@keystrokehq/platform 0.1.165 → 0.1.167

package/dist/{start-Dd2kW-r_.mjs → start-Dc5awJbc.mjs}

@@ -1,6 +1,6 @@
-import { C as setManagedServiceCredential, S as setCredentialInstanceSecretValue, _ as withMcpReadClient, a as completeMcpOAuthConnect, b as readCredentialInstanceSecret, c as describeCredentialBindings, d as discoverOpenApiApp, f as isDiscoveryError, g as PublicHttpUrlError, h as withCredentialAssignments, i as beginMcpOAuthConnect, l as discoverGraphqlApp, m as verifyOAuthState, n as cronPayloadSchema, o as createOAuthState, p as resolveConnectedMcpAuthHeaders, r as McpOAuthConnectError, s as decodeOAuthState, u as discoverMcpApp, v as deleteCredentialInstanceSecret, x as setCredentialInstanceSecret, y as deleteManagedServiceCredential$1 } from "./dist-DVEPOwmL.mjs";
-import { $ as AppSlugAvailabilityResponseSchema, $n as ProjectGitStatusResponseSchema, $r as UpdateProjectMemberRequestSchema, $t as HistoryRunDetailResponseSchema, A as prefetchCanvasShards, Ai as buildSlackAppManifest, An as McpDiscoverResponseSchema, Ar as SlugAvailabilityQuerySchema, At as DRAFT_SNAPSHOT_PLACEHOLDER_COMMIT_SHA, Ba as resolvePublicPlatformOrigin, Br as SubmitTeamRequestResponseSchema, Bt as DuplicateCredentialRequestSchema, C as keystrokeAssetsAppLogoKeyFromPublicUrl, Ca as PresignChatAttachmentResponseSchema, Ci as WorkspaceTriggerListResponseSchema, Cn as ListProjectMembersResponseSchema, Cr as SkillSummaryDetailResponseSchema, Ct as CreateProjectRequestSchema, Da as MICRO_CREDITS_PER_CREDIT, Di as agentMemoryFileId, Dn as ManagedServiceCredentialSchema, Dr as SlackAppListResponseSchema, Dt as DEFAULT_TRIGGER_OVERVIEW_MODEL, E as loadProjectSourceFiles, Ea as isAllowedChatAttachmentMediaType, Ei as WorkspaceWorkflowOverviewSchema, En as ListTemplatesResponseSchema, Er as SlackAppInstallStartResponseSchema, Et as CreateSlackAppResponseSchema, F as projectSourceBlobKey, Fa as verifyOrgWorkerToken, Fi as isDraftSnapshotPlaceholderCommitSha, Fn as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, Fr as SubmitAgentFeedbackRequestSchema, Ft as DraftCommitResponseSchema, G as AgentEnvImageSnapshotResponseSchema, Gi as mapOrganizationInvitation, Gn as PresignOrgLogoRequestSchema, Gr as TriggerInvokeRequestSchema, Gt as GetAppCatalogEntryResponseSchema, H as ActionsCatalogShardSchema, Hi as jsonSchemaToWorkflowInputSchema, Hn as PrepareManagedDeployResponseSchema, Hr as TemplateKindSchema, Ht as ErrorResponseSchema, I as publicKeystrokeAssetsObjectUrl, Ii as isHelloWorldTemplateSlug, Ir as SubmitAgentFeedbackResponseSchema, It as DraftConflictResponseSchema, J as AgentSummaryDetailResponseSchema, Ji as mapProjectArtifact, Jn as PresignProjectSourceResponseSchema, Jr as UpdateCredentialRequestSchema, Jt as GetTemplateResponseSchema, K as AgentManifestShardSchema, Ki as mapOrganizationMember, Kn as PresignOrgLogoResponseSchema, Kr as TriggerInvokeResponseSchema, Kt as GetCredentialResponseSchema, L as putBrowserProfileMeta, La as DEFAULT_CLOUD_PLATFORM_ORIGIN, Ln as PROJECT_SLUG_TAKEN_MESSAGE, Lr as SubmitMarketingContactRequestSchema, Lt as DraftFileContentQuerySchema, Ma as mintOrgWorkerToken, Mi as displayCredentialAppName, Mn as OpenApiDiscoverResponseSchema, Mr as StartMcpOAuthConnectionInputSchema, Mt as DeclineOrganizationInvitationResponseSchema, N as projectArtifactKey, Nn as OrganizationSidebarBrandingPatchSchema, Nr as StartMcpOAuthConnectionResultSchema, Nt as DownloadActiveProjectArtifactResponseSchema, O as openModularArtifactShards, Oa as credentialInputSchema, Oi as agentWorkspaceFileId, On as ManagedServiceKindSchema, Or as SlackAppManifestRequestSchema, Ot as DEFAULT_WORKFLOW_CANVAS_MODEL, Pn as OrganizationSidebarBrandingSchema, Pr as StoredProjectSourceManifestSchema, Pt as DownloadActiveProjectSourceResponseSchema, Q as AppSlugAvailabilityQuerySchema, Qi as mapUserOrganization, Qn as ProjectGitRemoteResponseSchema, Qr as UpdateOrganizationRequestSchema, Qt as HistoryRunCancelResponseSchema, R as putBrowserSessionMeta, Ra as resolveExternalPlatformOrigin, Ri as isLlmProviderSlug, Rr as SubmitMarketingContactResponseSchema, Rt as DraftRevisionResponseSchema, S as isUserAvatarStorageKey, Sa as PresignChatAttachmentRequestSchema, Si as WorkspaceTriggerFileSchema, Sn as ListProjectFilesResponseSchema, Sr as SLACK_KEYSTROKE_APP_SLUG, St as CreateProjectArtifactResponseSchema, T as keystrokeAssetsOrgLogoKeyFromPublicUrl, Ta as chatAttachmentExtension, Ti as WorkspaceTriggerRunListResponseSchema, Tn as ListProjectsResponseSchema, Tr as SkillSummarySchema, Tt as CreateSlackAppRequestSchema, U as ActiveOrganizationResponseSchema, Ui as jsonSchemaToZod, Un as PresignCustomAppLogoRequestSchema, Ur as TriggerAttachmentUpdateRequestSchema, Ut as FinalizeCustomAppLogoRequestSchema, V as AcceptOrganizationInvitationResponseSchema, Vi as isSlackCustomAppOauthSlug, Vn as PrepareManagedDeployRequestSchema, Vr as TemplateFilesResponseSchema, Vt as DuplicateCredentialsResponseSchema, W as ActiveProjectSourceRevisionSchema, Wi as listenPortFromPublicUrl, Wn as PresignCustomAppLogoResponseSchema, Wr as TriggerInvokeInputsSchema, Wt as FinalizeCustomAppLogoResponseSchema, X as AgentSummarySchema, Xi as mapProjectMember, Xn as PresignUserAvatarResponseSchema, Xr as UpdateOrganizationMemberRequestSchema, Xt as GraphqlDiscoverResponseSchema, Y as AgentSummaryListResponseSchema, Yi as mapProjectDeployment, Yn as PresignUserAvatarRequestSchema, Yr as UpdateManagedServiceCredentialRequestSchema, Yt as GraphqlDiscoverRequestSchema, Z as AgentWorkspaceFileSummarySchema, Zi as mapProjectSettings, Zn as ProjectGitRemoteRequestSchema, Zr as UpdateOrganizationMemberResponseSchema, Zt as HeartbeatManagedDeployResponseSchema, _ as isOrgLogoStorageKey, _a as validateFormFieldConfig, _i as WorkflowRunInputsSchema, _n as ListOrganizationInvitationsResponseSchema, _r as SLACK_CUSTOM_APP_BOT_SCOPES, _t as CreateDraftCommitRequestSchema, a as createAssetsStorageClient, aa as organizationSlugErrorCodeFromMessage, ai as UserAvatarPatchSchema, an as InviteProjectMembersResponseSchema, ar as ProjectSourceResourcesSchema, at as ChannelPlatformSchema, b as isStorageBucketNotFoundError, bi as WorkflowSummarySchema, bn as ListOrganizationsResponseSchema, br as SLACK_GATEWAY_OAUTH_APP_KEY, bt as CreateOrganizationResponseSchema, ca as projectFileId, ci as UserPreferencesSchema, cn as ListApiKeysResponseSchema, cr as PublicFormSubmitResponseSchema, ct as CompleteProjectArtifactRequestSchema, d as isAppLogoStorageKey, da as schemaHasFileFields, di as WorkflowCanvasSchema, dn as ListChannelPlatformsResponseSchema, dr as PublishedFormListResponseSchema, dt as CreateApiKeyRequestSchema, ea as mergeUserPreferences, ei as UpdateProjectMemberResponseSchema, en as HistoryRunListQuerySchema, er as ProjectReachabilityResponseSchema, f as isBrowserMediaStorageKey, fa as schemaHasUnsupportedFormFields, fi as WorkflowFormResponseSchema, fn as ListCredentialsPageQuerySchema, fr as PublishedFormSchema, ft as CreateApiKeyResponseSchema, g as isKeystrokeAssetsOrgLogoPublicUrl, ga as validateCredentialValueAgainstFields, gi as WorkflowRunInputsPutBodySchema, gn as ListMcpAppToolsResponseSchema, gr as RenewManagedDeployUploadResponseSchema, gt as CreateCustomAppResponseSchema, h as isKeystrokeAssetsAvatarPublicUrl, ha as slackCustomAppOauthSlug, hi as WorkflowManifestMetaShardSchema, hn as ListManagedServiceCredentialsResponseSchema, hr as RenewManagedDeployUploadRequestSchema, ht as CreateCustomAppRequestSchema, i as chatAttachmentStorageKey, ia as organizationInvitationAcceptPath, ii as UploadProjectSourceResponseSchema, in as InviteProjectMembersRequestSchema, ir as ProjectSlugAvailabilityResponseSchema, it as CancelManagedDeployResponseSchema, j as projectArtifactBlobKey, ji as deriveCredentialInstanceSlug, jn as OpenApiDiscoverRequestSchema, jr as SlugAvailabilityResponseSchema, jt as DbProxyQueryRequestSchema, k as orgLogoStorageKey, ki as buildCredentialInstanceLabel, kn as McpDiscoverRequestSchema, kr as SlackAppManifestResponseSchema, kt as DEFAULT_WORKFLOW_OVERVIEW_MODEL, l as getBrowserProfileMeta, la as resolvePublicFormFields, li as WorkflowCanvasCredentialBindingsSchema, ln as ListAppsResponseSchema, lr as PublishManagedDeployCandidateRequestSchema, lt as CompleteProjectArtifactResponseSchema, m as isKeystrokeAssetsAppLogoPublicUrl, ma as slackCustomAppHandleFromSlug, mi as WorkflowManifestFlowShardSchema, mn as ListDraftFilesResponseSchema, mr as RecentResourceSchema, mt as CreateCredentialsResponseSchema, n as publishDraftUpdateBestEffort, na as normalizeUserPreferences, ni as UpdateProjectSettingsRequestSchema, nn as InviteOrganizationMembersRequestSchema, nr as ProjectSettingsResponseSchema, nt as BrowserResumeStateSchema, o as ensureKeystrokeAssetsBucket, oa as parseAppSlug, oi as UserAvatarSchema, on as ListAgentMemoryFilesResponseSchema, or as PublicFormMetadataSchema, ot as CompleteManagedDeployArtifactRequestSchema, p as isChatAttachmentStorageKey, pa as slackAppBindingChannelId, pi as WorkflowFormUpsertBodySchema, pn as ListCredentialsPageResponseSchema, pr as RecentResourceListResponseSchema, pt as CreateCredentialsRequestSchema, q as AgentMemoryFileSummarySchema, qi as mapProject, qn as PresignProjectSourceRequestSchema, qr as TriggerRunListQuerySchema, qt as GetCustomAppResponseSchema, r as appLogoStorageKey, ri as UploadProjectSourceManifestRequestSchema, rn as InviteOrganizationMembersResponseSchema, rr as ProjectSlugAvailabilityQuerySchema, rt as CancelManagedDeployRequestSchema, s as extractRouteManifestFromArtifact, sa as parseStoredRouteManifest, si as UserPreferencesPatchSchema, sn as ListAgentWorkspaceFilesResponseSchema, sr as PublicFormSubmitBodySchema, st as CompleteManagedDeployArtifactResponseSchema, t as createInProcessProjectDraftNotifier, ta as normalizeSlackAppHandle, ti as UpdateProjectRequestSchema, tn as HistoryRunListResponseSchema, tr as ProjectResponseSchema, tt as BrainReferenceSchema, u as getBrowserSessionMeta, ua as resolveUniqueCredentialInstanceLabel, ui as WorkflowCanvasRunSchema, ur as PublishManagedDeployCandidateResponseSchema, ut as ConnectManagedServiceCredentialRequestSchema, v as isProjectArtifactIndexKey, va as validateWorkflowRunInputValues, vi as WorkflowSummaryDetailResponseSchema, vn as ListOrganizationMembersPageQuerySchema, vr as SLACK_CUSTOM_APP_CREDENTIAL_SLUG, vt as CreateDraftDiffCommitRequestSchema, w as keystrokeAssetsAvatarKeyFromPublicUrl, wa as PublicModelsResponseSchema, wi as WorkspaceTriggerOverviewSchema, wn as ListProjectMetricsResponseSchema, wr as SkillSummaryListResponseSchema, wt as CreateProjectResponseSchema, x as isStorageNotFoundError$1, xa as FilePartSchema, xi as WorkspaceTriggerDetailSchema, xn as ListProjectDeploymentsResponseSchema, xr as SLACK_KEYSTROKE_APP_BOT_SCOPES, xt as CreateProjectArtifactRequestSchema, ya as validationErrorResponse, yi as WorkflowSummaryListResponseSchema, yn as ListOrganizationMembersPageResponseSchema, yr as SLACK_CUSTOM_APP_SLUG_PREFIX, yt as CreateOrganizationRequestSchema, z as userAvatarStorageKey, za as resolvePublicPlatformApiOrigin, zr as SubmitTeamRequestRequestSchema, zt as DraftUpdateEventSchema } from "./project-draft-notifier-BSypKj9V.mjs";
-import { $ as canInviteToProject, A as toProjectGitRepository, B as requireSession, C as createProjectSourceServiceFactory, D as ProjectRepositoryNotReadyError, E as trackProductEvent, F as authorize, G as agentListScope, H as routeProject, I as forbidden, J as canAccessAgent, K as apiKeyListScope, L as requireOrganization, O as archiveProjectRepositoryInline, P as isProjectGitProviderError, Q as canInviteRole, R as requireProject, T as identifyOrganizationGroup, U as accessContext, V as requireVerifiedOrganization, W as getProjectInvitePermission, X as canAccessSkill, Y as canAccessHistoryRun, Z as canAccessWorkflow, _ as commitProjectDraftFromDiff, a as cancelManagedDeploy, at as credentialListScope, c as prepareManagedDeploy, ct as organizationActions, d as ManagedDeployError, dt as skillListScope, et as canReadApiKey, f as deleteManagedDeployCandidateBestEffort, ft as userActions, g as commitProjectDraft, gt as pingProjectTarget, ht as log, i as workerOrganizationIdFromContext, it as checkPermission, j as MANAGED_DRAFT_BRANCH, k as provisionProjectRepositoryInline, l as publishManagedDeployCandidate, lt as projectActions, mt as event, n as readWorkerTokenFromRequest, nt as canRevokeApiKey, o as completeManagedDeployArtifact, ot as historyListScope, p as promoteManagedDeployMain, pt as workflowListScope, q as apiKeysActions, r as requireWorkerToken, rt as canViewCredential, s as heartbeatManagedDeploy, st as managedServicesActions, t as withProjectScope, tt as canReadProject, u as renewManagedDeployUpload, ut as projectListScope, v as mapDraftCommitError, w as mapProjectSourceError, x as assertAvailable, y as ensureProjectRepositoryReady, z as requireProjectMembership } from "./with-project-scope-Qyn-vEQT.mjs";
+import { C as setManagedServiceCredential, S as setCredentialInstanceSecretValue, _ as withMcpReadClient, a as completeMcpOAuthConnect, b as readCredentialInstanceSecret, c as describeCredentialBindings, d as discoverOpenApiApp, f as isDiscoveryError, g as PublicHttpUrlError, h as withCredentialAssignments, i as beginMcpOAuthConnect, l as discoverGraphqlApp, m as verifyOAuthState, n as cronPayloadSchema, o as createOAuthState, p as resolveConnectedMcpAuthHeaders, r as McpOAuthConnectError, s as decodeOAuthState, u as discoverMcpApp, v as deleteCredentialInstanceSecret, x as setCredentialInstanceSecret, y as deleteManagedServiceCredential$1 } from "./dist-Bkbex-w_.mjs";
+import { $ as AppSlugAvailabilityResponseSchema, $i as mapUserOrganization, $n as ProjectGitRemoteResponseSchema, $r as UpdateOrganizationRequestSchema, $t as HistoryRunCancelResponseSchema, A as prefetchCanvasShards, Ai as buildCredentialInstanceLabel, An as McpDiscoverRequestSchema, Ar as SlackAppManifestResponseSchema, At as DEFAULT_WORKFLOW_OVERVIEW_MODEL, Ba as resolvePublicPlatformApiOrigin, Br as SubmitTeamRequestRequestSchema, Bt as DraftUpdateEventSchema, C as keystrokeAssetsAppLogoKeyFromPublicUrl, Ca as PresignChatAttachmentRequestSchema, Ci as WorkspaceTriggerFileSchema, Cn as ListProjectFilesResponseSchema, Cr as SLACK_KEYSTROKE_APP_SLUG, Ct as CreateProjectRequestSchema, Da as isAllowedChatAttachmentMediaType, Di as WorkspaceWorkflowOverviewSchema, Dn as ListTemplatesResponseSchema, Dr as SlackAppInstallStartResponseSchema, Dt as CredentialMaterializeRequestSchema, E as loadProjectSourceFiles, Ea as chatAttachmentExtension, Ei as WorkspaceTriggerRunListResponseSchema, En as ListProjectsResponseSchema, Er as SkillSummarySchema, Et as CreateSlackAppResponseSchema, F as projectSourceBlobKey, Fn as OrganizationSidebarBrandingSchema, Fr as StoredProjectSourceManifestSchema, Ft as DownloadActiveProjectSourceResponseSchema, G as AgentEnvImageSnapshotResponseSchema, Gi as listenPortFromPublicUrl, Gn as PresignCustomAppLogoResponseSchema, Gr as TriggerInvokeInputsSchema, Gt as FinalizeCustomAppLogoResponseSchema, H as ActionsCatalogShardSchema, Hi as isSlackCustomAppOauthSlug, Hn as PrepareManagedDeployRequestSchema, Hr as TemplateFilesResponseSchema, Ht as DuplicateCredentialsResponseSchema, I as publicKeystrokeAssetsObjectUrl, Ia as verifyOrgWorkerToken, Ii as isDraftSnapshotPlaceholderCommitSha, In as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, Ir as SubmitAgentFeedbackRequestSchema, It as DraftCommitResponseSchema, J as AgentSummaryDetailResponseSchema, Ji as mapProject, Jn as PresignProjectSourceRequestSchema, Jr as TriggerRunListQuerySchema, Jt as GetCustomAppResponseSchema, K as AgentManifestShardSchema, Ki as mapOrganizationInvitation, Kn as PresignOrgLogoRequestSchema, Kr as TriggerInvokeRequestSchema, Kt as GetAppCatalogEntryResponseSchema, L as putBrowserProfileMeta, Li as isHelloWorldTemplateSlug, Lr as SubmitAgentFeedbackResponseSchema, Lt as DraftConflictResponseSchema, Mi as deriveCredentialInstanceSlug, Mn as OpenApiDiscoverRequestSchema, Mr as SlugAvailabilityResponseSchema, Mt as DbProxyQueryRequestSchema, N as projectArtifactKey, Na as mintOrgWorkerToken, Ni as displayCredentialAppName, Nn as OpenApiDiscoverResponseSchema, Nr as StartMcpOAuthConnectionInputSchema, Nt as DeclineOrganizationInvitationResponseSchema, O as openModularArtifactShards, Oa as MICRO_CREDITS_PER_CREDIT, Oi as agentMemoryFileId, On as ManagedServiceCredentialSchema, Or as SlackAppListResponseSchema, Ot as DEFAULT_TRIGGER_OVERVIEW_MODEL, Pn as OrganizationSidebarBrandingPatchSchema, Pr as StartMcpOAuthConnectionResultSchema, Pt as DownloadActiveProjectArtifactResponseSchema, Q as AppSlugAvailabilityQuerySchema, Qi as mapProjectSettings, Qn as ProjectGitRemoteRequestSchema, Qr as UpdateOrganizationMemberResponseSchema, Qt as HeartbeatManagedDeployResponseSchema, R as putBrowserSessionMeta, Ra as DEFAULT_CLOUD_PLATFORM_ORIGIN, Rn as PROJECT_SLUG_TAKEN_MESSAGE, Rr as SubmitMarketingContactRequestSchema, Rt as DraftFileContentQuerySchema, S as isUserAvatarStorageKey, Sa as FilePartSchema, Si as WorkspaceTriggerDetailSchema, Sn as ListProjectDeploymentsResponseSchema, Sr as SLACK_KEYSTROKE_APP_BOT_SCOPES, St as CreateProjectArtifactResponseSchema, T as keystrokeAssetsOrgLogoKeyFromPublicUrl, Ta as PublicModelsResponseSchema, Ti as WorkspaceTriggerOverviewSchema, Tn as ListProjectMetricsResponseSchema, Tr as SkillSummaryListResponseSchema, Tt as CreateSlackAppRequestSchema, U as ActiveOrganizationResponseSchema, Ui as jsonSchemaToWorkflowInputSchema, Un as PrepareManagedDeployResponseSchema, Ur as TemplateKindSchema, Ut as ErrorResponseSchema, V as AcceptOrganizationInvitationResponseSchema, Va as resolvePublicPlatformOrigin, Vr as SubmitTeamRequestResponseSchema, Vt as DuplicateCredentialRequestSchema, W as ActiveProjectSourceRevisionSchema, Wi as jsonSchemaToZod, Wn as PresignCustomAppLogoRequestSchema, Wr as TriggerAttachmentUpdateRequestSchema, Wt as FinalizeCustomAppLogoRequestSchema, X as AgentSummarySchema, Xi as mapProjectDeployment, Xn as PresignUserAvatarRequestSchema, Xr as UpdateManagedServiceCredentialRequestSchema, Xt as GraphqlDiscoverRequestSchema, Y as AgentSummaryListResponseSchema, Yi as mapProjectArtifact, Yn as PresignProjectSourceResponseSchema, Yr as UpdateCredentialRequestSchema, Yt as GetTemplateResponseSchema, Z as AgentWorkspaceFileSummarySchema, Zi as mapProjectMember, Zn as PresignUserAvatarResponseSchema, Zr as UpdateOrganizationMemberRequestSchema, Zt as GraphqlDiscoverResponseSchema, _ as isOrgLogoStorageKey, _a as validateCredentialValueAgainstFields, _i as WorkflowRunInputsPutBodySchema, _n as ListMcpAppToolsResponseSchema, _r as RenewManagedDeployUploadResponseSchema, _t as CreateDraftCommitRequestSchema, a as createAssetsStorageClient, aa as organizationInvitationAcceptPath, ai as UploadProjectSourceResponseSchema, an as InviteProjectMembersRequestSchema, ar as ProjectSlugAvailabilityResponseSchema, at as ChannelPlatformSchema, b as isStorageBucketNotFoundError, ba as validationErrorResponse, bi as WorkflowSummaryListResponseSchema, bn as ListOrganizationMembersPageResponseSchema, br as SLACK_CUSTOM_APP_SLUG_PREFIX, bt as CreateOrganizationResponseSchema, ca as parseStoredRouteManifest, ci as UserPreferencesPatchSchema, cn as ListAgentWorkspaceFilesResponseSchema, cr as PublicFormSubmitBodySchema, ct as CompleteProjectArtifactRequestSchema, d as isAppLogoStorageKey, da as resolveUniqueCredentialInstanceLabel, di as WorkflowCanvasRunSchema, dr as PublishManagedDeployCandidateResponseSchema, dt as CreateApiKeyRequestSchema, ei as UpdateProjectMemberRequestSchema, en as HistoryRunDetailResponseSchema, er as ProjectGitStatusResponseSchema, f as isBrowserMediaStorageKey, fa as schemaHasFileFields, fi as WorkflowCanvasSchema, fn as ListChannelPlatformsResponseSchema, fr as PublishedFormListResponseSchema, ft as CreateApiKeyResponseSchema, g as isKeystrokeAssetsOrgLogoPublicUrl, ga as slackCustomAppOauthSlug, gi as WorkflowManifestMetaShardSchema, gn as ListManagedServiceCredentialsResponseSchema, gr as RenewManagedDeployUploadRequestSchema, gt as CreateCustomAppResponseSchema, h as isKeystrokeAssetsAvatarPublicUrl, ha as slackCustomAppHandleFromSlug, hi as WorkflowManifestFlowShardSchema, hn as ListDraftFilesResponseSchema, hr as RecentResourceSchema, ht as CreateCustomAppRequestSchema, i as chatAttachmentStorageKey, ii as UploadProjectSourceManifestRequestSchema, in as InviteOrganizationMembersResponseSchema, ir as ProjectSlugAvailabilityQuerySchema, it as CancelManagedDeployResponseSchema, j as projectArtifactBlobKey, ji as buildSlackAppManifest, jn as McpDiscoverResponseSchema, jr as SlugAvailabilityQuerySchema, jt as DRAFT_SNAPSHOT_PLACEHOLDER_COMMIT_SHA, k as orgLogoStorageKey, ka as credentialInputSchema, ki as agentWorkspaceFileId, kn as ManagedServiceKindSchema, kr as SlackAppManifestRequestSchema, kt as DEFAULT_WORKFLOW_CANVAS_MODEL, l as getBrowserProfileMeta, la as projectFileId, li as UserPreferencesSchema, ln as ListApiKeysResponseSchema, lr as PublicFormSubmitResponseSchema, lt as CompleteProjectArtifactResponseSchema, m as isKeystrokeAssetsAppLogoPublicUrl, ma as slackAppBindingChannelId, mi as WorkflowFormUpsertBodySchema, mn as ListCredentialsPageResponseSchema, mr as RecentResourceListResponseSchema, mt as CreateCredentialsResponseSchema, n as publishDraftUpdateBestEffort, na as normalizeSlackAppHandle, ni as UpdateProjectRequestSchema, nn as HistoryRunListResponseSchema, nr as ProjectResponseSchema, nt as BrowserResumeStateSchema, o as ensureKeystrokeAssetsBucket, oa as organizationSlugErrorCodeFromMessage, oi as UserAvatarPatchSchema, on as InviteProjectMembersResponseSchema, or as ProjectSourceResourcesSchema, ot as CompleteManagedDeployArtifactRequestSchema, p as isChatAttachmentStorageKey, pa as schemaHasUnsupportedFormFields, pi as WorkflowFormResponseSchema, pn as ListCredentialsPageQuerySchema, pr as PublishedFormSchema, pt as CreateCredentialsRequestSchema, q as AgentMemoryFileSummarySchema, qi as mapOrganizationMember, qn as PresignOrgLogoResponseSchema, qr as TriggerInvokeResponseSchema, qt as GetCredentialResponseSchema, r as appLogoStorageKey, ra as normalizeUserPreferences, ri as UpdateProjectSettingsRequestSchema, rn as InviteOrganizationMembersRequestSchema, rr as ProjectSettingsResponseSchema, rt as CancelManagedDeployRequestSchema, s as extractRouteManifestFromArtifact, sa as parseAppSlug, si as UserAvatarSchema, sn as ListAgentMemoryFilesResponseSchema, sr as PublicFormMetadataSchema, st as CompleteManagedDeployArtifactResponseSchema, t as createInProcessProjectDraftNotifier, ta as mergeUserPreferences, ti as UpdateProjectMemberResponseSchema, tn as HistoryRunListQuerySchema, tr as ProjectReachabilityResponseSchema, tt as BrainReferenceSchema, u as getBrowserSessionMeta, ua as resolvePublicFormFields, ui as WorkflowCanvasCredentialBindingsSchema, un as ListAppsResponseSchema, ur as PublishManagedDeployCandidateRequestSchema, ut as ConnectManagedServiceCredentialRequestSchema, v as isProjectArtifactIndexKey, va as validateFormFieldConfig, vi as WorkflowRunInputsSchema, vn as ListOrganizationInvitationsResponseSchema, vr as SLACK_CUSTOM_APP_BOT_SCOPES, vt as CreateDraftDiffCommitRequestSchema, w as keystrokeAssetsAvatarKeyFromPublicUrl, wa as PresignChatAttachmentResponseSchema, wi as WorkspaceTriggerListResponseSchema, wn as ListProjectMembersResponseSchema, wr as SkillSummaryDetailResponseSchema, wt as CreateProjectResponseSchema, x as isStorageNotFoundError$1, xi as WorkflowSummarySchema, xn as ListOrganizationsResponseSchema, xr as SLACK_GATEWAY_OAUTH_APP_KEY, xt as CreateProjectArtifactRequestSchema, ya as validateWorkflowRunInputValues, yi as WorkflowSummaryDetailResponseSchema, yn as ListOrganizationMembersPageQuerySchema, yr as SLACK_CUSTOM_APP_CREDENTIAL_SLUG, yt as CreateOrganizationRequestSchema, z as userAvatarStorageKey, za as resolveExternalPlatformOrigin, zi as isLlmProviderSlug, zr as SubmitMarketingContactResponseSchema, zt as DraftRevisionResponseSchema } from "./project-draft-notifier-CWDmJI58.mjs";
+import { $ as canInviteToProject, A as toProjectGitRepository, B as requireSession, C as createProjectSourceServiceFactory, D as ProjectRepositoryNotReadyError, E as trackProductEvent, F as authorize, G as agentListScope, H as routeProject, I as forbidden, J as canAccessAgent, K as apiKeyListScope, L as requireOrganization, O as archiveProjectRepositoryInline, P as isProjectGitProviderError, Q as canInviteRole, R as requireProject, T as identifyOrganizationGroup, U as accessContext, V as requireVerifiedOrganization, W as getProjectInvitePermission, X as canAccessSkill, Y as canAccessHistoryRun, Z as canAccessWorkflow, _ as commitProjectDraftFromDiff, a as cancelManagedDeploy, at as credentialListScope, c as prepareManagedDeploy, ct as organizationActions, d as ManagedDeployError, dt as skillListScope, et as canReadApiKey, f as deleteManagedDeployCandidateBestEffort, ft as userActions, g as commitProjectDraft, gt as pingProjectTarget, ht as log, i as workerOrganizationIdFromContext, it as checkPermission, j as MANAGED_DRAFT_BRANCH, k as provisionProjectRepositoryInline, l as publishManagedDeployCandidate, lt as projectActions, mt as event, n as readWorkerTokenFromRequest, nt as canRevokeApiKey, o as completeManagedDeployArtifact, ot as historyListScope, p as promoteManagedDeployMain, pt as workflowListScope, q as apiKeysActions, r as requireWorkerToken, rt as canViewCredential, s as heartbeatManagedDeploy, st as managedServicesActions, t as withProjectScope, tt as canReadProject, u as renewManagedDeployUpload, ut as projectListScope, v as mapDraftCommitError, w as mapProjectSourceError, x as assertAvailable, y as ensureProjectRepositoryReady, z as requireProjectMembership } from "./with-project-scope-fwIUr56U.mjs";
 import "./chunk-BZUGFHVS-B2NchobP.mjs";
 import { n as d$4, t as _$1 } from "./chunk-TN7HHBQW-B8PYcKz5.mjs";
 import { getCachedPublicModelIds, loadPublicModelIds } from "./lib/public-models.mjs";
@@ -73,6 +73,29 @@ function authorizePayload(schema, allow) {
 	};
 }
 //#endregion
+//#region src/auth/require-verified-account-organization.ts
+const ORGANIZATION_PATH = /^\/organizations\/[^/]+$/;
+function isPendingOrganizationRoute(method, path) {
+	return method === "GET" && (path === "/organizations" || path === "/organizations/slug-available" || ORGANIZATION_PATH.test(path)) || method === "POST" && (path === "/organizations" || path === "/team-requests");
+}
+/** Blocks authenticated account APIs except the minimum pending-organization flow. */
+function requireVerifiedAccountOrganization() {
+	const requireOrg = requireOrganization();
+	const requireVerifiedOrg = requireVerifiedOrganization();
+	return async (c, next) => {
+		const path = c.req.path.replace(/^\/api(?=\/|$)/, "");
+		if (isPendingOrganizationRoute(c.req.method, path)) {
+			await next();
+			return;
+		}
+		let response = void 0;
+		await requireOrg(c, async () => {
+			response = await requireVerifiedOrg(c, next);
+		});
+		return response;
+	};
+}
+//#endregion
 //#region src/auth/require-organization-param.ts
 function requireOrganizationParam() {
 	return async (c, next) => {
@@ -23042,43 +23065,43 @@ var tt = [
 	},
 	{
 		name: "cat",
-		load: async () => (await import("./cat-TSFMZVYS-hN-NJypJ.mjs")).catCommand
+		load: async () => (await import("./cat-TSFMZVYS-CGn6llPo.mjs")).catCommand
 	},
 	{
 		name: "printf",
-		load: async () => (await import("./printf-TWGXF445-Cx6Y3mmb.mjs")).printfCommand
+		load: async () => (await import("./printf-TWGXF445-CkIUXuiT.mjs")).printfCommand
 	},
 	{
 		name: "ls",
-		load: async () => (await import("./ls-ZJGQER7M-C-7m3nRV.mjs")).lsCommand
+		load: async () => (await import("./ls-ZJGQER7M-DA9jw5QB.mjs")).lsCommand
 	},
 	{
 		name: "mkdir",
-		load: async () => (await import("./mkdir-MEPGZOB6-B_3AnUeG.mjs")).mkdirCommand
+		load: async () => (await import("./mkdir-MEPGZOB6-1fTQLXh9.mjs")).mkdirCommand
 	},
 	{
 		name: "rmdir",
-		load: async () => (await import("./rmdir-OC4ZLPYA-CzTND9Wh.mjs")).rmdirCommand
+		load: async () => (await import("./rmdir-OC4ZLPYA-BFlTS2Wx.mjs")).rmdirCommand
 	},
 	{
 		name: "touch",
-		load: async () => (await import("./touch-UA33VN3N-CmApU3Hy.mjs")).touchCommand
+		load: async () => (await import("./touch-UA33VN3N-CT-yOZ5s.mjs")).touchCommand
 	},
 	{
 		name: "rm",
-		load: async () => (await import("./rm-SSGETQVQ-CjLz0GMi.mjs")).rmCommand
+		load: async () => (await import("./rm-SSGETQVQ-CokMXrPQ.mjs")).rmCommand
 	},
 	{
 		name: "cp",
-		load: async () => (await import("./cp-BISAAS7A-vA4qAJaH.mjs")).cpCommand
+		load: async () => (await import("./cp-BISAAS7A-aSSo5A_f.mjs")).cpCommand
 	},
 	{
 		name: "mv",
-		load: async () => (await import("./mv-W5BIQ646-2m18zeH1.mjs")).mvCommand
+		load: async () => (await import("./mv-W5BIQ646-Cbx7GDaP.mjs")).mvCommand
 	},
 	{
 		name: "ln",
-		load: async () => (await import("./ln-4LGSXXGD-DAxrAOYW.mjs")).lnCommand
+		load: async () => (await import("./ln-4LGSXXGD-DGnxBJnR.mjs")).lnCommand
 	},
 	{
 		name: "chmod",
@@ -23094,15 +23117,15 @@ var tt = [
 	},
 	{
 		name: "head",
-		load: async () => (await import("./head-442HYESI-CdxxS0eK.mjs")).headCommand
+		load: async () => (await import("./head-442HYESI-Dd0pLJ0n.mjs")).headCommand
 	},
 	{
 		name: "tail",
-		load: async () => (await import("./tail-R4PCA2C4-CjWssz0p.mjs")).tailCommand
+		load: async () => (await import("./tail-R4PCA2C4-BpuY1mDk.mjs")).tailCommand
 	},
 	{
 		name: "wc",
-		load: async () => (await import("./wc-LF7NU4LA-OBDH-9RV.mjs")).wcCommand
+		load: async () => (await import("./wc-LF7NU4LA-BsMOl-bO.mjs")).wcCommand
 	},
 	{
 		name: "stat",
@@ -23110,95 +23133,95 @@ var tt = [
 	},
 	{
 		name: "grep",
-		load: async () => (await import("./grep-V3LQVMRQ-DoamEVxq.mjs")).grepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).grepCommand
 	},
 	{
 		name: "fgrep",
-		load: async () => (await import("./grep-V3LQVMRQ-DoamEVxq.mjs")).fgrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).fgrepCommand
 	},
 	{
 		name: "egrep",
-		load: async () => (await import("./grep-V3LQVMRQ-DoamEVxq.mjs")).egrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).egrepCommand
 	},
 	{
 		name: "rg",
-		load: async () => (await import("./rg-S4FXYXWB-t9zpZo4d.mjs")).rgCommand
+		load: async () => (await import("./rg-S4FXYXWB-BDoRmTnO.mjs")).rgCommand
 	},
 	{
 		name: "sed",
-		load: async () => (await import("./sed-S5UIK574-BRKe7x3J.mjs")).sedCommand
+		load: async () => (await import("./sed-S5UIK574-BLYeSKhH.mjs")).sedCommand
 	},
 	{
 		name: "awk",
-		load: async () => (await import("./awk2-LA3USKJP-BUW_QukG.mjs")).awkCommand2
+		load: async () => (await import("./awk2-LA3USKJP-CxcnuH7z.mjs")).awkCommand2
 	},
 	{
 		name: "sort",
-		load: async () => (await import("./sort-SW2YEO5B-CBaAop0V.mjs")).sortCommand
+		load: async () => (await import("./sort-SW2YEO5B-BPmdqEWC.mjs")).sortCommand
 	},
 	{
 		name: "uniq",
-		load: async () => (await import("./uniq-XSIZR6PB-DtbwA9_Z.mjs")).uniqCommand
+		load: async () => (await import("./uniq-XSIZR6PB-BmPU1iXz.mjs")).uniqCommand
 	},
 	{
 		name: "comm",
-		load: async () => (await import("./comm-VV2LDX2J-BCh3IQFn.mjs")).commCommand
+		load: async () => (await import("./comm-VV2LDX2J-DCNy7GGf.mjs")).commCommand
 	},
 	{
 		name: "cut",
-		load: async () => (await import("./cut-OKARJCCV-CyDqMLn2.mjs")).cutCommand
+		load: async () => (await import("./cut-OKARJCCV-OcQWRbeH.mjs")).cutCommand
 	},
 	{
 		name: "paste",
-		load: async () => (await import("./paste-7JC6S4DX-DcdsSGV_.mjs")).pasteCommand
+		load: async () => (await import("./paste-7JC6S4DX-CDuMJXOI.mjs")).pasteCommand
 	},
 	{
 		name: "tr",
-		load: async () => (await import("./tr-36LHWFRQ-Dx9qES77.mjs")).trCommand
+		load: async () => (await import("./tr-36LHWFRQ-CcCsdOge.mjs")).trCommand
 	},
 	{
 		name: "rev",
-		load: async () => (await import("./rev-5EHFX4EJ-D69w62Na.mjs")).rev
+		load: async () => (await import("./rev-5EHFX4EJ-OyjlVpif.mjs")).rev
 	},
 	{
 		name: "nl",
-		load: async () => (await import("./nl-WSDW7I4O-B1B76hi7.mjs")).nl
+		load: async () => (await import("./nl-WSDW7I4O-BzwvYHlM.mjs")).nl
 	},
 	{
 		name: "fold",
-		load: async () => (await import("./fold-4TQNYMSW-BZFKjWm0.mjs")).fold
+		load: async () => (await import("./fold-4TQNYMSW-CjfFTerp.mjs")).fold
 	},
 	{
 		name: "expand",
-		load: async () => (await import("./expand-JSPG6VOP-BFGmjhWs.mjs")).expand
+		load: async () => (await import("./expand-JSPG6VOP-xrmY11uL.mjs")).expand
 	},
 	{
 		name: "unexpand",
-		load: async () => (await import("./unexpand-CADSA4VO-WTNnez3v.mjs")).unexpand
+		load: async () => (await import("./unexpand-CADSA4VO-CxilGlpF.mjs")).unexpand
 	},
 	{
 		name: "strings",
-		load: async () => (await import("./strings-6WDHLGMX-BeRuy36S.mjs")).strings
+		load: async () => (await import("./strings-6WDHLGMX-CD0sG0gF.mjs")).strings
 	},
 	{
 		name: "split",
-		load: async () => (await import("./split-4KKZZXXE-BrCt4u4f.mjs")).split
+		load: async () => (await import("./split-4KKZZXXE-B9zo-1EK.mjs")).split
 	},
 	{
 		name: "column",
-		load: async () => (await import("./column-XT6UFXNQ-Cft0y_bc.mjs")).column
+		load: async () => (await import("./column-XT6UFXNQ-DtxnxGnH.mjs")).column
 	},
 	{
 		name: "join",
-		load: async () => (await import("./join-TBRGI3LQ-Cks22NEI.mjs")).join
+		load: async () => (await import("./join-TBRGI3LQ-CLQ9RLQv.mjs")).join
 	},
 	{
 		name: "tee",
-		load: async () => (await import("./tee-YUZ2FKCJ-CkSijAvO.mjs")).teeCommand
+		load: async () => (await import("./tee-YUZ2FKCJ-BSt6nr1p.mjs")).teeCommand
 	},
 	{
 		name: "find",
-		load: async () => (await import("./find-INTH3OLC-BWdGX99c.mjs")).findCommand
+		load: async () => (await import("./find-INTH3OLC-CVY2XCyD.mjs")).findCommand
 	},
 	{
 		name: "basename",
@@ -23210,19 +23233,19 @@ var tt = [
 	},
 	{
 		name: "tree",
-		load: async () => (await import("./tree-YLD52CNT-BbLZ6TEG.mjs")).treeCommand
+		load: async () => (await import("./tree-YLD52CNT-DVL4rL8t.mjs")).treeCommand
 	},
 	{
 		name: "du",
-		load: async () => (await import("./du-572XNP42-Bxf5QFh5.mjs")).duCommand
+		load: async () => (await import("./du-572XNP42-BYCmkAIp.mjs")).duCommand
 	},
 	{
 		name: "env",
-		load: async () => (await import("./env-36M5BO7M-Bf14YjlF.mjs")).envCommand
+		load: async () => (await import("./env-36M5BO7M-Blzuj5cr.mjs")).envCommand
 	},
 	{
 		name: "printenv",
-		load: async () => (await import("./env-36M5BO7M-Bf14YjlF.mjs")).printenvCommand
+		load: async () => (await import("./env-36M5BO7M-Blzuj5cr.mjs")).printenvCommand
 	},
 	{
 		name: "alias",
@@ -23238,7 +23261,7 @@ var tt = [
 	},
 	{
 		name: "xargs",
-		load: async () => (await import("./xargs-MGZPH7AX-DBQR4AHD.mjs")).xargsCommand
+		load: async () => (await import("./xargs-MGZPH7AX-1LxG1fld.mjs")).xargsCommand
 	},
 	{
 		name: "true",
@@ -23254,23 +23277,23 @@ var tt = [
 	},
 	{
 		name: "bash",
-		load: async () => (await import("./bash-YZ33HQZQ-ABaVjHKD.mjs")).bashCommand
+		load: async () => (await import("./bash-YZ33HQZQ-C4UdzsRi.mjs")).bashCommand
 	},
 	{
 		name: "sh",
-		load: async () => (await import("./bash-YZ33HQZQ-ABaVjHKD.mjs")).shCommand
+		load: async () => (await import("./bash-YZ33HQZQ-C4UdzsRi.mjs")).shCommand
 	},
 	{
 		name: "jq",
-		load: async () => (await import("./jq-4XLYLOS5-5eVt5vv4.mjs")).jqCommand
+		load: async () => (await import("./jq-4XLYLOS5-DUSJUcDb.mjs")).jqCommand
 	},
 	{
 		name: "base64",
-		load: async () => (await import("./base64-C2AIWVNC-emVM5Yle.mjs")).base64Command
+		load: async () => (await import("./base64-C2AIWVNC-CdEK-zg_.mjs")).base64Command
 	},
 	{
 		name: "diff",
-		load: async () => (await import("./diff-MWJFIG7X-B2eFFBet.mjs")).diffCommand
+		load: async () => (await import("./diff-MWJFIG7X-CTtT-zOt.mjs")).diffCommand
 	},
 	{
 		name: "date",
@@ -23278,15 +23301,15 @@ var tt = [
 	},
 	{
 		name: "sleep",
-		load: async () => (await import("./sleep-X22JJINO-DaluG77q.mjs")).sleepCommand
+		load: async () => (await import("./sleep-X22JJINO-C1n_yjpw.mjs")).sleepCommand
 	},
 	{
 		name: "timeout",
-		load: async () => (await import("./timeout-YDCRSLPQ-DNjiG-2P.mjs")).timeoutCommand
+		load: async () => (await import("./timeout-YDCRSLPQ-o0-DKWJu.mjs")).timeoutCommand
 	},
 	{
 		name: "time",
-		load: async () => (await import("./time-D4LNBSWX-CPXejFM2.mjs")).timeCommand
+		load: async () => (await import("./time-D4LNBSWX-BCqgQclj.mjs")).timeCommand
 	},
 	{
 		name: "seq",
@@ -23294,19 +23317,19 @@ var tt = [
 	},
 	{
 		name: "expr",
-		load: async () => (await import("./expr-5JAACS4X-BtJBl6N4.mjs")).exprCommand
+		load: async () => (await import("./expr-5JAACS4X-Q7mzY-4B.mjs")).exprCommand
 	},
 	{
 		name: "md5sum",
-		load: async () => (await import("./md5sum-SPU24VSG-ppQw7LJv.mjs")).md5sumCommand
+		load: async () => (await import("./md5sum-SPU24VSG-BjYjx2P6.mjs")).md5sumCommand
 	},
 	{
 		name: "sha1sum",
-		load: async () => (await import("./sha1sum-2PTOAFR6-CVUagTt8.mjs")).sha1sumCommand
+		load: async () => (await import("./sha1sum-2PTOAFR6-CaTLiohJ.mjs")).sha1sumCommand
 	},
 	{
 		name: "sha256sum",
-		load: async () => (await import("./sha256sum-NS7D3IXX-BuDAbJr2.mjs")).sha256sumCommand
+		load: async () => (await import("./sha256sum-NS7D3IXX-CQXfNX4I.mjs")).sha256sumCommand
 	},
 	{
 		name: "file",
@@ -23314,11 +23337,11 @@ var tt = [
 	},
 	{
 		name: "html-to-markdown",
-		load: async () => (await import("./html-to-markdown-JW4MSQZO-DISJ5CX2.mjs")).htmlToMarkdownCommand
+		load: async () => (await import("./html-to-markdown-JW4MSQZO-3c447UDw.mjs")).htmlToMarkdownCommand
 	},
 	{
 		name: "help",
-		load: async () => (await import("./help-HZ6M2CKN-CLPAOvh2.mjs")).helpCommand
+		load: async () => (await import("./help-HZ6M2CKN-CeKpglff.mjs")).helpCommand
 	},
 	{
 		name: "which",
@@ -23326,7 +23349,7 @@ var tt = [
 	},
 	{
 		name: "tac",
-		load: async () => (await import("./tac-2STMMJYW-DEWlKP3i.mjs")).tac
+		load: async () => (await import("./tac-2STMMJYW-CyH-nXg_.mjs")).tac
 	},
 	{
 		name: "hostname",
@@ -23338,49 +23361,49 @@ var tt = [
 	},
 	{
 		name: "od",
-		load: async () => (await import("./od-WOKFDJTP-DScDOM1j.mjs")).od
+		load: async () => (await import("./od-WOKFDJTP-116XUWMI.mjs")).od
 	},
 	{
 		name: "gzip",
-		load: async () => (await import("./gzip-O5ASJAFY-D_P-xUud.mjs")).gzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).gzipCommand
 	},
 	{
 		name: "gunzip",
-		load: async () => (await import("./gzip-O5ASJAFY-D_P-xUud.mjs")).gunzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).gunzipCommand
 	},
 	{
 		name: "zcat",
-		load: async () => (await import("./gzip-O5ASJAFY-D_P-xUud.mjs")).zcatCommand
+		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).zcatCommand
 	}
 ];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (tt.push({
 	name: "tar",
-	load: async () => (await import("./tar-STHHZTZ6-BwzpZAFr.mjs")).tarCommand
+	load: async () => (await import("./tar-STHHZTZ6-_kx_2Kzk.mjs")).tarCommand
 }), tt.push({
 	name: "yq",
-	load: async () => (await import("./yq-4QJW3EQG-MzNwAH7g.mjs")).yqCommand
+	load: async () => (await import("./yq-4QJW3EQG-D5_MHFVc.mjs")).yqCommand
 }), tt.push({
 	name: "xan",
-	load: async () => (await import("./xan-Y6WF3IRG-C1uUinbC.mjs")).xanCommand
+	load: async () => (await import("./xan-Y6WF3IRG-di-Eo2k-.mjs")).xanCommand
 }), tt.push({
 	name: "sqlite3",
-	load: async () => (await import("./sqlite3-CGOEFJAO-DOQIPIbQ.mjs")).sqlite3Command
+	load: async () => (await import("./sqlite3-CGOEFJAO-DujzYsRa.mjs")).sqlite3Command
 }));
 var Yt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Yt.push({
 	name: "python3",
-	load: async () => (await import("./python3-POMOR4OA-BF_SGu6q.mjs")).python3Command
+	load: async () => (await import("./python3-POMOR4OA-pIqMzAay.mjs")).python3Command
 }), Yt.push({
 	name: "python",
-	load: async () => (await import("./python3-POMOR4OA-BF_SGu6q.mjs")).pythonCommand
+	load: async () => (await import("./python3-POMOR4OA-pIqMzAay.mjs")).pythonCommand
 }));
 var Qt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Qt.push({
 	name: "js-exec",
-	load: async () => (await import("./js-exec-N5KEZBH7-BJTradA3.mjs")).jsExecCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-kGBfZZcH.mjs")).jsExecCommand
 }), Qt.push({
 	name: "node",
-	load: async () => (await import("./js-exec-N5KEZBH7-BJTradA3.mjs")).nodeStubCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-kGBfZZcH.mjs")).nodeStubCommand
 }));
 new TextEncoder();
 Object.freeze({
@@ -25270,7 +25293,7 @@ const trace = class TraceAPI {
 	}
 }.getInstance();
 //#endregion
-//#region ../../packages/http/dist/with-public-project-runtime-Bd6t7zLW.mjs
+//#region ../../packages/http/dist/with-public-project-runtime-ClXYOYTT.mjs
 const requestBackgroundTasks = new AsyncLocalStorage();
 function runWithRequestBackgroundTasks(fn) {
 	return requestBackgroundTasks.run([], fn);
@@ -25499,6 +25522,10 @@ function createOrganizationHandler(deps) {
 		const body = await c.req.json().catch(() => null);
 		const parsed = CreateOrganizationRequestSchema.safeParse(body);
 		if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid organization request" }), 400);
+		if ((await selectUserOrganizations(user.id)).some(({ organization }) => organization.verifiedAt == null)) return c.json(ErrorResponseSchema.parse({
+			error: "Your organization is pending verification",
+			code: "org_unverified"
+		}), 403);
 		try {
 			const membership = await createOrganizationWithHosting(deps, user.id, parsed.data.name, parsed.data.slug);
 			const organizationId = membership.organization.id;
@@ -32465,6 +32492,7 @@ const handler$5 = async (c) => {
 		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
 		return c.json({ error: message }, 400);
 	}
+	if (!organizationContext.verified && parsed.data.type !== "verification") return c.json({ error: "This organization is pending verification" }, 403);
 	const organization = await selectOrganizationById(organizationContext.organizationId);
 	if (!organization) return c.json({ error: "Organization not found" }, 404);
 	try {
@@ -32659,6 +32687,7 @@ function mountAccountRoutes(options) {
 	account.get("/oauth/slack-app/callback", handler$22);
 	account.get(keystrokeSlackOAuthProvider.routes.callback, completeKeystrokeSlackInstall);
 	account.use("/*", protect);
+	account.use("/*", requireVerifiedAccountOrganization());
 	orgScoped.use("/*", protect);
 	orgScoped.use("/*", requireOrganization());
 	orgScoped.use("/*", requireVerifiedOrganization());
@@ -32973,10 +33002,17 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp, brain) {
 	const materialize = createCredentialMaterializeHandler(tokenRefresh, { resolveSandboxAccessToken: mcp ? (connectionId) => mcp.resolveSandboxAccessToken(connectionId) : void 0 });
 	internal.use("/orgs/:organizationId/db/*", async (c, next) => {
 		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
-		if (!verified || verified.organizationId !== c.req.param("organizationId")) return c.json({
-			error: "unauthorized",
-			message: "Invalid database proxy token."
-		}, 401);
+		if (!verified || verified.organizationId !== c.req.param("organizationId")) {
+			log.warn("security.tenant_scope_mismatch", {
+				organization_id: verified?.organizationId ?? null,
+				requested_organization_id: c.req.param("organizationId"),
+				resource_type: "database"
+			});
+			return c.json({
+				error: "unauthorized",
+				message: "Invalid database proxy token."
+			}, 401);
+		}
 		await next();
 	});
 	internal.post("/orgs/:organizationId/db/query", async (c) => {
@@ -33059,20 +33095,35 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp, brain) {
 	});
 	internal.use("/organizations/:organizationId/*", async (c, next) => {
 		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
-		if (verified && verified.organizationId !== c.req.param("organizationId")) return c.json({
-			error: "unauthorized",
-			message: "Token org mismatch."
-		}, 401);
+		if (verified && verified.organizationId !== c.req.param("organizationId")) {
+			log.warn("security.tenant_scope_mismatch", {
+				organization_id: verified.organizationId,
+				requested_organization_id: c.req.param("organizationId"),
+				resource_type: "organization"
+			});
+			return c.json({
+				error: "unauthorized",
+				message: "Token org mismatch."
+			}, 401);
+		}
 		await next();
 	});
 	internal.use("/projects/:projectId/*", async (c, next) => {
 		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
 		if (verified) {
 			const project = await selectProjectById(c.req.param("projectId"));
-			if (project && project.organizationId !== verified.organizationId) return c.json({
-				error: "unauthorized",
-				message: "Token org mismatch."
-			}, 401);
+			if (project && project.organizationId !== verified.organizationId) {
+				log.warn("security.tenant_scope_mismatch", {
+					organization_id: verified.organizationId,
+					requested_organization_id: project.organizationId,
+					project_id: project.id,
+					resource_type: "project"
+				});
+				return c.json({
+					error: "unauthorized",
+					message: "Token org mismatch."
+				}, 401);
+			}
 		}
 		await next();
 	});
@@ -33086,7 +33137,16 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp, brain) {
 	mcp?.mountInternalRoutes?.(internal, { withProjectScope });
 	brain?.mountInternalRoutes(internal);
 	internal.post("/projects/:projectId/credentials/materialize", async (c) => {
-		const response = await withProjectScope(c.req.param("projectId"), async () => materialize(c));
+		const projectId = c.req.param("projectId");
+		const body = CredentialMaterializeRequestSchema.safeParse(await c.req.raw.clone().json().catch(() => null));
+		const credential = body.success ? "instanceId" in body.data ? body.data.instanceId : "connectionId" in body.data ? body.data.connectionId : body.data.composioConnectionId : void 0;
+		const response = await withProjectScope(projectId, async () => materialize(c));
+		log.info("security.credential_materialized", {
+			project_id: projectId,
+			credential_id: credential ?? null,
+			verdict: response?.ok ? "allowed" : "failed",
+			status: response?.status ?? 404
+		});
 		if (response === void 0) return c.json({ error: "Project not found" }, 404);
 		return response ?? c.json({
 			error: "internal_error",
@@ -33720,4 +33780,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { r1 as S, o as _, c as a, b$1 as b, a$1 as c, c$1 as d, r as f, e as g, u as h, n$1 as i, d$1 as l, b as m, n, p as o, r$1 as p, i as r, x as s, startPlatformServer as t, x$1 as u, r$3 as v, I1 as x, h as y };
 
-//# sourceMappingURL=start-Dd2kW-r_.mjs.map
+//# sourceMappingURL=start-Dc5awJbc.mjs.map