@keystrokehq/platform 0.1.167 → 0.1.168

package/dist/{start-Dc5awJbc.mjs → start-WyfB1dkv.mjs}

@@ -1,16 +1,16 @@
 import { C as setManagedServiceCredential, S as setCredentialInstanceSecretValue, _ as withMcpReadClient, a as completeMcpOAuthConnect, b as readCredentialInstanceSecret, c as describeCredentialBindings, d as discoverOpenApiApp, f as isDiscoveryError, g as PublicHttpUrlError, h as withCredentialAssignments, i as beginMcpOAuthConnect, l as discoverGraphqlApp, m as verifyOAuthState, n as cronPayloadSchema, o as createOAuthState, p as resolveConnectedMcpAuthHeaders, r as McpOAuthConnectError, s as decodeOAuthState, u as discoverMcpApp, v as deleteCredentialInstanceSecret, x as setCredentialInstanceSecret, y as deleteManagedServiceCredential$1 } from "./dist-Bkbex-w_.mjs";
 import { $ as AppSlugAvailabilityResponseSchema, $i as mapUserOrganization, $n as ProjectGitRemoteResponseSchema, $r as UpdateOrganizationRequestSchema, $t as HistoryRunCancelResponseSchema, A as prefetchCanvasShards, Ai as buildCredentialInstanceLabel, An as McpDiscoverRequestSchema, Ar as SlackAppManifestResponseSchema, At as DEFAULT_WORKFLOW_OVERVIEW_MODEL, Ba as resolvePublicPlatformApiOrigin, Br as SubmitTeamRequestRequestSchema, Bt as DraftUpdateEventSchema, C as keystrokeAssetsAppLogoKeyFromPublicUrl, Ca as PresignChatAttachmentRequestSchema, Ci as WorkspaceTriggerFileSchema, Cn as ListProjectFilesResponseSchema, Cr as SLACK_KEYSTROKE_APP_SLUG, Ct as CreateProjectRequestSchema, Da as isAllowedChatAttachmentMediaType, Di as WorkspaceWorkflowOverviewSchema, Dn as ListTemplatesResponseSchema, Dr as SlackAppInstallStartResponseSchema, Dt as CredentialMaterializeRequestSchema, E as loadProjectSourceFiles, Ea as chatAttachmentExtension, Ei as WorkspaceTriggerRunListResponseSchema, En as ListProjectsResponseSchema, Er as SkillSummarySchema, Et as CreateSlackAppResponseSchema, F as projectSourceBlobKey, Fn as OrganizationSidebarBrandingSchema, Fr as StoredProjectSourceManifestSchema, Ft as DownloadActiveProjectSourceResponseSchema, G as AgentEnvImageSnapshotResponseSchema, Gi as listenPortFromPublicUrl, Gn as PresignCustomAppLogoResponseSchema, Gr as TriggerInvokeInputsSchema, Gt as FinalizeCustomAppLogoResponseSchema, H as ActionsCatalogShardSchema, Hi as isSlackCustomAppOauthSlug, Hn as PrepareManagedDeployRequestSchema, Hr as TemplateFilesResponseSchema, Ht as DuplicateCredentialsResponseSchema, I as publicKeystrokeAssetsObjectUrl, Ia as verifyOrgWorkerToken, Ii as isDraftSnapshotPlaceholderCommitSha, In as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, Ir as SubmitAgentFeedbackRequestSchema, It as DraftCommitResponseSchema, J as AgentSummaryDetailResponseSchema, Ji as mapProject, Jn as PresignProjectSourceRequestSchema, Jr as TriggerRunListQuerySchema, Jt as GetCustomAppResponseSchema, K as AgentManifestShardSchema, Ki as mapOrganizationInvitation, Kn as PresignOrgLogoRequestSchema, Kr as TriggerInvokeRequestSchema, Kt as GetAppCatalogEntryResponseSchema, L as putBrowserProfileMeta, Li as isHelloWorldTemplateSlug, Lr as SubmitAgentFeedbackResponseSchema, Lt as DraftConflictResponseSchema, Mi as deriveCredentialInstanceSlug, Mn as OpenApiDiscoverRequestSchema, Mr as SlugAvailabilityResponseSchema, Mt as DbProxyQueryRequestSchema, N as projectArtifactKey, Na as mintOrgWorkerToken, Ni as displayCredentialAppName, Nn as OpenApiDiscoverResponseSchema, Nr as StartMcpOAuthConnectionInputSchema, Nt as DeclineOrganizationInvitationResponseSchema, O as openModularArtifactShards, Oa as MICRO_CREDITS_PER_CREDIT, Oi as agentMemoryFileId, On as ManagedServiceCredentialSchema, Or as SlackAppListResponseSchema, Ot as DEFAULT_TRIGGER_OVERVIEW_MODEL, Pn as OrganizationSidebarBrandingPatchSchema, Pr as StartMcpOAuthConnectionResultSchema, Pt as DownloadActiveProjectArtifactResponseSchema, Q as AppSlugAvailabilityQuerySchema, Qi as mapProjectSettings, Qn as ProjectGitRemoteRequestSchema, Qr as UpdateOrganizationMemberResponseSchema, Qt as HeartbeatManagedDeployResponseSchema, R as putBrowserSessionMeta, Ra as DEFAULT_CLOUD_PLATFORM_ORIGIN, Rn as PROJECT_SLUG_TAKEN_MESSAGE, Rr as SubmitMarketingContactRequestSchema, Rt as DraftFileContentQuerySchema, S as isUserAvatarStorageKey, Sa as FilePartSchema, Si as WorkspaceTriggerDetailSchema, Sn as ListProjectDeploymentsResponseSchema, Sr as SLACK_KEYSTROKE_APP_BOT_SCOPES, St as CreateProjectArtifactResponseSchema, T as keystrokeAssetsOrgLogoKeyFromPublicUrl, Ta as PublicModelsResponseSchema, Ti as WorkspaceTriggerOverviewSchema, Tn as ListProjectMetricsResponseSchema, Tr as SkillSummaryListResponseSchema, Tt as CreateSlackAppRequestSchema, U as ActiveOrganizationResponseSchema, Ui as jsonSchemaToWorkflowInputSchema, Un as PrepareManagedDeployResponseSchema, Ur as TemplateKindSchema, Ut as ErrorResponseSchema, V as AcceptOrganizationInvitationResponseSchema, Va as resolvePublicPlatformOrigin, Vr as SubmitTeamRequestResponseSchema, Vt as DuplicateCredentialRequestSchema, W as ActiveProjectSourceRevisionSchema, Wi as jsonSchemaToZod, Wn as PresignCustomAppLogoRequestSchema, Wr as TriggerAttachmentUpdateRequestSchema, Wt as FinalizeCustomAppLogoRequestSchema, X as AgentSummarySchema, Xi as mapProjectDeployment, Xn as PresignUserAvatarRequestSchema, Xr as UpdateManagedServiceCredentialRequestSchema, Xt as GraphqlDiscoverRequestSchema, Y as AgentSummaryListResponseSchema, Yi as mapProjectArtifact, Yn as PresignProjectSourceResponseSchema, Yr as UpdateCredentialRequestSchema, Yt as GetTemplateResponseSchema, Z as AgentWorkspaceFileSummarySchema, Zi as mapProjectMember, Zn as PresignUserAvatarResponseSchema, Zr as UpdateOrganizationMemberRequestSchema, Zt as GraphqlDiscoverResponseSchema, _ as isOrgLogoStorageKey, _a as validateCredentialValueAgainstFields, _i as WorkflowRunInputsPutBodySchema, _n as ListMcpAppToolsResponseSchema, _r as RenewManagedDeployUploadResponseSchema, _t as CreateDraftCommitRequestSchema, a as createAssetsStorageClient, aa as organizationInvitationAcceptPath, ai as UploadProjectSourceResponseSchema, an as InviteProjectMembersRequestSchema, ar as ProjectSlugAvailabilityResponseSchema, at as ChannelPlatformSchema, b as isStorageBucketNotFoundError, ba as validationErrorResponse, bi as WorkflowSummaryListResponseSchema, bn as ListOrganizationMembersPageResponseSchema, br as SLACK_CUSTOM_APP_SLUG_PREFIX, bt as CreateOrganizationResponseSchema, ca as parseStoredRouteManifest, ci as UserPreferencesPatchSchema, cn as ListAgentWorkspaceFilesResponseSchema, cr as PublicFormSubmitBodySchema, ct as CompleteProjectArtifactRequestSchema, d as isAppLogoStorageKey, da as resolveUniqueCredentialInstanceLabel, di as WorkflowCanvasRunSchema, dr as PublishManagedDeployCandidateResponseSchema, dt as CreateApiKeyRequestSchema, ei as UpdateProjectMemberRequestSchema, en as HistoryRunDetailResponseSchema, er as ProjectGitStatusResponseSchema, f as isBrowserMediaStorageKey, fa as schemaHasFileFields, fi as WorkflowCanvasSchema, fn as ListChannelPlatformsResponseSchema, fr as PublishedFormListResponseSchema, ft as CreateApiKeyResponseSchema, g as isKeystrokeAssetsOrgLogoPublicUrl, ga as slackCustomAppOauthSlug, gi as WorkflowManifestMetaShardSchema, gn as ListManagedServiceCredentialsResponseSchema, gr as RenewManagedDeployUploadRequestSchema, gt as CreateCustomAppResponseSchema, h as isKeystrokeAssetsAvatarPublicUrl, ha as slackCustomAppHandleFromSlug, hi as WorkflowManifestFlowShardSchema, hn as ListDraftFilesResponseSchema, hr as RecentResourceSchema, ht as CreateCustomAppRequestSchema, i as chatAttachmentStorageKey, ii as UploadProjectSourceManifestRequestSchema, in as InviteOrganizationMembersResponseSchema, ir as ProjectSlugAvailabilityQuerySchema, it as CancelManagedDeployResponseSchema, j as projectArtifactBlobKey, ji as buildSlackAppManifest, jn as McpDiscoverResponseSchema, jr as SlugAvailabilityQuerySchema, jt as DRAFT_SNAPSHOT_PLACEHOLDER_COMMIT_SHA, k as orgLogoStorageKey, ka as credentialInputSchema, ki as agentWorkspaceFileId, kn as ManagedServiceKindSchema, kr as SlackAppManifestRequestSchema, kt as DEFAULT_WORKFLOW_CANVAS_MODEL, l as getBrowserProfileMeta, la as projectFileId, li as UserPreferencesSchema, ln as ListApiKeysResponseSchema, lr as PublicFormSubmitResponseSchema, lt as CompleteProjectArtifactResponseSchema, m as isKeystrokeAssetsAppLogoPublicUrl, ma as slackAppBindingChannelId, mi as WorkflowFormUpsertBodySchema, mn as ListCredentialsPageResponseSchema, mr as RecentResourceListResponseSchema, mt as CreateCredentialsResponseSchema, n as publishDraftUpdateBestEffort, na as normalizeSlackAppHandle, ni as UpdateProjectRequestSchema, nn as HistoryRunListResponseSchema, nr as ProjectResponseSchema, nt as BrowserResumeStateSchema, o as ensureKeystrokeAssetsBucket, oa as organizationSlugErrorCodeFromMessage, oi as UserAvatarPatchSchema, on as InviteProjectMembersResponseSchema, or as ProjectSourceResourcesSchema, ot as CompleteManagedDeployArtifactRequestSchema, p as isChatAttachmentStorageKey, pa as schemaHasUnsupportedFormFields, pi as WorkflowFormResponseSchema, pn as ListCredentialsPageQuerySchema, pr as PublishedFormSchema, pt as CreateCredentialsRequestSchema, q as AgentMemoryFileSummarySchema, qi as mapOrganizationMember, qn as PresignOrgLogoResponseSchema, qr as TriggerInvokeResponseSchema, qt as GetCredentialResponseSchema, r as appLogoStorageKey, ra as normalizeUserPreferences, ri as UpdateProjectSettingsRequestSchema, rn as InviteOrganizationMembersRequestSchema, rr as ProjectSettingsResponseSchema, rt as CancelManagedDeployRequestSchema, s as extractRouteManifestFromArtifact, sa as parseAppSlug, si as UserAvatarSchema, sn as ListAgentMemoryFilesResponseSchema, sr as PublicFormMetadataSchema, st as CompleteManagedDeployArtifactResponseSchema, t as createInProcessProjectDraftNotifier, ta as mergeUserPreferences, ti as UpdateProjectMemberResponseSchema, tn as HistoryRunListQuerySchema, tr as ProjectReachabilityResponseSchema, tt as BrainReferenceSchema, u as getBrowserSessionMeta, ua as resolvePublicFormFields, ui as WorkflowCanvasCredentialBindingsSchema, un as ListAppsResponseSchema, ur as PublishManagedDeployCandidateRequestSchema, ut as ConnectManagedServiceCredentialRequestSchema, v as isProjectArtifactIndexKey, va as validateFormFieldConfig, vi as WorkflowRunInputsSchema, vn as ListOrganizationInvitationsResponseSchema, vr as SLACK_CUSTOM_APP_BOT_SCOPES, vt as CreateDraftDiffCommitRequestSchema, w as keystrokeAssetsAvatarKeyFromPublicUrl, wa as PresignChatAttachmentResponseSchema, wi as WorkspaceTriggerListResponseSchema, wn as ListProjectMembersResponseSchema, wr as SkillSummaryDetailResponseSchema, wt as CreateProjectResponseSchema, x as isStorageNotFoundError$1, xi as WorkflowSummarySchema, xn as ListOrganizationsResponseSchema, xr as SLACK_GATEWAY_OAUTH_APP_KEY, xt as CreateProjectArtifactRequestSchema, ya as validateWorkflowRunInputValues, yi as WorkflowSummaryDetailResponseSchema, yn as ListOrganizationMembersPageQuerySchema, yr as SLACK_CUSTOM_APP_CREDENTIAL_SLUG, yt as CreateOrganizationRequestSchema, z as userAvatarStorageKey, za as resolveExternalPlatformOrigin, zi as isLlmProviderSlug, zr as SubmitMarketingContactResponseSchema, zt as DraftRevisionResponseSchema } from "./project-draft-notifier-CWDmJI58.mjs";
-import { $ as canInviteToProject, A as toProjectGitRepository, B as requireSession, C as createProjectSourceServiceFactory, D as ProjectRepositoryNotReadyError, E as trackProductEvent, F as authorize, G as agentListScope, H as routeProject, I as forbidden, J as canAccessAgent, K as apiKeyListScope, L as requireOrganization, O as archiveProjectRepositoryInline, P as isProjectGitProviderError, Q as canInviteRole, R as requireProject, T as identifyOrganizationGroup, U as accessContext, V as requireVerifiedOrganization, W as getProjectInvitePermission, X as canAccessSkill, Y as canAccessHistoryRun, Z as canAccessWorkflow, _ as commitProjectDraftFromDiff, a as cancelManagedDeploy, at as credentialListScope, c as prepareManagedDeploy, ct as organizationActions, d as ManagedDeployError, dt as skillListScope, et as canReadApiKey, f as deleteManagedDeployCandidateBestEffort, ft as userActions, g as commitProjectDraft, gt as pingProjectTarget, ht as log, i as workerOrganizationIdFromContext, it as checkPermission, j as MANAGED_DRAFT_BRANCH, k as provisionProjectRepositoryInline, l as publishManagedDeployCandidate, lt as projectActions, mt as event, n as readWorkerTokenFromRequest, nt as canRevokeApiKey, o as completeManagedDeployArtifact, ot as historyListScope, p as promoteManagedDeployMain, pt as workflowListScope, q as apiKeysActions, r as requireWorkerToken, rt as canViewCredential, s as heartbeatManagedDeploy, st as managedServicesActions, t as withProjectScope, tt as canReadProject, u as renewManagedDeployUpload, ut as projectListScope, v as mapDraftCommitError, w as mapProjectSourceError, x as assertAvailable, y as ensureProjectRepositoryReady, z as requireProjectMembership } from "./with-project-scope-fwIUr56U.mjs";
+import { $ as canInviteToProject, A as toProjectGitRepository, B as requireSession, C as createProjectSourceServiceFactory, D as ProjectRepositoryNotReadyError, E as trackProductEvent, F as authorize, G as agentListScope, H as routeProject, I as forbidden$1, J as canAccessAgent, K as apiKeyListScope, L as requireOrganization, O as archiveProjectRepositoryInline, P as isProjectGitProviderError, Q as canInviteRole, R as requireProject, T as identifyOrganizationGroup, U as accessContext, V as requireVerifiedOrganization, W as getProjectInvitePermission, X as canAccessSkill, Y as canAccessHistoryRun, Z as canAccessWorkflow, _ as commitProjectDraftFromDiff, a as cancelManagedDeploy, at as credentialListScope, c as prepareManagedDeploy, ct as organizationActions, d as ManagedDeployError, dt as skillListScope, et as canReadApiKey, f as deleteManagedDeployCandidateBestEffort, ft as userActions, g as commitProjectDraft, gt as pingProjectTarget, ht as log, i as workerOrganizationIdFromContext, it as checkPermission, j as MANAGED_DRAFT_BRANCH, k as provisionProjectRepositoryInline, l as publishManagedDeployCandidate, lt as projectActions, mt as event, n as readWorkerTokenFromRequest, nt as canRevokeApiKey, o as completeManagedDeployArtifact, ot as historyListScope, p as promoteManagedDeployMain, pt as workflowListScope, q as apiKeysActions, r as requireWorkerToken, rt as canViewCredential, s as heartbeatManagedDeploy, st as managedServicesActions, t as withProjectScope, tt as canReadProject, u as renewManagedDeployUpload, ut as projectListScope, v as mapDraftCommitError, w as mapProjectSourceError, x as assertAvailable, y as ensureProjectRepositoryReady, z as requireProjectMembership } from "./with-project-scope-fwIUr56U.mjs";
 import "./chunk-BZUGFHVS-B2NchobP.mjs";
 import { n as d$4, t as _$1 } from "./chunk-TN7HHBQW-B8PYcKz5.mjs";
 import { getCachedPublicModelIds, loadPublicModelIds } from "./lib/public-models.mjs";
 import { createRequire } from "node:module";
-import { createHash } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import "node:fs/promises";
 import { acquireProjectDatabasePool, buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, collectChildRunCancelTargets, deleteCredentialInstanceById, ensureOAuthCredentialInstance, findHistoryRunCore, getProjectScopeId, getServerTenantScopeId, getWorkspaceTriggerById, listActiveAgents, listActiveOrgGatewayBindingsByPlatform, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listAttachmentsByTriggerIds, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, listReplayEvents, listWorkspaceTriggerRunRows, listWorkspaceTriggers, releaseProjectDatabasePool, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowBySlug, selectActiveWorkflowsByIds, selectAgentBySlug, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesByAppSlug, selectCredentialInstancesForScope, selectProjectResourceCounts, selectTriggerById, selectWorkflowCanvasAnnotations, selectWorkflowLastRunAtByIds, selectWorkflowOverview, selectWorkflowRunById, selectWorkflowRunForWorkflow, selectWorkflowRunInputValues, setTriggerAttachmentEnabledState, setTriggerOverviewGenerating, setWorkflowCanvasAnnotationsGenerating, setWorkflowOverviewGenerating, softDeleteGatewayAttachmentByChannel, storedTriggerSourceFromRow, touchResourceActivity, triggerTimezoneFromConfig, updateTriggerOverview, updateWorkflowCanvasAnnotations, updateWorkflowOverview, updateWorkflowRunInputValues, upsertCredentialInstance } from "@keystrokehq/database";
 import { ZodError, z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectArtifactSourceManifestConflictError, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, buildDefaultOrgProjectName, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, countActiveMembersForOrganization, countActiveProjectsForOrganization, createOrgAgentStorageClient, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthAppBySlug, deleteOAuthConnectionById, deleteOrgApp, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureOAuthApp, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, getDecryptedOAuthAppBySlug, getManagedServiceCredential, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listManagedServiceCredentialsForOrganization, listOAuthAppsBySlugPrefix, listOAuthConnectionsByAppId, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, listPublishedFormsForOrganization, listTemplates, listUsageEventsForRuns, listWebhookApiKeysForProject, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgSchedulerRuntimeEnv, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, releaseProjectDeployLease, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgProjectDatabaseOptions, resolveOrgRuntimeDatabase, resolveTenantDatabaseUrl, revokeOrgPlatformApiKey, rotatePublishedFormToken, runWithOrganizationScope, saveOAuthConnection, seedOfficialTemplates, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectEnabledPublishedFormByToken, selectLastDeploymentAtByProject, selectManagedServiceCredentialById, selectOAuthAppById, selectOAuthAppBySlug, selectOAuthConnectionById, selectOAuthConnectionsByIds, selectOrgAppBySlug, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectRepositoryByProjectId, selectProjectsByOrganizationId, selectPublishedFormForWorkflow, selectTemplateBySlug, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, summarizeUsageForRuns, transitionProjectArtifactProtocolState, unpublishFormForWorkflow, updateOAuthAppMetadataBySlug, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectArtifactSourceManifest, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, upsertPublishedForm } from "@keystrokehq/platform-database";
+import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectArtifactSourceManifestConflictError, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, buildDefaultOrgProjectName, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, countActiveMembersForOrganization, countActiveProjectsForOrganization, createOrgAgentStorageClient, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthAppBySlug, deleteOAuthConnectionById, deleteOrgApp, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureOAuthApp, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, getDecryptedOAuthAppBySlug, getManagedServiceCredential, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listManagedServiceCredentialsForOrganization, listOAuthAppsBySlugPrefix, listOAuthConnectionsByAppId, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, listPublishedFormsForOrganization, listTemplates, listUsageEventsForRuns, listWebhookApiKeysForProject, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgSchedulerRuntimeEnv, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, releaseProjectDeployLease, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgProjectDatabaseOptions, resolveOrgRuntimeDatabase, resolveOrgStorageConfig, resolveTenantDatabaseUrl, revokeOrgPlatformApiKey, rotatePublishedFormToken, runWithOrganizationScope, saveOAuthConnection, seedOfficialTemplates, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectEnabledPublishedFormByToken, selectLastDeploymentAtByProject, selectManagedServiceCredentialById, selectOAuthAppById, selectOAuthAppBySlug, selectOAuthConnectionById, selectOAuthConnectionsByIds, selectOrgAppBySlug, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectRepositoryByProjectId, selectProjectsByOrganizationId, selectPublishedFormForWorkflow, selectTemplateBySlug, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, summarizeUsageForRuns, transitionProjectArtifactProtocolState, unpublishFormForWorkflow, updateOAuthAppMetadataBySlug, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectArtifactSourceManifest, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, upsertPublishedForm } from "@keystrokehq/platform-database";
 import "node:fs";
 import { basename, join, normalize, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
@@ -25,6 +25,8 @@ import "node:url";
 import "typescript";
 import "hono/route";
 import { Resend } from "resend";
+import { Sha256 } from "@aws-crypto/sha256-js";
+import { SignatureV4 } from "@smithy/signature-v4";
 import { getConnInfo } from "@hono/node-server/conninfo";
 //#region src/auth/mount.ts
 function mountAuth(app, auth) {
@@ -68,7 +70,7 @@ function authorizePayload(schema, allow) {
 			c,
 			ctx: accessContext(c),
 			body: parsed.data
-		})) return forbidden(c);
+		})) return forbidden$1(c);
 		await next();
 	};
 }
@@ -23065,43 +23067,43 @@ var tt = [
 	},
 	{
 		name: "cat",
-		load: async () => (await import("./cat-TSFMZVYS-CGn6llPo.mjs")).catCommand
+		load: async () => (await import("./cat-TSFMZVYS-CPfGWWie.mjs")).catCommand
 	},
 	{
 		name: "printf",
-		load: async () => (await import("./printf-TWGXF445-CkIUXuiT.mjs")).printfCommand
+		load: async () => (await import("./printf-TWGXF445-DQ86Sj1g.mjs")).printfCommand
 	},
 	{
 		name: "ls",
-		load: async () => (await import("./ls-ZJGQER7M-DA9jw5QB.mjs")).lsCommand
+		load: async () => (await import("./ls-ZJGQER7M-rEDr0p55.mjs")).lsCommand
 	},
 	{
 		name: "mkdir",
-		load: async () => (await import("./mkdir-MEPGZOB6-1fTQLXh9.mjs")).mkdirCommand
+		load: async () => (await import("./mkdir-MEPGZOB6-CCE99gYv.mjs")).mkdirCommand
 	},
 	{
 		name: "rmdir",
-		load: async () => (await import("./rmdir-OC4ZLPYA-BFlTS2Wx.mjs")).rmdirCommand
+		load: async () => (await import("./rmdir-OC4ZLPYA-uOL-IM2R.mjs")).rmdirCommand
 	},
 	{
 		name: "touch",
-		load: async () => (await import("./touch-UA33VN3N-CT-yOZ5s.mjs")).touchCommand
+		load: async () => (await import("./touch-UA33VN3N-BlByYkvd.mjs")).touchCommand
 	},
 	{
 		name: "rm",
-		load: async () => (await import("./rm-SSGETQVQ-CokMXrPQ.mjs")).rmCommand
+		load: async () => (await import("./rm-SSGETQVQ-B29gIaIP.mjs")).rmCommand
 	},
 	{
 		name: "cp",
-		load: async () => (await import("./cp-BISAAS7A-aSSo5A_f.mjs")).cpCommand
+		load: async () => (await import("./cp-BISAAS7A-DW5vWL64.mjs")).cpCommand
 	},
 	{
 		name: "mv",
-		load: async () => (await import("./mv-W5BIQ646-Cbx7GDaP.mjs")).mvCommand
+		load: async () => (await import("./mv-W5BIQ646-DYxU3jah.mjs")).mvCommand
 	},
 	{
 		name: "ln",
-		load: async () => (await import("./ln-4LGSXXGD-DGnxBJnR.mjs")).lnCommand
+		load: async () => (await import("./ln-4LGSXXGD-B4aCotPR.mjs")).lnCommand
 	},
 	{
 		name: "chmod",
@@ -23117,15 +23119,15 @@ var tt = [
 	},
 	{
 		name: "head",
-		load: async () => (await import("./head-442HYESI-Dd0pLJ0n.mjs")).headCommand
+		load: async () => (await import("./head-442HYESI-CZbafP0s.mjs")).headCommand
 	},
 	{
 		name: "tail",
-		load: async () => (await import("./tail-R4PCA2C4-BpuY1mDk.mjs")).tailCommand
+		load: async () => (await import("./tail-R4PCA2C4-B8SukRnT.mjs")).tailCommand
 	},
 	{
 		name: "wc",
-		load: async () => (await import("./wc-LF7NU4LA-BsMOl-bO.mjs")).wcCommand
+		load: async () => (await import("./wc-LF7NU4LA-B2HJVulR.mjs")).wcCommand
 	},
 	{
 		name: "stat",
@@ -23133,95 +23135,95 @@ var tt = [
 	},
 	{
 		name: "grep",
-		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).grepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-D4FoF2hj.mjs")).grepCommand
 	},
 	{
 		name: "fgrep",
-		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).fgrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-D4FoF2hj.mjs")).fgrepCommand
 	},
 	{
 		name: "egrep",
-		load: async () => (await import("./grep-V3LQVMRQ-Bq9VL9bJ.mjs")).egrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-D4FoF2hj.mjs")).egrepCommand
 	},
 	{
 		name: "rg",
-		load: async () => (await import("./rg-S4FXYXWB-BDoRmTnO.mjs")).rgCommand
+		load: async () => (await import("./rg-S4FXYXWB-Bw3zOHzz.mjs")).rgCommand
 	},
 	{
 		name: "sed",
-		load: async () => (await import("./sed-S5UIK574-BLYeSKhH.mjs")).sedCommand
+		load: async () => (await import("./sed-S5UIK574-omMBBXt-.mjs")).sedCommand
 	},
 	{
 		name: "awk",
-		load: async () => (await import("./awk2-LA3USKJP-CxcnuH7z.mjs")).awkCommand2
+		load: async () => (await import("./awk2-LA3USKJP-C8RbI8LN.mjs")).awkCommand2
 	},
 	{
 		name: "sort",
-		load: async () => (await import("./sort-SW2YEO5B-BPmdqEWC.mjs")).sortCommand
+		load: async () => (await import("./sort-SW2YEO5B-CO7ijoW_.mjs")).sortCommand
 	},
 	{
 		name: "uniq",
-		load: async () => (await import("./uniq-XSIZR6PB-BmPU1iXz.mjs")).uniqCommand
+		load: async () => (await import("./uniq-XSIZR6PB-Di_RyKgD.mjs")).uniqCommand
 	},
 	{
 		name: "comm",
-		load: async () => (await import("./comm-VV2LDX2J-DCNy7GGf.mjs")).commCommand
+		load: async () => (await import("./comm-VV2LDX2J-Gm0Q2MuD.mjs")).commCommand
 	},
 	{
 		name: "cut",
-		load: async () => (await import("./cut-OKARJCCV-OcQWRbeH.mjs")).cutCommand
+		load: async () => (await import("./cut-OKARJCCV-D_7uFyvH.mjs")).cutCommand
 	},
 	{
 		name: "paste",
-		load: async () => (await import("./paste-7JC6S4DX-CDuMJXOI.mjs")).pasteCommand
+		load: async () => (await import("./paste-7JC6S4DX-BpnoE3YM.mjs")).pasteCommand
 	},
 	{
 		name: "tr",
-		load: async () => (await import("./tr-36LHWFRQ-CcCsdOge.mjs")).trCommand
+		load: async () => (await import("./tr-36LHWFRQ-DKyhEcj-.mjs")).trCommand
 	},
 	{
 		name: "rev",
-		load: async () => (await import("./rev-5EHFX4EJ-OyjlVpif.mjs")).rev
+		load: async () => (await import("./rev-5EHFX4EJ-iIq6XMl_.mjs")).rev
 	},
 	{
 		name: "nl",
-		load: async () => (await import("./nl-WSDW7I4O-BzwvYHlM.mjs")).nl
+		load: async () => (await import("./nl-WSDW7I4O-FGrQaEQ5.mjs")).nl
 	},
 	{
 		name: "fold",
-		load: async () => (await import("./fold-4TQNYMSW-CjfFTerp.mjs")).fold
+		load: async () => (await import("./fold-4TQNYMSW-Dvz-42k5.mjs")).fold
 	},
 	{
 		name: "expand",
-		load: async () => (await import("./expand-JSPG6VOP-xrmY11uL.mjs")).expand
+		load: async () => (await import("./expand-JSPG6VOP-DIZsCGmM.mjs")).expand
 	},
 	{
 		name: "unexpand",
-		load: async () => (await import("./unexpand-CADSA4VO-CxilGlpF.mjs")).unexpand
+		load: async () => (await import("./unexpand-CADSA4VO-C-MUDggj.mjs")).unexpand
 	},
 	{
 		name: "strings",
-		load: async () => (await import("./strings-6WDHLGMX-CD0sG0gF.mjs")).strings
+		load: async () => (await import("./strings-6WDHLGMX-BhLDNB6N.mjs")).strings
 	},
 	{
 		name: "split",
-		load: async () => (await import("./split-4KKZZXXE-B9zo-1EK.mjs")).split
+		load: async () => (await import("./split-4KKZZXXE-BSoYryyg.mjs")).split
 	},
 	{
 		name: "column",
-		load: async () => (await import("./column-XT6UFXNQ-DtxnxGnH.mjs")).column
+		load: async () => (await import("./column-XT6UFXNQ-BtZHjQTK.mjs")).column
 	},
 	{
 		name: "join",
-		load: async () => (await import("./join-TBRGI3LQ-CLQ9RLQv.mjs")).join
+		load: async () => (await import("./join-TBRGI3LQ-pWVqtG6K.mjs")).join
 	},
 	{
 		name: "tee",
-		load: async () => (await import("./tee-YUZ2FKCJ-BSt6nr1p.mjs")).teeCommand
+		load: async () => (await import("./tee-YUZ2FKCJ-Wzp-lS32.mjs")).teeCommand
 	},
 	{
 		name: "find",
-		load: async () => (await import("./find-INTH3OLC-CVY2XCyD.mjs")).findCommand
+		load: async () => (await import("./find-INTH3OLC-BQ-pZYLw.mjs")).findCommand
 	},
 	{
 		name: "basename",
@@ -23233,19 +23235,19 @@ var tt = [
 	},
 	{
 		name: "tree",
-		load: async () => (await import("./tree-YLD52CNT-DVL4rL8t.mjs")).treeCommand
+		load: async () => (await import("./tree-YLD52CNT-Pn4kVV1_.mjs")).treeCommand
 	},
 	{
 		name: "du",
-		load: async () => (await import("./du-572XNP42-BYCmkAIp.mjs")).duCommand
+		load: async () => (await import("./du-572XNP42-Cae354U_.mjs")).duCommand
 	},
 	{
 		name: "env",
-		load: async () => (await import("./env-36M5BO7M-Blzuj5cr.mjs")).envCommand
+		load: async () => (await import("./env-36M5BO7M-BMqMAD13.mjs")).envCommand
 	},
 	{
 		name: "printenv",
-		load: async () => (await import("./env-36M5BO7M-Blzuj5cr.mjs")).printenvCommand
+		load: async () => (await import("./env-36M5BO7M-BMqMAD13.mjs")).printenvCommand
 	},
 	{
 		name: "alias",
@@ -23261,7 +23263,7 @@ var tt = [
 	},
 	{
 		name: "xargs",
-		load: async () => (await import("./xargs-MGZPH7AX-1LxG1fld.mjs")).xargsCommand
+		load: async () => (await import("./xargs-MGZPH7AX-EQ3QbGwA.mjs")).xargsCommand
 	},
 	{
 		name: "true",
@@ -23277,23 +23279,23 @@ var tt = [
 	},
 	{
 		name: "bash",
-		load: async () => (await import("./bash-YZ33HQZQ-C4UdzsRi.mjs")).bashCommand
+		load: async () => (await import("./bash-YZ33HQZQ-ANOHkNRr.mjs")).bashCommand
 	},
 	{
 		name: "sh",
-		load: async () => (await import("./bash-YZ33HQZQ-C4UdzsRi.mjs")).shCommand
+		load: async () => (await import("./bash-YZ33HQZQ-ANOHkNRr.mjs")).shCommand
 	},
 	{
 		name: "jq",
-		load: async () => (await import("./jq-4XLYLOS5-DUSJUcDb.mjs")).jqCommand
+		load: async () => (await import("./jq-4XLYLOS5-CmP3SWS_.mjs")).jqCommand
 	},
 	{
 		name: "base64",
-		load: async () => (await import("./base64-C2AIWVNC-CdEK-zg_.mjs")).base64Command
+		load: async () => (await import("./base64-C2AIWVNC-C7pLflo9.mjs")).base64Command
 	},
 	{
 		name: "diff",
-		load: async () => (await import("./diff-MWJFIG7X-CTtT-zOt.mjs")).diffCommand
+		load: async () => (await import("./diff-MWJFIG7X-DwW9Gj2K.mjs")).diffCommand
 	},
 	{
 		name: "date",
@@ -23301,15 +23303,15 @@ var tt = [
 	},
 	{
 		name: "sleep",
-		load: async () => (await import("./sleep-X22JJINO-C1n_yjpw.mjs")).sleepCommand
+		load: async () => (await import("./sleep-X22JJINO-mf19NvQl.mjs")).sleepCommand
 	},
 	{
 		name: "timeout",
-		load: async () => (await import("./timeout-YDCRSLPQ-o0-DKWJu.mjs")).timeoutCommand
+		load: async () => (await import("./timeout-YDCRSLPQ-BmnmV2xl.mjs")).timeoutCommand
 	},
 	{
 		name: "time",
-		load: async () => (await import("./time-D4LNBSWX-BCqgQclj.mjs")).timeCommand
+		load: async () => (await import("./time-D4LNBSWX-D9Hhm7d8.mjs")).timeCommand
 	},
 	{
 		name: "seq",
@@ -23317,19 +23319,19 @@ var tt = [
 	},
 	{
 		name: "expr",
-		load: async () => (await import("./expr-5JAACS4X-Q7mzY-4B.mjs")).exprCommand
+		load: async () => (await import("./expr-5JAACS4X-K1MqcoL0.mjs")).exprCommand
 	},
 	{
 		name: "md5sum",
-		load: async () => (await import("./md5sum-SPU24VSG-BjYjx2P6.mjs")).md5sumCommand
+		load: async () => (await import("./md5sum-SPU24VSG-CiKtVJg7.mjs")).md5sumCommand
 	},
 	{
 		name: "sha1sum",
-		load: async () => (await import("./sha1sum-2PTOAFR6-CaTLiohJ.mjs")).sha1sumCommand
+		load: async () => (await import("./sha1sum-2PTOAFR6-CCRLDwGO.mjs")).sha1sumCommand
 	},
 	{
 		name: "sha256sum",
-		load: async () => (await import("./sha256sum-NS7D3IXX-CQXfNX4I.mjs")).sha256sumCommand
+		load: async () => (await import("./sha256sum-NS7D3IXX-BiRUaUjI.mjs")).sha256sumCommand
 	},
 	{
 		name: "file",
@@ -23337,11 +23339,11 @@ var tt = [
 	},
 	{
 		name: "html-to-markdown",
-		load: async () => (await import("./html-to-markdown-JW4MSQZO-3c447UDw.mjs")).htmlToMarkdownCommand
+		load: async () => (await import("./html-to-markdown-JW4MSQZO-CFvK2efG.mjs")).htmlToMarkdownCommand
 	},
 	{
 		name: "help",
-		load: async () => (await import("./help-HZ6M2CKN-CeKpglff.mjs")).helpCommand
+		load: async () => (await import("./help-HZ6M2CKN-De32jrfm.mjs")).helpCommand
 	},
 	{
 		name: "which",
@@ -23349,7 +23351,7 @@ var tt = [
 	},
 	{
 		name: "tac",
-		load: async () => (await import("./tac-2STMMJYW-CyH-nXg_.mjs")).tac
+		load: async () => (await import("./tac-2STMMJYW-DagUpYA4.mjs")).tac
 	},
 	{
 		name: "hostname",
@@ -23361,49 +23363,49 @@ var tt = [
 	},
 	{
 		name: "od",
-		load: async () => (await import("./od-WOKFDJTP-116XUWMI.mjs")).od
+		load: async () => (await import("./od-WOKFDJTP-C-PIzwLw.mjs")).od
 	},
 	{
 		name: "gzip",
-		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).gzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-C-W63GPQ.mjs")).gzipCommand
 	},
 	{
 		name: "gunzip",
-		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).gunzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-C-W63GPQ.mjs")).gunzipCommand
 	},
 	{
 		name: "zcat",
-		load: async () => (await import("./gzip-O5ASJAFY-DtSdTVQF.mjs")).zcatCommand
+		load: async () => (await import("./gzip-O5ASJAFY-C-W63GPQ.mjs")).zcatCommand
 	}
 ];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (tt.push({
 	name: "tar",
-	load: async () => (await import("./tar-STHHZTZ6-_kx_2Kzk.mjs")).tarCommand
+	load: async () => (await import("./tar-STHHZTZ6-BSltqe4P.mjs")).tarCommand
 }), tt.push({
 	name: "yq",
-	load: async () => (await import("./yq-4QJW3EQG-D5_MHFVc.mjs")).yqCommand
+	load: async () => (await import("./yq-4QJW3EQG-DlI4eUji.mjs")).yqCommand
 }), tt.push({
 	name: "xan",
-	load: async () => (await import("./xan-Y6WF3IRG-di-Eo2k-.mjs")).xanCommand
+	load: async () => (await import("./xan-Y6WF3IRG-BIzw7jYC.mjs")).xanCommand
 }), tt.push({
 	name: "sqlite3",
-	load: async () => (await import("./sqlite3-CGOEFJAO-DujzYsRa.mjs")).sqlite3Command
+	load: async () => (await import("./sqlite3-CGOEFJAO-BDgran0k.mjs")).sqlite3Command
 }));
 var Yt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Yt.push({
 	name: "python3",
-	load: async () => (await import("./python3-POMOR4OA-pIqMzAay.mjs")).python3Command
+	load: async () => (await import("./python3-POMOR4OA-_HA4D6iP.mjs")).python3Command
 }), Yt.push({
 	name: "python",
-	load: async () => (await import("./python3-POMOR4OA-pIqMzAay.mjs")).pythonCommand
+	load: async () => (await import("./python3-POMOR4OA-_HA4D6iP.mjs")).pythonCommand
 }));
 var Qt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Qt.push({
 	name: "js-exec",
-	load: async () => (await import("./js-exec-N5KEZBH7-kGBfZZcH.mjs")).jsExecCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-TG3GbXd8.mjs")).jsExecCommand
 }), Qt.push({
 	name: "node",
-	load: async () => (await import("./js-exec-N5KEZBH7-kGBfZZcH.mjs")).nodeStubCommand
+	load: async () => (await import("./js-exec-N5KEZBH7-TG3GbXd8.mjs")).nodeStubCommand
 }));
 new TextEncoder();
 Object.freeze({
@@ -28242,7 +28244,7 @@ const handler$74 = async (c) => {
 	const record = await getWorkspaceTriggerById(triggerId, filter.projectIds);
 	if (!record) return c.json(ErrorResponseSchema.parse({ error: "Trigger not found" }), 404);
 	if (!record.assignments.find((entry) => entry.attachmentId === attachmentId)) return c.json(ErrorResponseSchema.parse({ error: "Attachment not found" }), 404);
-	if (!await canPerformProjectAction(c, record.projectId, projectActions.deploy)) return forbidden(c);
+	if (!await canPerformProjectAction(c, record.projectId, projectActions.deploy)) return forbidden$1(c);
 	const updated = await runWithProjectScope(record.projectId, () => setTriggerAttachmentEnabledState({
 		triggerId,
 		attachmentId,
@@ -28317,7 +28319,7 @@ const handler$73 = async (c) => {
 	if (filter === "empty") return c.json(ErrorResponseSchema.parse({ error: "Trigger not found" }), 404);
 	const record = await getWorkspaceTriggerById(triggerId, filter.projectIds);
 	if (!record) return c.json(ErrorResponseSchema.parse({ error: "Trigger not found" }), 404);
-	if (!await canPerformProjectAction(c, record.projectId, projectActions.deploy)) return forbidden(c);
+	if (!await canPerformProjectAction(c, record.projectId, projectActions.deploy)) return forbidden$1(c);
 	if (record.status === "disabled") return c.json(ErrorResponseSchema.parse({ error: "Trigger is disabled" }), 409);
 	const narrowed = narrowAssignments(record.assignments, parsed.data);
 	if ("error" in narrowed) return c.json(ErrorResponseSchema.parse({ error: narrowed.error }), narrowed.status);
@@ -32238,7 +32240,7 @@ const handler$10 = async (c) => {
 	if (!canRevokeApiKey(accessContext(c), {
 		userId: user.id,
 		createdByUserId: apiKey.createdByUserId
-	})) return forbidden(c);
+	})) return forbidden$1(c);
 	try {
 		await revokeOrgPlatformApiKey(apiKeyId, organizationId);
 		return c.body(null, 204);
@@ -33240,6 +33242,178 @@ function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp, brain) {
 	return internal;
 }
 //#endregion
+//#region src/routes/s3-gateway.ts
+const AUTH_RE = /^AWS4-HMAC-SHA256 Credential=([^/]+)\/([^/]+)\/([^/]+)\/([^/]+)\/aws4_request, SignedHeaders=([^,]+), Signature=([0-9a-f]+)$/i;
+function forbidden() {
+	return new Response("<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>AccessDenied</Code><Message>Access denied</Message></Error>", {
+		status: 403,
+		headers: { "content-type": "application/xml" }
+	});
+}
+function parseAuth(request) {
+	const match = AUTH_RE.exec(request.headers.get("authorization") ?? "");
+	return match ? {
+		accessKeyId: match[1],
+		date: match[2],
+		region: match[3],
+		service: match[4],
+		signedHeaders: match[5],
+		signature: match[6]
+	} : void 0;
+}
+function organizationIdFromAccessKey(accessKeyId) {
+	return (accessKeyId.startsWith("ksw_") ? accessKeyId.slice(4) : void 0)?.trim() || void 0;
+}
+function bucketFromPath(pathname) {
+	const first = pathname.split("/").filter(Boolean)[0];
+	return first ? decodeURIComponent(first) : void 0;
+}
+function physicalBucket(bucket, orgBucket) {
+	if (bucket === "workspace") return orgBucket;
+	if (bucket?.startsWith("workspace-")) return `${orgBucket}${bucket.slice(9)}`;
+}
+function copySourceBucket(request) {
+	const source = request.headers.get("x-amz-copy-source");
+	if (!source) return void 0;
+	try {
+		return bucketFromPath(new URL(source, "https://s3.invalid").pathname);
+	} catch {
+		return;
+	}
+}
+function safeEqual(left, right) {
+	const a = Buffer.from(left);
+	const b = Buffer.from(right);
+	return a.length === b.length && timingSafeEqual(a, b);
+}
+function requestForSigning(request) {
+	const url = new URL(request.url);
+	const query = {};
+	for (const [key, value] of url.searchParams) {
+		const current = query[key];
+		query[key] = current === void 0 ? value : Array.isArray(current) ? [...current, value] : [current, value];
+	}
+	const headers = Object.fromEntries(request.headers);
+	return {
+		method: request.method,
+		protocol: url.protocol,
+		hostname: url.hostname,
+		...url.port ? { port: Number(url.port) } : {},
+		path: url.pathname,
+		query,
+		headers
+	};
+}
+async function verifySigV4(request, secretAccessKey) {
+	const auth = parseAuth(request);
+	if (!auth || auth.service !== "s3") return false;
+	const amzDate = request.headers.get("x-amz-date") ?? "";
+	if (!amzDate.startsWith(auth.date)) return false;
+	const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})Z$/.exec(amzDate);
+	const timestamp = match ? Date.UTC(+match[1], +match[2] - 1, +match[3], +match[4], +match[5], +match[6]) : NaN;
+	if (!Number.isFinite(timestamp) || Math.abs(Date.now() - timestamp) > 15 * 6e4) return false;
+	const signed = await new SignatureV4({
+		credentials: {
+			accessKeyId: auth.accessKeyId,
+			secretAccessKey
+		},
+		region: auth.region,
+		service: "s3",
+		sha256: Sha256,
+		uriEscapePath: false
+	}).sign(requestForSigning(request), {
+		signingDate: new Date(timestamp),
+		unsignableHeaders: new Set([...request.headers.keys()].map((header) => header.toLowerCase()).filter((header) => !auth.signedHeaders.split(";").includes(header)))
+	});
+	const expected = parseAuth(new Request(request.url, { headers: signed.headers }))?.signature;
+	return !!expected && safeEqual(expected, auth.signature);
+}
+function stripHopHeaders(headers) {
+	const next = new Headers(headers);
+	for (const name of [
+		"authorization",
+		"connection",
+		"expect",
+		"host",
+		"keep-alive",
+		"proxy-authenticate",
+		"proxy-authorization",
+		"te",
+		"trailer",
+		"transfer-encoding",
+		"upgrade",
+		"x-amz-date"
+	]) next.delete(name);
+	return next;
+}
+function mountS3GatewayRoutes(app, workerSecret, options = {}) {
+	app.all("/s3/*", async (c) => {
+		if (!workerSecret) return forbidden();
+		const incoming = c.req.raw;
+		const auth = parseAuth(incoming);
+		const organizationId = auth ? organizationIdFromAccessKey(auth.accessKeyId) : void 0;
+		if (!organizationId) return forbidden();
+		if (!await verifySigV4(incoming, mintOrgWorkerToken(workerSecret, organizationId))) return forbidden();
+		const storage = options.resolveStorage ? await options.resolveStorage(organizationId) : await selectOrganizationById(organizationId).then((organization) => organization ? resolveOrgStorageConfig(organization) : void 0);
+		if (!storage) return forbidden();
+		const strippedPath = new URL(incoming.url).pathname.slice(3) || "/";
+		const bucket = bucketFromPath(strippedPath);
+		const mappedBucket = physicalBucket(bucket, storage.bucket);
+		const copyBucket = copySourceBucket(incoming);
+		const mappedCopyBucket = physicalBucket(copyBucket, storage.bucket);
+		if (!mappedBucket || incoming.headers.has("x-amz-copy-source") && !mappedCopyBucket) return forbidden();
+		const upstream = new URL(incoming.url);
+		const endpoint = new URL(storage.endpoint);
+		upstream.protocol = endpoint.protocol;
+		upstream.hostname = endpoint.hostname;
+		upstream.port = endpoint.port;
+		upstream.pathname = strippedPath.replace(`/${bucket}`, `/${mappedBucket}`);
+		const headers = stripHopHeaders(incoming.headers);
+		if (mappedCopyBucket) {
+			const source = headers.get("x-amz-copy-source");
+			headers.set("x-amz-copy-source", source.replace(`/${copyBucket}`, `/${mappedCopyBucket}`));
+		}
+		headers.set("host", upstream.host);
+		const body = incoming.method === "GET" || incoming.method === "HEAD" ? void 0 : incoming.body;
+		const signed = await new SignatureV4({
+			credentials: {
+				accessKeyId: storage.accessKeyId,
+				secretAccessKey: storage.secretAccessKey
+			},
+			region: storage.region,
+			service: "s3",
+			sha256: Sha256,
+			uriEscapePath: false
+		}).sign(requestForSigning(new Request(upstream, {
+			method: incoming.method,
+			headers
+		})));
+		try {
+			const response = await (options.fetch ?? fetch)(upstream, {
+				method: incoming.method,
+				headers: signed.headers,
+				body,
+				...body ? { duplex: "half" } : {}
+			});
+			return new Response(response.body, {
+				status: response.status,
+				headers: stripHopHeaders(response.headers)
+			});
+		} catch (error) {
+			console.error("S3 gateway upstream failed", {
+				organizationId,
+				method: incoming.method,
+				bucket: mappedBucket,
+				error
+			});
+			return new Response("<?xml version=\"1.0\" encoding=\"UTF-8\"?><Error><Code>ServiceUnavailable</Code><Message>Storage temporarily unavailable</Message></Error>", {
+				status: 503,
+				headers: { "content-type": "application/xml" }
+			});
+		}
+	});
+}
+//#endregion
 //#region src/routes/public/models/GET.ts
 async function handler$3(c) {
 	try {
@@ -33481,7 +33655,7 @@ async function handler(c) {
 //#region src/app.ts
 async function createApp$1(auth, options) {
 	const draftNotifier = options.draftNotifier ?? createInProcessProjectDraftNotifier();
-	return createApp({
+	const app = await createApp({
 		mode: "platform",
 		webOrigin: options.webOrigin,
 		schedulerPlugin: options.scheduler,
@@ -33517,6 +33691,8 @@ async function createApp$1(auth, options) {
 			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.mcp, options.brain));
 		}
 	});
+	mountS3GatewayRoutes(app, options.hosting.workerRuntime.workerToken);
+	return app;
 }
 //#endregion
 //#region src/lib/signup-slack.ts
@@ -33698,7 +33874,10 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 					organizationId: job.organizationId
 				},
 				env: {
-					...orgWorkspacesRuntimeEnv(organization, { containerEnv: process.env }),
+					...orgWorkspacesRuntimeEnv(organization, {
+						platformUrl: workerRuntime.platformUrl,
+						workerToken: orgWorkerToken
+					}),
 					...orgSchedulerRuntimeEnv(organization, process.env),
 					...platformConfig.llmProxy?.workerEnv({
 						platformUrl: workerRuntime.platformUrl,
@@ -33780,4 +33959,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { r1 as S, o as _, c as a, b$1 as b, a$1 as c, c$1 as d, r as f, e as g, u as h, n$1 as i, d$1 as l, b as m, n, p as o, r$1 as p, i as r, x as s, startPlatformServer as t, x$1 as u, r$3 as v, I1 as x, h as y };
 
-//# sourceMappingURL=start-Dc5awJbc.mjs.map
+//# sourceMappingURL=start-WyfB1dkv.mjs.map