@keystrokehq/platform 0.1.3 → 0.1.5

package/dist/{start-DAlaZ5zj.mjs → start-9_8ZcdaU.mjs}

@@ -1,10 +1,10 @@
-import { $ as ListOrganizationInvitationsResponseSchema, $t as mapOrganizationInvitation, A as CreateApiKeyResponseSchema, At as StoredProjectSourceManifestSchema, B as ErrorResponseSchema, Bt as UpdateProjectSettingsRequestSchema, C as AcceptOrganizationInvitationResponseSchema, Ct as RecentResourceListResponseSchema, D as AgentSummarySchema, Dt as SkillSummarySchema, E as AgentSummaryListResponseSchema, Et as SkillSummaryListResponseSchema, F as CreateProjectArtifactResponseSchema, Ft as UpdateOrganizationMemberResponseSchema, G as HistoryRunListResponseSchema, Gt as UserPreferencesPatchSchema, H as HistoryRunCancelResponseSchema, Ht as UploadProjectSourceResponseSchema, I as CreateProjectRequestSchema, It as UpdateOrganizationRequestSchema, J as InviteProjectMembersRequestSchema, Jt as WorkflowSummaryListResponseSchema, K as InviteOrganizationMembersRequestSchema, Kt as UserPreferencesSchema, L as CreateProjectResponseSchema, Ln as pingProjectTarget, Lt as UpdateProjectMemberRequestSchema, M as CreateCredentialsResponseSchema, Mt as SubmitTeamRequestResponseSchema, N as CreateOrganizationRequestSchema, Nt as UpdateCredentialRequestSchema, O as CompleteProjectArtifactResponseSchema, Ot as SlugAvailabilityQuerySchema, P as CreateOrganizationResponseSchema, Pt as UpdateOrganizationMemberRequestSchema, Q as ListCredentialsResponseSchema, Qt as listenPortFromPublicUrl, R as DeclineOrganizationInvitationResponseSchema, Rt as UpdateProjectMemberResponseSchema, S as ACTIVE_ORG_HEADER, St as ProjectSourceResourcesSchema, T as AgentSummaryDetailResponseSchema, Tt as SkillSummaryDetailResponseSchema, U as HistoryRunDetailResponseSchema, Ut as UserAvatarPatchSchema, V as GetCredentialResponseSchema, Vt as UploadProjectSourceManifestRequestSchema, W as HistoryRunListQuerySchema, Wt as UserAvatarSchema, X as ListApiKeysResponseSchema, Xt as buildCredentialInstanceLabel, Y as InviteProjectMembersResponseSchema, Yt as WorkflowSummarySchema, Z as ListAppsResponseSchema, Zt as displayCredentialAppName, _ as createJobQueue, _t as ProjectReachabilityResponseSchema, a as isKeystrokeAssetsAvatarPublicUrl, an as mapProjectSettings, at as ListProjectMetricsResponseSchema, b as readCredentialInstanceSecret, bt as ProjectSlugAvailabilityQuerySchema, c as isUserAvatarStorageKey, cn as normalizeUserPreferences, ct as OrganizationSidebarBrandingSchema, dn as parseStoredRouteManifest, dt as PresignOrgLogoRequestSchema, en as mapOrganizationMember, et as ListOrganizationMembersResponseSchema, f as orgLogoStorageKey, fn as projectFileId, ft as PresignOrgLogoResponseSchema, g as userAvatarStorageKey, gt as PresignUserAvatarResponseSchema, h as publicKeystrokeAssetsObjectUrl, ht as PresignUserAvatarRequestSchema, i as extractRouteManifestFromArtifact, in as mapProjectMember, it as ListProjectMembersResponseSchema, j as CreateCredentialsRequestSchema, jt as SubmitTeamRequestRequestSchema, k as CreateApiKeyRequestSchema, kt as SlugAvailabilityResponseSchema, l as keystrokeAssetsAvatarKeyFromPublicUrl, ln as organizationInvitationAcceptPath, lt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, m as projectSourceBlobKey, mn as validationErrorResponse, mt as PresignProjectSourceResponseSchema, n as createAssetsStorageClient, nn as mapProjectArtifact, nt as ListProjectDeploymentsResponseSchema, o as isKeystrokeAssetsOrgLogoPublicUrl, on as mapUserOrganization, ot as ListProjectsResponseSchema, p as projectArtifactKey, pn as resolveUniqueCredentialInstanceLabel, pt as PresignProjectSourceRequestSchema, q as InviteOrganizationMembersResponseSchema, qt as WorkflowSummaryDetailResponseSchema, r as ensureKeystrokeAssetsBucket, rn as mapProjectDeployment, rt as ListProjectFilesResponseSchema, s as isOrgLogoStorageKey, sn as mergeUserPreferences, st as OrganizationSidebarBrandingPatchSchema, t as RouteManifestNotFoundError, tn as mapProject, tt as ListOrganizationsResponseSchema, u as keystrokeAssetsOrgLogoKeyFromPublicUrl, un as organizationSlugErrorCodeFromMessage, ut as PROJECT_SLUG_TAKEN_MESSAGE, v as defaultSchedulerPlugin, vt as ProjectResponseSchema, w as ActiveOrganizationResponseSchema, wt as RecentResourceSchema, x as setCredentialInstanceSecret, xt as ProjectSlugAvailabilityResponseSchema, y as deleteCredentialInstanceSecret, yt as ProjectSettingsResponseSchema, z as DownloadActiveProjectArtifactResponseSchema, zt as UpdateProjectRequestSchema } from "./dist-70NUfApd.mjs";
+import { $ as InviteProjectMembersRequestSchema, $t as WorkflowSummaryListResponseSchema, A as CompleteProjectArtifactResponseSchema, At as SkillSummaryDetailResponseSchema, B as CreateProjectRequestSchema, Bt as UpdateOrganizationMemberResponseSchema, C as AcceptOrganizationInvitationResponseSchema, Ct as ProjectResponseSchema, D as AgentSummarySchema, Dt as ProjectSourceResourcesSchema, E as AgentSummaryListResponseSchema, Et as ProjectSlugAvailabilityResponseSchema, F as CreateCustomAppRequestSchema, Ft as StoredProjectSourceManifestSchema, G as GetCredentialResponseSchema, Gt as UpdateProjectSettingsRequestSchema, H as DeclineOrganizationInvitationResponseSchema, Ht as UpdateProjectMemberRequestSchema, I as CreateCustomAppResponseSchema, It as SubmitTeamRequestRequestSchema, J as HistoryRunDetailResponseSchema, Jt as UserAvatarPatchSchema, K as GetCustomAppResponseSchema, Kt as UploadProjectSourceManifestRequestSchema, L as CreateOrganizationRequestSchema, Lt as SubmitTeamRequestResponseSchema, M as CreateApiKeyResponseSchema, Mt as SkillSummarySchema, N as CreateCredentialsRequestSchema, Nt as SlugAvailabilityQuerySchema, O as AppSlugAvailabilityQuerySchema, Ot as RecentResourceListResponseSchema, P as CreateCredentialsResponseSchema, Pt as SlugAvailabilityResponseSchema, Q as InviteOrganizationMembersResponseSchema, Qt as WorkflowSummaryDetailResponseSchema, R as CreateOrganizationResponseSchema, Rt as UpdateCredentialRequestSchema, S as ACTIVE_ORG_HEADER, St as ProjectReachabilityResponseSchema, T as AgentSummaryDetailResponseSchema, Tt as ProjectSlugAvailabilityQuerySchema, U as DownloadActiveProjectArtifactResponseSchema, Ut as UpdateProjectMemberResponseSchema, V as CreateProjectResponseSchema, Vt as UpdateOrganizationRequestSchema, W as ErrorResponseSchema, Wn as pingProjectTarget, Wt as UpdateProjectRequestSchema, X as HistoryRunListResponseSchema, Xt as UserPreferencesPatchSchema, Y as HistoryRunListQuerySchema, Yt as UserAvatarSchema, Z as InviteOrganizationMembersRequestSchema, Zt as UserPreferencesSchema, _ as createJobQueue, _n as parseStoredRouteManifest, _t as PresignOrgLogoResponseSchema, a as isKeystrokeAssetsAvatarPublicUrl, an as mapOrganizationMember, at as ListOrganizationMembersResponseSchema, b as readCredentialInstanceSecret, bn as validateCredentialValueAgainstFields, bt as PresignUserAvatarRequestSchema, c as isUserAvatarStorageKey, cn as mapProjectDeployment, ct as ListProjectFilesResponseSchema, dn as mapUserOrganization, dt as ListProjectsResponseSchema, en as WorkflowSummarySchema, et as InviteProjectMembersResponseSchema, f as orgLogoStorageKey, fn as mergeUserPreferences, ft as OrganizationSidebarBrandingPatchSchema, g as userAvatarStorageKey, gn as parseAppSlug, gt as PresignOrgLogoRequestSchema, h as publicKeystrokeAssetsObjectUrl, hn as organizationSlugErrorCodeFromMessage, ht as PROJECT_SLUG_TAKEN_MESSAGE, i as extractRouteManifestFromArtifact, in as mapOrganizationInvitation, it as ListOrganizationInvitationsResponseSchema, j as CreateApiKeyRequestSchema, jt as SkillSummaryListResponseSchema, k as AppSlugAvailabilityResponseSchema, kt as RecentResourceSchema, l as keystrokeAssetsAvatarKeyFromPublicUrl, ln as mapProjectMember, lt as ListProjectMembersResponseSchema, m as projectSourceBlobKey, mn as organizationInvitationAcceptPath, mt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, n as createAssetsStorageClient, nn as displayCredentialAppName, nt as ListAppsResponseSchema, o as isKeystrokeAssetsOrgLogoPublicUrl, on as mapProject, ot as ListOrganizationsResponseSchema, p as projectArtifactKey, pn as normalizeUserPreferences, pt as OrganizationSidebarBrandingSchema, q as HistoryRunCancelResponseSchema, qt as UploadProjectSourceResponseSchema, r as ensureKeystrokeAssetsBucket, rn as listenPortFromPublicUrl, rt as ListCredentialsResponseSchema, s as isOrgLogoStorageKey, sn as mapProjectArtifact, st as ListProjectDeploymentsResponseSchema, t as RouteManifestNotFoundError, tn as buildCredentialInstanceLabel, tt as ListApiKeysResponseSchema, u as keystrokeAssetsOrgLogoKeyFromPublicUrl, un as mapProjectSettings, ut as ListProjectMetricsResponseSchema, v as defaultSchedulerPlugin, vn as projectFileId, vt as PresignProjectSourceRequestSchema, w as ActiveOrganizationResponseSchema, wt as ProjectSettingsResponseSchema, x as setCredentialInstanceSecret, xn as validationErrorResponse, xt as PresignUserAvatarResponseSchema, y as deleteCredentialInstanceSecret, yn as resolveUniqueCredentialInstanceLabel, yt as PresignProjectSourceResponseSchema, z as CreateProjectArtifactResponseSchema, zt as UpdateOrganizationMemberRequestSchema } from "./dist-CQMZgfp_.mjs";
 import { buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, deleteCredentialInstanceById, findHistoryRunCore, getServerTenantScopeId, inferDialect, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectWorkflowLastRunAtByIds, selectWorkflowRunById, touchResourceActivity, upsertCredentialInstance } from "@keystrokehq/database";
 import { ZodError, z } from "zod";
 import "node:path";
 import "node:fs";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { CannotModifyOwnerError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listOfficialApps, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgDatabaseUrl, resolveProjectRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectLastDeploymentAtByProject, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectFailed, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
+import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgDatabaseUrl, resolveOrgRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectLastDeploymentAtByProject, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, updateOrganizationActive, updateOrganizationFailed, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
 import { serve } from "@hono/node-server";
 import { AUTH_API_PATH, createAuth, createDefaultAuthJwtVerifier, extractWebhookApiKeyFromRequest, handleAuthRequest, resolveAuthEmailFrom, resolveRequestAuth } from "@keystrokehq/auth";
 import { buildWebhookUrl, createCredentialMaterializeHandler, extractWebhookRoutesFromManifest, seedOAuthAppsFromEnvForAllOrganizations, seedOAuthAppsFromEnvForOrganization, syncRegistryFromStoredManifest } from "@keystrokehq/runtime";
@@ -127,20 +127,11 @@ async function promoteProjectDeploy(input) {
 	const webhookRoutes = [...extractWebhookRoutesFromManifest(manifest), ...ephemeralRoutes];
 	if (webhookRoutes.length > 0) await ensureWebhookApiKeys(project.id, webhookRoutes, project.id);
 }
-/** Decide whether a pg-boss job should start runtime, skip as stale, or fail. */
-function resolveRuntimeArtifact(project, jobArtifactId) {
-	if (jobArtifactId && project.pendingArtifactId && jobArtifactId !== project.pendingArtifactId) return { action: "skip" };
-	if (jobArtifactId && !project.pendingArtifactId && project.activeArtifactId && jobArtifactId !== project.activeArtifactId) return { action: "skip" };
-	const artifactId = jobArtifactId ?? project.pendingArtifactId ?? project.activeArtifactId ?? null;
-	if (!artifactId) return {
-		action: "error",
-		message: `Project ${project.id} has no pending artifact`
-	};
-	if (!project.pendingArtifactId && project.activeArtifactId === artifactId && project.status === "active" && project.baseUrl && project.runtimeId) return { action: "skip" };
-	return {
-		action: "run",
-		artifactId
-	};
+/** True when a project still needs an org worker rebuild after a runtime job finishes. */
+function projectNeedsRuntimeFollowUp(project) {
+	if (project.status === "starting" && project.pendingArtifactId) return true;
+	if (project.pendingArtifactId && project.activeArtifactId !== project.pendingArtifactId) return true;
+	return false;
 }
 let runtimeQueue;
 let runtimeQueueInit;
@@ -150,7 +141,7 @@ function configureProjectRuntimeScheduler(plugin) {
 	runtimeQueue = void 0;
 	runtimeQueueInit = void 0;
 }
-async function getProjectRuntimeQueue() {
+async function getOrgRuntimeQueue() {
 	if (runtimeQueue) return runtimeQueue;
 	if (!runtimeQueueInit) runtimeQueueInit = (async () => {
 		const queue = await createJobQueue({
@@ -162,27 +153,60 @@ async function getProjectRuntimeQueue() {
 	})();
 	return runtimeQueueInit;
 }
-function toProjectRuntimeJob(payload) {
+function toOrgRuntimeJob(payload) {
 	const job = payload.payload;
-	if (!job?.projectId || !job.name || !job.artifactId) throw new Error("Invalid project runtime job payload");
+	if (!job?.organizationId) throw new Error("Invalid org runtime job payload");
 	return {
-		projectId: job.projectId,
-		name: job.name,
-		artifactId: job.artifactId
+		organizationId: job.organizationId,
+		triggerProjectId: job.triggerProjectId,
+		triggerArtifactId: job.triggerArtifactId
 	};
 }
-async function enqueueProjectRuntime(job) {
-	return (await getProjectRuntimeQueue()).enqueue({
+async function resolveOrgProjects(job) {
+	const projects = await selectProjectsByOrganizationId(job.organizationId);
+	const deploys = [];
+	for (const project of projects) {
+		const artifactId = project.id === job.triggerProjectId && job.triggerArtifactId ? job.triggerArtifactId : project.pendingArtifactId ?? project.activeArtifactId;
+		if (!artifactId) continue;
+		const artifact = await selectProjectArtifactById(artifactId);
+		if (!artifact || artifact.projectId !== project.id || artifact.status !== "ready") {
+			if (project.id === job.triggerProjectId) throw new Error(`Project ${project.id} pending artifact is not ready`);
+			continue;
+		}
+		deploys.push({
+			projectId: project.id,
+			name: project.name,
+			artifactId,
+			artifactStorageKey: artifact.storageKey
+		});
+	}
+	if (deploys.length === 0) throw new Error(`Organization ${job.organizationId} has no deployable projects`);
+	return deploys;
+}
+async function orgNeedsRuntimeFollowUp(organizationId) {
+	return (await selectProjectsByOrganizationId(organizationId)).some(projectNeedsRuntimeFollowUp);
+}
+async function enqueueOrgRuntime(job) {
+	return (await getOrgRuntimeQueue()).enqueue({
 		kind: "runtime",
-		targetId: job.projectId,
-		runId: job.artifactId,
+		targetId: job.organizationId,
+		runId: crypto.randomUUID(),
 		trigger: "api",
 		payload: job,
 		maxAttempts: 5,
-		dedupeKey: job.projectId
+		dedupeKey: job.organizationId
 	});
 }
-async function destroyProjectRuntime(runtime, input, runtimeId) {
+async function enqueueProjectRuntime(job) {
+	const project = await selectProjectById(job.projectId);
+	if (!project) throw new Error(`Project ${job.projectId} not found`);
+	return enqueueOrgRuntime({
+		organizationId: project.organizationId,
+		triggerProjectId: job.projectId,
+		triggerArtifactId: job.artifactId
+	});
+}
+async function destroyOrgRuntime(runtime, input, runtimeId) {
 	if (!runtime.destroy) return;
 	try {
 		await runtime.destroy({
@@ -190,49 +214,60 @@ async function destroyProjectRuntime(runtime, input, runtimeId) {
 			hosting: input.hosting
 		});
 	} catch (destroyError) {
-		console.error(`[project.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
+		console.error(`[org.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
 	}
 }
-async function handleProjectRuntimeJob(runtime, resolveStartInput, payload) {
+async function handleOrgRuntimeJob(runtime, resolveStartInput, payload) {
 	if (payload.kind !== "runtime") return;
-	const job = toProjectRuntimeJob(payload);
+	const job = toOrgRuntimeJob(payload);
 	try {
-		const project = await selectProjectById(job.projectId);
-		if (!project) throw new Error(`Project ${job.projectId} not found`);
-		const resolved = resolveRuntimeArtifact(project, job.artifactId);
-		if (resolved.action === "skip") return;
-		if (resolved.action === "error") throw new Error(resolved.message);
-		const input = await resolveStartInput({
-			...job,
-			artifactId: resolved.artifactId
-		});
+		const organization = await selectOrganizationById(job.organizationId);
+		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
+		const projects = await resolveOrgProjects(job);
+		const input = await resolveStartInput(job);
+		const mergedInput = {
+			...input,
+			organizationId: job.organizationId,
+			projects,
+			previousRuntimeId: input.previousRuntimeId ?? organization.runtimeId
+		};
 		let result;
 		try {
-			result = await runtime.start(input);
-			await promoteProjectDeploy({
-				projectId: job.projectId,
-				artifactId: resolved.artifactId,
-				baseUrl: result.baseUrl
+			result = await runtime.start(mergedInput);
+			for (const project of projects) {
+				await promoteProjectDeploy({
+					projectId: project.projectId,
+					artifactId: project.artifactId,
+					baseUrl: result.baseUrl
+				});
+				await updateProjectActive(project.projectId, {
+					baseUrl: result.baseUrl,
+					runtimeId: result.runtimeId
+				});
+			}
+			await updateOrganizationActive(job.organizationId, {
+				baseUrl: result.baseUrl,
+				runtimeId: result.runtimeId
 			});
-			await updateProjectActive(job.projectId, result);
-			if (input.previousRuntimeId) await destroyProjectRuntime(runtime, input, input.previousRuntimeId);
+			if (mergedInput.previousRuntimeId) await destroyOrgRuntime(runtime, mergedInput, mergedInput.previousRuntimeId);
+			if (await orgNeedsRuntimeFollowUp(job.organizationId)) await enqueueOrgRuntime({ organizationId: job.organizationId });
 		} catch (error) {
-			if (result) await destroyProjectRuntime(runtime, input, result.runtimeId);
+			if (result) await destroyOrgRuntime(runtime, mergedInput, result.runtimeId);
 			throw error;
 		}
 	} catch (error) {
-		console.error(`[project.runtime] ${job.projectId} failed`, error);
-		if (payload.exhaustedRetries) await updateProjectFailed(job.projectId, "Project runtime failed after retries");
+		console.error(`[org.runtime] ${job.organizationId} failed`, error);
+		if (payload.exhaustedRetries) await updateOrganizationFailed(job.organizationId, "Org runtime failed after retries");
 		throw error;
 	}
 }
 async function startProjectRuntimeWorker(runtime, options = {}) {
-	const queue = await getProjectRuntimeQueue();
+	const queue = await getOrgRuntimeQueue();
 	const resolveStartInput = options.resolveStartInput ?? (async (job) => {
-		throw new Error(`Project runtime for ${job.projectId} requires resolveStartInput with database credentials`);
+		throw new Error(`Org runtime for ${job.organizationId} requires resolveStartInput with database credentials`);
 	});
 	await queue.startWorker(async (payload) => {
-		await handleProjectRuntimeJob(runtime, resolveStartInput, payload);
+		await handleOrgRuntimeJob(runtime, resolveStartInput, payload);
 	});
 }
 //#endregion
@@ -538,7 +573,7 @@ function requireOrganizationParam() {
 	};
 }
 //#endregion
-//#region ../../packages/http/dist/with-public-project-runtime-BG_6tack.mjs
+//#region ../../packages/http/dist/with-public-project-runtime-B7hmgjbi.mjs
 const requestBackgroundTasks = new AsyncLocalStorage();
 function runWithRequestBackgroundTasks(fn) {
 	return requestBackgroundTasks.run([], fn);
@@ -576,7 +611,7 @@ function withOrganizationProjectDatabase() {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/GET.ts
-const handler$60 = async (c) => {
+const handler$63 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserAvatarSchema.parse({ url: dbUser.image ?? null }));
@@ -595,7 +630,7 @@ function avatarExtensionForContentType(contentType) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/presign/POST.ts
-const handler$59 = async (c) => {
+const handler$62 = async (c) => {
 	const parsed = PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -635,7 +670,7 @@ async function deleteStoredImageIfOwned(input) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/PATCH.ts
-const handler$58 = async (c) => {
+const handler$61 = async (c) => {
 	const parsed = UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
 	const user = c.get("user");
@@ -677,14 +712,14 @@ const handler$58 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/GET.ts
-const handler$57 = async (c) => {
+const handler$60 = async (c) => {
 	const dbUser = await selectUserById(c.get("user").id);
 	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(UserPreferencesSchema.parse(normalizeUserPreferences(dbUser.preferences)));
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/PATCH.ts
-const handler$56 = async (c) => {
+const handler$59 = async (c) => {
 	const parsed = UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
 	const user = c.get("user");
@@ -699,9 +734,9 @@ const handler$56 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/GET.ts
-const handler$55 = async (c) => {
+const handler$58 = async (c) => {
 	const memberships = await selectUserOrganizations(c.get("user").id);
-	return c.json(ListOrganizationsResponseSchema.parse({ organizations: memberships.map(mapUserOrganization) }));
+	return c.json(ListOrganizationsResponseSchema.parse(memberships.map(mapUserOrganization)));
 };
 //#endregion
 //#region src/services/create-organization.ts
@@ -767,7 +802,7 @@ function createOrganizationHandler(deps) {
 		if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid organization request" }), 400);
 		try {
 			const membership = await createOrganizationWithHosting(deps, user.id, parsed.data.name, parsed.data.slug);
-			return c.json(CreateOrganizationResponseSchema.parse({ organization: mapUserOrganization(membership) }), 201);
+			return c.json(CreateOrganizationResponseSchema.parse(mapUserOrganization(membership)), 201);
 		} catch (error) {
 			if (error instanceof OrganizationSlugTakenError$1) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
 			if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
@@ -777,7 +812,7 @@ function createOrganizationHandler(deps) {
 }
 //#endregion
 //#region src/routes/account/organizations/slug-available/GET.ts
-const handler$54 = async (c) => {
+const handler$57 = async (c) => {
 	const parsed = SlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
 		excludeOrganizationId: c.req.query("excludeOrganizationId")
@@ -788,15 +823,15 @@ const handler$54 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/GET.ts
-const handler$53 = async (c) => {
+const handler$56 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
 	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
-	return c.json(ActiveOrganizationResponseSchema.parse({ organization: mapUserOrganization(membership) }));
+	return c.json(ActiveOrganizationResponseSchema.parse(mapUserOrganization(membership)));
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/PATCH.ts
-const handler$52 = async (c) => {
+const handler$55 = async (c) => {
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
 	const parsed = UpdateOrganizationRequestSchema.safeParse(body);
@@ -809,10 +844,10 @@ const handler$52 = async (c) => {
 		if (parsed.data.name !== void 0) updated = await updateOrganizationName(organization.organizationId, parsed.data.name);
 		if (parsed.data.slug !== void 0) updated = await updateOrganizationSlug(organization.organizationId, parsed.data.slug);
 		if (!updated) throw new Error(`Organization update produced no result: ${organization.organizationId}`);
-		return c.json(ActiveOrganizationResponseSchema.parse({ organization: mapUserOrganization({
+		return c.json(ActiveOrganizationResponseSchema.parse(mapUserOrganization({
 			organization: updated,
 			role: organization.role
-		}) }));
+		})));
 	} catch (error) {
 		if (error instanceof OrganizationSlugTakenError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
 		if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
@@ -821,7 +856,7 @@ const handler$52 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/GET.ts
-const handler$51 = async (c) => {
+const handler$54 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
 	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
@@ -870,7 +905,7 @@ async function finalizeOrgLogoVariant(input) {
 		publicUrl: finalized.publicUrl
 	};
 }
-const handler$50 = async (c) => {
+const handler$53 = async (c) => {
 	const parsed = OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
 	const { organizationId } = c.get("organization");
@@ -898,7 +933,7 @@ const handler$50 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
-const handler$49 = async (c) => {
+const handler$52 = async (c) => {
 	const parsed = PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -989,7 +1024,7 @@ async function attachRanAsToDetail(detail, ranByUserId) {
 }
 //#endregion
 //#region src/routes/account/history/GET.ts
-const handler$48 = async (c) => {
+const handler$51 = async (c) => {
 	const organization = c.get("organization");
 	const ctx = accessContext(c);
 	const query = HistoryRunListQuerySchema.parse({
@@ -1012,7 +1047,7 @@ const handler$48 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/history/[runId]/GET.ts
-const handler$47 = async (c) => {
+const handler$50 = async (c) => {
 	const runId = c.req.param("runId") ?? "";
 	if (!runId) return c.json(null, 404);
 	const core = await findHistoryRunCore(runId);
@@ -1063,7 +1098,7 @@ function toAgentSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/agents/GET.ts
-const handler$46 = async (c) => {
+const handler$49 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(AgentSummaryListResponseSchema.parse([]));
 	const rows = await listActiveAgents(filter);
@@ -1077,7 +1112,7 @@ function touchResourceActivityBestEffort(options) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/GET.ts
-const handler$45 = async (c) => {
+const handler$48 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(AgentSummaryDetailResponseSchema.parse(null));
@@ -1112,7 +1147,7 @@ async function cancelHistoryRun(c, kind, cancel) {
 }
 //#endregion
 //#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
-const handler$44 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
+const handler$47 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
 //#endregion
 //#region src/routes/account/resources/workflows.ts
 function toWorkflowSummary(row, options) {
@@ -1129,7 +1164,7 @@ function toWorkflowSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/workflows/GET.ts
-const handler$43 = async (c) => {
+const handler$46 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(WorkflowSummaryListResponseSchema.parse([]));
 	const rows = await listActiveWorkflows(filter);
@@ -1138,7 +1173,7 @@ const handler$43 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/GET.ts
-const handler$42 = async (c) => {
+const handler$45 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const row = workflowId ? await selectActiveWorkflowById(workflowId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(WorkflowSummaryDetailResponseSchema.parse(null));
@@ -1153,7 +1188,7 @@ const handler$42 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
-const handler$41 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
+const handler$44 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
 //#endregion
 //#region src/routes/account/resources/skills.ts
 function toSkillSummary(row) {
@@ -1169,7 +1204,7 @@ function toSkillSummary(row) {
 }
 //#endregion
 //#region src/routes/account/skills/GET.ts
-const handler$40 = async (c) => {
+const handler$43 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(SkillSummaryListResponseSchema.parse([]));
 	const rows = await listActiveSkills(filter);
@@ -1177,7 +1212,7 @@ const handler$40 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/skills/[skillId]/GET.ts
-const handler$39 = async (c) => {
+const handler$42 = async (c) => {
 	const skillId = c.req.param("skillId") ?? "";
 	const row = skillId ? await selectActiveSkillById(skillId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(SkillSummaryDetailResponseSchema.parse(null));
@@ -1224,7 +1259,7 @@ function latestRecentInteractionAt(recent) {
 //#endregion
 //#region src/routes/account/recents/GET.ts
 const RECENTS_LIMIT = 50;
-const handler$38 = async (c) => {
+const handler$41 = async (c) => {
 	const userId = c.get("user").id;
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
@@ -1250,11 +1285,11 @@ const handler$38 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/GET.ts
-const handler$37 = async (c) => {
+const handler$40 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
-	return c.json(ListProjectsResponseSchema.parse({ projects: projects.map(mapProject) }));
+	return c.json(ListProjectsResponseSchema.parse(projects.map(mapProject)));
 };
 //#endregion
 //#region src/routes/account/projects/metrics/merge-project-list-metrics.ts
@@ -1276,7 +1311,7 @@ function mergeProjectListMetrics(input) {
 }
 //#endregion
 //#region src/routes/account/projects/metrics/GET.ts
-const handler$36 = async (c) => {
+const handler$39 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([selectProjectResourceCounts(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), selectLastDeploymentAtByProject(organization.organizationId)]);
@@ -1288,22 +1323,22 @@ const handler$36 = async (c) => {
 		const allowed = new Set(grantedProjectIdsList);
 		metrics = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => allowed.has(projectId)));
 	}
-	return c.json(ListProjectMetricsResponseSchema.parse({ metrics }));
+	return c.json(ListProjectMetricsResponseSchema.parse(metrics));
 };
 //#endregion
 //#region src/routes/account/projects/POST.ts
-const handler$35 = async (c) => {
+const handler$38 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const body = await c.req.json().catch(() => null);
 	const parsed = CreateProjectRequestSchema.safeParse(body);
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Project name is required" }), 400);
 	const project = await createProjectForOrganization(organization.organizationId, parsed.data.name, parsed.data.description, user.id);
-	return c.json(CreateProjectResponseSchema.parse({ project: mapProject(project) }), 201);
+	return c.json(CreateProjectResponseSchema.parse(mapProject(project)), 201);
 };
 //#endregion
 //#region src/routes/account/projects/slug-available/GET.ts
-const handler$34 = async (c) => {
+const handler$37 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = ProjectSlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
@@ -1315,12 +1350,12 @@ const handler$34 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/GET.ts
-const handler$33 = async (c) => {
-	return c.json(ProjectResponseSchema.parse({ project: routeProject(c.get("project")) }));
+const handler$36 = async (c) => {
+	return c.json(ProjectResponseSchema.parse(routeProject(c.get("project"))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/PATCH.ts
-const handler$32 = async (c) => {
+const handler$35 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1334,11 +1369,11 @@ const handler$32 = async (c) => {
 		throw error;
 	}
 	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(ProjectResponseSchema.parse({ project: mapProject(updated) }));
+	return c.json(ProjectResponseSchema.parse(mapProject(updated)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/DELETE.ts
-const handler$31 = async (c) => {
+const handler$34 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	if (!await deleteProjectForOrganization(organization.organizationId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
@@ -1346,15 +1381,15 @@ const handler$31 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/deployments/GET.ts
-const handler$30 = async (c) => {
+const handler$33 = async (c) => {
 	const rows = await selectProjectDeployments(c.get("project").id);
-	return c.json(ListProjectDeploymentsResponseSchema.parse({ deployments: rows.map(mapProjectDeployment) }));
+	return c.json(ListProjectDeploymentsResponseSchema.parse(rows.map(mapProjectDeployment)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/POST.ts
 const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
 const ARTIFACT_CONTENT_TYPE = "application/gzip";
-const handler$29 = async (c) => {
+const handler$32 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -1382,7 +1417,7 @@ const handler$29 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
 const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-const handler$28 = async (c) => {
+const handler$31 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await selectOrganizationById(organizationId);
@@ -1401,7 +1436,7 @@ const handler$28 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/complete/POST.ts
-const handler$27 = async (c) => {
+const handler$30 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1440,7 +1475,7 @@ const handler$27 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
 const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
-const handler$26 = async (c) => {
+const handler$29 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1468,7 +1503,7 @@ const handler$26 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
-const handler$25 = async (c) => {
+const handler$28 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1513,7 +1548,7 @@ function resolveSourcePaths(rows, kindDir, filePaths) {
 		}] : [];
 	});
 }
-const handler$24 = async (c) => {
+const handler$27 = async (c) => {
 	const project = c.get("project");
 	const active = await selectActiveArtifactSourceManifestForProject(project.id);
 	if (!active || !active.sourceManifestJson) return c.json(ListProjectFilesResponseSchema.parse({
@@ -1547,7 +1582,7 @@ const handler$24 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
-const handler$23 = async (c) => {
+const handler$26 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1576,24 +1611,25 @@ function createProjectReachabilityHandler(hosting) {
 	return async (c) => {
 		const project = c.get("project");
 		if (project.status !== "active") return c.json(ProjectReachabilityResponseSchema.parse({ reachable: false }));
+		const organization = await selectOrganizationById(project.organizationId);
 		const reachable = await pingProjectTarget({
-			baseUrl: project.baseUrl,
-			runtimeId: project.runtimeId
+			baseUrl: organization?.baseUrl ?? project.baseUrl,
+			runtimeId: organization?.runtimeId ?? project.runtimeId
 		}, { plugin: hosting });
 		return c.json(ProjectReachabilityResponseSchema.parse({ reachable }));
 	};
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/GET.ts
-const handler$22 = async (c) => {
+const handler$25 = async (c) => {
 	const project = c.get("project");
 	const currentUserId = c.get("user").id;
 	const members = await selectProjectMembers(project.id);
-	return c.json(ListProjectMembersResponseSchema.parse({ members: members.map((member) => mapProjectMember(member, { isCurrentUser: member.id === currentUserId })) }));
+	return c.json(ListProjectMembersResponseSchema.parse(members.map((member) => mapProjectMember(member, { isCurrentUser: member.id === currentUserId }))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/POST.ts
-const handler$21 = async (c) => {
+const handler$24 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1605,11 +1641,11 @@ const handler$21 = async (c) => {
 		emails: parsed.data.emails,
 		role: parsed.data.role
 	});
-	return c.json(InviteProjectMembersResponseSchema.parse({ results }));
+	return c.json(InviteProjectMembersResponseSchema.parse(results));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
-const handler$20 = async (c) => {
+const handler$23 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -1618,7 +1654,7 @@ const handler$20 = async (c) => {
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
 	try {
 		const member = await updateProjectMemberRole(project.id, userId, parsed.data.role);
-		return c.json(UpdateProjectMemberResponseSchema.parse({ member: mapProjectMember(member) }));
+		return c.json(UpdateProjectMemberResponseSchema.parse(mapProjectMember(member)));
 	} catch (error) {
 		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
 		throw error;
@@ -1626,7 +1662,7 @@ const handler$20 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
-const handler$19 = async (c) => {
+const handler$22 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -1640,7 +1676,7 @@ const handler$19 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
-const handler$18 = async (c) => {
+const handler$21 = async (c) => {
 	const project = c.get("project");
 	const userId = c.get("user").id;
 	try {
@@ -1653,13 +1689,13 @@ const handler$18 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/GET.ts
-const handler$17 = async (c) => {
+const handler$20 = async (c) => {
 	const project = c.get("project");
-	return c.json(ProjectSettingsResponseSchema.parse({ settings: mapProjectSettings(project) }));
+	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(project)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/PATCH.ts
-const handler$16 = async (c) => {
+const handler$19 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1671,7 +1707,7 @@ const handler$16 = async (c) => {
 		invitePermission: parsed.data.invitePermission
 	});
 	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(ProjectSettingsResponseSchema.parse({ settings: mapProjectSettings(updated) }));
+	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(updated)));
 };
 //#endregion
 //#region src/routes/account/credentials/enrich.ts
@@ -1693,8 +1729,12 @@ function canManageCredential(row, userId) {
 	if (row.scopeType === "user") return userId !== void 0 && row.scopeId === userId;
 	return true;
 }
-/** Display name derived from the credential key (e.g. `google-drive` → `Google Drive`). */
+/** Display name derived from the app slug (org-custom slugs use the segment after `/`). */
 function displayAppName(appId) {
+	try {
+		const parsed = parseAppSlug(appId);
+		if (parsed.kind === "org") return displayCredentialAppName(parsed.name);
+	} catch {}
 	return displayCredentialAppName(appId);
 }
 /** Masked preview of a secret — last 4 chars revealed, the rest masked. Plaintext never returned. */
@@ -1781,10 +1821,10 @@ async function enrichCredentialInstances(rows, organizationId) {
 }
 //#endregion
 //#region src/routes/account/credentials/GET.ts
-const handler$15 = async (c) => {
+const handler$18 = async (c) => {
 	const organization = c.get("organization");
 	const credentials = await enrichCredentialInstances(await listAllCredentialInstances(), organization.organizationId);
-	return c.json(ListCredentialsResponseSchema.parse({ credentials }));
+	return c.json(ListCredentialsResponseSchema.parse(credentials));
 };
 //#endregion
 //#region src/routes/account/credentials/POST.ts
@@ -1792,7 +1832,7 @@ function withTargetScope(target, fn) {
 	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
 	return fn();
 }
-const handler$14 = async (c) => {
+const handler$17 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -1801,6 +1841,13 @@ const handler$14 = async (c) => {
 		return c.json({ error: message }, 400);
 	}
 	const input = parsed.data;
+	if (input.connectionKind === "manual" && input.value) {
+		const app = await selectAppForOrganization(organization.organizationId, input.appId);
+		if (app && hasCredentialFieldTemplate(app)) {
+			const validation = validateCredentialValueAgainstFields(app.credentialFields, input.value);
+			if (!validation.ok) return c.json({ error: validation.message }, 400);
+		}
+	}
 	const resolvedProjects = [];
 	for (const slug of input.projects) {
 		const project = await selectProjectForOrganizationBySlug(organization.organizationId, slug);
@@ -1837,7 +1884,7 @@ const handler$14 = async (c) => {
 	for (const target of targets) {
 		const siblings = await withTargetScope(target, () => selectCredentialInstancesForScope(input.appId, target.scopeType, target.scopeId));
 		const label = resolveUniqueCredentialInstanceLabel({
-			baseLabel: buildCredentialInstanceLabel({
+			baseLabel: input.label?.trim() || buildCredentialInstanceLabel({
 				scopeType: target.scopeType,
 				appName,
 				projectName: target.projectName
@@ -1862,21 +1909,21 @@ const handler$14 = async (c) => {
 		if (row) rows.push(row);
 	}
 	const credentials = await enrichCredentialInstances(rows, organization.organizationId);
-	return c.json(CreateCredentialsResponseSchema.parse({ credentials }), 201);
+	return c.json(CreateCredentialsResponseSchema.parse(credentials), 201);
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/GET.ts
-const handler$13 = async (c) => {
+const handler$16 = async (c) => {
 	const organization = c.get("organization");
 	const credentialId = c.req.param("credentialId") ?? "";
 	const row = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
 	if (!row || toAppCredentialScope(row.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
 	const [credential] = await enrichCredentialInstances([row], organization.organizationId);
-	return c.json(GetCredentialResponseSchema.parse({ credential }));
+	return c.json(GetCredentialResponseSchema.parse(credential));
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/PATCH.ts
-const handler$12 = async (c) => {
+const handler$15 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -1929,7 +1976,7 @@ const handler$12 = async (c) => {
 	});
 	const updated = await selectCredentialInstanceById(credentialId);
 	const [credential] = await enrichCredentialInstances(updated ? [updated] : [], organization.organizationId);
-	return c.json(GetCredentialResponseSchema.parse({ credential }));
+	return c.json(GetCredentialResponseSchema.parse(credential));
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/DELETE.ts
@@ -1958,10 +2005,10 @@ function createDeleteCredentialHandler(options = {}) {
 }
 //#endregion
 //#region src/routes/account/members/GET.ts
-const handler$11 = async (c) => {
+const handler$14 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const members = await selectOrganizationMembers(organizationId);
-	return c.json(ListOrganizationMembersResponseSchema.parse({ members: members.map(mapOrganizationMember) }));
+	return c.json(ListOrganizationMembersResponseSchema.parse(members.map(mapOrganizationMember)));
 };
 //#endregion
 //#region src/email/organization-invite-email.ts
@@ -2006,7 +2053,7 @@ async function sendOrganizationInviteEmail(payload, resend) {
 }
 //#endregion
 //#region src/routes/account/members/invitations/POST.ts
-const handler$10 = async (c) => {
+const handler$13 = async (c) => {
 	const user = c.get("user");
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
@@ -2028,11 +2075,11 @@ const handler$10 = async (c) => {
 			inviterName: inviter?.name
 		});
 	}
-	return c.json(InviteOrganizationMembersResponseSchema.parse({ results }));
+	return c.json(InviteOrganizationMembersResponseSchema.parse(results));
 };
 //#endregion
 //#region src/routes/account/members/[userId]/PATCH.ts
-const handler$9 = async (c) => {
+const handler$12 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -2041,7 +2088,7 @@ const handler$9 = async (c) => {
 	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
 	try {
 		const member = await updateOrganizationMemberRole(organizationId, userId, parsed.data.role);
-		return c.json(UpdateOrganizationMemberResponseSchema.parse({ member: mapOrganizationMember(member) }));
+		return c.json(UpdateOrganizationMemberResponseSchema.parse(mapOrganizationMember(member)));
 	} catch (error) {
 		if (error instanceof CannotModifyOwnerError || error instanceof OrganizationMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
 		throw error;
@@ -2049,7 +2096,7 @@ const handler$9 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/DELETE.ts
-const handler$8 = async (c) => {
+const handler$11 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -2063,19 +2110,19 @@ const handler$8 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/GET.ts
-const handler$7 = async (c) => {
+const handler$10 = async (c) => {
 	const invitations = await selectPendingInvitationsForUser(c.get("user").id);
-	return c.json(ListOrganizationInvitationsResponseSchema.parse({ invitations: invitations.map(mapOrganizationInvitation) }));
+	return c.json(ListOrganizationInvitationsResponseSchema.parse(invitations.map(mapOrganizationInvitation)));
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/accept/POST.ts
-const handler$6 = async (c) => {
+const handler$9 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
 	try {
 		const membership = await acceptInvitation(invitationId, user.id);
-		return c.json(AcceptOrganizationInvitationResponseSchema.parse({ organization: mapUserOrganization(membership) }));
+		return c.json(AcceptOrganizationInvitationResponseSchema.parse(mapUserOrganization(membership)));
 	} catch (error) {
 		if (error instanceof OrganizationInvitationNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
 		if (error instanceof OrganizationInvitationForbiddenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 403);
@@ -2085,7 +2132,7 @@ const handler$6 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/decline/POST.ts
-const handler$5 = async (c) => {
+const handler$8 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -2110,14 +2157,83 @@ function appRowToCatalogEntry(row) {
 		integrationDescription: row.description,
 		...row.logo ? { logo: row.logo } : {},
 		authKind: row.authKind,
-		oauthScopes: row.oauthScopes
+		oauthScopes: row.oauthScopes,
+		source: row.source,
+		...hasCredentialFieldTemplate(row) ? { credentialFields: row.credentialFields } : {}
+	};
+}
+function appRowToCustomAppDetail(row) {
+	if (row.source !== "custom" || row.authKind !== "api_key") throw new Error(`App is not a custom api_key app: ${row.slug}`);
+	if (!hasCredentialFieldTemplate(row)) throw new Error(`Custom app is missing credential fields: ${row.slug}`);
+	return {
+		id: row.slug,
+		slug: row.slug,
+		name: row.name,
+		description: row.description,
+		category: row.category,
+		authKind: "api_key",
+		source: "custom",
+		credentialFields: row.credentialFields,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString()
 	};
 }
 //#endregion
 //#region src/routes/account/apps/GET.ts
+const handler$7 = async (c) => {
+	const apps = (await listAppsForOrganization(c.get("organization").organizationId)).map(appRowToCatalogEntry);
+	return c.json(ListAppsResponseSchema.parse(apps));
+};
+//#endregion
+//#region src/routes/account/apps/POST.ts
+const handler$6 = async (c) => {
+	const organization = c.get("organization");
+	const parsed = CreateCustomAppRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json(ErrorResponseSchema.parse({ error: message }), 400);
+	}
+	const org = await selectOrganizationById(organization.organizationId);
+	if (!org) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	try {
+		const row = await createOrgApp({
+			organizationId: organization.organizationId,
+			orgSlug: org.slug,
+			name: parsed.data.name,
+			slug: parsed.data.slug,
+			description: parsed.data.description,
+			credentialFields: parsed.data.fields
+		});
+		return c.json(CreateCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)), 201);
+	} catch (error) {
+		if (error instanceof OrgAppSlugTakenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 409);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/apps/slug-available/GET.ts
+const handler$5 = async (c) => {
+	const organization = c.get("organization");
+	const parsed = AppSlugAvailabilityQuerySchema.safeParse({ slug: c.req.query("slug") });
+	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
+	const org = await selectOrganizationById(organization.organizationId);
+	if (!org) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const availability = await checkOrgAppSlugAvailability(org.slug, parsed.data.slug);
+	return c.json(AppSlugAvailabilityResponseSchema.parse(availability));
+};
+//#endregion
+//#region src/routes/account/apps/[slug]/GET.ts
 const handler$4 = async (c) => {
-	const apps = (await listOfficialApps()).map(appRowToCatalogEntry);
-	return c.json(ListAppsResponseSchema.parse({ apps }));
+	const organization = c.get("organization");
+	const slug = c.req.param("slug") ?? "";
+	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	const row = await selectAppForOrganization(organization.organizationId, decodeURIComponent(slug));
+	if (!row || row.source !== "custom") return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	try {
+		return c.json(GetCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)));
+	} catch {
+		return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	}
 };
 //#endregion
 //#region src/routes/account/api-keys/GET.ts
@@ -2127,14 +2243,14 @@ const handler$3 = async (c) => {
 	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await listOrgPlatformApiKeysForOrganization(organizationId) : await listOrgPlatformApiKeysForUser(organizationId, user.id);
 	const creators = await selectUsersByIds([...new Set(records.map((record) => record.createdByUserId))]);
 	const creatorsById = new Map(creators.map((creator) => [creator.id, creator]));
-	return c.json(ListApiKeysResponseSchema.parse({ apiKeys: records.map((record) => ({
+	return c.json(ListApiKeysResponseSchema.parse(records.map((record) => ({
 		id: record.id,
 		name: record.name,
 		keyPreview: record.keyPreview,
 		createdAt: record.createdAt.toISOString(),
 		createdBy: mapOrgPlatformApiKeyCreatorOrDeleted(record.createdByUserId, creatorsById.get(record.createdByUserId)),
 		isCreatedByCurrentUser: record.createdByUserId === user.id
-	})) }));
+	}))));
 };
 //#endregion
 //#region src/routes/account/api-keys/POST.ts
@@ -2311,71 +2427,74 @@ function mountAccountRoutes(options) {
 	const requireProjectManageMembers = authorize(projectActions.manageMembers);
 	const requireInvitableProjectRole = authorizePayload(InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
 	const requireOrgParam = requireOrganizationParam();
-	account.get("/organizations", handler$55);
-	account.get("/organizations/slug-available", handler$54);
+	account.get("/organizations", handler$58);
+	account.get("/organizations/slug-available", handler$57);
 	account.post("/organizations", createOrganizationHandler(options));
-	account.get("/organizations/:organizationId", requireOrgParam, handler$53);
-	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$52);
-	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$51);
-	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$50);
-	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$49);
-	account.get("/invitations", handler$7);
-	account.post("/invitations/:invitationId/accept", handler$6);
-	account.post("/invitations/:invitationId/decline", handler$5);
-	account.get("/users/me/avatar", handler$60);
-	account.post("/users/me/avatar/presign", handler$59);
-	account.patch("/users/me/avatar", handler$58);
-	account.get("/users/me/preferences", handler$57);
-	account.patch("/users/me/preferences", handler$56);
-	account.get("/apps", handler$4);
-	orgScoped.get("/members", handler$11);
-	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$10);
-	orgScoped.patch("/members/:userId", requireUserManage, handler$9);
-	orgScoped.delete("/members/:userId", requireUserManage, handler$8);
+	account.get("/organizations/:organizationId", requireOrgParam, handler$56);
+	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$55);
+	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$54);
+	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$53);
+	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$52);
+	account.get("/invitations", handler$10);
+	account.post("/invitations/:invitationId/accept", handler$9);
+	account.post("/invitations/:invitationId/decline", handler$8);
+	account.get("/users/me/avatar", handler$63);
+	account.post("/users/me/avatar/presign", handler$62);
+	account.patch("/users/me/avatar", handler$61);
+	account.get("/users/me/preferences", handler$60);
+	account.patch("/users/me/preferences", handler$59);
+	orgScoped.get("/apps", handler$7);
+	orgScoped.get("/apps/slug-available", handler$5);
+	orgScoped.post("/apps", requireOrgUpdate, handler$6);
+	orgScoped.get("/apps/:slug", handler$4);
+	orgScoped.get("/members", handler$14);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$13);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$12);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$11);
 	orgScoped.get("/api-keys", handler$3);
 	orgScoped.post("/api-keys", requireApiKeyCreate, handler$2);
 	orgScoped.delete("/api-keys/:apiKeyId", handler$1);
 	const withOrgDb = withOrganizationProjectDatabase();
-	orgScoped.get("/agents", withOrgDb, handler$46);
-	orgScoped.get("/agents/:agentId", withOrgDb, handler$45);
-	orgScoped.get("/workflows", withOrgDb, handler$43);
-	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$42);
-	orgScoped.get("/skills", withOrgDb, handler$40);
-	orgScoped.get("/skills/:skillId", withOrgDb, handler$39);
-	orgScoped.get("/recents", withOrgDb, handler$38);
-	orgScoped.get("/history", withOrgDb, handler$48);
+	orgScoped.get("/agents", withOrgDb, handler$49);
+	orgScoped.get("/agents/:agentId", withOrgDb, handler$48);
+	orgScoped.get("/workflows", withOrgDb, handler$46);
+	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$45);
+	orgScoped.get("/skills", withOrgDb, handler$43);
+	orgScoped.get("/skills/:skillId", withOrgDb, handler$42);
+	orgScoped.get("/recents", withOrgDb, handler$41);
+	orgScoped.get("/history", withOrgDb, handler$51);
 	orgScoped.post("/team-requests", handler);
-	orgScoped.get("/history/:runId", withOrgDb, handler$47);
-	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$41);
-	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$44);
-	orgScoped.get("/credentials", withOrgDb, handler$15);
-	orgScoped.post("/credentials", withOrgDb, handler$14);
-	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$13(c, next));
-	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$12);
+	orgScoped.get("/history/:runId", withOrgDb, handler$50);
+	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$44);
+	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$47);
+	orgScoped.get("/credentials", withOrgDb, handler$18);
+	orgScoped.post("/credentials", withOrgDb, handler$17);
+	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$16(c, next));
+	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$15);
 	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
-	orgScoped.get("/projects", handler$37);
-	orgScoped.get("/projects/slug-available", handler$34);
-	orgScoped.get("/projects/metrics", withOrgDb, handler$36);
-	orgScoped.post("/projects", handler$35);
-	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$33);
-	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$32);
-	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$31);
-	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$17);
-	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$16);
-	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$22);
-	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$21);
-	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$20);
-	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$19);
-	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$18);
+	orgScoped.get("/projects", handler$40);
+	orgScoped.get("/projects/slug-available", handler$37);
+	orgScoped.get("/projects/metrics", withOrgDb, handler$39);
+	orgScoped.post("/projects", handler$38);
+	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$36);
+	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$35);
+	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$34);
+	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$20);
+	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$19);
+	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$25);
+	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$24);
+	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$23);
+	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$22);
+	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$21);
 	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
-	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$24);
-	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$23);
-	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$30);
-	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
-	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
-	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$27);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$26);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$25);
+	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$27);
+	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$26);
+	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$33);
+	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$31);
+	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$32);
+	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$30);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
 	orgScoped.route("/projects", projectScoped);
 	account.route("/", orgScoped);
 	return account;
@@ -2471,11 +2590,12 @@ const SandboxWriteBodySchema = SandboxSessionBodySchema.extend({
 	path: z.string().trim().min(1),
 	content: z.string()
 });
-function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy) {
+function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy, mcp) {
 	const internal = new Hono();
 	const protect = requireWorkerToken(workerToken);
 	const materialize = createCredentialMaterializeHandler(tokenRefresh);
 	internal.use("/*", protect);
+	mcp?.mountInternalRoutes?.(internal, { withProjectScope });
 	internal.post("/projects/:projectId/credentials/materialize", async (c) => {
 		const response = await withProjectScope(c.req.param("projectId"), async () => materialize(c));
 		if (response === void 0) return c.json({ error: "Project not found" }, 404);
@@ -2628,7 +2748,7 @@ async function createApp$1(auth, options) {
 			}));
 		},
 		mountInternal: (app, { tokenRefresh }) => {
-			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy));
+			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy, options.mcp));
 		}
 	});
 }
@@ -2652,45 +2772,34 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 	if (usesPgBossScheduler(platformConfig)) await ensureProjectPgBossGrants();
 	configureProjectRuntimeScheduler(platformConfig.scheduler);
 	await startProjectRuntimeWorker(runtime, { resolveStartInput: async (job) => {
-		const project = await selectProjectById(job.projectId);
-		if (!project) throw new Error(`Project ${job.projectId} not found`);
-		const resolved = resolveRuntimeArtifact(project, job.artifactId);
-		if (resolved.action === "error") throw new Error(resolved.message);
-		if (resolved.action === "skip") throw new Error(`Project ${job.projectId} has no deploy artifact to start`);
-		const artifact = await selectProjectArtifactById(resolved.artifactId);
-		if (!artifact || artifact.status !== "ready") throw new Error(`Project ${job.projectId} pending artifact is not ready`);
-		const organization = await selectOrganizationById(project.organizationId);
-		if (!organization) throw new Error(`Organization not found for project ${job.projectId}`);
+		const organization = await selectOrganizationById(job.organizationId);
+		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
+		const database = await resolveOrgRuntimeDatabase(job.organizationId);
 		const workerRuntime = platformConfig.hosting.workerRuntime;
 		return {
-			projectId: job.projectId,
-			name: job.name,
-			artifactId: resolved.artifactId,
-			artifactStorageKey: artifact.storageKey,
-			database: await resolveProjectRuntimeDatabase({
-				organizationId: project.organizationId,
-				projectId: project.id
-			}),
+			organizationId: job.organizationId,
+			projects: [],
+			database: {
+				...database,
+				organizationId: job.organizationId
+			},
 			env: {
 				...orgWorkspacesRuntimeEnv(organization, { containerEnv: process.env }),
 				...platformConfig.llmProxy?.workerEnv({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				}),
 				...platformConfig.sandboxProxy?.workerEnv({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				}),
 				...platformConfig.workerEnv?.({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				})
 			},
 			hosting: organization.hostingAppName ? { appName: organization.hostingAppName } : void 0,
-			previousRuntimeId: project.runtimeId
+			previousRuntimeId: organization.runtimeId
 		};
 	} });
 	const webUrl = process.env.PUBLIC_WEB_URL;
@@ -2724,4 +2833,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { startPlatformServer as t };
 
-//# sourceMappingURL=start-DAlaZ5zj.mjs.map
+//# sourceMappingURL=start-9_8ZcdaU.mjs.map