@keystrokehq/platform 0.1.104 → 0.1.106

package/dist/{start-DAmqO4hu.mjs → start-7oMxob_7.mjs}

@@ -1,15 +1,15 @@
-import { $ as CreateApiKeyRequestSchema, $n as UploadProjectSourceResponseSchema, $t as ManagedServiceCredentialSchema, A as discoverMcpApp, An as SlugAvailabilityResponseSchema, Ar as mapOrganizationMember, At as HistoryRunListResponseSchema, B as ACTIVE_ORG_HEADER, Bn as TriggerInvokeRequestSchema, Br as organizationInvitationAcceptPath, Bt as ListCredentialsPageQuerySchema, C as defaultSchedulerPlugin, Cn as PublicModelsResponseSchema, Cr as displayCredentialAppName, Ct as GetCredentialResponseSchema, D as decodeOAuthState, Dn as SkillSummaryListResponseSchema, Dr as jsonSchemaToWorkflowInputSchema, Dt as HistoryRunCancelResponseSchema, E as completeMcpOAuthConnect, En as SkillSummaryDetailResponseSchema, Er as isLlmProviderSlug, Et as GraphqlDiscoverResponseSchema, F as deleteCredentialInstanceSecret, Fn as SubmitMarketingContactResponseSchema, Fr as mapProjectSettings, Ft as ListAgentMemoryFilesResponseSchema, G as AgentSummaryListResponseSchema, Gn as UpdateOrganizationMemberRequestSchema, Gr as resolveExternalPlatformOrigin, Gt as ListOrganizationMembersPageResponseSchema, H as ActiveOrganizationResponseSchema, Hn as TriggerRunListQuerySchema, Hr as parseAppSlug, Ht as ListManagedServiceCredentialsResponseSchema, I as deleteManagedServiceCredential$1, In as SubmitTeamRequestRequestSchema, Ir as mapUserOrganization, It as ListAgentWorkspaceFilesResponseSchema, J as AppSlugAvailabilityQuerySchema, Jn as UpdateProjectMemberRequestSchema, Jr as validateWorkflowRunInputValues, Jt as ListProjectFilesResponseSchema, K as AgentSummarySchema, Kn as UpdateOrganizationMemberResponseSchema, Kr as resolveUniqueCredentialInstanceLabel, Kt as ListOrganizationsResponseSchema, L as readCredentialInstanceSecret, Ln as SubmitTeamRequestResponseSchema, Lr as mcpEntityId, Lt as ListApiKeysResponseSchema, M as isDiscoveryError, Mn as StartMcpOAuthConnectionResultSchema, Mr as mapProjectArtifact, Mt as InviteOrganizationMembersResponseSchema, N as withCredentialAssignments, Nn as StoredProjectSourceManifestSchema, Nr as mapProjectDeployment, Nt as InviteProjectMembersRequestSchema, O as describeCredentialBindings, On as SkillSummarySchema, Or as listenPortFromPublicUrl, Ot as HistoryRunDetailResponseSchema, P as PublicHttpUrlError, Pn as SubmitMarketingContactRequestSchema, Pr as mapProjectMember, Pt as InviteProjectMembersResponseSchema, Q as ConnectManagedServiceCredentialRequestSchema, Qn as UploadProjectSourceManifestRequestSchema, Qt as MICRO_CREDITS_PER_CREDIT, R as setCredentialInstanceSecret, Rn as TriggerAttachmentUpdateRequestSchema, Rr as mergeUserPreferences, Rt as ListAppsResponseSchema, S as createJobQueue, Sn as ProjectSourceResourcesSchema, Sr as deriveCredentialInstanceSlug, St as GetAppCatalogEntryResponseSchema, T as beginMcpOAuthConnect, Tn as RecentResourceSchema, Tr as isHelloWorldTemplateSlug, Tt as GraphqlDiscoverRequestSchema, U as AgentMemoryFileSummarySchema, Un as UpdateCredentialRequestSchema, Ur as parseStoredRouteManifest, Ut as ListOrganizationInvitationsResponseSchema, V as AcceptOrganizationInvitationResponseSchema, Vn as TriggerInvokeResponseSchema, Vr as organizationSlugErrorCodeFromMessage, Vt as ListCredentialsPageResponseSchema, W as AgentSummaryDetailResponseSchema, Wn as UpdateManagedServiceCredentialRequestSchema, Wr as projectFileId, Wt as ListOrganizationMembersPageQuerySchema, X as ChannelPlatformSchema, Xn as UpdateProjectRequestSchema, Xt as ListProjectMetricsResponseSchema, Y as AppSlugAvailabilityResponseSchema, Yn as UpdateProjectMemberResponseSchema, Yr as validationErrorResponse, Yt as ListProjectMembersResponseSchema, Z as CompleteProjectArtifactResponseSchema, Zn as UpdateProjectSettingsRequestSchema, Zt as ListProjectsResponseSchema, _ as orgLogoStorageKey, _n as ProjectReachabilityResponseSchema, _r as WorkspaceWorkflowOverviewSchema, _t as DownloadActiveProjectSourceResponseSchema, a as extractRouteManifestFromArtifact, an as OrganizationSidebarBrandingPatchSchema, ar as WorkflowCanvasRunSchema, at as CreateOrganizationRequestSchema, b as publicKeystrokeAssetsObjectUrl, bn as ProjectSlugAvailabilityQuerySchema, br as buildCredentialInstanceLabel, bt as ErrorResponseSchema, c as isKeystrokeAssetsOrgLogoPublicUrl, cn as PROJECT_SLUG_TAKEN_MESSAGE, cr as WorkflowRunInputsSchema, ct as CreateProjectRequestSchema, d as isStorageNotFoundError$1, dn as PresignOrgLogoRequestSchema, dr as WorkflowSummarySchema, dt as DEFAULT_TRIGGER_OVERVIEW_MODEL, en as ManagedServiceKindSchema, er as UserAvatarPatchSchema, et as CreateApiKeyResponseSchema, f as isUserAvatarStorageKey, fn as PresignOrgLogoResponseSchema, fr as WorkspaceTriggerDetailSchema, ft as DEFAULT_WORKFLOW_CANVAS_MODEL, gn as PresignUserAvatarResponseSchema, gr as WorkspaceTriggerRunListResponseSchema, gt as DownloadActiveProjectArtifactResponseSchema, h as loadProjectSourceFiles, hn as PresignUserAvatarRequestSchema, hr as WorkspaceTriggerOverviewSchema, ht as DeclineOrganizationInvitationResponseSchema, i as ensureKeystrokeAssetsBucket, in as OpenApiDiscoverResponseSchema, ir as WorkflowCanvasCredentialBindingsSchema, it as CreateCustomAppResponseSchema, j as discoverOpenApiApp, jn as StartMcpOAuthConnectionInputSchema, jr as mapProject, jt as InviteOrganizationMembersRequestSchema, k as discoverGraphqlApp, kn as SlugAvailabilityQuerySchema, kr as mapOrganizationInvitation, kt as HistoryRunListQuerySchema, l as isOrgLogoStorageKey, ln as PresignChatAttachmentRequestSchema, lr as WorkflowSummaryDetailResponseSchema, lt as CreateProjectResponseSchema, m as keystrokeAssetsOrgLogoKeyFromPublicUrl, mn as PresignProjectSourceResponseSchema, mr as WorkspaceTriggerListResponseSchema, mt as DbProxyQueryRequestSchema, n as chatAttachmentStorageKey, nn as McpDiscoverResponseSchema, nr as UserPreferencesPatchSchema, nt as CreateCredentialsResponseSchema, o as isChatAttachmentStorageKey, on as OrganizationSidebarBrandingSchema, or as WorkflowCanvasSchema, ot as CreateOrganizationResponseSchema, p as keystrokeAssetsAvatarKeyFromPublicUrl, pn as PresignProjectSourceRequestSchema, pr as WorkspaceTriggerFileSchema, pt as DEFAULT_WORKFLOW_OVERVIEW_MODEL, q as AgentWorkspaceFileSummarySchema, qn as UpdateOrganizationRequestSchema, qr as validateCredentialValueAgainstFields, qt as ListProjectDeploymentsResponseSchema, r as createAssetsStorageClient, rn as OpenApiDiscoverRequestSchema, rr as UserPreferencesSchema, rt as CreateCustomAppRequestSchema, s as isKeystrokeAssetsAvatarPublicUrl, sn as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, sr as WorkflowRunInputsPutBodySchema, st as CreateProjectArtifactResponseSchema, t as RouteManifestNotFoundError, tn as McpDiscoverRequestSchema, tr as UserAvatarSchema, tt as CreateCredentialsRequestSchema, u as isStorageBucketNotFoundError, un as PresignChatAttachmentResponseSchema, ur as WorkflowSummaryListResponseSchema, ut as DEFAULT_CLOUD_PLATFORM_ORIGIN, v as projectArtifactKey, vn as ProjectResponseSchema, vr as agentMemoryFileId, vt as DuplicateCredentialRequestSchema, w as cronPayloadSchema, wn as RecentResourceListResponseSchema, wr as isAllowedChatAttachmentMediaType, wt as GetCustomAppResponseSchema, x as userAvatarStorageKey, xn as ProjectSlugAvailabilityResponseSchema, xr as chatAttachmentExtension, xt as FilePartSchema, y as projectSourceBlobKey, yn as ProjectSettingsResponseSchema, yr as agentWorkspaceFileId, yt as DuplicateCredentialsResponseSchema, z as setManagedServiceCredential, zn as TriggerInvokeInputsSchema, zr as normalizeUserPreferences, zt as ListChannelPlatformsResponseSchema } from "./dist-UfTaqROI.mjs";
-import { a as verifyOrgWorkerToken, i as pingProjectTarget, n as fetchDeployStatus, r as mintOrgWorkerToken } from "./dist-BI3VEIg3.mjs";
+import { $ as CreateApiKeyRequestSchema, $n as UpdateProjectMemberResponseSchema, $r as resolveUniqueCredentialInstanceLabel, $t as ManagedServiceCredentialSchema, A as discoverMcpApp, An as SkillSummaryDetailResponseSchema, Ar as isAllowedChatAttachmentMediaType, At as HistoryRunListResponseSchema, B as ACTIVE_ORG_HEADER, Bn as SubmitTeamRequestRequestSchema, Br as mapProjectMember, Bt as ListCredentialsPageQuerySchema, C as defaultSchedulerPlugin, Cn as PublicFormMetadataSchema, Cr as WorkspaceWorkflowOverviewSchema, Ct as GetCredentialResponseSchema, D as decodeOAuthState, Dn as PublishedFormSchema, Dr as chatAttachmentExtension, Dt as HistoryRunCancelResponseSchema, E as completeMcpOAuthConnect, En as PublicModelsResponseSchema, Er as buildCredentialInstanceLabel, Et as GraphqlDiscoverResponseSchema, F as deleteCredentialInstanceSecret, Fn as StartMcpOAuthConnectionInputSchema, Fr as mapOrganizationInvitation, Ft as ListAgentMemoryFilesResponseSchema, G as AgentSummaryListResponseSchema, Gn as TriggerInvokeResponseSchema, Gr as normalizeUserPreferences, Gt as ListOrganizationMembersPageResponseSchema, H as ActiveOrganizationResponseSchema, Hn as TriggerAttachmentUpdateRequestSchema, Hr as mapUserOrganization, Ht as ListManagedServiceCredentialsResponseSchema, I as deleteManagedServiceCredential$1, In as StartMcpOAuthConnectionResultSchema, Ir as mapOrganizationMember, It as ListAgentWorkspaceFilesResponseSchema, J as AppSlugAvailabilityQuerySchema, Jn as UpdateManagedServiceCredentialRequestSchema, Jr as parseAppSlug, Jt as ListProjectFilesResponseSchema, K as AgentSummarySchema, Kn as TriggerRunListQuerySchema, Kr as organizationInvitationAcceptPath, Kt as ListOrganizationsResponseSchema, L as readCredentialInstanceSecret, Ln as StoredProjectSourceManifestSchema, Lr as mapProject, Lt as ListApiKeysResponseSchema, M as isDiscoveryError, Mn as SkillSummarySchema, Mr as isLlmProviderSlug, Mt as InviteOrganizationMembersResponseSchema, N as withCredentialAssignments, Nn as SlugAvailabilityQuerySchema, Nr as jsonSchemaToWorkflowInputSchema, Nt as InviteProjectMembersRequestSchema, O as describeCredentialBindings, On as RecentResourceListResponseSchema, Or as deriveCredentialInstanceSlug, Ot as HistoryRunDetailResponseSchema, P as PublicHttpUrlError, Pn as SlugAvailabilityResponseSchema, Pr as listenPortFromPublicUrl, Pt as InviteProjectMembersResponseSchema, Q as ConnectManagedServiceCredentialRequestSchema, Qn as UpdateProjectMemberRequestSchema, Qr as resolvePublicFormFields, Qt as MICRO_CREDITS_PER_CREDIT, R as setCredentialInstanceSecret, Rn as SubmitMarketingContactRequestSchema, Rr as mapProjectArtifact, Rt as ListAppsResponseSchema, S as createJobQueue, Sn as ProjectSourceResourcesSchema, Sr as WorkspaceTriggerRunListResponseSchema, St as GetAppCatalogEntryResponseSchema, T as beginMcpOAuthConnect, Tn as PublicFormSubmitResponseSchema, Tr as agentWorkspaceFileId, Tt as GraphqlDiscoverRequestSchema, U as AgentMemoryFileSummarySchema, Un as TriggerInvokeInputsSchema, Ur as mcpEntityId, Ut as ListOrganizationInvitationsResponseSchema, V as AcceptOrganizationInvitationResponseSchema, Vn as SubmitTeamRequestResponseSchema, Vr as mapProjectSettings, Vt as ListCredentialsPageResponseSchema, W as AgentSummaryDetailResponseSchema, Wn as TriggerInvokeRequestSchema, Wr as mergeUserPreferences, Wt as ListOrganizationMembersPageQuerySchema, X as ChannelPlatformSchema, Xn as UpdateOrganizationMemberResponseSchema, Xr as projectFileId, Xt as ListProjectMetricsResponseSchema, Y as AppSlugAvailabilityResponseSchema, Yn as UpdateOrganizationMemberRequestSchema, Yr as parseStoredRouteManifest, Yt as ListProjectMembersResponseSchema, Z as CompleteProjectArtifactResponseSchema, Zn as UpdateOrganizationRequestSchema, Zr as resolveExternalPlatformOrigin, Zt as ListProjectsResponseSchema, _ as orgLogoStorageKey, _n as ProjectReachabilityResponseSchema, _r as WorkflowSummarySchema, _t as DownloadActiveProjectSourceResponseSchema, a as extractRouteManifestFromArtifact, ai as validationErrorResponse, an as OrganizationSidebarBrandingPatchSchema, ar as UserAvatarSchema, at as CreateOrganizationRequestSchema, b as publicKeystrokeAssetsObjectUrl, bn as ProjectSlugAvailabilityQuerySchema, br as WorkspaceTriggerListResponseSchema, bt as ErrorResponseSchema, c as isKeystrokeAssetsOrgLogoPublicUrl, cn as PROJECT_SLUG_TAKEN_MESSAGE, cr as WorkflowCanvasCredentialBindingsSchema, ct as CreateProjectRequestSchema, d as isStorageNotFoundError$1, dn as PresignOrgLogoRequestSchema, dr as WorkflowFormResponseSchema, dt as DEFAULT_TRIGGER_OVERVIEW_MODEL, ei as schemaHasFileFields, en as ManagedServiceKindSchema, er as UpdateProjectRequestSchema, et as CreateApiKeyResponseSchema, f as isUserAvatarStorageKey, fn as PresignOrgLogoResponseSchema, fr as WorkflowFormUpsertBodySchema, ft as DEFAULT_WORKFLOW_CANVAS_MODEL, gn as PresignUserAvatarResponseSchema, gr as WorkflowSummaryListResponseSchema, gt as DownloadActiveProjectArtifactResponseSchema, h as loadProjectSourceFiles, hn as PresignUserAvatarRequestSchema, hr as WorkflowSummaryDetailResponseSchema, ht as DeclineOrganizationInvitationResponseSchema, i as ensureKeystrokeAssetsBucket, ii as validateWorkflowRunInputValues, in as OpenApiDiscoverResponseSchema, ir as UserAvatarPatchSchema, it as CreateCustomAppResponseSchema, j as discoverOpenApiApp, jn as SkillSummaryListResponseSchema, jr as isHelloWorldTemplateSlug, jt as InviteOrganizationMembersRequestSchema, k as discoverGraphqlApp, kn as RecentResourceSchema, kr as displayCredentialAppName, kt as HistoryRunListQuerySchema, l as isOrgLogoStorageKey, ln as PresignChatAttachmentRequestSchema, lr as WorkflowCanvasRunSchema, lt as CreateProjectResponseSchema, m as keystrokeAssetsOrgLogoKeyFromPublicUrl, mn as PresignProjectSourceResponseSchema, mr as WorkflowRunInputsSchema, mt as DbProxyQueryRequestSchema, n as chatAttachmentStorageKey, ni as validateCredentialValueAgainstFields, nn as McpDiscoverResponseSchema, nr as UploadProjectSourceManifestRequestSchema, nt as CreateCredentialsResponseSchema, o as isChatAttachmentStorageKey, on as OrganizationSidebarBrandingSchema, or as UserPreferencesPatchSchema, ot as CreateOrganizationResponseSchema, p as keystrokeAssetsAvatarKeyFromPublicUrl, pn as PresignProjectSourceRequestSchema, pr as WorkflowRunInputsPutBodySchema, pt as DEFAULT_WORKFLOW_OVERVIEW_MODEL, q as AgentWorkspaceFileSummarySchema, qn as UpdateCredentialRequestSchema, qr as organizationSlugErrorCodeFromMessage, qt as ListProjectDeploymentsResponseSchema, r as createAssetsStorageClient, ri as validateFormFieldConfig, rn as OpenApiDiscoverRequestSchema, rr as UploadProjectSourceResponseSchema, rt as CreateCustomAppRequestSchema, s as isKeystrokeAssetsAvatarPublicUrl, sn as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, sr as UserPreferencesSchema, st as CreateProjectArtifactResponseSchema, t as RouteManifestNotFoundError, ti as schemaHasUnsupportedFormFields, tn as McpDiscoverRequestSchema, tr as UpdateProjectSettingsRequestSchema, tt as CreateCredentialsRequestSchema, u as isStorageBucketNotFoundError, un as PresignChatAttachmentResponseSchema, ur as WorkflowCanvasSchema, ut as DEFAULT_CLOUD_PLATFORM_ORIGIN, v as projectArtifactKey, vn as ProjectResponseSchema, vr as WorkspaceTriggerDetailSchema, vt as DuplicateCredentialRequestSchema, w as cronPayloadSchema, wn as PublicFormSubmitBodySchema, wr as agentMemoryFileId, wt as GetCustomAppResponseSchema, x as userAvatarStorageKey, xn as ProjectSlugAvailabilityResponseSchema, xr as WorkspaceTriggerOverviewSchema, xt as FilePartSchema, y as projectSourceBlobKey, yn as ProjectSettingsResponseSchema, yr as WorkspaceTriggerFileSchema, yt as DuplicateCredentialsResponseSchema, z as setManagedServiceCredential, zn as SubmitMarketingContactResponseSchema, zr as mapProjectDeployment, zt as ListChannelPlatformsResponseSchema } from "./dist-2KoUXcsr.mjs";
+import { a as verifyOrgWorkerToken, i as pingProjectTarget, n as fetchDeployStatus, r as mintOrgWorkerToken } from "./dist-BVlTqMH2.mjs";
 import "./chunk-BZUGFHVS-B2NchobP.mjs";
 import { n as d$4, t as _$1 } from "./chunk-TN7HHBQW-B8PYcKz5.mjs";
-import { n as readWorkerTokenFromRequest, r as requireWorkerToken, t as withProjectScope } from "./with-project-scope-DhPi7-gm.mjs";
+import { n as readWorkerTokenFromRequest, r as requireWorkerToken, t as withProjectScope } from "./with-project-scope-C5w92Hd9.mjs";
 import { createRequire } from "node:module";
 import { createHash } from "node:crypto";
 import "node:fs/promises";
-import { acquireProjectDatabasePool, buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, collectChildRunCancelTargets, deleteCredentialInstanceById, findHistoryRunCore, getProjectScopeId, getServerTenantScopeId, getWorkspaceTriggerById, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listAttachmentsByTriggerIds, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, listReplayEvents, listTriggersByIds, listWorkspaceTriggerRunRows, listWorkspaceTriggers, releaseProjectDatabasePool, resolveMigrationsFolder, runMigrations, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentBySlug, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectTriggerById, selectWorkflowCanvasAnnotations, selectWorkflowLastRunAtByIds, selectWorkflowOverview, selectWorkflowRunById, selectWorkflowRunForWorkflow, selectWorkflowRunInputValues, setTriggerAttachmentEnabledState, setTriggerOverviewGenerating, setWorkflowCanvasAnnotationsGenerating, setWorkflowOverviewGenerating, storedTriggerSourceFromRow, touchResourceActivity, triggerTimezoneFromConfig, updateTriggerOverview, updateWorkflowCanvasAnnotations, updateWorkflowOverview, updateWorkflowRunInputValues, upsertCredentialInstance } from "@keystrokehq/database";
+import { acquireProjectDatabasePool, buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, collectChildRunCancelTargets, deleteCredentialInstanceById, findHistoryRunCore, getProjectScopeId, getServerTenantScopeId, getWorkspaceTriggerById, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listAttachmentsByTriggerIds, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, listReplayEvents, listTriggersByIds, listWorkspaceTriggerRunRows, listWorkspaceTriggers, releaseProjectDatabasePool, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowBySlug, selectActiveWorkflowsByIds, selectAgentBySlug, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectTriggerById, selectWorkflowCanvasAnnotations, selectWorkflowLastRunAtByIds, selectWorkflowOverview, selectWorkflowRunById, selectWorkflowRunForWorkflow, selectWorkflowRunInputValues, setTriggerAttachmentEnabledState, setTriggerOverviewGenerating, setWorkflowCanvasAnnotationsGenerating, setWorkflowOverviewGenerating, storedTriggerSourceFromRow, touchResourceActivity, triggerTimezoneFromConfig, updateTriggerOverview, updateWorkflowCanvasAnnotations, updateWorkflowOverview, updateWorkflowRunInputValues, upsertCredentialInstance } from "@keystrokehq/database";
 import { ZodError, z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, countActiveMembersForOrganization, countActiveProjectsForOrganization, createOrgAgentStorageClient, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, getManagedServiceCredential, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listManagedServiceCredentialsForOrganization, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, listUsageEventsForRuns, listWebhookApiKeysForProject, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, migrateAllOrgSchemas, orgSchedulerRuntimeEnv, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgDatabaseUrl, resolveOrgProjectDatabaseOptions, resolveOrgRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactManifestForProject, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectLastDeploymentAtByProject, selectManagedServiceCredentialById, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectArtifactSourceManifestForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, summarizeUsageForRuns, updateOrganizationActive, updateOrganizationFailed, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectFailed, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
+import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, countActiveMembersForOrganization, countActiveProjectsForOrganization, createOrgAgentStorageClient, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, getManagedServiceCredential, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listManagedServiceCredentialsForOrganization, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, listUsageEventsForRuns, listWebhookApiKeysForProject, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgSchedulerRuntimeEnv, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgProjectDatabaseOptions, resolveOrgRuntimeDatabase, resolvePlatformDatabaseUrl, revokeOrgPlatformApiKey, rotatePublishedFormToken, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactManifestForProject, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectEnabledPublishedFormByToken, selectLastDeploymentAtByProject, selectManagedServiceCredentialById, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectArtifactSourceManifestForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectPublishedFormForWorkflow, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, summarizeUsageForRuns, unpublishFormForWorkflow, updateOrganizationActive, updateOrganizationFailed, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectFailed, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, upsertPublishedForm, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
 import "node:fs";
 import { basename, join, normalize, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
@@ -40,49 +40,7 @@ function setTelemetryContext(patch) {
 	if (patch.sessionId !== void 0) current.sessionId = patch.sessionId;
 	if (patch.client !== void 0) current.client = patch.client;
 }
-/**
-* Returns true when an error is an expected client/control-flow failure that
-* should not become an Error Tracking issue.
-*/
-function isExpectedError(error) {
-	if (!error || typeof error !== "object") return false;
-	const status = readStatus(error);
-	if (status !== void 0 && (status === 0 || status >= 400 && status < 500)) return true;
-	if ("name" in error && typeof error.name === "string") {
-		if (error.name === "AbortError" || error.name === "CanceledError" || error.name === "CancelledError" || error.name === "RunTimeoutError") return true;
-	}
-	return false;
-}
-function readStatus(error) {
-	if ("status" in error && typeof error.status === "number") return error.status;
-	if ("statusCode" in error && typeof error.statusCode === "number") return error.statusCode;
-}
 const EVENT_NAME_PATTERN = /^[a-z][a-z0-9_]*(:[a-z][a-z0-9_]*)?$/;
-let sink;
-async function captureException(input) {
-	if (isExpectedError(input.error) || true) return;
-	const context = getTelemetryContext();
-	const actorId = input.actorId ?? context?.actorId;
-	const analyticsId = input.analyticsId ?? context?.analyticsId;
-	const organizationId = input.organizationId ?? context?.organizationId;
-	const projectId = input.projectId ?? context?.projectId;
-	const sessionId = input.sessionId ?? context?.sessionId;
-	const enriched = {
-		error: input.error,
-		...actorId ? { actorId } : {},
-		...analyticsId ? { analyticsId } : {},
-		...organizationId ? { organizationId } : {},
-		...projectId ? { projectId } : {},
-		...sessionId ? { sessionId } : {},
-		...input.operation ? { operation: input.operation } : {},
-		...input.properties ? { properties: input.properties } : {}
-	};
-	try {
-		await sink.captureException(enriched);
-	} catch (error) {
-		console.error("[telemetry] captureException sink failed", error);
-	}
-}
 async function event(input) {
 	if (!EVENT_NAME_PATTERN.test(input.name)) {
 		console.error(`[telemetry] rejected invalid event name: ${input.name}`);
@@ -22951,43 +22909,43 @@ var tt = [
 	},
 	{
 		name: "cat",
-		load: async () => (await import("./cat-TSFMZVYS-BxNjOPHo.mjs")).catCommand
+		load: async () => (await import("./cat-TSFMZVYS-CoHlzG1g.mjs")).catCommand
 	},
 	{
 		name: "printf",
-		load: async () => (await import("./printf-TWGXF445-SeXWdm7g.mjs")).printfCommand
+		load: async () => (await import("./printf-TWGXF445-TABq8pZA.mjs")).printfCommand
 	},
 	{
 		name: "ls",
-		load: async () => (await import("./ls-ZJGQER7M-CTMWgQdb.mjs")).lsCommand
+		load: async () => (await import("./ls-ZJGQER7M-CFGn-LL8.mjs")).lsCommand
 	},
 	{
 		name: "mkdir",
-		load: async () => (await import("./mkdir-MEPGZOB6-DlmASeJ8.mjs")).mkdirCommand
+		load: async () => (await import("./mkdir-MEPGZOB6-BcS5Q34m.mjs")).mkdirCommand
 	},
 	{
 		name: "rmdir",
-		load: async () => (await import("./rmdir-OC4ZLPYA-BGCS0MYZ.mjs")).rmdirCommand
+		load: async () => (await import("./rmdir-OC4ZLPYA-CNNN3q6l.mjs")).rmdirCommand
 	},
 	{
 		name: "touch",
-		load: async () => (await import("./touch-UA33VN3N-U3ZomRAc.mjs")).touchCommand
+		load: async () => (await import("./touch-UA33VN3N-FlNTn8Ds.mjs")).touchCommand
 	},
 	{
 		name: "rm",
-		load: async () => (await import("./rm-SSGETQVQ-Yp02JM15.mjs")).rmCommand
+		load: async () => (await import("./rm-SSGETQVQ-CZlEeKOZ.mjs")).rmCommand
 	},
 	{
 		name: "cp",
-		load: async () => (await import("./cp-BISAAS7A-LPv4X9LQ.mjs")).cpCommand
+		load: async () => (await import("./cp-BISAAS7A-BDW_Ftsa.mjs")).cpCommand
 	},
 	{
 		name: "mv",
-		load: async () => (await import("./mv-W5BIQ646-BUScaUnN.mjs")).mvCommand
+		load: async () => (await import("./mv-W5BIQ646-CoAyZhuD.mjs")).mvCommand
 	},
 	{
 		name: "ln",
-		load: async () => (await import("./ln-4LGSXXGD-DEz2c-lc.mjs")).lnCommand
+		load: async () => (await import("./ln-4LGSXXGD-QTMEXUOs.mjs")).lnCommand
 	},
 	{
 		name: "chmod",
@@ -23003,15 +22961,15 @@ var tt = [
 	},
 	{
 		name: "head",
-		load: async () => (await import("./head-442HYESI-DUHiojKA.mjs")).headCommand
+		load: async () => (await import("./head-442HYESI-Cs4EuPOi.mjs")).headCommand
 	},
 	{
 		name: "tail",
-		load: async () => (await import("./tail-R4PCA2C4-Ww4pv2Dp.mjs")).tailCommand
+		load: async () => (await import("./tail-R4PCA2C4-BkulcngY.mjs")).tailCommand
 	},
 	{
 		name: "wc",
-		load: async () => (await import("./wc-LF7NU4LA-B_10bksl.mjs")).wcCommand
+		load: async () => (await import("./wc-LF7NU4LA-DEaxr-il.mjs")).wcCommand
 	},
 	{
 		name: "stat",
@@ -23019,95 +22977,95 @@ var tt = [
 	},
 	{
 		name: "grep",
-		load: async () => (await import("./grep-V3LQVMRQ-CukE4iEL.mjs")).grepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-BQA7o3M1.mjs")).grepCommand
 	},
 	{
 		name: "fgrep",
-		load: async () => (await import("./grep-V3LQVMRQ-CukE4iEL.mjs")).fgrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-BQA7o3M1.mjs")).fgrepCommand
 	},
 	{
 		name: "egrep",
-		load: async () => (await import("./grep-V3LQVMRQ-CukE4iEL.mjs")).egrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-BQA7o3M1.mjs")).egrepCommand
 	},
 	{
 		name: "rg",
-		load: async () => (await import("./rg-S4FXYXWB-qJ8foUzL.mjs")).rgCommand
+		load: async () => (await import("./rg-S4FXYXWB-DBe0_b15.mjs")).rgCommand
 	},
 	{
 		name: "sed",
-		load: async () => (await import("./sed-S5UIK574-BVQuN_lF.mjs")).sedCommand
+		load: async () => (await import("./sed-S5UIK574-DvzUvOnq.mjs")).sedCommand
 	},
 	{
 		name: "awk",
-		load: async () => (await import("./awk2-LA3USKJP-D22qN7re.mjs")).awkCommand2
+		load: async () => (await import("./awk2-LA3USKJP-Dgay0H4p.mjs")).awkCommand2
 	},
 	{
 		name: "sort",
-		load: async () => (await import("./sort-SW2YEO5B-DPSl4CbI.mjs")).sortCommand
+		load: async () => (await import("./sort-SW2YEO5B-CsboAjc8.mjs")).sortCommand
 	},
 	{
 		name: "uniq",
-		load: async () => (await import("./uniq-XSIZR6PB-BytgRQOG.mjs")).uniqCommand
+		load: async () => (await import("./uniq-XSIZR6PB-BaYViHEU.mjs")).uniqCommand
 	},
 	{
 		name: "comm",
-		load: async () => (await import("./comm-VV2LDX2J-B9xsrXzR.mjs")).commCommand
+		load: async () => (await import("./comm-VV2LDX2J-z5VLja3D.mjs")).commCommand
 	},
 	{
 		name: "cut",
-		load: async () => (await import("./cut-OKARJCCV-8tOnAUTx.mjs")).cutCommand
+		load: async () => (await import("./cut-OKARJCCV-CxnqlZqu.mjs")).cutCommand
 	},
 	{
 		name: "paste",
-		load: async () => (await import("./paste-7JC6S4DX-DLKliCxf.mjs")).pasteCommand
+		load: async () => (await import("./paste-7JC6S4DX-DTlwJFjO.mjs")).pasteCommand
 	},
 	{
 		name: "tr",
-		load: async () => (await import("./tr-36LHWFRQ-De0ivsL4.mjs")).trCommand
+		load: async () => (await import("./tr-36LHWFRQ-BPsaTkYA.mjs")).trCommand
 	},
 	{
 		name: "rev",
-		load: async () => (await import("./rev-5EHFX4EJ-TtsbZt5q.mjs")).rev
+		load: async () => (await import("./rev-5EHFX4EJ-CkoAL_TJ.mjs")).rev
 	},
 	{
 		name: "nl",
-		load: async () => (await import("./nl-WSDW7I4O-CZJV7yor.mjs")).nl
+		load: async () => (await import("./nl-WSDW7I4O-8GpfdAsi.mjs")).nl
 	},
 	{
 		name: "fold",
-		load: async () => (await import("./fold-4TQNYMSW-C1ExSlRm.mjs")).fold
+		load: async () => (await import("./fold-4TQNYMSW-BOBzzbek.mjs")).fold
 	},
 	{
 		name: "expand",
-		load: async () => (await import("./expand-JSPG6VOP-DkKiBzVj.mjs")).expand
+		load: async () => (await import("./expand-JSPG6VOP-GQ9M1qlE.mjs")).expand
 	},
 	{
 		name: "unexpand",
-		load: async () => (await import("./unexpand-CADSA4VO-BFtZtqw9.mjs")).unexpand
+		load: async () => (await import("./unexpand-CADSA4VO-DgpWR91p.mjs")).unexpand
 	},
 	{
 		name: "strings",
-		load: async () => (await import("./strings-6WDHLGMX-Cy1ZR56z.mjs")).strings
+		load: async () => (await import("./strings-6WDHLGMX-ufOZIkh3.mjs")).strings
 	},
 	{
 		name: "split",
-		load: async () => (await import("./split-4KKZZXXE-Dk9lHFC8.mjs")).split
+		load: async () => (await import("./split-4KKZZXXE-D0uthb-r.mjs")).split
 	},
 	{
 		name: "column",
-		load: async () => (await import("./column-XT6UFXNQ-DssELUSO.mjs")).column
+		load: async () => (await import("./column-XT6UFXNQ-Dfl8vwzz.mjs")).column
 	},
 	{
 		name: "join",
-		load: async () => (await import("./join-TBRGI3LQ-DK7LepAd.mjs")).join
+		load: async () => (await import("./join-TBRGI3LQ-DiBTVdO3.mjs")).join
 	},
 	{
 		name: "tee",
-		load: async () => (await import("./tee-YUZ2FKCJ-CMei1bUb.mjs")).teeCommand
+		load: async () => (await import("./tee-YUZ2FKCJ-r5n-l2G2.mjs")).teeCommand
 	},
 	{
 		name: "find",
-		load: async () => (await import("./find-INTH3OLC-1l65phnN.mjs")).findCommand
+		load: async () => (await import("./find-INTH3OLC--hNBfGti.mjs")).findCommand
 	},
 	{
 		name: "basename",
@@ -23119,19 +23077,19 @@ var tt = [
 	},
 	{
 		name: "tree",
-		load: async () => (await import("./tree-YLD52CNT-DNAB_qw3.mjs")).treeCommand
+		load: async () => (await import("./tree-YLD52CNT-BCAIsMqc.mjs")).treeCommand
 	},
 	{
 		name: "du",
-		load: async () => (await import("./du-572XNP42-BD0Zs3Qz.mjs")).duCommand
+		load: async () => (await import("./du-572XNP42-B2I6Njvu.mjs")).duCommand
 	},
 	{
 		name: "env",
-		load: async () => (await import("./env-36M5BO7M-C-PYC1oQ.mjs")).envCommand
+		load: async () => (await import("./env-36M5BO7M-DcjiL3cp.mjs")).envCommand
 	},
 	{
 		name: "printenv",
-		load: async () => (await import("./env-36M5BO7M-C-PYC1oQ.mjs")).printenvCommand
+		load: async () => (await import("./env-36M5BO7M-DcjiL3cp.mjs")).printenvCommand
 	},
 	{
 		name: "alias",
@@ -23147,7 +23105,7 @@ var tt = [
 	},
 	{
 		name: "xargs",
-		load: async () => (await import("./xargs-MGZPH7AX-jq42agOA.mjs")).xargsCommand
+		load: async () => (await import("./xargs-MGZPH7AX-B1CnFZg_.mjs")).xargsCommand
 	},
 	{
 		name: "true",
@@ -23163,23 +23121,23 @@ var tt = [
 	},
 	{
 		name: "bash",
-		load: async () => (await import("./bash-YZ33HQZQ-CnwqBcTu.mjs")).bashCommand
+		load: async () => (await import("./bash-YZ33HQZQ-sT3B7KV-.mjs")).bashCommand
 	},
 	{
 		name: "sh",
-		load: async () => (await import("./bash-YZ33HQZQ-CnwqBcTu.mjs")).shCommand
+		load: async () => (await import("./bash-YZ33HQZQ-sT3B7KV-.mjs")).shCommand
 	},
 	{
 		name: "jq",
-		load: async () => (await import("./jq-4XLYLOS5-D_E-_pWV.mjs")).jqCommand
+		load: async () => (await import("./jq-4XLYLOS5-BALq_nh9.mjs")).jqCommand
 	},
 	{
 		name: "base64",
-		load: async () => (await import("./base64-C2AIWVNC-BZ355qNl.mjs")).base64Command
+		load: async () => (await import("./base64-C2AIWVNC-DHDX5cLS.mjs")).base64Command
 	},
 	{
 		name: "diff",
-		load: async () => (await import("./diff-MWJFIG7X-aAYDACUk.mjs")).diffCommand
+		load: async () => (await import("./diff-MWJFIG7X-CGXdgUmT.mjs")).diffCommand
 	},
 	{
 		name: "date",
@@ -23187,15 +23145,15 @@ var tt = [
 	},
 	{
 		name: "sleep",
-		load: async () => (await import("./sleep-X22JJINO-4I6l2NTe.mjs")).sleepCommand
+		load: async () => (await import("./sleep-X22JJINO-DCoy_Nqt.mjs")).sleepCommand
 	},
 	{
 		name: "timeout",
-		load: async () => (await import("./timeout-YDCRSLPQ-Z78PgVy2.mjs")).timeoutCommand
+		load: async () => (await import("./timeout-YDCRSLPQ-tZJha6AQ.mjs")).timeoutCommand
 	},
 	{
 		name: "time",
-		load: async () => (await import("./time-D4LNBSWX-z9IAaE5I.mjs")).timeCommand
+		load: async () => (await import("./time-D4LNBSWX-BaTW1ba4.mjs")).timeCommand
 	},
 	{
 		name: "seq",
@@ -23203,19 +23161,19 @@ var tt = [
 	},
 	{
 		name: "expr",
-		load: async () => (await import("./expr-5JAACS4X-Dppx8f72.mjs")).exprCommand
+		load: async () => (await import("./expr-5JAACS4X-DHONkP-t.mjs")).exprCommand
 	},
 	{
 		name: "md5sum",
-		load: async () => (await import("./md5sum-SPU24VSG-0bULe4dG.mjs")).md5sumCommand
+		load: async () => (await import("./md5sum-SPU24VSG-DSdkIq3n.mjs")).md5sumCommand
 	},
 	{
 		name: "sha1sum",
-		load: async () => (await import("./sha1sum-2PTOAFR6-D12ocftB.mjs")).sha1sumCommand
+		load: async () => (await import("./sha1sum-2PTOAFR6-CEM0r2Rz.mjs")).sha1sumCommand
 	},
 	{
 		name: "sha256sum",
-		load: async () => (await import("./sha256sum-NS7D3IXX-CXylnxEZ.mjs")).sha256sumCommand
+		load: async () => (await import("./sha256sum-NS7D3IXX-DNbm5sa_.mjs")).sha256sumCommand
 	},
 	{
 		name: "file",
@@ -23223,11 +23181,11 @@ var tt = [
 	},
 	{
 		name: "html-to-markdown",
-		load: async () => (await import("./html-to-markdown-JW4MSQZO-BQz_VlRg.mjs")).htmlToMarkdownCommand
+		load: async () => (await import("./html-to-markdown-JW4MSQZO-B1mP45ME.mjs")).htmlToMarkdownCommand
 	},
 	{
 		name: "help",
-		load: async () => (await import("./help-HZ6M2CKN-DLEdf0M2.mjs")).helpCommand
+		load: async () => (await import("./help-HZ6M2CKN-Cif0Mz1E.mjs")).helpCommand
 	},
 	{
 		name: "which",
@@ -23235,7 +23193,7 @@ var tt = [
 	},
 	{
 		name: "tac",
-		load: async () => (await import("./tac-2STMMJYW-D8GSnWwk.mjs")).tac
+		load: async () => (await import("./tac-2STMMJYW-BWAzF1gZ.mjs")).tac
 	},
 	{
 		name: "hostname",
@@ -23247,49 +23205,49 @@ var tt = [
 	},
 	{
 		name: "od",
-		load: async () => (await import("./od-WOKFDJTP-ByzrsPyh.mjs")).od
+		load: async () => (await import("./od-WOKFDJTP-CI6oY0LJ.mjs")).od
 	},
 	{
 		name: "gzip",
-		load: async () => (await import("./gzip-O5ASJAFY-wJ28ldi7.mjs")).gzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BN_VNZkL.mjs")).gzipCommand
 	},
 	{
 		name: "gunzip",
-		load: async () => (await import("./gzip-O5ASJAFY-wJ28ldi7.mjs")).gunzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BN_VNZkL.mjs")).gunzipCommand
 	},
 	{
 		name: "zcat",
-		load: async () => (await import("./gzip-O5ASJAFY-wJ28ldi7.mjs")).zcatCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BN_VNZkL.mjs")).zcatCommand
 	}
 ];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (tt.push({
 	name: "tar",
-	load: async () => (await import("./tar-STHHZTZ6-BzXQksgM.mjs")).tarCommand
+	load: async () => (await import("./tar-STHHZTZ6-DEOAF4gq.mjs")).tarCommand
 }), tt.push({
 	name: "yq",
-	load: async () => (await import("./yq-4QJW3EQG-BrQ6vsDL.mjs")).yqCommand
+	load: async () => (await import("./yq-4QJW3EQG-BCTiQ4M4.mjs")).yqCommand
 }), tt.push({
 	name: "xan",
-	load: async () => (await import("./xan-Y6WF3IRG-CwjgCDhd.mjs")).xanCommand
+	load: async () => (await import("./xan-Y6WF3IRG-lpubA7_O.mjs")).xanCommand
 }), tt.push({
 	name: "sqlite3",
-	load: async () => (await import("./sqlite3-CGOEFJAO-BHYKGg1a.mjs")).sqlite3Command
+	load: async () => (await import("./sqlite3-CGOEFJAO-Ct1OVItO.mjs")).sqlite3Command
 }));
 var Yt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Yt.push({
 	name: "python3",
-	load: async () => (await import("./python3-POMOR4OA-DCtD8PWe.mjs")).python3Command
+	load: async () => (await import("./python3-POMOR4OA-DTtek62H.mjs")).python3Command
 }), Yt.push({
 	name: "python",
-	load: async () => (await import("./python3-POMOR4OA-DCtD8PWe.mjs")).pythonCommand
+	load: async () => (await import("./python3-POMOR4OA-DTtek62H.mjs")).pythonCommand
 }));
 var Qt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Qt.push({
 	name: "js-exec",
-	load: async () => (await import("./js-exec-N5KEZBH7-aTSi2bNc.mjs")).jsExecCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-DZMBJ1Pu.mjs")).jsExecCommand
 }), Qt.push({
 	name: "node",
-	load: async () => (await import("./js-exec-N5KEZBH7-aTSi2bNc.mjs")).nodeStubCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-DZMBJ1Pu.mjs")).nodeStubCommand
 }));
 new TextEncoder();
 Object.freeze({
@@ -25951,7 +25909,7 @@ function withOrganizationProjectDatabase() {
 trace.getTracer("keystroke.http");
 //#endregion
 //#region src/routes/account/users/me/avatar/GET.ts
-const handler$102 = async (c) => {
+const handler$107 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserAvatarSchema.parse({ url: dbUser.image ?? null }));
@@ -25970,7 +25928,7 @@ function avatarExtensionForContentType(contentType) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/presign/POST.ts
-const handler$101 = async (c) => {
+const handler$106 = async (c) => {
 	const parsed = PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -26010,7 +25968,7 @@ async function deleteStoredImageIfOwned(input) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/PATCH.ts
-const handler$100 = async (c) => {
+const handler$105 = async (c) => {
 	const parsed = UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
 	const user = c.get("user");
@@ -26052,14 +26010,14 @@ const handler$100 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/GET.ts
-const handler$99 = async (c) => {
+const handler$104 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserPreferencesSchema.parse(normalizeUserPreferences(dbUser.preferences)));
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/PATCH.ts
-const handler$98 = async (c) => {
+const handler$103 = async (c) => {
 	const parsed = UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
 	const user = c.get("user");
@@ -26074,7 +26032,7 @@ const handler$98 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/GET.ts
-const handler$97 = async (c) => {
+const handler$102 = async (c) => {
 	const memberships = await selectUserOrganizations(c.get("user").id);
 	return c.json(ListOrganizationsResponseSchema.parse(memberships.map(mapUserOrganization)));
 };
@@ -26197,7 +26155,7 @@ function createOrganizationHandler(deps) {
 }
 //#endregion
 //#region src/routes/account/organizations/slug-available/GET.ts
-const handler$96 = async (c) => {
+const handler$101 = async (c) => {
 	const parsed = SlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
 		excludeOrganizationId: c.req.query("excludeOrganizationId")
@@ -26208,7 +26166,7 @@ const handler$96 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/GET.ts
-const handler$95 = async (c) => {
+const handler$100 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
 	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
@@ -26216,7 +26174,7 @@ const handler$95 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/PATCH.ts
-const handler$94 = async (c) => {
+const handler$99 = async (c) => {
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
 	const parsed = UpdateOrganizationRequestSchema.safeParse(body);
@@ -26241,7 +26199,7 @@ const handler$94 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/GET.ts
-const handler$93 = async (c) => {
+const handler$98 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
 	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
@@ -26290,7 +26248,7 @@ async function finalizeOrgLogoVariant(input) {
 		publicUrl: finalized.publicUrl
 	};
 }
-const handler$92 = async (c) => {
+const handler$97 = async (c) => {
 	const parsed = OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
 	const { organizationId } = c.get("organization");
@@ -26318,7 +26276,7 @@ const handler$92 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
-const handler$91 = async (c) => {
+const handler$96 = async (c) => {
 	const parsed = PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -26528,7 +26486,7 @@ function buildPlatformHistoryUsage(events, durationMs) {
 }
 //#endregion
 //#region src/routes/account/history/GET.ts
-const handler$90 = async (c) => {
+const handler$95 = async (c) => {
 	const organization = c.get("organization");
 	const ctx = accessContext(c);
 	const query = HistoryRunListQuerySchema.parse({
@@ -26553,7 +26511,7 @@ const handler$90 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/history/[runId]/GET.ts
-const handler$89 = async (c) => {
+const handler$94 = async (c) => {
 	const runId = c.req.param("runId") ?? "";
 	if (!runId) return c.json(null, 404);
 	const core = await findHistoryRunCore(runId);
@@ -26613,7 +26571,7 @@ function toAgentSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/agents/GET.ts
-const handler$88 = async (c) => {
+const handler$93 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(AgentSummaryListResponseSchema.parse([]));
 	const rows = await listActiveAgents(filter);
@@ -26627,7 +26585,7 @@ function touchResourceActivityBestEffort(options) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/GET.ts
-const handler$87 = async (c) => {
+const handler$92 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(AgentSummaryDetailResponseSchema.parse(null));
@@ -26650,7 +26608,7 @@ const handler$87 = async (c) => {
 function relativePathsFromStorageKeys(prefix, keys) {
 	return keys.filter((key) => key.startsWith(prefix) && key.endsWith(".md")).map((key) => key.slice(prefix.length)).filter((path) => !path.startsWith(".") && !path.includes("/."));
 }
-const handler$86 = async (c) => {
+const handler$91 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(ListAgentMemoryFilesResponseSchema.parse({ files: [] }), 404);
@@ -26675,7 +26633,7 @@ function isStorageNotFoundError(error) {
 	const status = typeof record.$metadata === "object" && record.$metadata !== null ? record.$metadata.httpStatusCode : void 0;
 	return name === "NoSuchKey" || code === "NoSuchKey" || code === "NotFound" || status === 404;
 }
-const handler$85 = async (c) => {
+const handler$90 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const path = c.req.query("path");
 	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
@@ -26729,7 +26687,7 @@ function workspaceRelativePathsFromStorageKeys(keys) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/workspace/files/GET.ts
-const handler$84 = async (c) => {
+const handler$89 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(ListAgentWorkspaceFilesResponseSchema.parse({ files: [] }), 404);
@@ -26752,7 +26710,7 @@ const handler$84 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/agents/[agentId]/workspace/files/content/GET.ts
-const handler$83 = async (c) => {
+const handler$88 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const path = c.req.query("path");
 	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
@@ -26804,7 +26762,7 @@ async function cancelHistoryRun(c, kind, cancel) {
 }
 //#endregion
 //#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
-const handler$82 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
+const handler$87 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
 //#endregion
 //#region src/routes/account/resources/workflows.ts
 function toWorkflowSummary(row, options) {
@@ -26821,7 +26779,7 @@ function toWorkflowSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/workflows/GET.ts
-const handler$81 = async (c) => {
+const handler$86 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(WorkflowSummaryListResponseSchema.parse([]));
 	const rows = await listActiveWorkflows(filter);
@@ -26830,7 +26788,7 @@ const handler$81 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/GET.ts
-const handler$80 = async (c) => {
+const handler$85 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const row = workflowId ? await selectActiveWorkflowById(workflowId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(WorkflowSummaryDetailResponseSchema.parse(null));
@@ -27281,7 +27239,7 @@ function buildWorkflowCanvas(input) {
 //#region src/routes/account/workflows/[workflowId]/canvas/GET.ts
 /** Bumped when the annotation prompt/model changes, so cached annotations invalidate. */
 const ANNOTATIONS_GENERATOR_VERSION = "wf-canvas-annotations-v1";
-const handler$79 = async (c) => {
+const handler$84 = async (c) => {
 	const organization = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27454,7 +27412,7 @@ function toBinding(key, description) {
 * each of its requirements currently binds to (read-only, no decryption). Not
 * content-hash cached — credential state changes without a redeploy.
 */
-const handler$78 = async (c) => {
+const handler$83 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27613,7 +27571,7 @@ function toCanvasRunStatus(status) {
 	if (status === "canceled") return "canceled";
 	return "running";
 }
-const handler$77 = async (c) => {
+const handler$82 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const runId = c.req.param("runId") ?? "";
 	if (!workflowId.trim() || !runId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow or run id" }), 400);
@@ -27668,7 +27626,7 @@ async function loadWorkflowSource(organization, projectId, sourcePath) {
 		return null;
 	}
 }
-const handler$76 = async (c) => {
+const handler$81 = async (c) => {
 	const organization = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27769,7 +27727,7 @@ const handler$76 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/run-inputs/GET.ts
-const handler$75 = async (c) => {
+const handler$80 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27784,7 +27742,7 @@ const handler$75 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/run-inputs/PUT.ts
-const handler$74 = async (c) => {
+const handler$79 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27807,7 +27765,7 @@ const handler$74 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/run/POST.ts
-function parseRunInput(requestSchema, input) {
+function parseRunInput$1(requestSchema, input) {
 	if (typeof z.fromJSONSchema === "function") return z.fromJSONSchema(requestSchema).parse(input ?? {});
 	return z.record(z.string(), z.unknown()).parse(input ?? {});
 }
@@ -27816,7 +27774,7 @@ function parseRunInput(requestSchema, input) {
 * the workflow row's request schema, creates a pending run, and enqueues it on
 * the project's queue (drained by the project runtime worker). Returns the run id.
 */
-const handler$73 = async (c) => {
+const handler$78 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27841,7 +27799,7 @@ const handler$73 = async (c) => {
 				workflowKey: row.slug,
 				input: body,
 				jobQueue: scheduler,
-				parseInput: (value) => parseRunInput(requestSchema, value),
+				parseInput: (value) => parseRunInput$1(requestSchema, value),
 				ranByUserId: userId
 			});
 		});
@@ -27852,6 +27810,106 @@ const handler$73 = async (c) => {
 	}
 };
 //#endregion
+//#region src/lib/public-form-url.ts
+function buildPublicFormUrl(token) {
+	return `${(process.env.PUBLIC_WEB_URL?.trim() || "http://localhost:3000").replace(/\/$/, "")}/forms/${encodeURIComponent(token)}`;
+}
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/form/shared.ts
+function publishedFormResponse(form, workflowId) {
+	return PublishedFormSchema.parse({
+		id: form.id,
+		workflowId,
+		workflowSlug: form.workflowSlug,
+		enabled: form.enabled,
+		title: form.title,
+		description: form.description,
+		fieldConfig: form.fieldConfig,
+		publicUrl: buildPublicFormUrl(form.token),
+		createdAt: form.createdAt.toISOString(),
+		updatedAt: form.updatedAt.toISOString()
+	});
+}
+async function resolveFormWorkflow(c, { requireManageAccess = false } = {}) {
+	const workflowId = c.req.param("workflowId")?.trim();
+	if (!workflowId) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
+	const workflow = await resolveWorkflow(c, workflowId);
+	if (!workflow) return c.json(ErrorResponseSchema.parse({ error: "Workflow not found" }), 404);
+	if (requireManageAccess && !await canPerformProjectAction(c, workflow.projectId, projectActions.update)) return c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
+	return {
+		workflowId,
+		projectId: workflow.projectId,
+		row: workflow.row
+	};
+}
+async function resolvePublishableInputSchema(projectId, row) {
+	const requestSchema = await resolveWorkflowRequestSchema(projectId, row);
+	if (!requestSchema) return new Response(JSON.stringify({ error: "Workflow not deployed" }), { status: 404 });
+	const inputSchema = jsonSchemaToWorkflowInputSchema(requestSchema);
+	if (inputSchema.fields.length === 0) return new Response(JSON.stringify({ error: "Workflow does not accept inputs" }), { status: 409 });
+	if (schemaHasFileFields(inputSchema)) return new Response(JSON.stringify({ error: "Forms do not support file inputs yet" }), { status: 409 });
+	if (schemaHasUnsupportedFormFields(inputSchema)) return new Response(JSON.stringify({ error: "Forms support scalar fields and arrays of scalar fields only" }), { status: 409 });
+	return inputSchema;
+}
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/form/GET.ts
+const handler$77 = async (c) => {
+	const resolved = await resolveFormWorkflow(c);
+	if (resolved instanceof Response) return resolved;
+	const { organizationId } = c.get("organization");
+	const form = await selectPublishedFormForWorkflow(organizationId, resolved.projectId, resolved.row.slug);
+	return c.json(WorkflowFormResponseSchema.parse(form ? publishedFormResponse(form, resolved.workflowId) : null));
+};
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/form/PUT.ts
+const handler$76 = async (c) => {
+	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
+	if (resolved instanceof Response) return resolved;
+	const body = WorkflowFormUpsertBodySchema.safeParse(await c.req.json().catch(() => null));
+	if (!body.success) {
+		const message = body.error.issues[0]?.message ?? "Invalid request body";
+		return c.json(ErrorResponseSchema.parse({ error: message }), 400);
+	}
+	const inputSchema = await resolvePublishableInputSchema(resolved.projectId, resolved.row);
+	if (inputSchema instanceof Response) return inputSchema;
+	if (body.data.fieldConfig) {
+		const validation = validateFormFieldConfig(inputSchema, body.data.fieldConfig);
+		if (!validation.ok) return c.json(ErrorResponseSchema.parse({ error: validation.error }), 400);
+	}
+	const { organizationId } = c.get("organization");
+	const form = await upsertPublishedForm({
+		organizationId,
+		projectId: resolved.projectId,
+		workflowSlug: resolved.row.slug,
+		createdByUserId: c.get("user").id,
+		enabled: body.data.enabled ?? true,
+		...body.data.title !== void 0 ? { title: body.data.title } : {},
+		...body.data.description !== void 0 ? { description: body.data.description } : {},
+		...body.data.fieldConfig !== void 0 ? { fieldConfig: body.data.fieldConfig } : {}
+	});
+	return c.json(publishedFormResponse(form, resolved.workflowId));
+};
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/form/DELETE.ts
+const handler$75 = async (c) => {
+	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
+	if (resolved instanceof Response) return resolved;
+	const { organizationId } = c.get("organization");
+	const form = await unpublishFormForWorkflow(organizationId, resolved.projectId, resolved.row.slug);
+	if (!form) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+	return c.json(publishedFormResponse(form, resolved.workflowId));
+};
+//#endregion
+//#region src/routes/account/workflows/[workflowId]/form/rotate/POST.ts
+const handler$74 = async (c) => {
+	const resolved = await resolveFormWorkflow(c, { requireManageAccess: true });
+	if (resolved instanceof Response) return resolved;
+	const { organizationId } = c.get("organization");
+	const form = await rotatePublishedFormToken(organizationId, resolved.projectId, resolved.row.slug);
+	if (!form) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+	return c.json(publishedFormResponse(form, resolved.workflowId));
+};
+//#endregion
 //#region src/routes/account/workflows/[workflowId]/attachments/presign/POST.ts
 function extensionFromUpload$1(contentType, filename) {
 	const fromName = filename.includes(".") ? filename.split(".").pop()?.toLowerCase() : void 0;
@@ -27865,7 +27923,7 @@ function extensionFromUpload$1(contentType, filename) {
 * hydration reads by project id + storage key, so runs read the file the same
 * way `storeFile` output does.
 */
-const handler$72 = async (c) => {
+const handler$73 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
@@ -27890,7 +27948,7 @@ const handler$72 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/runs/GET.ts
-const handler$71 = async (c) => {
+const handler$72 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	if (!workflowId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid workflow id" }), 400);
 	const resolved = await resolveWorkflow(c, workflowId);
@@ -27913,7 +27971,7 @@ const handler$71 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
-const handler$70 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
+const handler$71 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
 //#endregion
 //#region src/routes/account/resources/skills.ts
 function toSkillSummary(row) {
@@ -27930,7 +27988,7 @@ function toSkillSummary(row) {
 }
 //#endregion
 //#region src/routes/account/skills/GET.ts
-const handler$69 = async (c) => {
+const handler$70 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(SkillSummaryListResponseSchema.parse([]));
 	const rows = await listActiveSkills(filter);
@@ -27938,7 +27996,7 @@ const handler$69 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/skills/[skillId]/GET.ts
-const handler$68 = async (c) => {
+const handler$69 = async (c) => {
 	const skillId = c.req.param("skillId") ?? "";
 	const row = skillId ? await selectActiveSkillById(skillId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(SkillSummaryDetailResponseSchema.parse(null));
@@ -28047,7 +28105,7 @@ function toWorkspaceTriggerRunSummary(item, assignments) {
 }
 //#endregion
 //#region src/routes/account/triggers/GET.ts
-const handler$67 = async (c) => {
+const handler$68 = async (c) => {
 	const organization = c.get("organization");
 	const scope = listScope(c, projectListScope(accessContext(c)));
 	const filter = await resolveListProjectIds(c, scope, c.req.query("projectId"));
@@ -28059,7 +28117,7 @@ const handler$67 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/GET.ts
-const handler$66 = async (c) => {
+const handler$67 = async (c) => {
 	const organization = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28075,7 +28133,7 @@ const handler$66 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/runs/GET.ts
-const handler$65 = async (c) => {
+const handler$66 = async (c) => {
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
 	const filter = await resolveListProjectIds(c, listScope(c, projectListScope(accessContext(c))));
@@ -28104,7 +28162,7 @@ const handler$65 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/triggers/[triggerId]/file/GET.ts
-const handler$64 = async (c) => {
+const handler$65 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28141,7 +28199,7 @@ function envelope(row, status, hash) {
 		model: row.overviewModel ?? "deepseek/deepseek-v4-flash"
 	});
 }
-const handler$63 = async (c) => {
+const handler$64 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28223,7 +28281,7 @@ async function syncNativeTriggerSchedule(organization, trigger) {
 	}
 	await scheduler.removeTriggerSchedule?.(trigger.slug, trigger.projectId);
 }
-const handler$62 = async (c) => {
+const handler$63 = async (c) => {
 	const organization = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	const attachmentId = c.req.param("attachmentId") ?? "";
@@ -28295,7 +28353,7 @@ var InvokeHttpError = class extends Error {
 * Manually invoke a trigger from the dashboard or CLI. Validates webhook input against
 * stored attachment schemas, then enqueues a trigger job on the project's queue.
 */
-const handler$61 = async (c) => {
+const handler$62 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
@@ -28368,7 +28426,7 @@ const handler$61 = async (c) => {
 * Form metadata for the dashboard invoke popover: webhook request schemas and
 * cron's read-only static payload.
 */
-const handler$60 = async (c) => {
+const handler$61 = async (c) => {
 	const triggerId = c.req.param("triggerId") ?? "";
 	if (!triggerId.trim()) return c.json(ErrorResponseSchema.parse({ error: "Invalid trigger id" }), 400);
 	const filter = await resolveListProjectIds(c, listScope(c, projectListScope(accessContext(c))));
@@ -28434,7 +28492,7 @@ function latestRecentInteractionAt(recent) {
 //#endregion
 //#region src/routes/account/recents/GET.ts
 const RECENTS_LIMIT = 50;
-const handler$59 = async (c) => {
+const handler$60 = async (c) => {
 	const userId = c.get("user").id;
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
@@ -28460,7 +28518,7 @@ const handler$59 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/GET.ts
-const handler$58 = async (c) => {
+const handler$59 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
@@ -28486,7 +28544,7 @@ function mergeProjectListMetrics(input) {
 }
 //#endregion
 //#region src/routes/account/projects/metrics/GET.ts
-const handler$57 = async (c) => {
+const handler$58 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([selectProjectResourceCounts(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), selectLastDeploymentAtByProject(organization.organizationId)]);
@@ -28531,7 +28589,7 @@ function createCreateProjectHandler(projectQuotaGate) {
 }
 //#endregion
 //#region src/routes/account/projects/slug-available/GET.ts
-const handler$55 = async (c) => {
+const handler$56 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = ProjectSlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
@@ -28543,12 +28601,12 @@ const handler$55 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/GET.ts
-const handler$54 = async (c) => {
+const handler$55 = async (c) => {
 	return c.json(ProjectResponseSchema.parse(routeProject(c.get("project"))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/PATCH.ts
-const handler$53 = async (c) => {
+const handler$54 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -28566,7 +28624,7 @@ const handler$53 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/DELETE.ts
-const handler$52 = async (c) => {
+const handler$53 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	if (!await deleteProjectForOrganization(organization.organizationId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
@@ -28574,7 +28632,7 @@ const handler$52 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/deployments/GET.ts
-const handler$51 = async (c) => {
+const handler$52 = async (c) => {
 	const rows = await selectProjectDeployments(c.get("project").id);
 	return c.json(ListProjectDeploymentsResponseSchema.parse(rows.map(mapProjectDeployment)));
 };
@@ -28582,7 +28640,7 @@ const handler$51 = async (c) => {
 //#region src/routes/account/projects/[projectId]/artifacts/POST.ts
 const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
 const ARTIFACT_CONTENT_TYPE = "application/gzip";
-const handler$50 = async (c) => {
+const handler$51 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -28610,7 +28668,7 @@ const handler$50 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
 const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-const handler$49 = async (c) => {
+const handler$50 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -28629,7 +28687,7 @@ const handler$49 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/source/GET.ts
-const handler$48 = async (c) => {
+const handler$49 = async (c) => {
 	const project = c.get("project");
 	const active = await selectActiveArtifactSourceManifestForProject(project.id);
 	if (!active?.sourceManifestJson) return c.json(ErrorResponseSchema.parse({ error: "No active source for project" }), 404);
@@ -28658,7 +28716,7 @@ const TRIGGER_KINDS = new Set([
 	"trigger-poll-group",
 	"cron-schedule"
 ]);
-const handler$47 = async (c) => {
+const handler$48 = async (c) => {
 	const project = c.get("project");
 	const user = c.get("user");
 	const artifactId = c.req.param("artifactId");
@@ -28722,7 +28780,7 @@ const handler$47 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
 const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
-const handler$46 = async (c) => {
+const handler$47 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -28750,7 +28808,7 @@ const handler$46 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
-const handler$45 = async (c) => {
+const handler$46 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -28782,7 +28840,7 @@ function extensionFromUpload(contentType, filename) {
 	if (fromName && /^[a-z0-9]+$/.test(fromName)) return fromName;
 	return chatAttachmentExtension(contentType) ?? "bin";
 }
-const handler$44 = async (c) => {
+const handler$45 = async (c) => {
 	const project = c.get("project");
 	const slug = c.req.param("slug");
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "Agent slug is required" }), 400);
@@ -28807,7 +28865,7 @@ const handler$44 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/agents/[slug]/attachments/[...key]/GET.ts
-const handler$43 = async (c) => {
+const handler$44 = async (c) => {
 	const project = c.get("project");
 	const slug = c.req.param("slug");
 	const keyParam = c.req.param("key");
@@ -28853,7 +28911,7 @@ function resolveSourcePaths(rows, kindDir, filePaths) {
 		}] : [];
 	});
 }
-const handler$42 = async (c) => {
+const handler$43 = async (c) => {
 	const project = c.get("project");
 	const active = await selectActiveArtifactSourceManifestForProject(project.id);
 	if (!active || !active.sourceManifestJson) return c.json(ListProjectFilesResponseSchema.parse({
@@ -28898,7 +28956,7 @@ function ifNoneMatchMatches(ifNoneMatch, etag) {
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
-const handler$41 = async (c) => {
+const handler$42 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -28944,7 +29002,7 @@ function createProjectReachabilityHandler(hosting) {
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/GET.ts
-const handler$40 = async (c) => {
+const handler$41 = async (c) => {
 	const project = c.get("project");
 	const currentUserId = c.get("user").id;
 	const members = await selectProjectMembers(project.id);
@@ -28952,7 +29010,7 @@ const handler$40 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/POST.ts
-const handler$39 = async (c) => {
+const handler$40 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -28968,7 +29026,7 @@ const handler$39 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
-const handler$38 = async (c) => {
+const handler$39 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -28985,7 +29043,7 @@ const handler$38 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
-const handler$37 = async (c) => {
+const handler$38 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -28999,7 +29057,7 @@ const handler$37 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
-const handler$36 = async (c) => {
+const handler$37 = async (c) => {
 	const project = c.get("project");
 	const userId = c.get("user").id;
 	try {
@@ -29012,13 +29070,13 @@ const handler$36 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/GET.ts
-const handler$35 = async (c) => {
+const handler$36 = async (c) => {
 	const project = c.get("project");
 	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(project)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/PATCH.ts
-const handler$34 = async (c) => {
+const handler$35 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -29140,7 +29198,7 @@ async function enrichCredentialInstances(rows, organizationId) {
 }
 //#endregion
 //#region src/routes/account/credentials/GET.ts
-const handler$33 = async (c) => {
+const handler$34 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const query = ListCredentialsPageQuerySchema.parse({
@@ -29169,7 +29227,7 @@ function withTargetScope$1(target, fn) {
 	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
 	return fn();
 }
-const handler$32 = async (c) => {
+const handler$33 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -29285,7 +29343,7 @@ async function canAccessCredentialRow(c, row) {
 }
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/GET.ts
-const handler$31 = async (c) => {
+const handler$32 = async (c) => {
 	const organization = c.get("organization");
 	const credentialId = c.req.param("credentialId") ?? "";
 	const row = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
@@ -29346,7 +29404,7 @@ function sharedConnectionIdFor(row, scopeType, scopeId) {
 	if (!row.connectionId) return row.sharedConnectionId;
 	return mcpEntityId(scopeType, scopeId);
 }
-const handler$30 = async (c) => {
+const handler$31 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -29447,7 +29505,7 @@ function withTargetScope(target, fn) {
 	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
 	return fn();
 }
-const handler$29 = async (c) => {
+const handler$30 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -29577,7 +29635,7 @@ function createDeleteCredentialHandler(options = {}) {
 }
 //#endregion
 //#region src/routes/account/members/GET.ts
-const handler$28 = async (c) => {
+const handler$29 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const query = ListOrganizationMembersPageQuerySchema.parse({
 		limit: c.req.query("limit") || void 0,
@@ -29635,7 +29693,7 @@ async function sendOrganizationInviteEmail(payload, resend) {
 }
 //#endregion
 //#region src/routes/account/members/invitations/POST.ts
-const handler$27 = async (c) => {
+const handler$28 = async (c) => {
 	const user = c.get("user");
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
@@ -29661,7 +29719,7 @@ const handler$27 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/PATCH.ts
-const handler$26 = async (c) => {
+const handler$27 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -29678,7 +29736,7 @@ const handler$26 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/DELETE.ts
-const handler$25 = async (c) => {
+const handler$26 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -29692,13 +29750,13 @@ const handler$25 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/GET.ts
-const handler$24 = async (c) => {
+const handler$25 = async (c) => {
 	const invitations = await selectPendingInvitationsForUser(c.get("user").id);
 	return c.json(ListOrganizationInvitationsResponseSchema.parse(invitations.map(mapOrganizationInvitation)));
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/accept/POST.ts
-const handler$23 = async (c) => {
+const handler$24 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -29719,7 +29777,7 @@ const handler$23 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/decline/POST.ts
-const handler$22 = async (c) => {
+const handler$23 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -29805,13 +29863,13 @@ function appRowToCustomAppDetail(row) {
 }
 //#endregion
 //#region src/routes/account/apps/GET.ts
-const handler$21 = async (c) => {
+const handler$22 = async (c) => {
 	const apps = (await listAppsForOrganization(c.get("organization").organizationId)).map(appRowToCatalogSummary);
 	return c.json(ListAppsResponseSchema.parse(apps));
 };
 //#endregion
 //#region src/routes/account/apps/POST.ts
-const handler$20 = async (c) => {
+const handler$21 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = CreateCustomAppRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -29855,7 +29913,7 @@ const handler$20 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover/POST.ts
-const handler$19 = async (c) => {
+const handler$20 = async (c) => {
 	const parsed = McpDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -29869,7 +29927,7 @@ const handler$19 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover-openapi/POST.ts
-const handler$18 = async (c) => {
+const handler$19 = async (c) => {
 	const parsed = OpenApiDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -29886,7 +29944,7 @@ const handler$18 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/discover-graphql/POST.ts
-const handler$17 = async (c) => {
+const handler$18 = async (c) => {
 	const parsed = GraphqlDiscoverRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json({ error: "Invalid request body" }, 400);
 	try {
@@ -29903,7 +29961,7 @@ const handler$17 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/[slug]/mcp/oauth/connections/POST.ts
-const handler$16 = async (c) => {
+const handler$17 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const appSlug = c.req.param("slug")?.trim();
@@ -29963,7 +30021,7 @@ function buildOAuthWebLandingUrl(webOrigin, params) {
 }
 //#endregion
 //#region src/routes/account/mcp/oauth/callback/GET.ts
-const handler$15 = async (c) => {
+const handler$16 = async (c) => {
 	const code = c.req.query("code")?.trim();
 	const state = c.req.query("state")?.trim();
 	const oauthError = c.req.query("error")?.trim();
@@ -30061,7 +30119,7 @@ const handler$15 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/slug-available/GET.ts
-const handler$14 = async (c) => {
+const handler$15 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = AppSlugAvailabilityQuerySchema.safeParse({ slug: c.req.query("slug") });
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
@@ -30072,7 +30130,7 @@ const handler$14 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/apps/[slug]/GET.ts
-const handler$13 = async (c) => {
+const handler$14 = async (c) => {
 	const organization = c.get("organization");
 	const slug = c.req.param("slug") ?? "";
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
@@ -30087,7 +30145,7 @@ const handler$13 = async (c) => {
 //#endregion
 //#region src/routes/account/apps/[slug]/catalog/GET.ts
 /** Full catalog entry (scopes + credential template) for connect UI. */
-const handler$12 = async (c) => {
+const handler$13 = async (c) => {
 	const organization = c.get("organization");
 	const slug = c.req.param("slug") ?? "";
 	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
@@ -30120,14 +30178,14 @@ function projectChannelPlatform(row) {
 	});
 }
 /** Gateway platforms only — avoids downloading the full apps catalog. */
-const handler$11 = async (c) => {
+const handler$12 = async (c) => {
 	const organization = c.get("organization");
 	const platforms = (await Promise.all(Object.keys(GATEWAY_BY_APP_SLUG).map((slug) => selectAppForOrganization(organization.organizationId, slug)))).flatMap((row) => row ? [projectChannelPlatform(row)] : []);
 	return c.json(ListChannelPlatformsResponseSchema.parse(platforms));
 };
 //#endregion
 //#region src/routes/account/api-keys/GET.ts
-const handler$10 = async (c) => {
+const handler$11 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await listOrgPlatformApiKeysForOrganization(organizationId) : await listOrgPlatformApiKeysForUser(organizationId, user.id);
@@ -30144,7 +30202,7 @@ const handler$10 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/api-keys/POST.ts
-const handler$9 = async (c) => {
+const handler$10 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const body = CreateApiKeyRequestSchema.parse(await c.req.json());
@@ -30167,7 +30225,7 @@ const handler$9 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/api-keys/[apiKeyId]/DELETE.ts
-const handler$8 = async (c) => {
+const handler$9 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const apiKeyId = c.req.param("apiKeyId");
@@ -30192,7 +30250,7 @@ const handler$8 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/GET.ts
-const handler$7 = async (c) => {
+const handler$8 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const kindParam = c.req.query("kind");
@@ -30212,7 +30270,7 @@ const handler$7 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/POST.ts
-const handler$6 = async (c) => {
+const handler$7 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const body = ConnectManagedServiceCredentialRequestSchema.parse(await c.req.json());
@@ -30241,7 +30299,7 @@ const handler$6 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/[id]/PATCH.ts
-const handler$5 = async (c) => {
+const handler$6 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("id");
@@ -30272,7 +30330,7 @@ const handler$5 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/managed-service-credentials/[id]/DELETE.ts
-const handler$4 = async (c) => {
+const handler$5 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const credentialId = c.req.param("id");
 	if (!credentialId) return c.json(ErrorResponseSchema.parse({ error: "Credential id is required" }), 400);
@@ -30391,7 +30449,7 @@ async function postTeamRequestToSlack(input) {
 }
 //#endregion
 //#region src/routes/account/team-requests/POST.ts
-const handler$3 = async (c) => {
+const handler$4 = async (c) => {
 	const user = c.get("user");
 	const organizationContext = c.get("organization");
 	const parsed = SubmitTeamRequestRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -30436,7 +30494,7 @@ function mountAccountRoutes(options) {
 	const projectScoped = new Hono();
 	const protect = requireSession(createDefaultAuthJwtVerifier());
 	const deleteCredential = createDeleteCredentialHandler({ mcp: options.mcp });
-	account.get("/mcp/oauth/callback", handler$15);
+	account.get("/mcp/oauth/callback", handler$16);
 	account.use("/*", protect);
 	orgScoped.use("/*", protect);
 	orgScoped.use("/*", requireOrganization());
@@ -30458,109 +30516,113 @@ function mountAccountRoutes(options) {
 	const requireProjectManageMembers = authorize(projectActions.manageMembers);
 	const requireInvitableProjectRole = authorizePayload(InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
 	const requireOrgParam = requireOrganizationParam();
-	account.get("/organizations", handler$97);
-	account.get("/organizations/slug-available", handler$96);
+	account.get("/organizations", handler$102);
+	account.get("/organizations/slug-available", handler$101);
 	account.post("/organizations", createOrganizationHandler(options));
-	account.get("/organizations/:organizationId", requireOrgParam, handler$95);
-	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$94);
-	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$93);
-	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$92);
-	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$91);
-	account.get("/invitations", handler$24);
-	account.post("/invitations/:invitationId/accept", handler$23);
-	account.post("/invitations/:invitationId/decline", handler$22);
-	account.get("/users/me/avatar", handler$102);
-	account.post("/users/me/avatar/presign", handler$101);
-	account.patch("/users/me/avatar", handler$100);
-	account.get("/users/me/preferences", handler$99);
-	account.patch("/users/me/preferences", handler$98);
+	account.get("/organizations/:organizationId", requireOrgParam, handler$100);
+	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$99);
+	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$98);
+	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$97);
+	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$96);
+	account.get("/invitations", handler$25);
+	account.post("/invitations/:invitationId/accept", handler$24);
+	account.post("/invitations/:invitationId/decline", handler$23);
+	account.get("/users/me/avatar", handler$107);
+	account.post("/users/me/avatar/presign", handler$106);
+	account.patch("/users/me/avatar", handler$105);
+	account.get("/users/me/preferences", handler$104);
+	account.patch("/users/me/preferences", handler$103);
 	const withOrgDb = withOrganizationProjectDatabase();
-	orgScoped.get("/apps", handler$21);
-	orgScoped.get("/apps/slug-available", handler$14);
-	orgScoped.get("/channel-platforms", handler$11);
-	orgScoped.post("/apps/discover", requireOrgUpdate, handler$19);
-	orgScoped.post("/apps/discover-openapi", requireOrgUpdate, handler$18);
-	orgScoped.post("/apps/discover-graphql", requireOrgUpdate, handler$17);
-	orgScoped.post("/apps", requireOrgUpdate, handler$20);
-	orgScoped.post("/apps/:slug/mcp/oauth/connections", requireOrgUpdate, withOrgDb, handler$16);
-	orgScoped.get("/apps/:slug/catalog", handler$12);
-	orgScoped.get("/apps/:slug", handler$13);
-	account.post("/team-requests", requireOrganization(), handler$3);
-	orgScoped.get("/members", handler$28);
-	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$27);
-	orgScoped.patch("/members/:userId", requireUserManage, handler$26);
-	orgScoped.delete("/members/:userId", requireUserManage, handler$25);
-	orgScoped.get("/api-keys", handler$10);
-	orgScoped.post("/api-keys", requireApiKeyCreate, handler$9);
-	orgScoped.delete("/api-keys/:apiKeyId", handler$8);
-	orgScoped.get("/managed-service-credentials", requireManagedServicesRead, handler$7);
-	orgScoped.post("/managed-service-credentials", requireManagedServicesManage, handler$6);
-	orgScoped.patch("/managed-service-credentials/:id", requireManagedServicesManage, handler$5);
-	orgScoped.delete("/managed-service-credentials/:id", requireManagedServicesManage, handler$4);
-	orgScoped.get("/agents", withOrgDb, handler$88);
-	orgScoped.get("/agents/:agentId", withOrgDb, handler$87);
-	orgScoped.get("/agents/:agentId/memory/files", withOrgDb, handler$86);
-	orgScoped.get("/agents/:agentId/memory/files/content", withOrgDb, handler$85);
-	orgScoped.get("/agents/:agentId/workspace/files", withOrgDb, handler$84);
-	orgScoped.get("/agents/:agentId/workspace/files/content", withOrgDb, handler$83);
-	orgScoped.get("/workflows", withOrgDb, handler$81);
-	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$80);
-	orgScoped.get("/workflows/:workflowId/canvas", withOrgDb, handler$79);
-	orgScoped.get("/workflows/:workflowId/canvas/credentials", withOrgDb, handler$78);
-	orgScoped.get("/workflows/:workflowId/canvas/runs/:runId", withOrgDb, handler$77);
-	orgScoped.get("/workflows/:workflowId/overview", withOrgDb, handler$76);
-	orgScoped.get("/workflows/:workflowId/runs", withOrgDb, handler$71);
-	orgScoped.get("/workflows/:workflowId/run-inputs", withOrgDb, handler$75);
-	orgScoped.put("/workflows/:workflowId/run-inputs", withOrgDb, handler$74);
-	orgScoped.post("/workflows/:workflowId/run", withOrgDb, handler$73);
-	orgScoped.post("/workflows/:workflowId/attachments/presign", withOrgDb, handler$72);
-	orgScoped.get("/skills", withOrgDb, handler$69);
-	orgScoped.get("/skills/:skillId", withOrgDb, handler$68);
-	orgScoped.get("/triggers", withOrgDb, handler$67);
-	orgScoped.get("/triggers/:triggerId", withOrgDb, handler$66);
-	orgScoped.get("/triggers/:triggerId/runs", withOrgDb, handler$65);
-	orgScoped.get("/triggers/:triggerId/file", withOrgDb, handler$64);
-	orgScoped.get("/triggers/:triggerId/overview", withOrgDb, handler$63);
-	orgScoped.get("/triggers/:triggerId/invoke-inputs", withOrgDb, handler$60);
-	orgScoped.post("/triggers/:triggerId/invoke", withOrgDb, handler$61);
-	orgScoped.patch("/triggers/:triggerId/attachments/:attachmentId", withOrgDb, handler$62);
-	orgScoped.get("/recents", withOrgDb, handler$59);
-	orgScoped.get("/history", withOrgDb, handler$90);
-	orgScoped.get("/history/:runId", withOrgDb, handler$89);
-	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$70);
-	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$82);
-	orgScoped.get("/credentials", withOrgDb, handler$33);
-	orgScoped.post("/credentials", withOrgDb, handler$32);
-	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$31(c, next));
-	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$30);
-	orgScoped.post("/credentials/:credentialId/duplicate", withOrgDb, handler$29);
+	orgScoped.get("/apps", handler$22);
+	orgScoped.get("/apps/slug-available", handler$15);
+	orgScoped.get("/channel-platforms", handler$12);
+	orgScoped.post("/apps/discover", requireOrgUpdate, handler$20);
+	orgScoped.post("/apps/discover-openapi", requireOrgUpdate, handler$19);
+	orgScoped.post("/apps/discover-graphql", requireOrgUpdate, handler$18);
+	orgScoped.post("/apps", requireOrgUpdate, handler$21);
+	orgScoped.post("/apps/:slug/mcp/oauth/connections", requireOrgUpdate, withOrgDb, handler$17);
+	orgScoped.get("/apps/:slug/catalog", handler$13);
+	orgScoped.get("/apps/:slug", handler$14);
+	account.post("/team-requests", requireOrganization(), handler$4);
+	orgScoped.get("/members", handler$29);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$28);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$27);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$26);
+	orgScoped.get("/api-keys", handler$11);
+	orgScoped.post("/api-keys", requireApiKeyCreate, handler$10);
+	orgScoped.delete("/api-keys/:apiKeyId", handler$9);
+	orgScoped.get("/managed-service-credentials", requireManagedServicesRead, handler$8);
+	orgScoped.post("/managed-service-credentials", requireManagedServicesManage, handler$7);
+	orgScoped.patch("/managed-service-credentials/:id", requireManagedServicesManage, handler$6);
+	orgScoped.delete("/managed-service-credentials/:id", requireManagedServicesManage, handler$5);
+	orgScoped.get("/agents", withOrgDb, handler$93);
+	orgScoped.get("/agents/:agentId", withOrgDb, handler$92);
+	orgScoped.get("/agents/:agentId/memory/files", withOrgDb, handler$91);
+	orgScoped.get("/agents/:agentId/memory/files/content", withOrgDb, handler$90);
+	orgScoped.get("/agents/:agentId/workspace/files", withOrgDb, handler$89);
+	orgScoped.get("/agents/:agentId/workspace/files/content", withOrgDb, handler$88);
+	orgScoped.get("/workflows", withOrgDb, handler$86);
+	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$85);
+	orgScoped.get("/workflows/:workflowId/canvas", withOrgDb, handler$84);
+	orgScoped.get("/workflows/:workflowId/canvas/credentials", withOrgDb, handler$83);
+	orgScoped.get("/workflows/:workflowId/canvas/runs/:runId", withOrgDb, handler$82);
+	orgScoped.get("/workflows/:workflowId/overview", withOrgDb, handler$81);
+	orgScoped.get("/workflows/:workflowId/runs", withOrgDb, handler$72);
+	orgScoped.get("/workflows/:workflowId/run-inputs", withOrgDb, handler$80);
+	orgScoped.put("/workflows/:workflowId/run-inputs", withOrgDb, handler$79);
+	orgScoped.post("/workflows/:workflowId/run", withOrgDb, handler$78);
+	orgScoped.get("/workflows/:workflowId/form", withOrgDb, handler$77);
+	orgScoped.put("/workflows/:workflowId/form", withOrgDb, handler$76);
+	orgScoped.delete("/workflows/:workflowId/form", withOrgDb, handler$75);
+	orgScoped.post("/workflows/:workflowId/form/rotate", withOrgDb, handler$74);
+	orgScoped.post("/workflows/:workflowId/attachments/presign", withOrgDb, handler$73);
+	orgScoped.get("/skills", withOrgDb, handler$70);
+	orgScoped.get("/skills/:skillId", withOrgDb, handler$69);
+	orgScoped.get("/triggers", withOrgDb, handler$68);
+	orgScoped.get("/triggers/:triggerId", withOrgDb, handler$67);
+	orgScoped.get("/triggers/:triggerId/runs", withOrgDb, handler$66);
+	orgScoped.get("/triggers/:triggerId/file", withOrgDb, handler$65);
+	orgScoped.get("/triggers/:triggerId/overview", withOrgDb, handler$64);
+	orgScoped.get("/triggers/:triggerId/invoke-inputs", withOrgDb, handler$61);
+	orgScoped.post("/triggers/:triggerId/invoke", withOrgDb, handler$62);
+	orgScoped.patch("/triggers/:triggerId/attachments/:attachmentId", withOrgDb, handler$63);
+	orgScoped.get("/recents", withOrgDb, handler$60);
+	orgScoped.get("/history", withOrgDb, handler$95);
+	orgScoped.get("/history/:runId", withOrgDb, handler$94);
+	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$71);
+	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$87);
+	orgScoped.get("/credentials", withOrgDb, handler$34);
+	orgScoped.post("/credentials", withOrgDb, handler$33);
+	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$32(c, next));
+	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$31);
+	orgScoped.post("/credentials/:credentialId/duplicate", withOrgDb, handler$30);
 	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
-	orgScoped.get("/projects", handler$58);
-	orgScoped.get("/projects/slug-available", handler$55);
-	orgScoped.get("/projects/metrics", withOrgDb, handler$57);
+	orgScoped.get("/projects", handler$59);
+	orgScoped.get("/projects/slug-available", handler$56);
+	orgScoped.get("/projects/metrics", withOrgDb, handler$58);
 	orgScoped.post("/projects", createCreateProjectHandler(options.projectQuotaGate));
-	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$54);
-	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$53);
-	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$52);
-	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$35);
-	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$34);
-	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$40);
-	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$39);
-	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$38);
-	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$37);
-	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$36);
+	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$55);
+	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$54);
+	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$53);
+	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$36);
+	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$35);
+	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$41);
+	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$40);
+	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$39);
+	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$38);
+	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$37);
 	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
-	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$42);
-	projectScoped.post("/:projectId/agents/:slug/attachments/presign", requireProject(), requireProjectMember, withOrgDb, handler$44);
-	projectScoped.get("/:projectId/agents/:slug/attachments/:key{.+}", requireProject(), requireProjectMember, withOrgDb, handler$43);
-	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$41);
-	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$51);
-	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$49);
-	projectScoped.get("/:projectId/artifacts/active/source", requireProject(), requireProjectMember, withOrgDb, handler$48);
-	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$50);
-	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$47);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$46);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$45);
+	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$43);
+	projectScoped.post("/:projectId/agents/:slug/attachments/presign", requireProject(), requireProjectMember, withOrgDb, handler$45);
+	projectScoped.get("/:projectId/agents/:slug/attachments/:key{.+}", requireProject(), requireProjectMember, withOrgDb, handler$44);
+	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$42);
+	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$52);
+	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$50);
+	projectScoped.get("/:projectId/artifacts/active/source", requireProject(), requireProjectMember, withOrgDb, handler$49);
+	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$51);
+	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$48);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$47);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$46);
 	orgScoped.route("/projects", projectScoped);
 	account.route("/", orgScoped);
 	return account;
@@ -30618,7 +30680,7 @@ var DbProxyRejectedError = class extends Error {
 	}
 };
 /** Reject multi-statement SQL and explicit transaction/session control. */
-const FORBIDDEN_SQL = /\b(BEGIN|COMMIT|ROLLBACK|START\s+TRANSACTION|SET\s+ROLE|SET\s+SESSION|RESET\s+ROLE|SET\s+LOCAL\s+ROLE)\b/i;
+const FORBIDDEN_SQL = /\b(BEGIN|COMMIT|ROLLBACK|START\s+TRANSACTION|SET\s+ROLE|SET\s+SESSION|RESET\s+ROLE|SET\s+LOCAL\s+ROLE|SET\s+CONFIG|SELECT\s+SET_CONFIG)\b/i;
 function assertSingleSafeStatement(sql) {
 	const trimmed = sql.trim();
 	if (!trimmed) throw new DbProxyRejectedError("Empty SQL is not allowed");
@@ -30628,46 +30690,23 @@ function assertSingleSafeStatement(sql) {
 		if (withoutLiterals.split(";").map((part) => part.trim()).filter(Boolean).length > 1) throw new DbProxyRejectedError("Only one SQL statement is allowed per proxy request");
 	}
 }
-function resolveUntrustedOrgProxyOptions(organization) {
+/** Shared platform pool + signed organization claim (RLS). */
+function resolveTenantProxyOptions(organization) {
 	return {
-		url: resolveOrgDatabaseUrl(organization),
-		searchPath: organization.dbSchema
+		url: resolvePlatformDatabaseUrl(),
+		organizationId: organization.id
 	};
 }
-async function resetProxySession(client) {
-	await client.query("ROLLBACK").catch(() => void 0);
-	await client.query("DISCARD ALL").catch(() => void 0);
-}
 async function runOrgDatabaseQuery(options, query) {
 	assertSingleSafeStatement(query.sql);
 	const handle = await acquireProjectDatabasePool(options);
 	try {
 		if (handle.dialect !== "postgres") throw new Error("DB proxy requires postgres");
-		const client = await handle.pool.connect();
-		try {
-			return { rows: (await client.query({
-				text: query.sql,
-				values: query.params,
-				rowMode: query.method === "all" ? "array" : void 0
-			})).rows };
-		} finally {
-			await resetProxySession(client);
-			client.release();
-		}
-	} finally {
-		releaseProjectDatabasePool(options);
-	}
-}
-/**
-* Apply platform-owned org schema migrations. Worker-supplied SQL is ignored —
-* only embedded `@keystrokehq/database` migrations run under the org login.
-*/
-async function runOrgDatabaseMigrations(options) {
-	const handle = await acquireProjectDatabasePool(options);
-	try {
-		if (handle.dialect !== "postgres") throw new Error("DB proxy requires postgres");
-		await runMigrations(handle, resolveMigrationsFolder("postgres"));
-		return [];
+		return { rows: (await handle.pool.query({
+			text: query.sql,
+			values: query.params,
+			rowMode: query.method === "all" ? "array" : void 0
+		})).rows };
 	} finally {
 		releaseProjectDatabasePool(options);
 	}
@@ -30693,7 +30732,7 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp) {
 			error: "Invalid request body",
 			details: parsed.error.flatten()
 		}, 400);
-		const options = resolveUntrustedOrgProxyOptions(organization);
+		const options = resolveTenantProxyOptions(organization);
 		try {
 			return c.json(await runOrgDatabaseQuery(options, parsed.data));
 		} catch (error) {
@@ -30712,25 +30751,6 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp) {
 			}, 500);
 		}
 	});
-	internal.post("/orgs/:organizationId/db/migrate", async (c) => {
-		const organizationId = c.req.param("organizationId");
-		const organization = await getCachedOrganization(organizationId);
-		if (!organization) return c.json({ error: "Organization not found" }, 404);
-		const options = resolveUntrustedOrgProxyOptions(organization);
-		try {
-			return c.json({ results: await runOrgDatabaseMigrations(options) });
-		} catch (error) {
-			console.error("Database proxy migration failed", {
-				organizationId,
-				error
-			});
-			const message = error instanceof Error ? error.message : "Database proxy migration failed.";
-			return c.json({
-				error: "db_proxy_migrate_failed",
-				message
-			}, 500);
-		}
-	});
 	internal.use("/*", protect);
 	internal.use("/projects/:projectId/*", async (c, next) => {
 		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
@@ -30836,7 +30856,7 @@ async function loadModelIds() {
 	})();
 	return pendingFetch;
 }
-async function handler$2(c) {
+async function handler$3(c) {
 	try {
 		const models = await loadModelIds();
 		return c.json(PublicModelsResponseSchema.parse({ models }));
@@ -30847,21 +30867,34 @@ async function handler$2(c) {
 	}
 }
 //#endregion
+//#region src/lib/client-ip.ts
+function clientIp(c) {
+	const forwarded = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
+	if (forwarded) return forwarded;
+	const realIp = c.req.header("x-real-ip")?.trim();
+	if (realIp) return realIp;
+	try {
+		return getConnInfo(c).remote.address ?? "unknown";
+	} catch {
+		return "unknown";
+	}
+}
+//#endregion
 //#region src/lib/contact-rate-limit.ts
-const WINDOW_MS = 6e4;
-const MAX_REQUESTS_PER_WINDOW = 5;
-const hits = /* @__PURE__ */ new Map();
+const WINDOW_MS$1 = 6e4;
+const MAX_REQUESTS_PER_WINDOW$1 = 5;
+const hits$1 = /* @__PURE__ */ new Map();
 function consumeContactRateLimit(key) {
 	const now = Date.now();
-	const entry = hits.get(key);
+	const entry = hits$1.get(key);
 	if (!entry || now >= entry.resetAt) {
-		hits.set(key, {
+		hits$1.set(key, {
 			count: 1,
-			resetAt: now + WINDOW_MS
+			resetAt: now + WINDOW_MS$1
 		});
 		return true;
 	}
-	if (entry.count >= MAX_REQUESTS_PER_WINDOW) return false;
+	if (entry.count >= MAX_REQUESTS_PER_WINDOW$1) return false;
 	entry.count += 1;
 	return true;
 }
@@ -30917,18 +30950,7 @@ async function postMarketingContactToSlack(input) {
 }
 //#endregion
 //#region src/routes/public/contact/POST.ts
-function clientIp(c) {
-	const forwarded = c.req.header("x-forwarded-for")?.split(",")[0]?.trim();
-	if (forwarded) return forwarded;
-	const realIp = c.req.header("x-real-ip")?.trim();
-	if (realIp) return realIp;
-	try {
-		return getConnInfo(c).remote.address ?? "unknown";
-	} catch {
-		return "unknown";
-	}
-}
-async function handler$1(c) {
+async function handler$2(c) {
 	if (!consumeContactRateLimit(clientIp(c))) return c.json({ error: "Too many requests" }, 429);
 	const parsed = SubmitMarketingContactRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) {
@@ -30950,6 +30972,115 @@ async function handler$1(c) {
 	return c.json(SubmitMarketingContactResponseSchema.parse({ ok: true }), 200);
 }
 //#endregion
+//#region src/routes/public/forms/resolve.ts
+async function resolvePublicWorkflowForm(token) {
+	const publishedForm = await selectEnabledPublishedFormByToken(token);
+	if (!publishedForm) return null;
+	const workflow = await withProjectScope(publishedForm.project.id, () => selectActiveWorkflowBySlug(publishedForm.form.workflowSlug));
+	if (!workflow) return null;
+	const requestSchema = await resolveWorkflowRequestSchema(publishedForm.project.id, workflow);
+	if (!requestSchema) return null;
+	const inputSchema = jsonSchemaToWorkflowInputSchema(requestSchema);
+	if (inputSchema.fields.length === 0 || schemaHasFileFields(inputSchema) || schemaHasUnsupportedFormFields(inputSchema)) return null;
+	return {
+		publishedForm,
+		workflow,
+		requestSchema,
+		inputSchema
+	};
+}
+//#endregion
+//#region src/routes/public/forms/GET.ts
+async function handler$1(c) {
+	const token = c.req.param("token")?.trim();
+	if (!token) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+	const resolved = await resolvePublicWorkflowForm(token);
+	if (!resolved) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+	const { publishedForm, workflow, inputSchema } = resolved;
+	const branding = publishedForm.organization;
+	return c.json(PublicFormMetadataSchema.parse({
+		title: publishedForm.form.title ?? workflow.name,
+		description: publishedForm.form.description ?? workflow.description,
+		fields: resolvePublicFormFields(inputSchema, publishedForm.form.fieldConfig),
+		branding: {
+			organizationName: branding.name,
+			projectName: publishedForm.project.name,
+			logoLightUrl: branding.customLogoEnabled ? branding.logoLightUrl : null,
+			logoDarkUrl: branding.customLogoEnabled ? branding.logoDarkUrl : null,
+			logoHeightPx: branding.logoHeightPx
+		}
+	}));
+}
+//#endregion
+//#region src/lib/public-form-rate-limit.ts
+const WINDOW_MS = 6e4;
+const MAX_REQUESTS_PER_WINDOW = 5;
+const hits = /* @__PURE__ */ new Map();
+/** Limits a visitor's submissions to one published form. */
+function consumePublicFormRateLimit(formToken, ip) {
+	const key = `${formToken}:${ip}`;
+	const now = Date.now();
+	const entry = hits.get(key);
+	if (!entry || now >= entry.resetAt) {
+		hits.set(key, {
+			count: 1,
+			resetAt: now + WINDOW_MS
+		});
+		return true;
+	}
+	if (entry.count >= MAX_REQUESTS_PER_WINDOW) return false;
+	entry.count += 1;
+	return true;
+}
+//#endregion
+//#region src/routes/public/forms/submit/POST.ts
+function parseRunInput(requestSchema, input) {
+	if (typeof z.fromJSONSchema === "function") return z.fromJSONSchema(requestSchema).parse(input ?? {});
+	return z.record(z.string(), z.unknown()).parse(input ?? {});
+}
+function createHandler(promptCreditGate) {
+	return async (c) => {
+		const token = c.req.param("token")?.trim();
+		if (!token) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+		const resolved = await resolvePublicWorkflowForm(token);
+		if (!resolved) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+		if (!consumePublicFormRateLimit(token, clientIp(c))) return c.json(ErrorResponseSchema.parse({ error: "Too many requests" }), 429);
+		const parsed = PublicFormSubmitBodySchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) {
+			const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+			return c.json(ErrorResponseSchema.parse({ error: message }), 400);
+		}
+		if (parsed.data.website?.trim()) return c.json(PublicFormSubmitResponseSchema.parse({ ok: true }), 202);
+		const { publishedForm, requestSchema, workflow } = resolved;
+		if (promptCreditGate) try {
+			const creditResult = await promptCreditGate(publishedForm.organization.id);
+			if (!creditResult.allow) return c.json(ErrorResponseSchema.parse({
+				error: creditResult.reason,
+				message: "This workspace is out of credits. Add credits in billing settings to run workflows."
+			}), 402);
+		} catch (error) {
+			console.error("[public-forms] prompt credit gate failed (allowing):", error);
+		}
+		const organization = await selectOrganizationById(publishedForm.organization.id);
+		if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Form not found" }), 404);
+		try {
+			await withProjectScope(publishedForm.project.id, async () => {
+				const scheduler = await getProjectScheduler(organization, publishedForm.project.id);
+				await enqueueWorkflowRunByKey({
+					workflowKey: workflow.slug,
+					input: parsed.data.values,
+					jobQueue: scheduler,
+					parseInput: (value) => parseRunInput(requestSchema, value)
+				});
+			});
+		} catch (error) {
+			if (error instanceof ZodError) return c.json(validationErrorResponse(error, "Invalid workflow input"), 400);
+			throw error;
+		}
+		return c.json(PublicFormSubmitResponseSchema.parse({ ok: true }), 202);
+	};
+}
+//#endregion
 //#region src/routes/well-known/oauth-client-metadata/GET.ts
 /** Public CIMD document for outbound MCP OAuth (no session required). */
 async function handler(c) {
@@ -30976,8 +31107,10 @@ async function createApp$1(auth, options) {
 		},
 		mountAccount: async (app) => {
 			app.get(OAUTH_CLIENT_METADATA_PATH, handler);
-			app.post("/api/public/contact", handler$1);
-			app.get("/api/public/models", handler$2);
+			app.post("/api/public/contact", handler$2);
+			app.get("/api/public/models", handler$3);
+			app.get("/api/public/forms/:token", handler$1);
+			app.post("/api/public/forms/:token/submit", createHandler(options.promptCreditGate));
 			app.route("/api", mountAccountRoutes({
 				hosting: options.hosting,
 				storage: options.storage,
@@ -31023,28 +31156,6 @@ function usesPgBossScheduler(platformConfig) {
 async function startPlatformServer(platformConfig, hooks = {}) {
 	const runtime = platformConfig.hosting.createRuntime();
 	await initDatabase();
-	migrateAllOrgSchemas({ tryLock: true }).then(async ({ organizationCount, migratedCount, failures, skipped }) => {
-		if (skipped) {
-			console.log("[platform] org schema migrate-all skipped (another machine holds the cluster lock)");
-			return;
-		}
-		console.log(`Applied org runtime migrations for ${migratedCount}/${organizationCount} organization(s).`);
-		for (const failure of failures) {
-			console.error(`[platform] org schema migration failed for ${failure.organizationId} (${failure.dbSchema})`, failure.error);
-			await captureException({
-				error: failure.error,
-				organizationId: failure.organizationId,
-				operation: "platform.migrate_org_schema",
-				properties: { db_schema: failure.dbSchema }
-			});
-		}
-	}).catch((error) => {
-		console.error("[platform] background org schema migrate-all failed", error);
-		captureException({
-			error,
-			operation: "platform.migrate_org_schema"
-		});
-	});
 	await ensureKeystrokeAssetsBucket();
 	await seedOAuthAppsFromEnvForAllOrganizations();
 	if (usesPgBossScheduler(platformConfig)) await ensureProjectPgBossGrants();
@@ -31139,4 +31250,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { r1 as S, o as _, c as a, b$1 as b, a$1 as c, c$1 as d, r as f, e as g, u as h, n$1 as i, d$1 as l, b as m, n, p as o, r$1 as p, i as r, x as s, startPlatformServer as t, x$1 as u, r$3 as v, I1 as x, h as y };
 
-//# sourceMappingURL=start-DAmqO4hu.mjs.map
+//# sourceMappingURL=start-7oMxob_7.mjs.map