@keystrokehq/platform 0.1.1 → 0.1.3

package/dist/start-DAlaZ5zj.mjs

@@ -0,0 +1,2727 @@
+import { $ as ListOrganizationInvitationsResponseSchema, $t as mapOrganizationInvitation, A as CreateApiKeyResponseSchema, At as StoredProjectSourceManifestSchema, B as ErrorResponseSchema, Bt as UpdateProjectSettingsRequestSchema, C as AcceptOrganizationInvitationResponseSchema, Ct as RecentResourceListResponseSchema, D as AgentSummarySchema, Dt as SkillSummarySchema, E as AgentSummaryListResponseSchema, Et as SkillSummaryListResponseSchema, F as CreateProjectArtifactResponseSchema, Ft as UpdateOrganizationMemberResponseSchema, G as HistoryRunListResponseSchema, Gt as UserPreferencesPatchSchema, H as HistoryRunCancelResponseSchema, Ht as UploadProjectSourceResponseSchema, I as CreateProjectRequestSchema, It as UpdateOrganizationRequestSchema, J as InviteProjectMembersRequestSchema, Jt as WorkflowSummaryListResponseSchema, K as InviteOrganizationMembersRequestSchema, Kt as UserPreferencesSchema, L as CreateProjectResponseSchema, Ln as pingProjectTarget, Lt as UpdateProjectMemberRequestSchema, M as CreateCredentialsResponseSchema, Mt as SubmitTeamRequestResponseSchema, N as CreateOrganizationRequestSchema, Nt as UpdateCredentialRequestSchema, O as CompleteProjectArtifactResponseSchema, Ot as SlugAvailabilityQuerySchema, P as CreateOrganizationResponseSchema, Pt as UpdateOrganizationMemberRequestSchema, Q as ListCredentialsResponseSchema, Qt as listenPortFromPublicUrl, R as DeclineOrganizationInvitationResponseSchema, Rt as UpdateProjectMemberResponseSchema, S as ACTIVE_ORG_HEADER, St as ProjectSourceResourcesSchema, T as AgentSummaryDetailResponseSchema, Tt as SkillSummaryDetailResponseSchema, U as HistoryRunDetailResponseSchema, Ut as UserAvatarPatchSchema, V as GetCredentialResponseSchema, Vt as UploadProjectSourceManifestRequestSchema, W as HistoryRunListQuerySchema, Wt as UserAvatarSchema, X as ListApiKeysResponseSchema, Xt as buildCredentialInstanceLabel, Y as InviteProjectMembersResponseSchema, Yt as WorkflowSummarySchema, Z as ListAppsResponseSchema, Zt as displayCredentialAppName, _ as createJobQueue, _t as ProjectReachabilityResponseSchema, a as isKeystrokeAssetsAvatarPublicUrl, an as mapProjectSettings, at as ListProjectMetricsResponseSchema, b as readCredentialInstanceSecret, bt as ProjectSlugAvailabilityQuerySchema, c as isUserAvatarStorageKey, cn as normalizeUserPreferences, ct as OrganizationSidebarBrandingSchema, dn as parseStoredRouteManifest, dt as PresignOrgLogoRequestSchema, en as mapOrganizationMember, et as ListOrganizationMembersResponseSchema, f as orgLogoStorageKey, fn as projectFileId, ft as PresignOrgLogoResponseSchema, g as userAvatarStorageKey, gt as PresignUserAvatarResponseSchema, h as publicKeystrokeAssetsObjectUrl, ht as PresignUserAvatarRequestSchema, i as extractRouteManifestFromArtifact, in as mapProjectMember, it as ListProjectMembersResponseSchema, j as CreateCredentialsRequestSchema, jt as SubmitTeamRequestRequestSchema, k as CreateApiKeyRequestSchema, kt as SlugAvailabilityResponseSchema, l as keystrokeAssetsAvatarKeyFromPublicUrl, ln as organizationInvitationAcceptPath, lt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, m as projectSourceBlobKey, mn as validationErrorResponse, mt as PresignProjectSourceResponseSchema, n as createAssetsStorageClient, nn as mapProjectArtifact, nt as ListProjectDeploymentsResponseSchema, o as isKeystrokeAssetsOrgLogoPublicUrl, on as mapUserOrganization, ot as ListProjectsResponseSchema, p as projectArtifactKey, pn as resolveUniqueCredentialInstanceLabel, pt as PresignProjectSourceRequestSchema, q as InviteOrganizationMembersResponseSchema, qt as WorkflowSummaryDetailResponseSchema, r as ensureKeystrokeAssetsBucket, rn as mapProjectDeployment, rt as ListProjectFilesResponseSchema, s as isOrgLogoStorageKey, sn as mergeUserPreferences, st as OrganizationSidebarBrandingPatchSchema, t as RouteManifestNotFoundError, tn as mapProject, tt as ListOrganizationsResponseSchema, u as keystrokeAssetsOrgLogoKeyFromPublicUrl, un as organizationSlugErrorCodeFromMessage, ut as PROJECT_SLUG_TAKEN_MESSAGE, v as defaultSchedulerPlugin, vt as ProjectResponseSchema, w as ActiveOrganizationResponseSchema, wt as RecentResourceSchema, x as setCredentialInstanceSecret, xt as ProjectSlugAvailabilityResponseSchema, y as deleteCredentialInstanceSecret, yt as ProjectSettingsResponseSchema, z as DownloadActiveProjectArtifactResponseSchema, zt as UpdateProjectRequestSchema } from "./dist-70NUfApd.mjs";
+import { buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, deleteCredentialInstanceById, findHistoryRunCore, getServerTenantScopeId, inferDialect, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectWorkflowLastRunAtByIds, selectWorkflowRunById, touchResourceActivity, upsertCredentialInstance } from "@keystrokehq/database";
+import { ZodError, z } from "zod";
+import "node:path";
+import "node:fs";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { CannotModifyOwnerError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listOfficialApps, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgDatabaseUrl, resolveProjectRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectLastDeploymentAtByProject, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectFailed, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
+import { serve } from "@hono/node-server";
+import { AUTH_API_PATH, createAuth, createDefaultAuthJwtVerifier, extractWebhookApiKeyFromRequest, handleAuthRequest, resolveAuthEmailFrom, resolveRequestAuth } from "@keystrokehq/auth";
+import { buildWebhookUrl, createCredentialMaterializeHandler, extractWebhookRoutesFromManifest, seedOAuthAppsFromEnvForAllOrganizations, seedOAuthAppsFromEnvForOrganization, syncRegistryFromStoredManifest } from "@keystrokehq/runtime";
+import { createApp, externalPlatformOrigin, getProjectScheduler, platformWebhookOrigin, resolveMcpEntityId } from "@keystrokehq/http";
+import { Hono } from "hono";
+import { Resend } from "resend";
+//#region ../../packages/manifest/dist/index.mjs
+function normalizeWebhookEndpoint(endpoint) {
+	return endpoint.replace(/^\/+|\/+$/g, "").replace(/^triggers\/?/, "");
+}
+function webhookRouteFromEndpoint(endpoint) {
+	const normalized = normalizeWebhookEndpoint(endpoint);
+	if (!normalized) throw new Error("Webhook endpoint must not be empty");
+	return `/triggers/${normalized}`;
+}
+const WORKFLOW = Symbol.for("keystroke.workflow");
+function isManifestWorkflow(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (!(WORKFLOW in value) || value[WORKFLOW] !== true) return false;
+	const workflow = value;
+	return typeof workflow.slug === "string" && workflow.slug.trim().length > 0 && workflow.input instanceof Object && "safeParse" in workflow.input && workflow.output instanceof Object && "safeParse" in workflow.output;
+}
+const zodSchema = z.custom((value) => value instanceof z.ZodType, "must be a Zod schema");
+const cronScheduleSchema = z.string().trim().min(1, "cron schedule must be a non-empty string");
+const workflowSchema = z.custom((value) => isManifestWorkflow(value), "must be defineWorkflow(...)");
+const agentSchema = z.custom((value) => typeof value === "object" && value !== null && typeof value.slug === "string" && value.slug.trim().length > 0 && typeof value.prompt === "function", "must be defineAgent(...)");
+const promptSchema = z.union([z.string(), z.function()]);
+const baseSourceShape = {
+	key: z.string().trim().min(1),
+	attach: z.function()
+};
+const webhookSourceSchema = z.object({
+	kind: z.literal("webhook"),
+	...baseSourceShape,
+	endpoint: z.string().min(1),
+	request: zodSchema,
+	filter: zodSchema.optional(),
+	passes: z.function()
+});
+const cronSourceSchema = z.object({
+	kind: z.literal("cron"),
+	...baseSourceShape,
+	schedule: cronScheduleSchema
+});
+const pollSourceSchema = z.object({
+	kind: z.literal("poll"),
+	...baseSourceShape,
+	id: z.string().optional(),
+	schedule: cronScheduleSchema,
+	run: z.function(),
+	filters: z.array(z.function()),
+	passes: z.function()
+});
+const triggerSourceSchema = z.discriminatedUnion("kind", [
+	webhookSourceSchema,
+	cronSourceSchema,
+	pollSourceSchema
+]);
+const workflowAttachmentSchema = z.object({
+	key: z.string().trim().min(1),
+	source: triggerSourceSchema,
+	target: z.literal("workflow"),
+	workflow: workflowSchema,
+	transform: z.function().optional()
+});
+const agentAttachmentSchema = z.object({
+	key: z.string().trim().min(1),
+	source: triggerSourceSchema,
+	target: z.literal("agent"),
+	agent: agentSchema,
+	prompt: promptSchema
+});
+z.discriminatedUnion("target", [workflowAttachmentSchema, agentAttachmentSchema]);
+//#endregion
+//#region ../../packages/projects/dist/index.mjs
+async function resolveDeployManifest(input) {
+	if (input.artifactManifest != null) return parseStoredRouteManifest(input.artifactManifest);
+	return parseStoredRouteManifest(extractRouteManifestFromArtifact(input.artifactBytes));
+}
+/** Cut over activeArtifactId, then sync org project registry from the artifact manifest. */
+async function promoteProjectDeploy(input) {
+	const project = await selectProjectById(input.projectId);
+	if (!project) throw new Error(`Project ${input.projectId} not found`);
+	const artifact = await selectProjectArtifactById(input.artifactId);
+	if (!artifact || artifact.projectId !== input.projectId) throw new Error(`Artifact ${input.artifactId} not found for project ${input.projectId}`);
+	const organization = await selectOrganizationById(project.organizationId);
+	if (!organization) throw new Error(`Organization not found for project ${input.projectId}`);
+	if (!input.artifactBytes && artifact.manifestJson == null) throw new RouteManifestNotFoundError("Artifact has no stored route manifest; rebuild and redeploy");
+	const manifest = await resolveDeployManifest({
+		artifactId: input.artifactId,
+		artifactManifest: artifact.manifestJson,
+		artifactBytes: input.artifactBytes ?? Buffer.alloc(0)
+	});
+	if (artifact.manifestJson == null) await updateProjectArtifactManifest({
+		artifactId: input.artifactId,
+		manifestJson: manifest
+	});
+	if (project.pendingArtifactId === input.artifactId) await promoteProjectArtifact({
+		projectId: input.projectId,
+		artifactId: input.artifactId
+	});
+	else if (project.activeArtifactId !== input.artifactId) throw new Error(`Artifact ${input.artifactId} is not the pending deploy for project ${input.projectId}`);
+	const ephemeralRoutes = [];
+	await runWithProjectDatabase({
+		url: resolveOrgDatabaseUrl(organization),
+		searchPath: organization.dbSchema
+	}, async () => runWithProjectScope(project.id, async () => {
+		await syncRegistryFromStoredManifest(manifest);
+		const byRoute = /* @__PURE__ */ new Map();
+		for (const row of await selectEphemeralTriggerAttachments()) {
+			if (row.source.kind !== "webhook") continue;
+			const route = webhookRouteFromEndpoint(row.source.endpoint);
+			byRoute.set(route, [...byRoute.get(route) ?? [], row.slug]);
+		}
+		for (const [route, attachmentKeys] of byRoute) ephemeralRoutes.push({
+			route,
+			attachmentKeys
+		});
+	}));
+	const webhookRoutes = [...extractWebhookRoutesFromManifest(manifest), ...ephemeralRoutes];
+	if (webhookRoutes.length > 0) await ensureWebhookApiKeys(project.id, webhookRoutes, project.id);
+}
+/** Decide whether a pg-boss job should start runtime, skip as stale, or fail. */
+function resolveRuntimeArtifact(project, jobArtifactId) {
+	if (jobArtifactId && project.pendingArtifactId && jobArtifactId !== project.pendingArtifactId) return { action: "skip" };
+	if (jobArtifactId && !project.pendingArtifactId && project.activeArtifactId && jobArtifactId !== project.activeArtifactId) return { action: "skip" };
+	const artifactId = jobArtifactId ?? project.pendingArtifactId ?? project.activeArtifactId ?? null;
+	if (!artifactId) return {
+		action: "error",
+		message: `Project ${project.id} has no pending artifact`
+	};
+	if (!project.pendingArtifactId && project.activeArtifactId === artifactId && project.status === "active" && project.baseUrl && project.runtimeId) return { action: "skip" };
+	return {
+		action: "run",
+		artifactId
+	};
+}
+let runtimeQueue;
+let runtimeQueueInit;
+let runtimeSchedulerPlugin;
+function configureProjectRuntimeScheduler(plugin) {
+	runtimeSchedulerPlugin = plugin;
+	runtimeQueue = void 0;
+	runtimeQueueInit = void 0;
+}
+async function getProjectRuntimeQueue() {
+	if (runtimeQueue) return runtimeQueue;
+	if (!runtimeQueueInit) runtimeQueueInit = (async () => {
+		const queue = await createJobQueue({
+			scope: "platform",
+			plugin: runtimeSchedulerPlugin ?? defaultSchedulerPlugin()
+		});
+		runtimeQueue = queue;
+		return queue;
+	})();
+	return runtimeQueueInit;
+}
+function toProjectRuntimeJob(payload) {
+	const job = payload.payload;
+	if (!job?.projectId || !job.name || !job.artifactId) throw new Error("Invalid project runtime job payload");
+	return {
+		projectId: job.projectId,
+		name: job.name,
+		artifactId: job.artifactId
+	};
+}
+async function enqueueProjectRuntime(job) {
+	return (await getProjectRuntimeQueue()).enqueue({
+		kind: "runtime",
+		targetId: job.projectId,
+		runId: job.artifactId,
+		trigger: "api",
+		payload: job,
+		maxAttempts: 5,
+		dedupeKey: job.projectId
+	});
+}
+async function destroyProjectRuntime(runtime, input, runtimeId) {
+	if (!runtime.destroy) return;
+	try {
+		await runtime.destroy({
+			runtimeId,
+			hosting: input.hosting
+		});
+	} catch (destroyError) {
+		console.error(`[project.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
+	}
+}
+async function handleProjectRuntimeJob(runtime, resolveStartInput, payload) {
+	if (payload.kind !== "runtime") return;
+	const job = toProjectRuntimeJob(payload);
+	try {
+		const project = await selectProjectById(job.projectId);
+		if (!project) throw new Error(`Project ${job.projectId} not found`);
+		const resolved = resolveRuntimeArtifact(project, job.artifactId);
+		if (resolved.action === "skip") return;
+		if (resolved.action === "error") throw new Error(resolved.message);
+		const input = await resolveStartInput({
+			...job,
+			artifactId: resolved.artifactId
+		});
+		let result;
+		try {
+			result = await runtime.start(input);
+			await promoteProjectDeploy({
+				projectId: job.projectId,
+				artifactId: resolved.artifactId,
+				baseUrl: result.baseUrl
+			});
+			await updateProjectActive(job.projectId, result);
+			if (input.previousRuntimeId) await destroyProjectRuntime(runtime, input, input.previousRuntimeId);
+		} catch (error) {
+			if (result) await destroyProjectRuntime(runtime, input, result.runtimeId);
+			throw error;
+		}
+	} catch (error) {
+		console.error(`[project.runtime] ${job.projectId} failed`, error);
+		if (payload.exhaustedRetries) await updateProjectFailed(job.projectId, "Project runtime failed after retries");
+		throw error;
+	}
+}
+async function startProjectRuntimeWorker(runtime, options = {}) {
+	const queue = await getProjectRuntimeQueue();
+	const resolveStartInput = options.resolveStartInput ?? (async (job) => {
+		throw new Error(`Project runtime for ${job.projectId} requires resolveStartInput with database credentials`);
+	});
+	await queue.startWorker(async (payload) => {
+		await handleProjectRuntimeJob(runtime, resolveStartInput, payload);
+	});
+}
+//#endregion
+//#region src/auth/mount.ts
+function mountAuth(app, auth) {
+	app.on(["POST", "GET"], AUTH_API_PATH, (c) => handleAuthRequest(auth, c.req.raw));
+}
+//#endregion
+//#region ../../packages/access-control/dist/index.mjs
+const apiKeysActions = {
+	read: "apiKeys:read",
+	create: "apiKeys:create"
+};
+const apiKeysGrants = Object.values(apiKeysActions);
+const apiKeysRoleGrants = {
+	owner: [apiKeysActions.read, apiKeysActions.create],
+	admin: [apiKeysActions.read, apiKeysActions.create],
+	builder: [apiKeysActions.create]
+};
+const organizationActions = {
+	update: "organization:update",
+	delete: "organization:delete"
+};
+const organizationGrants = Object.values(organizationActions);
+const organizationRoleGrants = {
+	owner: [organizationActions.update, organizationActions.delete],
+	admin: [organizationActions.update],
+	builder: []
+};
+const userActions = {
+	manage: "users:manage",
+	invite: "users:invite"
+};
+const userGrants = Object.values(userActions);
+const userRoleGrants = {
+	owner: [userActions.manage, userActions.invite],
+	admin: [userActions.manage, userActions.invite],
+	builder: [userActions.invite]
+};
+/** Role ceiling: which roles each inviter may grant. Owner is never invitable (shared schema). */
+const invitableRolesByRole = {
+	owner: ["admin", "builder"],
+	admin: ["admin", "builder"],
+	builder: ["builder"]
+};
+function canInviteRole(inviter, invited) {
+	return invitableRolesByRole[inviter].includes(invited);
+}
+function mergeRoleGrants(role) {
+	return [
+		...organizationRoleGrants[role],
+		...userRoleGrants[role],
+		...apiKeysRoleGrants[role]
+	];
+}
+const orgRolePermissions = {
+	owner: mergeRoleGrants("owner"),
+	admin: mergeRoleGrants("admin"),
+	builder: mergeRoleGrants("builder")
+};
+const projectActions = {
+	read: "project:read",
+	deploy: "project:deploy",
+	update: "project:update",
+	delete: "project:delete",
+	manageMembers: "project:manage-members",
+	invite: "project:invite"
+};
+const projectGrants = Object.values(projectActions);
+const projectRoleGrants = {
+	admin: Object.values(projectActions),
+	builder: [projectActions.read, projectActions.deploy]
+};
+const orgAdminRoles = new Set(["owner", "admin"]);
+const projectActionSet = new Set(projectGrants);
+function isProjectAction(action) {
+	return projectActionSet.has(action);
+}
+function checkPermission(action, ctx) {
+	if (isProjectAction(action)) {
+		if (orgAdminRoles.has(ctx.orgRole)) return true;
+		return ctx.projectRole != null && projectRoleGrants[ctx.projectRole].includes(action);
+	}
+	return orgRolePermissions[ctx.orgRole].includes(action);
+}
+function projectListScope(ctx) {
+	return checkPermission(projectActions.read, ctx) ? { kind: "all" } : { kind: "member-only" };
+}
+function canReadProject(ctx, hasMembership) {
+	return checkPermission(projectActions.read, ctx) || hasMembership;
+}
+const agentListScope = projectListScope;
+const canAccessAgent = canReadProject;
+function canRevokeApiKey(ctx, input) {
+	return input.userId === input.createdByUserId || checkPermission(userActions.manage, ctx);
+}
+function apiKeyListScope(ctx) {
+	return checkPermission(apiKeysActions.read, ctx) ? { kind: "all" } : { kind: "creator-only" };
+}
+function canReadApiKey(ctx, input) {
+	return checkPermission(apiKeysActions.read, ctx) || input.userId === input.createdByUserId;
+}
+[
+	...organizationGrants,
+	...userGrants,
+	...apiKeysGrants,
+	...projectGrants
+];
+const historyListScope = projectListScope;
+const canAccessHistoryRun = canReadProject;
+function canInviteToProject(ctx, settings, invitedRole) {
+	if (!(checkPermission(projectActions.invite, ctx) || settings.invitePermission === "all" && ctx.projectRole === "builder")) return false;
+	if (checkPermission(projectActions.manageMembers, ctx)) return true;
+	return invitedRole === "builder";
+}
+const skillListScope = projectListScope;
+const canAccessSkill = canReadProject;
+const workflowListScope = projectListScope;
+const canAccessWorkflow = canReadProject;
+//#endregion
+//#region src/auth/access-context.ts
+function accessContext(c) {
+	const organization = c.get("organization");
+	const projectMember = c.get("projectMember");
+	return {
+		orgRole: organization.role,
+		projectRole: projectMember?.role
+	};
+}
+function getProjectInvitePermission(c) {
+	return c.get("project").invitePermission;
+}
+//#endregion
+//#region ../../packages/http/dist/require-session-BLPGA50N.mjs
+function resolveActiveOrganizationId(c) {
+	const header = c.req.header(ACTIVE_ORG_HEADER)?.trim();
+	if (header) return header;
+	return c.get("apiKeyAuth")?.organizationId;
+}
+async function resolveOrganizationContext(c) {
+	const organizationId = resolveActiveOrganizationId(c);
+	if (!organizationId) return {
+		ok: false,
+		response: c.json(ErrorResponseSchema.parse({
+			error: "Select an organization to continue",
+			code: "needs_org_selection"
+		}), 409)
+	};
+	const apiKeyAuth = c.get("apiKeyAuth");
+	if (apiKeyAuth && apiKeyAuth.organizationId !== organizationId) return {
+		ok: false,
+		response: c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403)
+	};
+	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
+	if (!membership) return {
+		ok: false,
+		response: c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403)
+	};
+	return {
+		ok: true,
+		organization: {
+			organizationId: membership.organization.id,
+			organizationName: membership.organization.name,
+			role: membership.role
+		}
+	};
+}
+function requireOrganization() {
+	return async (c, next) => {
+		const resolved = await resolveOrganizationContext(c);
+		if (!resolved.ok) return resolved.response;
+		c.set("organization", resolved.organization);
+		await next();
+	};
+}
+function requireProject() {
+	return async (c, next) => {
+		const organization = c.get("organization");
+		const projectId = c.req.param("projectId")?.trim();
+		if (!projectId) return c.json(ErrorResponseSchema.parse({ error: "Project id is required" }), 400);
+		const [project, organizationRow] = await Promise.all([selectProjectForOrganization(organization.organizationId, projectId), selectOrganizationById(organization.organizationId)]);
+		if (!project) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
+		if (!organizationRow) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+		c.set("project", project);
+		await runWithWorkspaceContext({
+			organizationId: organization.organizationId,
+			role: organization.role,
+			projectId: project.id,
+			dbSchema: organizationRow.dbSchema
+		}, () => next());
+	};
+}
+function routeProject(project) {
+	return mapProject(project);
+}
+function forbidden(c) {
+	return c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
+}
+function notFound(c, message = "Not found") {
+	return c.json(ErrorResponseSchema.parse({ error: message }), 404);
+}
+function requireProjectMembership() {
+	return async (c, next) => {
+		const { role: orgRole } = c.get("organization");
+		const project = c.get("project");
+		if (checkPermission(projectActions.read, { orgRole })) {
+			await next();
+			return;
+		}
+		const membership = await selectUserProjectMembership(c.get("user").id, project.id);
+		if (!membership) return notFound(c, "Project not found");
+		c.set("projectMember", { role: membership.role });
+		await next();
+	};
+}
+function sessionFromApiKeyUser(user, token) {
+	return {
+		user: {
+			id: user.id,
+			email: user.email,
+			name: user.name,
+			image: user.image ?? null,
+			emailVerified: user.emailVerified,
+			createdAt: user.createdAt,
+			updatedAt: user.updatedAt
+		},
+		session: {
+			id: user.id,
+			userId: user.id,
+			token,
+			expiresAt: new Date(Date.now() + 900 * 1e3),
+			createdAt: /* @__PURE__ */ new Date(),
+			updatedAt: /* @__PURE__ */ new Date()
+		}
+	};
+}
+function requireSession(jwtVerifier) {
+	const verifier = jwtVerifier ?? createDefaultAuthJwtVerifier();
+	return async (c, next) => {
+		const result = await resolveRequestAuth(verifier, c.req.raw.headers);
+		if (result) {
+			c.set("user", result.user);
+			c.set("session", result.session);
+			await next();
+			return;
+		}
+		const apiKeySecret = extractWebhookApiKeyFromRequest(c.req.raw);
+		if (apiKeySecret) {
+			const verified = await verifyOrgPlatformApiKeySecret(apiKeySecret);
+			if (verified) {
+				const user = await loadOrgPlatformApiKeyUser(verified.userId);
+				if (user) {
+					const session = sessionFromApiKeyUser(user, apiKeySecret);
+					c.set("user", session.user);
+					c.set("session", session.session);
+					c.set("apiKeyAuth", {
+						apiKeyId: verified.apiKeyId,
+						organizationId: verified.organizationId
+					});
+					await next();
+					return;
+				}
+			}
+		}
+		return c.json({ error: "Unauthorized" }, 401);
+	};
+}
+//#endregion
+//#region src/auth/authorize.ts
+function authorize(action) {
+	return async (c, next) => {
+		if (!checkPermission(action, accessContext(c))) return forbidden(c);
+		await next();
+	};
+}
+//#endregion
+//#region src/auth/authorize-payload.ts
+function authorizePayload(schema, allow) {
+	return async (c, next) => {
+		const parsed = schema.safeParse(await c.req.json().catch(() => null));
+		if (parsed.success && !allow({
+			c,
+			ctx: accessContext(c),
+			body: parsed.data
+		})) return forbidden(c);
+		await next();
+	};
+}
+//#endregion
+//#region src/auth/require-organization-param.ts
+function requireOrganizationParam() {
+	return async (c, next) => {
+		const organizationId = c.req.param("organizationId")?.trim();
+		if (!organizationId) return c.json(ErrorResponseSchema.parse({ error: "Organization id is required" }), 400);
+		const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
+		if (!membership) return c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
+		c.set("organization", {
+			organizationId: membership.organization.id,
+			organizationName: membership.organization.name,
+			role: membership.role
+		});
+		await next();
+	};
+}
+//#endregion
+//#region ../../packages/http/dist/with-public-project-runtime-BG_6tack.mjs
+const requestBackgroundTasks = new AsyncLocalStorage();
+function runWithRequestBackgroundTasks(fn) {
+	return requestBackgroundTasks.run([], fn);
+}
+function deferRequestBackgroundTask(task) {
+	const tasks = requestBackgroundTasks.getStore();
+	if (!tasks) return;
+	tasks.push(task);
+}
+async function flushRequestBackgroundTasks() {
+	const tasks = requestBackgroundTasks.getStore() ?? [];
+	await Promise.allSettled(tasks);
+}
+/** Org DB connection options for `@keystrokehq/database` project scope (pg schema vs sqlite file). */
+function resolveOrgProjectDatabaseOptions(organization) {
+	const url = resolveOrgDatabaseUrl(organization);
+	if (inferDialect(url) === "postgres") return {
+		url,
+		searchPath: organization.dbSchema
+	};
+	return { url };
+}
+/** Bind the org's shared Postgres schema (all projects in the org use this DB). */
+function withOrganizationProjectDatabase() {
+	return async (c, next) => {
+		const { organizationId } = c.get("organization");
+		const organization = await selectOrganizationById(organizationId);
+		if (!organization) return c.json({ error: "Organization not found" }, 404);
+		const dbOptions = resolveOrgProjectDatabaseOptions(organization);
+		await runWithOrganizationScope(organizationId, () => runWithProjectDatabase(dbOptions, () => runWithTenantScope(organizationId, () => runWithRequestBackgroundTasks(async () => {
+			await next();
+			await flushRequestBackgroundTasks();
+		}))));
+	};
+}
+//#endregion
+//#region src/routes/account/users/me/avatar/GET.ts
+const handler$60 = async (c) => {
+	const dbUser = await selectUserById(c.get("user").id);
+	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
+	return c.json(UserAvatarSchema.parse({ url: dbUser.image ?? null }));
+};
+//#endregion
+//#region src/lib/user-avatar-content-type.ts
+const ALLOWED_AVATAR_CONTENT_TYPES = {
+	"image/jpeg": "jpg",
+	"image/jpg": "jpg",
+	"image/png": "png",
+	"image/webp": "webp",
+	"image/gif": "gif"
+};
+function avatarExtensionForContentType(contentType) {
+	return ALLOWED_AVATAR_CONTENT_TYPES[contentType.split(";")[0]?.trim().toLowerCase() ?? ""] ?? null;
+}
+//#endregion
+//#region src/routes/account/users/me/avatar/presign/POST.ts
+const handler$59 = async (c) => {
+	const parsed = PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
+	const extension = avatarExtensionForContentType(parsed.data.contentType);
+	if (!extension) return c.json(ErrorResponseSchema.parse({ error: "Unsupported image type" }), 400);
+	const storageKey = userAvatarStorageKey(c.get("user").id, extension);
+	const uploadUrl = await createAssetsStorageClient().presignPut({
+		key: storageKey,
+		contentType: parsed.data.contentType
+	});
+	return c.json(PresignUserAvatarResponseSchema.parse({
+		uploadUrl,
+		storageKey
+	}));
+};
+//#endregion
+//#region src/lib/stored-image.ts
+async function finalizeStoredImageUpload(input) {
+	if (!input.isValidStorageKey(input.storageKey)) return {
+		ok: false,
+		error: "Invalid storage key"
+	};
+	const head = await input.storage.headObject(input.storageKey);
+	if (!head || head.contentLength <= 0) return {
+		ok: false,
+		error: "Upload not found"
+	};
+	return {
+		ok: true,
+		publicUrl: input.buildPublicUrl(input.storageKey)
+	};
+}
+async function deleteStoredImageIfOwned(input) {
+	if (!input.url || !input.isOwnedPublicUrl(input.url)) return;
+	const key = input.keyFromPublicUrl(input.url);
+	if (!key) return;
+	await input.storage.deleteObject(key).catch(() => void 0);
+}
+//#endregion
+//#region src/routes/account/users/me/avatar/PATCH.ts
+const handler$58 = async (c) => {
+	const parsed = UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
+	const user = c.get("user");
+	const dbUser = await selectUserById(user.id);
+	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
+	const storage = createAssetsStorageClient();
+	const { storageKey } = parsed.data;
+	if (storageKey === null) {
+		await deleteStoredImageIfOwned({
+			storage,
+			url: dbUser.image,
+			isOwnedPublicUrl: isKeystrokeAssetsAvatarPublicUrl,
+			keyFromPublicUrl: keystrokeAssetsAvatarKeyFromPublicUrl
+		});
+		await updateUserById(user.id, {
+			image: null,
+			updatedAt: /* @__PURE__ */ new Date()
+		});
+		return c.json(UserAvatarSchema.parse({ url: null }));
+	}
+	const finalized = await finalizeStoredImageUpload({
+		storage,
+		storageKey,
+		isValidStorageKey: (key) => isUserAvatarStorageKey(key, user.id),
+		buildPublicUrl: publicKeystrokeAssetsObjectUrl
+	});
+	if (!finalized.ok) return c.json(ErrorResponseSchema.parse({ error: finalized.error }), 400);
+	if (dbUser.image && dbUser.image !== finalized.publicUrl) await deleteStoredImageIfOwned({
+		storage,
+		url: dbUser.image,
+		isOwnedPublicUrl: isKeystrokeAssetsAvatarPublicUrl,
+		keyFromPublicUrl: keystrokeAssetsAvatarKeyFromPublicUrl
+	});
+	await updateUserById(user.id, {
+		image: finalized.publicUrl,
+		updatedAt: /* @__PURE__ */ new Date()
+	});
+	return c.json(UserAvatarSchema.parse({ url: finalized.publicUrl }));
+};
+//#endregion
+//#region src/routes/account/users/me/preferences/GET.ts
+const handler$57 = async (c) => {
+	const dbUser = await selectUserById(c.get("user").id);
+	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
+	return c.json(UserPreferencesSchema.parse(normalizeUserPreferences(dbUser.preferences)));
+};
+//#endregion
+//#region src/routes/account/users/me/preferences/PATCH.ts
+const handler$56 = async (c) => {
+	const parsed = UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
+	const user = c.get("user");
+	const dbUser = await selectUserById(user.id);
+	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
+	const next = mergeUserPreferences(normalizeUserPreferences(dbUser.preferences), parsed.data);
+	await updateUserById(user.id, {
+		preferences: next,
+		updatedAt: /* @__PURE__ */ new Date()
+	});
+	return c.json(UserPreferencesSchema.parse(next));
+};
+//#endregion
+//#region src/routes/account/organizations/GET.ts
+const handler$55 = async (c) => {
+	const memberships = await selectUserOrganizations(c.get("user").id);
+	return c.json(ListOrganizationsResponseSchema.parse({ organizations: memberships.map(mapUserOrganization) }));
+};
+//#endregion
+//#region src/services/create-organization.ts
+async function createOrganizationWithHosting(deps, userId, name, preferredSlug) {
+	const { hosting, storage } = deps;
+	const identity = await resolveNewOrganizationIdentity(name, preferredSlug);
+	let hostedAppName;
+	let provisionedStorage;
+	let organizationPersisted = false;
+	try {
+		if (hosting.provisionOrganization) hostedAppName = (await hosting.provisionOrganization({
+			organizationId: identity.organizationId,
+			name: name.trim()
+		})).appName;
+		provisionedStorage = await storage.provisionOrganization({
+			organizationId: identity.organizationId,
+			name: name.trim()
+		});
+		const membership = await createOrganizationForUser(userId, name, preferredSlug, {
+			organizationId: identity.organizationId,
+			slug: identity.slug,
+			hostingAppName: hostedAppName ?? null,
+			storage: {
+				bucket: provisionedStorage.bucket,
+				endpoint: provisionedStorage.endpoint,
+				accessKeyIdCiphertext: encryptCredentialPayload$1(provisionedStorage.accessKeyId),
+				secretAccessKeyCiphertext: encryptCredentialPayload$1(provisionedStorage.secretAccessKey),
+				region: provisionedStorage.region ?? null,
+				forcePathStyle: provisionedStorage.forcePathStyle ?? null
+			}
+		});
+		organizationPersisted = true;
+		await seedOAuthAppsFromEnvForOrganization(identity.organizationId);
+		return membership;
+	} catch (error) {
+		if (provisionedStorage && !organizationPersisted) {
+			if (!await isOrganizationStorageBucketInUse(provisionedStorage.bucket)) await storage.deprovisionOrganization(provisionedStorage).catch(() => void 0);
+		}
+		if (hostedAppName && hosting.deprovisionOrganization) await hosting.deprovisionOrganization({ appName: hostedAppName }).catch(() => void 0);
+		throw error;
+	}
+}
+//#endregion
+//#region src/routes/account/organizations/slug-errors.ts
+function organizationSlugErrorBody(error) {
+	if (error instanceof OrganizationSlugTakenError) return {
+		error: error.message,
+		code: "slug_taken"
+	};
+	const message = error.issues[0]?.message ?? "Invalid organization slug";
+	return {
+		error: message,
+		code: organizationSlugErrorCodeFromMessage(message)
+	};
+}
+//#endregion
+//#region src/routes/account/organizations/POST.ts
+function createOrganizationHandler(deps) {
+	return async (c) => {
+		const user = c.get("user");
+		const body = await c.req.json().catch(() => null);
+		const parsed = CreateOrganizationRequestSchema.safeParse(body);
+		if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid organization request" }), 400);
+		try {
+			const membership = await createOrganizationWithHosting(deps, user.id, parsed.data.name, parsed.data.slug);
+			return c.json(CreateOrganizationResponseSchema.parse({ organization: mapUserOrganization(membership) }), 201);
+		} catch (error) {
+			if (error instanceof OrganizationSlugTakenError$1) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
+			if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
+			throw error;
+		}
+	};
+}
+//#endregion
+//#region src/routes/account/organizations/slug-available/GET.ts
+const handler$54 = async (c) => {
+	const parsed = SlugAvailabilityQuerySchema.safeParse({
+		slug: c.req.query("slug"),
+		excludeOrganizationId: c.req.query("excludeOrganizationId")
+	});
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
+	const availability = await checkOrganizationSlugAvailability(parsed.data.slug, parsed.data.excludeOrganizationId);
+	return c.json(SlugAvailabilityResponseSchema.parse(availability));
+};
+//#endregion
+//#region src/routes/account/organizations/[organizationId]/GET.ts
+const handler$53 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
+	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
+	return c.json(ActiveOrganizationResponseSchema.parse({ organization: mapUserOrganization(membership) }));
+};
+//#endregion
+//#region src/routes/account/organizations/[organizationId]/PATCH.ts
+const handler$52 = async (c) => {
+	const organization = c.get("organization");
+	const body = await c.req.json().catch(() => null);
+	const parsed = UpdateOrganizationRequestSchema.safeParse(body);
+	if (!parsed.success) {
+		const errorBody = parsed.error.issues.some((issue) => issue.path[0] === "slug") ? organizationSlugErrorBody(parsed.error) : validationErrorResponse(parsed.error, "Invalid organization update");
+		return c.json(ErrorResponseSchema.parse(errorBody), 400);
+	}
+	try {
+		let updated;
+		if (parsed.data.name !== void 0) updated = await updateOrganizationName(organization.organizationId, parsed.data.name);
+		if (parsed.data.slug !== void 0) updated = await updateOrganizationSlug(organization.organizationId, parsed.data.slug);
+		if (!updated) throw new Error(`Organization update produced no result: ${organization.organizationId}`);
+		return c.json(ActiveOrganizationResponseSchema.parse({ organization: mapUserOrganization({
+			organization: updated,
+			role: organization.role
+		}) }));
+	} catch (error) {
+		if (error instanceof OrganizationSlugTakenError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
+		if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/organizations/[organizationId]/branding/GET.ts
+const handler$51 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	return c.json(OrganizationSidebarBrandingSchema.parse(organizationRowToSidebarBranding(organization)));
+};
+//#endregion
+//#region src/routes/account/organizations/[organizationId]/branding/PATCH.ts
+const LOGO_VARIANTS = [{
+	variant: "light",
+	storageKeyField: "logoLightStorageKey",
+	urlField: "logoLightUrl"
+}, {
+	variant: "dark",
+	storageKeyField: "logoDarkStorageKey",
+	urlField: "logoDarkUrl"
+}];
+async function finalizeOrgLogoVariant(input) {
+	const storage = createAssetsStorageClient();
+	if (input.storageKey === null) {
+		await deleteStoredImageIfOwned({
+			storage,
+			url: input.currentUrl,
+			isOwnedPublicUrl: isKeystrokeAssetsOrgLogoPublicUrl,
+			keyFromPublicUrl: keystrokeAssetsOrgLogoKeyFromPublicUrl
+		});
+		return {
+			ok: true,
+			publicUrl: null
+		};
+	}
+	const finalized = await finalizeStoredImageUpload({
+		storage,
+		storageKey: input.storageKey,
+		isValidStorageKey: (key) => isOrgLogoStorageKey(key, input.organizationId, input.variant),
+		buildPublicUrl: publicKeystrokeAssetsObjectUrl
+	});
+	if (!finalized.ok) return finalized;
+	if (input.currentUrl && input.currentUrl !== finalized.publicUrl) await deleteStoredImageIfOwned({
+		storage,
+		url: input.currentUrl,
+		isOwnedPublicUrl: isKeystrokeAssetsOrgLogoPublicUrl,
+		keyFromPublicUrl: keystrokeAssetsOrgLogoKeyFromPublicUrl
+	});
+	return {
+		ok: true,
+		publicUrl: finalized.publicUrl
+	};
+}
+const handler$50 = async (c) => {
+	const parsed = OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const dbUpdate = {
+		customLogoEnabled: parsed.data.customLogoEnabled,
+		customLogoExplicitlyDisabled: parsed.data.customLogoExplicitlyDisabled,
+		logoHeightPx: parsed.data.logoHeightPx
+	};
+	for (const { variant, storageKeyField, urlField } of LOGO_VARIANTS) {
+		const storageKey = parsed.data[storageKeyField];
+		if (storageKey === void 0) continue;
+		const result = await finalizeOrgLogoVariant({
+			organizationId,
+			variant,
+			storageKey,
+			currentUrl: organization[urlField]
+		});
+		if (!result.ok) return c.json(ErrorResponseSchema.parse({ error: result.error }), 400);
+		dbUpdate[urlField] = result.publicUrl;
+	}
+	const updated = await updateOrganizationSidebarBranding(organizationId, dbUpdate);
+	return c.json(OrganizationSidebarBrandingSchema.parse(organizationRowToSidebarBranding(updated)));
+};
+//#endregion
+//#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
+const handler$49 = async (c) => {
+	const parsed = PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
+	const extension = avatarExtensionForContentType(parsed.data.contentType);
+	if (!extension) return c.json(ErrorResponseSchema.parse({ error: "Unsupported image type" }), 400);
+	const { organizationId } = c.get("organization");
+	const storageKey = orgLogoStorageKey(organizationId, parsed.data.variant, extension);
+	const uploadUrl = await createAssetsStorageClient().presignPut({
+		key: storageKey,
+		contentType: parsed.data.contentType
+	});
+	return c.json(PresignOrgLogoResponseSchema.parse({
+		uploadUrl,
+		storageKey
+	}));
+};
+//#endregion
+//#region src/auth/project-access.ts
+function adminViewRequested(c) {
+	return c.req.query("admin") === "true";
+}
+/** Capability from policy, narrowed by the caller's view preference. */
+function listScope(c, capability) {
+	return adminViewRequested(c) ? capability : { kind: "member-only" };
+}
+async function grantedProjectIds(c, scope) {
+	if (scope.kind === "all") return;
+	const { organizationId } = c.get("organization");
+	return selectProjectIdsForUser(organizationId, c.get("user").id);
+}
+async function resolveListProjectIds(c, scope, requested) {
+	const granted = await grantedProjectIds(c, scope);
+	const projectId = requested?.trim() || void 0;
+	if (projectId) {
+		if (granted !== void 0 && !granted.includes(projectId)) return "empty";
+		return { projectIds: [projectId] };
+	}
+	if (granted === void 0) return {};
+	if (granted.length === 0) return "empty";
+	return { projectIds: granted };
+}
+async function canAccessProjectId(c, projectId, check) {
+	const ctx = accessContext(c);
+	const granted = await grantedProjectIds(c, projectListScope(ctx));
+	return check(ctx, granted === void 0 ? false : granted.includes(projectId));
+}
+//#endregion
+//#region src/routes/account/history/enrich.ts
+async function resolveHistoryRunActor(ranByUserId) {
+	if (!ranByUserId) return null;
+	const user = await selectUserById(ranByUserId);
+	if (!user) return null;
+	return {
+		userId: user.id,
+		name: user.name,
+		avatarUrl: user.image ?? null
+	};
+}
+async function enrichHistoryRun(run, projectNameById) {
+	const { ranByUserId, ...rest } = run;
+	return {
+		...rest,
+		projectName: projectNameById.get(run.projectId) ?? "Project",
+		ranAs: await resolveHistoryRunActor(ranByUserId)
+	};
+}
+async function enrichHistoryRuns(runs, projectNameById) {
+	const actorByUserId = /* @__PURE__ */ new Map();
+	return Promise.all(runs.map(async (run) => {
+		const { ranByUserId, ...rest } = run;
+		let ranAs = null;
+		if (ranByUserId) {
+			if (!actorByUserId.has(ranByUserId)) actorByUserId.set(ranByUserId, await resolveHistoryRunActor(ranByUserId));
+			ranAs = actorByUserId.get(ranByUserId) ?? null;
+		}
+		return {
+			...rest,
+			projectName: projectNameById.get(run.projectId) ?? "Project",
+			ranAs
+		};
+	}));
+}
+async function attachRanAsToDetail(detail, ranByUserId) {
+	const ranAs = await resolveHistoryRunActor(ranByUserId);
+	return {
+		...detail,
+		ranAs
+	};
+}
+//#endregion
+//#region src/routes/account/history/GET.ts
+const handler$48 = async (c) => {
+	const organization = c.get("organization");
+	const ctx = accessContext(c);
+	const query = HistoryRunListQuerySchema.parse({
+		project: c.req.query("project")?.trim() || void 0,
+		status: c.req.query("status")?.trim() || void 0,
+		kind: c.req.query("kind")?.trim() || void 0
+	});
+	const scope = listScope(c, historyListScope(ctx));
+	const filter = await resolveListProjectIds(c, scope, query.project);
+	if (filter === "empty") return c.json(HistoryRunListResponseSchema.parse([]));
+	const runs = await listHistoryRuns({
+		...filter,
+		...query.status ? { status: query.status } : {},
+		...query.kind ? { kind: query.kind } : {}
+	});
+	const grantedProjectIdsList = await grantedProjectIds(c, scope);
+	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
+	const historyRuns = await enrichHistoryRuns(runs, new Map(projects.map((project) => [project.id, project.name])));
+	return c.json(HistoryRunListResponseSchema.parse(historyRuns));
+};
+//#endregion
+//#region src/routes/account/history/[runId]/GET.ts
+const handler$47 = async (c) => {
+	const runId = c.req.param("runId") ?? "";
+	if (!runId) return c.json(null, 404);
+	const core = await findHistoryRunCore(runId);
+	if (!core || !await canAccessProjectId(c, core.projectId, canAccessHistoryRun)) return c.json(null, 404);
+	const detail = await runWithProjectScope(core.projectId, async () => {
+		if (core.kind === "workflow") {
+			const row = await selectWorkflowRunById(runId);
+			if (!row) return null;
+			return buildHistoryWorkflowRunDetail(row.workflowSlug, runId);
+		}
+		const session = await selectAgentSessionById(runId);
+		if (!session) return null;
+		const agent = await selectActiveAgentById(session.agentId);
+		if (!agent) return null;
+		return buildHistoryAgentSessionDetail(agent.slug, runId);
+	});
+	if (!detail) return c.json(null, 404);
+	return c.json(HistoryRunDetailResponseSchema.parse(await attachRanAsToDetail(detail, core.ranByUserId)));
+};
+//#endregion
+//#region src/routes/account/resources/common.ts
+/** Derive a human display name from a resource slug when no explicit name is stored. */
+function titleCaseKey(slug) {
+	const normalized = slug.split(/[/_-]+/).filter(Boolean).join(" ");
+	if (!normalized) return PLATFORM_RESOURCE_UNSUPPORTED_TEXT;
+	return normalized.replace(/\b\w/g, (char) => char.toUpperCase());
+}
+//#endregion
+//#region src/routes/account/resources/agents.ts
+function formatModel(model) {
+	if (!model) return;
+	return model;
+}
+function toAgentSummary(row, options) {
+	return AgentSummarySchema.parse({
+		id: row.id,
+		slug: row.slug,
+		name: row.name?.trim() || titleCaseKey(row.slug),
+		description: row.description ?? void 0,
+		projectId: row.projectId,
+		updatedAt: row.updatedAt.toISOString(),
+		sourcePath: row.moduleFile,
+		model: formatModel(row.model),
+		toolCount: row.toolCount ?? void 0,
+		credentialCount: row.credentialCount ?? void 0,
+		lastRunAt: options?.lastRunAt?.toISOString()
+	});
+}
+//#endregion
+//#region src/routes/account/agents/GET.ts
+const handler$46 = async (c) => {
+	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
+	if (filter === "empty") return c.json(AgentSummaryListResponseSchema.parse([]));
+	const rows = await listActiveAgents(filter);
+	const lastRunAtById = await selectAgentLastRunAtByIds(rows.map((row) => row.id));
+	return c.json(AgentSummaryListResponseSchema.parse(rows.map((row) => toAgentSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null }))));
+};
+//#endregion
+//#region src/routes/account/lib/touch-resource-activity.ts
+function touchResourceActivityBestEffort(options) {
+	deferRequestBackgroundTask(touchResourceActivity(options).catch(() => {}));
+}
+//#endregion
+//#region src/routes/account/agents/[agentId]/GET.ts
+const handler$45 = async (c) => {
+	const agentId = c.req.param("agentId") ?? "";
+	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
+	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(AgentSummaryDetailResponseSchema.parse(null));
+	touchResourceActivityBestEffort({
+		userId: c.get("user").id,
+		projectId: row.projectId,
+		resourceKind: "agent",
+		resourceId: row.id
+	});
+	const lastRunAtById = await selectAgentLastRunAtByIds([row.id]);
+	return c.json(AgentSummaryDetailResponseSchema.parse(toAgentSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null })));
+};
+//#endregion
+//#region src/routes/account/history/cancel-run.ts
+/** Shared body for the workflow-run and agent-session cancel endpoints. */
+async function cancelHistoryRun(c, kind, cancel) {
+	const organizationContext = c.get("organization");
+	const id = c.req.param(kind === "workflow" ? "runId" : "sessionId") ?? "";
+	if (!id) return c.json(null, 404);
+	const core = await findHistoryRunCore(id);
+	if (!core || core.kind !== kind) return c.json(null, 404);
+	if (!await canAccessProjectId(c, core.projectId, canAccessHistoryRun)) return c.json(null, 404);
+	const run = await runWithProjectScope(core.projectId, () => cancel(id));
+	if (!run) return c.json(null, 404);
+	const organization = await selectOrganizationById(organizationContext.organizationId);
+	if (!organization) return c.json(null, 404);
+	await (await getProjectScheduler(organization, core.projectId)).publishCancel(id);
+	const grantedProjectIdsList = await grantedProjectIds(c, historyListScope(accessContext(c)));
+	const projects = await selectProjectsByOrganizationId(organizationContext.organizationId, { grantedProjectIds: grantedProjectIdsList });
+	const historyRun = await enrichHistoryRun(run, new Map(projects.map((project) => [project.id, project.name])));
+	return c.json(HistoryRunCancelResponseSchema.parse(historyRun));
+}
+//#endregion
+//#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
+const handler$44 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
+//#endregion
+//#region src/routes/account/resources/workflows.ts
+function toWorkflowSummary(row, options) {
+	return WorkflowSummarySchema.parse({
+		id: row.id,
+		slug: row.slug,
+		name: row.name?.trim() || titleCaseKey(row.slug),
+		description: row.description ?? void 0,
+		projectId: row.projectId,
+		updatedAt: row.updatedAt.toISOString(),
+		sourcePath: row.moduleFile,
+		lastRunAt: options?.lastRunAt?.toISOString()
+	});
+}
+//#endregion
+//#region src/routes/account/workflows/GET.ts
+const handler$43 = async (c) => {
+	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
+	if (filter === "empty") return c.json(WorkflowSummaryListResponseSchema.parse([]));
+	const rows = await listActiveWorkflows(filter);
+	const lastRunAtById = await selectWorkflowLastRunAtByIds(rows.map((row) => row.id));
+	return c.json(WorkflowSummaryListResponseSchema.parse(rows.map((row) => toWorkflowSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null }))));
+};
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/GET.ts
+const handler$42 = async (c) => {
+	const workflowId = c.req.param("workflowId") ?? "";
+	const row = workflowId ? await selectActiveWorkflowById(workflowId) : void 0;
+	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(WorkflowSummaryDetailResponseSchema.parse(null));
+	touchResourceActivityBestEffort({
+		userId: c.get("user").id,
+		projectId: row.projectId,
+		resourceKind: "workflow",
+		resourceId: row.id
+	});
+	const lastRunAtById = await selectWorkflowLastRunAtByIds([row.id]);
+	return c.json(WorkflowSummaryDetailResponseSchema.parse(toWorkflowSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null })));
+};
+//#endregion
+//#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
+const handler$41 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
+//#endregion
+//#region src/routes/account/resources/skills.ts
+function toSkillSummary(row) {
+	return SkillSummarySchema.parse({
+		id: row.id,
+		slug: row.slug,
+		name: row.name?.trim() || titleCaseKey(row.slug),
+		description: row.description ?? void 0,
+		projectId: row.projectId,
+		updatedAt: row.updatedAt.toISOString(),
+		sourcePath: row.moduleFile
+	});
+}
+//#endregion
+//#region src/routes/account/skills/GET.ts
+const handler$40 = async (c) => {
+	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
+	if (filter === "empty") return c.json(SkillSummaryListResponseSchema.parse([]));
+	const rows = await listActiveSkills(filter);
+	return c.json(SkillSummaryListResponseSchema.parse(rows.map(toSkillSummary)));
+};
+//#endregion
+//#region src/routes/account/skills/[skillId]/GET.ts
+const handler$39 = async (c) => {
+	const skillId = c.req.param("skillId") ?? "";
+	const row = skillId ? await selectActiveSkillById(skillId) : void 0;
+	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(SkillSummaryDetailResponseSchema.parse(null));
+	touchResourceActivityBestEffort({
+		userId: c.get("user").id,
+		projectId: row.projectId,
+		resourceKind: "skill",
+		resourceId: row.id
+	});
+	return c.json(SkillSummaryDetailResponseSchema.parse(toSkillSummary(row)));
+};
+//#endregion
+//#region src/routes/account/resources/recents.ts
+function toRecentResource(activity, resource, projectName) {
+	return RecentResourceSchema.parse({
+		id: activity.id,
+		resourceKind: activity.resourceKind,
+		resourceId: activity.resourceId,
+		name: resource.name,
+		projectId: resource.projectId,
+		projectName,
+		sourcePath: resource.sourcePath,
+		source: "owned",
+		lastOpenedAt: activity.lastOpenedAt.toISOString(),
+		lastModifiedAt: resource.lastModifiedAt.toISOString()
+	});
+}
+function hydrateRecentResource(activity, lookup, projectNameById) {
+	const resource = lookup[activity.resourceKind]?.get(activity.resourceId);
+	if (!resource) return null;
+	return toRecentResource(activity, resource, projectNameById.get(resource.projectId) ?? resource.projectId);
+}
+function hydratedResourceFromAgentRow(row) {
+	return {
+		name: row.name?.trim() || titleCaseKey(row.slug),
+		projectId: row.projectId,
+		sourcePath: row.moduleFile,
+		lastModifiedAt: row.updatedAt
+	};
+}
+function latestRecentInteractionAt(recent) {
+	return Math.max(new Date(recent.lastOpenedAt).getTime(), new Date(recent.lastModifiedAt).getTime());
+}
+//#endregion
+//#region src/routes/account/recents/GET.ts
+const RECENTS_LIMIT = 50;
+const handler$38 = async (c) => {
+	const userId = c.get("user").id;
+	const organization = c.get("organization");
+	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
+	const activities = await listRecentResourceActivity(userId, RECENTS_LIMIT);
+	const visibleActivities = grantedProjectIdsList === void 0 ? activities : activities.filter((activity) => grantedProjectIdsList.includes(activity.projectId));
+	const agentIds = visibleActivities.filter((activity) => activity.resourceKind === "agent").map((activity) => activity.resourceId);
+	const workflowIds = visibleActivities.filter((activity) => activity.resourceKind === "workflow").map((activity) => activity.resourceId);
+	const skillIds = visibleActivities.filter((activity) => activity.resourceKind === "skill").map((activity) => activity.resourceId);
+	const [agents, workflows, skills, projects] = await Promise.all([
+		selectActiveAgentsByIds(agentIds),
+		selectActiveWorkflowsByIds(workflowIds),
+		selectActiveSkillsByIds(skillIds),
+		selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList })
+	]);
+	const projectNameById = new Map(projects.map((project) => [project.id, project.name]));
+	const lookup = {
+		agent: new Map(agents.map((row) => [row.id, hydratedResourceFromAgentRow(row)])),
+		workflow: new Map(workflows.map((row) => [row.id, hydratedResourceFromAgentRow(row)])),
+		skill: new Map(skills.map((row) => [row.id, hydratedResourceFromAgentRow(row)]))
+	};
+	const recents = visibleActivities.map((activity) => hydrateRecentResource(activity, lookup, projectNameById)).filter((recent) => recent !== null).sort((left, right) => latestRecentInteractionAt(right) - latestRecentInteractionAt(left));
+	return c.json(RecentResourceListResponseSchema.parse(recents));
+};
+//#endregion
+//#region src/routes/account/projects/GET.ts
+const handler$37 = async (c) => {
+	const organization = c.get("organization");
+	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
+	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
+	return c.json(ListProjectsResponseSchema.parse({ projects: projects.map(mapProject) }));
+};
+//#endregion
+//#region src/routes/account/projects/metrics/merge-project-list-metrics.ts
+function mergeProjectListMetrics(input) {
+	const projectIds = new Set([...Object.keys(input.resourceCounts), ...Object.keys(input.lastDeploymentAtByProject)]);
+	const metrics = {};
+	for (const projectId of projectIds) {
+		const counts = input.resourceCounts[projectId];
+		const lastDeploymentAt = input.lastDeploymentAtByProject[projectId];
+		metrics[projectId] = {
+			agentCount: counts?.agentCount ?? 0,
+			workflowCount: counts?.workflowCount ?? 0,
+			skillCount: counts?.skillCount ?? 0,
+			credentialCount: counts?.credentialCount ?? 0,
+			lastDeploymentAt: lastDeploymentAt ? lastDeploymentAt.toISOString() : null
+		};
+	}
+	return metrics;
+}
+//#endregion
+//#region src/routes/account/projects/metrics/GET.ts
+const handler$36 = async (c) => {
+	const organization = c.get("organization");
+	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
+	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([selectProjectResourceCounts(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), selectLastDeploymentAtByProject(organization.organizationId)]);
+	let metrics = mergeProjectListMetrics({
+		resourceCounts,
+		lastDeploymentAtByProject
+	});
+	if (grantedProjectIdsList !== void 0) {
+		const allowed = new Set(grantedProjectIdsList);
+		metrics = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => allowed.has(projectId)));
+	}
+	return c.json(ListProjectMetricsResponseSchema.parse({ metrics }));
+};
+//#endregion
+//#region src/routes/account/projects/POST.ts
+const handler$35 = async (c) => {
+	const organization = c.get("organization");
+	const user = c.get("user");
+	const body = await c.req.json().catch(() => null);
+	const parsed = CreateProjectRequestSchema.safeParse(body);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Project name is required" }), 400);
+	const project = await createProjectForOrganization(organization.organizationId, parsed.data.name, parsed.data.description, user.id);
+	return c.json(CreateProjectResponseSchema.parse({ project: mapProject(project) }), 201);
+};
+//#endregion
+//#region src/routes/account/projects/slug-available/GET.ts
+const handler$34 = async (c) => {
+	const organization = c.get("organization");
+	const parsed = ProjectSlugAvailabilityQuerySchema.safeParse({
+		slug: c.req.query("slug"),
+		excludeProjectId: c.req.query("excludeProjectId")
+	});
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
+	const availability = await checkProjectSlugAvailability(organization.organizationId, parsed.data.slug, parsed.data.excludeProjectId);
+	return c.json(ProjectSlugAvailabilityResponseSchema.parse(availability));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/GET.ts
+const handler$33 = async (c) => {
+	return c.json(ProjectResponseSchema.parse({ project: routeProject(c.get("project")) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/PATCH.ts
+const handler$32 = async (c) => {
+	const organization = c.get("organization");
+	const project = c.get("project");
+	const body = await c.req.json().catch(() => null);
+	const parsed = UpdateProjectRequestSchema.safeParse(body);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid project update request" }), 400);
+	let updated;
+	try {
+		updated = await updateProjectForOrganization(organization.organizationId, project.id, parsed.data);
+	} catch (error) {
+		if (error instanceof ProjectSlugTakenError) return c.json(ErrorResponseSchema.parse({ error: PROJECT_SLUG_TAKEN_MESSAGE }), 409);
+		throw error;
+	}
+	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
+	return c.json(ProjectResponseSchema.parse({ project: mapProject(updated) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/DELETE.ts
+const handler$31 = async (c) => {
+	const organization = c.get("organization");
+	const project = c.get("project");
+	if (!await deleteProjectForOrganization(organization.organizationId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
+	return c.body(null, 204);
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/deployments/GET.ts
+const handler$30 = async (c) => {
+	const rows = await selectProjectDeployments(c.get("project").id);
+	return c.json(ListProjectDeploymentsResponseSchema.parse({ deployments: rows.map(mapProjectDeployment) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/POST.ts
+const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
+const ARTIFACT_CONTENT_TYPE = "application/gzip";
+const handler$29 = async (c) => {
+	const project = c.get("project");
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json({ error: "Organization not found" }, 404);
+	const artifactId = crypto.randomUUID();
+	const storageKey = projectArtifactKey(project.id, artifactId);
+	const storage = createOrgStorageClient(organization);
+	const artifact = await insertProjectArtifact({
+		id: artifactId,
+		projectId: project.id,
+		storageKey,
+		createdByUserId: c.get("user").id
+	});
+	const uploadUrl = await storage.presignPut({
+		key: storageKey,
+		contentType: ARTIFACT_CONTENT_TYPE,
+		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS$1
+	});
+	return c.json(CreateProjectArtifactResponseSchema.parse({
+		artifact: mapProjectArtifact(artifact),
+		uploadUrl,
+		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS$1
+	}), 201);
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
+const DEFAULT_PRESIGN_TTL_SECONDS = 900;
+const handler$28 = async (c) => {
+	const project = c.get("project");
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json({ error: "Organization not found" }, 404);
+	const artifact = await selectActiveProjectArtifactForProject(project.id);
+	if (!artifact) return c.json({ error: "No active artifact for project" }, 404);
+	const downloadUrl = await createOrgStorageClient(organization).presignGet({
+		key: artifact.storageKey,
+		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS
+	});
+	return c.json(DownloadActiveProjectArtifactResponseSchema.parse({
+		artifactId: artifact.id,
+		downloadUrl,
+		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS
+	}));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/complete/POST.ts
+const handler$27 = async (c) => {
+	const project = c.get("project");
+	const artifactId = c.req.param("artifactId");
+	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
+	const existing = await selectProjectArtifactForProject(artifactId, project.id);
+	if (!existing) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
+	if (existing.status === "ready") return c.json(ErrorResponseSchema.parse({ error: "Artifact already completed" }), 409);
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const storage = createOrgStorageClient(organization);
+	const head = await storage.headObject(existing.storageKey);
+	if (!head || head.contentLength <= 0) return c.json(ErrorResponseSchema.parse({ error: "Artifact upload not found in storage" }), 400);
+	try {
+		const artifactBytes = await storage.getObject(existing.storageKey);
+		if (!artifactBytes || artifactBytes.byteLength <= 0) return c.json(ErrorResponseSchema.parse({ error: "Artifact upload not found in storage" }), 400);
+		const manifestJson = parseStoredRouteManifest(extractRouteManifestFromArtifact(Buffer.from(artifactBytes)));
+		const result = await completeProjectArtifact({
+			artifactId,
+			projectId: project.id,
+			manifestJson
+		});
+		await enqueueProjectRuntime({
+			projectId: project.id,
+			name: project.name,
+			artifactId
+		});
+		return c.json(CompleteProjectArtifactResponseSchema.parse({
+			artifact: mapProjectArtifact(result.artifact),
+			project: mapProject(result.project)
+		}));
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Failed to complete artifact";
+		return c.json(ErrorResponseSchema.parse({ error: message }), 400);
+	}
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
+const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
+const handler$26 = async (c) => {
+	const project = c.get("project");
+	const artifactId = c.req.param("artifactId");
+	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
+	if (!await selectProjectArtifactForProject(artifactId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
+	const parsed = PresignProjectSourceRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid blob list" }), 400);
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const storage = createOrgStorageClient(organization);
+	const hashes = [...new Set(parsed.data.blobs.map((blob) => blob.hash))];
+	const uploads = await Promise.all(hashes.map(async (hash) => {
+		const key = projectSourceBlobKey(project.id, hash);
+		const head = await storage.headObject(key);
+		if (head && head.contentLength > 0) return null;
+		return {
+			hash,
+			url: await storage.presignPut({
+				key,
+				contentType: SOURCE_BLOB_CONTENT_TYPE
+			})
+		};
+	}));
+	return c.json(PresignProjectSourceResponseSchema.parse({ uploads: uploads.filter((upload) => upload !== null) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
+const handler$25 = async (c) => {
+	const project = c.get("project");
+	const artifactId = c.req.param("artifactId");
+	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
+	if (!await selectProjectArtifactForProject(artifactId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
+	const parsed = UploadProjectSourceManifestRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid source manifest" }), 400);
+	const manifest = StoredProjectSourceManifestSchema.parse({
+		files: parsed.data.files.map((file) => ({
+			id: projectFileId(file.path),
+			path: file.path,
+			hash: file.hash
+		})),
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	await updateProjectArtifactSourceManifest({
+		artifactId,
+		projectId: project.id,
+		sourceManifestJson: manifest
+	});
+	return c.json(UploadProjectSourceResponseSchema.parse({
+		ok: true,
+		fileCount: manifest.files.length
+	}), 201);
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/files/GET.ts
+/**
+* Resolve registry moduleFile values to paths in the deploy source snapshot.
+*
+* New deploys store project-root-relative source paths (`src/agents/support.ts`),
+* matched exactly. Rows synced by older runtimes hold module-dir-relative values
+* (`support.ts` under `src/agents/`), matched by suffix. Resources without a
+* match are dropped rather than emitting paths clients can't find in the tree.
+*/
+function resolveSourcePaths(rows, kindDir, filePaths) {
+	return rows.flatMap((row) => {
+		const suffix = `${kindDir}/${row.moduleFile}`;
+		const path = filePaths.find((filePath) => filePath === row.moduleFile) ?? filePaths.find((filePath) => filePath === suffix || filePath.endsWith(`/${suffix}`));
+		return path ? [{
+			slug: row.slug,
+			path
+		}] : [];
+	});
+}
+const handler$24 = async (c) => {
+	const project = c.get("project");
+	const active = await selectActiveArtifactSourceManifestForProject(project.id);
+	if (!active || !active.sourceManifestJson) return c.json(ListProjectFilesResponseSchema.parse({
+		artifactId: active?.artifactId ?? null,
+		files: []
+	}));
+	const manifest = StoredProjectSourceManifestSchema.parse(active.sourceManifestJson);
+	const [agents, workflows, skills] = await Promise.all([
+		listActiveAgents({ projectIds: [project.id] }),
+		listActiveWorkflows({ projectIds: [project.id] }),
+		listActiveSkills({ projectIds: [project.id] })
+	]);
+	const filePaths = manifest.files.map((file) => file.path);
+	const resources = ProjectSourceResourcesSchema.parse({
+		agents: resolveSourcePaths(agents, "agents", filePaths),
+		workflows: resolveSourcePaths(workflows, "workflows", filePaths),
+		skills: skills.map((row) => ({
+			slug: row.slug,
+			path: row.moduleFile
+		}))
+	});
+	return c.json(ListProjectFilesResponseSchema.parse({
+		artifactId: active.artifactId,
+		files: manifest.files.map((file) => ({
+			id: file.id,
+			path: file.path,
+			hash: file.hash
+		})),
+		resources
+	}));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
+const handler$23 = async (c) => {
+	const project = c.get("project");
+	const artifactId = c.req.param("artifactId");
+	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
+	const path = c.req.query("path");
+	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
+	const artifact = await selectProjectArtifactForProject(artifactId, project.id);
+	if (!artifact || !artifact.sourceManifestJson) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
+	const file = StoredProjectSourceManifestSchema.parse(artifact.sourceManifestJson).files.find((entry) => entry.path === path);
+	if (!file) return c.json(ErrorResponseSchema.parse({ error: "File not found" }), 404);
+	const { organizationId } = c.get("organization");
+	const organization = await selectOrganizationById(organizationId);
+	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const storage = createOrgStorageClient(organization);
+	let bytes;
+	try {
+		bytes = await storage.getObject(projectSourceBlobKey(project.id, file.hash));
+	} catch {
+		return c.json(ErrorResponseSchema.parse({ error: "File contents not found" }), 404);
+	}
+	c.header("Content-Type", "text/plain; charset=utf-8");
+	return c.body(new TextDecoder().decode(bytes));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/reachability/GET.ts
+function createProjectReachabilityHandler(hosting) {
+	return async (c) => {
+		const project = c.get("project");
+		if (project.status !== "active") return c.json(ProjectReachabilityResponseSchema.parse({ reachable: false }));
+		const reachable = await pingProjectTarget({
+			baseUrl: project.baseUrl,
+			runtimeId: project.runtimeId
+		}, { plugin: hosting });
+		return c.json(ProjectReachabilityResponseSchema.parse({ reachable }));
+	};
+}
+//#endregion
+//#region src/routes/account/projects/[projectId]/members/GET.ts
+const handler$22 = async (c) => {
+	const project = c.get("project");
+	const currentUserId = c.get("user").id;
+	const members = await selectProjectMembers(project.id);
+	return c.json(ListProjectMembersResponseSchema.parse({ members: members.map((member) => mapProjectMember(member, { isCurrentUser: member.id === currentUserId })) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/members/POST.ts
+const handler$21 = async (c) => {
+	const organization = c.get("organization");
+	const project = c.get("project");
+	const body = await c.req.json().catch(() => null);
+	const parsed = InviteProjectMembersRequestSchema.safeParse(body);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid invite request" }), 400);
+	const results = await inviteProjectMembers({
+		projectId: project.id,
+		organizationId: organization.organizationId,
+		emails: parsed.data.emails,
+		role: parsed.data.role
+	});
+	return c.json(InviteProjectMembersResponseSchema.parse({ results }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
+const handler$20 = async (c) => {
+	const project = c.get("project");
+	const userId = c.req.param("userId");
+	const body = await c.req.json().catch(() => null);
+	const parsed = UpdateProjectMemberRequestSchema.safeParse(body);
+	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
+	try {
+		const member = await updateProjectMemberRole(project.id, userId, parsed.data.role);
+		return c.json(UpdateProjectMemberResponseSchema.parse({ member: mapProjectMember(member) }));
+	} catch (error) {
+		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
+const handler$19 = async (c) => {
+	const project = c.get("project");
+	const userId = c.req.param("userId");
+	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
+	try {
+		await removeProjectMember(project.id, userId);
+		return c.body(null, 204);
+	} catch (error) {
+		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
+const handler$18 = async (c) => {
+	const project = c.get("project");
+	const userId = c.get("user").id;
+	try {
+		await removeProjectMember(project.id, userId);
+		return c.body(null, 204);
+	} catch (error) {
+		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/settings/GET.ts
+const handler$17 = async (c) => {
+	const project = c.get("project");
+	return c.json(ProjectSettingsResponseSchema.parse({ settings: mapProjectSettings(project) }));
+};
+//#endregion
+//#region src/routes/account/projects/[projectId]/settings/PATCH.ts
+const handler$16 = async (c) => {
+	const organization = c.get("organization");
+	const project = c.get("project");
+	const body = await c.req.json().catch(() => null);
+	const parsed = UpdateProjectSettingsRequestSchema.safeParse(body);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid project settings request" }), 400);
+	const updated = await updateProjectSettings(organization.organizationId, project.id, {
+		description: parsed.data.description,
+		defaultMemberRole: parsed.data.defaultRole,
+		invitePermission: parsed.data.invitePermission
+	});
+	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
+	return c.json(ProjectSettingsResponseSchema.parse({ settings: mapProjectSettings(updated) }));
+};
+//#endregion
+//#region src/routes/account/credentials/enrich.ts
+const APP_CREDENTIAL_SCOPES = [
+	"user",
+	"project",
+	"organization"
+];
+function toAppCredentialScope(scopeType) {
+	return APP_CREDENTIAL_SCOPES.includes(scopeType) ? scopeType : null;
+}
+/** Run `fn` with the row's project scope bound (no-op for org/user rows). */
+function withCredentialRowScope(row, fn) {
+	if (row.scopeType === "project") return runWithProjectScope(row.projectId, fn);
+	return fn();
+}
+/** User-scoped credentials are only manageable by their owner. */
+function canManageCredential(row, userId) {
+	if (row.scopeType === "user") return userId !== void 0 && row.scopeId === userId;
+	return true;
+}
+/** Display name derived from the credential key (e.g. `google-drive` → `Google Drive`). */
+function displayAppName(appId) {
+	return displayCredentialAppName(appId);
+}
+/** Masked preview of a secret — last 4 chars revealed, the rest masked. Plaintext never returned. */
+function maskSecretPreview(value) {
+	const trimmed = value.trim();
+	if (trimmed.length <= 4) return "•".repeat(Math.max(trimmed.length, 4));
+	return `${"•".repeat(Math.min(trimmed.length - 4, 20))}${trimmed.slice(-4)}`;
+}
+async function readSecretKeyPreviews(instanceId) {
+	const payload = await readCredentialInstanceSecret(instanceId);
+	if (!payload) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(payload);
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const keyPreviews = {};
+	for (const [key, value] of Object.entries(parsed)) keyPreviews[key] = maskSecretPreview(typeof value === "string" ? value : JSON.stringify(value));
+	const credentialKeys = Object.keys(keyPreviews);
+	return credentialKeys.length > 0 ? {
+		credentialKeys,
+		keyPreviews
+	} : null;
+}
+function ownerFields(owner) {
+	if (!owner) return {};
+	return {
+		ownerUserId: owner.id,
+		ownerName: owner.name,
+		...owner.image && URL.canParse(owner.image) ? { ownerAvatarUrl: owner.image } : {}
+	};
+}
+function uniqueIds(rows, pick) {
+	return [...new Set(rows.map(pick).filter((id) => Boolean(id)))];
+}
+/** Cross-database lookups: instances live in the org DB; projects/users/connections in the platform DB. */
+async function loadCredentialLookups(rows, organizationId) {
+	const [projects, owners, connections] = await Promise.all([
+		selectProjectsByOrganizationId(organizationId),
+		selectUsersByIds(uniqueIds(rows, (row) => row.scopeType === "user" ? row.scopeId : null)),
+		selectOAuthConnectionsByIds(uniqueIds(rows, (row) => row.authKind === "oauth_managed" ? row.connectionId : null))
+	]);
+	return {
+		projectNameById: new Map(projects.map((project) => [project.id, project.name])),
+		ownersById: new Map(owners.map((owner) => [owner.id, owner])),
+		connectionsById: new Map(connections.map((connection) => [connection.id, connection]))
+	};
+}
+async function toCredentialSummary(row, scope, lookups) {
+	const isOAuth = row.authKind === "oauth_managed";
+	const isKeystroke = row.authKind === "keystroke";
+	const appName = displayAppName(row.slug);
+	const connection = row.connectionId ? lookups.connectionsById.get(row.connectionId) : void 0;
+	const secretKeys = isOAuth || isKeystroke ? null : await readSecretKeyPreviews(row.id);
+	const projectId = scope === "project" ? row.scopeId ?? row.projectId : void 0;
+	const projectName = projectId ? lookups.projectNameById.get(projectId) : void 0;
+	return {
+		id: row.id,
+		appId: row.slug,
+		label: row.label ?? appName,
+		scope,
+		lastRefreshedAt: isOAuth ? connection?.updatedAt.toISOString() ?? null : null,
+		appName,
+		...projectId ? { projectId } : {},
+		...projectName ? { projectName } : {},
+		status: isOAuth && !connection ? "Disconnected" : "Active",
+		createdAt: row.createdAt.toISOString(),
+		lastUsedAt: null,
+		isDefault: Boolean(row.isDefault),
+		connectionKind: isOAuth ? "oauth" : isKeystroke ? "oauth" : "manual",
+		...scope === "user" && row.scopeId ? ownerFields(lookups.ownersById.get(row.scopeId)) : {},
+		...connection?.grantedScopes?.length ? { grantedScopes: connection.grantedScopes } : {},
+		...secretKeys ?? {},
+		...connection?.accessTokenExpiresAt ? { expiresAt: connection.accessTokenExpiresAt.toISOString() } : {}
+	};
+}
+/** Build `AppCredentialSummary` rows from org-database instances plus platform lookups. */
+async function enrichCredentialInstances(rows, organizationId) {
+	const visible = rows.filter((row) => toAppCredentialScope(row.scopeType) !== null);
+	const lookups = await loadCredentialLookups(visible, organizationId);
+	return (await Promise.all(visible.map((row) => toCredentialSummary(row, toAppCredentialScope(row.scopeType), lookups)))).sort((a, b) => new Date(b.createdAt ?? 0).getTime() - new Date(a.createdAt ?? 0).getTime());
+}
+//#endregion
+//#region src/routes/account/credentials/GET.ts
+const handler$15 = async (c) => {
+	const organization = c.get("organization");
+	const credentials = await enrichCredentialInstances(await listAllCredentialInstances(), organization.organizationId);
+	return c.json(ListCredentialsResponseSchema.parse({ credentials }));
+};
+//#endregion
+//#region src/routes/account/credentials/POST.ts
+function withTargetScope(target, fn) {
+	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
+	return fn();
+}
+const handler$14 = async (c) => {
+	const organization = c.get("organization");
+	const user = c.get("user");
+	const parsed = CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json({ error: message }, 400);
+	}
+	const input = parsed.data;
+	const resolvedProjects = [];
+	for (const slug of input.projects) {
+		const project = await selectProjectForOrganizationBySlug(organization.organizationId, slug);
+		if (!project) return c.json({ error: `Project "${slug}" not found` }, 400);
+		resolvedProjects.push({
+			id: project.id,
+			name: project.name
+		});
+	}
+	const targets = [
+		...resolvedProjects.map((project) => ({
+			scopeType: "project",
+			scopeId: project.id,
+			projectScope: project.id,
+			projectName: project.name
+		})),
+		...input.createOrganizationCredential ? [{
+			scopeType: "organization",
+			scopeId: getServerTenantScopeId()
+		}] : [],
+		...input.createUserProvidedCredential ? [{
+			scopeType: "user",
+			scopeId: user.id
+		}] : []
+	];
+	const appName = displayCredentialAppName(input.appId);
+	const siblingCounts = /* @__PURE__ */ new Map();
+	for (const target of targets) {
+		const siblings = await withTargetScope(target, () => selectCredentialInstancesForScope(input.appId, target.scopeType, target.scopeId));
+		siblingCounts.set(target, siblings.length);
+	}
+	const value = input.value;
+	const createdIds = [];
+	for (const target of targets) {
+		const siblings = await withTargetScope(target, () => selectCredentialInstancesForScope(input.appId, target.scopeType, target.scopeId));
+		const label = resolveUniqueCredentialInstanceLabel({
+			baseLabel: buildCredentialInstanceLabel({
+				scopeType: target.scopeType,
+				appName,
+				projectName: target.projectName
+			}),
+			takenLabels: siblings.map((row) => row.label)
+		});
+		const id = crypto.randomUUID();
+		await withTargetScope(target, () => setCredentialInstanceSecret({
+			id,
+			key: input.appId,
+			scopeType: target.scopeType,
+			scopeId: target.scopeId,
+			label,
+			isDefault: (siblingCounts.get(target) ?? 0) === 0,
+			value
+		}));
+		createdIds.push(id);
+	}
+	const rows = [];
+	for (const id of createdIds) {
+		const row = await selectCredentialInstanceById(id);
+		if (row) rows.push(row);
+	}
+	const credentials = await enrichCredentialInstances(rows, organization.organizationId);
+	return c.json(CreateCredentialsResponseSchema.parse({ credentials }), 201);
+};
+//#endregion
+//#region src/routes/account/credentials/[credentialId]/GET.ts
+const handler$13 = async (c) => {
+	const organization = c.get("organization");
+	const credentialId = c.req.param("credentialId") ?? "";
+	const row = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
+	if (!row || toAppCredentialScope(row.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
+	const [credential] = await enrichCredentialInstances([row], organization.organizationId);
+	return c.json(GetCredentialResponseSchema.parse({ credential }));
+};
+//#endregion
+//#region src/routes/account/credentials/[credentialId]/PATCH.ts
+const handler$12 = async (c) => {
+	const organization = c.get("organization");
+	const user = c.get("user");
+	const credentialId = c.req.param("credentialId") ?? "";
+	const existing = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
+	if (!existing || toAppCredentialScope(existing.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
+	if (!canManageCredential(existing, user.id)) return c.json({ error: "Forbidden" }, 403);
+	const parsed = UpdateCredentialRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json({ error: message }, 400);
+	}
+	if (parsed.data.value && existing.authKind !== "api_key") return c.json({ error: "Only api-key credentials support secret rotation" }, 400);
+	const label = parsed.data.label !== void 0 ? parsed.data.label : existing.label;
+	const isDefault = parsed.data.isDefault !== void 0 ? parsed.data.isDefault : Boolean(existing.isDefault);
+	if (label !== existing.label) {
+		if ((await withCredentialRowScope(existing, () => selectCredentialInstancesForScope(existing.slug, existing.scopeType, existing.scopeId))).some((row) => row.id !== credentialId && (row.label ?? null) === label)) return c.json({ error: "A credential with this label already exists" }, 409);
+	}
+	await withCredentialRowScope(existing, async () => {
+		if (parsed.data.value) {
+			await setCredentialInstanceSecret({
+				id: existing.id,
+				key: existing.slug,
+				scopeType: existing.scopeType,
+				scopeId: existing.scopeId,
+				label,
+				isDefault,
+				value: parsed.data.value
+			});
+			return;
+		}
+		if (isDefault) await clearCredentialInstanceDefaults({
+			slug: existing.slug,
+			scopeType: existing.scopeType,
+			scopeId: existing.scopeId,
+			exceptId: credentialId
+		});
+		await upsertCredentialInstance({
+			id: existing.id,
+			slug: existing.slug,
+			scopeType: existing.scopeType,
+			scopeId: existing.scopeId,
+			label,
+			isDefault,
+			authKind: existing.authKind,
+			ciphertext: existing.ciphertext,
+			connectionId: existing.connectionId,
+			createdAt: existing.createdAt,
+			updatedAt: /* @__PURE__ */ new Date()
+		});
+	});
+	const updated = await selectCredentialInstanceById(credentialId);
+	const [credential] = await enrichCredentialInstances(updated ? [updated] : [], organization.organizationId);
+	return c.json(GetCredentialResponseSchema.parse({ credential }));
+};
+//#endregion
+//#region src/routes/account/credentials/[credentialId]/DELETE.ts
+function createDeleteCredentialHandler(options = {}) {
+	return async (c) => {
+		const user = c.get("user");
+		const credentialId = c.req.param("credentialId") ?? "";
+		const existing = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
+		if (!existing || toAppCredentialScope(existing.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
+		if (!canManageCredential(existing, user.id)) return c.json({ error: "Forbidden" }, 403);
+		if (existing.authKind === "oauth_managed") {
+			if (existing.connectionId) {
+				if ((await listCredentialInstancesByConnectionId(existing.connectionId)).every((row) => row.id === existing.id)) await deleteOAuthConnectionById(existing.connectionId);
+			}
+		} else if (existing.authKind === "keystroke") {
+			if (existing.connectionId) {
+				if ((await listCredentialInstancesByConnectionId(existing.connectionId)).every((row) => row.id === existing.id)) {
+					if (!options.mcp) return c.json({ error: "mcp_unconfigured" }, 501);
+					await options.mcp.revokeConnection(resolveMcpEntityId(existing), existing.connectionId);
+				}
+			}
+		} else await deleteCredentialInstanceSecret(existing.id);
+		await deleteCredentialInstanceById(credentialId);
+		return c.body(null, 204);
+	};
+}
+//#endregion
+//#region src/routes/account/members/GET.ts
+const handler$11 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const members = await selectOrganizationMembers(organizationId);
+	return c.json(ListOrganizationMembersResponseSchema.parse({ members: members.map(mapOrganizationMember) }));
+};
+//#endregion
+//#region src/email/organization-invite-email.ts
+function envValue(name) {
+	return process.env[name]?.trim() || void 0;
+}
+function resolveOrganizationInviteUrl(invitationId) {
+	return `${(envValue("PUBLIC_WEB_URL") ?? "http://localhost:3000").replace(/\/$/, "")}${organizationInvitationAcceptPath(invitationId)}`;
+}
+function resolveResendApiKey() {
+	return envValue("RESEND_API_KEY");
+}
+function buildOrganizationInviteEmailHtml(payload) {
+	const inviteUrl = resolveOrganizationInviteUrl(payload.invitationId);
+	const escapedOrg = payload.organizationName.replaceAll("&", "&amp;").replaceAll("<", "&lt;");
+	return `<!DOCTYPE html>
+<html>
+  <body style="font-family: system-ui, sans-serif; line-height: 1.5; color: #111;">
+    ${payload.inviterName ? `<p>${payload.inviterName.replaceAll("&", "&amp;").replaceAll("<", "&lt;")} invited you to join <strong>${escapedOrg}</strong> on Keystroke.</p>` : `<p>You have been invited to join <strong>${escapedOrg}</strong> on Keystroke.</p>`}
+    <p><a href="${inviteUrl}" style="display: inline-block; padding: 10px 16px; background: #111; color: #fff; text-decoration: none; border-radius: 8px;">View invitation</a></p>
+    <p style="color: #666; font-size: 13px;">Sign in with this email address to accept the invitation.</p>
+  </body>
+</html>`;
+}
+async function sendOrganizationInviteEmail(payload, resend) {
+	const apiKey = resolveResendApiKey();
+	if (!apiKey) {
+		console.warn("[platform] RESEND_API_KEY not set; organization invite email skipped");
+		return false;
+	}
+	const { error } = await (resend ?? new Resend(apiKey)).emails.send({
+		from: resolveAuthEmailFrom(),
+		to: payload.email,
+		subject: `Invitation to join ${payload.organizationName} on Keystroke`,
+		html: buildOrganizationInviteEmailHtml(payload)
+	});
+	if (error) {
+		console.warn(`[platform] Failed to send organization invite email: ${error.message}`);
+		return false;
+	}
+	return true;
+}
+//#endregion
+//#region src/routes/account/members/invitations/POST.ts
+const handler$10 = async (c) => {
+	const user = c.get("user");
+	const organization = c.get("organization");
+	const body = await c.req.json().catch(() => null);
+	const parsed = InviteOrganizationMembersRequestSchema.safeParse(body);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid invite request" }), 400);
+	const results = await inviteOrganizationMembers({
+		organizationId: organization.organizationId,
+		invitedByUserId: user.id,
+		emails: parsed.data.emails,
+		role: parsed.data.role
+	});
+	const inviter = await selectUserById(user.id);
+	for (const result of results) {
+		if (!result.invitationId || result.status !== "sent" && result.status !== "pending") continue;
+		await sendOrganizationInviteEmail({
+			email: result.email,
+			organizationName: organization.organizationName,
+			invitationId: result.invitationId,
+			inviterName: inviter?.name
+		});
+	}
+	return c.json(InviteOrganizationMembersResponseSchema.parse({ results }));
+};
+//#endregion
+//#region src/routes/account/members/[userId]/PATCH.ts
+const handler$9 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const userId = c.req.param("userId");
+	const body = await c.req.json().catch(() => null);
+	const parsed = UpdateOrganizationMemberRequestSchema.safeParse(body);
+	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
+	try {
+		const member = await updateOrganizationMemberRole(organizationId, userId, parsed.data.role);
+		return c.json(UpdateOrganizationMemberResponseSchema.parse({ member: mapOrganizationMember(member) }));
+	} catch (error) {
+		if (error instanceof CannotModifyOwnerError || error instanceof OrganizationMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/members/[userId]/DELETE.ts
+const handler$8 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const userId = c.req.param("userId");
+	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
+	try {
+		await removeOrganizationMember(organizationId, userId);
+		return c.body(null, 204);
+	} catch (error) {
+		if (error instanceof CannotModifyOwnerError || error instanceof OrganizationMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/invitations/GET.ts
+const handler$7 = async (c) => {
+	const invitations = await selectPendingInvitationsForUser(c.get("user").id);
+	return c.json(ListOrganizationInvitationsResponseSchema.parse({ invitations: invitations.map(mapOrganizationInvitation) }));
+};
+//#endregion
+//#region src/routes/account/invitations/[invitationId]/accept/POST.ts
+const handler$6 = async (c) => {
+	const user = c.get("user");
+	const invitationId = c.req.param("invitationId");
+	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
+	try {
+		const membership = await acceptInvitation(invitationId, user.id);
+		return c.json(AcceptOrganizationInvitationResponseSchema.parse({ organization: mapUserOrganization(membership) }));
+	} catch (error) {
+		if (error instanceof OrganizationInvitationNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
+		if (error instanceof OrganizationInvitationForbiddenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 403);
+		if (error instanceof OrganizationInvitationExpiredError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 410);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/invitations/[invitationId]/decline/POST.ts
+const handler$5 = async (c) => {
+	const user = c.get("user");
+	const invitationId = c.req.param("invitationId");
+	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
+	try {
+		await declineInvitation(invitationId, user.id);
+		return c.json(DeclineOrganizationInvitationResponseSchema.parse({ success: true }));
+	} catch (error) {
+		if (error instanceof OrganizationInvitationNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
+		if (error instanceof OrganizationInvitationForbiddenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 403);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/apps/map-catalog.ts
+/** Map a platform `apps` row to the connect-picker wire shape. */
+function appRowToCatalogEntry(row) {
+	return {
+		id: row.slug,
+		name: row.name,
+		description: row.description,
+		category: row.category,
+		integrationDescription: row.description,
+		...row.logo ? { logo: row.logo } : {},
+		authKind: row.authKind,
+		oauthScopes: row.oauthScopes
+	};
+}
+//#endregion
+//#region src/routes/account/apps/GET.ts
+const handler$4 = async (c) => {
+	const apps = (await listOfficialApps()).map(appRowToCatalogEntry);
+	return c.json(ListAppsResponseSchema.parse({ apps }));
+};
+//#endregion
+//#region src/routes/account/api-keys/GET.ts
+const handler$3 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const user = c.get("user");
+	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await listOrgPlatformApiKeysForOrganization(organizationId) : await listOrgPlatformApiKeysForUser(organizationId, user.id);
+	const creators = await selectUsersByIds([...new Set(records.map((record) => record.createdByUserId))]);
+	const creatorsById = new Map(creators.map((creator) => [creator.id, creator]));
+	return c.json(ListApiKeysResponseSchema.parse({ apiKeys: records.map((record) => ({
+		id: record.id,
+		name: record.name,
+		keyPreview: record.keyPreview,
+		createdAt: record.createdAt.toISOString(),
+		createdBy: mapOrgPlatformApiKeyCreatorOrDeleted(record.createdByUserId, creatorsById.get(record.createdByUserId)),
+		isCreatedByCurrentUser: record.createdByUserId === user.id
+	})) }));
+};
+//#endregion
+//#region src/routes/account/api-keys/POST.ts
+const handler$2 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const user = c.get("user");
+	const body = CreateApiKeyRequestSchema.parse(await c.req.json());
+	const created = await createOrgPlatformApiKey({
+		organizationId,
+		userId: user.id,
+		name: body.name
+	});
+	const creator = await loadOrgPlatformApiKeyUser(user.id);
+	if (!creator) return c.json({ error: "User not found" }, 404);
+	return c.json(CreateApiKeyResponseSchema.parse({
+		id: created.id,
+		name: created.name,
+		keyPreview: created.keyPreview,
+		createdAt: created.createdAt.toISOString(),
+		createdBy: mapOrgPlatformApiKeyCreator(creator),
+		isCreatedByCurrentUser: true,
+		secret: created.secret
+	}), 201);
+};
+//#endregion
+//#region src/routes/account/api-keys/[apiKeyId]/DELETE.ts
+const handler$1 = async (c) => {
+	const { organizationId } = c.get("organization");
+	const user = c.get("user");
+	const apiKeyId = c.req.param("apiKeyId");
+	if (!apiKeyId) return c.json(ErrorResponseSchema.parse({ error: "API key id is required" }), 400);
+	const apiKey = await selectOrgPlatformApiKeyForOrganization(apiKeyId, organizationId);
+	if (!apiKey) return c.json(ErrorResponseSchema.parse({ error: "API key not found" }), 404);
+	if (!canReadApiKey(accessContext(c), {
+		userId: user.id,
+		createdByUserId: apiKey.createdByUserId
+	})) return c.json(ErrorResponseSchema.parse({ error: "API key not found" }), 404);
+	if (!canRevokeApiKey(accessContext(c), {
+		userId: user.id,
+		createdByUserId: apiKey.createdByUserId
+	})) return forbidden(c);
+	try {
+		await revokeOrgPlatformApiKey(apiKeyId, organizationId);
+		return c.body(null, 204);
+	} catch (error) {
+		if (error instanceof OrgPlatformApiKeyNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
+		throw error;
+	}
+};
+//#endregion
+//#region src/lib/team-request-slack.ts
+const TEAM_REQUEST_HEADINGS = {
+	"org-deletion": "Org deletion requested",
+	contact: "Contact request",
+	"enterprise-upgrade": "Enterprise upgrade requested"
+};
+function buildTeamRequestSlackPayload(input) {
+	const timestamp = input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+	const heading = TEAM_REQUEST_HEADINGS[input.type];
+	const summary = `${heading} from ${input.user.name} (${input.org.name})`;
+	const fields = [
+		{
+			type: "mrkdwn",
+			text: `*Request type:*\n${input.type}`
+		},
+		{
+			type: "mrkdwn",
+			text: `*Timestamp:*\n${timestamp}`
+		},
+		{
+			type: "mrkdwn",
+			text: `*User:*\n${input.user.name}\n${input.user.email}\n\`${input.user.id}\``
+		},
+		{
+			type: "mrkdwn",
+			text: `*Organization:*\n${input.org.name}\n\`${input.org.slug}\`\n\`${input.org.id}\``
+		}
+	];
+	const blocks = [{
+		type: "header",
+		text: {
+			type: "plain_text",
+			text: heading,
+			emoji: true
+		}
+	}, {
+		type: "section",
+		fields
+	}];
+	if (input.type === "contact" && input.message?.trim()) blocks.push({
+		type: "section",
+		text: {
+			type: "mrkdwn",
+			text: `*Message:*\n${input.message.trim()}`
+		}
+	});
+	return {
+		text: summary,
+		blocks
+	};
+}
+async function postTeamRequestToSlack(input) {
+	const webhookUrl = process.env.TEAM_SLACK_WEBHOOK_URL?.trim();
+	if (!webhookUrl) {
+		console.warn("TEAM_SLACK_WEBHOOK_URL is not set; skipping team request Slack delivery");
+		return;
+	}
+	const payload = buildTeamRequestSlackPayload(input);
+	const response = await fetch(webhookUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(payload)
+	});
+	if (!response.ok) {
+		const body = await response.text().catch(() => "");
+		throw new Error(`Failed to deliver team request to Slack (${response.status})${body ? `: ${body}` : ""}`);
+	}
+}
+//#endregion
+//#region src/routes/account/team-requests/POST.ts
+const handler = async (c) => {
+	const user = c.get("user");
+	const organizationContext = c.get("organization");
+	const parsed = SubmitTeamRequestRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json({ error: message }, 400);
+	}
+	const organization = await selectOrganizationById(organizationContext.organizationId);
+	if (!organization) return c.json({ error: "Organization not found" }, 404);
+	try {
+		await postTeamRequestToSlack({
+			type: parsed.data.type,
+			message: parsed.data.message,
+			user: {
+				id: user.id,
+				name: user.name,
+				email: user.email
+			},
+			org: {
+				id: organization.id,
+				name: organization.name,
+				slug: organization.slug
+			}
+		});
+	} catch (error) {
+		console.error("Failed to deliver team request to Slack", error);
+		return c.json({ error: "Failed to deliver team request" }, 502);
+	}
+	return c.json(SubmitTeamRequestResponseSchema.parse({ ok: true }), 200);
+};
+//#endregion
+//#region src/routes/account/mount.ts
+function mountAccountRoutes(options) {
+	const account = new Hono();
+	const orgScoped = new Hono();
+	const projectScoped = new Hono();
+	const protect = requireSession(createDefaultAuthJwtVerifier());
+	const deleteCredential = createDeleteCredentialHandler({ mcp: options.mcp });
+	account.use("/*", protect);
+	orgScoped.use("/*", protect);
+	orgScoped.use("/*", requireOrganization());
+	projectScoped.use("/*", protect);
+	projectScoped.use("/*", requireOrganization());
+	const requireOrgUpdate = authorize(organizationActions.update);
+	const requireUserManage = authorize(userActions.manage);
+	const requireUserInvite = authorize(userActions.invite);
+	const requireApiKeyCreate = authorize(apiKeysActions.create);
+	const requireInvitableRole = authorizePayload(InviteOrganizationMembersRequestSchema, ({ ctx, body }) => canInviteRole(ctx.orgRole, body.role));
+	const requireProjectMember = requireProjectMembership();
+	const requireProjectDeploy = authorize(projectActions.deploy);
+	const requireProjectUpdate = authorize(projectActions.update);
+	const requireProjectDelete = authorize(projectActions.delete);
+	const requireProjectManageMembers = authorize(projectActions.manageMembers);
+	const requireInvitableProjectRole = authorizePayload(InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
+	const requireOrgParam = requireOrganizationParam();
+	account.get("/organizations", handler$55);
+	account.get("/organizations/slug-available", handler$54);
+	account.post("/organizations", createOrganizationHandler(options));
+	account.get("/organizations/:organizationId", requireOrgParam, handler$53);
+	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$52);
+	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$51);
+	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$50);
+	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$49);
+	account.get("/invitations", handler$7);
+	account.post("/invitations/:invitationId/accept", handler$6);
+	account.post("/invitations/:invitationId/decline", handler$5);
+	account.get("/users/me/avatar", handler$60);
+	account.post("/users/me/avatar/presign", handler$59);
+	account.patch("/users/me/avatar", handler$58);
+	account.get("/users/me/preferences", handler$57);
+	account.patch("/users/me/preferences", handler$56);
+	account.get("/apps", handler$4);
+	orgScoped.get("/members", handler$11);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$10);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$9);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$8);
+	orgScoped.get("/api-keys", handler$3);
+	orgScoped.post("/api-keys", requireApiKeyCreate, handler$2);
+	orgScoped.delete("/api-keys/:apiKeyId", handler$1);
+	const withOrgDb = withOrganizationProjectDatabase();
+	orgScoped.get("/agents", withOrgDb, handler$46);
+	orgScoped.get("/agents/:agentId", withOrgDb, handler$45);
+	orgScoped.get("/workflows", withOrgDb, handler$43);
+	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$42);
+	orgScoped.get("/skills", withOrgDb, handler$40);
+	orgScoped.get("/skills/:skillId", withOrgDb, handler$39);
+	orgScoped.get("/recents", withOrgDb, handler$38);
+	orgScoped.get("/history", withOrgDb, handler$48);
+	orgScoped.post("/team-requests", handler);
+	orgScoped.get("/history/:runId", withOrgDb, handler$47);
+	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$41);
+	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$44);
+	orgScoped.get("/credentials", withOrgDb, handler$15);
+	orgScoped.post("/credentials", withOrgDb, handler$14);
+	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$13(c, next));
+	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$12);
+	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
+	orgScoped.get("/projects", handler$37);
+	orgScoped.get("/projects/slug-available", handler$34);
+	orgScoped.get("/projects/metrics", withOrgDb, handler$36);
+	orgScoped.post("/projects", handler$35);
+	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$33);
+	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$32);
+	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$31);
+	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$17);
+	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$16);
+	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$22);
+	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$21);
+	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$20);
+	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$19);
+	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$18);
+	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
+	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$24);
+	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$23);
+	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$30);
+	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
+	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
+	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$27);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$26);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$25);
+	orgScoped.route("/projects", projectScoped);
+	account.route("/", orgScoped);
+	return account;
+}
+//#endregion
+//#region src/middleware/require-worker-token.ts
+/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */
+function readWorkerTokenFromRequest(c) {
+	const authorization = c.req.header("authorization");
+	if (authorization?.startsWith("Bearer ")) return authorization.slice(7).trim();
+	const apiKey = c.req.header("x-api-key")?.trim();
+	if (apiKey) return apiKey;
+}
+function requireWorkerToken(expectedToken) {
+	return async (c, next) => {
+		if (!expectedToken) return c.json({
+			error: "worker_auth_unconfigured",
+			message: "Worker auth is not configured."
+		}, 503);
+		const token = readWorkerTokenFromRequest(c);
+		if (!token || token !== expectedToken) return c.json({
+			error: "unauthorized",
+			message: "Invalid worker token."
+		}, 401);
+		await next();
+	};
+}
+//#endregion
+//#region src/routes/internal/web-search-proxy.ts
+const EXA_API_ORIGIN = "https://api.exa.ai";
+async function proxyExaWebSearchRequest(options) {
+	const apiKey = options.apiKey?.trim();
+	if (!apiKey) return Response.json({ error: "web_search_unconfigured" }, { status: 501 });
+	const target = new URL(`${EXA_API_ORIGIN}/${options.path.replace(/^\/+/, "")}`);
+	target.search = new URL(options.requestUrl).search;
+	const response = await (options.fetchImpl ?? fetch)(target, {
+		method: options.method,
+		headers: {
+			"content-type": "application/json",
+			"x-api-key": apiKey
+		},
+		body: options.method === "GET" || options.method === "HEAD" ? void 0 : options.body
+	});
+	const headers = new Headers(response.headers);
+	headers.delete("content-encoding");
+	headers.delete("transfer-encoding");
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+//#region src/routes/internal/with-project-scope.ts
+async function withProjectScope(projectId, fn) {
+	const project = await selectProjectById(projectId);
+	if (!project) return;
+	const organization = await selectOrganizationById(project.organizationId);
+	if (!organization) return;
+	const url = resolveOrgDatabaseUrl(organization);
+	let result;
+	await runWithOrganizationScope(project.organizationId, () => runWithProjectDatabase({
+		url,
+		searchPath: organization.dbSchema
+	}, () => runWithProjectScope(project.id, () => runWithTenantScope(project.organizationId, async () => {
+		result = await fn({
+			organizationId: project.organizationId,
+			projectId: project.id
+		});
+	}))));
+	return result;
+}
+//#endregion
+//#region src/routes/internal/mount.ts
+const EnsureWebhookRouteBodySchema = z.object({
+	route: z.string().trim().min(1),
+	attachmentKeys: z.array(z.string().trim().min(1)).min(1)
+});
+const SandboxSessionBodySchema = z.object({
+	agentId: z.string().trim().min(1),
+	sessionId: z.string().trim().min(1)
+});
+const SandboxExecBodySchema = SandboxSessionBodySchema.extend({
+	script: z.string(),
+	options: z.object({
+		cwd: z.string().optional(),
+		env: z.record(z.string(), z.string()).optional(),
+		stdin: z.string().optional()
+	}).optional()
+});
+const SandboxReadBodySchema = SandboxSessionBodySchema.extend({ path: z.string().trim().min(1) });
+const SandboxWriteBodySchema = SandboxSessionBodySchema.extend({
+	path: z.string().trim().min(1),
+	content: z.string()
+});
+function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy) {
+	const internal = new Hono();
+	const protect = requireWorkerToken(workerToken);
+	const materialize = createCredentialMaterializeHandler(tokenRefresh);
+	internal.use("/*", protect);
+	internal.post("/projects/:projectId/credentials/materialize", async (c) => {
+		const response = await withProjectScope(c.req.param("projectId"), async () => materialize(c));
+		if (response === void 0) return c.json({ error: "Project not found" }, 404);
+		return response ?? c.json({
+			error: "internal_error",
+			message: "Failed to materialize credential."
+		}, 500);
+	});
+	internal.all("/projects/:projectId/web-search/:path{.+}", async (c) => {
+		const body = c.req.method === "GET" || c.req.method === "HEAD" ? void 0 : await c.req.arrayBuffer();
+		return proxyExaWebSearchRequest({
+			apiKey: process.env.EXA_API_KEY,
+			method: c.req.method,
+			path: c.req.param("path"),
+			requestUrl: c.req.url,
+			body
+		});
+	});
+	if (llmProxy) internal.all("/projects/:projectId/llm/:path{.+}", async (c) => {
+		const response = await withProjectScope(c.req.param("projectId"), async (ctx) => llmProxy.handler(c, {
+			organizationId: ctx.organizationId,
+			projectId: ctx.projectId,
+			pathSuffix: `/${c.req.param("path")}`
+		}));
+		if (response === void 0) return c.json({ error: "Project not found" }, 404);
+		return response ?? c.json({
+			error: "internal_error",
+			message: "Failed to proxy LLM request."
+		}, 500);
+	});
+	if (sandboxProxy) {
+		internal.post("/projects/:projectId/sandbox/create", async (c) => {
+			const projectId = c.req.param("projectId");
+			const parsed = SandboxSessionBodySchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) return c.json({
+				error: "Invalid request body",
+				details: parsed.error.flatten()
+			}, 400);
+			const result = await withProjectScope(projectId, async (ctx) => sandboxProxy.create({
+				...ctx,
+				...parsed.data
+			}));
+			if (result === void 0) return c.json({ error: "Project not found" }, 404);
+			return c.json(result);
+		});
+		internal.post("/projects/:projectId/sandbox/exec", async (c) => {
+			const projectId = c.req.param("projectId");
+			const parsed = SandboxExecBodySchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) return c.json({
+				error: "Invalid request body",
+				details: parsed.error.flatten()
+			}, 400);
+			const { script, options, ...session } = parsed.data;
+			const result = await withProjectScope(projectId, async (ctx) => sandboxProxy.exec({
+				...ctx,
+				...session
+			}, script, options));
+			if (result === void 0) return c.json({ error: "Project not found" }, 404);
+			return c.json(result);
+		});
+		internal.post("/projects/:projectId/sandbox/read", async (c) => {
+			const projectId = c.req.param("projectId");
+			const parsed = SandboxReadBodySchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) return c.json({
+				error: "Invalid request body",
+				details: parsed.error.flatten()
+			}, 400);
+			const { path, ...session } = parsed.data;
+			const content = await withProjectScope(projectId, async (ctx) => sandboxProxy.readFile({
+				...ctx,
+				...session
+			}, path));
+			if (content === void 0) return c.json({ error: "Project not found" }, 404);
+			return c.json({ content });
+		});
+		internal.post("/projects/:projectId/sandbox/write", async (c) => {
+			const projectId = c.req.param("projectId");
+			const parsed = SandboxWriteBodySchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) return c.json({
+				error: "Invalid request body",
+				details: parsed.error.flatten()
+			}, 400);
+			const { path, content, ...session } = parsed.data;
+			if (await withProjectScope(projectId, async (ctx) => {
+				await sandboxProxy.writeFile({
+					...ctx,
+					...session
+				}, path, content);
+				return true;
+			}) === void 0) return c.json({ error: "Project not found" }, 404);
+			return c.json({});
+		});
+		internal.post("/projects/:projectId/sandbox/dispose", async (c) => {
+			const projectId = c.req.param("projectId");
+			const parsed = SandboxSessionBodySchema.safeParse(await c.req.json().catch(() => null));
+			if (!parsed.success) return c.json({
+				error: "Invalid request body",
+				details: parsed.error.flatten()
+			}, 400);
+			if (await withProjectScope(projectId, async (ctx) => {
+				await sandboxProxy.dispose({
+					...ctx,
+					...parsed.data
+				});
+				return true;
+			}) === void 0) return c.json({ error: "Project not found" }, 404);
+			return c.json({});
+		});
+	}
+	internal.post("/projects/:projectId/webhooks/ensure", async (c) => {
+		const projectId = c.req.param("projectId");
+		if (!await withProjectScope(projectId, async (ctx) => ctx)) return c.json({ error: "Project not found" }, 404);
+		const parsed = EnsureWebhookRouteBodySchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			error: "Invalid request body",
+			details: parsed.error.flatten()
+		}, 400);
+		const origin = platformWebhookOrigin(projectId, externalPlatformOrigin());
+		if (!origin) return c.json({ error: "PUBLIC_PLATFORM_URL is not configured" }, 500);
+		try {
+			const token = await ensureWebhookApiKeyForRoute(projectId, parsed.data.route, parsed.data.attachmentKeys);
+			return c.json({ webhookUrl: buildWebhookUrl(origin, parsed.data.route, token) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : "Failed to ensure webhook API key.";
+			return c.json({
+				error: "webhook_provisioning_failed",
+				message
+			}, 500);
+		}
+	});
+	return internal;
+}
+//#endregion
+//#region src/app.ts
+async function createApp$1(auth, options) {
+	return createApp({
+		mode: "platform",
+		webOrigin: options.webOrigin,
+		schedulerPlugin: options.scheduler,
+		mcp: options.mcp,
+		auth,
+		mountAuth: (app, authInstance) => {
+			mountAuth(app, authInstance);
+		},
+		mountAccount: async (app) => {
+			app.route("/api", mountAccountRoutes({
+				hosting: options.hosting,
+				storage: options.storage,
+				mcp: options.mcp
+			}));
+		},
+		mountInternal: (app, { tokenRefresh }) => {
+			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy));
+		}
+	});
+}
+//#endregion
+//#region src/start.ts
+/** Fly `internal_port` — not the public HTTPS URL port. */
+const PRODUCTION_PLATFORM_LISTEN_PORT = 8080;
+const LOCAL_PLATFORM_PORT = 3002;
+function resolvePlatformListenPort() {
+	if (process.env.NODE_ENV === "production") return PRODUCTION_PLATFORM_LISTEN_PORT;
+	return listenPortFromPublicUrl(process.env.PUBLIC_PLATFORM_URL, LOCAL_PLATFORM_PORT);
+}
+function usesPgBossScheduler(platformConfig) {
+	return platformConfig.scheduler.name === "pg-boss" || platformConfig.scheduler.name === "default";
+}
+async function startPlatformServer(platformConfig, hooks = {}) {
+	const runtime = platformConfig.hosting.createRuntime();
+	await initDatabase();
+	await ensureKeystrokeAssetsBucket();
+	await seedOAuthAppsFromEnvForAllOrganizations();
+	if (usesPgBossScheduler(platformConfig)) await ensureProjectPgBossGrants();
+	configureProjectRuntimeScheduler(platformConfig.scheduler);
+	await startProjectRuntimeWorker(runtime, { resolveStartInput: async (job) => {
+		const project = await selectProjectById(job.projectId);
+		if (!project) throw new Error(`Project ${job.projectId} not found`);
+		const resolved = resolveRuntimeArtifact(project, job.artifactId);
+		if (resolved.action === "error") throw new Error(resolved.message);
+		if (resolved.action === "skip") throw new Error(`Project ${job.projectId} has no deploy artifact to start`);
+		const artifact = await selectProjectArtifactById(resolved.artifactId);
+		if (!artifact || artifact.status !== "ready") throw new Error(`Project ${job.projectId} pending artifact is not ready`);
+		const organization = await selectOrganizationById(project.organizationId);
+		if (!organization) throw new Error(`Organization not found for project ${job.projectId}`);
+		const workerRuntime = platformConfig.hosting.workerRuntime;
+		return {
+			projectId: job.projectId,
+			name: job.name,
+			artifactId: resolved.artifactId,
+			artifactStorageKey: artifact.storageKey,
+			database: await resolveProjectRuntimeDatabase({
+				organizationId: project.organizationId,
+				projectId: project.id
+			}),
+			env: {
+				...orgWorkspacesRuntimeEnv(organization, { containerEnv: process.env }),
+				...platformConfig.llmProxy?.workerEnv({
+					platformUrl: workerRuntime.platformUrl,
+					workerToken: workerRuntime.workerToken,
+					projectId: project.id
+				}),
+				...platformConfig.sandboxProxy?.workerEnv({
+					platformUrl: workerRuntime.platformUrl,
+					workerToken: workerRuntime.workerToken,
+					projectId: project.id
+				}),
+				...platformConfig.workerEnv?.({
+					platformUrl: workerRuntime.platformUrl,
+					workerToken: workerRuntime.workerToken,
+					projectId: project.id
+				})
+			},
+			hosting: organization.hostingAppName ? { appName: organization.hostingAppName } : void 0,
+			previousRuntimeId: project.runtimeId
+		};
+	} });
+	const webUrl = process.env.PUBLIC_WEB_URL;
+	if (!webUrl) throw new Error("PUBLIC_WEB_URL is required for the platform server");
+	const platformUrl = process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "");
+	if (!platformUrl) throw new Error("PUBLIC_PLATFORM_URL is required for the platform server");
+	const auth = createAuth({
+		baseURL: platformUrl,
+		verificationUri: `${webUrl.replace(/\/+$/, "")}/device`,
+		trustedOrigins: [webUrl]
+	});
+	if (!auth) throw new Error("BETTER_AUTH_SECRET is required for the platform server");
+	const app = await createApp$1(auth, {
+		webOrigin: webUrl,
+		hosting: platformConfig.hosting,
+		storage: platformConfig.storage,
+		scheduler: platformConfig.scheduler,
+		llmProxy: platformConfig.llmProxy,
+		sandboxProxy: platformConfig.sandboxProxy,
+		mcp: platformConfig.mcp
+	});
+	await hooks.afterCreateApp?.(app);
+	const port = resolvePlatformListenPort();
+	serve({
+		fetch: app.fetch,
+		port
+	}, (info) => {
+		console.log(`Platform API listening on http://localhost:${info.port}`);
+	});
+}
+//#endregion
+export { startPlatformServer as t };
+
+//# sourceMappingURL=start-DAlaZ5zj.mjs.map