/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsTabsRouteWithChildren
+  '/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
   '/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsRouteWithChildren
   '/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesTabsRouteWithChildren
   '/$organizationId/$projectId/reports/$reportId': typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -745,18 +745,17 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/settings': typeof AppOrganizationIdProjectIdSettingsTabsRouteWithChildren
   '/$organizationId/account/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/$organizationId/account/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/$organizationId/integrations/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/$organizationId/integrations/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/$organizationId/members/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/$organizationId/members/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/$organizationId/account/': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/$organizationId/integrations/': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/$organizationId/members/': typeof AppOrganizationIdMembersTabsIndexRoute
   '/$organizationId/$projectId/cohorts/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsRouteWithChildren
   '/$organizationId/$projectId/events/conversions': typeof AppOrganizationIdProjectIdEventsTabsConversionsRoute
   '/$organizationId/$projectId/events/events': typeof AppOrganizationIdProjectIdEventsTabsEventsRoute
   '/$organizationId/$projectId/events/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/$organizationId/$projectId/groups/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsRouteWithChildren
+  '/$organizationId/$projectId/integrations/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/$organizationId/$projectId/integrations/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/$organizationId/$projectId/notifications/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/$organizationId/$projectId/notifications/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdTabsRouteWithChildren
@@ -772,6 +771,7 @@ export interface FileRoutesByFullPath {
   '/$organizationId/$projectId/settings/tracking': typeof AppOrganizationIdProjectIdSettingsTabsTrackingRoute
   '/$organizationId/$projectId/settings/widgets': typeof AppOrganizationIdProjectIdSettingsTabsWidgetsRoute
   '/$organizationId/$projectId/events/': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/$organizationId/$projectId/integrations/': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/$organizationId/$projectId/notifications/': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/$organizationId/$projectId/profiles/': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/$organizationId/$projectId/settings/': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
@@ -817,13 +817,13 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/seo': typeof AppOrganizationIdProjectIdSeoRoute
   '/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/$organizationId/account': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/$organizationId/integrations': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/$organizationId/members': typeof AppOrganizationIdMembersTabsIndexRoute
   '/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
   '/onboarding/$projectId/verify': typeof StepsOnboardingProjectIdVerifyRoute
   '/$organizationId/$projectId': typeof AppOrganizationIdProjectIdIndexRoute
   '/$organizationId/$projectId/dashboards/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/$organizationId/$projectId/reports/$reportId': typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -831,8 +831,6 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/settings': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
   '/$organizationId/account/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/$organizationId/account/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/$organizationId/integrations/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/$organizationId/integrations/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/$organizationId/members/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/$organizationId/members/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/$organizationId/$projectId/cohorts/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsIndexRoute
@@ -840,6 +838,8 @@ export interface FileRoutesByTo {
   '/$organizationId/$projectId/events/events': typeof AppOrganizationIdProjectIdEventsTabsEventsRoute
   '/$organizationId/$projectId/events/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/$organizationId/$projectId/groups/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsIndexRoute
+  '/$organizationId/$projectId/integrations/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/$organizationId/$projectId/integrations/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/$organizationId/$projectId/notifications/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/$organizationId/$projectId/notifications/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdTabsIndexRoute
@@ -901,8 +901,6 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/sessions': typeof AppOrganizationIdProjectIdSessionsRoute
   '/_app/$organizationId/account': typeof AppOrganizationIdAccountRouteWithChildren
   '/_app/$organizationId/account/_tabs': typeof AppOrganizationIdAccountTabsRouteWithChildren
-  '/_app/$organizationId/integrations': typeof AppOrganizationIdIntegrationsRouteWithChildren
-  '/_app/$organizationId/integrations/_tabs': typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
   '/_app/$organizationId/members': typeof AppOrganizationIdMembersRouteWithChildren
   '/_app/$organizationId/members/_tabs': typeof AppOrganizationIdMembersTabsRouteWithChildren
   '/_steps/onboarding/$projectId/connect': typeof StepsOnboardingProjectIdConnectRoute
@@ -911,6 +909,8 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/dashboards_/$dashboardId': typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   '/_app/$organizationId/$projectId/events': typeof AppOrganizationIdProjectIdEventsRouteWithChildren
   '/_app/$organizationId/$projectId/events/_tabs': typeof AppOrganizationIdProjectIdEventsTabsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations': typeof AppOrganizationIdProjectIdIntegrationsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations/_tabs': typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
   '/_app/$organizationId/$projectId/notifications': typeof AppOrganizationIdProjectIdNotificationsRouteWithChildren
   '/_app/$organizationId/$projectId/notifications/_tabs': typeof AppOrganizationIdProjectIdNotificationsTabsRouteWithChildren
   '/_app/$organizationId/$projectId/profiles': typeof AppOrganizationIdProjectIdProfilesRouteWithChildren
@@ -921,12 +921,9 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/settings/_tabs': typeof AppOrganizationIdProjectIdSettingsTabsRouteWithChildren
   '/_app/$organizationId/account/_tabs/email-preferences': typeof AppOrganizationIdAccountTabsEmailPreferencesRoute
   '/_app/$organizationId/account/_tabs/two-factor': typeof AppOrganizationIdAccountTabsTwoFactorRoute
-  '/_app/$organizationId/integrations/_tabs/available': typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  '/_app/$organizationId/integrations/_tabs/installed': typeof AppOrganizationIdIntegrationsTabsInstalledRoute
   '/_app/$organizationId/members/_tabs/invitations': typeof AppOrganizationIdMembersTabsInvitationsRoute
   '/_app/$organizationId/members/_tabs/members': typeof AppOrganizationIdMembersTabsMembersRoute
   '/_app/$organizationId/account/_tabs/': typeof AppOrganizationIdAccountTabsIndexRoute
-  '/_app/$organizationId/integrations/_tabs/': typeof AppOrganizationIdIntegrationsTabsIndexRoute
   '/_app/$organizationId/members/_tabs/': typeof AppOrganizationIdMembersTabsIndexRoute
   '/_app/$organizationId/$projectId/cohorts_/$cohortId': typeof AppOrganizationIdProjectIdCohortsCohortIdRouteWithChildren
   '/_app/$organizationId/$projectId/cohorts_/$cohortId/_tabs': typeof AppOrganizationIdProjectIdCohortsCohortIdTabsRouteWithChildren
@@ -935,6 +932,8 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/events/_tabs/stats': typeof AppOrganizationIdProjectIdEventsTabsStatsRoute
   '/_app/$organizationId/$projectId/groups_/$groupId': typeof AppOrganizationIdProjectIdGroupsGroupIdRouteWithChildren
   '/_app/$organizationId/$projectId/groups_/$groupId/_tabs': typeof AppOrganizationIdProjectIdGroupsGroupIdTabsRouteWithChildren
+  '/_app/$organizationId/$projectId/integrations/_tabs/available': typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  '/_app/$organizationId/$projectId/integrations/_tabs/installed': typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/notifications': typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/rules': typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
   '/_app/$organizationId/$projectId/profiles/$profileId': typeof AppOrganizationIdProjectIdProfilesProfileIdRouteWithChildren
@@ -951,6 +950,7 @@ export interface FileRoutesById {
   '/_app/$organizationId/$projectId/settings/_tabs/tracking': typeof AppOrganizationIdProjectIdSettingsTabsTrackingRoute
   '/_app/$organizationId/$projectId/settings/_tabs/widgets': typeof AppOrganizationIdProjectIdSettingsTabsWidgetsRoute
   '/_app/$organizationId/$projectId/events/_tabs/': typeof AppOrganizationIdProjectIdEventsTabsIndexRoute
+  '/_app/$organizationId/$projectId/integrations/_tabs/': typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
   '/_app/$organizationId/$projectId/notifications/_tabs/': typeof AppOrganizationIdProjectIdNotificationsTabsIndexRoute
   '/_app/$organizationId/$projectId/profiles/_tabs/': typeof AppOrganizationIdProjectIdProfilesTabsIndexRoute
   '/_app/$organizationId/$projectId/settings/_tabs/': typeof AppOrganizationIdProjectIdSettingsTabsIndexRoute
@@ -1000,13 +1000,13 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/seo'
     | '/$organizationId/$projectId/sessions'
     | '/$organizationId/account'
-    | '/$organizationId/integrations'
     | '/$organizationId/members'
     | '/onboarding/$projectId/connect'
     | '/onboarding/$projectId/verify'
     | '/$organizationId/$projectId/'
     | '/$organizationId/$projectId/dashboards/$dashboardId'
     | '/$organizationId/$projectId/events'
+    | '/$organizationId/$projectId/integrations'
     | '/$organizationId/$projectId/notifications'
     | '/$organizationId/$projectId/profiles'
     | '/$organizationId/$projectId/reports/$reportId'
@@ -1014,18 +1014,17 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings'
     | '/$organizationId/account/email-preferences'
     | '/$organizationId/account/two-factor'
-    | '/$organizationId/integrations/available'
-    | '/$organizationId/integrations/installed'
     | '/$organizationId/members/invitations'
     | '/$organizationId/members/members'
     | '/$organizationId/account/'
-    | '/$organizationId/integrations/'
     | '/$organizationId/members/'
     | '/$organizationId/$projectId/cohorts/$cohortId'
     | '/$organizationId/$projectId/events/conversions'
     | '/$organizationId/$projectId/events/events'
     | '/$organizationId/$projectId/events/stats'
     | '/$organizationId/$projectId/groups/$groupId'
+    | '/$organizationId/$projectId/integrations/available'
+    | '/$organizationId/$projectId/integrations/installed'
     | '/$organizationId/$projectId/notifications/notifications'
     | '/$organizationId/$projectId/notifications/rules'
     | '/$organizationId/$projectId/profiles/$profileId'
@@ -1041,6 +1040,7 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings/tracking'
     | '/$organizationId/$projectId/settings/widgets'
     | '/$organizationId/$projectId/events/'
+    | '/$organizationId/$projectId/integrations/'
     | '/$organizationId/$projectId/notifications/'
     | '/$organizationId/$projectId/profiles/'
     | '/$organizationId/$projectId/settings/'
@@ -1086,13 +1086,13 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/seo'
     | '/$organizationId/$projectId/sessions'
     | '/$organizationId/account'
-    | '/$organizationId/integrations'
     | '/$organizationId/members'
     | '/onboarding/$projectId/connect'
     | '/onboarding/$projectId/verify'
     | '/$organizationId/$projectId'
     | '/$organizationId/$projectId/dashboards/$dashboardId'
     | '/$organizationId/$projectId/events'
+    | '/$organizationId/$projectId/integrations'
     | '/$organizationId/$projectId/notifications'
     | '/$organizationId/$projectId/profiles'
     | '/$organizationId/$projectId/reports/$reportId'
@@ -1100,8 +1100,6 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/settings'
     | '/$organizationId/account/email-preferences'
     | '/$organizationId/account/two-factor'
-    | '/$organizationId/integrations/available'
-    | '/$organizationId/integrations/installed'
     | '/$organizationId/members/invitations'
     | '/$organizationId/members/members'
     | '/$organizationId/$projectId/cohorts/$cohortId'
@@ -1109,6 +1107,8 @@ export interface FileRouteTypes {
     | '/$organizationId/$projectId/events/events'
     | '/$organizationId/$projectId/events/stats'
     | '/$organizationId/$projectId/groups/$groupId'
+    | '/$organizationId/$projectId/integrations/available'
+    | '/$organizationId/$projectId/integrations/installed'
     | '/$organizationId/$projectId/notifications/notifications'
     | '/$organizationId/$projectId/notifications/rules'
     | '/$organizationId/$projectId/profiles/$profileId'
@@ -1169,8 +1169,6 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/sessions'
     | '/_app/$organizationId/account'
     | '/_app/$organizationId/account/_tabs'
-    | '/_app/$organizationId/integrations'
-    | '/_app/$organizationId/integrations/_tabs'
     | '/_app/$organizationId/members'
     | '/_app/$organizationId/members/_tabs'
     | '/_steps/onboarding/$projectId/connect'
@@ -1179,6 +1177,8 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/dashboards_/$dashboardId'
     | '/_app/$organizationId/$projectId/events'
     | '/_app/$organizationId/$projectId/events/_tabs'
+    | '/_app/$organizationId/$projectId/integrations'
+    | '/_app/$organizationId/$projectId/integrations/_tabs'
     | '/_app/$organizationId/$projectId/notifications'
     | '/_app/$organizationId/$projectId/notifications/_tabs'
     | '/_app/$organizationId/$projectId/profiles'
@@ -1189,12 +1189,9 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/settings/_tabs'
     | '/_app/$organizationId/account/_tabs/email-preferences'
     | '/_app/$organizationId/account/_tabs/two-factor'
-    | '/_app/$organizationId/integrations/_tabs/available'
-    | '/_app/$organizationId/integrations/_tabs/installed'
     | '/_app/$organizationId/members/_tabs/invitations'
     | '/_app/$organizationId/members/_tabs/members'
     | '/_app/$organizationId/account/_tabs/'
-    | '/_app/$organizationId/integrations/_tabs/'
     | '/_app/$organizationId/members/_tabs/'
     | '/_app/$organizationId/$projectId/cohorts_/$cohortId'
     | '/_app/$organizationId/$projectId/cohorts_/$cohortId/_tabs'
@@ -1203,6 +1200,8 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/events/_tabs/stats'
     | '/_app/$organizationId/$projectId/groups_/$groupId'
     | '/_app/$organizationId/$projectId/groups_/$groupId/_tabs'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/available'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/installed'
     | '/_app/$organizationId/$projectId/notifications/_tabs/notifications'
     | '/_app/$organizationId/$projectId/notifications/_tabs/rules'
     | '/_app/$organizationId/$projectId/profiles/$profileId'
@@ -1219,6 +1218,7 @@ export interface FileRouteTypes {
     | '/_app/$organizationId/$projectId/settings/_tabs/tracking'
     | '/_app/$organizationId/$projectId/settings/_tabs/widgets'
     | '/_app/$organizationId/$projectId/events/_tabs/'
+    | '/_app/$organizationId/$projectId/integrations/_tabs/'
     | '/_app/$organizationId/$projectId/notifications/_tabs/'
     | '/_app/$organizationId/$projectId/profiles/_tabs/'
     | '/_app/$organizationId/$projectId/settings/_tabs/'
@@ -1386,13 +1386,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersRouteImport
       parentRoute: typeof AppOrganizationIdRoute
     }
-    '/_app/$organizationId/integrations': {
-      id: '/_app/$organizationId/integrations'
-      path: '/integrations'
-      fullPath: '/$organizationId/integrations'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsRouteImport
-      parentRoute: typeof AppOrganizationIdRoute
-    }
     '/_app/$organizationId/account': {
       id: '/_app/$organizationId/account'
       path: '/account'
@@ -1477,6 +1470,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdRoute
     }
+    '/_app/$organizationId/$projectId/integrations': {
+      id: '/_app/$organizationId/$projectId/integrations'
+      path: '/integrations'
+      fullPath: '/$organizationId/$projectId/integrations'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdRoute
+    }
     '/_app/$organizationId/$projectId/events': {
       id: '/_app/$organizationId/$projectId/events'
       path: '/events'
@@ -1512,13 +1512,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsRouteImport
       parentRoute: typeof AppOrganizationIdMembersRoute
     }
-    '/_app/$organizationId/integrations/_tabs': {
-      id: '/_app/$organizationId/integrations/_tabs'
-      path: '/integrations'
-      fullPath: '/$organizationId/integrations'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsRoute
-    }
     '/_app/$organizationId/account/_tabs': {
       id: '/_app/$organizationId/account/_tabs'
       path: '/account'
@@ -1624,13 +1617,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsIndexRouteImport
       parentRoute: typeof AppOrganizationIdMembersTabsRoute
     }
-    '/_app/$organizationId/integrations/_tabs/': {
-      id: '/_app/$organizationId/integrations/_tabs/'
-      path: '/'
-      fullPath: '/$organizationId/integrations/'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsIndexRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
     '/_app/$organizationId/account/_tabs/': {
       id: '/_app/$organizationId/account/_tabs/'
       path: '/'
@@ -1652,20 +1638,6 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdMembersTabsInvitationsRouteImport
       parentRoute: typeof AppOrganizationIdMembersTabsRoute
     }
-    '/_app/$organizationId/integrations/_tabs/installed': {
-      id: '/_app/$organizationId/integrations/_tabs/installed'
-      path: '/installed'
-      fullPath: '/$organizationId/integrations/installed'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsInstalledRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
-    '/_app/$organizationId/integrations/_tabs/available': {
-      id: '/_app/$organizationId/integrations/_tabs/available'
-      path: '/available'
-      fullPath: '/$organizationId/integrations/available'
-      preLoaderRoute: typeof AppOrganizationIdIntegrationsTabsAvailableRouteImport
-      parentRoute: typeof AppOrganizationIdIntegrationsTabsRoute
-    }
     '/_app/$organizationId/account/_tabs/two-factor': {
       id: '/_app/$organizationId/account/_tabs/two-factor'
       path: '/two-factor'
@@ -1715,6 +1687,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs'
+      path: '/integrations'
+      fullPath: '/$organizationId/$projectId/integrations'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsRoute
+    }
     '/_app/$organizationId/$projectId/events/_tabs': {
       id: '/_app/$organizationId/$projectId/events/_tabs'
       path: '/events'
@@ -1750,6 +1729,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsIndexRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs/': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/'
+      path: '/'
+      fullPath: '/$organizationId/$projectId/integrations/'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
     '/_app/$organizationId/$projectId/events/_tabs/': {
       id: '/_app/$organizationId/$projectId/events/_tabs/'
       path: '/'
@@ -1855,6 +1841,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRouteImport
       parentRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRoute
     }
+    '/_app/$organizationId/$projectId/integrations/_tabs/installed': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/installed'
+      path: '/installed'
+      fullPath: '/$organizationId/$projectId/integrations/installed'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
+    '/_app/$organizationId/$projectId/integrations/_tabs/available': {
+      id: '/_app/$organizationId/$projectId/integrations/_tabs/available'
+      path: '/available'
+      fullPath: '/$organizationId/$projectId/integrations/available'
+      preLoaderRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRouteImport
+      parentRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRoute
+    }
     '/_app/$organizationId/$projectId/groups_/$groupId/_tabs': {
       id: '/_app/$organizationId/$projectId/groups_/$groupId/_tabs'
       path: '/groups/$groupId'
@@ -1995,6 +1995,42 @@ const AppOrganizationIdProjectIdEventsRouteWithChildren =
     AppOrganizationIdProjectIdEventsRouteChildren,
   )
 
+interface AppOrganizationIdProjectIdIntegrationsTabsRouteChildren {
+  AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute
+  AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute
+  AppOrganizationIdProjectIdIntegrationsTabsIndexRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsIndexRoute
+}
+
+const AppOrganizationIdProjectIdIntegrationsTabsRouteChildren: AppOrganizationIdProjectIdIntegrationsTabsRouteChildren =
+  {
+    AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsAvailableRoute,
+    AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsInstalledRoute,
+    AppOrganizationIdProjectIdIntegrationsTabsIndexRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsIndexRoute,
+  }
+
+const AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren =
+  AppOrganizationIdProjectIdIntegrationsTabsRoute._addFileChildren(
+    AppOrganizationIdProjectIdIntegrationsTabsRouteChildren,
+  )
+
+interface AppOrganizationIdProjectIdIntegrationsRouteChildren {
+  AppOrganizationIdProjectIdIntegrationsTabsRoute: typeof AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren
+}
+
+const AppOrganizationIdProjectIdIntegrationsRouteChildren: AppOrganizationIdProjectIdIntegrationsRouteChildren =
+  {
+    AppOrganizationIdProjectIdIntegrationsTabsRoute:
+      AppOrganizationIdProjectIdIntegrationsTabsRouteWithChildren,
+  }
+
+const AppOrganizationIdProjectIdIntegrationsRouteWithChildren =
+  AppOrganizationIdProjectIdIntegrationsRoute._addFileChildren(
+    AppOrganizationIdProjectIdIntegrationsRouteChildren,
+  )
+
 interface AppOrganizationIdProjectIdNotificationsTabsRouteChildren {
   AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute: typeof AppOrganizationIdProjectIdNotificationsTabsNotificationsRoute
   AppOrganizationIdProjectIdNotificationsTabsRulesRoute: typeof AppOrganizationIdProjectIdNotificationsTabsRulesRoute
@@ -2249,6 +2285,7 @@ interface AppOrganizationIdProjectIdRouteChildren {
   AppOrganizationIdProjectIdIndexRoute: typeof AppOrganizationIdProjectIdIndexRoute
   AppOrganizationIdProjectIdDashboardsDashboardIdRoute: typeof AppOrganizationIdProjectIdDashboardsDashboardIdRoute
   AppOrganizationIdProjectIdEventsRoute: typeof AppOrganizationIdProjectIdEventsRouteWithChildren
+  AppOrganizationIdProjectIdIntegrationsRoute: typeof AppOrganizationIdProjectIdIntegrationsRouteWithChildren
   AppOrganizationIdProjectIdNotificationsRoute: typeof AppOrganizationIdProjectIdNotificationsRouteWithChildren
   AppOrganizationIdProjectIdProfilesRoute: typeof AppOrganizationIdProjectIdProfilesRouteWithChildren
   AppOrganizationIdProjectIdReportsReportIdRoute: typeof AppOrganizationIdProjectIdReportsReportIdRoute
@@ -2283,6 +2320,8 @@ const AppOrganizationIdProjectIdRouteChildren: AppOrganizationIdProjectIdRouteCh
       AppOrganizationIdProjectIdDashboardsDashboardIdRoute,
     AppOrganizationIdProjectIdEventsRoute:
       AppOrganizationIdProjectIdEventsRouteWithChildren,
+    AppOrganizationIdProjectIdIntegrationsRoute:
+      AppOrganizationIdProjectIdIntegrationsRouteWithChildren,
     AppOrganizationIdProjectIdNotificationsRoute:
       AppOrganizationIdProjectIdNotificationsRouteWithChildren,
     AppOrganizationIdProjectIdProfilesRoute:
@@ -2340,42 +2379,6 @@ const AppOrganizationIdAccountRouteWithChildren =
     AppOrganizationIdAccountRouteChildren,
   )
 
-interface AppOrganizationIdIntegrationsTabsRouteChildren {
-  AppOrganizationIdIntegrationsTabsAvailableRoute: typeof AppOrganizationIdIntegrationsTabsAvailableRoute
-  AppOrganizationIdIntegrationsTabsInstalledRoute: typeof AppOrganizationIdIntegrationsTabsInstalledRoute
-  AppOrganizationIdIntegrationsTabsIndexRoute: typeof AppOrganizationIdIntegrationsTabsIndexRoute
-}
-
-const AppOrganizationIdIntegrationsTabsRouteChildren: AppOrganizationIdIntegrationsTabsRouteChildren =
-  {
-    AppOrganizationIdIntegrationsTabsAvailableRoute:
-      AppOrganizationIdIntegrationsTabsAvailableRoute,
-    AppOrganizationIdIntegrationsTabsInstalledRoute:
-      AppOrganizationIdIntegrationsTabsInstalledRoute,
-    AppOrganizationIdIntegrationsTabsIndexRoute:
-      AppOrganizationIdIntegrationsTabsIndexRoute,
-  }
-
-const AppOrganizationIdIntegrationsTabsRouteWithChildren =
-  AppOrganizationIdIntegrationsTabsRoute._addFileChildren(
-    AppOrganizationIdIntegrationsTabsRouteChildren,
-  )
-
-interface AppOrganizationIdIntegrationsRouteChildren {
-  AppOrganizationIdIntegrationsTabsRoute: typeof AppOrganizationIdIntegrationsTabsRouteWithChildren
-}
-
-const AppOrganizationIdIntegrationsRouteChildren: AppOrganizationIdIntegrationsRouteChildren =
-  {
-    AppOrganizationIdIntegrationsTabsRoute:
-      AppOrganizationIdIntegrationsTabsRouteWithChildren,
-  }
-
-const AppOrganizationIdIntegrationsRouteWithChildren =
-  AppOrganizationIdIntegrationsRoute._addFileChildren(
-    AppOrganizationIdIntegrationsRouteChildren,
-  )
-
 interface AppOrganizationIdMembersTabsRouteChildren {
   AppOrganizationIdMembersTabsInvitationsRoute: typeof AppOrganizationIdMembersTabsInvitationsRoute
   AppOrganizationIdMembersTabsMembersRoute: typeof AppOrganizationIdMembersTabsMembersRoute
@@ -2418,7 +2421,6 @@ interface AppOrganizationIdRouteChildren {
   AppOrganizationIdSettingsRoute: typeof AppOrganizationIdSettingsRoute
   AppOrganizationIdIndexRoute: typeof AppOrganizationIdIndexRoute
   AppOrganizationIdAccountRoute: typeof AppOrganizationIdAccountRouteWithChildren
-  AppOrganizationIdIntegrationsRoute: typeof AppOrganizationIdIntegrationsRouteWithChildren
   AppOrganizationIdMembersRoute: typeof AppOrganizationIdMembersRouteWithChildren
 }
 
@@ -2428,8 +2430,6 @@ const AppOrganizationIdRouteChildren: AppOrganizationIdRouteChildren = {
   AppOrganizationIdSettingsRoute: AppOrganizationIdSettingsRoute,
   AppOrganizationIdIndexRoute: AppOrganizationIdIndexRoute,
   AppOrganizationIdAccountRoute: AppOrganizationIdAccountRouteWithChildren,
-  AppOrganizationIdIntegrationsRoute:
-    AppOrganizationIdIntegrationsRouteWithChildren,
   AppOrganizationIdMembersRoute: AppOrganizationIdMembersRouteWithChildren,
 }
 
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
similarity index 79%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
index d9c66d13a..71f94be10 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.available.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.available.tsx
@@ -2,7 +2,7 @@ import { AllIntegrations } from '@/components/integrations/all-integrations';
 import { createFileRoute } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/available',
+  '/_app/$organizationId/$projectId/integrations/_tabs/available',
 )({
   component: Component,
 });
diff --git a/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx
new file mode 100644
index 000000000..132dd083f
--- /dev/null
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.index.tsx
@@ -0,0 +1,17 @@
+import { createFileRoute, redirect } from '@tanstack/react-router';
+
+export const Route = createFileRoute(
+  '/_app/$organizationId/$projectId/integrations/_tabs/',
+)({
+  component: Component,
+  beforeLoad({ params }) {
+    throw redirect({
+      to: '/$organizationId/$projectId/integrations/installed',
+      params,
+    });
+  },
+});
+
+function Component() {
+  return null;
+}
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
similarity index 80%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
index f55928297..796905da3 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.installed.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.installed.tsx
@@ -2,7 +2,7 @@ import { ActiveIntegrations } from '@/components/integrations/active-integration
 import { createFileRoute } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/installed',
+  '/_app/$organizationId/$projectId/integrations/_tabs/installed',
 )({
   component: Component,
 });
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
similarity index 65%
rename from apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx
rename to apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
index 27ea87a54..f652542f1 100644
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.tsx
+++ b/apps/start/src/routes/_app.$organizationId.$projectId.integrations._tabs.tsx
@@ -1,35 +1,22 @@
-import FullPageLoadingState from '@/components/full-page-loading-state';
 import { PageHeader } from '@/components/page-header';
 import { Tabs, TabsList, TabsTrigger } from '@/components/ui/tabs';
 import { usePageTabs } from '@/hooks/use-page-tabs';
-import { PAGE_TITLES, createOrganizationTitle } from '@/utils/title';
+import { PAGE_TITLES, createProjectTitle } from '@/utils/title';
 import { Outlet, createFileRoute, useRouter } from '@tanstack/react-router';
 
 export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs',
+  '/_app/$organizationId/$projectId/integrations/_tabs',
 )({
   component: Component,
-  loader: async ({ context, params }) => {
-    const organization = await context.queryClient.fetchQuery(
-      context.trpc.organization.get.queryOptions({
-        organizationId: params.organizationId,
-      }),
-    );
-    return { organization };
-  },
-  head: ({ loaderData }) => {
+  head: () => {
     return {
       meta: [
         {
-          title: createOrganizationTitle(
-            PAGE_TITLES.INTEGRATIONS,
-            loaderData?.organization?.name,
-          ),
+          title: createProjectTitle(PAGE_TITLES.INTEGRATIONS),
         },
       ],
     };
   },
-  pendingComponent: FullPageLoadingState,
 });
 
 function Component() {
diff --git a/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx b/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx
deleted file mode 100644
index 7e2ed4a51..000000000
--- a/apps/start/src/routes/_app.$organizationId.integrations._tabs.index.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-import { redirect } from '@tanstack/react-router';
-import { createFileRoute } from '@tanstack/react-router';
-
-export const Route = createFileRoute(
-  '/_app/$organizationId/integrations/_tabs/',
-)({
-  component: Component,
-  beforeLoad: ({ params }) => {
-    throw redirect({
-      to: '/$organizationId/integrations/installed',
-      params,
-    });
-  },
-});
-
-function Component() {
-  return null;
-}
diff --git a/apps/worker/package.json b/apps/worker/package.json
index 494824189..2ef4d6ee4 100644
--- a/apps/worker/package.json
+++ b/apps/worker/package.json
@@ -26,6 +26,7 @@
     "@openpanel/payments": "workspace:*",
     "@openpanel/queue": "workspace:*",
     "@openpanel/redis": "workspace:*",
+    "@openpanel/validation": "workspace:*",
     "bullmq": "^5.63.0",
     "date-fns": "^3.3.1",
     "express": "^4.18.2",
@@ -47,5 +48,10 @@
     "@types/uuid": "^9.0.8",
     "tsdown": "0.14.2",
     "typescript": "catalog:"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0"
   }
 }
\ No newline at end of file
diff --git a/apps/worker/src/boot-cron.ts b/apps/worker/src/boot-cron.ts
index 9e17b845e..d88cce2ed 100644
--- a/apps/worker/src/boot-cron.ts
+++ b/apps/worker/src/boot-cron.ts
@@ -113,6 +113,11 @@ export async function bootCron() {
       type: 'weeklyDigest',
       pattern: '0 8 * * 1', // Mondays 08:00 UTC — weekly analytics digest email
     },
+    {
+      name: 'flushExports',
+      type: 'flushExports',
+      pattern: 1000 * 60, // Every 1 minute — drains export buffers to S3/GCS
+    },
   ];
 
   if (process.env.SELF_HOSTED && process.env.NODE_ENV === 'production') {
diff --git a/apps/worker/src/boot-debug.ts b/apps/worker/src/boot-debug.ts
index 28bb2dd1e..27bc0a46f 100644
--- a/apps/worker/src/boot-debug.ts
+++ b/apps/worker/src/boot-debug.ts
@@ -30,6 +30,7 @@ const CRON_TYPES = [
   'sessionVacuum',
   'insightCleanup',
   'weeklyDigest',
+  'flushExports',
 ] as const satisfies readonly CronQueueType[];
 
 function escapeHtml(value: string) {
diff --git a/apps/worker/src/jobs/cron.flush-exports.ts b/apps/worker/src/jobs/cron.flush-exports.ts
new file mode 100644
index 000000000..77b6037ca
--- /dev/null
+++ b/apps/worker/src/jobs/cron.flush-exports.ts
@@ -0,0 +1,304 @@
+import { DateTime } from '@openpanel/common';
+import {
+  ch,
+  clickhouseEventToExportEvent,
+  convertClickhouseDateToJs,
+  createBatch,
+  createManifest,
+  db,
+  generateBatchPath,
+  type IClickhouseEvent,
+  MANIFEST_CONTENT_TYPE,
+  MANIFEST_FILENAME,
+  serializeManifest,
+  TABLE_NAMES,
+} from '@openpanel/db';
+import type { IObjectStoreAdapter } from '@openpanel/integrations/src/object-store';
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
+import { createLogger } from '@openpanel/logger';
+import type { CronQueuePayload } from '@openpanel/queue';
+import {
+  type IGCSExportConfig,
+  type IIntegrationConfig,
+  type IS3ExportConfig,
+  isKind,
+} from '@openpanel/validation';
+import type { Job } from 'bullmq';
+
+const logger = createLogger({ name: 'flush-exports' });
+
+// Safety lag: never export events whose inserted_at is within this window of
+// now(), so an in-flight CH insert batch (or replica lag) can't be half-read at
+// the boundary. Evaluated server-side via CH now64() to avoid worker/CH clock skew.
+const LAG_SECONDS = Number.parseInt(process.env.EXPORT_LAG_SECONDS || '60', 10);
+// Max rows per object/batch and max batches drained per (project, integration)
+// per run. A backlog drains over subsequent ticks rather than in one giant pass.
+const BATCH_SIZE = Number.parseInt(process.env.EXPORT_BATCH_SIZE || '50000', 10);
+const MAX_BATCHES_PER_RUN = Number.parseInt(
+  process.env.EXPORT_MAX_BATCHES_PER_RUN || '20',
+  10
+);
+const CONCURRENCY = Number.parseInt(process.env.EXPORT_CONCURRENCY || '4', 10);
+
+// Sentinel cursor id for the first window of a (project, integration). The
+// events `id` column is a UUID, so the tie-breaker must compare as UUID — an
+// empty string fails to parse. The id tie-breaker is load-bearing: an import
+// stamps the same inserted_at across its whole batch, so a timestamp-only cursor
+// would skip all but one row.
+const NIL_UUID = '00000000-0000-0000-0000-000000000000';
+
+const EXPORT_COLUMNS = `
+  id, name, sdk_name, sdk_version, device_id, profile_id, project_id,
+  session_id, path, origin, referrer, referrer_name, referrer_type,
+  duration, properties, created_at, country, city, region,
+  longitude, latitude, os, os_version, browser, browser_version,
+  device, brand, model, imported_at, inserted_at, revenue
+`;
+
+type ExportConfig = IS3ExportConfig | IGCSExportConfig;
+
+interface Cursor {
+  // CH datetime string 'yyyy-MM-dd HH:mm:ss.SSS' + last event id, a composite
+  // cursor so rows sharing an inserted_at aren't skipped or duplicated.
+  insertedAt: string;
+  eventId: string;
+}
+
+function isExportConfig(config: IIntegrationConfig): config is ExportConfig {
+  // Capability comes from the integration registry, not a hardcoded type list.
+  return isKind(config, 'export');
+}
+
+const formatCh = (date: Date): string =>
+  DateTime.fromJSDate(date).setZone('UTC').toFormat('yyyy-MM-dd HH:mm:ss.SSS');
+
+/**
+ * Drain new ClickHouse events into each configured object-store export.
+ *
+ * The Redis buffer + per-event hook are gone: ClickHouse is the single source of
+ * truth, so this job windows the events table by `inserted_at` and uploads
+ * batched files. Export never touches the ingestion path.
+ */
+export async function flushExportsJob(_job: Job<CronQueuePayload>) {
+  const integrations = await db.integration.findMany();
+  const exportIntegrations = integrations.filter((i) =>
+    isExportConfig(i.config)
+  );
+
+  if (exportIntegrations.length === 0) {
+    return;
+  }
+
+  // Project-scoped integrations export exactly their one project. Legacy
+  // org-wide integrations (projectId == null) still fan out across every active
+  // project in the org. Either way each (project, integration) pair gets its own
+  // watermark + object path.
+  const items: Array<{
+    projectId: string;
+    integrationId: string;
+    config: ExportConfig;
+  }> = [];
+  for (const integration of exportIntegrations) {
+    const config = integration.config as ExportConfig;
+
+    if (integration.projectId) {
+      items.push({
+        projectId: integration.projectId,
+        integrationId: integration.id,
+        config,
+      });
+      continue;
+    }
+
+    const projects = await db.project.findMany({
+      where: { organizationId: integration.organizationId, deleteAt: null },
+      select: { id: true },
+    });
+    for (const project of projects) {
+      items.push({
+        projectId: project.id,
+        integrationId: integration.id,
+        config,
+      });
+    }
+  }
+
+  await runWithConcurrency(items, CONCURRENCY, (item) =>
+    processExport(item.projectId, item.integrationId, item.config).catch(
+      (error) => {
+        logger.error(
+          {
+            err: error,
+            projectId: item.projectId,
+            integrationId: item.integrationId,
+          },
+          'Export failed for project'
+        );
+      }
+    )
+  );
+}
+
+async function processExport(
+  projectId: string,
+  integrationId: string,
+  config: ExportConfig
+): Promise<void> {
+  let cursor = await loadCursor(projectId, integrationId);
+  const adapter: IObjectStoreAdapter | undefined = getServerIntegration(
+    config.type
+  ).export?.createAdapter(config);
+  if (!adapter) {
+    throw new Error(`Integration ${config.type} has no export adapter`);
+  }
+  const prefix = config.prefix || 'openpanel-exports';
+  const format = config.format || 'jsonl_gzip';
+
+  for (let i = 0; i < MAX_BATCHES_PER_RUN; i++) {
+    const rows = await queryWindow(projectId, cursor);
+    if (rows.length === 0) {
+      break;
+    }
+
+    const events = rows.map(clickhouseEventToExportEvent);
+    const batch = await createBatch(projectId, integrationId, events, format);
+    const basePath = generateBatchPath(
+      prefix,
+      projectId,
+      integrationId,
+      batch.info.batchId,
+      new Date(batch.info.minEventTime)
+    );
+
+    // Upload data files first, then the manifest last as the commit marker.
+    for (const file of batch.files) {
+      await adapter.upload({
+        bucket: config.bucket,
+        key: `${basePath}/${file.filename}`,
+        content: file.content,
+        contentType: file.contentType,
+      });
+    }
+    const manifest = createManifest(
+      batch.info,
+      batch.files.map((f) => f.filename)
+    );
+    await adapter.upload({
+      bucket: config.bucket,
+      key: `${basePath}/${MANIFEST_FILENAME}`,
+      content: serializeManifest(manifest),
+      contentType: MANIFEST_CONTENT_TYPE,
+    });
+
+    // Advance the watermark only after a successful upload. A crash mid-run
+    // re-exports the un-acked batch next tick (at-least-once); the manifest is
+    // the consumer's signal that a batch is complete.
+    const last = rows[rows.length - 1]!;
+    cursor = { insertedAt: last.inserted_at!, eventId: last.id };
+    await saveCursor(projectId, integrationId, cursor);
+
+    logger.info(
+      {
+        projectId,
+        integrationId,
+        batchId: batch.info.batchId,
+        recordCount: batch.info.recordCount,
+        format,
+      },
+      'Export batch uploaded'
+    );
+
+    if (rows.length < BATCH_SIZE) {
+      break;
+    }
+  }
+}
+
+async function queryWindow(
+  projectId: string,
+  cursor: Cursor
+): Promise<IClickhouseEvent[]> {
+  const result = await ch.query({
+    query: `
+      SELECT ${EXPORT_COLUMNS}
+      FROM ${TABLE_NAMES.events}
+      WHERE project_id = {projectId:String}
+        AND inserted_at <= now64(3) - INTERVAL {lag:UInt32} SECOND
+        AND (
+          inserted_at > {wTs:DateTime64(3)}
+          OR (inserted_at = {wTs:DateTime64(3)} AND id > {wId:UUID})
+        )
+      ORDER BY inserted_at, id
+      LIMIT {limit:UInt32}
+    `,
+    query_params: {
+      projectId,
+      lag: LAG_SECONDS,
+      wTs: cursor.insertedAt,
+      wId: cursor.eventId || NIL_UUID,
+      limit: BATCH_SIZE,
+    },
+    format: 'JSONEachRow',
+  });
+
+  return (await result.json()) as IClickhouseEvent[];
+}
+
+async function loadCursor(
+  projectId: string,
+  integrationId: string
+): Promise<Cursor> {
+  const existing = await db.exportWatermark.findUnique({
+    where: { projectId_integrationId: { projectId, integrationId } },
+  });
+  if (existing) {
+    return {
+      insertedAt: formatCh(existing.lastInsertedAt),
+      eventId: existing.lastEventId,
+    };
+  }
+
+  // First run for this pair: start from now, so connecting an export doesn't
+  // dump the project's entire history. Historical backfill is a separate,
+  // explicit operation (reset the watermark).
+  const now = new Date();
+  await db.exportWatermark.create({
+    data: { projectId, integrationId, lastInsertedAt: now, lastEventId: NIL_UUID },
+  });
+  return { insertedAt: formatCh(now), eventId: NIL_UUID };
+}
+
+async function saveCursor(
+  projectId: string,
+  integrationId: string,
+  cursor: Cursor
+): Promise<void> {
+  await db.exportWatermark.update({
+    where: { projectId_integrationId: { projectId, integrationId } },
+    data: {
+      lastInsertedAt: convertClickhouseDateToJs(cursor.insertedAt),
+      lastEventId: cursor.eventId,
+    },
+  });
+}
+
+async function runWithConcurrency<T>(
+  items: T[],
+  limit: number,
+  fn: (item: T) => Promise<void>
+): Promise<void> {
+  const queue = [...items];
+  const workers = Array.from(
+    { length: Math.max(1, Math.min(limit, queue.length)) },
+    async () => {
+      while (queue.length > 0) {
+        const item = queue.shift();
+        if (item === undefined) {
+          break;
+        }
+        await fn(item);
+      }
+    }
+  );
+  await Promise.all(workers);
+}
diff --git a/apps/worker/src/jobs/cron.ts b/apps/worker/src/jobs/cron.ts
index 008d2dbd5..5c70fa120 100644
--- a/apps/worker/src/jobs/cron.ts
+++ b/apps/worker/src/jobs/cron.ts
@@ -10,6 +10,7 @@ import type { CronQueuePayload } from '@openpanel/queue';
 import type { Job } from 'bullmq';
 import { cohortRefreshCronJob } from './cron.cohort-refresh';
 import { jobDelete } from './cron.delete';
+import { flushExportsJob } from './cron.flush-exports';
 import { insightCleanupCronJob } from './cron.insight-cleanup';
 import { weeklyDigestCronJob } from './cron.weekly-digest';
 import { onboardingJob } from './cron.onboarding';
@@ -75,5 +76,8 @@ export async function cronJob(job: Job<CronQueuePayload>) {
     case 'weeklyDigest': {
       return await weeklyDigestCronJob();
     }
+    case 'flushExports': {
+      return await flushExportsJob(job);
+    }
   }
 }
diff --git a/apps/worker/src/jobs/notification.ts b/apps/worker/src/jobs/notification.ts
index 702fa93e3..f47e9d995 100644
--- a/apps/worker/src/jobs/notification.ts
+++ b/apps/worker/src/jobs/notification.ts
@@ -1,9 +1,7 @@
 import type { Job } from 'bullmq';
 
 import { Prisma, db } from '@openpanel/db';
-import { sendDiscordNotification } from '@openpanel/integrations/src/discord';
-import { sendSlackNotification } from '@openpanel/integrations/src/slack';
-import { execute as executeJavaScriptTemplate } from '@openpanel/js-runtime';
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
 import type { NotificationQueuePayload } from '@openpanel/queue';
 import { publishEvent } from '@openpanel/redis';
 
@@ -23,6 +21,7 @@ export async function notificationJob(job: Job<NotificationQueuePayload>) {
     case 'sendNotification': {
       const { notification } = job.data.payload;
 
+      // App + email are pseudo-integrations dispatched by flags, not real rows.
       if (notification.sendToApp) {
         publishEvent('notification', 'created', notification);
         return;
@@ -48,59 +47,30 @@ export async function notificationJob(job: Job<NotificationQueuePayload>) {
         return new Error('Invalid payload');
       }
 
-      switch (integration.config.type) {
-        case 'webhook': {
-          let body: unknown;
-
-          if (integration.config.mode === 'javascript') {
-            // We only transform event payloads for now (not funnel)
-            if (
-              integration.config.javascriptTemplate &&
-              payload.type === 'event'
-            ) {
-              const result = executeJavaScriptTemplate(
-                integration.config.javascriptTemplate,
-                payload.event,
-              );
-              body = result;
-            } else {
-              body = payload;
-            }
-          } else {
-            body = {
-              title: notification.title,
-              message: notification.message,
-            };
-          }
-
-          return fetch(integration.config.url, {
-            method: 'POST',
-            headers: {
-              ...(integration.config.headers ?? {}),
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify(body),
-          });
-        }
-        case 'discord': {
-          return sendDiscordNotification({
-            webhookUrl: integration.config.url,
-            message: [
-              `🔔 **${notification.title}**`,
-              notification.message,
-            ].join('\n'),
-          });
-        }
+      // An integration whose config is still empty (e.g. a Slack integration
+      // before its OAuth callback fills the config) has no type yet — nothing
+      // to deliver to.
+      if (!integration.config?.type) {
+        return;
+      }
 
-        case 'slack': {
-          return sendSlackNotification({
-            webhookUrl: integration.config.incoming_webhook.url,
-            message: [`🔔 *${notification.title}*`, notification.message].join(
-              '\n',
-            ),
-          });
-        }
+      // Generic registry dispatch — no per-type switch. A new notification
+      // integration just registers a `notification.deliver` plugin.
+      const plugin = getServerIntegration(integration.config.type);
+      if (!plugin.notification) {
+        throw new Error(
+          `Integration ${integration.config.type} is not a notification sink`,
+        );
       }
+
+      return plugin.notification.deliver({
+        config: integration.config,
+        notification: {
+          title: notification.title,
+          message: notification.message,
+        },
+        payload,
+      });
     }
   }
 }
diff --git a/apps/worker/tsdown.config.ts b/apps/worker/tsdown.config.ts
index c41662a85..fcc2fd9a2 100644
--- a/apps/worker/tsdown.config.ts
+++ b/apps/worker/tsdown.config.ts
@@ -10,6 +10,10 @@ const options: Options = {
     'pino',
     'pino-pretty',
     '@node-rs/argon2',
+    // integrations package
+    '@aws-sdk/client-s3',
+    '@aws-sdk/client-sts',
+    '@google-cloud/storage',
   ],
   sourcemap: true,
   platform: 'node',
diff --git a/packages/common/server/encryption.test.ts b/packages/common/server/encryption.test.ts
new file mode 100644
index 000000000..d2fe657fd
--- /dev/null
+++ b/packages/common/server/encryption.test.ts
@@ -0,0 +1,39 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+import {
+  decrypt,
+  decryptCredential,
+  encrypt,
+  encryptCredential,
+  isEncrypted,
+} from './encryption';
+
+beforeAll(() => {
+  // Deterministic key for the round-trips (overrides any ambient value).
+  process.env.ENCRYPTION_KEY = 'a'.repeat(64);
+});
+
+describe('encryption (single ENCRYPTION_KEY)', () => {
+  it('encrypt/decrypt round-trips without a prefix (TOTP/GSC format)', () => {
+    const secret = 'totp-or-gsc-secret';
+    const enc = encrypt(secret);
+    expect(isEncrypted(enc)).toBe(false);
+    expect(enc).not.toBe(secret);
+    expect(decrypt(enc)).toBe(secret);
+  });
+
+  it('encryptCredential/decryptCredential round-trips with the enc: prefix', () => {
+    const secret = 'aws-secret-access-key';
+    const enc = encryptCredential(secret);
+    expect(isEncrypted(enc)).toBe(true);
+    expect(decryptCredential(enc)).toBe(secret);
+  });
+
+  it('encryptCredential is idempotent (never double-encrypts)', () => {
+    const enc = encryptCredential('x');
+    expect(encryptCredential(enc)).toBe(enc);
+  });
+
+  it('decryptCredential passes plaintext through (test-connection flow)', () => {
+    expect(decryptCredential('plaintext')).toBe('plaintext');
+  });
+});
diff --git a/packages/common/server/encryption.ts b/packages/common/server/encryption.ts
new file mode 100644
index 000000000..39f7c385a
--- /dev/null
+++ b/packages/common/server/encryption.ts
@@ -0,0 +1,140 @@
+import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
+
+const ENCRYPTION_PREFIX = 'enc:';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+const ENCODING = 'base64';
+
+/**
+ * Single symmetric key for all at-rest encryption (TOTP secrets, GSC tokens,
+ * integration credentials). Must be 32 bytes (64 hex characters).
+ * Generate with: openssl rand -hex 32
+ */
+function getEncryptionKey(): Buffer {
+  const keyHex = process.env.ENCRYPTION_KEY;
+
+  if (!keyHex) {
+    throw new Error('ENCRYPTION_KEY environment variable is not set');
+  }
+
+  if (keyHex.length !== 64) {
+    throw new Error(
+      'ENCRYPTION_KEY must be 32 bytes (64 hex characters). Generate with: openssl rand -hex 32',
+    );
+  }
+
+  return Buffer.from(keyHex, 'hex');
+}
+
+// ---------------------------------------------------------------------------
+// Plain encrypt/decrypt — base64(iv + authTag + ciphertext), no prefix.
+// Used for TOTP secrets and GSC tokens. (Kept format-stable so existing
+// ciphertext keeps decrypting; this is the implementation db re-exports.)
+// ---------------------------------------------------------------------------
+
+export function encrypt(plaintext: string): string {
+  const key = getEncryptionKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, tag, encrypted]).toString(ENCODING);
+}
+
+export function decrypt(ciphertext: string): string {
+  const key = getEncryptionKey();
+  const buf = Buffer.from(ciphertext, ENCODING);
+  const iv = buf.subarray(0, IV_LENGTH);
+  const tag = buf.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+  const encrypted = buf.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(encrypted) + decipher.final('utf8');
+}
+
+// ---------------------------------------------------------------------------
+// Credential variant — enc:base64(iv + ciphertext + authTag). The enc: prefix
+// makes it idempotent (skip already-encrypted values) and lets a plaintext
+// value pass through unchanged, which the integration test-connection flow
+// relies on (it builds adapters from the raw, unsaved config).
+// ---------------------------------------------------------------------------
+
+export function isEncrypted(value: string): boolean {
+  return value.startsWith(ENCRYPTION_PREFIX);
+}
+
+export function encryptCredential(plaintext: string): string {
+  if (!plaintext) {
+    return plaintext;
+  }
+  // Don't double-encrypt
+  if (isEncrypted(plaintext)) {
+    return plaintext;
+  }
+
+  const key = getEncryptionKey();
+  const iv = randomBytes(IV_LENGTH);
+
+  const cipher = createCipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+
+  const ciphertext = Buffer.concat([
+    cipher.update(plaintext, 'utf8'),
+    cipher.final(),
+  ]);
+
+  const authTag = cipher.getAuthTag();
+
+  // Combine: IV (12 bytes) + ciphertext (variable) + authTag (16 bytes)
+  const combined = Buffer.concat([iv, ciphertext, authTag]);
+
+  return ENCRYPTION_PREFIX + combined.toString('base64');
+}
+
+export function decryptCredential(ciphertext: string): string {
+  if (!ciphertext) {
+    return ciphertext;
+  }
+  // If not encrypted, return as-is (allows for graceful migration)
+  if (!isEncrypted(ciphertext)) {
+    return ciphertext;
+  }
+
+  const key = getEncryptionKey();
+
+  // Remove prefix and decode base64
+  const combined = Buffer.from(
+    ciphertext.slice(ENCRYPTION_PREFIX.length),
+    'base64',
+  );
+
+  if (combined.length < IV_LENGTH + AUTH_TAG_LENGTH) {
+    throw new Error('Invalid encrypted credential: too short');
+  }
+
+  // Extract components
+  const iv = combined.subarray(0, IV_LENGTH);
+  const authTag = combined.subarray(combined.length - AUTH_TAG_LENGTH);
+  const encryptedData = combined.subarray(
+    IV_LENGTH,
+    combined.length - AUTH_TAG_LENGTH,
+  );
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv, {
+    authTagLength: AUTH_TAG_LENGTH,
+  });
+
+  decipher.setAuthTag(authTag);
+
+  const decrypted = Buffer.concat([
+    decipher.update(encryptedData),
+    decipher.final(),
+  ]);
+
+  return decrypted.toString('utf8');
+}
diff --git a/packages/common/server/index.ts b/packages/common/server/index.ts
index cb5409062..9a2343cd1 100644
--- a/packages/common/server/index.ts
+++ b/packages/common/server/index.ts
@@ -1,5 +1,7 @@
 export * from './crypto';
+export * from './encryption';
 export * from './profileId';
 export * from './parser-user-agent';
 export * from './parse-referrer';
 export * from './id';
+export * from './ssrf';
diff --git a/packages/common/server/ssrf.test.ts b/packages/common/server/ssrf.test.ts
new file mode 100644
index 000000000..d6d052f42
--- /dev/null
+++ b/packages/common/server/ssrf.test.ts
@@ -0,0 +1,49 @@
+import { afterEach, describe, expect, it } from 'vitest';
+import { assertSafeUrl, isBlockedAddress } from './ssrf';
+
+describe('isBlockedAddress', () => {
+  it('blocks private / loopback / link-local / metadata', () => {
+    expect(isBlockedAddress('127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('10.0.0.5')).toBe(true);
+    expect(isBlockedAddress('172.16.0.1')).toBe(true);
+    expect(isBlockedAddress('192.168.1.1')).toBe(true);
+    expect(isBlockedAddress('169.254.169.254')).toBe(true); // cloud metadata
+    expect(isBlockedAddress('100.64.0.1')).toBe(true); // CGNAT
+    expect(isBlockedAddress('::1')).toBe(true);
+    expect(isBlockedAddress('fd00::1')).toBe(true);
+    expect(isBlockedAddress('fe80::1')).toBe(true);
+    expect(isBlockedAddress('::ffff:127.0.0.1')).toBe(true);
+    expect(isBlockedAddress('not-an-ip')).toBe(true);
+  });
+
+  it('allows public addresses', () => {
+    expect(isBlockedAddress('1.1.1.1')).toBe(false);
+    expect(isBlockedAddress('8.8.8.8')).toBe(false);
+    expect(isBlockedAddress('2606:4700:4700::1111')).toBe(false);
+  });
+});
+
+describe('assertSafeUrl', () => {
+  const original = process.env.SELF_HOSTED;
+  afterEach(() => {
+    process.env.SELF_HOSTED = original;
+  });
+
+  it('rejects non-http(s) schemes on the cloud', async () => {
+    process.env.SELF_HOSTED = '';
+    await expect(assertSafeUrl('ftp://example.com')).rejects.toThrow();
+  });
+
+  it('rejects literal private / metadata hosts on the cloud', async () => {
+    process.env.SELF_HOSTED = '';
+    await expect(assertSafeUrl('http://127.0.0.1/x')).rejects.toThrow();
+    await expect(
+      assertSafeUrl('http://169.254.169.254/latest/meta-data/'),
+    ).rejects.toThrow();
+  });
+
+  it('is a no-op on self-hosted (operator controls the network)', async () => {
+    process.env.SELF_HOSTED = 'true';
+    await expect(assertSafeUrl('http://127.0.0.1/x')).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/common/server/ssrf.ts b/packages/common/server/ssrf.ts
new file mode 100644
index 000000000..8cae43b03
--- /dev/null
+++ b/packages/common/server/ssrf.ts
@@ -0,0 +1,92 @@
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+
+/**
+ * Block a resolved IP that targets internal/reserved space — loopback, private
+ * ranges, CGNAT, and link-local (which includes the cloud metadata endpoint
+ * 169.254.169.254). Anything that isn't a valid public IP is blocked.
+ */
+function isBlockedIpv4(ip: string): boolean {
+  const parts = ip.split('.').map(Number);
+  if (
+    parts.length !== 4 ||
+    parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)
+  ) {
+    return true;
+  }
+  const [a, b] = parts as [number, number, number, number];
+  return (
+    a === 0 || // "this" network
+    a === 10 || // private
+    a === 127 || // loopback
+    (a === 100 && b >= 64 && b <= 127) || // CGNAT
+    (a === 169 && b === 254) || // link-local + cloud metadata
+    (a === 172 && b >= 16 && b <= 31) || // private
+    (a === 192 && b === 168) // private
+  );
+}
+
+function isBlockedIpv6(ip: string): boolean {
+  const lower = ip.toLowerCase();
+  if (lower === '::1' || lower === '::') {
+    return true; // loopback / unspecified
+  }
+  const mapped = lower.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (mapped) {
+    return isBlockedIpv4(mapped[1]!); // IPv4-mapped
+  }
+  return (
+    lower.startsWith('fc') || // unique-local fc00::/7
+    lower.startsWith('fd') ||
+    /^fe[89ab]/.test(lower) // link-local fe80::/10
+  );
+}
+
+export function isBlockedAddress(ip: string): boolean {
+  const family = isIP(ip);
+  if (family === 4) {
+    return isBlockedIpv4(ip);
+  }
+  if (family === 6) {
+    return isBlockedIpv6(ip);
+  }
+  return true; // not a parseable IP → block
+}
+
+/**
+ * SSRF guard for tenant-controlled URLs (webhooks, custom S3 endpoints). Rejects
+ * non-HTTP(S) schemes and any host that resolves to internal/reserved address
+ * space, before a connection is made.
+ *
+ * Skipped on self-hosted deployments: there's a single tenant who already
+ * controls the network, and reaching internal services (e.g. an internal MinIO
+ * or webhook receiver) is a legitimate, pre-existing use. The guard exists to
+ * stop cross-tenant SSRF on the managed/multi-tenant cloud.
+ *
+ * Note: DNS is resolved here and again by the client, so a deliberate DNS-rebind
+ * between the two is not covered; this stops the common cases (literal
+ * private/metadata URLs and hostnames pointing at internal IPs).
+ */
+export async function assertSafeUrl(rawUrl: string): Promise<void> {
+  if (process.env.SELF_HOSTED) {
+    return;
+  }
+
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error('Invalid URL');
+  }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+    throw new Error('URL must use http or https');
+  }
+
+  const resolved = await lookup(url.hostname, { all: true });
+  if (
+    resolved.length === 0 ||
+    resolved.some((r) => isBlockedAddress(r.address))
+  ) {
+    throw new Error('URL resolves to a disallowed address');
+  }
+}
diff --git a/packages/db/code-migrations/18-add-events-inserted-at.ts b/packages/db/code-migrations/18-add-events-inserted-at.ts
new file mode 100644
index 000000000..c7964fff2
--- /dev/null
+++ b/packages/db/code-migrations/18-add-events-inserted-at.ts
@@ -0,0 +1,56 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {
+  addColumns,
+  runClickhouseMigrationCommands,
+} from '../src/clickhouse/migration';
+import { getIsCluster } from './helpers';
+
+export async function up() {
+  const isClustered = getIsCluster();
+
+  // `inserted_at` is the ingestion (CH-insert) time, used as the cursor for the
+  // object-store export job. New rows set it explicitly at insert time (see
+  // createEvent / moveImportsToProduction). The DEFAULT is `created_at` — NOT
+  // `now()` — on purpose: a DEFAULT now() on a column added to an existing
+  // MergeTree is evaluated lazily at read time for pre-migration parts, so old
+  // rows would read as "just inserted" on every scan and never settle. Defaulting
+  // to the existing `created_at` column is deterministic and needs no part
+  // rewrite, so historical rows keep a stable, in-the-past inserted_at.
+  // `inserted_at` is not part of the table's ORDER BY, so the windowed export
+  // query (WHERE inserted_at > cursor) can't use the primary index. A minmax
+  // skip index lets ClickHouse skip granules whose inserted_at range is entirely
+  // below the cursor. It only needs to exist on the local MergeTree (the
+  // `_replicated` table when clustered); the distributed table has no data.
+  const indexName = 'idx_inserted_at';
+  const indexExpr = `ADD INDEX IF NOT EXISTS ${indexName} inserted_at TYPE minmax GRANULARITY 1`;
+  const indexSql = isClustered
+    ? `ALTER TABLE events_replicated ON CLUSTER '{cluster}' ${indexExpr}`
+    : `ALTER TABLE events ${indexExpr}`;
+
+  const sqls: string[] = [
+    ...addColumns(
+      'events',
+      ['`inserted_at` DateTime64(3) DEFAULT created_at AFTER `imported_at`'],
+      isClustered,
+    ),
+    indexSql,
+  ];
+
+  fs.writeFileSync(
+    path.join(__filename.replace('.ts', '.sql')),
+    sqls
+      .map((sql) =>
+        sql
+          .trim()
+          .replace(/;$/, '')
+          .replace(/\n{2,}/g, '\n')
+          .concat(';'),
+      )
+      .join('\n\n---\n\n'),
+  );
+
+  if (!process.argv.includes('--dry')) {
+    await runClickhouseMigrationCommands(sqls);
+  }
+}
diff --git a/packages/db/index.ts b/packages/db/index.ts
index 727ea5663..bc4413572 100644
--- a/packages/db/index.ts
+++ b/packages/db/index.ts
@@ -4,6 +4,7 @@ export * from './src/clickhouse/query-builder';
 export * from './src/encryption';
 export * from './src/engine';
 export * from './src/engine';
+export * from './src/exports';
 export * from './src/gsc';
 export * from './src/prisma-client';
 export * from './src/services/access.service';
diff --git a/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql b/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql
new file mode 100644
index 000000000..5df01e977
--- /dev/null
+++ b/packages/db/prisma/migrations/20260622204749_export_watermarks/migration.sql
@@ -0,0 +1,24 @@
+-- CreateTable
+CREATE TABLE "public"."export_watermarks" (
+    "id" UUID NOT NULL DEFAULT gen_random_uuid(),
+    "projectId" TEXT NOT NULL,
+    "integrationId" UUID NOT NULL,
+    "lastInsertedAt" TIMESTAMP(3) NOT NULL,
+    "lastEventId" TEXT NOT NULL DEFAULT '',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "export_watermarks_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "export_watermarks_integrationId_idx" ON "public"."export_watermarks"("integrationId");
+
+-- CreateIndex
+CREATE UNIQUE INDEX "export_watermarks_projectId_integrationId_key" ON "public"."export_watermarks"("projectId", "integrationId");
+
+-- AddForeignKey
+ALTER TABLE "public"."export_watermarks" ADD CONSTRAINT "export_watermarks_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "public"."projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "public"."export_watermarks" ADD CONSTRAINT "export_watermarks_integrationId_fkey" FOREIGN KEY ("integrationId") REFERENCES "public"."integrations"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql b/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql
new file mode 100644
index 000000000..37c33032e
--- /dev/null
+++ b/packages/db/prisma/migrations/20260623092702_integration_project_scope/migration.sql
@@ -0,0 +1,11 @@
+-- AlterTable
+ALTER TABLE "public"."integrations" ADD COLUMN     "projectId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "integrations_organizationId_idx" ON "public"."integrations"("organizationId");
+
+-- CreateIndex
+CREATE INDEX "integrations_projectId_idx" ON "public"."integrations"("projectId");
+
+-- AddForeignKey
+ALTER TABLE "public"."integrations" ADD CONSTRAINT "integrations_projectId_fkey" FOREIGN KEY ("projectId") REFERENCES "public"."projects"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema.prisma b/packages/db/prisma/schema.prisma
index 8e9fe979d..8dfb8900a 100644
--- a/packages/db/prisma/schema.prisma
+++ b/packages/db/prisma/schema.prisma
@@ -253,6 +253,8 @@ model Project {
   imports           Import[]
   gscConnection     GscConnection?
   cohorts           Cohort[]
+  exportWatermarks  ExportWatermark[]
+  integrations      Integration[]
 
   // When deleteAt > now(), the project will be deleted
   deleteAt DateTime?
@@ -582,14 +584,42 @@ model Integration {
   config            Json
   organization      Organization       @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   organizationId    String
+  // When set, the integration is scoped to a single project; null = legacy
+  // org-wide (applies to every project in the org). organizationId is kept
+  // (derived from the project on create) so org-level queries/cascades still work.
+  project           Project?           @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  projectId         String?
   notificationRules NotificationRule[]
   notifications     Notification[]
+  exportWatermarks  ExportWatermark[]
   createdAt         DateTime           @default(now())
   updatedAt         DateTime           @default(now()) @updatedAt
 
+  @@index([organizationId])
+  @@index([projectId])
   @@map("integrations")
 }
 
+// Tracks how far the object-store export (S3/GCS) has progressed for a given
+// (project, integration) pair. The cursor is ClickHouse `inserted_at` plus the
+// last event id to break ties within the same millisecond, so windowed reads
+// are exactly-once across runs.
+model ExportWatermark {
+  id             String      @id @default(dbgenerated("gen_random_uuid()")) @db.Uuid
+  project        Project     @relation(fields: [projectId], references: [id], onDelete: Cascade)
+  projectId      String
+  integration    Integration @relation(fields: [integrationId], references: [id], onDelete: Cascade)
+  integrationId  String      @db.Uuid
+  lastInsertedAt DateTime
+  lastEventId    String      @default("")
+  createdAt      DateTime    @default(now())
+  updatedAt      DateTime    @default(now()) @updatedAt
+
+  @@unique([projectId, integrationId])
+  @@index([integrationId])
+  @@map("export_watermarks")
+}
+
 model ResetPassword {
   id        String   @id
   accountId String
diff --git a/packages/db/src/encryption.ts b/packages/db/src/encryption.ts
index b0835ec06..86e19e0a1 100644
--- a/packages/db/src/encryption.ts
+++ b/packages/db/src/encryption.ts
@@ -1,44 +1,5 @@
-import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';
-
-const ALGORITHM = 'aes-256-gcm';
-const IV_LENGTH = 12;
-const TAG_LENGTH = 16;
-const ENCODING = 'base64';
-
-function getKey(): Buffer {
-  const raw = process.env.ENCRYPTION_KEY;
-  if (!raw) {
-    throw new Error('ENCRYPTION_KEY environment variable is not set');
-  }
-  const buf = Buffer.from(raw, 'hex');
-  if (buf.length !== 32) {
-    throw new Error(
-      'ENCRYPTION_KEY must be a 64-character hex string (32 bytes)'
-    );
-  }
-  return buf;
-}
-
-export function encrypt(plaintext: string): string {
-  const key = getKey();
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv(ALGORITHM, key, iv);
-  const encrypted = Buffer.concat([
-    cipher.update(plaintext, 'utf8'),
-    cipher.final(),
-  ]);
-  const tag = cipher.getAuthTag();
-  // Format: base64(iv + tag + ciphertext)
-  return Buffer.concat([iv, tag, encrypted]).toString(ENCODING);
-}
-
-export function decrypt(ciphertext: string): string {
-  const key = getKey();
-  const buf = Buffer.from(ciphertext, ENCODING);
-  const iv = buf.subarray(0, IV_LENGTH);
-  const tag = buf.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
-  const encrypted = buf.subarray(IV_LENGTH + TAG_LENGTH);
-  const decipher = createDecipheriv(ALGORITHM, key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted) + decipher.final('utf8');
-}
+// At-rest encryption lives in @openpanel/common/server so it can be shared by
+// packages that can't depend on db (e.g. @openpanel/integrations). Re-exported
+// here for existing `@openpanel/db` importers (GSC tokens, TOTP). Same key
+// (ENCRYPTION_KEY) and same format as before — no data migration.
+export { encrypt, decrypt } from '@openpanel/common/server';
diff --git a/packages/db/src/exports/batch-creator.ts b/packages/db/src/exports/batch-creator.ts
new file mode 100644
index 000000000..3880c35ec
--- /dev/null
+++ b/packages/db/src/exports/batch-creator.ts
@@ -0,0 +1,219 @@
+import { createGzip } from 'node:zlib';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { generateSecureId } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+
+import type { IExportEvent } from './export-event';
+
+const logger = createLogger({ name: 'batch-creator' });
+
+/**
+ * Supported export formats
+ */
+export type ExportFormat = 'jsonl_gzip' | 'parquet';
+
+/**
+ * Batch metadata for tracking
+ */
+export interface IBatchInfo {
+  batchId: string;
+  projectId: string;
+  integrationId: string;
+  format: ExportFormat;
+  recordCount: number;
+  minEventTime: string;
+  maxEventTime: string;
+  createdAt: string;
+  // Partition info
+  partitionDate: string; // YYYY-MM-DD
+  partitionHour: string; // HH
+}
+
+/**
+ * Created batch file info
+ */
+export interface IBatchFile {
+  filename: string;
+  content: Buffer;
+  contentType: string;
+}
+
+/**
+ * Result of creating a batch
+ */
+export interface IBatchResult {
+  info: IBatchInfo;
+  files: IBatchFile[];
+}
+
+/**
+ * Generate the object path for a batch
+ * Layout: {prefix}/project_id={projectId}/integration_id={integrationId}/dt=YYYY-MM-DD/hour=HH/batch_id={batchId}/
+ */
+export function generateBatchPath(
+  prefix: string,
+  projectId: string,
+  integrationId: string,
+  batchId: string,
+  date: Date,
+): string {
+  const dt = date.toISOString().split('T')[0]; // YYYY-MM-DD
+  const hour = date.getUTCHours().toString().padStart(2, '0'); // HH
+
+  return [
+    prefix,
+    `project_id=${projectId}`,
+    `integration_id=${integrationId}`,
+    `dt=${dt}`,
+    `hour=${hour}`,
+    `batch_id=${batchId}`,
+  ].join('/');
+}
+
+/**
+ * Get file extension for format
+ */
+export function getFileExtension(format: ExportFormat): string {
+  switch (format) {
+    case 'jsonl_gzip':
+      return 'jsonl.gz';
+    case 'parquet':
+      return 'parquet';
+  }
+}
+
+/**
+ * Get content type for format
+ */
+export function getContentType(format: ExportFormat): string {
+  switch (format) {
+    case 'jsonl_gzip':
+      return 'application/gzip';
+    case 'parquet':
+      return 'application/vnd.apache.parquet';
+  }
+}
+
+/**
+ * Extract the min/max event time across a batch (used for partitioning + the
+ * manifest time range).
+ */
+function eventTimeRange(events: IExportEvent[]): {
+  minEventTime: string;
+  maxEventTime: string;
+} {
+  let minTime: Date | null = null;
+  let maxTime: Date | null = null;
+
+  for (const event of events) {
+    const eventTime = new Date(event.event_time);
+    if (!minTime || eventTime < minTime) {
+      minTime = eventTime;
+    }
+    if (!maxTime || eventTime > maxTime) {
+      maxTime = eventTime;
+    }
+  }
+
+  return {
+    minEventTime: minTime?.toISOString() || new Date().toISOString(),
+    maxEventTime: maxTime?.toISOString() || new Date().toISOString(),
+  };
+}
+
+/**
+ * Create JSONL content from events
+ */
+function createJsonlContent(events: IExportEvent[]): string {
+  return events.map((event) => JSON.stringify(event)).join('\n') + '\n';
+}
+
+/**
+ * Gzip compress content
+ */
+async function gzipCompress(content: string): Promise<Buffer> {
+  const chunks: Buffer[] = [];
+  const gzip = createGzip({ level: 6 });
+  const source = Readable.from([content]);
+
+  await pipeline(source, gzip, async function* (source) {
+    for await (const chunk of source) {
+      chunks.push(chunk as Buffer);
+    }
+  });
+
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Create a batch of events in the specified format
+ */
+export async function createBatch(
+  projectId: string,
+  integrationId: string,
+  events: IExportEvent[],
+  format: ExportFormat = 'jsonl_gzip',
+): Promise<IBatchResult> {
+  const batchId = generateSecureId('batch');
+  const now = new Date();
+
+  if (events.length === 0) {
+    throw new Error('No valid events to create batch');
+  }
+
+  const { minEventTime, maxEventTime } = eventTimeRange(events);
+
+  // Determine partition based on min event time
+  const partitionDate = new Date(minEventTime);
+  const dt = partitionDate.toISOString().split('T')[0]!;
+  const hour = partitionDate.getUTCHours().toString().padStart(2, '0');
+
+  const info: IBatchInfo = {
+    batchId,
+    projectId,
+    integrationId,
+    format,
+    recordCount: events.length,
+    minEventTime,
+    maxEventTime,
+    createdAt: now.toISOString(),
+    partitionDate: dt,
+    partitionHour: hour,
+  };
+
+  const files: IBatchFile[] = [];
+
+  switch (format) {
+    case 'jsonl_gzip': {
+      const jsonlContent = createJsonlContent(events);
+      const gzippedContent = await gzipCompress(jsonlContent);
+
+      files.push({
+        filename: `part-0000.${getFileExtension(format)}`,
+        content: gzippedContent,
+        contentType: getContentType(format),
+      });
+      break;
+    }
+    case 'parquet': {
+      // Parquet support to be implemented later
+      throw new Error('Parquet format not yet implemented');
+    }
+  }
+
+  logger.info(
+    {
+      batchId,
+      projectId,
+      integrationId,
+      format,
+      recordCount: events.length,
+      partitionDate: dt,
+      partitionHour: hour,
+    },
+    'Batch created',
+  );
+
+  return { info, files };
+}
diff --git a/packages/db/src/exports/export-event.ts b/packages/db/src/exports/export-event.ts
new file mode 100644
index 000000000..3a440799a
--- /dev/null
+++ b/packages/db/src/exports/export-event.ts
@@ -0,0 +1,72 @@
+import { convertClickhouseDateToJs } from '../clickhouse/client';
+import type { IClickhouseEvent } from '../services/event.service';
+
+/**
+ * Stable, versioned export schema written to the object store (JSONL/Parquet).
+ * Decoupled from the ClickHouse row shape so the export format can evolve
+ * independently of the internal column layout.
+ */
+export interface IExportEvent {
+  event_id: string;
+  project_id: string;
+  event_name: string;
+  event_time: string; // ISO 8601 (the event's created_at)
+  user_id: string | null;
+  session_id: string | null;
+  device_id: string | null;
+  properties: Record<string, unknown>;
+  // Geo data
+  country: string | null;
+  city: string | null;
+  region: string | null;
+  // Device data
+  os: string | null;
+  browser: string | null;
+  device: string | null;
+  // Page data
+  path: string | null;
+  origin: string | null;
+  referrer: string | null;
+  // Metadata
+  ingested_at: string; // ISO 8601 (ClickHouse inserted_at)
+  schema_version: number;
+}
+
+export const EXPORT_SCHEMA_VERSION = 1;
+
+const toIso = (chDate: string): string =>
+  convertClickhouseDateToJs(chDate).toISOString();
+
+/**
+ * Map a ClickHouse event row to the stable export schema.
+ */
+export function clickhouseEventToExportEvent(
+  event: IClickhouseEvent,
+): IExportEvent {
+  return {
+    event_id: event.id,
+    project_id: event.project_id,
+    event_name: event.name,
+    event_time: toIso(event.created_at),
+    // device_id doubles as the anonymous profile id; only surface a real,
+    // external user id.
+    user_id:
+      event.profile_id && event.profile_id !== event.device_id
+        ? event.profile_id
+        : null,
+    session_id: event.session_id || null,
+    device_id: event.device_id || null,
+    properties: event.properties ?? {},
+    country: event.country || null,
+    city: event.city || null,
+    region: event.region || null,
+    os: event.os || null,
+    browser: event.browser || null,
+    device: event.device || null,
+    path: event.path || null,
+    origin: event.origin || null,
+    referrer: event.referrer || null,
+    ingested_at: toIso(event.inserted_at || event.created_at),
+    schema_version: EXPORT_SCHEMA_VERSION,
+  };
+}
diff --git a/packages/db/src/exports/index.ts b/packages/db/src/exports/index.ts
new file mode 100644
index 000000000..0aed4a1a7
--- /dev/null
+++ b/packages/db/src/exports/index.ts
@@ -0,0 +1,25 @@
+export {
+  createBatch,
+  generateBatchPath,
+  getFileExtension,
+  getContentType,
+  type ExportFormat,
+  type IBatchInfo,
+  type IBatchFile,
+  type IBatchResult,
+} from './batch-creator';
+
+export {
+  createManifest,
+  serializeManifest,
+  parseManifest,
+  MANIFEST_FILENAME,
+  MANIFEST_CONTENT_TYPE,
+  type IManifest,
+} from './manifest';
+
+export {
+  clickhouseEventToExportEvent,
+  EXPORT_SCHEMA_VERSION,
+  type IExportEvent,
+} from './export-event';
diff --git a/packages/db/src/exports/manifest.ts b/packages/db/src/exports/manifest.ts
new file mode 100644
index 000000000..529614c5a
--- /dev/null
+++ b/packages/db/src/exports/manifest.ts
@@ -0,0 +1,70 @@
+import type { ExportFormat, IBatchInfo } from './batch-creator';
+
+/**
+ * Manifest file structure
+ * This file is uploaded LAST to signal that the batch is complete and ready for loading
+ */
+export interface IManifest {
+  batch_id: string;
+  project_id: string;
+  integration_id: string;
+  format: ExportFormat;
+  files: string[];
+  record_count: number;
+  min_event_time: string;
+  max_event_time: string;
+  schema_version: number;
+  created_at: string;
+  // Partition info for easy discovery
+  partition_date: string; // YYYY-MM-DD
+  partition_hour: string; // HH
+}
+
+const CURRENT_SCHEMA_VERSION = 1;
+
+/**
+ * Create a manifest for a batch
+ */
+export function createManifest(
+  batchInfo: IBatchInfo,
+  fileNames: string[],
+): IManifest {
+  return {
+    batch_id: batchInfo.batchId,
+    project_id: batchInfo.projectId,
+    integration_id: batchInfo.integrationId,
+    format: batchInfo.format,
+    files: fileNames,
+    record_count: batchInfo.recordCount,
+    min_event_time: batchInfo.minEventTime,
+    max_event_time: batchInfo.maxEventTime,
+    schema_version: CURRENT_SCHEMA_VERSION,
+    created_at: batchInfo.createdAt,
+    partition_date: batchInfo.partitionDate,
+    partition_hour: batchInfo.partitionHour,
+  };
+}
+
+/**
+ * Serialize manifest to JSON
+ */
+export function serializeManifest(manifest: IManifest): string {
+  return JSON.stringify(manifest, null, 2);
+}
+
+/**
+ * Parse a manifest from JSON
+ */
+export function parseManifest(json: string): IManifest {
+  return JSON.parse(json) as IManifest;
+}
+
+/**
+ * Manifest filename (always the same)
+ */
+export const MANIFEST_FILENAME = 'manifest.json';
+
+/**
+ * Manifest content type
+ */
+export const MANIFEST_CONTENT_TYPE = 'application/json';
diff --git a/packages/db/src/services/event.service.ts b/packages/db/src/services/event.service.ts
index 981c17f1d..c3167f294 100644
--- a/packages/db/src/services/event.service.ts
+++ b/packages/db/src/services/event.service.ts
@@ -90,6 +90,11 @@ export interface IClickhouseEvent {
   brand: string;
   model: string;
   imported_at: string | null;
+  // Ingestion (ClickHouse-insert) time. Set explicitly at insert time; the
+  // column DEFAULTs to created_at for rows that omit it. Used as the cursor for
+  // object-store exports. Optional here because most read queries don't select
+  // it.
+  inserted_at?: string;
   sdk_name: string;
   sdk_version: string;
   revenue?: number;
@@ -400,6 +405,10 @@ export async function createEvent(payload: IServiceCreateEventPayload) {
     referrer_name: payload.referrerName ?? '',
     referrer_type: payload.referrerType ?? '',
     imported_at: null,
+    // Ingestion time, used as the export cursor. Stamped here rather than via the
+    // column DEFAULT so backdated events (server-side, offline, past timestamps)
+    // still get a real, monotonic-ish insert time instead of their event time.
+    inserted_at: DateTime.utc().toFormat('yyyy-MM-dd HH:mm:ss.SSS'),
     sdk_name: payload.sdkName ?? '',
     sdk_version: payload.sdkVersion ?? '',
     revenue: payload.revenue,
diff --git a/packages/db/src/services/import.service.ts b/packages/db/src/services/import.service.ts
index 66a04222a..dc4b3b622 100644
--- a/packages/db/src/services/import.service.ts
+++ b/packages/db/src/services/import.service.ts
@@ -453,14 +453,14 @@ export async function moveImportsToProduction(
       session_id, path, origin, referrer, referrer_name, referrer_type,
       duration, properties, created_at, country, city, region,
       longitude, latitude, os, os_version, browser, browser_version,
-      device, brand, model, imported_at
+      device, brand, model, imported_at, inserted_at
     )
-    SELECT 
+    SELECT
       id, name, sdk_name, sdk_version, device_id, profile_id, project_id,
       session_id, path, origin, referrer, referrer_name, referrer_type,
       duration, properties, created_at, country, city, region,
       longitude, latitude, os, os_version, browser, browser_version,
-      device, brand, model, imported_at
+      device, brand, model, imported_at, now64(3) AS inserted_at
     FROM ${TABLE_NAMES.events_imports}
     WHERE ${whereClause}
     ORDER BY created_at ASC
diff --git a/packages/db/src/services/notification.service.ts b/packages/db/src/services/notification.service.ts
index 5b357151a..9ed70b592 100644
--- a/packages/db/src/services/notification.service.ts
+++ b/packages/db/src/services/notification.service.ts
@@ -49,6 +49,7 @@ export const BASE_INTEGRATIONS: Integration[] = [
       type: APP_NOTIFICATION_INTEGRATION_ID,
     },
     organizationId: '',
+    projectId: null,
   },
   // {
   //   id: EMAIL_NOTIFICATION_INTEGRATION_ID,
diff --git a/packages/integrations/package.json b/packages/integrations/package.json
index 59acc578f..cca334e6f 100644
--- a/packages/integrations/package.json
+++ b/packages/integrations/package.json
@@ -7,13 +7,19 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.974.0",
+    "@aws-sdk/client-sts": "^3.974.0",
+    "@google-cloud/storage": "^7.18.0",
+    "@openpanel/common": "workspace:*",
+    "@openpanel/js-runtime": "workspace:*",
+    "@openpanel/validation": "workspace:*",
     "@slack/bolt": "^3.18.0",
     "@slack/oauth": "^3.0.0"
   },
   "devDependencies": {
+    "@openpanel/logger": "workspace:*",
     "@openpanel/tsconfig": "workspace:*",
-    "@openpanel/validation": "workspace:*",
     "@types/node": "catalog:",
     "typescript": "catalog:"
   }
-}
+}
\ No newline at end of file
diff --git a/packages/integrations/src/object-store/gcs-adapter.ts b/packages/integrations/src/object-store/gcs-adapter.ts
new file mode 100644
index 000000000..ebfa035a0
--- /dev/null
+++ b/packages/integrations/src/object-store/gcs-adapter.ts
@@ -0,0 +1,165 @@
+import { Storage } from '@google-cloud/storage';
+import { decryptCredential } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+import type { IGCSExportConfig } from '@openpanel/validation';
+
+import type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
+
+const logger = createLogger({ name: 'gcs-adapter' });
+
+/**
+ * GCS Adapter for uploading export batches to Google Cloud Storage
+ * Uses service account credentials for authentication
+ */
+export class GCSAdapter implements IObjectStoreAdapter {
+  private config: IGCSExportConfig;
+  private storage: Storage | null = null;
+
+  constructor(config: IGCSExportConfig) {
+    // Decrypt the service account key if encrypted
+    this.config = {
+      ...config,
+      serviceAccountKey: decryptCredential(config.serviceAccountKey),
+    };
+  }
+
+  /**
+   * Get or create a GCS Storage client
+   */
+  private getStorage(): Storage {
+    if (this.storage) {
+      return this.storage;
+    }
+
+    try {
+      // Parse the service account key JSON
+      const credentials = JSON.parse(this.config.serviceAccountKey);
+
+      this.storage = new Storage({
+        credentials,
+        projectId: credentials.project_id,
+      });
+
+      logger.debug(
+        {
+          projectId: credentials.project_id,
+        },
+        'GCS client created',
+      );
+
+      return this.storage;
+    } catch (error) {
+      logger.error({ error }, 'Failed to create GCS client');
+      throw new Error('Invalid service account key JSON');
+    }
+  }
+
+  /**
+   * Upload a single file to GCS
+   */
+  async upload(options: IUploadOptions): Promise<IUploadResult> {
+    const storage = this.getStorage();
+    const bucket = storage.bucket(options.bucket);
+    const file = bucket.file(options.key);
+
+    try {
+      const content =
+        typeof options.content === 'string'
+          ? Buffer.from(options.content)
+          : options.content;
+
+      await file.save(content, {
+        contentType: options.contentType,
+        resumable: false, // For small files, non-resumable is faster
+        metadata: {
+          contentType: options.contentType,
+        },
+      });
+
+      // Get file metadata to retrieve the generation (similar to etag)
+      const [metadata] = await file.getMetadata();
+
+      logger.debug(
+        {
+          bucket: options.bucket,
+          key: options.key,
+          generation: metadata.generation,
+        },
+        'File uploaded to GCS',
+      );
+
+      return {
+        bucket: options.bucket,
+        key: options.key,
+        etag: metadata.etag || undefined,
+        location: `gs://${options.bucket}/${options.key}`,
+      };
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          bucket: options.bucket,
+          key: options.key,
+        },
+        'Failed to upload file to GCS',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Upload multiple files to GCS
+   */
+  async uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>> {
+    const results = await Promise.allSettled(
+      options.map((opt) => this.upload(opt)),
+    );
+
+    return results.map((result) => {
+      if (result.status === 'fulfilled') {
+        return result.value;
+      }
+      return result.reason instanceof Error
+        ? result.reason
+        : new Error(String(result.reason));
+    });
+  }
+
+  /**
+   * Test the connection to GCS bucket
+   */
+  async testConnection(): Promise<{ success: boolean; error?: string }> {
+    try {
+      const storage = this.getStorage();
+      const bucket = storage.bucket(this.config.bucket);
+
+      // Check if bucket exists and we have access
+      const [exists] = await bucket.exists();
+
+      if (!exists) {
+        return {
+          success: false,
+          error: `Bucket '${this.config.bucket}' does not exist or is not accessible`,
+        };
+      }
+
+      return { success: true };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      return { success: false, error: message };
+    }
+  }
+}
+
+/**
+ * Create a GCS adapter from integration config
+ */
+export function createGCSAdapter(config: IGCSExportConfig): GCSAdapter {
+  return new GCSAdapter(config);
+}
diff --git a/packages/integrations/src/object-store/index.ts b/packages/integrations/src/object-store/index.ts
new file mode 100644
index 000000000..dbfd87e7a
--- /dev/null
+++ b/packages/integrations/src/object-store/index.ts
@@ -0,0 +1,7 @@
+export { S3Adapter, createS3Adapter } from './s3-adapter';
+export { GCSAdapter, createGCSAdapter } from './gcs-adapter';
+export type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
diff --git a/packages/integrations/src/object-store/s3-adapter.ts b/packages/integrations/src/object-store/s3-adapter.ts
new file mode 100644
index 000000000..edb372253
--- /dev/null
+++ b/packages/integrations/src/object-store/s3-adapter.ts
@@ -0,0 +1,298 @@
+import {
+  HeadBucketCommand,
+  PutObjectCommand,
+  type PutObjectCommandInput,
+  S3Client,
+} from '@aws-sdk/client-s3';
+import { AssumeRoleCommand, STSClient } from '@aws-sdk/client-sts';
+import { assertSafeUrl, decryptCredential } from '@openpanel/common/server';
+import { createLogger } from '@openpanel/logger';
+import type { IS3ExportConfig } from '@openpanel/validation';
+
+import type {
+  IObjectStoreAdapter,
+  IUploadOptions,
+  IUploadResult,
+} from './types';
+
+const logger = createLogger({ name: 's3-adapter' });
+
+/**
+ * S3 Adapter for uploading export batches to AWS S3 or S3-compatible storage
+ * Supports two authentication modes:
+ * - IAM role assumption (AWS best practice)
+ * - Access keys (for R2, MinIO, DigitalOcean Spaces, etc.)
+ */
+export class S3Adapter implements IObjectStoreAdapter {
+  private config: IS3ExportConfig;
+  private clientPromise: Promise<S3Client> | null = null;
+  private clientExpiresAt = 0;
+
+  constructor(config: IS3ExportConfig) {
+    // Decrypt secretAccessKey if present and encrypted
+    if (config.authMode === 'access_key') {
+      this.config = {
+        ...config,
+        secretAccessKey: decryptCredential(config.secretAccessKey),
+      };
+    } else {
+      this.config = config;
+    }
+  }
+
+  /**
+   * Get or create an S3 client based on auth mode
+   */
+  private async getClient(): Promise<S3Client> {
+    // A custom endpoint is tenant-controlled; SSRF-guard the resolved host
+    // before connecting (no-op on self-hosted). Default AWS endpoints are safe.
+    if (this.config.endpoint) {
+      await assertSafeUrl(this.config.endpoint);
+    }
+    if (this.config.authMode === 'iam_role') {
+      return this.getClientWithAssumedRole();
+    }
+    return this.getClientWithAccessKeys();
+  }
+
+  /**
+   * Get or create an S3 client using static access keys
+   * For R2, MinIO, DigitalOcean Spaces, etc.
+   */
+  private getClientWithAccessKeys(): S3Client {
+    // Access key clients don't expire, reuse if available
+    if (this.clientPromise && this.clientExpiresAt === 0) {
+      return this.clientPromise as unknown as S3Client;
+    }
+
+    if (this.config.authMode !== 'access_key') {
+      throw new Error('Access key auth mode required but IAM role config provided');
+    }
+
+    const client = new S3Client({
+      region: this.config.region,
+      endpoint: this.config.endpoint,
+      credentials: {
+        accessKeyId: this.config.accessKeyId,
+        secretAccessKey: this.config.secretAccessKey,
+      },
+      // For R2, MinIO, etc.: force path-style addressing
+      forcePathStyle: !!this.config.endpoint,
+    });
+
+    logger.debug(
+      {
+        region: this.config.region,
+        endpoint: this.config.endpoint || 'default',
+      },
+      'S3 client created with access keys',
+    );
+
+    // Mark as non-expiring
+    this.clientExpiresAt = 0;
+    this.clientPromise = Promise.resolve(client);
+
+    return client;
+  }
+
+  /**
+   * Get or create an S3 client with assumed role credentials
+   */
+  private async getClientWithAssumedRole(): Promise<S3Client> {
+    const now = Date.now();
+
+    // Reuse client if credentials haven't expired (with 5 min buffer)
+    if (this.clientPromise && this.clientExpiresAt > now + 5 * 60 * 1000) {
+      return this.clientPromise;
+    }
+
+    this.clientPromise = this.createClientWithAssumedRole();
+    return this.clientPromise;
+  }
+
+  /**
+   * Create an S3 client by assuming the customer's IAM role
+   */
+  private async createClientWithAssumedRole(): Promise<S3Client> {
+    if (this.config.authMode !== 'iam_role') {
+      throw new Error('IAM role auth mode required but access key config provided');
+    }
+
+    const stsClient = new STSClient({ region: this.config.region });
+
+    const assumeRoleParams: {
+      RoleArn: string;
+      RoleSessionName: string;
+      DurationSeconds: number;
+      ExternalId?: string;
+    } = {
+      RoleArn: this.config.roleArn,
+      RoleSessionName: 'OpenPanelExport',
+      DurationSeconds: 3600, // 1 hour
+    };
+
+    if (this.config.externalId) {
+      assumeRoleParams.ExternalId = this.config.externalId;
+    }
+
+    try {
+      const assumeRoleCommand = new AssumeRoleCommand(assumeRoleParams);
+      const assumeRoleResponse = await stsClient.send(assumeRoleCommand);
+
+      const credentials = assumeRoleResponse.Credentials;
+      if (!credentials) {
+        throw new Error('Failed to assume role: no credentials returned');
+      }
+
+      // Track when credentials expire
+      this.clientExpiresAt =
+        credentials.Expiration?.getTime() || Date.now() + 3600 * 1000;
+
+      const s3Client = new S3Client({
+        region: this.config.region,
+        credentials: {
+          accessKeyId: credentials.AccessKeyId!,
+          secretAccessKey: credentials.SecretAccessKey!,
+          sessionToken: credentials.SessionToken,
+        },
+      });
+
+      logger.debug(
+        {
+          roleArn: this.config.roleArn,
+          expiresAt: new Date(this.clientExpiresAt).toISOString(),
+        },
+        'S3 client created with assumed role',
+      );
+
+      return s3Client;
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          roleArn: this.config.roleArn,
+        },
+        'Failed to assume role for S3 access',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Get encryption parameters based on config
+   */
+  private getEncryptionParams(): Partial<PutObjectCommandInput> {
+    const encryption = this.config.encryption || 'SSE-S3';
+
+    switch (encryption) {
+      case 'SSE-S3':
+        return {
+          ServerSideEncryption: 'AES256',
+        };
+      case 'SSE-KMS':
+        return {
+          ServerSideEncryption: 'aws:kms',
+          SSEKMSKeyId: this.config.kmsKeyId,
+        };
+      case 'none':
+        return {};
+      default:
+        return {
+          ServerSideEncryption: 'AES256',
+        };
+    }
+  }
+
+  /**
+   * Upload a single file to S3
+   */
+  async upload(options: IUploadOptions): Promise<IUploadResult> {
+    const client = await this.getClient();
+
+    const putParams: PutObjectCommandInput = {
+      Bucket: options.bucket,
+      Key: options.key,
+      Body: options.content,
+      ContentType: options.contentType,
+      ...this.getEncryptionParams(),
+    };
+
+    try {
+      const command = new PutObjectCommand(putParams);
+      const response = await client.send(command);
+
+      logger.debug(
+        {
+          bucket: options.bucket,
+          key: options.key,
+          etag: response.ETag,
+        },
+        'File uploaded to S3',
+      );
+
+      return {
+        bucket: options.bucket,
+        key: options.key,
+        etag: response.ETag,
+        location: `s3://${options.bucket}/${options.key}`,
+      };
+    } catch (error) {
+      logger.error(
+        {
+          error,
+          bucket: options.bucket,
+          key: options.key,
+        },
+        'Failed to upload file to S3',
+      );
+      throw error;
+    }
+  }
+
+  /**
+   * Upload multiple files to S3
+   */
+  async uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>> {
+    const results = await Promise.allSettled(
+      options.map((opt) => this.upload(opt)),
+    );
+
+    return results.map((result) => {
+      if (result.status === 'fulfilled') {
+        return result.value;
+      }
+      return result.reason instanceof Error
+        ? result.reason
+        : new Error(String(result.reason));
+    });
+  }
+
+  /**
+   * Test the connection to S3 bucket
+   */
+  async testConnection(): Promise<{ success: boolean; error?: string }> {
+    try {
+      const client = await this.getClient();
+
+      const command = new HeadBucketCommand({
+        Bucket: this.config.bucket,
+      });
+
+      await client.send(command);
+
+      return { success: true };
+    } catch (error) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      return { success: false, error: message };
+    }
+  }
+}
+
+/**
+ * Create an S3 adapter from integration config
+ */
+export function createS3Adapter(config: IS3ExportConfig): S3Adapter {
+  return new S3Adapter(config);
+}
diff --git a/packages/integrations/src/object-store/types.ts b/packages/integrations/src/object-store/types.ts
new file mode 100644
index 000000000..b28c86fc5
--- /dev/null
+++ b/packages/integrations/src/object-store/types.ts
@@ -0,0 +1,45 @@
+/**
+ * Common types for object store adapters
+ */
+
+/**
+ * Upload options for object store adapters
+ */
+export interface IUploadOptions {
+  bucket: string;
+  key: string;
+  content: Buffer | string;
+  contentType: string;
+}
+
+/**
+ * Result of an upload operation
+ */
+export interface IUploadResult {
+  bucket: string;
+  key: string;
+  etag?: string;
+  location?: string;
+}
+
+/**
+ * Object store adapter interface
+ */
+export interface IObjectStoreAdapter {
+  /**
+   * Upload a file to object storage
+   */
+  upload(options: IUploadOptions): Promise<IUploadResult>;
+
+  /**
+   * Upload multiple files to object storage
+   */
+  uploadMany(
+    options: Array<IUploadOptions>,
+  ): Promise<Array<IUploadResult | Error>>;
+
+  /**
+   * Check if the adapter is properly configured and can connect
+   */
+  testConnection(): Promise<{ success: boolean; error?: string }>;
+}
diff --git a/packages/integrations/src/registry.ts b/packages/integrations/src/registry.ts
new file mode 100644
index 000000000..90bc1370c
--- /dev/null
+++ b/packages/integrations/src/registry.ts
@@ -0,0 +1,198 @@
+import { assertSafeUrl, encryptCredential } from '@openpanel/common/server';
+import {
+  execute as executeJavaScriptTemplate,
+  validate as validateJavaScriptTemplate,
+} from '@openpanel/js-runtime';
+import type { IIntegrationConfig } from '@openpanel/validation';
+import {
+  sendDiscordNotification,
+  sendTestDiscordNotification,
+} from './discord';
+import {
+  createGCSAdapter,
+  createS3Adapter,
+  type IObjectStoreAdapter,
+} from './object-store';
+import { sendSlackNotification } from './slack';
+
+/** Narrow the integration config union to one `type`. */
+export type ConfigOf<T extends IIntegrationConfig['type']> = Extract<
+  IIntegrationConfig,
+  { type: T }
+>;
+
+/**
+ * Structural mirror of @openpanel/db `INotificationPayload`, kept local so the
+ * integrations package needn't depend on db. The worker passes the real,
+ * fully-typed payload — it's assignable to this looser shape.
+ */
+export type INotificationDeliverPayload =
+  | { type: 'event'; event: unknown }
+  | { type: 'funnel'; funnel: unknown };
+
+export interface INotificationDeliverArgs<
+  T extends IIntegrationConfig['type'],
+> {
+  config: ConfigOf<T>;
+  notification: { title: string; message: string };
+  payload: INotificationDeliverPayload;
+}
+
+/**
+ * Server-side behavior for one integration type. Capability slots are optional;
+ * which ones are present is declared by the core descriptor's `kinds`. A new
+ * integration adds one entry to SERVER_INTEGRATIONS — the `satisfies Record`
+ * below forces an entry for every union member (a missing one is a compile
+ * error, not a silent runtime gap).
+ *
+ * The notification capability is added in a later step (it needs the db payload
+ * type + js-runtime); export-only for now.
+ */
+export interface IServerIntegration<T extends IIntegrationConfig['type']> {
+  type: T;
+  // Notification sink (delivered when a notification rule matches).
+  notification?: {
+    deliver(args: INotificationDeliverArgs<T>): Promise<unknown> | unknown;
+  };
+  // Object-store export sink.
+  export?: {
+    createAdapter(config: ConfigOf<T>): IObjectStoreAdapter;
+  };
+  // Optional synchronous config validation run before persisting (e.g. webhook
+  // JS template). Returning invalid rejects the create/update.
+  validateConfig?(config: ConfigOf<T>): { valid: boolean; error?: string };
+  // Optional pre-save connection test (used by the generic tRPC procedure).
+  testConnection?(
+    config: ConfigOf<T>,
+  ): Promise<{ success: boolean; error?: string }>;
+  // Optional at-rest credential encryption applied before persisting config.
+  encryptCredentials?(config: ConfigOf<T>): ConfigOf<T>;
+}
+
+const slackServer: IServerIntegration<'slack'> = {
+  type: 'slack',
+  notification: {
+    deliver: ({ config, notification }) =>
+      sendSlackNotification({
+        webhookUrl: config.incoming_webhook.url,
+        message: [`🔔 *${notification.title}*`, notification.message].join('\n'),
+      }),
+  },
+};
+
+const discordServer: IServerIntegration<'discord'> = {
+  type: 'discord',
+  testConnection: async (config) => {
+    const res = await sendTestDiscordNotification(config.url);
+    return res.ok
+      ? { success: true }
+      : { success: false, error: 'Failed to send test notification' };
+  },
+  notification: {
+    deliver: ({ config, notification }) =>
+      sendDiscordNotification({
+        webhookUrl: config.url,
+        message: [`🔔 **${notification.title}**`, notification.message].join(
+          '\n'
+        ),
+      }),
+  },
+};
+
+const webhookServer: IServerIntegration<'webhook'> = {
+  type: 'webhook',
+  validateConfig: (config) => {
+    if (config.mode === 'javascript' && config.javascriptTemplate) {
+      const result = validateJavaScriptTemplate(config.javascriptTemplate);
+      if (!result.valid) {
+        return { valid: false, error: result.error };
+      }
+    }
+    return { valid: true };
+  },
+  notification: {
+    deliver: async ({ config, notification, payload }) => {
+      // SSRF guard before any outbound request.
+      await assertSafeUrl(config.url);
+
+      let body: unknown;
+      if (config.mode === 'javascript') {
+        // We only transform event payloads for now (not funnel)
+        if (config.javascriptTemplate && payload.type === 'event') {
+          body = executeJavaScriptTemplate(
+            config.javascriptTemplate,
+            payload.event as Record<string, unknown>
+          );
+        } else {
+          body = payload;
+        }
+      } else {
+        body = {
+          title: notification.title,
+          message: notification.message,
+        };
+      }
+
+      return fetch(config.url, {
+        method: 'POST',
+        headers: {
+          ...(config.headers ?? {}),
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify(body),
+      });
+    },
+  },
+};
+
+const s3Server: IServerIntegration<'s3_export'> = {
+  type: 's3_export',
+  export: {
+    createAdapter: (config) => createS3Adapter(config),
+  },
+  testConnection: (config) => createS3Adapter(config).testConnection(),
+  encryptCredentials: (config) =>
+    config.authMode === 'access_key'
+      ? {
+          ...config,
+          secretAccessKey: encryptCredential(config.secretAccessKey),
+        }
+      : config,
+};
+
+const gcsServer: IServerIntegration<'gcs_export'> = {
+  type: 'gcs_export',
+  export: {
+    createAdapter: (config) => createGCSAdapter(config),
+  },
+  testConnection: (config) => createGCSAdapter(config).testConnection(),
+  encryptCredentials: (config) => ({
+    ...config,
+    serviceAccountKey: encryptCredential(config.serviceAccountKey),
+  }),
+};
+
+export const SERVER_INTEGRATIONS = {
+  slack: slackServer,
+  discord: discordServer,
+  webhook: webhookServer,
+  // Pseudo-integrations dispatched by sendToApp/sendToEmail flags before the
+  // registry lookup; no server delivery handler of their own.
+  app: { type: 'app' },
+  email: { type: 'email' },
+  s3_export: s3Server,
+  gcs_export: gcsServer,
+} satisfies {
+  [T in IIntegrationConfig['type']]: IServerIntegration<T>;
+};
+
+/**
+ * Look up a server integration by type. Indexing the record by a union-typed
+ * key widens the handler params, so the one unavoidable cast in the whole
+ * dispatch path lives here; call sites get a correctly-typed IServerIntegration<T>.
+ */
+export function getServerIntegration<T extends IIntegrationConfig['type']>(
+  type: T,
+): IServerIntegration<T> {
+  return SERVER_INTEGRATIONS[type] as unknown as IServerIntegration<T>;
+}
diff --git a/packages/integrations/src/slack.ts b/packages/integrations/src/slack.ts
index 893751510..2f6de644c 100644
--- a/packages/integrations/src/slack.ts
+++ b/packages/integrations/src/slack.ts
@@ -25,7 +25,8 @@ export const slackInstaller = SLACK_CLIENT_ID
 export const getSlackInstallUrl = ({
   integrationId,
   organizationId,
-}: { integrationId: string; organizationId: string }) => {
+  projectId,
+}: { integrationId: string; organizationId: string; projectId: string }) => {
   if (!SLACK_CLIENT_ID) {
     throw new Error('SLACK_CLIENT_ID is not set (slack.ts)');
   }
@@ -37,7 +38,7 @@ export const getSlackInstallUrl = ({
       'team:read',
     ],
     redirectUri: SLACK_OAUTH_REDIRECT_URL,
-    metadata: JSON.stringify({ integrationId, organizationId }),
+    metadata: JSON.stringify({ integrationId, organizationId, projectId }),
   });
 };
 
diff --git a/packages/queue/src/queues.ts b/packages/queue/src/queues.ts
index 9683374ac..7592591f3 100644
--- a/packages/queue/src/queues.ts
+++ b/packages/queue/src/queues.ts
@@ -160,6 +160,10 @@ export type CronQueuePayloadWeeklyDigest = {
   type: 'weeklyDigest';
   payload: undefined;
 };
+export type CronQueuePayloadFlushExports = {
+  type: 'flushExports';
+  payload: undefined;
+};
 export type CronQueuePayload =
   | CronQueuePayloadSalt
   | CronQueuePayloadFlushEvents
@@ -168,6 +172,7 @@ export type CronQueuePayload =
   | CronQueuePayloadFlushProfileBackfill
   | CronQueuePayloadFlushReplay
   | CronQueuePayloadFlushGroups
+  | CronQueuePayloadFlushExports
   | CronQueuePayloadPing
   | CronQueuePayloadDelete
   | CronQueuePayloadInsightsDaily
diff --git a/packages/trpc/src/routers/integration.ts b/packages/trpc/src/routers/integration.ts
index 3efbd063b..9f30e21bc 100644
--- a/packages/trpc/src/routers/integration.ts
+++ b/packages/trpc/src/routers/integration.ts
@@ -2,17 +2,108 @@ import { z } from 'zod';
 
 import { BASE_INTEGRATIONS, db } from '@openpanel/db';
 
+import { getServerIntegration } from '@openpanel/integrations/src/registry';
 import { getSlackInstallUrl } from '@openpanel/integrations/src/slack';
 import {
+  type IIntegrationConfig,
   type ISlackConfig,
-  zCreateDiscordIntegration,
+  zCreateGCSExportIntegration,
+  zCreateS3ExportIntegration,
   zCreateSlackIntegration,
-  zCreateWebhookIntegration,
+  zIntegrationConfig,
 } from '@openpanel/validation';
-import { getOrganizationAccess } from '../access';
+import { getOrganizationAccess, getProjectAccess } from '../access';
 import { TRPCForbiddenError, TRPCBadRequestError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
-import { validate as validateJavaScriptTemplate } from '@openpanel/js-runtime';
+
+// Assert the user can access the project, and return the project's
+// organizationId (still stored on the integration for org-level queries/cascades).
+async function assertProjectAccessAndGetOrg(userId: string, projectId: string) {
+  const access = await getProjectAccess({ userId, projectId });
+  if (!access) {
+    throw new TRPCForbiddenError('You do not have access to this project');
+  }
+  const project = await db.project.findUniqueOrThrow({
+    where: { id: projectId },
+    select: { organizationId: true },
+  });
+  return project.organizationId;
+}
+
+// Shared create/update path for any form-configured integration. All per-type
+// behavior (validation, connection test, credential encryption) is delegated to
+// the integration's server plugin — adding a new integration needs no change here.
+async function upsertIntegration(
+  userId: string,
+  input: {
+    id?: string;
+    name: string;
+    projectId: string;
+    config: IIntegrationConfig;
+  },
+) {
+  // Authorize first. For an update, authorize against the EXISTING integration's
+  // scope — not the attacker-controlled input.projectId — so a user with access
+  // to one project can't update another project's integration in the same org.
+  let organizationId: string;
+  if (input.id) {
+    const existing = await db.integration.findUniqueOrThrow({
+      where: { id: input.id },
+      select: { projectId: true, organizationId: true },
+    });
+    await assertIntegrationAccess(userId, existing);
+    organizationId = existing.organizationId;
+  } else {
+    organizationId = await assertProjectAccessAndGetOrg(userId, input.projectId);
+  }
+
+  const plugin = getServerIntegration(input.config.type);
+
+  const validation = plugin.validateConfig?.(input.config);
+  if (validation && !validation.valid) {
+    throw new TRPCBadRequestError(`Invalid config: ${validation.error}`);
+  }
+
+  // Test the connection with the unencrypted credentials before saving.
+  const testResult = await plugin.testConnection?.(input.config);
+  if (testResult && !testResult.success) {
+    throw new TRPCBadRequestError(`Failed to connect: ${testResult.error}`);
+  }
+
+  const config = plugin.encryptCredentials?.(input.config) ?? input.config;
+
+  if (input.id) {
+    return db.integration.update({
+      where: { id: input.id, organizationId },
+      data: { name: input.name, config },
+    });
+  }
+  return db.integration.create({
+    data: {
+      name: input.name,
+      organizationId,
+      projectId: input.projectId,
+      config,
+    },
+  });
+}
+
+// Access check for an existing integration of either scope: project-scoped rows
+// check project access; legacy org-wide rows (projectId null) check org access.
+async function assertIntegrationAccess(
+  userId: string,
+  integration: { projectId: string | null; organizationId: string },
+) {
+  const access = integration.projectId
+    ? await getProjectAccess({ userId, projectId: integration.projectId })
+    : await getOrganizationAccess({
+        userId,
+        organizationId: integration.organizationId,
+      });
+  if (!access) {
+    throw new TRPCForbiddenError('You do not have access to this integration');
+  }
+}
 
 export const integrationRouter = createTRPCRouter({
   get: protectedProcedure
@@ -24,23 +115,27 @@ export const integrationRouter = createTRPCRouter({
         },
       });
 
-      const access = await getOrganizationAccess({
-        userId: ctx.session.userId,
-        organizationId: integration.organizationId,
-      });
-
-      if (!access) {
-        throw new TRPCForbiddenError('You do not have access to this project');
-      }
+      await assertIntegrationAccess(ctx.session.userId, integration);
 
       return integration;
     }),
   list: protectedProcedure
-    .input(z.object({ organizationId: z.string() }))
-    .query(async ({ input }) => {
+    .input(z.object({ projectId: z.string() }))
+    .query(async ({ input, ctx }) => {
+      const organizationId = await assertProjectAccessAndGetOrg(
+        ctx.session.userId,
+        input.projectId,
+      );
+
       const integrations = await db.integration.findMany({
         where: {
-          organizationId: input.organizationId,
+          // The project's own integrations, plus legacy org-wide integrations
+          // (projectId null) so they stay visible/selectable during the
+          // transition off org-scoping.
+          OR: [
+            { projectId: input.projectId },
+            { projectId: null, organizationId },
+          ],
           config: {
             not: {},
           },
@@ -51,85 +146,91 @@ export const integrationRouter = createTRPCRouter({
     }),
   createOrUpdateSlack: protectedProcedure
     .input(zCreateSlackIntegration)
-    .mutation(async ({ input }) => {
+    .mutation(async ({ input, ctx }) => {
+      // For an update, authorize against the existing integration's scope so a
+      // user can't clear/re-install another project's Slack integration.
+      let organizationId: string;
       if (input.id) {
-        const res = await db.integration.update({
-          where: {
-            id: input.id,
-            organizationId: input.organizationId,
-          },
-          data: {
-            name: input.name,
-            // This is empty and will be filled by the webhook
-            config: {} as ISlackConfig,
-          },
+        const existing = await db.integration.findUniqueOrThrow({
+          where: { id: input.id },
+          select: { projectId: true, organizationId: true },
         });
-
-        return {
-          ...res,
-          slackInstallUrl: await getSlackInstallUrl({
-            integrationId: res.id,
-            organizationId: input.organizationId,
-          }),
-        };
+        await assertIntegrationAccess(ctx.session.userId, existing);
+        organizationId = existing.organizationId;
+      } else {
+        organizationId = await assertProjectAccessAndGetOrg(
+          ctx.session.userId,
+          input.projectId,
+        );
       }
 
-      const res = await db.integration.create({
-        data: {
-          name: input.name,
-          organizationId: input.organizationId,
-          // This is empty and will be filled by the webhook
-          config: {} as ISlackConfig,
-        },
-      });
+      const res = input.id
+        ? await db.integration.update({
+            where: {
+              id: input.id,
+              organizationId,
+            },
+            data: {
+              name: input.name,
+              // This is empty and will be filled by the webhook
+              config: {} as ISlackConfig,
+            },
+          })
+        : await db.integration.create({
+            data: {
+              name: input.name,
+              organizationId,
+              projectId: input.projectId,
+              // This is empty and will be filled by the webhook
+              config: {} as ISlackConfig,
+            },
+          });
 
       return {
         ...res,
         slackInstallUrl: await getSlackInstallUrl({
           integrationId: res.id,
-          organizationId: input.organizationId,
+          organizationId,
+          projectId: input.projectId,
         }),
       };
     }),
+  // Generic create/update for any form-configured integration. Per-type
+  // behavior lives in the server plugin; no switch here.
   createOrUpdate: protectedProcedure
-    .input(z.union([zCreateDiscordIntegration, zCreateWebhookIntegration]))
-    .mutation(async ({ input }) => {
-      // Validate JavaScript template if mode is javascript
-      if (
-        input.config.type === 'webhook' &&
-        input.config.mode === 'javascript' &&
-        input.config.javascriptTemplate
-      ) {
-        const validation = validateJavaScriptTemplate(
-          input.config.javascriptTemplate,
-        );
-        if (!validation.valid) {
-          throw new TRPCBadRequestError(
-            `Invalid JavaScript template: ${validation.error}`,
-          );
-        }
-      }
-
-      if (input.id) {
-        return db.integration.update({
-          where: {
-            id: input.id,
-            organizationId: input.organizationId,
-          },
-          data: {
-            name: input.name,
-            config: input.config,
-          },
-        });
-      }
-      return db.integration.create({
-        data: {
-          name: input.name,
-          organizationId: input.organizationId,
-          config: input.config,
-        },
-      });
-    }),
+    .input(
+      z.object({
+        id: z.string().optional(),
+        name: z.string().min(1),
+        projectId: z.string().min(1),
+        config: zIntegrationConfig,
+      }),
+    )
+    .mutation(({ input, ctx }) => upsertIntegration(ctx.session.userId, input)),
+  // Back-compat alias for the export forms; delegates to the same generic path.
+  // TODO: remove once the dashboard calls `createOrUpdate` directly.
+  createOrUpdateExport: protectedProcedure
+    .input(z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]))
+    .mutation(({ input, ctx }) => upsertIntegration(ctx.session.userId, input)),
+  // Generic, registry-driven connection test.
+  testConnection: protectedProcedure
+    .input(z.object({ config: zIntegrationConfig }))
+    .mutation(
+      async ({ input }) =>
+        (await getServerIntegration(input.config.type).testConnection?.(
+          input.config,
+        )) ?? { success: true },
+    ),
+  // Back-compat alias for the export forms.
+  // TODO: remove once the dashboard calls `testConnection` directly.
+  testExportConnection: protectedProcedure
+    .input(z.union([zCreateS3ExportIntegration, zCreateGCSExportIntegration]))
+    .mutation(
+      async ({ input }) =>
+        (await getServerIntegration(input.config.type).testConnection?.(
+          input.config,
+        )) ?? { success: false, error: 'Unknown export type' },
+    ),
   delete: protectedProcedure
     .input(z.object({ id: z.string() }))
     .mutation(async ({ input: { id }, ctx }) => {
@@ -139,14 +240,7 @@ export const integrationRouter = createTRPCRouter({
         },
       });
 
-      const access = await getOrganizationAccess({
-        userId: ctx.session.userId,
-        organizationId: integration.organizationId,
-      });
-
-      if (!access) {
-        throw new TRPCForbiddenError('You do not have access to this project');
-      }
+      await assertIntegrationAccess(ctx.session.userId, integration);
 
       return db.integration.delete({
         where: {
diff --git a/packages/trpc/src/routers/notification.ts b/packages/trpc/src/routers/notification.ts
index ec74d2de5..1d78d6113 100644
--- a/packages/trpc/src/routers/notification.ts
+++ b/packages/trpc/src/routers/notification.ts
@@ -11,7 +11,7 @@ import {
 import { zCreateNotificationRule } from '@openpanel/validation';
 
 import { getProjectAccess } from '../access';
-import { TRPCForbiddenError } from '../errors';
+import { TRPCBadRequestError, TRPCForbiddenError } from '../errors';
 import { createTRPCRouter, protectedProcedure } from '../trpc';
 
 export const notificationRouter = createTRPCRouter({
@@ -80,6 +80,48 @@ export const notificationRouter = createTRPCRouter({
       // Clear the cache for the project
       await getNotificationRulesByProjectId.clear(input.projectId);
 
+      // Authorize the target project (covers both create and update; the create
+      // branch previously had no access check) and verify every connected
+      // integration belongs to this project or is a legacy org-wide one in the
+      // same org — never another project's.
+      const project = await db.project.findUniqueOrThrow({
+        where: { id: input.projectId },
+        select: { organizationId: true },
+      });
+      const access = await getProjectAccess({
+        userId: ctx.session.userId,
+        projectId: input.projectId,
+      });
+      if (!access) {
+        throw new TRPCForbiddenError('You do not have access to this project');
+      }
+
+      const integrationIds = input.integrations.filter(
+        (id) => !isBaseIntegration(id),
+      );
+      if (integrationIds.length > 0) {
+        const integrations = await db.integration.findMany({
+          where: { id: { in: integrationIds } },
+          select: { id: true, projectId: true, organizationId: true },
+        });
+        if (integrations.length !== integrationIds.length) {
+          throw new TRPCBadRequestError(
+            'One or more integrations were not found',
+          );
+        }
+        for (const integration of integrations) {
+          const sameProject = integration.projectId === input.projectId;
+          const orgWideSameOrg =
+            integration.projectId === null &&
+            integration.organizationId === project.organizationId;
+          if (!sameProject && !orgWideSameOrg) {
+            throw new TRPCForbiddenError(
+              'Integration does not belong to this project',
+            );
+          }
+        }
+      }
+
       if (input.id) {
         const existing = await db.notificationRule.findUniqueOrThrow({
           where: {
diff --git a/packages/validation/src/index.ts b/packages/validation/src/index.ts
index bd1c7a45e..a21e05840 100644
--- a/packages/validation/src/index.ts
+++ b/packages/validation/src/index.ts
@@ -393,84 +393,8 @@ export const zOnboardingProject = z
     }
   });
 
-export const zSlackAuthResponse = z.object({
-  ok: z.literal(true),
-  app_id: z.string(),
-  authed_user: z.object({
-    id: z.string(),
-  }),
-  scope: z.string(),
-  token_type: z.literal('bot'),
-  access_token: z.string(),
-  bot_user_id: z.string(),
-  team: z.object({
-    id: z.string(),
-    name: z.string(),
-  }),
-  incoming_webhook: z.object({
-    channel: z.string(),
-    channel_id: z.string(),
-    configuration_url: z.string().url(),
-    url: z.string().url(),
-  }),
-});
-
-export const zSlackConfig = z
-  .object({
-    type: z.literal('slack'),
-  })
-  .extend(zSlackAuthResponse.shape);
-
-export type ISlackConfig = z.infer<typeof zSlackConfig>;
-
-export const zWebhookConfig = z.object({
-  type: z.literal('webhook'),
-  url: z.string().url(),
-  headers: z.record(z.string(), z.string()),
-  payload: z.record(z.string(), z.unknown()).optional(),
-  mode: z.enum(['message', 'javascript']).default('message'),
-  javascriptTemplate: z.string().optional(),
-});
-export type IWebhookConfig = z.infer<typeof zWebhookConfig>;
-
-export const zDiscordConfig = z.object({
-  type: z.literal('discord'),
-  url: z.string().url(),
-});
-export type IDiscordConfig = z.infer<typeof zDiscordConfig>;
-
-export const zAppConfig = z.object({
-  type: z.literal('app'),
-});
-export type IAppConfig = z.infer<typeof zAppConfig>;
-
-export const zEmailConfig = z.object({
-  type: z.literal('email'),
-});
-export type IEmailConfig = z.infer<typeof zEmailConfig>;
-
-export type IIntegrationConfig =
-  | ISlackConfig
-  | IDiscordConfig
-  | IWebhookConfig
-  | IAppConfig
-  | IEmailConfig;
-
-const zCreateIntegration = z.object({
-  id: z.string().optional(),
-  name: z.string().min(1),
-  organizationId: z.string().min(1),
-});
-
-export const zCreateSlackIntegration = zCreateIntegration;
 
-export const zCreateWebhookIntegration = zCreateIntegration.extend({
-  config: zWebhookConfig,
-});
-
-export const zCreateDiscordIntegration = zCreateIntegration.extend({
-  config: zDiscordConfig,
-});
+export * from './integrations';
 
 export const zNotificationRuleEventConfig = z.object({
   type: z.literal('events'),
diff --git a/packages/validation/src/integrations.test.ts b/packages/validation/src/integrations.test.ts
new file mode 100644
index 000000000..7311ff43f
--- /dev/null
+++ b/packages/validation/src/integrations.test.ts
@@ -0,0 +1,24 @@
+import { describe, expect, it } from 'vitest';
+import { isKind } from './integrations';
+
+describe('isKind', () => {
+  it('matches a declared capability', () => {
+    expect(isKind({ type: 's3_export' }, 'export')).toBe(true);
+    expect(isKind({ type: 'gcs_export' }, 'export')).toBe(true);
+    expect(isKind({ type: 'slack' }, 'notification')).toBe(true);
+    expect(isKind({ type: 'webhook' }, 'notification')).toBe(true);
+  });
+
+  it('returns false for a capability the integration does not have', () => {
+    expect(isKind({ type: 's3_export' }, 'notification')).toBe(false);
+    expect(isKind({ type: 'slack' }, 'export')).toBe(false);
+  });
+
+  it('is lenient for empty/unknown config (does not throw)', () => {
+    // A Slack integration before its OAuth callback has config {} with no type;
+    // the export cron filters over every integration, so this must not throw.
+    expect(isKind({}, 'export')).toBe(false);
+    expect(isKind({ type: undefined }, 'export')).toBe(false);
+    expect(isKind({ type: 'something-unknown' }, 'export')).toBe(false);
+  });
+});
diff --git a/packages/validation/src/integrations.ts b/packages/validation/src/integrations.ts
new file mode 100644
index 000000000..1d6f63e9b
--- /dev/null
+++ b/packages/validation/src/integrations.ts
@@ -0,0 +1,343 @@
+import { z } from 'zod';
+
+// ---------------------------------------------------------------------------
+// Per-type config schemas
+// ---------------------------------------------------------------------------
+
+export const zSlackAuthResponse = z.object({
+  ok: z.literal(true),
+  app_id: z.string(),
+  authed_user: z.object({
+    id: z.string(),
+  }),
+  scope: z.string(),
+  token_type: z.literal('bot'),
+  access_token: z.string(),
+  bot_user_id: z.string(),
+  team: z.object({
+    id: z.string(),
+    name: z.string(),
+  }),
+  incoming_webhook: z.object({
+    channel: z.string(),
+    channel_id: z.string(),
+    configuration_url: z.string().url(),
+    url: z.string().url(),
+  }),
+});
+
+export const zSlackConfig = z
+  .object({
+    type: z.literal('slack'),
+  })
+  .extend(zSlackAuthResponse.shape);
+export type ISlackConfig = z.infer<typeof zSlackConfig>;
+
+export const zWebhookConfig = z.object({
+  type: z.literal('webhook'),
+  url: z.string().url(),
+  headers: z.record(z.string(), z.string()),
+  payload: z.record(z.string(), z.unknown()).optional(),
+  mode: z.enum(['message', 'javascript']).default('message'),
+  javascriptTemplate: z.string().optional(),
+});
+export type IWebhookConfig = z.infer<typeof zWebhookConfig>;
+
+export const zDiscordConfig = z.object({
+  type: z.literal('discord'),
+  url: z.string().url(),
+});
+export type IDiscordConfig = z.infer<typeof zDiscordConfig>;
+
+export const zAppConfig = z.object({
+  type: z.literal('app'),
+});
+export type IAppConfig = z.infer<typeof zAppConfig>;
+
+export const zEmailConfig = z.object({
+  type: z.literal('email'),
+});
+export type IEmailConfig = z.infer<typeof zEmailConfig>;
+
+// S3 Export Integration Config - Base fields shared by both auth modes
+const zS3ExportConfigBase = z.object({
+  type: z.literal('s3_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  region: z.string().min(1, 'Region is required'),
+  endpoint: z.string().url().optional(), // For R2, MinIO, etc.
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Optional encryption settings (S3-side encryption)
+  encryption: z.enum(['SSE-S3', 'SSE-KMS', 'none']).default('SSE-S3'),
+  kmsKeyId: z.string().optional(),
+});
+
+// Auth mode: IAM Role assumption (AWS best practice)
+const zS3AuthIamRole = z.object({
+  authMode: z.literal('iam_role'),
+  roleArn: z.string().min(1, 'IAM Role ARN is required'),
+  externalId: z.string().optional(),
+});
+
+// Auth mode: Access Keys (for R2, MinIO, DigitalOcean Spaces, etc.)
+const zS3AuthAccessKey = z.object({
+  authMode: z.literal('access_key'),
+  accessKeyId: z.string().min(1, 'Access Key ID is required'),
+  secretAccessKey: z.string().min(1, 'Secret Access Key is required'),
+});
+
+// S3 config with IAM role auth
+export const zS3ExportConfigIamRole = zS3ExportConfigBase.merge(zS3AuthIamRole);
+export type IS3ExportConfigIamRole = z.infer<typeof zS3ExportConfigIamRole>;
+
+// S3 config with access key auth
+export const zS3ExportConfigAccessKey =
+  zS3ExportConfigBase.merge(zS3AuthAccessKey);
+export type IS3ExportConfigAccessKey = z.infer<typeof zS3ExportConfigAccessKey>;
+
+// Combined discriminated union
+export const zS3ExportConfig = z.discriminatedUnion('authMode', [
+  zS3ExportConfigIamRole,
+  zS3ExportConfigAccessKey,
+]);
+export type IS3ExportConfig = z.infer<typeof zS3ExportConfig>;
+
+// GCS Export Integration Config
+export const zGCSExportConfig = z.object({
+  type: z.literal('gcs_export'),
+  bucket: z.string().min(1, 'Bucket name is required'),
+  prefix: z.string().default('openpanel-exports'),
+  format: z.enum(['jsonl_gzip', 'parquet']).default('jsonl_gzip'),
+  // Service account credentials (JSON key as string)
+  serviceAccountKey: z.string().min(1, 'Service account key is required'),
+});
+export type IGCSExportConfig = z.infer<typeof zGCSExportConfig>;
+
+// ---------------------------------------------------------------------------
+// The explicit discriminated union — the SOURCE OF TRUTH for narrowing.
+// Do NOT derive this from the registry: deriving via z.infer over a registry
+// array can silently widen a member to { type: string } and break every
+// config.type narrow downstream (incl. Prisma's IPrismaIntegrationConfig).
+// The registry below is forced to MATCH this union via `satisfies`, never the
+// other way round.
+// ---------------------------------------------------------------------------
+
+export type IIntegrationConfig =
+  | ISlackConfig
+  | IDiscordConfig
+  | IWebhookConfig
+  | IAppConfig
+  | IEmailConfig
+  | IS3ExportConfig
+  | IGCSExportConfig;
+
+export type IIntegrationType = IIntegrationConfig['type'];
+
+// ---------------------------------------------------------------------------
+// Plugin descriptor registry (core layer). Each integration declares its
+// capabilities, setup style, config schema and catalog metadata once. The
+// server (packages/integrations) and client (apps/start) registries are keyed
+// by the same `type` literal and are forced to cover this union.
+// ---------------------------------------------------------------------------
+
+export type IIntegrationKind = 'notification' | 'export';
+
+export interface IIntegrationDescriptor<
+  TType extends IIntegrationType = IIntegrationType,
+  TSchema extends z.ZodTypeAny = z.ZodTypeAny,
+> {
+  type: TType;
+  kinds: readonly IIntegrationKind[];
+  // 'form' renders a config form; 'oauth' renders an install button and fills
+  // the config via an OAuth callback.
+  setup: 'form' | 'oauth';
+  configSchema: TSchema;
+  catalog: {
+    name: string;
+    description: string;
+    // Pseudo-integrations (app/email) are dispatched by flags, not user-added.
+    hidden?: boolean;
+  };
+}
+
+export const slackDescriptor = {
+  type: 'slack',
+  kinds: ['notification'],
+  setup: 'oauth',
+  configSchema: zSlackConfig,
+  catalog: {
+    name: 'Slack',
+    description:
+      'Connect your Slack workspace to get notified when new issues are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'slack', typeof zSlackConfig>;
+
+export const discordDescriptor = {
+  type: 'discord',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zDiscordConfig,
+  catalog: {
+    name: 'Discord',
+    description:
+      'Connect your Discord server to get notified when new issues are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'discord', typeof zDiscordConfig>;
+
+export const webhookDescriptor = {
+  type: 'webhook',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zWebhookConfig,
+  catalog: {
+    name: 'Webhook',
+    description:
+      'Create a webhook to take actions in your own systems when new events are created.',
+  },
+} as const satisfies IIntegrationDescriptor<'webhook', typeof zWebhookConfig>;
+
+export const appDescriptor = {
+  type: 'app',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zAppConfig,
+  catalog: { name: 'Website', description: 'In-app notifications', hidden: true },
+} as const satisfies IIntegrationDescriptor<'app', typeof zAppConfig>;
+
+export const emailDescriptor = {
+  type: 'email',
+  kinds: ['notification'],
+  setup: 'form',
+  configSchema: zEmailConfig,
+  catalog: { name: 'Email', description: 'Email notifications', hidden: true },
+} as const satisfies IIntegrationDescriptor<'email', typeof zEmailConfig>;
+
+export const s3ExportDescriptor = {
+  type: 's3_export',
+  kinds: ['export'],
+  setup: 'form',
+  configSchema: zS3ExportConfig,
+  catalog: {
+    name: 'S3 Export',
+    description:
+      'Export events to Amazon S3 for loading into Redshift, Snowflake, Athena, or other data warehouses.',
+  },
+} as const satisfies IIntegrationDescriptor<'s3_export', typeof zS3ExportConfig>;
+
+export const gcsExportDescriptor = {
+  type: 'gcs_export',
+  kinds: ['export'],
+  setup: 'form',
+  configSchema: zGCSExportConfig,
+  catalog: {
+    name: 'GCS Export',
+    description:
+      'Export events to Google Cloud Storage for loading into BigQuery or other data warehouses.',
+  },
+} as const satisfies IIntegrationDescriptor<
+  'gcs_export',
+  typeof zGCSExportConfig
+>;
+
+export const INTEGRATION_DESCRIPTORS = [
+  slackDescriptor,
+  discordDescriptor,
+  webhookDescriptor,
+  appDescriptor,
+  emailDescriptor,
+  s3ExportDescriptor,
+  gcsExportDescriptor,
+] as const;
+
+const descriptorByType = new Map(
+  INTEGRATION_DESCRIPTORS.map((d) => [d.type, d] as const),
+);
+
+export function isKind(
+  config: Pick<IIntegrationConfig, 'type'> | { type?: string },
+  kind: IIntegrationKind,
+): boolean {
+  // Lenient lookup: used as a filter predicate over all integrations, including
+  // rows whose config is still empty (e.g. a Slack integration before its OAuth
+  // callback fills the config). Unknown/undefined types are simply not of `kind`.
+  const descriptor = descriptorByType.get(config.type as IIntegrationType);
+  return descriptor
+    ? (descriptor.kinds as readonly IIntegrationKind[]).includes(kind)
+    : false;
+}
+
+// Runtime parser for any integration config. A plain union (not
+// discriminatedUnion) because the s3 schema is itself a union on `authMode`.
+// Static narrowing always comes from the explicit IIntegrationConfig above.
+export const zIntegrationConfig = z.union([
+  zSlackConfig,
+  zWebhookConfig,
+  zDiscordConfig,
+  zAppConfig,
+  zEmailConfig,
+  zS3ExportConfig,
+  zGCSExportConfig,
+]);
+
+// ---------------------------------------------------------------------------
+// Create-integration input schemas
+// ---------------------------------------------------------------------------
+
+const zCreateIntegrationBase = z.object({
+  id: z.string().optional(),
+  name: z.string().min(1),
+  projectId: z.string().min(1),
+});
+
+export const zCreateSlackIntegration = zCreateIntegrationBase;
+
+export const zCreateWebhookIntegration = zCreateIntegrationBase.extend({
+  config: zWebhookConfig,
+});
+
+export const zCreateDiscordIntegration = zCreateIntegrationBase.extend({
+  config: zDiscordConfig,
+});
+
+export const zCreateS3ExportIntegration = zCreateIntegrationBase.merge(
+  z.object({
+    config: zS3ExportConfig,
+  }),
+);
+
+export const zCreateGCSExportIntegration = zCreateIntegrationBase.merge(
+  z.object({
+    config: zGCSExportConfig,
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// Compile-time guards (the type-safety gate). These are type aliases, so they
+// add no runtime and don't trip unused-locals, but they fail `tsc` if the
+// invariant breaks.
+// ---------------------------------------------------------------------------
+
+type Assert<T extends true> = T;
+type Equal<A, B> = [A] extends [B]
+  ? [B] extends [A]
+    ? true
+    : false
+  : false;
+
+// Every member of the union must keep a *literal* `type` discriminant. If any
+// widens to { type: string }, this drops it and the equality fails.
+type LiteralDiscriminant<U> = U extends { type: infer T }
+  ? string extends T
+    ? never
+    : U
+  : never;
+type _AssertLiteralDiscriminant = Assert<
+  Equal<IIntegrationConfig, LiteralDiscriminant<IIntegrationConfig>>
+>;
+
+// The descriptor registry must cover exactly the union's types — no missing,
+// no extra. Add a config variant but forget its descriptor → compile error.
+type _DescriptorTypes = (typeof INTEGRATION_DESCRIPTORS)[number]['type'];
+type _AssertDescriptorCoverage = Assert<
+  Equal<IIntegrationType, _DescriptorTypes>
+>;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index d0048263b..8c3e83c97 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -121,6 +121,12 @@ importers:
 
   apps/api:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
       '@better-agent/adapters':
         specifier: ^0.1.0-beta.3
         version: 0.1.0-beta.3(@better-agent/core@0.1.0-beta.3)
@@ -148,6 +154,9 @@ importers:
       '@fastify/websocket':
         specifier: ^11.2.0
         version: 11.2.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
       '@hyperdx/node-opentelemetry':
         specifier: 'catalog:'
         version: 0.10.3
@@ -986,12 +995,21 @@ importers:
 
   apps/worker:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
       '@bull-board/api':
         specifier: 6.14.0
         version: 6.14.0(@bull-board/ui@6.14.0)
       '@bull-board/express':
         specifier: 6.14.0
         version: 6.14.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
       '@hyperdx/node-opentelemetry':
         specifier: 'catalog:'
         version: 0.10.3
@@ -1031,6 +1049,9 @@ importers:
       '@openpanel/redis':
         specifier: workspace:*
         version: link:../../packages/redis
+      '@openpanel/validation':
+        specifier: workspace:*
+        version: link:../../packages/validation
       bullmq:
         specifier: ^5.63.0
         version: 5.63.0
@@ -1456,6 +1477,24 @@ importers:
 
   packages/integrations:
     dependencies:
+      '@aws-sdk/client-s3':
+        specifier: ^3.974.0
+        version: 3.984.0
+      '@aws-sdk/client-sts':
+        specifier: ^3.974.0
+        version: 3.1073.0
+      '@google-cloud/storage':
+        specifier: ^7.18.0
+        version: 7.21.0
+      '@openpanel/common':
+        specifier: workspace:*
+        version: link:../common
+      '@openpanel/js-runtime':
+        specifier: workspace:*
+        version: link:../js-runtime
+      '@openpanel/validation':
+        specifier: workspace:*
+        version: link:../validation
       '@slack/bolt':
         specifier: ^3.18.0
         version: 3.21.4
@@ -1463,12 +1502,12 @@ importers:
         specifier: ^3.0.0
         version: 3.0.1
     devDependencies:
+      '@openpanel/logger':
+        specifier: workspace:*
+        version: link:../logger
       '@openpanel/tsconfig':
         specifier: workspace:*
         version: link:../../tooling/typescript
-      '@openpanel/validation':
-        specifier: workspace:*
-        version: link:../validation
       '@types/node':
         specifier: 'catalog:'
         version: 24.10.1
@@ -2144,14 +2183,26 @@ packages:
     resolution: {integrity: sha512-xTEaPjZwOqVjGbLOP7qzwbdOWJOo1ne2mUhTZwEBBkPvNk4aXB/vcYwWwrjoSWUqtit4+GDbO75ePc/S6TUJYQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-sts@3.1073.0':
+    resolution: {integrity: sha512-ZJTSvyXOcufw8zpj0+IgzFhz81DcA8OpFpfdaNP7aDY8YFsWp5e5J5l1TLQbr+EfH+sSjgvkU2mP14ceqK6lCA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/core@3.973.10':
     resolution: {integrity: sha512-4u/FbyyT3JqzfsESI70iFg6e2yp87MB5kS2qcxIA66m52VSTN1fvuvbCY1h/LKq1LvuxIrlJ1ItcyjvcKoaPLg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/core@3.974.23':
+    resolution: {integrity: sha512-MiWR/uWjxjFXGzrE0Ghc5lWxUxzHsUWFhV+OX7M4cR9SrmrnZs6TXavnCWnzzdwJeFri34xQo81rvGNzK3c4BQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/crc64-nvme@3.972.0':
     resolution: {integrity: sha512-ThlLhTqX68jvoIVv+pryOdb5coP1cX1/MaTbB9xkGDCbWbsqQcLqzPxuSoW1DCnAAIacmXCWpzUNOB9pv+xXQw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-env@3.972.49':
+    resolution: {integrity: sha512-liB3yQNHCM9k/gu/w36XHMKPluT7HTlnGUhRbBGSISDQkcr/Sy1zsZabiuvQj8WG5yW573u9RehrBvvnIQ9OEQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-env@3.972.8':
     resolution: {integrity: sha512-r91OOPAcHnLCSxaeu/lzZAVRCZ/CtTNuwmJkUwpwSDshUrP7bkX1OmFn2nUMWd9kN53Q4cEo8b7226G4olt2Mg==}
     engines: {node: '>=20.0.0'}
@@ -2160,26 +2211,54 @@ packages:
     resolution: {integrity: sha512-DTtuyXSWB+KetzLcWaSahLJCtTUe/3SXtlGp4ik9PCe9xD6swHEkG8n8/BNsQ9dsihb9nhFvuUB4DpdBGDcvVg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-http@3.972.51':
+    resolution: {integrity: sha512-XET0H2oofciJ5lMRWNIvRjAP7Q3wv2XT+JtJJEdhPWUMwe3TvQ9qcxonpu7vXmNngncvFpi4E2It+Tamas/naA==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/credential-provider-ini@3.972.56':
+    resolution: {integrity: sha512-IAmc61hbgQiHht9U3x0tnRwz0lzdwOwD/i9voRgdJrKamF+JtmrBOsW9GwB7mfFonNWOWL4qARWYrF8veEMe3w==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-ini@3.972.8':
     resolution: {integrity: sha512-n2dMn21gvbBIEh00E8Nb+j01U/9rSqFIamWRdGm/mE5e+vHQ9g0cBNdrYFlM6AAiryKVHZmShWT9D1JAWJ3ISw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-login@3.972.55':
+    resolution: {integrity: sha512-hBBkANo3cDn+h2qxxzER4a+J8JCO9o9Z/YYmU7iky6AcaarX5RRdRcHNC6SLdwY0vAXQygn6soUbDqPn3GghaA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-login@3.972.8':
     resolution: {integrity: sha512-rMFuVids8ICge/X9DF5pRdGMIvkVhDV9IQFQ8aTYk6iF0rl9jOUa1C3kjepxiXUlpgJQT++sLZkT9n0TMLHhQw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-node@3.972.58':
+    resolution: {integrity: sha512-OyCLVmSI7pZO8hxwNVX6pXhTVlJqRBTp+ijdEfJSUj0RyjHnF602OfAarOzGq6wkGodeFkYBt8MmJ6A6ycRgWw==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-node@3.972.9':
     resolution: {integrity: sha512-LfJfO0ClRAq2WsSnA9JuUsNyIicD2eyputxSlSL0EiMrtxOxELLRG6ZVYDf/a1HCepaYPXeakH4y8D5OLCauag==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-process@3.972.49':
+    resolution: {integrity: sha512-C8h36lBuC/RnBSsjlO+dn6xZm3KbAl5vpJaVPAfQnMmz2/OISmKOc8XZcqMQgO2ADwBYNRMM6Kf3vz9G/TulMQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-process@3.972.8':
     resolution: {integrity: sha512-6cg26ffFltxM51OOS8NH7oE41EccaYiNlbd5VgUYwhiGCySLfHoGuGrLm2rMB4zhy+IO5nWIIG0HiodX8zdvHA==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-sso@3.972.55':
+    resolution: {integrity: sha512-1FkOz74Ea5QGS9jtIoXp55T/IkSS3spv+nLTT07fRY/+T5xmEOqaYBVIaEmX4zTNvbV6g2lrtlaVKWEoNyJt3w==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-sso@3.972.8':
     resolution: {integrity: sha512-35kqmFOVU1n26SNv+U37sM8b2TzG8LyqAcd6iM9gprqxyHEh/8IM3gzN4Jzufs3qM6IrH8e43ryZWYdvfVzzKQ==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/credential-provider-web-identity@3.972.55':
+    resolution: {integrity: sha512-g2BoECD1q01kTPByi56+VLVvdWDzMkKIcr77qixpqH0okw2t0U5CoPv+6S8v/D1Y2Wa6QKKtn6XAtDzP+Kfpvg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/credential-provider-web-identity@3.972.8':
     resolution: {integrity: sha512-CZhN1bOc1J3ubQPqbmr5b4KaMJBgdDvYsmEIZuX++wFlzmZsKj1bwkaiTEb5U2V7kXuzLlpF5HJSOM9eY/6nGA==}
     engines: {node: '>=20.0.0'}
@@ -2244,6 +2323,10 @@ packages:
     resolution: {integrity: sha512-3NA0s66vsy8g7hPh36ZsUgO4SiMyrhwcYvuuNK1PezO52vX3hXDW4pQrC6OQLGKGJV0o6tbEyQtXb/mPs8zg8w==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/nested-clients@3.997.23':
+    resolution: {integrity: sha512-gO93ZPsI2bxeFZD42f1/qjDw6FAZkNZcKRO94LIiT03fzOmcJ9e/tunxjVjA1Rl69ClmVJzz8H3G9CdKef10PA==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/region-config-resolver@3.972.3':
     resolution: {integrity: sha512-v4J8qYAWfOMcZ4MJUyatntOicTzEMaU7j3OpkRCGGFSL2NgXQ5VbxauIyORA+pxdKZ0qQG2tCQjQjZDlXEC3Ow==}
     engines: {node: '>=20.0.0'}
@@ -2252,6 +2335,14 @@ packages:
     resolution: {integrity: sha512-TaWbfYCwnuOSvDSrgs7QgoaoXse49E7LzUkVOUhoezwB7bkmhp+iojADm7UepCEu4021SquD7NG1xA+WCvmldA==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/signature-v4-multi-region@3.996.35':
+    resolution: {integrity: sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg==}
+    engines: {node: '>=20.0.0'}
+
+  '@aws-sdk/token-providers@3.1074.0':
+    resolution: {integrity: sha512-pv80IzgGW4RnXWtft692chZOM9i6PhebVsLCcnaM4dBEPZva2fE6FXAHs76G7Rc7s3yGyX/68G0nZMrUy+Vmpg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/token-providers@3.990.0':
     resolution: {integrity: sha512-L3BtUb2v9XmYgQdfGBzbBtKMXaP5fV973y3Qdxeevs6oUTVXFmi/mV1+LnScA/1wVPJC9/hlK+1o5vbt7cG7EQ==}
     engines: {node: '>=20.0.0'}
@@ -2260,6 +2351,10 @@ packages:
     resolution: {integrity: sha512-DwHBiMNOB468JiX6+i34c+THsKHErYUdNQ3HexeXZvVn4zouLjgaS4FejiGSi2HyBuzuyHg7SuOPmjSvoU9NRg==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/types@3.973.13':
+    resolution: {integrity: sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/util-arn-parser@3.972.2':
     resolution: {integrity: sha512-VkykWbqMjlSgBFDyrY3nOSqupMc6ivXuGmvci6Q3NnLq5kC+mKQe2QBZ4nrWRE/jqOxeFP2uYzLtwncYYcvQDg==}
     engines: {node: '>=20.0.0'}
@@ -2288,6 +2383,10 @@ packages:
       aws-crt:
         optional: true
 
+  '@aws-sdk/xml-builder@3.972.31':
+    resolution: {integrity: sha512-SzE4Pgyl+hDF+BuyuzxUSpwnuUu9lJuO1YGgteG89/4Qv0+2IQiVQqdbPV32IozLvXWQChPQcdkk/sKvb1QHiQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/xml-builder@3.972.4':
     resolution: {integrity: sha512-0zJ05ANfYqI6+rGqj8samZBFod0dPPousBjLEqg8WdxSgbMAkRgLyn81lP215Do0rFJ/17LIXwr7q0yK24mP6Q==}
     engines: {node: '>=20.0.0'}
@@ -4867,6 +4966,22 @@ packages:
   '@gar/promisify@1.1.3':
     resolution: {integrity: sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==}
 
+  '@google-cloud/paginator@5.0.2':
+    resolution: {integrity: sha512-DJS3s0OVH4zFDB1PzjxAsHqJT6sKVbRwwML0ZBP9PbU7Yebtu/7SWMRzvO2J3nUi9pRNITCfu4LJeooM2w4pjg==}
+    engines: {node: '>=14.0.0'}
+
+  '@google-cloud/projectify@4.0.0':
+    resolution: {integrity: sha512-MmaX6HeSvyPbWGwFq7mXdo0uQZLGBYCwziiLIGq5JVX+/bdI3SAq6bP98trV5eTWfLuvsMcIC1YJOF2vfteLFA==}
+    engines: {node: '>=14.0.0'}
+
+  '@google-cloud/promisify@4.0.0':
+    resolution: {integrity: sha512-Orxzlfb9c67A15cq2JQEyVc7wEsmFBmHjZWZYQMUyJ1qivXyMwdyNOs9odi79hze+2zqdTtu1E19IM/FtqZ10g==}
+    engines: {node: '>=14'}
+
+  '@google-cloud/storage@7.21.0':
+    resolution: {integrity: sha512-l+IFTkd+6Y5LoAuXyYCKNAKtw/Ci+rAMqgdTB1jv4iZiLhw0rtq+0qjIRbBizXkNzEFmXiXUW0H7sZQQvk1ffA==}
+    engines: {node: '>=14'}
+
   '@graphql-typed-document-node/core@3.2.0':
     resolution: {integrity: sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ==}
     peerDependencies:
@@ -8728,10 +8843,18 @@ packages:
     resolution: {integrity: sha512-Yq4UPVoQICM9zHnByLmG8632t2M0+yap4T7ANVw482J0W7HW0pOuxwVmeOwzJqX2Q89fkXz0Vybz55Wj2Xzrsg==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/core@3.26.0':
+    resolution: {integrity: sha512-mLUktFAn+Pa2agl1J7VgtYNFWCX8/b4GMJSK1hCu4YCvtBfM6F8Os3EP4ry+DFFlXOf3wyvlgXhuUdFoy52D3g==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/credential-provider-imds@4.2.8':
     resolution: {integrity: sha512-FNT0xHS1c/CPN8upqbMFP83+ul5YgdisfCfkZ86Jh2NSmnqw/AJ6x5pEogVCTVvSm7j9MopRU89bmDelxuDMYw==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/credential-provider-imds@4.4.2':
+    resolution: {integrity: sha512-18UMDMyrAbDcpmL1gLUA7ww0fRTcdCrSjSJOi2Sbld+tVjwD/pW+OAwjlScFLR7vvBnhZrIPQ7kVuTf1mnJLug==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/eventstream-codec@4.2.8':
     resolution: {integrity: sha512-jS/O5Q14UsufqoGhov7dHLOPCzkYJl9QDzusI2Psh4wyYx/izhzvX9P4D69aTxcdfVhEPhjK+wYyn/PzLjKbbw==}
     engines: {node: '>=18.0.0'}
@@ -8756,6 +8879,10 @@ packages:
     resolution: {integrity: sha512-I4UhmcTYXBrct03rwzQX1Y/iqQlzVQaPxWjCjula++5EmWq9YGBrx6bbGqluGc1f0XEfhSkiY4jhLgbsJUMKRA==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/fetch-http-handler@5.5.2':
+    resolution: {integrity: sha512-Ei/UK/QMhq0rKaMqGPlOAkE2yS9DZeYmZdk1RAKc3vp3zxgleZHZyBLlZv8yLsxljX4svCRuMTD6u3LLIcU4Bg==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/hash-blob-browser@4.2.9':
     resolution: {integrity: sha512-m80d/iicI7DlBDxyQP6Th7BW/ejDGiF0bgI754+tiwK0lgMkcaIBgvwwVc7OFbY4eUzpGtnig52MhPAEJ7iNYg==}
     engines: {node: '>=18.0.0'}
@@ -8812,6 +8939,10 @@ packages:
     resolution: {integrity: sha512-u4YeUwOWRZaHbWaebvrs3UhwQwj+2VNmcVCwXcYTvPIuVyM7Ex1ftAj+fdbG/P4AkBwLq/+SKn+ydOI4ZJE9PA==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/node-http-handler@4.8.2':
+    resolution: {integrity: sha512-wfl1uwrAqMH9/pi4kqBo5LBcFwrJLxuDLqL7p7qNcJIFcyZDUc6pzhYk4CYv+DP7fIUpQCZumwNnkhPKS52osQ==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/property-provider@4.2.8':
     resolution: {integrity: sha512-EtCTbyIveCKeOXDSWSdze3k612yCPq1YbXsbqX3UHhkOSW8zKsM9NOJG5gTIya0vbY2DIaieG8pKo1rITHYL0w==}
     engines: {node: '>=18.0.0'}
@@ -8840,6 +8971,10 @@ packages:
     resolution: {integrity: sha512-6A4vdGj7qKNRF16UIcO8HhHjKW27thsxYci+5r/uVRkdcBEkOEiY8OMPuydLX4QHSrJqGHPJzPRwwVTqbLZJhg==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/signature-v4@5.5.2':
+    resolution: {integrity: sha512-7xHpmPY4rt0IOmeAA8EfjgEH8isT+587TCdy9H6a7d4OMi5CQ0oEHhWllunvPu4j4Cq0vTFwdxXN/kABWPjdyA==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/smithy-client@4.11.3':
     resolution: {integrity: sha512-Q7kY5sDau8OoE6Y9zJoRGgje8P4/UY0WzH8R2ok0PDh+iJ+ZnEKowhjEqYafVcubkbYxQVaqwm3iufktzhprGg==}
     engines: {node: '>=18.0.0'}
@@ -8848,6 +8983,10 @@ packages:
     resolution: {integrity: sha512-9YcuJVTOBDjg9LWo23Qp0lTQ3D7fQsQtwle0jVfpbUHy9qBwCEgKuVH4FqFB3VYu0nwdHKiEMA+oXz7oV8X1kw==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/types@4.15.0':
+    resolution: {integrity: sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==}
+    engines: {node: '>=18.0.0'}
+
   '@smithy/url-parser@4.2.8':
     resolution: {integrity: sha512-NQho9U68TGMEU639YkXnVMV3GEFFULmmaWdlu1E9qzyIePOHsoSnagTGSDv1Zi8DCNN6btxOSdgmy5E/hsZwhA==}
     engines: {node: '>=18.0.0'}
@@ -9410,6 +9549,10 @@ packages:
       '@types/react-dom':
         optional: true
 
+  '@tootallnate/once@2.0.1':
+    resolution: {integrity: sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==}
+    engines: {node: '>= 10'}
+
   '@trpc-limiter/core@1.0.0':
     resolution: {integrity: sha512-Wjq2oTCmCdwNbZKRfKpzpl1Um9QXGE8OHXOab+EUSj5Wk+26I/V6Vs2p0VBFAz6eEsBn36982cCC/vaaznA8+Q==}
     engines: {node: '>=16'}
@@ -9506,6 +9649,9 @@ packages:
   '@types/bunyan@1.8.11':
     resolution: {integrity: sha512-758fRH7umIMk5qt5ELmRMff4mLDlN+xyYzC+dkPTdKwbSkJFvz6xwyScrytPU0QIBbRRwbiE8/BIg8bpajerNQ==}
 
+  '@types/caseless@0.12.5':
+    resolution: {integrity: sha512-hWtVTC2q7hc7xZ/RLbxapMvDMgUnDvKvMOpKal4DrMyfGBUfB1oKaZlIRr6mJL+If3bAP6sV/QneGzF6tJjZDg==}
+
   '@types/compression@1.7.5':
     resolution: {integrity: sha512-AAQvK5pxMpaT+nDvhHrsBhLSYG5yQdtkaJE1WYieSNY2mVFKAgmU4ks65rkZD5oqnGCFLyQpUr1CqI4DmUMyDg==}
 
@@ -9884,6 +10030,9 @@ packages:
   '@types/request-ip@0.0.41':
     resolution: {integrity: sha512-Qzz0PM2nSZej4lsLzzNfADIORZhhxO7PED0fXpg4FjXiHuJ/lMyUg+YFF5q8x9HPZH3Gl6N+NOM8QZjItNgGKg==}
 
+  '@types/request@2.48.13':
+    resolution: {integrity: sha512-FGJ6udDNUCjd19pp0Q3iTiDkwhYup7J8hpMW9c4k53NrccQFFWKRho6hvtPPEhnXWKvukfwAlB6DbDz4yhH5Gg==}
+
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
@@ -9929,6 +10078,9 @@ packages:
   '@types/through@0.0.33':
     resolution: {integrity: sha512-HsJ+z3QuETzP3cswwtzt2vEIiHBk/dCcHGhbmG5X3ecnwFD/lPrMpliGXxSCg03L9AhrdwA4Oz/qfspkDW+xGQ==}
 
+  '@types/tough-cookie@4.0.5':
+    resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==}
+
   '@types/triple-beam@1.3.5':
     resolution: {integrity: sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==}
 
@@ -10529,6 +10681,9 @@ packages:
   async-limiter@1.0.1:
     resolution: {integrity: sha512-csOlWGAcRFJaI6m+F2WKdnMKr4HhdhFVBk0H/QbJFMCr+uO2kwohwXQPxw/9OCxp05r5ghVBFSyioixx3gfkNQ==}
 
+  async-retry@1.3.3:
+    resolution: {integrity: sha512-wfr/jstw9xNi/0teMHrRW7dsz3Lt5ARhYNZ2ewpadnhaIp5mbALhOAP+EAdsC7t4Z6wqsDVv9+W6gm1Dk9mEyw==}
+
   async-sema@3.1.1:
     resolution: {integrity: sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg==}
 
@@ -12746,6 +12901,10 @@ packages:
     resolution: {integrity: sha512-m21N3WOmEEURgk6B9GLOE4RuWOFf28Lhh9qGYeNlGq4VDXUlJy2th2slBNU8Gp8EzloYZOibZJ7t5ecIrFSjVA==}
     engines: {node: '>= 0.12'}
 
+  form-data@2.5.6:
+    resolution: {integrity: sha512-Ogz/E85h9tlfJzpI6TuFpGcHZFhLrb9Gw8wq9v40CxSCPnv7ahKr6Xgtkn0KYCDQJ8DNn5VoMO8EXr9V5PadyA==}
+    engines: {node: '>= 0.12'}
+
   form-data@3.0.4:
     resolution: {integrity: sha512-f0cRzm6dkyVYV3nPoooP8XlccPQukegwhAnpoLcXy+X+A8KfpGOoXwDr9FLZd3wzgLaBGQBE3lY93Zm/i1JvIQ==}
     engines: {node: '>= 6'}
@@ -13213,6 +13372,10 @@ packages:
     peerDependencies:
       csstype: ^3.0.10
 
+  google-auth-library@9.15.1:
+    resolution: {integrity: sha512-Jb6Z0+nvECVz+2lzSMt9u98UsoakXxA2HGHMCxh+so3n90XgYWkq5dur19JAJV7ONiJY22yBTyJB1TSkvPq9Ng==}
+    engines: {node: '>=14'}
+
   gopd@1.2.0:
     resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
     engines: {node: '>= 0.4'}
@@ -13236,6 +13399,10 @@ packages:
     peerDependencies:
       ioredis: '>=5'
 
+  gtoken@7.1.0:
+    resolution: {integrity: sha512-pCcEwRi+TKpMlxAQObHDQ56KawURgyAf6jtIY046fJ5tIv3zDe/LEIubckAO8fj6JnAxLdmWkUfNyulQ2iKdEw==}
+    engines: {node: '>=14.0.0'}
+
   gzip-size@6.0.0:
     resolution: {integrity: sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==}
     engines: {node: '>=10'}
@@ -13309,6 +13476,10 @@ packages:
     resolution: {integrity: sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==}
     engines: {node: '>= 0.4'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   hast-util-from-dom@5.0.1:
     resolution: {integrity: sha512-N+LqofjR2zuzTjCPzyDUdSshy4Ma6li7p/c3pA78uTwzFgENbgbUrm2ugwsOdcjI1muO+o6Dgzp9p8WHtn/39Q==}
 
@@ -13408,6 +13579,9 @@ packages:
     resolution: {integrity: sha512-Y22oTqIU4uuPgEemfz7NDJz6OeKf12Lsu+QC+s3BVpda64lTiMYCyGwg5ki4vFxkMwQdeZDl2adZoqUgdFuTgQ==}
     engines: {node: '>=18'}
 
+  html-entities@2.6.0:
+    resolution: {integrity: sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==}
+
   html-escaper@3.0.3:
     resolution: {integrity: sha512-RuMffC89BOWQoY0WKGpIhn5gX3iI54O6nRA0yC124NYVtzjmFWBIiFd8M0x+ZdX0P9R4lADg1mgP8C7PxGOWuQ==}
 
@@ -13438,6 +13612,10 @@ packages:
     resolution: {integrity: sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==}
     engines: {node: '>= 0.8'}
 
+  http-proxy-agent@5.0.0:
+    resolution: {integrity: sha512-n2hY8YdoRE1i7r6M0w9DIw5GgZN0G25P8zLCRQ8rjXtTU3vsNFBI/vWK/UIeE6g5MUUz6avwAPXmL6Fy9D/90w==}
+    engines: {node: '>= 6'}
+
   http-proxy-agent@7.0.2:
     resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
     engines: {node: '>= 14'}
@@ -14211,9 +14389,15 @@ packages:
   jwa@1.4.1:
     resolution: {integrity: sha512-qiLX/xhEEFKUAJ6FiBMbes3w9ATzyk5W7Hvzpa/SLYdxNtng+gcurvrI7TbACjIXlsJyr05/S1oUhZrc63evQA==}
 
+  jwa@2.0.1:
+    resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
+
   jws@3.2.2:
     resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==}
 
+  jws@4.0.1:
+    resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
+
   kafkajs@2.2.4:
     resolution: {integrity: sha512-j/YeapB1vfPT2iOIUn/vxdyKEuhuY2PxMBvf5JWux6iSaukAccrMtXEY/Lb7OvavDhOWME589bpLrEdnVHjfjA==}
     engines: {node: '>=14.0.0'}
@@ -17149,6 +17333,10 @@ packages:
   retext@9.0.0:
     resolution: {integrity: sha512-sbMDcpHCNjvlheSgMfEcVrZko3cDzdbe1x/e7G66dFp0Ff7Mldvi2uv6JkJQzdRcvLYE8CA8Oe8siQx8ZOgTcA==}
 
+  retry-request@7.0.2:
+    resolution: {integrity: sha512-dUOvLMJ0/JJYEn8NrpOaGNE7X3vpI5XlZS/u0ANjqtcZVKnIxP7IgCFwrKTxENw29emmwug53awKtaMm4i9g5w==}
+    engines: {node: '>=14'}
+
   retry@0.13.1:
     resolution: {integrity: sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==}
     engines: {node: '>= 4'}
@@ -17767,6 +17955,9 @@ packages:
     resolution: {integrity: sha512-uyQK/mx5QjHun80FLJTfaWE7JtwfRMKBLkMne6udYOmvH0CawotVa7TfgYHzAnpphn4+TweIx1QKMnRIbipmUg==}
     engines: {node: '>= 0.10.0'}
 
+  stream-events@1.0.5:
+    resolution: {integrity: sha512-E1GUzBSgvct8Jsb3v2X15pjzN1tYebtbLaMg+eBOUOAxgbLoSbT2NS91ckc5lJD1KfLjId+jXJRgo0qnV5Nerg==}
+
   stream-shift@1.0.3:
     resolution: {integrity: sha512-76ORR0DO1o1hlKwTbi/DM3EXWGf3ZJYO8cXX5RJwnul2DEg2oyoZyjLNoQM8WsvZiFKCRfC1O0J7iCvie3RZmQ==}
 
@@ -17868,9 +18059,6 @@ packages:
   strnum@1.0.5:
     resolution: {integrity: sha512-J8bbNyKKXl5qYcR36TIO8W3mVGVHrmmxsd5PAItGkmyzwJvybiw2IVq5nqd0i4LSNSkB/sx9VHllbfFdr9k1JA==}
 
-  strnum@2.1.2:
-    resolution: {integrity: sha512-l63NF9y/cLROq/yqKXSLtcMeeyOfnSQlfMSlzFt/K73oIaD8DGaQWd7Z34X9GPiKqP5rbSh84Hl4bOlLcjiSrQ==}
-
   strnum@2.2.3:
     resolution: {integrity: sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==}
 
@@ -17880,6 +18068,9 @@ packages:
   structured-headers@0.4.1:
     resolution: {integrity: sha512-0MP/Cxx5SzeeZ10p/bZI0S6MpgD+yxAhi1BOQ34jgnMXsCq3j1t6tQnZu+KdlL7dvJTLT3g9xN8tl10TqgFMcg==}
 
+  stubs@3.0.0:
+    resolution: {integrity: sha512-PdHt7hHUJKxvTCgbKX9C1V/ftOcjJQgz8BZwNfV5c4B6dcGqlpelTbJ999jBGZ2jYiPAwcX5dP6oBwVlBlUbxw==}
+
   style-mod@4.1.3:
     resolution: {integrity: sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==}
 
@@ -18029,6 +18220,10 @@ packages:
   tdigest@0.1.2:
     resolution: {integrity: sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==}
 
+  teeny-request@9.0.0:
+    resolution: {integrity: sha512-resvxdc6Mgb7YEThw6G6bExlXKkv6+YbuzGg9xuXxSgxJF7Ozs+o8Y9+2R3sArdWdW8nOokoQb1yrpFB0pQK2g==}
+    engines: {node: '>=14'}
+
   temp-dir@1.0.0:
     resolution: {integrity: sha512-xZFXEGbG7SNC3itwBzI3RYjq/cEhBkx2hJuKGIUOcEULmkQExXiHat2z/qkISYsuR+IKumhEfKKbV5qXmhICFQ==}
     engines: {node: '>=4'}
@@ -19892,7 +20087,7 @@ snapshots:
   '@aws-crypto/crc32@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.973.1
+      '@aws-sdk/types': 3.973.13
       tslib: 2.8.1
 
   '@aws-crypto/crc32c@5.2.0':
@@ -20227,6 +20422,20 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/client-sts@3.1073.0':
+    dependencies:
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/credential-provider-node': 3.972.58
+      '@aws-sdk/signature-v4-multi-region': 3.996.35
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/core@3.973.10':
     dependencies:
       '@aws-sdk/types': 3.973.1
@@ -20243,11 +20452,30 @@ snapshots:
       '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
+  '@aws-sdk/core@3.974.23':
+    dependencies:
+      '@aws-sdk/types': 3.973.13
+      '@aws-sdk/xml-builder': 3.972.31
+      '@aws/lambda-invoke-store': 0.2.3
+      '@smithy/core': 3.26.0
+      '@smithy/signature-v4': 5.5.2
+      '@smithy/types': 4.15.0
+      bowser: 2.14.1
+      tslib: 2.8.1
+
   '@aws-sdk/crc64-nvme@3.972.0':
     dependencies:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-env@3.972.49':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-env@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20269,6 +20497,32 @@ snapshots:
       '@smithy/util-stream': 4.5.12
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-http@3.972.51':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
+  '@aws-sdk/credential-provider-ini@3.972.56':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/credential-provider-env': 3.972.49
+      '@aws-sdk/credential-provider-http': 3.972.51
+      '@aws-sdk/credential-provider-login': 3.972.55
+      '@aws-sdk/credential-provider-process': 3.972.49
+      '@aws-sdk/credential-provider-sso': 3.972.55
+      '@aws-sdk/credential-provider-web-identity': 3.972.55
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/credential-provider-imds': 4.4.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-ini@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20288,6 +20542,15 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-login@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-login@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20301,6 +20564,20 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-node@3.972.58':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.972.49
+      '@aws-sdk/credential-provider-http': 3.972.51
+      '@aws-sdk/credential-provider-ini': 3.972.56
+      '@aws-sdk/credential-provider-process': 3.972.49
+      '@aws-sdk/credential-provider-sso': 3.972.55
+      '@aws-sdk/credential-provider-web-identity': 3.972.55
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/credential-provider-imds': 4.4.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-node@3.972.9':
     dependencies:
       '@aws-sdk/credential-provider-env': 3.972.8
@@ -20318,6 +20595,14 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-process@3.972.49':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-process@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20327,6 +20612,16 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/credential-provider-sso@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/token-providers': 3.1074.0
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-sso@3.972.8':
     dependencies:
       '@aws-sdk/client-sso': 3.990.0
@@ -20340,6 +20635,15 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/credential-provider-web-identity@3.972.55':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/credential-provider-web-identity@3.972.8':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20521,6 +20825,19 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
+  '@aws-sdk/nested-clients@3.997.23':
+    dependencies:
+      '@aws-crypto/sha256-browser': 5.2.0
+      '@aws-crypto/sha256-js': 5.2.0
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/signature-v4-multi-region': 3.996.35
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/fetch-http-handler': 5.5.2
+      '@smithy/node-http-handler': 4.8.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/region-config-resolver@3.972.3':
     dependencies:
       '@aws-sdk/types': 3.973.1
@@ -20538,6 +20855,22 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/signature-v4-multi-region@3.996.35':
+    dependencies:
+      '@aws-sdk/types': 3.973.13
+      '@smithy/signature-v4': 5.5.2
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
+  '@aws-sdk/token-providers@3.1074.0':
+    dependencies:
+      '@aws-sdk/core': 3.974.23
+      '@aws-sdk/nested-clients': 3.997.23
+      '@aws-sdk/types': 3.973.13
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/token-providers@3.990.0':
     dependencies:
       '@aws-sdk/core': 3.973.10
@@ -20555,6 +20888,11 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/types@3.973.13':
+    dependencies:
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/util-arn-parser@3.972.2':
     dependencies:
       tslib: 2.8.1
@@ -20594,6 +20932,11 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@aws-sdk/xml-builder@3.972.31':
+    dependencies:
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@aws-sdk/xml-builder@3.972.4':
     dependencies:
       '@smithy/types': 4.12.0
@@ -24540,6 +24883,35 @@ snapshots:
 
   '@gar/promisify@1.1.3': {}
 
+  '@google-cloud/paginator@5.0.2':
+    dependencies:
+      arrify: 2.0.1
+      extend: 3.0.2
+
+  '@google-cloud/projectify@4.0.0': {}
+
+  '@google-cloud/promisify@4.0.0': {}
+
+  '@google-cloud/storage@7.21.0':
+    dependencies:
+      '@google-cloud/paginator': 5.0.2
+      '@google-cloud/projectify': 4.0.0
+      '@google-cloud/promisify': 4.0.0
+      abort-controller: 3.0.0
+      async-retry: 1.3.3
+      duplexify: 4.1.3
+      fast-xml-parser: 5.5.10
+      gaxios: 6.7.1
+      google-auth-library: 9.15.1
+      html-entities: 2.6.0
+      mime: 3.0.0
+      p-limit: 3.1.0
+      retry-request: 7.0.2
+      teeny-request: 9.0.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   '@graphql-typed-document-node/core@3.2.0(graphql@15.8.0)':
     dependencies:
       graphql: 15.8.0
@@ -29054,6 +29426,12 @@ snapshots:
       '@smithy/uuid': 1.1.0
       tslib: 2.8.1
 
+  '@smithy/core@3.26.0':
+    dependencies:
+      '@aws-crypto/crc32': 5.2.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/credential-provider-imds@4.2.8':
     dependencies:
       '@smithy/node-config-provider': 4.3.8
@@ -29062,6 +29440,12 @@ snapshots:
       '@smithy/url-parser': 4.2.8
       tslib: 2.8.1
 
+  '@smithy/credential-provider-imds@4.4.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/eventstream-codec@4.2.8':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
@@ -29100,6 +29484,12 @@ snapshots:
       '@smithy/util-base64': 4.3.0
       tslib: 2.8.1
 
+  '@smithy/fetch-http-handler@5.5.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/hash-blob-browser@4.2.9':
     dependencies:
       '@smithy/chunked-blob-reader': 5.2.0
@@ -29194,6 +29584,12 @@ snapshots:
       '@smithy/types': 4.12.0
       tslib: 2.8.1
 
+  '@smithy/node-http-handler@4.8.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/property-provider@4.2.8':
     dependencies:
       '@smithy/types': 4.12.0
@@ -29235,6 +29631,12 @@ snapshots:
       '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
+  '@smithy/signature-v4@5.5.2':
+    dependencies:
+      '@smithy/core': 3.26.0
+      '@smithy/types': 4.15.0
+      tslib: 2.8.1
+
   '@smithy/smithy-client@4.11.3':
     dependencies:
       '@smithy/core': 3.23.0
@@ -29249,6 +29651,10 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  '@smithy/types@4.15.0':
+    dependencies:
+      tslib: 2.8.1
+
   '@smithy/url-parser@4.2.8':
     dependencies:
       '@smithy/querystring-parser': 4.2.8
@@ -29970,6 +30376,8 @@ snapshots:
       '@types/react': 19.2.7
       '@types/react-dom': 19.2.3(@types/react@19.2.7)
 
+  '@tootallnate/once@2.0.1': {}
+
   '@trpc-limiter/core@1.0.0(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.3))(typescript@5.9.3))(@trpc/server@11.17.0(typescript@5.9.3))':
     dependencies:
       '@trpc/client': 11.17.0(@trpc/server@11.17.0(typescript@5.9.3))(typescript@5.9.3)
@@ -30073,6 +30481,8 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/caseless@0.12.5': {}
+
   '@types/compression@1.7.5':
     dependencies:
       '@types/express': 5.0.3
@@ -30517,6 +30927,13 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/request@2.48.13':
+    dependencies:
+      '@types/caseless': 0.12.5
+      '@types/node': 20.19.24
+      '@types/tough-cookie': 4.0.5
+      form-data: 2.5.6
+
   '@types/resolve@1.20.2': {}
 
   '@types/retry@0.12.0': {}
@@ -30567,6 +30984,8 @@ snapshots:
     dependencies:
       '@types/node': 20.19.24
 
+  '@types/tough-cookie@4.0.5': {}
+
   '@types/triple-beam@1.3.5': {}
 
   '@types/tsscmp@1.0.2': {}
@@ -31435,6 +31854,10 @@ snapshots:
 
   async-limiter@1.0.1: {}
 
+  async-retry@1.3.3:
+    dependencies:
+      retry: 0.13.1
+
   async-sema@3.1.1: {}
 
   async@3.2.5: {}
@@ -33383,7 +33806,7 @@ snapshots:
       has-property-descriptors: 1.0.2
       has-proto: 1.2.0
       has-symbols: 1.1.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       internal-slot: 1.1.0
       is-array-buffer: 3.0.5
       is-callable: 1.2.7
@@ -34135,7 +34558,7 @@ snapshots:
 
   fast-xml-parser@5.3.4:
     dependencies:
-      strnum: 2.1.2
+      strnum: 2.2.3
 
   fast-xml-parser@5.5.10:
     dependencies:
@@ -34401,12 +34824,21 @@ snapshots:
       combined-stream: 1.0.8
       mime-types: 2.1.35
 
+  form-data@2.5.6:
+    dependencies:
+      asynckit: 0.4.0
+      combined-stream: 1.0.8
+      es-set-tostringtag: 2.1.0
+      hasown: 2.0.4
+      mime-types: 2.1.35
+      safe-buffer: 5.2.1
+
   form-data@3.0.4:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8
       es-set-tostringtag: 2.1.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       mime-types: 2.1.35
 
   form-data@4.0.0:
@@ -34697,7 +35129,7 @@ snapshots:
       call-bound: 1.0.4
       define-properties: 1.2.1
       functions-have-names: 1.2.3
-      hasown: 2.0.2
+      hasown: 2.0.4
       is-callable: 1.2.7
 
   functions-have-names@1.2.3: {}
@@ -34935,6 +35367,18 @@ snapshots:
     dependencies:
       csstype: 3.2.3
 
+  google-auth-library@9.15.1:
+    dependencies:
+      base64-js: 1.5.1
+      ecdsa-sig-formatter: 1.0.11
+      gaxios: 6.7.1
+      gcp-metadata: 6.1.0
+      gtoken: 7.1.0
+      jws: 4.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   gopd@1.2.0: {}
 
   graceful-fs@4.2.11: {}
@@ -34951,6 +35395,14 @@ snapshots:
       cron-parser: 4.9.0
       ioredis: 5.8.2
 
+  gtoken@7.1.0:
+    dependencies:
+      gaxios: 6.7.1
+      jws: 4.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   gzip-size@6.0.0:
     dependencies:
       duplexer: 0.1.2
@@ -35026,6 +35478,10 @@ snapshots:
     dependencies:
       function-bind: 1.1.2
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   hast-util-from-dom@5.0.1:
     dependencies:
       '@types/hast': 3.0.4
@@ -35225,6 +35681,8 @@ snapshots:
     dependencies:
       whatwg-encoding: 3.1.1
 
+  html-entities@2.6.0: {}
+
   html-escaper@3.0.3: {}
 
   html-to-text@9.0.5:
@@ -35271,6 +35729,14 @@ snapshots:
       statuses: 2.0.2
       toidentifier: 1.0.1
 
+  http-proxy-agent@5.0.0:
+    dependencies:
+      '@tootallnate/once': 2.0.1
+      agent-base: 6.0.2
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   http-proxy-agent@7.0.2:
     dependencies:
       agent-base: 7.1.4
@@ -35428,7 +35894,7 @@ snapshots:
   internal-slot@1.1.0:
     dependencies:
       es-errors: 1.3.0
-      hasown: 2.0.2
+      hasown: 2.0.4
       side-channel: 1.1.0
 
   internmap@1.0.1: {}
@@ -35679,7 +36145,7 @@ snapshots:
       call-bound: 1.0.4
       gopd: 1.2.0
       has-tostringtag: 1.0.2
-      hasown: 2.0.2
+      hasown: 2.0.4
 
   is-relative@1.0.0:
     dependencies:
@@ -36112,11 +36578,22 @@ snapshots:
       ecdsa-sig-formatter: 1.0.11
       safe-buffer: 5.2.1
 
+  jwa@2.0.1:
+    dependencies:
+      buffer-equal-constant-time: 1.0.1
+      ecdsa-sig-formatter: 1.0.11
+      safe-buffer: 5.2.1
+
   jws@3.2.2:
     dependencies:
       jwa: 1.4.1
       safe-buffer: 5.2.1
 
+  jws@4.0.1:
+    dependencies:
+      jwa: 2.0.1
+      safe-buffer: 5.2.1
+
   kafkajs@2.2.4: {}
 
   katex@0.16.21:
@@ -40014,6 +40491,15 @@ snapshots:
       retext-stringify: 4.0.0
       unified: 11.0.5
 
+  retry-request@7.0.2:
+    dependencies:
+      '@types/request': 2.48.13
+      extend: 3.0.2
+      teeny-request: 9.0.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   retry@0.13.1: {}
 
   reusify@1.0.4: {}
@@ -40771,6 +41257,10 @@ snapshots:
 
   stream-buffers@2.2.0: {}
 
+  stream-events@1.0.5:
+    dependencies:
+      stubs: 3.0.0
+
   stream-shift@1.0.3: {}
 
   streamsearch@1.1.0: {}
@@ -40901,14 +41391,14 @@ snapshots:
 
   strnum@1.0.5: {}
 
-  strnum@2.1.2: {}
-
   strnum@2.2.3: {}
 
   structured-clone-es@1.0.0: {}
 
   structured-headers@0.4.1: {}
 
+  stubs@3.0.0: {}
+
   style-mod@4.1.3: {}
 
   style-to-js@1.1.21:
@@ -41117,6 +41607,17 @@ snapshots:
     dependencies:
       bintrees: 1.0.2
 
+  teeny-request@9.0.0:
+    dependencies:
+      http-proxy-agent: 5.0.0
+      https-proxy-agent: 5.0.1
+      node-fetch: 2.7.0
+      stream-events: 1.0.5
+      uuid: 9.0.1
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   temp-dir@1.0.0: {}
 
   temp-dir@2.0.0: {}