@keystrokehq/platform 0.1.5 → 1.0.0

package/dist/start-9_8ZcdaU.mjs

@@ -1,2836 +0,0 @@
-import { $ as InviteProjectMembersRequestSchema, $t as WorkflowSummaryListResponseSchema, A as CompleteProjectArtifactResponseSchema, At as SkillSummaryDetailResponseSchema, B as CreateProjectRequestSchema, Bt as UpdateOrganizationMemberResponseSchema, C as AcceptOrganizationInvitationResponseSchema, Ct as ProjectResponseSchema, D as AgentSummarySchema, Dt as ProjectSourceResourcesSchema, E as AgentSummaryListResponseSchema, Et as ProjectSlugAvailabilityResponseSchema, F as CreateCustomAppRequestSchema, Ft as StoredProjectSourceManifestSchema, G as GetCredentialResponseSchema, Gt as UpdateProjectSettingsRequestSchema, H as DeclineOrganizationInvitationResponseSchema, Ht as UpdateProjectMemberRequestSchema, I as CreateCustomAppResponseSchema, It as SubmitTeamRequestRequestSchema, J as HistoryRunDetailResponseSchema, Jt as UserAvatarPatchSchema, K as GetCustomAppResponseSchema, Kt as UploadProjectSourceManifestRequestSchema, L as CreateOrganizationRequestSchema, Lt as SubmitTeamRequestResponseSchema, M as CreateApiKeyResponseSchema, Mt as SkillSummarySchema, N as CreateCredentialsRequestSchema, Nt as SlugAvailabilityQuerySchema, O as AppSlugAvailabilityQuerySchema, Ot as RecentResourceListResponseSchema, P as CreateCredentialsResponseSchema, Pt as SlugAvailabilityResponseSchema, Q as InviteOrganizationMembersResponseSchema, Qt as WorkflowSummaryDetailResponseSchema, R as CreateOrganizationResponseSchema, Rt as UpdateCredentialRequestSchema, S as ACTIVE_ORG_HEADER, St as ProjectReachabilityResponseSchema, T as AgentSummaryDetailResponseSchema, Tt as ProjectSlugAvailabilityQuerySchema, U as DownloadActiveProjectArtifactResponseSchema, Ut as UpdateProjectMemberResponseSchema, V as CreateProjectResponseSchema, Vt as UpdateOrganizationRequestSchema, W as ErrorResponseSchema, Wn as pingProjectTarget, Wt as UpdateProjectRequestSchema, X as HistoryRunListResponseSchema, Xt as UserPreferencesPatchSchema, Y as HistoryRunListQuerySchema, Yt as UserAvatarSchema, Z as InviteOrganizationMembersRequestSchema, Zt as UserPreferencesSchema, _ as createJobQueue, _n as parseStoredRouteManifest, _t as PresignOrgLogoResponseSchema, a as isKeystrokeAssetsAvatarPublicUrl, an as mapOrganizationMember, at as ListOrganizationMembersResponseSchema, b as readCredentialInstanceSecret, bn as validateCredentialValueAgainstFields, bt as PresignUserAvatarRequestSchema, c as isUserAvatarStorageKey, cn as mapProjectDeployment, ct as ListProjectFilesResponseSchema, dn as mapUserOrganization, dt as ListProjectsResponseSchema, en as WorkflowSummarySchema, et as InviteProjectMembersResponseSchema, f as orgLogoStorageKey, fn as mergeUserPreferences, ft as OrganizationSidebarBrandingPatchSchema, g as userAvatarStorageKey, gn as parseAppSlug, gt as PresignOrgLogoRequestSchema, h as publicKeystrokeAssetsObjectUrl, hn as organizationSlugErrorCodeFromMessage, ht as PROJECT_SLUG_TAKEN_MESSAGE, i as extractRouteManifestFromArtifact, in as mapOrganizationInvitation, it as ListOrganizationInvitationsResponseSchema, j as CreateApiKeyRequestSchema, jt as SkillSummaryListResponseSchema, k as AppSlugAvailabilityResponseSchema, kt as RecentResourceSchema, l as keystrokeAssetsAvatarKeyFromPublicUrl, ln as mapProjectMember, lt as ListProjectMembersResponseSchema, m as projectSourceBlobKey, mn as organizationInvitationAcceptPath, mt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, n as createAssetsStorageClient, nn as displayCredentialAppName, nt as ListAppsResponseSchema, o as isKeystrokeAssetsOrgLogoPublicUrl, on as mapProject, ot as ListOrganizationsResponseSchema, p as projectArtifactKey, pn as normalizeUserPreferences, pt as OrganizationSidebarBrandingSchema, q as HistoryRunCancelResponseSchema, qt as UploadProjectSourceResponseSchema, r as ensureKeystrokeAssetsBucket, rn as listenPortFromPublicUrl, rt as ListCredentialsResponseSchema, s as isOrgLogoStorageKey, sn as mapProjectArtifact, st as ListProjectDeploymentsResponseSchema, t as RouteManifestNotFoundError, tn as buildCredentialInstanceLabel, tt as ListApiKeysResponseSchema, u as keystrokeAssetsOrgLogoKeyFromPublicUrl, un as mapProjectSettings, ut as ListProjectMetricsResponseSchema, v as defaultSchedulerPlugin, vn as projectFileId, vt as PresignProjectSourceRequestSchema, w as ActiveOrganizationResponseSchema, wt as ProjectSettingsResponseSchema, x as setCredentialInstanceSecret, xn as validationErrorResponse, xt as PresignUserAvatarResponseSchema, y as deleteCredentialInstanceSecret, yn as resolveUniqueCredentialInstanceLabel, yt as PresignProjectSourceResponseSchema, z as CreateProjectArtifactResponseSchema, zt as UpdateOrganizationMemberRequestSchema } from "./dist-CQMZgfp_.mjs";
-import { buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, deleteCredentialInstanceById, findHistoryRunCore, getServerTenantScopeId, inferDialect, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectWorkflowLastRunAtByIds, selectWorkflowRunById, touchResourceActivity, upsertCredentialInstance } from "@keystrokehq/database";
-import { ZodError, z } from "zod";
-import "node:path";
-import "node:fs";
-import { AsyncLocalStorage } from "node:async_hooks";
-import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgDatabaseUrl, resolveOrgRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectLastDeploymentAtByProject, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, updateOrganizationActive, updateOrganizationFailed, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
-import { serve } from "@hono/node-server";
-import { AUTH_API_PATH, createAuth, createDefaultAuthJwtVerifier, extractWebhookApiKeyFromRequest, handleAuthRequest, resolveAuthEmailFrom, resolveRequestAuth } from "@keystrokehq/auth";
-import { buildWebhookUrl, createCredentialMaterializeHandler, extractWebhookRoutesFromManifest, seedOAuthAppsFromEnvForAllOrganizations, seedOAuthAppsFromEnvForOrganization, syncRegistryFromStoredManifest } from "@keystrokehq/runtime";
-import { createApp, externalPlatformOrigin, getProjectScheduler, platformWebhookOrigin, resolveMcpEntityId } from "@keystrokehq/http";
-import { Hono } from "hono";
-import { Resend } from "resend";
-//#region ../../packages/manifest/dist/index.mjs
-function normalizeWebhookEndpoint(endpoint) {
-	return endpoint.replace(/^\/+|\/+$/g, "").replace(/^triggers\/?/, "");
-}
-function webhookRouteFromEndpoint(endpoint) {
-	const normalized = normalizeWebhookEndpoint(endpoint);
-	if (!normalized) throw new Error("Webhook endpoint must not be empty");
-	return `/triggers/${normalized}`;
-}
-const WORKFLOW = Symbol.for("keystroke.workflow");
-function isManifestWorkflow(value) {
-	if (typeof value !== "object" || value === null) return false;
-	if (!(WORKFLOW in value) || value[WORKFLOW] !== true) return false;
-	const workflow = value;
-	return typeof workflow.slug === "string" && workflow.slug.trim().length > 0 && workflow.input instanceof Object && "safeParse" in workflow.input && workflow.output instanceof Object && "safeParse" in workflow.output;
-}
-const zodSchema = z.custom((value) => value instanceof z.ZodType, "must be a Zod schema");
-const cronScheduleSchema = z.string().trim().min(1, "cron schedule must be a non-empty string");
-const workflowSchema = z.custom((value) => isManifestWorkflow(value), "must be defineWorkflow(...)");
-const agentSchema = z.custom((value) => typeof value === "object" && value !== null && typeof value.slug === "string" && value.slug.trim().length > 0 && typeof value.prompt === "function", "must be defineAgent(...)");
-const promptSchema = z.union([z.string(), z.function()]);
-const baseSourceShape = {
-	key: z.string().trim().min(1),
-	attach: z.function()
-};
-const webhookSourceSchema = z.object({
-	kind: z.literal("webhook"),
-	...baseSourceShape,
-	endpoint: z.string().min(1),
-	request: zodSchema,
-	filter: zodSchema.optional(),
-	passes: z.function()
-});
-const cronSourceSchema = z.object({
-	kind: z.literal("cron"),
-	...baseSourceShape,
-	schedule: cronScheduleSchema
-});
-const pollSourceSchema = z.object({
-	kind: z.literal("poll"),
-	...baseSourceShape,
-	id: z.string().optional(),
-	schedule: cronScheduleSchema,
-	run: z.function(),
-	filters: z.array(z.function()),
-	passes: z.function()
-});
-const triggerSourceSchema = z.discriminatedUnion("kind", [
-	webhookSourceSchema,
-	cronSourceSchema,
-	pollSourceSchema
-]);
-const workflowAttachmentSchema = z.object({
-	key: z.string().trim().min(1),
-	source: triggerSourceSchema,
-	target: z.literal("workflow"),
-	workflow: workflowSchema,
-	transform: z.function().optional()
-});
-const agentAttachmentSchema = z.object({
-	key: z.string().trim().min(1),
-	source: triggerSourceSchema,
-	target: z.literal("agent"),
-	agent: agentSchema,
-	prompt: promptSchema
-});
-z.discriminatedUnion("target", [workflowAttachmentSchema, agentAttachmentSchema]);
-//#endregion
-//#region ../../packages/projects/dist/index.mjs
-async function resolveDeployManifest(input) {
-	if (input.artifactManifest != null) return parseStoredRouteManifest(input.artifactManifest);
-	return parseStoredRouteManifest(extractRouteManifestFromArtifact(input.artifactBytes));
-}
-/** Cut over activeArtifactId, then sync org project registry from the artifact manifest. */
-async function promoteProjectDeploy(input) {
-	const project = await selectProjectById(input.projectId);
-	if (!project) throw new Error(`Project ${input.projectId} not found`);
-	const artifact = await selectProjectArtifactById(input.artifactId);
-	if (!artifact || artifact.projectId !== input.projectId) throw new Error(`Artifact ${input.artifactId} not found for project ${input.projectId}`);
-	const organization = await selectOrganizationById(project.organizationId);
-	if (!organization) throw new Error(`Organization not found for project ${input.projectId}`);
-	if (!input.artifactBytes && artifact.manifestJson == null) throw new RouteManifestNotFoundError("Artifact has no stored route manifest; rebuild and redeploy");
-	const manifest = await resolveDeployManifest({
-		artifactId: input.artifactId,
-		artifactManifest: artifact.manifestJson,
-		artifactBytes: input.artifactBytes ?? Buffer.alloc(0)
-	});
-	if (artifact.manifestJson == null) await updateProjectArtifactManifest({
-		artifactId: input.artifactId,
-		manifestJson: manifest
-	});
-	if (project.pendingArtifactId === input.artifactId) await promoteProjectArtifact({
-		projectId: input.projectId,
-		artifactId: input.artifactId
-	});
-	else if (project.activeArtifactId !== input.artifactId) throw new Error(`Artifact ${input.artifactId} is not the pending deploy for project ${input.projectId}`);
-	const ephemeralRoutes = [];
-	await runWithProjectDatabase({
-		url: resolveOrgDatabaseUrl(organization),
-		searchPath: organization.dbSchema
-	}, async () => runWithProjectScope(project.id, async () => {
-		await syncRegistryFromStoredManifest(manifest);
-		const byRoute = /* @__PURE__ */ new Map();
-		for (const row of await selectEphemeralTriggerAttachments()) {
-			if (row.source.kind !== "webhook") continue;
-			const route = webhookRouteFromEndpoint(row.source.endpoint);
-			byRoute.set(route, [...byRoute.get(route) ?? [], row.slug]);
-		}
-		for (const [route, attachmentKeys] of byRoute) ephemeralRoutes.push({
-			route,
-			attachmentKeys
-		});
-	}));
-	const webhookRoutes = [...extractWebhookRoutesFromManifest(manifest), ...ephemeralRoutes];
-	if (webhookRoutes.length > 0) await ensureWebhookApiKeys(project.id, webhookRoutes, project.id);
-}
-/** True when a project still needs an org worker rebuild after a runtime job finishes. */
-function projectNeedsRuntimeFollowUp(project) {
-	if (project.status === "starting" && project.pendingArtifactId) return true;
-	if (project.pendingArtifactId && project.activeArtifactId !== project.pendingArtifactId) return true;
-	return false;
-}
-let runtimeQueue;
-let runtimeQueueInit;
-let runtimeSchedulerPlugin;
-function configureProjectRuntimeScheduler(plugin) {
-	runtimeSchedulerPlugin = plugin;
-	runtimeQueue = void 0;
-	runtimeQueueInit = void 0;
-}
-async function getOrgRuntimeQueue() {
-	if (runtimeQueue) return runtimeQueue;
-	if (!runtimeQueueInit) runtimeQueueInit = (async () => {
-		const queue = await createJobQueue({
-			scope: "platform",
-			plugin: runtimeSchedulerPlugin ?? defaultSchedulerPlugin()
-		});
-		runtimeQueue = queue;
-		return queue;
-	})();
-	return runtimeQueueInit;
-}
-function toOrgRuntimeJob(payload) {
-	const job = payload.payload;
-	if (!job?.organizationId) throw new Error("Invalid org runtime job payload");
-	return {
-		organizationId: job.organizationId,
-		triggerProjectId: job.triggerProjectId,
-		triggerArtifactId: job.triggerArtifactId
-	};
-}
-async function resolveOrgProjects(job) {
-	const projects = await selectProjectsByOrganizationId(job.organizationId);
-	const deploys = [];
-	for (const project of projects) {
-		const artifactId = project.id === job.triggerProjectId && job.triggerArtifactId ? job.triggerArtifactId : project.pendingArtifactId ?? project.activeArtifactId;
-		if (!artifactId) continue;
-		const artifact = await selectProjectArtifactById(artifactId);
-		if (!artifact || artifact.projectId !== project.id || artifact.status !== "ready") {
-			if (project.id === job.triggerProjectId) throw new Error(`Project ${project.id} pending artifact is not ready`);
-			continue;
-		}
-		deploys.push({
-			projectId: project.id,
-			name: project.name,
-			artifactId,
-			artifactStorageKey: artifact.storageKey
-		});
-	}
-	if (deploys.length === 0) throw new Error(`Organization ${job.organizationId} has no deployable projects`);
-	return deploys;
-}
-async function orgNeedsRuntimeFollowUp(organizationId) {
-	return (await selectProjectsByOrganizationId(organizationId)).some(projectNeedsRuntimeFollowUp);
-}
-async function enqueueOrgRuntime(job) {
-	return (await getOrgRuntimeQueue()).enqueue({
-		kind: "runtime",
-		targetId: job.organizationId,
-		runId: crypto.randomUUID(),
-		trigger: "api",
-		payload: job,
-		maxAttempts: 5,
-		dedupeKey: job.organizationId
-	});
-}
-async function enqueueProjectRuntime(job) {
-	const project = await selectProjectById(job.projectId);
-	if (!project) throw new Error(`Project ${job.projectId} not found`);
-	return enqueueOrgRuntime({
-		organizationId: project.organizationId,
-		triggerProjectId: job.projectId,
-		triggerArtifactId: job.artifactId
-	});
-}
-async function destroyOrgRuntime(runtime, input, runtimeId) {
-	if (!runtime.destroy) return;
-	try {
-		await runtime.destroy({
-			runtimeId,
-			hosting: input.hosting
-		});
-	} catch (destroyError) {
-		console.error(`[org.runtime] failed to destroy runtime ${runtimeId}`, destroyError);
-	}
-}
-async function handleOrgRuntimeJob(runtime, resolveStartInput, payload) {
-	if (payload.kind !== "runtime") return;
-	const job = toOrgRuntimeJob(payload);
-	try {
-		const organization = await selectOrganizationById(job.organizationId);
-		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
-		const projects = await resolveOrgProjects(job);
-		const input = await resolveStartInput(job);
-		const mergedInput = {
-			...input,
-			organizationId: job.organizationId,
-			projects,
-			previousRuntimeId: input.previousRuntimeId ?? organization.runtimeId
-		};
-		let result;
-		try {
-			result = await runtime.start(mergedInput);
-			for (const project of projects) {
-				await promoteProjectDeploy({
-					projectId: project.projectId,
-					artifactId: project.artifactId,
-					baseUrl: result.baseUrl
-				});
-				await updateProjectActive(project.projectId, {
-					baseUrl: result.baseUrl,
-					runtimeId: result.runtimeId
-				});
-			}
-			await updateOrganizationActive(job.organizationId, {
-				baseUrl: result.baseUrl,
-				runtimeId: result.runtimeId
-			});
-			if (mergedInput.previousRuntimeId) await destroyOrgRuntime(runtime, mergedInput, mergedInput.previousRuntimeId);
-			if (await orgNeedsRuntimeFollowUp(job.organizationId)) await enqueueOrgRuntime({ organizationId: job.organizationId });
-		} catch (error) {
-			if (result) await destroyOrgRuntime(runtime, mergedInput, result.runtimeId);
-			throw error;
-		}
-	} catch (error) {
-		console.error(`[org.runtime] ${job.organizationId} failed`, error);
-		if (payload.exhaustedRetries) await updateOrganizationFailed(job.organizationId, "Org runtime failed after retries");
-		throw error;
-	}
-}
-async function startProjectRuntimeWorker(runtime, options = {}) {
-	const queue = await getOrgRuntimeQueue();
-	const resolveStartInput = options.resolveStartInput ?? (async (job) => {
-		throw new Error(`Org runtime for ${job.organizationId} requires resolveStartInput with database credentials`);
-	});
-	await queue.startWorker(async (payload) => {
-		await handleOrgRuntimeJob(runtime, resolveStartInput, payload);
-	});
-}
-//#endregion
-//#region src/auth/mount.ts
-function mountAuth(app, auth) {
-	app.on(["POST", "GET"], AUTH_API_PATH, (c) => handleAuthRequest(auth, c.req.raw));
-}
-//#endregion
-//#region ../../packages/access-control/dist/index.mjs
-const apiKeysActions = {
-	read: "apiKeys:read",
-	create: "apiKeys:create"
-};
-const apiKeysGrants = Object.values(apiKeysActions);
-const apiKeysRoleGrants = {
-	owner: [apiKeysActions.read, apiKeysActions.create],
-	admin: [apiKeysActions.read, apiKeysActions.create],
-	builder: [apiKeysActions.create]
-};
-const organizationActions = {
-	update: "organization:update",
-	delete: "organization:delete"
-};
-const organizationGrants = Object.values(organizationActions);
-const organizationRoleGrants = {
-	owner: [organizationActions.update, organizationActions.delete],
-	admin: [organizationActions.update],
-	builder: []
-};
-const userActions = {
-	manage: "users:manage",
-	invite: "users:invite"
-};
-const userGrants = Object.values(userActions);
-const userRoleGrants = {
-	owner: [userActions.manage, userActions.invite],
-	admin: [userActions.manage, userActions.invite],
-	builder: [userActions.invite]
-};
-/** Role ceiling: which roles each inviter may grant. Owner is never invitable (shared schema). */
-const invitableRolesByRole = {
-	owner: ["admin", "builder"],
-	admin: ["admin", "builder"],
-	builder: ["builder"]
-};
-function canInviteRole(inviter, invited) {
-	return invitableRolesByRole[inviter].includes(invited);
-}
-function mergeRoleGrants(role) {
-	return [
-		...organizationRoleGrants[role],
-		...userRoleGrants[role],
-		...apiKeysRoleGrants[role]
-	];
-}
-const orgRolePermissions = {
-	owner: mergeRoleGrants("owner"),
-	admin: mergeRoleGrants("admin"),
-	builder: mergeRoleGrants("builder")
-};
-const projectActions = {
-	read: "project:read",
-	deploy: "project:deploy",
-	update: "project:update",
-	delete: "project:delete",
-	manageMembers: "project:manage-members",
-	invite: "project:invite"
-};
-const projectGrants = Object.values(projectActions);
-const projectRoleGrants = {
-	admin: Object.values(projectActions),
-	builder: [projectActions.read, projectActions.deploy]
-};
-const orgAdminRoles = new Set(["owner", "admin"]);
-const projectActionSet = new Set(projectGrants);
-function isProjectAction(action) {
-	return projectActionSet.has(action);
-}
-function checkPermission(action, ctx) {
-	if (isProjectAction(action)) {
-		if (orgAdminRoles.has(ctx.orgRole)) return true;
-		return ctx.projectRole != null && projectRoleGrants[ctx.projectRole].includes(action);
-	}
-	return orgRolePermissions[ctx.orgRole].includes(action);
-}
-function projectListScope(ctx) {
-	return checkPermission(projectActions.read, ctx) ? { kind: "all" } : { kind: "member-only" };
-}
-function canReadProject(ctx, hasMembership) {
-	return checkPermission(projectActions.read, ctx) || hasMembership;
-}
-const agentListScope = projectListScope;
-const canAccessAgent = canReadProject;
-function canRevokeApiKey(ctx, input) {
-	return input.userId === input.createdByUserId || checkPermission(userActions.manage, ctx);
-}
-function apiKeyListScope(ctx) {
-	return checkPermission(apiKeysActions.read, ctx) ? { kind: "all" } : { kind: "creator-only" };
-}
-function canReadApiKey(ctx, input) {
-	return checkPermission(apiKeysActions.read, ctx) || input.userId === input.createdByUserId;
-}
-[
-	...organizationGrants,
-	...userGrants,
-	...apiKeysGrants,
-	...projectGrants
-];
-const historyListScope = projectListScope;
-const canAccessHistoryRun = canReadProject;
-function canInviteToProject(ctx, settings, invitedRole) {
-	if (!(checkPermission(projectActions.invite, ctx) || settings.invitePermission === "all" && ctx.projectRole === "builder")) return false;
-	if (checkPermission(projectActions.manageMembers, ctx)) return true;
-	return invitedRole === "builder";
-}
-const skillListScope = projectListScope;
-const canAccessSkill = canReadProject;
-const workflowListScope = projectListScope;
-const canAccessWorkflow = canReadProject;
-//#endregion
-//#region src/auth/access-context.ts
-function accessContext(c) {
-	const organization = c.get("organization");
-	const projectMember = c.get("projectMember");
-	return {
-		orgRole: organization.role,
-		projectRole: projectMember?.role
-	};
-}
-function getProjectInvitePermission(c) {
-	return c.get("project").invitePermission;
-}
-//#endregion
-//#region ../../packages/http/dist/require-session-BLPGA50N.mjs
-function resolveActiveOrganizationId(c) {
-	const header = c.req.header(ACTIVE_ORG_HEADER)?.trim();
-	if (header) return header;
-	return c.get("apiKeyAuth")?.organizationId;
-}
-async function resolveOrganizationContext(c) {
-	const organizationId = resolveActiveOrganizationId(c);
-	if (!organizationId) return {
-		ok: false,
-		response: c.json(ErrorResponseSchema.parse({
-			error: "Select an organization to continue",
-			code: "needs_org_selection"
-		}), 409)
-	};
-	const apiKeyAuth = c.get("apiKeyAuth");
-	if (apiKeyAuth && apiKeyAuth.organizationId !== organizationId) return {
-		ok: false,
-		response: c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403)
-	};
-	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
-	if (!membership) return {
-		ok: false,
-		response: c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403)
-	};
-	return {
-		ok: true,
-		organization: {
-			organizationId: membership.organization.id,
-			organizationName: membership.organization.name,
-			role: membership.role
-		}
-	};
-}
-function requireOrganization() {
-	return async (c, next) => {
-		const resolved = await resolveOrganizationContext(c);
-		if (!resolved.ok) return resolved.response;
-		c.set("organization", resolved.organization);
-		await next();
-	};
-}
-function requireProject() {
-	return async (c, next) => {
-		const organization = c.get("organization");
-		const projectId = c.req.param("projectId")?.trim();
-		if (!projectId) return c.json(ErrorResponseSchema.parse({ error: "Project id is required" }), 400);
-		const [project, organizationRow] = await Promise.all([selectProjectForOrganization(organization.organizationId, projectId), selectOrganizationById(organization.organizationId)]);
-		if (!project) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-		if (!organizationRow) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-		c.set("project", project);
-		await runWithWorkspaceContext({
-			organizationId: organization.organizationId,
-			role: organization.role,
-			projectId: project.id,
-			dbSchema: organizationRow.dbSchema
-		}, () => next());
-	};
-}
-function routeProject(project) {
-	return mapProject(project);
-}
-function forbidden(c) {
-	return c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
-}
-function notFound(c, message = "Not found") {
-	return c.json(ErrorResponseSchema.parse({ error: message }), 404);
-}
-function requireProjectMembership() {
-	return async (c, next) => {
-		const { role: orgRole } = c.get("organization");
-		const project = c.get("project");
-		if (checkPermission(projectActions.read, { orgRole })) {
-			await next();
-			return;
-		}
-		const membership = await selectUserProjectMembership(c.get("user").id, project.id);
-		if (!membership) return notFound(c, "Project not found");
-		c.set("projectMember", { role: membership.role });
-		await next();
-	};
-}
-function sessionFromApiKeyUser(user, token) {
-	return {
-		user: {
-			id: user.id,
-			email: user.email,
-			name: user.name,
-			image: user.image ?? null,
-			emailVerified: user.emailVerified,
-			createdAt: user.createdAt,
-			updatedAt: user.updatedAt
-		},
-		session: {
-			id: user.id,
-			userId: user.id,
-			token,
-			expiresAt: new Date(Date.now() + 900 * 1e3),
-			createdAt: /* @__PURE__ */ new Date(),
-			updatedAt: /* @__PURE__ */ new Date()
-		}
-	};
-}
-function requireSession(jwtVerifier) {
-	const verifier = jwtVerifier ?? createDefaultAuthJwtVerifier();
-	return async (c, next) => {
-		const result = await resolveRequestAuth(verifier, c.req.raw.headers);
-		if (result) {
-			c.set("user", result.user);
-			c.set("session", result.session);
-			await next();
-			return;
-		}
-		const apiKeySecret = extractWebhookApiKeyFromRequest(c.req.raw);
-		if (apiKeySecret) {
-			const verified = await verifyOrgPlatformApiKeySecret(apiKeySecret);
-			if (verified) {
-				const user = await loadOrgPlatformApiKeyUser(verified.userId);
-				if (user) {
-					const session = sessionFromApiKeyUser(user, apiKeySecret);
-					c.set("user", session.user);
-					c.set("session", session.session);
-					c.set("apiKeyAuth", {
-						apiKeyId: verified.apiKeyId,
-						organizationId: verified.organizationId
-					});
-					await next();
-					return;
-				}
-			}
-		}
-		return c.json({ error: "Unauthorized" }, 401);
-	};
-}
-//#endregion
-//#region src/auth/authorize.ts
-function authorize(action) {
-	return async (c, next) => {
-		if (!checkPermission(action, accessContext(c))) return forbidden(c);
-		await next();
-	};
-}
-//#endregion
-//#region src/auth/authorize-payload.ts
-function authorizePayload(schema, allow) {
-	return async (c, next) => {
-		const parsed = schema.safeParse(await c.req.json().catch(() => null));
-		if (parsed.success && !allow({
-			c,
-			ctx: accessContext(c),
-			body: parsed.data
-		})) return forbidden(c);
-		await next();
-	};
-}
-//#endregion
-//#region src/auth/require-organization-param.ts
-function requireOrganizationParam() {
-	return async (c, next) => {
-		const organizationId = c.req.param("organizationId")?.trim();
-		if (!organizationId) return c.json(ErrorResponseSchema.parse({ error: "Organization id is required" }), 400);
-		const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
-		if (!membership) return c.json(ErrorResponseSchema.parse({ error: "Forbidden" }), 403);
-		c.set("organization", {
-			organizationId: membership.organization.id,
-			organizationName: membership.organization.name,
-			role: membership.role
-		});
-		await next();
-	};
-}
-//#endregion
-//#region ../../packages/http/dist/with-public-project-runtime-B7hmgjbi.mjs
-const requestBackgroundTasks = new AsyncLocalStorage();
-function runWithRequestBackgroundTasks(fn) {
-	return requestBackgroundTasks.run([], fn);
-}
-function deferRequestBackgroundTask(task) {
-	const tasks = requestBackgroundTasks.getStore();
-	if (!tasks) return;
-	tasks.push(task);
-}
-async function flushRequestBackgroundTasks() {
-	const tasks = requestBackgroundTasks.getStore() ?? [];
-	await Promise.allSettled(tasks);
-}
-/** Org DB connection options for `@keystrokehq/database` project scope (pg schema vs sqlite file). */
-function resolveOrgProjectDatabaseOptions(organization) {
-	const url = resolveOrgDatabaseUrl(organization);
-	if (inferDialect(url) === "postgres") return {
-		url,
-		searchPath: organization.dbSchema
-	};
-	return { url };
-}
-/** Bind the org's shared Postgres schema (all projects in the org use this DB). */
-function withOrganizationProjectDatabase() {
-	return async (c, next) => {
-		const { organizationId } = c.get("organization");
-		const organization = await selectOrganizationById(organizationId);
-		if (!organization) return c.json({ error: "Organization not found" }, 404);
-		const dbOptions = resolveOrgProjectDatabaseOptions(organization);
-		await runWithOrganizationScope(organizationId, () => runWithProjectDatabase(dbOptions, () => runWithTenantScope(organizationId, () => runWithRequestBackgroundTasks(async () => {
-			await next();
-			await flushRequestBackgroundTasks();
-		}))));
-	};
-}
-//#endregion
-//#region src/routes/account/users/me/avatar/GET.ts
-const handler$63 = async (c) => {
-	const dbUser = await selectUserById(c.get("user").id);
-	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
-	return c.json(UserAvatarSchema.parse({ url: dbUser.image ?? null }));
-};
-//#endregion
-//#region src/lib/user-avatar-content-type.ts
-const ALLOWED_AVATAR_CONTENT_TYPES = {
-	"image/jpeg": "jpg",
-	"image/jpg": "jpg",
-	"image/png": "png",
-	"image/webp": "webp",
-	"image/gif": "gif"
-};
-function avatarExtensionForContentType(contentType) {
-	return ALLOWED_AVATAR_CONTENT_TYPES[contentType.split(";")[0]?.trim().toLowerCase() ?? ""] ?? null;
-}
-//#endregion
-//#region src/routes/account/users/me/avatar/presign/POST.ts
-const handler$62 = async (c) => {
-	const parsed = PresignUserAvatarRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar upload request" }), 400);
-	const extension = avatarExtensionForContentType(parsed.data.contentType);
-	if (!extension) return c.json(ErrorResponseSchema.parse({ error: "Unsupported image type" }), 400);
-	const storageKey = userAvatarStorageKey(c.get("user").id, extension);
-	const uploadUrl = await createAssetsStorageClient().presignPut({
-		key: storageKey,
-		contentType: parsed.data.contentType
-	});
-	return c.json(PresignUserAvatarResponseSchema.parse({
-		uploadUrl,
-		storageKey
-	}));
-};
-//#endregion
-//#region src/lib/stored-image.ts
-async function finalizeStoredImageUpload(input) {
-	if (!input.isValidStorageKey(input.storageKey)) return {
-		ok: false,
-		error: "Invalid storage key"
-	};
-	const head = await input.storage.headObject(input.storageKey);
-	if (!head || head.contentLength <= 0) return {
-		ok: false,
-		error: "Upload not found"
-	};
-	return {
-		ok: true,
-		publicUrl: input.buildPublicUrl(input.storageKey)
-	};
-}
-async function deleteStoredImageIfOwned(input) {
-	if (!input.url || !input.isOwnedPublicUrl(input.url)) return;
-	const key = input.keyFromPublicUrl(input.url);
-	if (!key) return;
-	await input.storage.deleteObject(key).catch(() => void 0);
-}
-//#endregion
-//#region src/routes/account/users/me/avatar/PATCH.ts
-const handler$61 = async (c) => {
-	const parsed = UserAvatarPatchSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid avatar update" }), 400);
-	const user = c.get("user");
-	const dbUser = await selectUserById(user.id);
-	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
-	const storage = createAssetsStorageClient();
-	const { storageKey } = parsed.data;
-	if (storageKey === null) {
-		await deleteStoredImageIfOwned({
-			storage,
-			url: dbUser.image,
-			isOwnedPublicUrl: isKeystrokeAssetsAvatarPublicUrl,
-			keyFromPublicUrl: keystrokeAssetsAvatarKeyFromPublicUrl
-		});
-		await updateUserById(user.id, {
-			image: null,
-			updatedAt: /* @__PURE__ */ new Date()
-		});
-		return c.json(UserAvatarSchema.parse({ url: null }));
-	}
-	const finalized = await finalizeStoredImageUpload({
-		storage,
-		storageKey,
-		isValidStorageKey: (key) => isUserAvatarStorageKey(key, user.id),
-		buildPublicUrl: publicKeystrokeAssetsObjectUrl
-	});
-	if (!finalized.ok) return c.json(ErrorResponseSchema.parse({ error: finalized.error }), 400);
-	if (dbUser.image && dbUser.image !== finalized.publicUrl) await deleteStoredImageIfOwned({
-		storage,
-		url: dbUser.image,
-		isOwnedPublicUrl: isKeystrokeAssetsAvatarPublicUrl,
-		keyFromPublicUrl: keystrokeAssetsAvatarKeyFromPublicUrl
-	});
-	await updateUserById(user.id, {
-		image: finalized.publicUrl,
-		updatedAt: /* @__PURE__ */ new Date()
-	});
-	return c.json(UserAvatarSchema.parse({ url: finalized.publicUrl }));
-};
-//#endregion
-//#region src/routes/account/users/me/preferences/GET.ts
-const handler$60 = async (c) => {
-	const dbUser = await selectUserById(c.get("user").id);
-	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
-	return c.json(UserPreferencesSchema.parse(normalizeUserPreferences(dbUser.preferences)));
-};
-//#endregion
-//#region src/routes/account/users/me/preferences/PATCH.ts
-const handler$59 = async (c) => {
-	const parsed = UserPreferencesPatchSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid preferences update" }), 400);
-	const user = c.get("user");
-	const dbUser = await selectUserById(user.id);
-	if (!dbUser) return c.json(ErrorResponseSchema.parse({ error: "User not found" }), 404);
-	const next = mergeUserPreferences(normalizeUserPreferences(dbUser.preferences), parsed.data);
-	await updateUserById(user.id, {
-		preferences: next,
-		updatedAt: /* @__PURE__ */ new Date()
-	});
-	return c.json(UserPreferencesSchema.parse(next));
-};
-//#endregion
-//#region src/routes/account/organizations/GET.ts
-const handler$58 = async (c) => {
-	const memberships = await selectUserOrganizations(c.get("user").id);
-	return c.json(ListOrganizationsResponseSchema.parse(memberships.map(mapUserOrganization)));
-};
-//#endregion
-//#region src/services/create-organization.ts
-async function createOrganizationWithHosting(deps, userId, name, preferredSlug) {
-	const { hosting, storage } = deps;
-	const identity = await resolveNewOrganizationIdentity(name, preferredSlug);
-	let hostedAppName;
-	let provisionedStorage;
-	let organizationPersisted = false;
-	try {
-		if (hosting.provisionOrganization) hostedAppName = (await hosting.provisionOrganization({
-			organizationId: identity.organizationId,
-			name: name.trim()
-		})).appName;
-		provisionedStorage = await storage.provisionOrganization({
-			organizationId: identity.organizationId,
-			name: name.trim()
-		});
-		const membership = await createOrganizationForUser(userId, name, preferredSlug, {
-			organizationId: identity.organizationId,
-			slug: identity.slug,
-			hostingAppName: hostedAppName ?? null,
-			storage: {
-				bucket: provisionedStorage.bucket,
-				endpoint: provisionedStorage.endpoint,
-				accessKeyIdCiphertext: encryptCredentialPayload$1(provisionedStorage.accessKeyId),
-				secretAccessKeyCiphertext: encryptCredentialPayload$1(provisionedStorage.secretAccessKey),
-				region: provisionedStorage.region ?? null,
-				forcePathStyle: provisionedStorage.forcePathStyle ?? null
-			}
-		});
-		organizationPersisted = true;
-		await seedOAuthAppsFromEnvForOrganization(identity.organizationId);
-		return membership;
-	} catch (error) {
-		if (provisionedStorage && !organizationPersisted) {
-			if (!await isOrganizationStorageBucketInUse(provisionedStorage.bucket)) await storage.deprovisionOrganization(provisionedStorage).catch(() => void 0);
-		}
-		if (hostedAppName && hosting.deprovisionOrganization) await hosting.deprovisionOrganization({ appName: hostedAppName }).catch(() => void 0);
-		throw error;
-	}
-}
-//#endregion
-//#region src/routes/account/organizations/slug-errors.ts
-function organizationSlugErrorBody(error) {
-	if (error instanceof OrganizationSlugTakenError) return {
-		error: error.message,
-		code: "slug_taken"
-	};
-	const message = error.issues[0]?.message ?? "Invalid organization slug";
-	return {
-		error: message,
-		code: organizationSlugErrorCodeFromMessage(message)
-	};
-}
-//#endregion
-//#region src/routes/account/organizations/POST.ts
-function createOrganizationHandler(deps) {
-	return async (c) => {
-		const user = c.get("user");
-		const body = await c.req.json().catch(() => null);
-		const parsed = CreateOrganizationRequestSchema.safeParse(body);
-		if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid organization request" }), 400);
-		try {
-			const membership = await createOrganizationWithHosting(deps, user.id, parsed.data.name, parsed.data.slug);
-			return c.json(CreateOrganizationResponseSchema.parse(mapUserOrganization(membership)), 201);
-		} catch (error) {
-			if (error instanceof OrganizationSlugTakenError$1) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
-			if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
-			throw error;
-		}
-	};
-}
-//#endregion
-//#region src/routes/account/organizations/slug-available/GET.ts
-const handler$57 = async (c) => {
-	const parsed = SlugAvailabilityQuerySchema.safeParse({
-		slug: c.req.query("slug"),
-		excludeOrganizationId: c.req.query("excludeOrganizationId")
-	});
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
-	const availability = await checkOrganizationSlugAvailability(parsed.data.slug, parsed.data.excludeOrganizationId);
-	return c.json(SlugAvailabilityResponseSchema.parse(availability));
-};
-//#endregion
-//#region src/routes/account/organizations/[organizationId]/GET.ts
-const handler$56 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const membership = await selectUserOrganizationMembership(c.get("user").id, organizationId);
-	if (!membership) throw new Error(`Organization membership missing after param guard: ${organizationId}`);
-	return c.json(ActiveOrganizationResponseSchema.parse(mapUserOrganization(membership)));
-};
-//#endregion
-//#region src/routes/account/organizations/[organizationId]/PATCH.ts
-const handler$55 = async (c) => {
-	const organization = c.get("organization");
-	const body = await c.req.json().catch(() => null);
-	const parsed = UpdateOrganizationRequestSchema.safeParse(body);
-	if (!parsed.success) {
-		const errorBody = parsed.error.issues.some((issue) => issue.path[0] === "slug") ? organizationSlugErrorBody(parsed.error) : validationErrorResponse(parsed.error, "Invalid organization update");
-		return c.json(ErrorResponseSchema.parse(errorBody), 400);
-	}
-	try {
-		let updated;
-		if (parsed.data.name !== void 0) updated = await updateOrganizationName(organization.organizationId, parsed.data.name);
-		if (parsed.data.slug !== void 0) updated = await updateOrganizationSlug(organization.organizationId, parsed.data.slug);
-		if (!updated) throw new Error(`Organization update produced no result: ${organization.organizationId}`);
-		return c.json(ActiveOrganizationResponseSchema.parse(mapUserOrganization({
-			organization: updated,
-			role: organization.role
-		})));
-	} catch (error) {
-		if (error instanceof OrganizationSlugTakenError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 409);
-		if (error instanceof ZodError) return c.json(ErrorResponseSchema.parse(organizationSlugErrorBody(error)), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/organizations/[organizationId]/branding/GET.ts
-const handler$54 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	return c.json(OrganizationSidebarBrandingSchema.parse(organizationRowToSidebarBranding(organization)));
-};
-//#endregion
-//#region src/routes/account/organizations/[organizationId]/branding/PATCH.ts
-const LOGO_VARIANTS = [{
-	variant: "light",
-	storageKeyField: "logoLightStorageKey",
-	urlField: "logoLightUrl"
-}, {
-	variant: "dark",
-	storageKeyField: "logoDarkStorageKey",
-	urlField: "logoDarkUrl"
-}];
-async function finalizeOrgLogoVariant(input) {
-	const storage = createAssetsStorageClient();
-	if (input.storageKey === null) {
-		await deleteStoredImageIfOwned({
-			storage,
-			url: input.currentUrl,
-			isOwnedPublicUrl: isKeystrokeAssetsOrgLogoPublicUrl,
-			keyFromPublicUrl: keystrokeAssetsOrgLogoKeyFromPublicUrl
-		});
-		return {
-			ok: true,
-			publicUrl: null
-		};
-	}
-	const finalized = await finalizeStoredImageUpload({
-		storage,
-		storageKey: input.storageKey,
-		isValidStorageKey: (key) => isOrgLogoStorageKey(key, input.organizationId, input.variant),
-		buildPublicUrl: publicKeystrokeAssetsObjectUrl
-	});
-	if (!finalized.ok) return finalized;
-	if (input.currentUrl && input.currentUrl !== finalized.publicUrl) await deleteStoredImageIfOwned({
-		storage,
-		url: input.currentUrl,
-		isOwnedPublicUrl: isKeystrokeAssetsOrgLogoPublicUrl,
-		keyFromPublicUrl: keystrokeAssetsOrgLogoKeyFromPublicUrl
-	});
-	return {
-		ok: true,
-		publicUrl: finalized.publicUrl
-	};
-}
-const handler$53 = async (c) => {
-	const parsed = OrganizationSidebarBrandingPatchSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid branding update" }), 400);
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	const dbUpdate = {
-		customLogoEnabled: parsed.data.customLogoEnabled,
-		customLogoExplicitlyDisabled: parsed.data.customLogoExplicitlyDisabled,
-		logoHeightPx: parsed.data.logoHeightPx
-	};
-	for (const { variant, storageKeyField, urlField } of LOGO_VARIANTS) {
-		const storageKey = parsed.data[storageKeyField];
-		if (storageKey === void 0) continue;
-		const result = await finalizeOrgLogoVariant({
-			organizationId,
-			variant,
-			storageKey,
-			currentUrl: organization[urlField]
-		});
-		if (!result.ok) return c.json(ErrorResponseSchema.parse({ error: result.error }), 400);
-		dbUpdate[urlField] = result.publicUrl;
-	}
-	const updated = await updateOrganizationSidebarBranding(organizationId, dbUpdate);
-	return c.json(OrganizationSidebarBrandingSchema.parse(organizationRowToSidebarBranding(updated)));
-};
-//#endregion
-//#region src/routes/account/organizations/[organizationId]/branding/logo/presign/POST.ts
-const handler$52 = async (c) => {
-	const parsed = PresignOrgLogoRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid logo upload request" }), 400);
-	const extension = avatarExtensionForContentType(parsed.data.contentType);
-	if (!extension) return c.json(ErrorResponseSchema.parse({ error: "Unsupported image type" }), 400);
-	const { organizationId } = c.get("organization");
-	const storageKey = orgLogoStorageKey(organizationId, parsed.data.variant, extension);
-	const uploadUrl = await createAssetsStorageClient().presignPut({
-		key: storageKey,
-		contentType: parsed.data.contentType
-	});
-	return c.json(PresignOrgLogoResponseSchema.parse({
-		uploadUrl,
-		storageKey
-	}));
-};
-//#endregion
-//#region src/auth/project-access.ts
-function adminViewRequested(c) {
-	return c.req.query("admin") === "true";
-}
-/** Capability from policy, narrowed by the caller's view preference. */
-function listScope(c, capability) {
-	return adminViewRequested(c) ? capability : { kind: "member-only" };
-}
-async function grantedProjectIds(c, scope) {
-	if (scope.kind === "all") return;
-	const { organizationId } = c.get("organization");
-	return selectProjectIdsForUser(organizationId, c.get("user").id);
-}
-async function resolveListProjectIds(c, scope, requested) {
-	const granted = await grantedProjectIds(c, scope);
-	const projectId = requested?.trim() || void 0;
-	if (projectId) {
-		if (granted !== void 0 && !granted.includes(projectId)) return "empty";
-		return { projectIds: [projectId] };
-	}
-	if (granted === void 0) return {};
-	if (granted.length === 0) return "empty";
-	return { projectIds: granted };
-}
-async function canAccessProjectId(c, projectId, check) {
-	const ctx = accessContext(c);
-	const granted = await grantedProjectIds(c, projectListScope(ctx));
-	return check(ctx, granted === void 0 ? false : granted.includes(projectId));
-}
-//#endregion
-//#region src/routes/account/history/enrich.ts
-async function resolveHistoryRunActor(ranByUserId) {
-	if (!ranByUserId) return null;
-	const user = await selectUserById(ranByUserId);
-	if (!user) return null;
-	return {
-		userId: user.id,
-		name: user.name,
-		avatarUrl: user.image ?? null
-	};
-}
-async function enrichHistoryRun(run, projectNameById) {
-	const { ranByUserId, ...rest } = run;
-	return {
-		...rest,
-		projectName: projectNameById.get(run.projectId) ?? "Project",
-		ranAs: await resolveHistoryRunActor(ranByUserId)
-	};
-}
-async function enrichHistoryRuns(runs, projectNameById) {
-	const actorByUserId = /* @__PURE__ */ new Map();
-	return Promise.all(runs.map(async (run) => {
-		const { ranByUserId, ...rest } = run;
-		let ranAs = null;
-		if (ranByUserId) {
-			if (!actorByUserId.has(ranByUserId)) actorByUserId.set(ranByUserId, await resolveHistoryRunActor(ranByUserId));
-			ranAs = actorByUserId.get(ranByUserId) ?? null;
-		}
-		return {
-			...rest,
-			projectName: projectNameById.get(run.projectId) ?? "Project",
-			ranAs
-		};
-	}));
-}
-async function attachRanAsToDetail(detail, ranByUserId) {
-	const ranAs = await resolveHistoryRunActor(ranByUserId);
-	return {
-		...detail,
-		ranAs
-	};
-}
-//#endregion
-//#region src/routes/account/history/GET.ts
-const handler$51 = async (c) => {
-	const organization = c.get("organization");
-	const ctx = accessContext(c);
-	const query = HistoryRunListQuerySchema.parse({
-		project: c.req.query("project")?.trim() || void 0,
-		status: c.req.query("status")?.trim() || void 0,
-		kind: c.req.query("kind")?.trim() || void 0
-	});
-	const scope = listScope(c, historyListScope(ctx));
-	const filter = await resolveListProjectIds(c, scope, query.project);
-	if (filter === "empty") return c.json(HistoryRunListResponseSchema.parse([]));
-	const runs = await listHistoryRuns({
-		...filter,
-		...query.status ? { status: query.status } : {},
-		...query.kind ? { kind: query.kind } : {}
-	});
-	const grantedProjectIdsList = await grantedProjectIds(c, scope);
-	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
-	const historyRuns = await enrichHistoryRuns(runs, new Map(projects.map((project) => [project.id, project.name])));
-	return c.json(HistoryRunListResponseSchema.parse(historyRuns));
-};
-//#endregion
-//#region src/routes/account/history/[runId]/GET.ts
-const handler$50 = async (c) => {
-	const runId = c.req.param("runId") ?? "";
-	if (!runId) return c.json(null, 404);
-	const core = await findHistoryRunCore(runId);
-	if (!core || !await canAccessProjectId(c, core.projectId, canAccessHistoryRun)) return c.json(null, 404);
-	const detail = await runWithProjectScope(core.projectId, async () => {
-		if (core.kind === "workflow") {
-			const row = await selectWorkflowRunById(runId);
-			if (!row) return null;
-			return buildHistoryWorkflowRunDetail(row.workflowSlug, runId);
-		}
-		const session = await selectAgentSessionById(runId);
-		if (!session) return null;
-		const agent = await selectActiveAgentById(session.agentId);
-		if (!agent) return null;
-		return buildHistoryAgentSessionDetail(agent.slug, runId);
-	});
-	if (!detail) return c.json(null, 404);
-	return c.json(HistoryRunDetailResponseSchema.parse(await attachRanAsToDetail(detail, core.ranByUserId)));
-};
-//#endregion
-//#region src/routes/account/resources/common.ts
-/** Derive a human display name from a resource slug when no explicit name is stored. */
-function titleCaseKey(slug) {
-	const normalized = slug.split(/[/_-]+/).filter(Boolean).join(" ");
-	if (!normalized) return PLATFORM_RESOURCE_UNSUPPORTED_TEXT;
-	return normalized.replace(/\b\w/g, (char) => char.toUpperCase());
-}
-//#endregion
-//#region src/routes/account/resources/agents.ts
-function formatModel(model) {
-	if (!model) return;
-	return model;
-}
-function toAgentSummary(row, options) {
-	return AgentSummarySchema.parse({
-		id: row.id,
-		slug: row.slug,
-		name: row.name?.trim() || titleCaseKey(row.slug),
-		description: row.description ?? void 0,
-		projectId: row.projectId,
-		updatedAt: row.updatedAt.toISOString(),
-		sourcePath: row.moduleFile,
-		model: formatModel(row.model),
-		toolCount: row.toolCount ?? void 0,
-		credentialCount: row.credentialCount ?? void 0,
-		lastRunAt: options?.lastRunAt?.toISOString()
-	});
-}
-//#endregion
-//#region src/routes/account/agents/GET.ts
-const handler$49 = async (c) => {
-	const filter = await resolveListProjectIds(c, listScope(c, agentListScope(accessContext(c))), c.req.query("projectId"));
-	if (filter === "empty") return c.json(AgentSummaryListResponseSchema.parse([]));
-	const rows = await listActiveAgents(filter);
-	const lastRunAtById = await selectAgentLastRunAtByIds(rows.map((row) => row.id));
-	return c.json(AgentSummaryListResponseSchema.parse(rows.map((row) => toAgentSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null }))));
-};
-//#endregion
-//#region src/routes/account/lib/touch-resource-activity.ts
-function touchResourceActivityBestEffort(options) {
-	deferRequestBackgroundTask(touchResourceActivity(options).catch(() => {}));
-}
-//#endregion
-//#region src/routes/account/agents/[agentId]/GET.ts
-const handler$48 = async (c) => {
-	const agentId = c.req.param("agentId") ?? "";
-	const row = agentId ? await selectActiveAgentById(agentId) : void 0;
-	if (!row || !await canAccessProjectId(c, row.projectId, canAccessAgent)) return c.json(AgentSummaryDetailResponseSchema.parse(null));
-	touchResourceActivityBestEffort({
-		userId: c.get("user").id,
-		projectId: row.projectId,
-		resourceKind: "agent",
-		resourceId: row.id
-	});
-	const lastRunAtById = await selectAgentLastRunAtByIds([row.id]);
-	return c.json(AgentSummaryDetailResponseSchema.parse(toAgentSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null })));
-};
-//#endregion
-//#region src/routes/account/history/cancel-run.ts
-/** Shared body for the workflow-run and agent-session cancel endpoints. */
-async function cancelHistoryRun(c, kind, cancel) {
-	const organizationContext = c.get("organization");
-	const id = c.req.param(kind === "workflow" ? "runId" : "sessionId") ?? "";
-	if (!id) return c.json(null, 404);
-	const core = await findHistoryRunCore(id);
-	if (!core || core.kind !== kind) return c.json(null, 404);
-	if (!await canAccessProjectId(c, core.projectId, canAccessHistoryRun)) return c.json(null, 404);
-	const run = await runWithProjectScope(core.projectId, () => cancel(id));
-	if (!run) return c.json(null, 404);
-	const organization = await selectOrganizationById(organizationContext.organizationId);
-	if (!organization) return c.json(null, 404);
-	await (await getProjectScheduler(organization, core.projectId)).publishCancel(id);
-	const grantedProjectIdsList = await grantedProjectIds(c, historyListScope(accessContext(c)));
-	const projects = await selectProjectsByOrganizationId(organizationContext.organizationId, { grantedProjectIds: grantedProjectIdsList });
-	const historyRun = await enrichHistoryRun(run, new Map(projects.map((project) => [project.id, project.name])));
-	return c.json(HistoryRunCancelResponseSchema.parse(historyRun));
-}
-//#endregion
-//#region src/routes/account/agents/sessions/[sessionId]/cancel/POST.ts
-const handler$47 = (c) => cancelHistoryRun(c, "agent", cancelAgentSession);
-//#endregion
-//#region src/routes/account/resources/workflows.ts
-function toWorkflowSummary(row, options) {
-	return WorkflowSummarySchema.parse({
-		id: row.id,
-		slug: row.slug,
-		name: row.name?.trim() || titleCaseKey(row.slug),
-		description: row.description ?? void 0,
-		projectId: row.projectId,
-		updatedAt: row.updatedAt.toISOString(),
-		sourcePath: row.moduleFile,
-		lastRunAt: options?.lastRunAt?.toISOString()
-	});
-}
-//#endregion
-//#region src/routes/account/workflows/GET.ts
-const handler$46 = async (c) => {
-	const filter = await resolveListProjectIds(c, listScope(c, workflowListScope(accessContext(c))), c.req.query("projectId"));
-	if (filter === "empty") return c.json(WorkflowSummaryListResponseSchema.parse([]));
-	const rows = await listActiveWorkflows(filter);
-	const lastRunAtById = await selectWorkflowLastRunAtByIds(rows.map((row) => row.id));
-	return c.json(WorkflowSummaryListResponseSchema.parse(rows.map((row) => toWorkflowSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null }))));
-};
-//#endregion
-//#region src/routes/account/workflows/[workflowId]/GET.ts
-const handler$45 = async (c) => {
-	const workflowId = c.req.param("workflowId") ?? "";
-	const row = workflowId ? await selectActiveWorkflowById(workflowId) : void 0;
-	if (!row || !await canAccessProjectId(c, row.projectId, canAccessWorkflow)) return c.json(WorkflowSummaryDetailResponseSchema.parse(null));
-	touchResourceActivityBestEffort({
-		userId: c.get("user").id,
-		projectId: row.projectId,
-		resourceKind: "workflow",
-		resourceId: row.id
-	});
-	const lastRunAtById = await selectWorkflowLastRunAtByIds([row.id]);
-	return c.json(WorkflowSummaryDetailResponseSchema.parse(toWorkflowSummary(row, { lastRunAt: lastRunAtById.get(row.id) ?? null })));
-};
-//#endregion
-//#region src/routes/account/workflows/runs/[runId]/cancel/POST.ts
-const handler$44 = (c) => cancelHistoryRun(c, "workflow", cancelWorkflowRun);
-//#endregion
-//#region src/routes/account/resources/skills.ts
-function toSkillSummary(row) {
-	return SkillSummarySchema.parse({
-		id: row.id,
-		slug: row.slug,
-		name: row.name?.trim() || titleCaseKey(row.slug),
-		description: row.description ?? void 0,
-		projectId: row.projectId,
-		updatedAt: row.updatedAt.toISOString(),
-		sourcePath: row.moduleFile
-	});
-}
-//#endregion
-//#region src/routes/account/skills/GET.ts
-const handler$43 = async (c) => {
-	const filter = await resolveListProjectIds(c, listScope(c, skillListScope(accessContext(c))), c.req.query("projectId"));
-	if (filter === "empty") return c.json(SkillSummaryListResponseSchema.parse([]));
-	const rows = await listActiveSkills(filter);
-	return c.json(SkillSummaryListResponseSchema.parse(rows.map(toSkillSummary)));
-};
-//#endregion
-//#region src/routes/account/skills/[skillId]/GET.ts
-const handler$42 = async (c) => {
-	const skillId = c.req.param("skillId") ?? "";
-	const row = skillId ? await selectActiveSkillById(skillId) : void 0;
-	if (!row || !await canAccessProjectId(c, row.projectId, canAccessSkill)) return c.json(SkillSummaryDetailResponseSchema.parse(null));
-	touchResourceActivityBestEffort({
-		userId: c.get("user").id,
-		projectId: row.projectId,
-		resourceKind: "skill",
-		resourceId: row.id
-	});
-	return c.json(SkillSummaryDetailResponseSchema.parse(toSkillSummary(row)));
-};
-//#endregion
-//#region src/routes/account/resources/recents.ts
-function toRecentResource(activity, resource, projectName) {
-	return RecentResourceSchema.parse({
-		id: activity.id,
-		resourceKind: activity.resourceKind,
-		resourceId: activity.resourceId,
-		name: resource.name,
-		projectId: resource.projectId,
-		projectName,
-		sourcePath: resource.sourcePath,
-		source: "owned",
-		lastOpenedAt: activity.lastOpenedAt.toISOString(),
-		lastModifiedAt: resource.lastModifiedAt.toISOString()
-	});
-}
-function hydrateRecentResource(activity, lookup, projectNameById) {
-	const resource = lookup[activity.resourceKind]?.get(activity.resourceId);
-	if (!resource) return null;
-	return toRecentResource(activity, resource, projectNameById.get(resource.projectId) ?? resource.projectId);
-}
-function hydratedResourceFromAgentRow(row) {
-	return {
-		name: row.name?.trim() || titleCaseKey(row.slug),
-		projectId: row.projectId,
-		sourcePath: row.moduleFile,
-		lastModifiedAt: row.updatedAt
-	};
-}
-function latestRecentInteractionAt(recent) {
-	return Math.max(new Date(recent.lastOpenedAt).getTime(), new Date(recent.lastModifiedAt).getTime());
-}
-//#endregion
-//#region src/routes/account/recents/GET.ts
-const RECENTS_LIMIT = 50;
-const handler$41 = async (c) => {
-	const userId = c.get("user").id;
-	const organization = c.get("organization");
-	const grantedProjectIdsList = await grantedProjectIds(c, { kind: "member-only" });
-	const activities = await listRecentResourceActivity(userId, RECENTS_LIMIT);
-	const visibleActivities = grantedProjectIdsList === void 0 ? activities : activities.filter((activity) => grantedProjectIdsList.includes(activity.projectId));
-	const agentIds = visibleActivities.filter((activity) => activity.resourceKind === "agent").map((activity) => activity.resourceId);
-	const workflowIds = visibleActivities.filter((activity) => activity.resourceKind === "workflow").map((activity) => activity.resourceId);
-	const skillIds = visibleActivities.filter((activity) => activity.resourceKind === "skill").map((activity) => activity.resourceId);
-	const [agents, workflows, skills, projects] = await Promise.all([
-		selectActiveAgentsByIds(agentIds),
-		selectActiveWorkflowsByIds(workflowIds),
-		selectActiveSkillsByIds(skillIds),
-		selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList })
-	]);
-	const projectNameById = new Map(projects.map((project) => [project.id, project.name]));
-	const lookup = {
-		agent: new Map(agents.map((row) => [row.id, hydratedResourceFromAgentRow(row)])),
-		workflow: new Map(workflows.map((row) => [row.id, hydratedResourceFromAgentRow(row)])),
-		skill: new Map(skills.map((row) => [row.id, hydratedResourceFromAgentRow(row)]))
-	};
-	const recents = visibleActivities.map((activity) => hydrateRecentResource(activity, lookup, projectNameById)).filter((recent) => recent !== null).sort((left, right) => latestRecentInteractionAt(right) - latestRecentInteractionAt(left));
-	return c.json(RecentResourceListResponseSchema.parse(recents));
-};
-//#endregion
-//#region src/routes/account/projects/GET.ts
-const handler$40 = async (c) => {
-	const organization = c.get("organization");
-	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
-	const projects = await selectProjectsByOrganizationId(organization.organizationId, { grantedProjectIds: grantedProjectIdsList });
-	return c.json(ListProjectsResponseSchema.parse(projects.map(mapProject)));
-};
-//#endregion
-//#region src/routes/account/projects/metrics/merge-project-list-metrics.ts
-function mergeProjectListMetrics(input) {
-	const projectIds = new Set([...Object.keys(input.resourceCounts), ...Object.keys(input.lastDeploymentAtByProject)]);
-	const metrics = {};
-	for (const projectId of projectIds) {
-		const counts = input.resourceCounts[projectId];
-		const lastDeploymentAt = input.lastDeploymentAtByProject[projectId];
-		metrics[projectId] = {
-			agentCount: counts?.agentCount ?? 0,
-			workflowCount: counts?.workflowCount ?? 0,
-			skillCount: counts?.skillCount ?? 0,
-			credentialCount: counts?.credentialCount ?? 0,
-			lastDeploymentAt: lastDeploymentAt ? lastDeploymentAt.toISOString() : null
-		};
-	}
-	return metrics;
-}
-//#endregion
-//#region src/routes/account/projects/metrics/GET.ts
-const handler$39 = async (c) => {
-	const organization = c.get("organization");
-	const grantedProjectIdsList = await grantedProjectIds(c, listScope(c, projectListScope(accessContext(c))));
-	const [resourceCounts, lastDeploymentAtByProject] = await Promise.all([selectProjectResourceCounts(grantedProjectIdsList !== void 0 ? { projectIds: grantedProjectIdsList } : void 0), selectLastDeploymentAtByProject(organization.organizationId)]);
-	let metrics = mergeProjectListMetrics({
-		resourceCounts,
-		lastDeploymentAtByProject
-	});
-	if (grantedProjectIdsList !== void 0) {
-		const allowed = new Set(grantedProjectIdsList);
-		metrics = Object.fromEntries(Object.entries(metrics).filter(([projectId]) => allowed.has(projectId)));
-	}
-	return c.json(ListProjectMetricsResponseSchema.parse(metrics));
-};
-//#endregion
-//#region src/routes/account/projects/POST.ts
-const handler$38 = async (c) => {
-	const organization = c.get("organization");
-	const user = c.get("user");
-	const body = await c.req.json().catch(() => null);
-	const parsed = CreateProjectRequestSchema.safeParse(body);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Project name is required" }), 400);
-	const project = await createProjectForOrganization(organization.organizationId, parsed.data.name, parsed.data.description, user.id);
-	return c.json(CreateProjectResponseSchema.parse(mapProject(project)), 201);
-};
-//#endregion
-//#region src/routes/account/projects/slug-available/GET.ts
-const handler$37 = async (c) => {
-	const organization = c.get("organization");
-	const parsed = ProjectSlugAvailabilityQuerySchema.safeParse({
-		slug: c.req.query("slug"),
-		excludeProjectId: c.req.query("excludeProjectId")
-	});
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
-	const availability = await checkProjectSlugAvailability(organization.organizationId, parsed.data.slug, parsed.data.excludeProjectId);
-	return c.json(ProjectSlugAvailabilityResponseSchema.parse(availability));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/GET.ts
-const handler$36 = async (c) => {
-	return c.json(ProjectResponseSchema.parse(routeProject(c.get("project"))));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/PATCH.ts
-const handler$35 = async (c) => {
-	const organization = c.get("organization");
-	const project = c.get("project");
-	const body = await c.req.json().catch(() => null);
-	const parsed = UpdateProjectRequestSchema.safeParse(body);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid project update request" }), 400);
-	let updated;
-	try {
-		updated = await updateProjectForOrganization(organization.organizationId, project.id, parsed.data);
-	} catch (error) {
-		if (error instanceof ProjectSlugTakenError) return c.json(ErrorResponseSchema.parse({ error: PROJECT_SLUG_TAKEN_MESSAGE }), 409);
-		throw error;
-	}
-	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(ProjectResponseSchema.parse(mapProject(updated)));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/DELETE.ts
-const handler$34 = async (c) => {
-	const organization = c.get("organization");
-	const project = c.get("project");
-	if (!await deleteProjectForOrganization(organization.organizationId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.body(null, 204);
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/deployments/GET.ts
-const handler$33 = async (c) => {
-	const rows = await selectProjectDeployments(c.get("project").id);
-	return c.json(ListProjectDeploymentsResponseSchema.parse(rows.map(mapProjectDeployment)));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/POST.ts
-const DEFAULT_PRESIGN_TTL_SECONDS$1 = 900;
-const ARTIFACT_CONTENT_TYPE = "application/gzip";
-const handler$32 = async (c) => {
-	const project = c.get("project");
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json({ error: "Organization not found" }, 404);
-	const artifactId = crypto.randomUUID();
-	const storageKey = projectArtifactKey(project.id, artifactId);
-	const storage = createOrgStorageClient(organization);
-	const artifact = await insertProjectArtifact({
-		id: artifactId,
-		projectId: project.id,
-		storageKey,
-		createdByUserId: c.get("user").id
-	});
-	const uploadUrl = await storage.presignPut({
-		key: storageKey,
-		contentType: ARTIFACT_CONTENT_TYPE,
-		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS$1
-	});
-	return c.json(CreateProjectArtifactResponseSchema.parse({
-		artifact: mapProjectArtifact(artifact),
-		uploadUrl,
-		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS$1
-	}), 201);
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/active/download/GET.ts
-const DEFAULT_PRESIGN_TTL_SECONDS = 900;
-const handler$31 = async (c) => {
-	const project = c.get("project");
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json({ error: "Organization not found" }, 404);
-	const artifact = await selectActiveProjectArtifactForProject(project.id);
-	if (!artifact) return c.json({ error: "No active artifact for project" }, 404);
-	const downloadUrl = await createOrgStorageClient(organization).presignGet({
-		key: artifact.storageKey,
-		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS
-	});
-	return c.json(DownloadActiveProjectArtifactResponseSchema.parse({
-		artifactId: artifact.id,
-		downloadUrl,
-		expiresInSeconds: DEFAULT_PRESIGN_TTL_SECONDS
-	}));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/complete/POST.ts
-const handler$30 = async (c) => {
-	const project = c.get("project");
-	const artifactId = c.req.param("artifactId");
-	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
-	const existing = await selectProjectArtifactForProject(artifactId, project.id);
-	if (!existing) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
-	if (existing.status === "ready") return c.json(ErrorResponseSchema.parse({ error: "Artifact already completed" }), 409);
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	const storage = createOrgStorageClient(organization);
-	const head = await storage.headObject(existing.storageKey);
-	if (!head || head.contentLength <= 0) return c.json(ErrorResponseSchema.parse({ error: "Artifact upload not found in storage" }), 400);
-	try {
-		const artifactBytes = await storage.getObject(existing.storageKey);
-		if (!artifactBytes || artifactBytes.byteLength <= 0) return c.json(ErrorResponseSchema.parse({ error: "Artifact upload not found in storage" }), 400);
-		const manifestJson = parseStoredRouteManifest(extractRouteManifestFromArtifact(Buffer.from(artifactBytes)));
-		const result = await completeProjectArtifact({
-			artifactId,
-			projectId: project.id,
-			manifestJson
-		});
-		await enqueueProjectRuntime({
-			projectId: project.id,
-			name: project.name,
-			artifactId
-		});
-		return c.json(CompleteProjectArtifactResponseSchema.parse({
-			artifact: mapProjectArtifact(result.artifact),
-			project: mapProject(result.project)
-		}));
-	} catch (error) {
-		const message = error instanceof Error ? error.message : "Failed to complete artifact";
-		return c.json(ErrorResponseSchema.parse({ error: message }), 400);
-	}
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/presign/POST.ts
-const SOURCE_BLOB_CONTENT_TYPE = "text/plain; charset=utf-8";
-const handler$29 = async (c) => {
-	const project = c.get("project");
-	const artifactId = c.req.param("artifactId");
-	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
-	if (!await selectProjectArtifactForProject(artifactId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
-	const parsed = PresignProjectSourceRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid blob list" }), 400);
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	const storage = createOrgStorageClient(organization);
-	const hashes = [...new Set(parsed.data.blobs.map((blob) => blob.hash))];
-	const uploads = await Promise.all(hashes.map(async (hash) => {
-		const key = projectSourceBlobKey(project.id, hash);
-		const head = await storage.headObject(key);
-		if (head && head.contentLength > 0) return null;
-		return {
-			hash,
-			url: await storage.presignPut({
-				key,
-				contentType: SOURCE_BLOB_CONTENT_TYPE
-			})
-		};
-	}));
-	return c.json(PresignProjectSourceResponseSchema.parse({ uploads: uploads.filter((upload) => upload !== null) }));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/source/manifest/POST.ts
-const handler$28 = async (c) => {
-	const project = c.get("project");
-	const artifactId = c.req.param("artifactId");
-	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
-	if (!await selectProjectArtifactForProject(artifactId, project.id)) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
-	const parsed = UploadProjectSourceManifestRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid source manifest" }), 400);
-	const manifest = StoredProjectSourceManifestSchema.parse({
-		files: parsed.data.files.map((file) => ({
-			id: projectFileId(file.path),
-			path: file.path,
-			hash: file.hash
-		})),
-		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	});
-	await updateProjectArtifactSourceManifest({
-		artifactId,
-		projectId: project.id,
-		sourceManifestJson: manifest
-	});
-	return c.json(UploadProjectSourceResponseSchema.parse({
-		ok: true,
-		fileCount: manifest.files.length
-	}), 201);
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/files/GET.ts
-/**
-* Resolve registry moduleFile values to paths in the deploy source snapshot.
-*
-* New deploys store project-root-relative source paths (`src/agents/support.ts`),
-* matched exactly. Rows synced by older runtimes hold module-dir-relative values
-* (`support.ts` under `src/agents/`), matched by suffix. Resources without a
-* match are dropped rather than emitting paths clients can't find in the tree.
-*/
-function resolveSourcePaths(rows, kindDir, filePaths) {
-	return rows.flatMap((row) => {
-		const suffix = `${kindDir}/${row.moduleFile}`;
-		const path = filePaths.find((filePath) => filePath === row.moduleFile) ?? filePaths.find((filePath) => filePath === suffix || filePath.endsWith(`/${suffix}`));
-		return path ? [{
-			slug: row.slug,
-			path
-		}] : [];
-	});
-}
-const handler$27 = async (c) => {
-	const project = c.get("project");
-	const active = await selectActiveArtifactSourceManifestForProject(project.id);
-	if (!active || !active.sourceManifestJson) return c.json(ListProjectFilesResponseSchema.parse({
-		artifactId: active?.artifactId ?? null,
-		files: []
-	}));
-	const manifest = StoredProjectSourceManifestSchema.parse(active.sourceManifestJson);
-	const [agents, workflows, skills] = await Promise.all([
-		listActiveAgents({ projectIds: [project.id] }),
-		listActiveWorkflows({ projectIds: [project.id] }),
-		listActiveSkills({ projectIds: [project.id] })
-	]);
-	const filePaths = manifest.files.map((file) => file.path);
-	const resources = ProjectSourceResourcesSchema.parse({
-		agents: resolveSourcePaths(agents, "agents", filePaths),
-		workflows: resolveSourcePaths(workflows, "workflows", filePaths),
-		skills: skills.map((row) => ({
-			slug: row.slug,
-			path: row.moduleFile
-		}))
-	});
-	return c.json(ListProjectFilesResponseSchema.parse({
-		artifactId: active.artifactId,
-		files: manifest.files.map((file) => ({
-			id: file.id,
-			path: file.path,
-			hash: file.hash
-		})),
-		resources
-	}));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/artifacts/[artifactId]/files/content/GET.ts
-const handler$26 = async (c) => {
-	const project = c.get("project");
-	const artifactId = c.req.param("artifactId");
-	if (!artifactId) return c.json(ErrorResponseSchema.parse({ error: "Artifact id is required" }), 400);
-	const path = c.req.query("path");
-	if (!path) return c.json(ErrorResponseSchema.parse({ error: "File path is required" }), 400);
-	const artifact = await selectProjectArtifactForProject(artifactId, project.id);
-	if (!artifact || !artifact.sourceManifestJson) return c.json(ErrorResponseSchema.parse({ error: "Artifact not found" }), 404);
-	const file = StoredProjectSourceManifestSchema.parse(artifact.sourceManifestJson).files.find((entry) => entry.path === path);
-	if (!file) return c.json(ErrorResponseSchema.parse({ error: "File not found" }), 404);
-	const { organizationId } = c.get("organization");
-	const organization = await selectOrganizationById(organizationId);
-	if (!organization) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	const storage = createOrgStorageClient(organization);
-	let bytes;
-	try {
-		bytes = await storage.getObject(projectSourceBlobKey(project.id, file.hash));
-	} catch {
-		return c.json(ErrorResponseSchema.parse({ error: "File contents not found" }), 404);
-	}
-	c.header("Content-Type", "text/plain; charset=utf-8");
-	return c.body(new TextDecoder().decode(bytes));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/reachability/GET.ts
-function createProjectReachabilityHandler(hosting) {
-	return async (c) => {
-		const project = c.get("project");
-		if (project.status !== "active") return c.json(ProjectReachabilityResponseSchema.parse({ reachable: false }));
-		const organization = await selectOrganizationById(project.organizationId);
-		const reachable = await pingProjectTarget({
-			baseUrl: organization?.baseUrl ?? project.baseUrl,
-			runtimeId: organization?.runtimeId ?? project.runtimeId
-		}, { plugin: hosting });
-		return c.json(ProjectReachabilityResponseSchema.parse({ reachable }));
-	};
-}
-//#endregion
-//#region src/routes/account/projects/[projectId]/members/GET.ts
-const handler$25 = async (c) => {
-	const project = c.get("project");
-	const currentUserId = c.get("user").id;
-	const members = await selectProjectMembers(project.id);
-	return c.json(ListProjectMembersResponseSchema.parse(members.map((member) => mapProjectMember(member, { isCurrentUser: member.id === currentUserId }))));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/members/POST.ts
-const handler$24 = async (c) => {
-	const organization = c.get("organization");
-	const project = c.get("project");
-	const body = await c.req.json().catch(() => null);
-	const parsed = InviteProjectMembersRequestSchema.safeParse(body);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid invite request" }), 400);
-	const results = await inviteProjectMembers({
-		projectId: project.id,
-		organizationId: organization.organizationId,
-		emails: parsed.data.emails,
-		role: parsed.data.role
-	});
-	return c.json(InviteProjectMembersResponseSchema.parse(results));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/members/[userId]/PATCH.ts
-const handler$23 = async (c) => {
-	const project = c.get("project");
-	const userId = c.req.param("userId");
-	const body = await c.req.json().catch(() => null);
-	const parsed = UpdateProjectMemberRequestSchema.safeParse(body);
-	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
-	try {
-		const member = await updateProjectMemberRole(project.id, userId, parsed.data.role);
-		return c.json(UpdateProjectMemberResponseSchema.parse(mapProjectMember(member)));
-	} catch (error) {
-		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/members/[userId]/DELETE.ts
-const handler$22 = async (c) => {
-	const project = c.get("project");
-	const userId = c.req.param("userId");
-	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
-	try {
-		await removeProjectMember(project.id, userId);
-		return c.body(null, 204);
-	} catch (error) {
-		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/members/me/DELETE.ts
-const handler$21 = async (c) => {
-	const project = c.get("project");
-	const userId = c.get("user").id;
-	try {
-		await removeProjectMember(project.id, userId);
-		return c.body(null, 204);
-	} catch (error) {
-		if (error instanceof ProjectMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/settings/GET.ts
-const handler$20 = async (c) => {
-	const project = c.get("project");
-	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(project)));
-};
-//#endregion
-//#region src/routes/account/projects/[projectId]/settings/PATCH.ts
-const handler$19 = async (c) => {
-	const organization = c.get("organization");
-	const project = c.get("project");
-	const body = await c.req.json().catch(() => null);
-	const parsed = UpdateProjectSettingsRequestSchema.safeParse(body);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid project settings request" }), 400);
-	const updated = await updateProjectSettings(organization.organizationId, project.id, {
-		description: parsed.data.description,
-		defaultMemberRole: parsed.data.defaultRole,
-		invitePermission: parsed.data.invitePermission
-	});
-	if (!updated) return c.json(ErrorResponseSchema.parse({ error: "Project not found" }), 404);
-	return c.json(ProjectSettingsResponseSchema.parse(mapProjectSettings(updated)));
-};
-//#endregion
-//#region src/routes/account/credentials/enrich.ts
-const APP_CREDENTIAL_SCOPES = [
-	"user",
-	"project",
-	"organization"
-];
-function toAppCredentialScope(scopeType) {
-	return APP_CREDENTIAL_SCOPES.includes(scopeType) ? scopeType : null;
-}
-/** Run `fn` with the row's project scope bound (no-op for org/user rows). */
-function withCredentialRowScope(row, fn) {
-	if (row.scopeType === "project") return runWithProjectScope(row.projectId, fn);
-	return fn();
-}
-/** User-scoped credentials are only manageable by their owner. */
-function canManageCredential(row, userId) {
-	if (row.scopeType === "user") return userId !== void 0 && row.scopeId === userId;
-	return true;
-}
-/** Display name derived from the app slug (org-custom slugs use the segment after `/`). */
-function displayAppName(appId) {
-	try {
-		const parsed = parseAppSlug(appId);
-		if (parsed.kind === "org") return displayCredentialAppName(parsed.name);
-	} catch {}
-	return displayCredentialAppName(appId);
-}
-/** Masked preview of a secret — last 4 chars revealed, the rest masked. Plaintext never returned. */
-function maskSecretPreview(value) {
-	const trimmed = value.trim();
-	if (trimmed.length <= 4) return "•".repeat(Math.max(trimmed.length, 4));
-	return `${"•".repeat(Math.min(trimmed.length - 4, 20))}${trimmed.slice(-4)}`;
-}
-async function readSecretKeyPreviews(instanceId) {
-	const payload = await readCredentialInstanceSecret(instanceId);
-	if (!payload) return null;
-	let parsed;
-	try {
-		parsed = JSON.parse(payload);
-	} catch {
-		return null;
-	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const keyPreviews = {};
-	for (const [key, value] of Object.entries(parsed)) keyPreviews[key] = maskSecretPreview(typeof value === "string" ? value : JSON.stringify(value));
-	const credentialKeys = Object.keys(keyPreviews);
-	return credentialKeys.length > 0 ? {
-		credentialKeys,
-		keyPreviews
-	} : null;
-}
-function ownerFields(owner) {
-	if (!owner) return {};
-	return {
-		ownerUserId: owner.id,
-		ownerName: owner.name,
-		...owner.image && URL.canParse(owner.image) ? { ownerAvatarUrl: owner.image } : {}
-	};
-}
-function uniqueIds(rows, pick) {
-	return [...new Set(rows.map(pick).filter((id) => Boolean(id)))];
-}
-/** Cross-database lookups: instances live in the org DB; projects/users/connections in the platform DB. */
-async function loadCredentialLookups(rows, organizationId) {
-	const [projects, owners, connections] = await Promise.all([
-		selectProjectsByOrganizationId(organizationId),
-		selectUsersByIds(uniqueIds(rows, (row) => row.scopeType === "user" ? row.scopeId : null)),
-		selectOAuthConnectionsByIds(uniqueIds(rows, (row) => row.authKind === "oauth_managed" ? row.connectionId : null))
-	]);
-	return {
-		projectNameById: new Map(projects.map((project) => [project.id, project.name])),
-		ownersById: new Map(owners.map((owner) => [owner.id, owner])),
-		connectionsById: new Map(connections.map((connection) => [connection.id, connection]))
-	};
-}
-async function toCredentialSummary(row, scope, lookups) {
-	const isOAuth = row.authKind === "oauth_managed";
-	const isKeystroke = row.authKind === "keystroke";
-	const appName = displayAppName(row.slug);
-	const connection = row.connectionId ? lookups.connectionsById.get(row.connectionId) : void 0;
-	const secretKeys = isOAuth || isKeystroke ? null : await readSecretKeyPreviews(row.id);
-	const projectId = scope === "project" ? row.scopeId ?? row.projectId : void 0;
-	const projectName = projectId ? lookups.projectNameById.get(projectId) : void 0;
-	return {
-		id: row.id,
-		appId: row.slug,
-		label: row.label ?? appName,
-		scope,
-		lastRefreshedAt: isOAuth ? connection?.updatedAt.toISOString() ?? null : null,
-		appName,
-		...projectId ? { projectId } : {},
-		...projectName ? { projectName } : {},
-		status: isOAuth && !connection ? "Disconnected" : "Active",
-		createdAt: row.createdAt.toISOString(),
-		lastUsedAt: null,
-		isDefault: Boolean(row.isDefault),
-		connectionKind: isOAuth ? "oauth" : isKeystroke ? "oauth" : "manual",
-		...scope === "user" && row.scopeId ? ownerFields(lookups.ownersById.get(row.scopeId)) : {},
-		...connection?.grantedScopes?.length ? { grantedScopes: connection.grantedScopes } : {},
-		...secretKeys ?? {},
-		...connection?.accessTokenExpiresAt ? { expiresAt: connection.accessTokenExpiresAt.toISOString() } : {}
-	};
-}
-/** Build `AppCredentialSummary` rows from org-database instances plus platform lookups. */
-async function enrichCredentialInstances(rows, organizationId) {
-	const visible = rows.filter((row) => toAppCredentialScope(row.scopeType) !== null);
-	const lookups = await loadCredentialLookups(visible, organizationId);
-	return (await Promise.all(visible.map((row) => toCredentialSummary(row, toAppCredentialScope(row.scopeType), lookups)))).sort((a, b) => new Date(b.createdAt ?? 0).getTime() - new Date(a.createdAt ?? 0).getTime());
-}
-//#endregion
-//#region src/routes/account/credentials/GET.ts
-const handler$18 = async (c) => {
-	const organization = c.get("organization");
-	const credentials = await enrichCredentialInstances(await listAllCredentialInstances(), organization.organizationId);
-	return c.json(ListCredentialsResponseSchema.parse(credentials));
-};
-//#endregion
-//#region src/routes/account/credentials/POST.ts
-function withTargetScope(target, fn) {
-	if (target.projectScope) return runWithProjectScope(target.projectScope, fn);
-	return fn();
-}
-const handler$17 = async (c) => {
-	const organization = c.get("organization");
-	const user = c.get("user");
-	const parsed = CreateCredentialsRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) {
-		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
-		return c.json({ error: message }, 400);
-	}
-	const input = parsed.data;
-	if (input.connectionKind === "manual" && input.value) {
-		const app = await selectAppForOrganization(organization.organizationId, input.appId);
-		if (app && hasCredentialFieldTemplate(app)) {
-			const validation = validateCredentialValueAgainstFields(app.credentialFields, input.value);
-			if (!validation.ok) return c.json({ error: validation.message }, 400);
-		}
-	}
-	const resolvedProjects = [];
-	for (const slug of input.projects) {
-		const project = await selectProjectForOrganizationBySlug(organization.organizationId, slug);
-		if (!project) return c.json({ error: `Project "${slug}" not found` }, 400);
-		resolvedProjects.push({
-			id: project.id,
-			name: project.name
-		});
-	}
-	const targets = [
-		...resolvedProjects.map((project) => ({
-			scopeType: "project",
-			scopeId: project.id,
-			projectScope: project.id,
-			projectName: project.name
-		})),
-		...input.createOrganizationCredential ? [{
-			scopeType: "organization",
-			scopeId: getServerTenantScopeId()
-		}] : [],
-		...input.createUserProvidedCredential ? [{
-			scopeType: "user",
-			scopeId: user.id
-		}] : []
-	];
-	const appName = displayCredentialAppName(input.appId);
-	const siblingCounts = /* @__PURE__ */ new Map();
-	for (const target of targets) {
-		const siblings = await withTargetScope(target, () => selectCredentialInstancesForScope(input.appId, target.scopeType, target.scopeId));
-		siblingCounts.set(target, siblings.length);
-	}
-	const value = input.value;
-	const createdIds = [];
-	for (const target of targets) {
-		const siblings = await withTargetScope(target, () => selectCredentialInstancesForScope(input.appId, target.scopeType, target.scopeId));
-		const label = resolveUniqueCredentialInstanceLabel({
-			baseLabel: input.label?.trim() || buildCredentialInstanceLabel({
-				scopeType: target.scopeType,
-				appName,
-				projectName: target.projectName
-			}),
-			takenLabels: siblings.map((row) => row.label)
-		});
-		const id = crypto.randomUUID();
-		await withTargetScope(target, () => setCredentialInstanceSecret({
-			id,
-			key: input.appId,
-			scopeType: target.scopeType,
-			scopeId: target.scopeId,
-			label,
-			isDefault: (siblingCounts.get(target) ?? 0) === 0,
-			value
-		}));
-		createdIds.push(id);
-	}
-	const rows = [];
-	for (const id of createdIds) {
-		const row = await selectCredentialInstanceById(id);
-		if (row) rows.push(row);
-	}
-	const credentials = await enrichCredentialInstances(rows, organization.organizationId);
-	return c.json(CreateCredentialsResponseSchema.parse(credentials), 201);
-};
-//#endregion
-//#region src/routes/account/credentials/[credentialId]/GET.ts
-const handler$16 = async (c) => {
-	const organization = c.get("organization");
-	const credentialId = c.req.param("credentialId") ?? "";
-	const row = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
-	if (!row || toAppCredentialScope(row.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
-	const [credential] = await enrichCredentialInstances([row], organization.organizationId);
-	return c.json(GetCredentialResponseSchema.parse(credential));
-};
-//#endregion
-//#region src/routes/account/credentials/[credentialId]/PATCH.ts
-const handler$15 = async (c) => {
-	const organization = c.get("organization");
-	const user = c.get("user");
-	const credentialId = c.req.param("credentialId") ?? "";
-	const existing = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
-	if (!existing || toAppCredentialScope(existing.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
-	if (!canManageCredential(existing, user.id)) return c.json({ error: "Forbidden" }, 403);
-	const parsed = UpdateCredentialRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) {
-		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
-		return c.json({ error: message }, 400);
-	}
-	if (parsed.data.value && existing.authKind !== "api_key") return c.json({ error: "Only api-key credentials support secret rotation" }, 400);
-	const label = parsed.data.label !== void 0 ? parsed.data.label : existing.label;
-	const isDefault = parsed.data.isDefault !== void 0 ? parsed.data.isDefault : Boolean(existing.isDefault);
-	if (label !== existing.label) {
-		if ((await withCredentialRowScope(existing, () => selectCredentialInstancesForScope(existing.slug, existing.scopeType, existing.scopeId))).some((row) => row.id !== credentialId && (row.label ?? null) === label)) return c.json({ error: "A credential with this label already exists" }, 409);
-	}
-	await withCredentialRowScope(existing, async () => {
-		if (parsed.data.value) {
-			await setCredentialInstanceSecret({
-				id: existing.id,
-				key: existing.slug,
-				scopeType: existing.scopeType,
-				scopeId: existing.scopeId,
-				label,
-				isDefault,
-				value: parsed.data.value
-			});
-			return;
-		}
-		if (isDefault) await clearCredentialInstanceDefaults({
-			slug: existing.slug,
-			scopeType: existing.scopeType,
-			scopeId: existing.scopeId,
-			exceptId: credentialId
-		});
-		await upsertCredentialInstance({
-			id: existing.id,
-			slug: existing.slug,
-			scopeType: existing.scopeType,
-			scopeId: existing.scopeId,
-			label,
-			isDefault,
-			authKind: existing.authKind,
-			ciphertext: existing.ciphertext,
-			connectionId: existing.connectionId,
-			createdAt: existing.createdAt,
-			updatedAt: /* @__PURE__ */ new Date()
-		});
-	});
-	const updated = await selectCredentialInstanceById(credentialId);
-	const [credential] = await enrichCredentialInstances(updated ? [updated] : [], organization.organizationId);
-	return c.json(GetCredentialResponseSchema.parse(credential));
-};
-//#endregion
-//#region src/routes/account/credentials/[credentialId]/DELETE.ts
-function createDeleteCredentialHandler(options = {}) {
-	return async (c) => {
-		const user = c.get("user");
-		const credentialId = c.req.param("credentialId") ?? "";
-		const existing = credentialId ? await selectCredentialInstanceById(credentialId) : void 0;
-		if (!existing || toAppCredentialScope(existing.scopeType) === null) return c.json({ error: "Credential not found" }, 404);
-		if (!canManageCredential(existing, user.id)) return c.json({ error: "Forbidden" }, 403);
-		if (existing.authKind === "oauth_managed") {
-			if (existing.connectionId) {
-				if ((await listCredentialInstancesByConnectionId(existing.connectionId)).every((row) => row.id === existing.id)) await deleteOAuthConnectionById(existing.connectionId);
-			}
-		} else if (existing.authKind === "keystroke") {
-			if (existing.connectionId) {
-				if ((await listCredentialInstancesByConnectionId(existing.connectionId)).every((row) => row.id === existing.id)) {
-					if (!options.mcp) return c.json({ error: "mcp_unconfigured" }, 501);
-					await options.mcp.revokeConnection(resolveMcpEntityId(existing), existing.connectionId);
-				}
-			}
-		} else await deleteCredentialInstanceSecret(existing.id);
-		await deleteCredentialInstanceById(credentialId);
-		return c.body(null, 204);
-	};
-}
-//#endregion
-//#region src/routes/account/members/GET.ts
-const handler$14 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const members = await selectOrganizationMembers(organizationId);
-	return c.json(ListOrganizationMembersResponseSchema.parse(members.map(mapOrganizationMember)));
-};
-//#endregion
-//#region src/email/organization-invite-email.ts
-function envValue(name) {
-	return process.env[name]?.trim() || void 0;
-}
-function resolveOrganizationInviteUrl(invitationId) {
-	return `${(envValue("PUBLIC_WEB_URL") ?? "http://localhost:3000").replace(/\/$/, "")}${organizationInvitationAcceptPath(invitationId)}`;
-}
-function resolveResendApiKey() {
-	return envValue("RESEND_API_KEY");
-}
-function buildOrganizationInviteEmailHtml(payload) {
-	const inviteUrl = resolveOrganizationInviteUrl(payload.invitationId);
-	const escapedOrg = payload.organizationName.replaceAll("&", "&amp;").replaceAll("<", "&lt;");
-	return `<!DOCTYPE html>
-<html>
-  <body style="font-family: system-ui, sans-serif; line-height: 1.5; color: #111;">
-    ${payload.inviterName ? `<p>${payload.inviterName.replaceAll("&", "&amp;").replaceAll("<", "&lt;")} invited you to join <strong>${escapedOrg}</strong> on Keystroke.</p>` : `<p>You have been invited to join <strong>${escapedOrg}</strong> on Keystroke.</p>`}
-    <p><a href="${inviteUrl}" style="display: inline-block; padding: 10px 16px; background: #111; color: #fff; text-decoration: none; border-radius: 8px;">View invitation</a></p>
-    <p style="color: #666; font-size: 13px;">Sign in with this email address to accept the invitation.</p>
-  </body>
-</html>`;
-}
-async function sendOrganizationInviteEmail(payload, resend) {
-	const apiKey = resolveResendApiKey();
-	if (!apiKey) {
-		console.warn("[platform] RESEND_API_KEY not set; organization invite email skipped");
-		return false;
-	}
-	const { error } = await (resend ?? new Resend(apiKey)).emails.send({
-		from: resolveAuthEmailFrom(),
-		to: payload.email,
-		subject: `Invitation to join ${payload.organizationName} on Keystroke`,
-		html: buildOrganizationInviteEmailHtml(payload)
-	});
-	if (error) {
-		console.warn(`[platform] Failed to send organization invite email: ${error.message}`);
-		return false;
-	}
-	return true;
-}
-//#endregion
-//#region src/routes/account/members/invitations/POST.ts
-const handler$13 = async (c) => {
-	const user = c.get("user");
-	const organization = c.get("organization");
-	const body = await c.req.json().catch(() => null);
-	const parsed = InviteOrganizationMembersRequestSchema.safeParse(body);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid invite request" }), 400);
-	const results = await inviteOrganizationMembers({
-		organizationId: organization.organizationId,
-		invitedByUserId: user.id,
-		emails: parsed.data.emails,
-		role: parsed.data.role
-	});
-	const inviter = await selectUserById(user.id);
-	for (const result of results) {
-		if (!result.invitationId || result.status !== "sent" && result.status !== "pending") continue;
-		await sendOrganizationInviteEmail({
-			email: result.email,
-			organizationName: organization.organizationName,
-			invitationId: result.invitationId,
-			inviterName: inviter?.name
-		});
-	}
-	return c.json(InviteOrganizationMembersResponseSchema.parse(results));
-};
-//#endregion
-//#region src/routes/account/members/[userId]/PATCH.ts
-const handler$12 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const userId = c.req.param("userId");
-	const body = await c.req.json().catch(() => null);
-	const parsed = UpdateOrganizationMemberRequestSchema.safeParse(body);
-	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid member update request" }), 400);
-	try {
-		const member = await updateOrganizationMemberRole(organizationId, userId, parsed.data.role);
-		return c.json(UpdateOrganizationMemberResponseSchema.parse(mapOrganizationMember(member)));
-	} catch (error) {
-		if (error instanceof CannotModifyOwnerError || error instanceof OrganizationMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/members/[userId]/DELETE.ts
-const handler$11 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const userId = c.req.param("userId");
-	if (!userId) return c.json(ErrorResponseSchema.parse({ error: "User id is required" }), 400);
-	try {
-		await removeOrganizationMember(organizationId, userId);
-		return c.body(null, 204);
-	} catch (error) {
-		if (error instanceof CannotModifyOwnerError || error instanceof OrganizationMemberNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 400);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/invitations/GET.ts
-const handler$10 = async (c) => {
-	const invitations = await selectPendingInvitationsForUser(c.get("user").id);
-	return c.json(ListOrganizationInvitationsResponseSchema.parse(invitations.map(mapOrganizationInvitation)));
-};
-//#endregion
-//#region src/routes/account/invitations/[invitationId]/accept/POST.ts
-const handler$9 = async (c) => {
-	const user = c.get("user");
-	const invitationId = c.req.param("invitationId");
-	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
-	try {
-		const membership = await acceptInvitation(invitationId, user.id);
-		return c.json(AcceptOrganizationInvitationResponseSchema.parse(mapUserOrganization(membership)));
-	} catch (error) {
-		if (error instanceof OrganizationInvitationNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
-		if (error instanceof OrganizationInvitationForbiddenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 403);
-		if (error instanceof OrganizationInvitationExpiredError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 410);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/invitations/[invitationId]/decline/POST.ts
-const handler$8 = async (c) => {
-	const user = c.get("user");
-	const invitationId = c.req.param("invitationId");
-	if (!invitationId) return c.json(ErrorResponseSchema.parse({ error: "Invitation id is required" }), 400);
-	try {
-		await declineInvitation(invitationId, user.id);
-		return c.json(DeclineOrganizationInvitationResponseSchema.parse({ success: true }));
-	} catch (error) {
-		if (error instanceof OrganizationInvitationNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
-		if (error instanceof OrganizationInvitationForbiddenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 403);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/apps/map-catalog.ts
-/** Map a platform `apps` row to the connect-picker wire shape. */
-function appRowToCatalogEntry(row) {
-	return {
-		id: row.slug,
-		name: row.name,
-		description: row.description,
-		category: row.category,
-		integrationDescription: row.description,
-		...row.logo ? { logo: row.logo } : {},
-		authKind: row.authKind,
-		oauthScopes: row.oauthScopes,
-		source: row.source,
-		...hasCredentialFieldTemplate(row) ? { credentialFields: row.credentialFields } : {}
-	};
-}
-function appRowToCustomAppDetail(row) {
-	if (row.source !== "custom" || row.authKind !== "api_key") throw new Error(`App is not a custom api_key app: ${row.slug}`);
-	if (!hasCredentialFieldTemplate(row)) throw new Error(`Custom app is missing credential fields: ${row.slug}`);
-	return {
-		id: row.slug,
-		slug: row.slug,
-		name: row.name,
-		description: row.description,
-		category: row.category,
-		authKind: "api_key",
-		source: "custom",
-		credentialFields: row.credentialFields,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	};
-}
-//#endregion
-//#region src/routes/account/apps/GET.ts
-const handler$7 = async (c) => {
-	const apps = (await listAppsForOrganization(c.get("organization").organizationId)).map(appRowToCatalogEntry);
-	return c.json(ListAppsResponseSchema.parse(apps));
-};
-//#endregion
-//#region src/routes/account/apps/POST.ts
-const handler$6 = async (c) => {
-	const organization = c.get("organization");
-	const parsed = CreateCustomAppRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) {
-		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
-		return c.json(ErrorResponseSchema.parse({ error: message }), 400);
-	}
-	const org = await selectOrganizationById(organization.organizationId);
-	if (!org) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	try {
-		const row = await createOrgApp({
-			organizationId: organization.organizationId,
-			orgSlug: org.slug,
-			name: parsed.data.name,
-			slug: parsed.data.slug,
-			description: parsed.data.description,
-			credentialFields: parsed.data.fields
-		});
-		return c.json(CreateCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)), 201);
-	} catch (error) {
-		if (error instanceof OrgAppSlugTakenError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 409);
-		throw error;
-	}
-};
-//#endregion
-//#region src/routes/account/apps/slug-available/GET.ts
-const handler$5 = async (c) => {
-	const organization = c.get("organization");
-	const parsed = AppSlugAvailabilityQuerySchema.safeParse({ slug: c.req.query("slug") });
-	if (!parsed.success) return c.json(ErrorResponseSchema.parse({ error: "Invalid slug query" }), 400);
-	const org = await selectOrganizationById(organization.organizationId);
-	if (!org) return c.json(ErrorResponseSchema.parse({ error: "Organization not found" }), 404);
-	const availability = await checkOrgAppSlugAvailability(org.slug, parsed.data.slug);
-	return c.json(AppSlugAvailabilityResponseSchema.parse(availability));
-};
-//#endregion
-//#region src/routes/account/apps/[slug]/GET.ts
-const handler$4 = async (c) => {
-	const organization = c.get("organization");
-	const slug = c.req.param("slug") ?? "";
-	if (!slug) return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
-	const row = await selectAppForOrganization(organization.organizationId, decodeURIComponent(slug));
-	if (!row || row.source !== "custom") return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
-	try {
-		return c.json(GetCustomAppResponseSchema.parse(appRowToCustomAppDetail(row)));
-	} catch {
-		return c.json(ErrorResponseSchema.parse({ error: "App not found" }), 404);
-	}
-};
-//#endregion
-//#region src/routes/account/api-keys/GET.ts
-const handler$3 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const user = c.get("user");
-	const records = apiKeyListScope(accessContext(c)).kind === "all" ? await listOrgPlatformApiKeysForOrganization(organizationId) : await listOrgPlatformApiKeysForUser(organizationId, user.id);
-	const creators = await selectUsersByIds([...new Set(records.map((record) => record.createdByUserId))]);
-	const creatorsById = new Map(creators.map((creator) => [creator.id, creator]));
-	return c.json(ListApiKeysResponseSchema.parse(records.map((record) => ({
-		id: record.id,
-		name: record.name,
-		keyPreview: record.keyPreview,
-		createdAt: record.createdAt.toISOString(),
-		createdBy: mapOrgPlatformApiKeyCreatorOrDeleted(record.createdByUserId, creatorsById.get(record.createdByUserId)),
-		isCreatedByCurrentUser: record.createdByUserId === user.id
-	}))));
-};
-//#endregion
-//#region src/routes/account/api-keys/POST.ts
-const handler$2 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const user = c.get("user");
-	const body = CreateApiKeyRequestSchema.parse(await c.req.json());
-	const created = await createOrgPlatformApiKey({
-		organizationId,
-		userId: user.id,
-		name: body.name
-	});
-	const creator = await loadOrgPlatformApiKeyUser(user.id);
-	if (!creator) return c.json({ error: "User not found" }, 404);
-	return c.json(CreateApiKeyResponseSchema.parse({
-		id: created.id,
-		name: created.name,
-		keyPreview: created.keyPreview,
-		createdAt: created.createdAt.toISOString(),
-		createdBy: mapOrgPlatformApiKeyCreator(creator),
-		isCreatedByCurrentUser: true,
-		secret: created.secret
-	}), 201);
-};
-//#endregion
-//#region src/routes/account/api-keys/[apiKeyId]/DELETE.ts
-const handler$1 = async (c) => {
-	const { organizationId } = c.get("organization");
-	const user = c.get("user");
-	const apiKeyId = c.req.param("apiKeyId");
-	if (!apiKeyId) return c.json(ErrorResponseSchema.parse({ error: "API key id is required" }), 400);
-	const apiKey = await selectOrgPlatformApiKeyForOrganization(apiKeyId, organizationId);
-	if (!apiKey) return c.json(ErrorResponseSchema.parse({ error: "API key not found" }), 404);
-	if (!canReadApiKey(accessContext(c), {
-		userId: user.id,
-		createdByUserId: apiKey.createdByUserId
-	})) return c.json(ErrorResponseSchema.parse({ error: "API key not found" }), 404);
-	if (!canRevokeApiKey(accessContext(c), {
-		userId: user.id,
-		createdByUserId: apiKey.createdByUserId
-	})) return forbidden(c);
-	try {
-		await revokeOrgPlatformApiKey(apiKeyId, organizationId);
-		return c.body(null, 204);
-	} catch (error) {
-		if (error instanceof OrgPlatformApiKeyNotFoundError) return c.json(ErrorResponseSchema.parse({ error: error.message }), 404);
-		throw error;
-	}
-};
-//#endregion
-//#region src/lib/team-request-slack.ts
-const TEAM_REQUEST_HEADINGS = {
-	"org-deletion": "Org deletion requested",
-	contact: "Contact request",
-	"enterprise-upgrade": "Enterprise upgrade requested"
-};
-function buildTeamRequestSlackPayload(input) {
-	const timestamp = input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
-	const heading = TEAM_REQUEST_HEADINGS[input.type];
-	const summary = `${heading} from ${input.user.name} (${input.org.name})`;
-	const fields = [
-		{
-			type: "mrkdwn",
-			text: `*Request type:*\n${input.type}`
-		},
-		{
-			type: "mrkdwn",
-			text: `*Timestamp:*\n${timestamp}`
-		},
-		{
-			type: "mrkdwn",
-			text: `*User:*\n${input.user.name}\n${input.user.email}\n\`${input.user.id}\``
-		},
-		{
-			type: "mrkdwn",
-			text: `*Organization:*\n${input.org.name}\n\`${input.org.slug}\`\n\`${input.org.id}\``
-		}
-	];
-	const blocks = [{
-		type: "header",
-		text: {
-			type: "plain_text",
-			text: heading,
-			emoji: true
-		}
-	}, {
-		type: "section",
-		fields
-	}];
-	if (input.type === "contact" && input.message?.trim()) blocks.push({
-		type: "section",
-		text: {
-			type: "mrkdwn",
-			text: `*Message:*\n${input.message.trim()}`
-		}
-	});
-	return {
-		text: summary,
-		blocks
-	};
-}
-async function postTeamRequestToSlack(input) {
-	const webhookUrl = process.env.TEAM_SLACK_WEBHOOK_URL?.trim();
-	if (!webhookUrl) {
-		console.warn("TEAM_SLACK_WEBHOOK_URL is not set; skipping team request Slack delivery");
-		return;
-	}
-	const payload = buildTeamRequestSlackPayload(input);
-	const response = await fetch(webhookUrl, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(payload)
-	});
-	if (!response.ok) {
-		const body = await response.text().catch(() => "");
-		throw new Error(`Failed to deliver team request to Slack (${response.status})${body ? `: ${body}` : ""}`);
-	}
-}
-//#endregion
-//#region src/routes/account/team-requests/POST.ts
-const handler = async (c) => {
-	const user = c.get("user");
-	const organizationContext = c.get("organization");
-	const parsed = SubmitTeamRequestRequestSchema.safeParse(await c.req.json().catch(() => null));
-	if (!parsed.success) {
-		const message = parsed.error.issues[0]?.message ?? "Invalid request body";
-		return c.json({ error: message }, 400);
-	}
-	const organization = await selectOrganizationById(organizationContext.organizationId);
-	if (!organization) return c.json({ error: "Organization not found" }, 404);
-	try {
-		await postTeamRequestToSlack({
-			type: parsed.data.type,
-			message: parsed.data.message,
-			user: {
-				id: user.id,
-				name: user.name,
-				email: user.email
-			},
-			org: {
-				id: organization.id,
-				name: organization.name,
-				slug: organization.slug
-			}
-		});
-	} catch (error) {
-		console.error("Failed to deliver team request to Slack", error);
-		return c.json({ error: "Failed to deliver team request" }, 502);
-	}
-	return c.json(SubmitTeamRequestResponseSchema.parse({ ok: true }), 200);
-};
-//#endregion
-//#region src/routes/account/mount.ts
-function mountAccountRoutes(options) {
-	const account = new Hono();
-	const orgScoped = new Hono();
-	const projectScoped = new Hono();
-	const protect = requireSession(createDefaultAuthJwtVerifier());
-	const deleteCredential = createDeleteCredentialHandler({ mcp: options.mcp });
-	account.use("/*", protect);
-	orgScoped.use("/*", protect);
-	orgScoped.use("/*", requireOrganization());
-	projectScoped.use("/*", protect);
-	projectScoped.use("/*", requireOrganization());
-	const requireOrgUpdate = authorize(organizationActions.update);
-	const requireUserManage = authorize(userActions.manage);
-	const requireUserInvite = authorize(userActions.invite);
-	const requireApiKeyCreate = authorize(apiKeysActions.create);
-	const requireInvitableRole = authorizePayload(InviteOrganizationMembersRequestSchema, ({ ctx, body }) => canInviteRole(ctx.orgRole, body.role));
-	const requireProjectMember = requireProjectMembership();
-	const requireProjectDeploy = authorize(projectActions.deploy);
-	const requireProjectUpdate = authorize(projectActions.update);
-	const requireProjectDelete = authorize(projectActions.delete);
-	const requireProjectManageMembers = authorize(projectActions.manageMembers);
-	const requireInvitableProjectRole = authorizePayload(InviteProjectMembersRequestSchema, ({ c, ctx, body }) => canInviteToProject(ctx, { invitePermission: getProjectInvitePermission(c) }, body.role));
-	const requireOrgParam = requireOrganizationParam();
-	account.get("/organizations", handler$58);
-	account.get("/organizations/slug-available", handler$57);
-	account.post("/organizations", createOrganizationHandler(options));
-	account.get("/organizations/:organizationId", requireOrgParam, handler$56);
-	account.patch("/organizations/:organizationId", requireOrgParam, requireOrgUpdate, handler$55);
-	account.get("/organizations/:organizationId/branding", requireOrgParam, handler$54);
-	account.patch("/organizations/:organizationId/branding", requireOrgParam, requireOrgUpdate, handler$53);
-	account.post("/organizations/:organizationId/branding/logo/presign", requireOrgParam, requireOrgUpdate, handler$52);
-	account.get("/invitations", handler$10);
-	account.post("/invitations/:invitationId/accept", handler$9);
-	account.post("/invitations/:invitationId/decline", handler$8);
-	account.get("/users/me/avatar", handler$63);
-	account.post("/users/me/avatar/presign", handler$62);
-	account.patch("/users/me/avatar", handler$61);
-	account.get("/users/me/preferences", handler$60);
-	account.patch("/users/me/preferences", handler$59);
-	orgScoped.get("/apps", handler$7);
-	orgScoped.get("/apps/slug-available", handler$5);
-	orgScoped.post("/apps", requireOrgUpdate, handler$6);
-	orgScoped.get("/apps/:slug", handler$4);
-	orgScoped.get("/members", handler$14);
-	orgScoped.post("/members/invitations", requireUserInvite, requireInvitableRole, handler$13);
-	orgScoped.patch("/members/:userId", requireUserManage, handler$12);
-	orgScoped.delete("/members/:userId", requireUserManage, handler$11);
-	orgScoped.get("/api-keys", handler$3);
-	orgScoped.post("/api-keys", requireApiKeyCreate, handler$2);
-	orgScoped.delete("/api-keys/:apiKeyId", handler$1);
-	const withOrgDb = withOrganizationProjectDatabase();
-	orgScoped.get("/agents", withOrgDb, handler$49);
-	orgScoped.get("/agents/:agentId", withOrgDb, handler$48);
-	orgScoped.get("/workflows", withOrgDb, handler$46);
-	orgScoped.get("/workflows/:workflowId", withOrgDb, handler$45);
-	orgScoped.get("/skills", withOrgDb, handler$43);
-	orgScoped.get("/skills/:skillId", withOrgDb, handler$42);
-	orgScoped.get("/recents", withOrgDb, handler$41);
-	orgScoped.get("/history", withOrgDb, handler$51);
-	orgScoped.post("/team-requests", handler);
-	orgScoped.get("/history/:runId", withOrgDb, handler$50);
-	orgScoped.post("/workflows/runs/:runId/cancel", withOrgDb, handler$44);
-	orgScoped.post("/agents/sessions/:sessionId/cancel", withOrgDb, handler$47);
-	orgScoped.get("/credentials", withOrgDb, handler$18);
-	orgScoped.post("/credentials", withOrgDb, handler$17);
-	orgScoped.get("/credentials/:credentialId", withOrgDb, (c, next) => c.req.param("credentialId") === "instances" ? next() : handler$16(c, next));
-	orgScoped.patch("/credentials/:credentialId", withOrgDb, handler$15);
-	orgScoped.delete("/credentials/:credentialId", withOrgDb, deleteCredential);
-	orgScoped.get("/projects", handler$40);
-	orgScoped.get("/projects/slug-available", handler$37);
-	orgScoped.get("/projects/metrics", withOrgDb, handler$39);
-	orgScoped.post("/projects", handler$38);
-	projectScoped.get("/:projectId", requireProject(), requireProjectMember, handler$36);
-	projectScoped.patch("/:projectId", requireProject(), requireProjectMember, requireProjectUpdate, handler$35);
-	projectScoped.delete("/:projectId", requireProject(), requireProjectMember, requireProjectDelete, handler$34);
-	projectScoped.get("/:projectId/settings", requireProject(), requireProjectMember, handler$20);
-	projectScoped.patch("/:projectId/settings", requireProject(), requireProjectMember, requireProjectUpdate, handler$19);
-	projectScoped.get("/:projectId/members", requireProject(), requireProjectMember, handler$25);
-	projectScoped.post("/:projectId/members", requireProject(), requireProjectMember, requireInvitableProjectRole, handler$24);
-	projectScoped.patch("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$23);
-	projectScoped.delete("/:projectId/members/:userId", requireProject(), requireProjectMember, requireProjectManageMembers, handler$22);
-	projectScoped.delete("/:projectId/members/me", requireProject(), requireProjectMember, handler$21);
-	projectScoped.get("/:projectId/reachability", requireProject(), requireProjectMember, createProjectReachabilityHandler(options.hosting));
-	projectScoped.get("/:projectId/files", requireProject(), requireProjectMember, withOrgDb, handler$27);
-	projectScoped.get("/:projectId/artifacts/:artifactId/files/content", requireProject(), requireProjectMember, handler$26);
-	projectScoped.get("/:projectId/deployments", requireProject(), requireProjectMember, handler$33);
-	projectScoped.get("/:projectId/artifacts/active/download", requireProject(), requireProjectMember, requireProjectDeploy, handler$31);
-	projectScoped.post("/:projectId/artifacts", requireProject(), requireProjectMember, requireProjectDeploy, handler$32);
-	projectScoped.post("/:projectId/artifacts/:artifactId/complete", requireProject(), requireProjectMember, requireProjectDeploy, handler$30);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/presign", requireProject(), requireProjectMember, requireProjectDeploy, handler$29);
-	projectScoped.post("/:projectId/artifacts/:artifactId/source/manifest", requireProject(), requireProjectMember, requireProjectDeploy, handler$28);
-	orgScoped.route("/projects", projectScoped);
-	account.route("/", orgScoped);
-	return account;
-}
-//#endregion
-//#region src/middleware/require-worker-token.ts
-/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */
-function readWorkerTokenFromRequest(c) {
-	const authorization = c.req.header("authorization");
-	if (authorization?.startsWith("Bearer ")) return authorization.slice(7).trim();
-	const apiKey = c.req.header("x-api-key")?.trim();
-	if (apiKey) return apiKey;
-}
-function requireWorkerToken(expectedToken) {
-	return async (c, next) => {
-		if (!expectedToken) return c.json({
-			error: "worker_auth_unconfigured",
-			message: "Worker auth is not configured."
-		}, 503);
-		const token = readWorkerTokenFromRequest(c);
-		if (!token || token !== expectedToken) return c.json({
-			error: "unauthorized",
-			message: "Invalid worker token."
-		}, 401);
-		await next();
-	};
-}
-//#endregion
-//#region src/routes/internal/web-search-proxy.ts
-const EXA_API_ORIGIN = "https://api.exa.ai";
-async function proxyExaWebSearchRequest(options) {
-	const apiKey = options.apiKey?.trim();
-	if (!apiKey) return Response.json({ error: "web_search_unconfigured" }, { status: 501 });
-	const target = new URL(`${EXA_API_ORIGIN}/${options.path.replace(/^\/+/, "")}`);
-	target.search = new URL(options.requestUrl).search;
-	const response = await (options.fetchImpl ?? fetch)(target, {
-		method: options.method,
-		headers: {
-			"content-type": "application/json",
-			"x-api-key": apiKey
-		},
-		body: options.method === "GET" || options.method === "HEAD" ? void 0 : options.body
-	});
-	const headers = new Headers(response.headers);
-	headers.delete("content-encoding");
-	headers.delete("transfer-encoding");
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-//#endregion
-//#region src/routes/internal/with-project-scope.ts
-async function withProjectScope(projectId, fn) {
-	const project = await selectProjectById(projectId);
-	if (!project) return;
-	const organization = await selectOrganizationById(project.organizationId);
-	if (!organization) return;
-	const url = resolveOrgDatabaseUrl(organization);
-	let result;
-	await runWithOrganizationScope(project.organizationId, () => runWithProjectDatabase({
-		url,
-		searchPath: organization.dbSchema
-	}, () => runWithProjectScope(project.id, () => runWithTenantScope(project.organizationId, async () => {
-		result = await fn({
-			organizationId: project.organizationId,
-			projectId: project.id
-		});
-	}))));
-	return result;
-}
-//#endregion
-//#region src/routes/internal/mount.ts
-const EnsureWebhookRouteBodySchema = z.object({
-	route: z.string().trim().min(1),
-	attachmentKeys: z.array(z.string().trim().min(1)).min(1)
-});
-const SandboxSessionBodySchema = z.object({
-	agentId: z.string().trim().min(1),
-	sessionId: z.string().trim().min(1)
-});
-const SandboxExecBodySchema = SandboxSessionBodySchema.extend({
-	script: z.string(),
-	options: z.object({
-		cwd: z.string().optional(),
-		env: z.record(z.string(), z.string()).optional(),
-		stdin: z.string().optional()
-	}).optional()
-});
-const SandboxReadBodySchema = SandboxSessionBodySchema.extend({ path: z.string().trim().min(1) });
-const SandboxWriteBodySchema = SandboxSessionBodySchema.extend({
-	path: z.string().trim().min(1),
-	content: z.string()
-});
-function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, sandboxProxy, mcp) {
-	const internal = new Hono();
-	const protect = requireWorkerToken(workerToken);
-	const materialize = createCredentialMaterializeHandler(tokenRefresh);
-	internal.use("/*", protect);
-	mcp?.mountInternalRoutes?.(internal, { withProjectScope });
-	internal.post("/projects/:projectId/credentials/materialize", async (c) => {
-		const response = await withProjectScope(c.req.param("projectId"), async () => materialize(c));
-		if (response === void 0) return c.json({ error: "Project not found" }, 404);
-		return response ?? c.json({
-			error: "internal_error",
-			message: "Failed to materialize credential."
-		}, 500);
-	});
-	internal.all("/projects/:projectId/web-search/:path{.+}", async (c) => {
-		const body = c.req.method === "GET" || c.req.method === "HEAD" ? void 0 : await c.req.arrayBuffer();
-		return proxyExaWebSearchRequest({
-			apiKey: process.env.EXA_API_KEY,
-			method: c.req.method,
-			path: c.req.param("path"),
-			requestUrl: c.req.url,
-			body
-		});
-	});
-	if (llmProxy) internal.all("/projects/:projectId/llm/:path{.+}", async (c) => {
-		const response = await withProjectScope(c.req.param("projectId"), async (ctx) => llmProxy.handler(c, {
-			organizationId: ctx.organizationId,
-			projectId: ctx.projectId,
-			pathSuffix: `/${c.req.param("path")}`
-		}));
-		if (response === void 0) return c.json({ error: "Project not found" }, 404);
-		return response ?? c.json({
-			error: "internal_error",
-			message: "Failed to proxy LLM request."
-		}, 500);
-	});
-	if (sandboxProxy) {
-		internal.post("/projects/:projectId/sandbox/create", async (c) => {
-			const projectId = c.req.param("projectId");
-			const parsed = SandboxSessionBodySchema.safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success) return c.json({
-				error: "Invalid request body",
-				details: parsed.error.flatten()
-			}, 400);
-			const result = await withProjectScope(projectId, async (ctx) => sandboxProxy.create({
-				...ctx,
-				...parsed.data
-			}));
-			if (result === void 0) return c.json({ error: "Project not found" }, 404);
-			return c.json(result);
-		});
-		internal.post("/projects/:projectId/sandbox/exec", async (c) => {
-			const projectId = c.req.param("projectId");
-			const parsed = SandboxExecBodySchema.safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success) return c.json({
-				error: "Invalid request body",
-				details: parsed.error.flatten()
-			}, 400);
-			const { script, options, ...session } = parsed.data;
-			const result = await withProjectScope(projectId, async (ctx) => sandboxProxy.exec({
-				...ctx,
-				...session
-			}, script, options));
-			if (result === void 0) return c.json({ error: "Project not found" }, 404);
-			return c.json(result);
-		});
-		internal.post("/projects/:projectId/sandbox/read", async (c) => {
-			const projectId = c.req.param("projectId");
-			const parsed = SandboxReadBodySchema.safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success) return c.json({
-				error: "Invalid request body",
-				details: parsed.error.flatten()
-			}, 400);
-			const { path, ...session } = parsed.data;
-			const content = await withProjectScope(projectId, async (ctx) => sandboxProxy.readFile({
-				...ctx,
-				...session
-			}, path));
-			if (content === void 0) return c.json({ error: "Project not found" }, 404);
-			return c.json({ content });
-		});
-		internal.post("/projects/:projectId/sandbox/write", async (c) => {
-			const projectId = c.req.param("projectId");
-			const parsed = SandboxWriteBodySchema.safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success) return c.json({
-				error: "Invalid request body",
-				details: parsed.error.flatten()
-			}, 400);
-			const { path, content, ...session } = parsed.data;
-			if (await withProjectScope(projectId, async (ctx) => {
-				await sandboxProxy.writeFile({
-					...ctx,
-					...session
-				}, path, content);
-				return true;
-			}) === void 0) return c.json({ error: "Project not found" }, 404);
-			return c.json({});
-		});
-		internal.post("/projects/:projectId/sandbox/dispose", async (c) => {
-			const projectId = c.req.param("projectId");
-			const parsed = SandboxSessionBodySchema.safeParse(await c.req.json().catch(() => null));
-			if (!parsed.success) return c.json({
-				error: "Invalid request body",
-				details: parsed.error.flatten()
-			}, 400);
-			if (await withProjectScope(projectId, async (ctx) => {
-				await sandboxProxy.dispose({
-					...ctx,
-					...parsed.data
-				});
-				return true;
-			}) === void 0) return c.json({ error: "Project not found" }, 404);
-			return c.json({});
-		});
-	}
-	internal.post("/projects/:projectId/webhooks/ensure", async (c) => {
-		const projectId = c.req.param("projectId");
-		if (!await withProjectScope(projectId, async (ctx) => ctx)) return c.json({ error: "Project not found" }, 404);
-		const parsed = EnsureWebhookRouteBodySchema.safeParse(await c.req.json().catch(() => null));
-		if (!parsed.success) return c.json({
-			error: "Invalid request body",
-			details: parsed.error.flatten()
-		}, 400);
-		const origin = platformWebhookOrigin(projectId, externalPlatformOrigin());
-		if (!origin) return c.json({ error: "PUBLIC_PLATFORM_URL is not configured" }, 500);
-		try {
-			const token = await ensureWebhookApiKeyForRoute(projectId, parsed.data.route, parsed.data.attachmentKeys);
-			return c.json({ webhookUrl: buildWebhookUrl(origin, parsed.data.route, token) });
-		} catch (error) {
-			const message = error instanceof Error ? error.message : "Failed to ensure webhook API key.";
-			return c.json({
-				error: "webhook_provisioning_failed",
-				message
-			}, 500);
-		}
-	});
-	return internal;
-}
-//#endregion
-//#region src/app.ts
-async function createApp$1(auth, options) {
-	return createApp({
-		mode: "platform",
-		webOrigin: options.webOrigin,
-		schedulerPlugin: options.scheduler,
-		mcp: options.mcp,
-		auth,
-		mountAuth: (app, authInstance) => {
-			mountAuth(app, authInstance);
-		},
-		mountAccount: async (app) => {
-			app.route("/api", mountAccountRoutes({
-				hosting: options.hosting,
-				storage: options.storage,
-				mcp: options.mcp
-			}));
-		},
-		mountInternal: (app, { tokenRefresh }) => {
-			app.route("/internal", mountInternalRoutes(options.hosting.workerRuntime.workerToken, tokenRefresh, options.llmProxy, options.sandboxProxy, options.mcp));
-		}
-	});
-}
-//#endregion
-//#region src/start.ts
-/** Fly `internal_port` — not the public HTTPS URL port. */
-const PRODUCTION_PLATFORM_LISTEN_PORT = 8080;
-const LOCAL_PLATFORM_PORT = 3002;
-function resolvePlatformListenPort() {
-	if (process.env.NODE_ENV === "production") return PRODUCTION_PLATFORM_LISTEN_PORT;
-	return listenPortFromPublicUrl(process.env.PUBLIC_PLATFORM_URL, LOCAL_PLATFORM_PORT);
-}
-function usesPgBossScheduler(platformConfig) {
-	return platformConfig.scheduler.name === "pg-boss" || platformConfig.scheduler.name === "default";
-}
-async function startPlatformServer(platformConfig, hooks = {}) {
-	const runtime = platformConfig.hosting.createRuntime();
-	await initDatabase();
-	await ensureKeystrokeAssetsBucket();
-	await seedOAuthAppsFromEnvForAllOrganizations();
-	if (usesPgBossScheduler(platformConfig)) await ensureProjectPgBossGrants();
-	configureProjectRuntimeScheduler(platformConfig.scheduler);
-	await startProjectRuntimeWorker(runtime, { resolveStartInput: async (job) => {
-		const organization = await selectOrganizationById(job.organizationId);
-		if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
-		const database = await resolveOrgRuntimeDatabase(job.organizationId);
-		const workerRuntime = platformConfig.hosting.workerRuntime;
-		return {
-			organizationId: job.organizationId,
-			projects: [],
-			database: {
-				...database,
-				organizationId: job.organizationId
-			},
-			env: {
-				...orgWorkspacesRuntimeEnv(organization, { containerEnv: process.env }),
-				...platformConfig.llmProxy?.workerEnv({
-					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken
-				}),
-				...platformConfig.sandboxProxy?.workerEnv({
-					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken
-				}),
-				...platformConfig.workerEnv?.({
-					platformUrl: workerRuntime.platformUrl,
-					workerToken: workerRuntime.workerToken
-				})
-			},
-			hosting: organization.hostingAppName ? { appName: organization.hostingAppName } : void 0,
-			previousRuntimeId: organization.runtimeId
-		};
-	} });
-	const webUrl = process.env.PUBLIC_WEB_URL;
-	if (!webUrl) throw new Error("PUBLIC_WEB_URL is required for the platform server");
-	const platformUrl = process.env.PUBLIC_PLATFORM_URL?.replace(/\/+$/, "");
-	if (!platformUrl) throw new Error("PUBLIC_PLATFORM_URL is required for the platform server");
-	const auth = createAuth({
-		baseURL: platformUrl,
-		verificationUri: `${webUrl.replace(/\/+$/, "")}/device`,
-		trustedOrigins: [webUrl]
-	});
-	if (!auth) throw new Error("BETTER_AUTH_SECRET is required for the platform server");
-	const app = await createApp$1(auth, {
-		webOrigin: webUrl,
-		hosting: platformConfig.hosting,
-		storage: platformConfig.storage,
-		scheduler: platformConfig.scheduler,
-		llmProxy: platformConfig.llmProxy,
-		sandboxProxy: platformConfig.sandboxProxy,
-		mcp: platformConfig.mcp
-	});
-	await hooks.afterCreateApp?.(app);
-	const port = resolvePlatformListenPort();
-	serve({
-		fetch: app.fetch,
-		port
-	}, (info) => {
-		console.log(`Platform API listening on http://localhost:${info.port}`);
-	});
-}
-//#endregion
-export { startPlatformServer as t };
-
-//# sourceMappingURL=start-9_8ZcdaU.mjs.map