@keystrokehq/platform 0.1.3 → 0.1.5

package/dist/{start-BX-bkX9K.cjs → start-CBrH4KOb.cjs}

@@ -1,10 +1,10 @@
-const require_dist = require("./dist-D1Iv7_7S.cjs");
+const require_dist = require("./dist-C3ioU2dM.cjs");
 let _keystrokehq_database = require("@keystrokehq/database");
 let zod = require("zod");
 require("node:path");
 require("node:fs");
-require("node:url");
 let node_async_hooks = require("node:async_hooks");
+require("node:url");
 let _keystrokehq_platform_database = require("@keystrokehq/platform-database");
 let _hono_node_server = require("@hono/node-server");
 let _keystrokehq_auth = require("@keystrokehq/auth");
@@ -128,20 +128,11 @@ async function promoteProjectDeploy(input) {
 	const webhookRoutes = [...(0, _keystrokehq_runtime.extractWebhookRoutesFromManifest)(manifest), ...ephemeralRoutes];
 	if (webhookRoutes.length > 0) await (0, _keystrokehq_platform_database.ensureWebhookApiKeys)(project.id, webhookRoutes, project.id);
 }
-/** Decide whether a pg-boss job should start runtime, skip as stale, or fail. */
-function resolveRuntimeArtifact(project, jobArtifactId) {
-	if (jobArtifactId && project.pendingArtifactId && jobArtifactId !== project.pendingArtifactId) return { action: "skip" };
-	if (jobArtifactId && !project.pendingArtifactId && project.activeArtifactId && jobArtifactId !== project.activeArtifactId) return { action: "skip" };
-	const artifactId = jobArtifactId ?? project.pendingArtifactId ?? project.activeArtifactId ?? null;
-	if (!artifactId) return {
-		action: "error",
-		message: `Project ${project.id} has no pending artifact`
-	};
-	if (!project.pendingArtifactId && project.activeArtifactId === artifactId && project.status === "active" && project.baseUrl && project.runtimeId) return { action: "skip" };
-	return {
-		action: "run",
-		artifactId
-	};
+/** True when a project still needs an org worker rebuild after a runtime job finishes. */
+function projectNeedsRuntimeFollowUp(project) {
+	if (project.status === "starting" && project.pendingArtifactId) return true;
+	if (project.pendingArtifactId && project.activeArtifactId !== project.pendingArtifactId) return true;
+	return false;
 }
 let runtimeQueue;
 let runtimeQueueInit;
@@ -151,7 +142,7 @@ function configureProjectRuntimeScheduler(plugin) {
 	runtimeQueue = void 0;
 	runtimeQueueInit = void 0;
 }
-async function getProjectRuntimeQueue() {
+async function getOrgRuntimeQueue() {
 	if (runtimeQueue) return runtimeQueue;
 	if (!runtimeQueueInit) runtimeQueueInit = (async () => {
 		const queue = await require_dist.createJobQueue({
@@ -163,27 +154,60 @@ async function getProjectRuntimeQueue() {
 	})();
 	return runtimeQueueInit;
 }
-function toProjectRuntimeJob(payload) {
+function toOrgRuntimeJob(payload) {
 	const job = payload.payload;
-	if (!job?.projectId || !job.name || !job.artifactId) throw new Error("Invalid project runtime job payload");
+	if (!job?.organizationId) throw new Error("Invalid org runtime job payload");
 	return {
-		projectId: job.projectId,
-		name: job.name,
-		artifactId: job.artifactId
+		organizationId: job.organizationId,
+		triggerProjectId: job.triggerProjectId,
+		triggerArtifactId: job.triggerArtifactId
 	};
 }
-async function enqueueProjectRuntime(job) {
-	return (await getProjectRuntimeQueue()).enqueue({
+async function resolveOrgProjects(job) {
+	const projects = await (0, _keystrokehq_platform_database.selectProjectsByOrganizationId)(job.organizationId);
+	const deploys = [];
+	for (const project of projects) {
+		const artifactId = project.id === job.triggerProjectId && job.triggerArtifactId ? job.triggerArtifactId : project.pendingArtifactId ?? project.activeArtifactId;
+		if (!artifactId) continue;
+		const artifact = await (0, _keystrokehq_platform_database.selectProjectArtifactById)(artifactId);
+		if (!artifact || artifact.projectId !== project.id || artifact.status !== "ready") {
+			if (project.id === job.triggerProjectId) throw new Error(`Project ${project.id} pending artifact is not ready`);
+			continue;
+		}
+		deploys.push({
+			projectId: project.id,
+			name: project.name,
+			artifactId,
+			artifactStorageKey: artifact.storageKey
+		});
+	}
+	if (deploys.length === 0) throw new Error(`Organization ${job.organizationId} has no deployable projects`);
+	return deploys;
+}
+async function orgNeedsRuntimeFollowUp(organizationId) {
+	return (await (0, _keystrokehq_platform_database.selectProjectsByOrganizationId)(organizationId)).some(projectNeedsRuntimeFollowUp);
+}
+async function enqueueOrgRuntime(job) {
+	return (await getOrgRuntimeQueue()).enqueue({
 		kind: "runtime",
-		targetId: job.projectId,
-		runId: job.artifactId,
+		targetId: job.organizationId,
+		runId: crypto.randomUUID(),
 		trigger: "api",
 		payload: job,
 		maxAttempts: 5,
-		dedupeKey: job.projectId
+		dedupeKey: job.organizationId
+	});
+}
+async function enqueueProjectRuntime(job) {
+	const project = await (0, _keystrokehq_platform_database.selectProjectById)(job.projectId);
+	if (!project) throw new Error(`Project ${job.projectId} not found`);
+	return enqueueOrgRuntime({
+		organizationId: project.organizationId,
+		triggerProjectId: job.projectId,
+		triggerArtifactId: job.artifactId
 	});
 }
-async function destroyProjectRuntime(runtime, input, runtimeId) {
+async function destroyOrgRuntime(runtime, input, runtimeId) {
 	if (!runtime.destroy) return;
 	try {
 		await runtime.destroy({
@@ -191,49 +215,60 @@ async function destroyProjectRuntime(runtime, input, runtimeId) {
 			hosting: input.hosting
 		});
 	} catch (destroyError) {
-		console.error(`[project.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
+		console.error(`[org.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
 	}
 }
-async function handleProjectRuntimeJob(runtime, resolveStartInput, payload) {
+async function handleOrgRuntimeJob(runtime, resolveStartInput, payload) {
 	if (payload.kind !== "runtime") return;
-	const job = toProjectRuntimeJob(payload);
+	const job = toOrgRuntimeJob(payload);
 	try {
-		const project = await (0, _keystrokehq_platform_database.selectProjectById)(job.projectId);
-		if (!project) throw new Error(`Project ${job.projectId} not found`);
-		const resolved = resolveRuntimeArtifact(project, job.artifactId);
-		if (resolved.action === "skip") return;
-		if (resolved.action === "error") throw new Error(resolved.message);
-		const input = await resolveStartInput({
-			...job,
-			artifactId: resolved.artifactId
-		});
+		const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(job.organizationId);
+		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
+		const projects = await resolveOrgProjects(job);
+		const input = await resolveStartInput(job);
+		const mergedInput = {
+			...input,
+			organizationId: job.organizationId,
+			projects,
+			previousRuntimeId: input.previousRuntimeId ?? organization.runtimeId
+		};
 		let result;
 		try {
-			result = await runtime.start(input);
-			await promoteProjectDeploy({
-				projectId: job.projectId,
-				artifactId: resolved.artifactId,
-				baseUrl: result.baseUrl
+			result = await runtime.start(mergedInput);
+			for (const project of projects) {
+				await promoteProjectDeploy({
+					projectId: project.projectId,
+					artifactId: project.artifactId,
+					baseUrl: result.baseUrl
+				});
+				await (0, _keystrokehq_platform_database.updateProjectActive)(project.projectId, {
+					baseUrl: result.baseUrl,
+					runtimeId: result.runtimeId
+				});
+			}
+			await (0, _keystrokehq_platform_database.updateOrganizationActive)(job.organizationId, {
+				baseUrl: result.baseUrl,
+				runtimeId: result.runtimeId
 			});
-			await (0, _keystrokehq_platform_database.updateProjectActive)(job.projectId, result);
-			if (input.previousRuntimeId) await destroyProjectRuntime(runtime, input, input.previousRuntimeId);
+			if (mergedInput.previousRuntimeId) await destroyOrgRuntime(runtime, mergedInput, mergedInput.previousRuntimeId);
+			if (await orgNeedsRuntimeFollowUp(job.organizationId)) await enqueueOrgRuntime({ organizationId: job.organizationId });
 		} catch (error) {
-			if (result) await destroyProjectRuntime(runtime, input, result.runtimeId);
+			if (result) await destroyOrgRuntime(runtime, mergedInput, result.runtimeId);
 			throw error;
 		}
 	} catch (error) {
-		console.error(`[project.runtime] ${job.projectId} failed`, error);
-		if (payload.exhaustedRetries) await (0, _keystrokehq_platform_database.updateProjectFailed)(job.projectId, "Project runtime failed after retries");
+		console.error(`[org.runtime] ${job.organizationId} failed`, error);
+		if (payload.exhaustedRetries) await (0, _keystrokehq_platform_database.updateOrganizationFailed)(job.organizationId, "Org runtime failed after retries");
 		throw error;
 	}
 }
 async function startProjectRuntimeWorker(runtime, options = {}) {
-	const queue = await getProjectRuntimeQueue();
+	const queue = await getOrgRuntimeQueue();
 	const resolveStartInput = options.resolveStartInput ?? (async (job) => {
-		throw new Error(`Project runtime for ${job.projectId} requires resolveStartInput with database credentials`);
+		throw new Error(`Org runtime for ${job.organizationId} requires resolveStartInput with database credentials`);
 	});
 	await queue.startWorker(async (payload) => {
-		await handleProjectRuntimeJob(runtime, resolveStartInput, payload);
+		await handleOrgRuntimeJob(runtime, resolveStartInput, payload);
 	});
 }
 //#endregion
@@ -539,7 +574,7 @@ function requireOrganizationParam() {
 	};
 }
 //#endregion
-//#region ../../packages/http/dist/with-public-project-runtime-BG_6tack.mjs
+//#region ../../packages/http/dist/with-public-project-runtime-B7hmgjbi.mjs
 const requestBackgroundTasks = new node_async_hooks.AsyncLocalStorage();
 function runWithRequestBackgroundTasks(fn) {
 	return requestBackgroundTasks.run([], fn);
@@ -577,7 +612,7 @@ function withOrganizationProjectDatabase() {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/GET.ts
-const handler$60 = async (c) => {
+const handler$63 = async (c) => {
 	const dbUser = await (0, _keystrokehq_platform_database.selectUserById)(c.get("user").id);
 	if (!dbUser) return c.json(require_dist.ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(require_dist.UserAvatarSchema.parse({ url: dbUser.image ?? null }));
@@ -596,7 +631,7 @@ function avatarExtensionForContentType(contentType) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/presign/POST.ts
-const handler$59 = async (c) => {
+const handler$62 = async (c) => {
 	const parsed = require_dist.PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -636,7 +671,7 @@ async function deleteStoredImageIfOwned(input) {
 }
 //#endregion
 //#region src/routes/account/users/me/avatar/PATCH.ts
-const handler$58 = async (c) => {
+const handler$61 = async (c) => {
 	const parsed = require_dist.UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
 	const user = c.get("user");
@@ -678,14 +713,14 @@ const handler$58 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/GET.ts
-const handler$57 = async (c) => {
+const handler$60 = async (c) => {
 	const dbUser = await (0, _keystrokehq_platform_database.selectUserById)(c.get("user").id);
 	if (!dbUser) return c.json(require_dist.ErrorResponseSchema.parse({ error: "User not found" }), 404);
 	return c.json(require_dist.UserPreferencesSchema.parse(require_dist.normalizeUserPreferences(dbUser.preferences)));
 };
 //#endregion
 //#region src/routes/account/users/me/preferences/PATCH.ts
-const handler$56 = async (c) => {
+const handler$59 = async (c) => {
 	const parsed = require_dist.UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
 	const user = c.get("user");
@@ -700,9 +735,9 @@ const handler$56 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/GET.ts
-const handler$55 = async (c) => {
+const handler$58 = async (c) => {
 	const memberships = await (0, _keystrokehq_platform_database.selectUserOrganizations)(c.get("user").id);
-	return c.json(require_dist.ListOrganizationsResponseSchema.parse({ organizations: memberships.map(require_dist.mapUserOrganization) }));
+	return c.json(require_dist.ListOrganizationsResponseSchema.parse(memberships.map(require_dist.mapUserOrganization)));
 };
 //#endregion
 //#region src/services/create-organization.ts
@@ -768,7 +803,7 @@ function createOrganizationHandler(deps) {
 		if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid organization request" }), 400);
 		try {
 			const membership = await createOrganizationWithHosting(deps, user.id, parsed.data.name, parsed.data.slug);
-			return c.json(require_dist.CreateOrganizationResponseSchema.parse({ organization: require_dist.mapUserOrganization(membership) }), 201);
+			return c.json(require_dist.CreateOrganizationResponseSchema.parse(require_dist.mapUserOrganization(membership)), 201);
 		} catch (error) {
 			if (error instanceof _keystrokehq_platform_database.OrganizationSlugTakenError) return c.json(require_dist.ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
 			if (error instanceof zod.ZodError) return c.json(require_dist.ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
@@ -778,7 +813,7 @@ function createOrganizationHandler(deps) {
 }
 //#endregion
 //#region src/routes/account/organizations/slug-available/GET.ts
-const handler$54 = async (c) => {
+const handler$57 = async (c) => {
 	const parsed = require_dist.SlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
 		excludeOrganizationId: c.req.query("excludeOrganizationId")
@@ -789,15 +824,15 @@ const handler$54 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/GET.ts
-const handler$53 = async (c) => {
+const handler$56 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const membership = await (0, _keystrokehq_platform_database.selectUserOrganizationMembership)(c.get("user").id, organizationId);
 	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
-	return c.json(require_dist.ActiveOrganizationResponseSchema.parse({ organization: require_dist.mapUserOrganization(membership) }));
+	return c.json(require_dist.ActiveOrganizationResponseSchema.parse(require_dist.mapUserOrganization(membership)));
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/PATCH.ts
-const handler$52 = async (c) => {
+const handler$55 = async (c) => {
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
 	const parsed = require_dist.UpdateOrganizationRequestSchema.safeParse(body);
@@ -810,10 +845,10 @@ const handler$52 = async (c) => {
 		if (parsed.data.name !== void 0) updated = await (0, _keystrokehq_platform_database.updateOrganizationName)(organization.organizationId, parsed.data.name);
 		if (parsed.data.slug !== void 0) updated = await (0, _keystrokehq_platform_database.updateOrganizationSlug)(organization.organizationId, parsed.data.slug);
 		if (!updated) throw new Error(`Organization update produced no result: ${organization.organizationId}`);
-		return c.json(require_dist.ActiveOrganizationResponseSchema.parse({ organization: require_dist.mapUserOrganization({
+		return c.json(require_dist.ActiveOrganizationResponseSchema.parse(require_dist.mapUserOrganization({
 			organization: updated,
 			role: organization.role
-		}) }));
+		})));
 	} catch (error) {
 		if (error instanceof _keystrokehq_platform_database.OrganizationSlugTakenError) return c.json(require_dist.ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
 		if (error instanceof zod.ZodError) return c.json(require_dist.ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
@@ -822,7 +857,7 @@ const handler$52 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/GET.ts
-const handler$51 = async (c) => {
+const handler$54 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(organizationId);
 	if (!organization) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
@@ -871,7 +906,7 @@ async function finalizeOrgLogoVariant(input) {
 		publicUrl: finalized.publicUrl
 	};
 }
-const handler$50 = async (c) => {
+const handler$53 = async (c) => {
 	const parsed = require_dist.OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
 	const { organizationId } = c.get("organization");
@@ -899,7 +934,7 @@ const handler$50 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
-const handler$49 = async (c) => {
+const handler$52 = async (c) => {
 	const parsed = require_dist.PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
 	const extension = avatarExtensionForContentType(parsed.data.contentType);
@@ -990,7 +1025,7 @@ async function attachRanAsToDetail(detail, ranByUserId) {
 }
 //#endregion
 //#region src/routes/account/history/GET.ts
-const handler$48 = async (c) => {
+const handler$51 = async (c) => {
 	const organization = c.get("organization");
 	const ctx = accessContext(c);
 	const query = require_dist.HistoryRunListQuerySchema.parse({
@@ -1013,7 +1048,7 @@ const handler$48 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/history/[runId]/GET.ts
-const handler$47 = async (c) => {
+const handler$50 = async (c) => {
 	const runId = c.req.param("runId") ?? "";
 	if (!runId) return c.json(null, 404);
 	const core = await (0, _keystrokehq_database.findHistoryRunCore)(runId);
@@ -1064,7 +1099,7 @@ function toAgentSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/agents/GET.ts
-const handler$46 = async (c) => {
+const handler$49 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(require_dist.AgentSummaryListResponseSchema.parse([]));
 	const rows = await (0, _keystrokehq_database.listActiveAgents)(filter);
@@ -1078,7 +1113,7 @@ function touchResourceActivityBestEffort(options) {
 }
 //#endregion
 //#region src/routes/account/agents/[agentId]/GET.ts
-const handler$45 = async (c) => {
+const handler$48 = async (c) => {
 	const agentId = c.req.param("agentId") ?? "";
 	const row = agentId ? await (0, _keystrokehq_database.selectActiveAgentById)(agentId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(require_dist.AgentSummaryDetailResponseSchema.parse(null));
@@ -1113,7 +1148,7 @@ async function cancelHistoryRun(c, kind, cancel) {
 }
 //#endregion
 //#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
-const handler$44 = (c) => cancelHistoryRun(c, "agent", _keystrokehq_database.cancelAgentSession);
+const handler$47 = (c) => cancelHistoryRun(c, "agent", _keystrokehq_database.cancelAgentSession);
 //#endregion
 //#region src/routes/account/resources/workflows.ts
 function toWorkflowSummary(row, options) {
@@ -1130,7 +1165,7 @@ function toWorkflowSummary(row, options) {
 }
 //#endregion
 //#region src/routes/account/workflows/GET.ts
-const handler$43 = async (c) => {
+const handler$46 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(require_dist.WorkflowSummaryListResponseSchema.parse([]));
 	const rows = await (0, _keystrokehq_database.listActiveWorkflows)(filter);
@@ -1139,7 +1174,7 @@ const handler$43 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/[workflowId]/GET.ts
-const handler$42 = async (c) => {
+const handler$45 = async (c) => {
 	const workflowId = c.req.param("workflowId") ?? "";
 	const row = workflowId ? await (0, _keystrokehq_database.selectActiveWorkflowById)(workflowId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(require_dist.WorkflowSummaryDetailResponseSchema.parse(null));
@@ -1154,7 +1189,7 @@ const handler$42 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
-const handler$41 = (c) => cancelHistoryRun(c, "workflow", _keystrokehq_database.cancelWorkflowRun);
+const handler$44 = (c) => cancelHistoryRun(c, "workflow", _keystrokehq_database.cancelWorkflowRun);
 //#endregion
 //#region src/routes/account/resources/skills.ts
 function toSkillSummary(row) {
@@ -1170,7 +1205,7 @@ function toSkillSummary(row) {
 }
 //#endregion
 //#region src/routes/account/skills/GET.ts
-const handler$40 = async (c) => {
+const handler$43 = async (c) => {
 	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
 	if (filter === "empty") return c.json(require_dist.SkillSummaryListResponseSchema.parse([]));
 	const rows = await (0, _keystrokehq_database.listActiveSkills)(filter);
@@ -1178,7 +1213,7 @@ const handler$40 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/skills/[skillId]/GET.ts
-const handler$39 = async (c) => {
+const handler$42 = async (c) => {
 	const skillId = c.req.param("skillId") ?? "";
 	const row = skillId ? await (0, _keystrokehq_database.selectActiveSkillById)(skillId) : void 0;
 	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(require_dist.SkillSummaryDetailResponseSchema.parse(null));
@@ -1225,7 +1260,7 @@ function latestRecentInteractionAt(recent) {
 //#endregion
 //#region src/routes/account/recents/GET.ts
 const RECENTS_LIMIT = 50;
-const handler$38 = async (c) => {
+const handler$41 = async (c) => {
 	const userId = c.get("user").id;
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
@@ -1251,11 +1286,11 @@ const handler$38 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/GET.ts
-const handler$37 = async (c) => {
+const handler$40 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const projects = await (0, _keystrokehq_platform_database.selectProjectsByOrganizationId)(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
-	return c.json(require_dist.ListProjectsResponseSchema.parse({ projects: projects.map(require_dist.mapProject) }));
+	return c.json(require_dist.ListProjectsResponseSchema.parse(projects.map(require_dist.mapProject)));
 };
 //#endregion
 //#region src/routes/account/projects/metrics/merge-project-list-metrics.ts
@@ -1277,7 +1312,7 @@ function mergeProjectListMetrics(input) {
 }
 //#endregion
 //#region src/routes/account/projects/metrics/GET.ts
-const handler$36 = async (c) => {
+const handler$39 = async (c) => {
 	const organization = c.get("organization");
 	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
 	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([(0, _keystrokehq_database.selectProjectResourceCounts)(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), (0, _keystrokehq_platform_database.selectLastDeploymentAtByProject)(organization.organizationId)]);
@@ -1289,22 +1324,22 @@ const handler$36 = async (c) => {
 		const allowed = new Set(grantedProjectIdsList);
 		metrics = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => allowed.has(projectId)));
 	}
-	return c.json(require_dist.ListProjectMetricsResponseSchema.parse({ metrics }));
+	return c.json(require_dist.ListProjectMetricsResponseSchema.parse(metrics));
 };
 //#endregion
 //#region src/routes/account/projects/POST.ts
-const handler$35 = async (c) => {
+const handler$38 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const body = await c.req.json().catch(() => null);
 	const parsed = require_dist.CreateProjectRequestSchema.safeParse(body);
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Project name is required" }), 400);
 	const project = await (0, _keystrokehq_platform_database.createProjectForOrganization)(organization.organizationId, parsed.data.name, parsed.data.description, user.id);
-	return c.json(require_dist.CreateProjectResponseSchema.parse({ project: require_dist.mapProject(project) }), 201);
+	return c.json(require_dist.CreateProjectResponseSchema.parse(require_dist.mapProject(project)), 201);
 };
 //#endregion
 //#region src/routes/account/projects/slug-available/GET.ts
-const handler$34 = async (c) => {
+const handler$37 = async (c) => {
 	const organization = c.get("organization");
 	const parsed = require_dist.ProjectSlugAvailabilityQuerySchema.safeParse({
 		slug: c.req.query("slug"),
@@ -1316,12 +1351,12 @@ const handler$34 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/GET.ts
-const handler$33 = async (c) => {
-	return c.json(require_dist.ProjectResponseSchema.parse({ project: routeProject(c.get("project")) }));
+const handler$36 = async (c) => {
+	return c.json(require_dist.ProjectResponseSchema.parse(routeProject(c.get("project"))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/PATCH.ts
-const handler$32 = async (c) => {
+const handler$35 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1335,11 +1370,11 @@ const handler$32 = async (c) => {
 		throw error;
 	}
 	if (!updated) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(require_dist.ProjectResponseSchema.parse({ project: require_dist.mapProject(updated) }));
+	return c.json(require_dist.ProjectResponseSchema.parse(require_dist.mapProject(updated)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/DELETE.ts
-const handler$31 = async (c) => {
+const handler$34 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	if (!await (0, _keystrokehq_platform_database.deleteProjectForOrganization)(organization.organizationId, project.id)) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Project not found" }), 404);
@@ -1347,15 +1382,15 @@ const handler$31 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/deployments/GET.ts
-const handler$30 = async (c) => {
+const handler$33 = async (c) => {
 	const rows = await (0, _keystrokehq_platform_database.selectProjectDeployments)(c.get("project").id);
-	return c.json(require_dist.ListProjectDeploymentsResponseSchema.parse({ deployments: rows.map(require_dist.mapProjectDeployment) }));
+	return c.json(require_dist.ListProjectDeploymentsResponseSchema.parse(rows.map(require_dist.mapProjectDeployment)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/POST.ts
 const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
 const ARTIFACT_CONTENT_TYPE = "application/gzip";
-const handler$29 = async (c) => {
+const handler$32 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(organizationId);
@@ -1383,7 +1418,7 @@ const handler$29 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
 const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-const handler$28 = async (c) => {
+const handler$31 = async (c) => {
 	const project = c.get("project");
 	const { organizationId } = c.get("organization");
 	const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(organizationId);
@@ -1402,7 +1437,7 @@ const handler$28 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/complete/POST.ts
-const handler$27 = async (c) => {
+const handler$30 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1441,7 +1476,7 @@ const handler$27 = async (c) => {
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
 const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
-const handler$26 = async (c) => {
+const handler$29 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1469,7 +1504,7 @@ const handler$26 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
-const handler$25 = async (c) => {
+const handler$28 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1514,7 +1549,7 @@ function resolveSourcePaths(rows, kindDir, filePaths) {
 		}] : [];
 	});
 }
-const handler$24 = async (c) => {
+const handler$27 = async (c) => {
 	const project = c.get("project");
 	const active = await (0, _keystrokehq_platform_database.selectActiveArtifactSourceManifestForProject)(project.id);
 	if (!active || !active.sourceManifestJson) return c.json(require_dist.ListProjectFilesResponseSchema.parse({
@@ -1548,7 +1583,7 @@ const handler$24 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
-const handler$23 = async (c) => {
+const handler$26 = async (c) => {
 	const project = c.get("project");
 	const artifactId = c.req.param("artifactId");
 	if (!artifactId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
@@ -1577,24 +1612,25 @@ function createProjectReachabilityHandler(hosting) {
 	return async (c) => {
 		const project = c.get("project");
 		if (project.status !== "active") return c.json(require_dist.ProjectReachabilityResponseSchema.parse({ reachable: false }));
+		const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(project.organizationId);
 		const reachable = await require_dist.pingProjectTarget({
-			baseUrl: project.baseUrl,
-			runtimeId: project.runtimeId
+			baseUrl: organization?.baseUrl ?? project.baseUrl,
+			runtimeId: organization?.runtimeId ?? project.runtimeId
 		}, { plugin: hosting });
 		return c.json(require_dist.ProjectReachabilityResponseSchema.parse({ reachable }));
 	};
 }
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/GET.ts
-const handler$22 = async (c) => {
+const handler$25 = async (c) => {
 	const project = c.get("project");
 	const currentUserId = c.get("user").id;
 	const members = await (0, _keystrokehq_platform_database.selectProjectMembers)(project.id);
-	return c.json(require_dist.ListProjectMembersResponseSchema.parse({ members: members.map((member) => require_dist.mapProjectMember(member, { isCurrentUser: member.id === currentUserId })) }));
+	return c.json(require_dist.ListProjectMembersResponseSchema.parse(members.map((member) => require_dist.mapProjectMember(member, { isCurrentUser: member.id === currentUserId }))));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/POST.ts
-const handler$21 = async (c) => {
+const handler$24 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1606,11 +1642,11 @@ const handler$21 = async (c) => {
 		emails: parsed.data.emails,
 		role: parsed.data.role
 	});
-	return c.json(require_dist.InviteProjectMembersResponseSchema.parse({ results }));
+	return c.json(require_dist.InviteProjectMembersResponseSchema.parse(results));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
-const handler$20 = async (c) => {
+const handler$23 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -1619,7 +1655,7 @@ const handler$20 = async (c) => {
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
 	try {
 		const member = await (0, _keystrokehq_platform_database.updateProjectMemberRole)(project.id, userId, parsed.data.role);
-		return c.json(require_dist.UpdateProjectMemberResponseSchema.parse({ member: require_dist.mapProjectMember(member) }));
+		return c.json(require_dist.UpdateProjectMemberResponseSchema.parse(require_dist.mapProjectMember(member)));
 	} catch (error) {
 		if (error instanceof _keystrokehq_platform_database.ProjectMemberNotFoundError) return c.json(require_dist.ErrorResponseSchema.parse({ error: error.message }), 400);
 		throw error;
@@ -1627,7 +1663,7 @@ const handler$20 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
-const handler$19 = async (c) => {
+const handler$22 = async (c) => {
 	const project = c.get("project");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -1641,7 +1677,7 @@ const handler$19 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
-const handler$18 = async (c) => {
+const handler$21 = async (c) => {
 	const project = c.get("project");
 	const userId = c.get("user").id;
 	try {
@@ -1654,13 +1690,13 @@ const handler$18 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/GET.ts
-const handler$17 = async (c) => {
+const handler$20 = async (c) => {
 	const project = c.get("project");
-	return c.json(require_dist.ProjectSettingsResponseSchema.parse({ settings: require_dist.mapProjectSettings(project) }));
+	return c.json(require_dist.ProjectSettingsResponseSchema.parse(require_dist.mapProjectSettings(project)));
 };
 //#endregion
 //#region src/routes/account/projects/[projectId]/settings/PATCH.ts
-const handler$16 = async (c) => {
+const handler$19 = async (c) => {
 	const organization = c.get("organization");
 	const project = c.get("project");
 	const body = await c.req.json().catch(() => null);
@@ -1672,7 +1708,7 @@ const handler$16 = async (c) => {
 		invitePermission: parsed.data.invitePermission
 	});
 	if (!updated) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(require_dist.ProjectSettingsResponseSchema.parse({ settings: require_dist.mapProjectSettings(updated) }));
+	return c.json(require_dist.ProjectSettingsResponseSchema.parse(require_dist.mapProjectSettings(updated)));
 };
 //#endregion
 //#region src/routes/account/credentials/enrich.ts
@@ -1694,8 +1730,12 @@ function canManageCredential(row, userId) {
 	if (row.scopeType === "user") return userId !== void 0 && row.scopeId === userId;
 	return true;
 }
-/** Display name derived from the credential key (e.g. `google-drive` → `Google Drive`). */
+/** Display name derived from the app slug (org-custom slugs use the segment after `/`). */
 function displayAppName(appId) {
+	try {
+		const parsed = require_dist.parseAppSlug(appId);
+		if (parsed.kind === "org") return require_dist.displayCredentialAppName(parsed.name);
+	} catch {}
 	return require_dist.displayCredentialAppName(appId);
 }
 /** Masked preview of a secret — last 4 chars revealed, the rest masked. Plaintext never returned. */
@@ -1782,10 +1822,10 @@ async function enrichCredentialInstances(rows, organizationId) {
 }
 //#endregion
 //#region src/routes/account/credentials/GET.ts
-const handler$15 = async (c) => {
+const handler$18 = async (c) => {
 	const organization = c.get("organization");
 	const credentials = await enrichCredentialInstances(await (0, _keystrokehq_database.listAllCredentialInstances)(), organization.organizationId);
-	return c.json(require_dist.ListCredentialsResponseSchema.parse({ credentials }));
+	return c.json(require_dist.ListCredentialsResponseSchema.parse(credentials));
 };
 //#endregion
 //#region src/routes/account/credentials/POST.ts
@@ -1793,7 +1833,7 @@ function withTargetScope(target, fn) {
 	if (target.projectScope) return (0, _keystrokehq_database.runWithProjectScope)(target.projectScope, fn);
 	return fn();
 }
-const handler$14 = async (c) => {
+const handler$17 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const parsed = require_dist.CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
@@ -1802,6 +1842,13 @@ const handler$14 = async (c) => {
 		return c.json({ error: message }, 400);
 	}
 	const input = parsed.data;
+	if (input.connectionKind === "manual" && input.value) {
+		const app = await (0, _keystrokehq_platform_database.selectAppForOrganization)(organization.organizationId, input.appId);
+		if (app && (0, _keystrokehq_platform_database.hasCredentialFieldTemplate)(app)) {
+			const validation = require_dist.validateCredentialValueAgainstFields(app.credentialFields, input.value);
+			if (!validation.ok) return c.json({ error: validation.message }, 400);
+		}
+	}
 	const resolvedProjects = [];
 	for (const slug of input.projects) {
 		const project = await (0, _keystrokehq_platform_database.selectProjectForOrganizationBySlug)(organization.organizationId, slug);
@@ -1838,7 +1885,7 @@ const handler$14 = async (c) => {
 	for (const target of targets) {
 		const siblings = await withTargetScope(target, () => (0, _keystrokehq_database.selectCredentialInstancesForScope)(input.appId, target.scopeType, target.scopeId));
 		const label = require_dist.resolveUniqueCredentialInstanceLabel({
-			baseLabel: require_dist.buildCredentialInstanceLabel({
+			baseLabel: input.label?.trim() || require_dist.buildCredentialInstanceLabel({
 				scopeType: target.scopeType,
 				appName,
 				projectName: target.projectName
@@ -1863,21 +1910,21 @@ const handler$14 = async (c) => {
 		if (row) rows.push(row);
 	}
 	const credentials = await enrichCredentialInstances(rows, organization.organizationId);
-	return c.json(require_dist.CreateCredentialsResponseSchema.parse({ credentials }), 201);
+	return c.json(require_dist.CreateCredentialsResponseSchema.parse(credentials), 201);
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/GET.ts
-const handler$13 = async (c) => {
+const handler$16 = async (c) => {
 	const organization = c.get("organization");
 	const credentialId = c.req.param("credentialId") ?? "";
 	const row = credentialId ? await (0, _keystrokehq_database.selectCredentialInstanceById)(credentialId) : void 0;
 	if (!row || toAppCredentialScope(row.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
 	const [credential] = await enrichCredentialInstances([row], organization.organizationId);
-	return c.json(require_dist.GetCredentialResponseSchema.parse({ credential }));
+	return c.json(require_dist.GetCredentialResponseSchema.parse(credential));
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/PATCH.ts
-const handler$12 = async (c) => {
+const handler$15 = async (c) => {
 	const organization = c.get("organization");
 	const user = c.get("user");
 	const credentialId = c.req.param("credentialId") ?? "";
@@ -1930,7 +1977,7 @@ const handler$12 = async (c) => {
 	});
 	const updated = await (0, _keystrokehq_database.selectCredentialInstanceById)(credentialId);
 	const [credential] = await enrichCredentialInstances(updated ? [updated] : [], organization.organizationId);
-	return c.json(require_dist.GetCredentialResponseSchema.parse({ credential }));
+	return c.json(require_dist.GetCredentialResponseSchema.parse(credential));
 };
 //#endregion
 //#region src/routes/account/credentials/[credentialId]/DELETE.ts
@@ -1959,10 +2006,10 @@ function createDeleteCredentialHandler(options = {}) {
 }
 //#endregion
 //#region src/routes/account/members/GET.ts
-const handler$11 = async (c) => {
+const handler$14 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const members = await (0, _keystrokehq_platform_database.selectOrganizationMembers)(organizationId);
-	return c.json(require_dist.ListOrganizationMembersResponseSchema.parse({ members: members.map(require_dist.mapOrganizationMember) }));
+	return c.json(require_dist.ListOrganizationMembersResponseSchema.parse(members.map(require_dist.mapOrganizationMember)));
 };
 //#endregion
 //#region src/email/organization-invite-email.ts
@@ -2007,7 +2054,7 @@ async function sendOrganizationInviteEmail(payload, resend$1) {
 }
 //#endregion
 //#region src/routes/account/members/invitations/POST.ts
-const handler$10 = async (c) => {
+const handler$13 = async (c) => {
 	const user = c.get("user");
 	const organization = c.get("organization");
 	const body = await c.req.json().catch(() => null);
@@ -2029,11 +2076,11 @@ const handler$10 = async (c) => {
 			inviterName: inviter?.name
 		});
 	}
-	return c.json(require_dist.InviteOrganizationMembersResponseSchema.parse({ results }));
+	return c.json(require_dist.InviteOrganizationMembersResponseSchema.parse(results));
 };
 //#endregion
 //#region src/routes/account/members/[userId]/PATCH.ts
-const handler$9 = async (c) => {
+const handler$12 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	const body = await c.req.json().catch(() => null);
@@ -2042,7 +2089,7 @@ const handler$9 = async (c) => {
 	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
 	try {
 		const member = await (0, _keystrokehq_platform_database.updateOrganizationMemberRole)(organizationId, userId, parsed.data.role);
-		return c.json(require_dist.UpdateOrganizationMemberResponseSchema.parse({ member: require_dist.mapOrganizationMember(member) }));
+		return c.json(require_dist.UpdateOrganizationMemberResponseSchema.parse(require_dist.mapOrganizationMember(member)));
 	} catch (error) {
 		if (error instanceof _keystrokehq_platform_database.CannotModifyOwnerError || error instanceof _keystrokehq_platform_database.OrganizationMemberNotFoundError) return c.json(require_dist.ErrorResponseSchema.parse({ error: error.message }), 400);
 		throw error;
@@ -2050,7 +2097,7 @@ const handler$9 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/members/[userId]/DELETE.ts
-const handler$8 = async (c) => {
+const handler$11 = async (c) => {
 	const { organizationId } = c.get("organization");
 	const userId = c.req.param("userId");
 	if (!userId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "User id is required" }), 400);
@@ -2064,19 +2111,19 @@ const handler$8 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/GET.ts
-const handler$7 = async (c) => {
+const handler$10 = async (c) => {
 	const invitations = await (0, _keystrokehq_platform_database.selectPendingInvitationsForUser)(c.get("user").id);
-	return c.json(require_dist.ListOrganizationInvitationsResponseSchema.parse({ invitations: invitations.map(require_dist.mapOrganizationInvitation) }));
+	return c.json(require_dist.ListOrganizationInvitationsResponseSchema.parse(invitations.map(require_dist.mapOrganizationInvitation)));
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/accept/POST.ts
-const handler$6 = async (c) => {
+const handler$9 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
 	try {
 		const membership = await (0, _keystrokehq_platform_database.acceptInvitation)(invitationId, user.id);
-		return c.json(require_dist.AcceptOrganizationInvitationResponseSchema.parse({ organization: require_dist.mapUserOrganization(membership) }));
+		return c.json(require_dist.AcceptOrganizationInvitationResponseSchema.parse(require_dist.mapUserOrganization(membership)));
 	} catch (error) {
 		if (error instanceof _keystrokehq_platform_database.OrganizationInvitationNotFoundError) return c.json(require_dist.ErrorResponseSchema.parse({ error: error.message }), 404);
 		if (error instanceof _keystrokehq_platform_database.OrganizationInvitationForbiddenError) return c.json(require_dist.ErrorResponseSchema.parse({ error: error.message }), 403);
@@ -2086,7 +2133,7 @@ const handler$6 = async (c) => {
 };
 //#endregion
 //#region src/routes/account/invitations/[invitationId]/decline/POST.ts
-const handler$5 = async (c) => {
+const handler$8 = async (c) => {
 	const user = c.get("user");
 	const invitationId = c.req.param("invitationId");
 	if (!invitationId) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
@@ -2111,14 +2158,83 @@ function appRowToCatalogEntry(row) {
 		integrationDescription: row.description,
 		...row.logo ? { logo: row.logo } : {},
 		authKind: row.authKind,
-		oauthScopes: row.oauthScopes
+		oauthScopes: row.oauthScopes,
+		source: row.source,
+		...(0, _keystrokehq_platform_database.hasCredentialFieldTemplate)(row) ? { credentialFields: row.credentialFields } : {}
+	};
+}
+function appRowToCustomAppDetail(row) {
+	if (row.source !== "custom" || row.authKind !== "api_key") throw new Error(`App is not a custom api_key app: ${row.slug}`);
+	if (!(0, _keystrokehq_platform_database.hasCredentialFieldTemplate)(row)) throw new Error(`Custom app is missing credential fields: ${row.slug}`);
+	return {
+		id: row.slug,
+		slug: row.slug,
+		name: row.name,
+		description: row.description,
+		category: row.category,
+		authKind: "api_key",
+		source: "custom",
+		credentialFields: row.credentialFields,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString()
 	};
 }
 //#endregion
 //#region src/routes/account/apps/GET.ts
+const handler$7 = async (c) => {
+	const apps = (await (0, _keystrokehq_platform_database.listAppsForOrganization)(c.get("organization").organizationId)).map(appRowToCatalogEntry);
+	return c.json(require_dist.ListAppsResponseSchema.parse(apps));
+};
+//#endregion
+//#region src/routes/account/apps/POST.ts
+const handler$6 = async (c) => {
+	const organization = c.get("organization");
+	const parsed = require_dist.CreateCustomAppRequestSchema.safeParse(await c.req.json().catch(() => null));
+	if (!parsed.success) {
+		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
+		return c.json(require_dist.ErrorResponseSchema.parse({ error: message }), 400);
+	}
+	const org = await (0, _keystrokehq_platform_database.selectOrganizationById)(organization.organizationId);
+	if (!org) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	try {
+		const row = await (0, _keystrokehq_platform_database.createOrgApp)({
+			organizationId: organization.organizationId,
+			orgSlug: org.slug,
+			name: parsed.data.name,
+			slug: parsed.data.slug,
+			description: parsed.data.description,
+			credentialFields: parsed.data.fields
+		});
+		return c.json(require_dist.CreateCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)), 201);
+	} catch (error) {
+		if (error instanceof _keystrokehq_platform_database.OrgAppSlugTakenError) return c.json(require_dist.ErrorResponseSchema.parse({ error: error.message }), 409);
+		throw error;
+	}
+};
+//#endregion
+//#region src/routes/account/apps/slug-available/GET.ts
+const handler$5 = async (c) => {
+	const organization = c.get("organization");
+	const parsed = require_dist.AppSlugAvailabilityQuerySchema.safeParse({ slug: c.req.query("slug") });
+	if (!parsed.success) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
+	const org = await (0, _keystrokehq_platform_database.selectOrganizationById)(organization.organizationId);
+	if (!org) return c.json(require_dist.ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
+	const availability = await (0, _keystrokehq_platform_database.checkOrgAppSlugAvailability)(org.slug, parsed.data.slug);
+	return c.json(require_dist.AppSlugAvailabilityResponseSchema.parse(availability));
+};
+//#endregion
+//#region src/routes/account/apps/[slug]/GET.ts
 const handler$4 = async (c) => {
-	const apps = (await (0, _keystrokehq_platform_database.listOfficialApps)()).map(appRowToCatalogEntry);
-	return c.json(require_dist.ListAppsResponseSchema.parse({ apps }));
+	const organization = c.get("organization");
+	const slug = c.req.param("slug") ?? "";
+	if (!slug) return c.json(require_dist.ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	const row = await (0, _keystrokehq_platform_database.selectAppForOrganization)(organization.organizationId, decodeURIComponent(slug));
+	if (!row || row.source !== "custom") return c.json(require_dist.ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	try {
+		return c.json(require_dist.GetCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)));
+	} catch {
+		return c.json(require_dist.ErrorResponseSchema.parse({ error: "App not found" }), 404);
+	}
 };
 //#endregion
 //#region src/routes/account/api-keys/GET.ts
@@ -2128,14 +2244,14 @@ const handler$3 = async (c) => {
 	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await (0, _keystrokehq_platform_database.listOrgPlatformApiKeysForOrganization)(organizationId) : await (0, _keystrokehq_platform_database.listOrgPlatformApiKeysForUser)(organizationId, user.id);
 	const creators = await (0, _keystrokehq_platform_database.selectUsersByIds)([...new Set(records.map((record) => record.createdByUserId))]);
 	const creatorsById = new Map(creators.map((creator) => [creator.id, creator]));
-	return c.json(require_dist.ListApiKeysResponseSchema.parse({ apiKeys: records.map((record) => ({
+	return c.json(require_dist.ListApiKeysResponseSchema.parse(records.map((record) => ({
 		id: record.id,
 		name: record.name,
 		keyPreview: record.keyPreview,
 		createdAt: record.createdAt.toISOString(),
 		createdBy: (0, _keystrokehq_platform_database.mapOrgPlatformApiKeyCreatorOrDeleted)(record.createdByUserId, creatorsById.get(record.createdByUserId)),
 		isCreatedByCurrentUser: record.createdByUserId === user.id
-	})) }));
+	}))));
 };
 //#endregion
 //#region src/routes/account/api-keys/POST.ts
@@ -2312,71 +2428,74 @@ function mountAccountRoutes(options) {
 	const requireProjectManageMembers = authorize(projectActions.manageMembers);
 	const requireInvitableProjectRole = authorizePayload(require_dist.InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
 	const requireOrgParam = requireOrganizationParam();
-	account.get("/organizations", handler$55);
-	account.get("/organizations/slug-available", handler$54);
+	account.get("/organizations", handler$58);
+	account.get("/organizations/slug-available", handler$57);
 	account.post("/organizations", createOrganizationHandler(options));
-	account.get("/organizations/:organizationId", requireOrgParam, handler$53);
-	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$52);
-	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$51);
-	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$50);
-	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$49);
-	account.get("/invitations", handler$7);
-	account.post("/invitations/:invitationId/accept", handler$6);
-	account.post("/invitations/:invitationId/decline", handler$5);
-	account.get("/users/me/avatar", handler$60);
-	account.post("/users/me/avatar/presign", handler$59);
-	account.patch("/users/me/avatar", handler$58);
-	account.get("/users/me/preferences", handler$57);
-	account.patch("/users/me/preferences", handler$56);
-	account.get("/apps", handler$4);
-	orgScoped.get("/members", handler$11);
-	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$10);
-	orgScoped.patch("/members/:userId", requireUserManage, handler$9);
-	orgScoped.delete("/members/:userId", requireUserManage, handler$8);
+	account.get("/organizations/:organizationId", requireOrgParam, handler$56);
+	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$55);
+	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$54);
+	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$53);
+	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$52);
+	account.get("/invitations", handler$10);
+	account.post("/invitations/:invitationId/accept", handler$9);
+	account.post("/invitations/:invitationId/decline", handler$8);
+	account.get("/users/me/avatar", handler$63);
+	account.post("/users/me/avatar/presign", handler$62);
+	account.patch("/users/me/avatar", handler$61);
+	account.get("/users/me/preferences", handler$60);
+	account.patch("/users/me/preferences", handler$59);
+	orgScoped.get("/apps", handler$7);
+	orgScoped.get("/apps/slug-available", handler$5);
+	orgScoped.post("/apps", requireOrgUpdate, handler$6);
+	orgScoped.get("/apps/:slug", handler$4);
+	orgScoped.get("/members", handler$14);
+	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$13);
+	orgScoped.patch("/members/:userId", requireUserManage, handler$12);
+	orgScoped.delete("/members/:userId", requireUserManage, handler$11);
 	orgScoped.get("/api-keys", handler$3);
 	orgScoped.post("/api-keys", requireApiKeyCreate, handler$2);
 	orgScoped.delete("/api-keys/:apiKeyId", handler$1);
 	const withOrgDb = withOrganizationProjectDatabase();
-	orgScoped.get("/agents", withOrgDb, handler$46);
-	orgScoped.get("/agents/:agentId", withOrgDb, handler$45);
-	orgScoped.get("/workflows", withOrgDb, handler$43);
-	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$42);
-	orgScoped.get("/skills", withOrgDb, handler$40);
-	orgScoped.get("/skills/:skillId", withOrgDb, handler$39);
-	orgScoped.get("/recents", withOrgDb, handler$38);
-	orgScoped.get("/history", withOrgDb, handler$48);
+	orgScoped.get("/agents", withOrgDb, handler$49);
+	orgScoped.get("/agents/:agentId", withOrgDb, handler$48);
+	orgScoped.get("/workflows", withOrgDb, handler$46);
+	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$45);
+	orgScoped.get("/skills", withOrgDb, handler$43);
+	orgScoped.get("/skills/:skillId", withOrgDb, handler$42);
+	orgScoped.get("/recents", withOrgDb, handler$41);
+	orgScoped.get("/history", withOrgDb, handler$51);
 	orgScoped.post("/team-requests", handler);
-	orgScoped.get("/history/:runId", withOrgDb, handler$47);
-	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$41);
-	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$44);
-	orgScoped.get("/credentials", withOrgDb, handler$15);
-	orgScoped.post("/credentials", withOrgDb, handler$14);
-	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$13(c, next));
-	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$12);
+	orgScoped.get("/history/:runId", withOrgDb, handler$50);
+	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$44);
+	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$47);
+	orgScoped.get("/credentials", withOrgDb, handler$18);
+	orgScoped.post("/credentials", withOrgDb, handler$17);
+	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$16(c, next));
+	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$15);
 	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
-	orgScoped.get("/projects", handler$37);
-	orgScoped.get("/projects/slug-available", handler$34);
-	orgScoped.get("/projects/metrics", withOrgDb, handler$36);
-	orgScoped.post("/projects", handler$35);
-	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$33);
-	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$32);
-	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$31);
-	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$17);
-	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$16);
-	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$22);
-	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$21);
-	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$20);
-	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$19);
-	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$18);
+	orgScoped.get("/projects", handler$40);
+	orgScoped.get("/projects/slug-available", handler$37);
+	orgScoped.get("/projects/metrics", withOrgDb, handler$39);
+	orgScoped.post("/projects", handler$38);
+	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$36);
+	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$35);
+	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$34);
+	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$20);
+	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$19);
+	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$25);
+	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$24);
+	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$23);
+	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$22);
+	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$21);
 	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
-	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$24);
-	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$23);
-	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$30);
-	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
-	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
-	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$27);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$26);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$25);
+	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$27);
+	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$26);
+	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$33);
+	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$31);
+	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$32);
+	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$30);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
+	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
 	orgScoped.route("/projects", projectScoped);
 	account.route("/", orgScoped);
 	return account;
@@ -2472,11 +2591,12 @@ const SandboxWriteBodySchema = SandboxSessionBodySchema.extend({
 	path: zod.z.string().trim().min(1),
 	content: zod.z.string()
 });
-function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy) {
+function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy, mcp) {
 	const internal = new hono.Hono();
 	const protect = requireWorkerToken(workerToken);
 	const materialize = (0, _keystrokehq_runtime.createCredentialMaterializeHandler)(tokenRefresh);
 	internal.use("/*", protect);
+	mcp?.mountInternalRoutes?.(internal, { withProjectScope });
 	internal.post("/projects/:projectId/credentials/materialize", async (c) => {
 		const response = await withProjectScope(c.req.param("projectId"), async () => materialize(c));
 		if (response === void 0) return c.json({ error: "Project not found" }, 404);
@@ -2629,7 +2749,7 @@ async function createApp(auth, options) {
 			}));
 		},
 		mountInternal: (app, { tokenRefresh }) => {
-			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy));
+			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy, options.mcp));
 		}
 	});
 }
@@ -2653,45 +2773,34 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 	if (usesPgBossScheduler(platformConfig)) await (0, _keystrokehq_platform_database.ensureProjectPgBossGrants)();
 	configureProjectRuntimeScheduler(platformConfig.scheduler);
 	await startProjectRuntimeWorker(runtime, { resolveStartInput: async (job) => {
-		const project = await (0, _keystrokehq_platform_database.selectProjectById)(job.projectId);
-		if (!project) throw new Error(`Project ${job.projectId} not found`);
-		const resolved = resolveRuntimeArtifact(project, job.artifactId);
-		if (resolved.action === "error") throw new Error(resolved.message);
-		if (resolved.action === "skip") throw new Error(`Project ${job.projectId} has no deploy artifact to start`);
-		const artifact = await (0, _keystrokehq_platform_database.selectProjectArtifactById)(resolved.artifactId);
-		if (!artifact || artifact.status !== "ready") throw new Error(`Project ${job.projectId} pending artifact is not ready`);
-		const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(project.organizationId);
-		if (!organization) throw new Error(`Organization not found for project ${job.projectId}`);
+		const organization = await (0, _keystrokehq_platform_database.selectOrganizationById)(job.organizationId);
+		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
+		const database = await (0, _keystrokehq_platform_database.resolveOrgRuntimeDatabase)(job.organizationId);
 		const workerRuntime = platformConfig.hosting.workerRuntime;
 		return {
-			projectId: job.projectId,
-			name: job.name,
-			artifactId: resolved.artifactId,
-			artifactStorageKey: artifact.storageKey,
-			database: await (0, _keystrokehq_platform_database.resolveProjectRuntimeDatabase)({
-				organizationId: project.organizationId,
-				projectId: project.id
-			}),
+			organizationId: job.organizationId,
+			projects: [],
+			database: {
+				...database,
+				organizationId: job.organizationId
+			},
 			env: {
 				...(0, _keystrokehq_platform_database.orgWorkspacesRuntimeEnv)(organization, { containerEnv: process.env }),
 				...platformConfig.llmProxy?.workerEnv({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				}),
 				...platformConfig.sandboxProxy?.workerEnv({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				}),
 				...platformConfig.workerEnv?.({
 					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken,
-					projectId: project.id
+					workerToken: workerRuntime.workerToken
 				})
 			},
 			hosting: organization.hostingAppName ? { appName: organization.hostingAppName } : void 0,
-			previousRuntimeId: project.runtimeId
+			previousRuntimeId: organization.runtimeId
 		};
 	} });
 	const webUrl = process.env.PUBLIC_WEB_URL;
@@ -2730,4 +2839,4 @@ Object.defineProperty(exports, "startPlatformServer", {
 	}
 });
 
-//# sourceMappingURL=start-BX-bkX9K.cjs.map
+//# sourceMappingURL=start-CBrH4KOb.cjs.map