@keystrokehq/platform 0.1.57 → 0.1.59

package/dist/{start-CVrMV6Nm.mjs → start-MLNBN7iD.mjs}

@@ -1,14 +1,15 @@
-import { $ as CreateCredentialsResponseSchema, $n as WorkspaceTriggerListResponseSchema, $t as PresignOrgLogoRequestSchema, A as discoverOpenApiApp, An as UpdateOrganizationMemberRequestSchema, Ar as validateCredentialValueAgainstFields, At as ListAppsResponseSchema, B as ActiveOrganizationResponseSchema, Bn as UserAvatarSchema, Bt as ListProjectsResponseSchema, C as defaultSchedulerPlugin, Cn as SubmitMarketingContactResponseSchema, Cr as organizationInvitationAcceptPath, Ct as InviteOrganizationMembersRequestSchema, D as describeCredentialBinding, Dn as TriggerRunListQuerySchema, Dr as projectFileId, Dt as ListAgentMemoryFilesResponseSchema, E as decodeOAuthState, En as TriggerAttachmentUpdateRequestSchema, Er as parseStoredRouteManifest, Et as InviteProjectMembersResponseSchema, F as readCredentialInstanceSecret, Fn as UpdateProjectRequestSchema, Fr as pingProjectTarget, Ft as ListOrganizationsResponseSchema, G as AgentWorkspaceFileSummarySchema, Gn as WorkflowCanvasSchema, Gt as OpenApiDiscoverRequestSchema, H as AgentSummaryDetailResponseSchema, Hn as UserPreferencesSchema, Ht as ManagedServiceKindSchema, I as setCredentialInstanceSecret, In as UpdateProjectSettingsRequestSchema, It as ListProjectDeploymentsResponseSchema, J as CompleteProjectArtifactResponseSchema, Jn as WorkflowSummaryDetailResponseSchema, Jt as OrganizationSidebarBrandingSchema, K as AppSlugAvailabilityQuerySchema, Kn as WorkflowRunInputsPutBodySchema, Kt as OpenApiDiscoverResponseSchema, L as setManagedServiceCredential, Ln as UploadProjectSourceManifestRequestSchema, Lt as ListProjectFilesResponseSchema, M as PublicHttpUrlError, Mn as UpdateOrganizationRequestSchema, Mr as validationErrorResponse, Mt as ListManagedServiceCredentialsResponseSchema, N as deleteCredentialInstanceSecret, Nn as UpdateProjectMemberRequestSchema, Nt as ListOrganizationInvitationsResponseSchema, O as discoverGraphqlApp, On as UpdateCredentialRequestSchema, Or as resolveExternalPlatformOrigin, Ot as ListAgentWorkspaceFilesResponseSchema, P as deleteManagedServiceCredential$1, Pn as UpdateProjectMemberResponseSchema, Pr as fetchDeployStatus, Pt as ListOrganizationMembersResponseSchema, Q as CreateCredentialsRequestSchema, Qn as WorkspaceTriggerFileSchema, Qt as PresignChatAttachmentResponseSchema, R as ACTIVE_ORG_HEADER, Rn as UploadProjectSourceResponseSchema, Rt as ListProjectMembersResponseSchema, S as createJobQueue, Sn as SubmitMarketingContactRequestSchema, Sr as normalizeUserPreferences, St as HistoryRunListResponseSchema, T as completeMcpOAuthConnect, Tn as SubmitTeamRequestResponseSchema, Tr as parseAppSlug, Tt as InviteProjectMembersRequestSchema, U as AgentSummaryListResponseSchema, Un as WorkflowCanvasCredentialBindingsSchema, Ut as McpDiscoverRequestSchema, V as AgentMemoryFileSummarySchema, Vn as UserPreferencesPatchSchema, Vt as ManagedServiceCredentialSchema, W as AgentSummarySchema, Wn as WorkflowCanvasRunSchema, Wt as McpDiscoverResponseSchema, X as CreateApiKeyRequestSchema, Xn as WorkflowSummarySchema, Xt as PROJECT_SLUG_TAKEN_MESSAGE, Y as ConnectManagedServiceCredentialRequestSchema, Yn as WorkflowSummaryListResponseSchema, Yt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, Z as CreateApiKeyResponseSchema, Zn as WorkspaceTriggerDetailSchema, Zt as PresignChatAttachmentRequestSchema, _ as orgLogoStorageKey, _n as SlugAvailabilityQuerySchema, _r as mapProjectDeployment, _t as GraphqlDiscoverRequestSchema, a as extractRouteManifestFromArtifact, an as ProjectReachabilityResponseSchema, ar as buildCredentialInstanceLabel, at as CreateProjectRequestSchema, b as publicKeystrokeAssetsObjectUrl, bn as StartMcpOAuthConnectionResultSchema, br as mapUserOrganization, bt as HistoryRunDetailResponseSchema, c as isKeystrokeAssetsOrgLogoPublicUrl, cn as ProjectSlugAvailabilityQuerySchema, cr as displayCredentialAppName, ct as DEFAULT_TRIGGER_OVERVIEW_MODEL, d as isStorageNotFoundError$1, dn as PublicModelsResponseSchema, dr as jsonSchemaToWorkflowInputSchema, dt as DeclineOrganizationInvitationResponseSchema, en as PresignOrgLogoResponseSchema, er as WorkspaceTriggerOverviewSchema, et as CreateCustomAppRequestSchema, f as isUserAvatarStorageKey, fn as RecentResourceListResponseSchema, fr as listenPortFromPublicUrl, ft as DownloadActiveProjectArtifactResponseSchema, gn as SkillSummarySchema, gr as mapProjectArtifact, gt as GetCustomAppResponseSchema, h as loadProjectSourceFiles, hn as SkillSummaryListResponseSchema, hr as mapProject, ht as GetCredentialResponseSchema, i as ensureKeystrokeAssetsBucket, in as PresignUserAvatarResponseSchema, ir as agentWorkspaceFileId, it as CreateProjectArtifactResponseSchema, j as withCredentialAssignments, jn as UpdateOrganizationMemberResponseSchema, jr as validateWorkflowRunInputValues, jt as ListCredentialsResponseSchema, k as discoverMcpApp, kn as UpdateManagedServiceCredentialRequestSchema, kr as resolveUniqueCredentialInstanceLabel, kt as ListApiKeysResponseSchema, l as isOrgLogoStorageKey, ln as ProjectSlugAvailabilityResponseSchema, lr as isAllowedChatAttachmentMediaType, lt as DEFAULT_WORKFLOW_CANVAS_MODEL, m as keystrokeAssetsOrgLogoKeyFromPublicUrl, mn as SkillSummaryDetailResponseSchema, mr as mapOrganizationMember, mt as ErrorResponseSchema, n as chatAttachmentStorageKey, nn as PresignProjectSourceResponseSchema, nr as WorkspaceWorkflowOverviewSchema, nt as CreateOrganizationRequestSchema, o as isChatAttachmentStorageKey, on as ProjectResponseSchema, or as chatAttachmentExtension, ot as CreateProjectResponseSchema, p as keystrokeAssetsAvatarKeyFromPublicUrl, pn as RecentResourceSchema, pr as mapOrganizationInvitation, pt as DownloadActiveProjectSourceResponseSchema, q as AppSlugAvailabilityResponseSchema, qn as WorkflowRunInputsSchema, qt as OrganizationSidebarBrandingPatchSchema, r as createAssetsStorageClient, rn as PresignUserAvatarRequestSchema, rr as agentMemoryFileId, rt as CreateOrganizationResponseSchema, s as isKeystrokeAssetsAvatarPublicUrl, sn as ProjectSettingsResponseSchema, sr as deriveCredentialInstanceSlug, st as DEFAULT_CLOUD_PLATFORM_ORIGIN, t as RouteManifestNotFoundError, tn as PresignProjectSourceRequestSchema, tr as WorkspaceTriggerRunListResponseSchema, tt as CreateCustomAppResponseSchema, u as isStorageBucketNotFoundError, un as ProjectSourceResourcesSchema, ur as isLlmProviderSlug, ut as DEFAULT_WORKFLOW_OVERVIEW_MODEL, v as projectArtifactKey, vn as SlugAvailabilityResponseSchema, vr as mapProjectMember, vt as GraphqlDiscoverResponseSchema, w as beginMcpOAuthConnect, wn as SubmitTeamRequestRequestSchema, wr as organizationSlugErrorCodeFromMessage, wt as InviteOrganizationMembersResponseSchema, x as userAvatarStorageKey, xn as StoredProjectSourceManifestSchema, xr as mergeUserPreferences, xt as HistoryRunListQuerySchema, y as projectSourceBlobKey, yn as StartMcpOAuthConnectionInputSchema, yr as mapProjectSettings, yt as HistoryRunCancelResponseSchema, z as AcceptOrganizationInvitationResponseSchema, zn as UserAvatarPatchSchema, zt as ListProjectMetricsResponseSchema } from "./dist-CFKAFYn8.mjs";
+import { $ as CreateCredentialsRequestSchema, $n as WorkflowSummarySchema, $t as PROJECT_SLUG_TAKEN_MESSAGE, A as discoverMcpApp, An as TriggerRunListQuerySchema, Ar as projectFileId, At as ListAgentMemoryFilesResponseSchema, B as AcceptOrganizationInvitationResponseSchema, Bn as UploadProjectSourceManifestRequestSchema, Bt as ListProjectFilesResponseSchema, C as defaultSchedulerPlugin, Cn as StartMcpOAuthConnectionResultSchema, Cr as mapUserOrganization, Ct as HistoryRunDetailResponseSchema, D as decodeOAuthState, Dn as SubmitTeamRequestRequestSchema, Dr as organizationSlugErrorCodeFromMessage, Dt as InviteOrganizationMembersResponseSchema, E as completeMcpOAuthConnect, En as SubmitMarketingContactResponseSchema, Er as organizationInvitationAcceptPath, Et as InviteOrganizationMembersRequestSchema, F as deleteManagedServiceCredential$1, Fn as UpdateOrganizationRequestSchema, Fr as validationErrorResponse, Ft as ListManagedServiceCredentialsResponseSchema, G as AgentSummarySchema, Gn as UserPreferencesSchema, Gt as ManagedServiceKindSchema, H as AgentMemoryFileSummarySchema, Hn as UserAvatarPatchSchema, Ht as ListProjectMetricsResponseSchema, I as readCredentialInstanceSecret, In as UpdateProjectMemberRequestSchema, It as ListOrganizationInvitationsResponseSchema, J as AppSlugAvailabilityResponseSchema, Jn as WorkflowCanvasSchema, Jt as OpenApiDiscoverRequestSchema, K as AgentWorkspaceFileSummarySchema, Kn as WorkflowCanvasCredentialBindingsSchema, Kt as McpDiscoverRequestSchema, L as setCredentialInstanceSecret, Ln as UpdateProjectMemberResponseSchema, Lt as ListOrganizationMembersResponseSchema, M as withCredentialAssignments, Mn as UpdateManagedServiceCredentialRequestSchema, Mr as resolveUniqueCredentialInstanceLabel, Mt as ListApiKeysResponseSchema, N as PublicHttpUrlError, Nn as UpdateOrganizationMemberRequestSchema, Nr as validateCredentialValueAgainstFields, Nt as ListAppsResponseSchema, O as describeCredentialBinding, On as SubmitTeamRequestResponseSchema, Or as parseAppSlug, Ot as InviteProjectMembersRequestSchema, P as deleteCredentialInstanceSecret, Pn as UpdateOrganizationMemberResponseSchema, Pr as validateWorkflowRunInputValues, Pt as ListCredentialsResponseSchema, Q as CreateApiKeyResponseSchema, Qn as WorkflowSummaryListResponseSchema, Qt as PLATFORM_RESOURCE_UNSUPPORTED_TEXT, R as setManagedServiceCredential, Rn as UpdateProjectRequestSchema, Rt as ListOrganizationsResponseSchema, S as createJobQueue, Sn as StartMcpOAuthConnectionInputSchema, Sr as mapProjectSettings, St as HistoryRunCancelResponseSchema, T as beginMcpOAuthConnect, Tn as SubmitMarketingContactRequestSchema, Tr as normalizeUserPreferences, Tt as HistoryRunListResponseSchema, U as AgentSummaryDetailResponseSchema, Un as UserAvatarSchema, Ut as ListProjectsResponseSchema, V as ActiveOrganizationResponseSchema, Vn as UploadProjectSourceResponseSchema, Vt as ListProjectMembersResponseSchema, W as AgentSummaryListResponseSchema, Wn as UserPreferencesPatchSchema, Wt as ManagedServiceCredentialSchema, X as ConnectManagedServiceCredentialRequestSchema, Xn as WorkflowRunInputsSchema, Xt as OrganizationSidebarBrandingPatchSchema, Y as CompleteProjectArtifactResponseSchema, Yn as WorkflowRunInputsPutBodySchema, Yt as OpenApiDiscoverResponseSchema, Z as CreateApiKeyRequestSchema, Zn as WorkflowSummaryDetailResponseSchema, Zt as OrganizationSidebarBrandingSchema, _ as orgLogoStorageKey, _n as SkillSummaryDetailResponseSchema, _r as mapOrganizationMember, _t as ErrorResponseSchema, a as extractRouteManifestFromArtifact, an as PresignProjectSourceResponseSchema, ar as WorkspaceWorkflowOverviewSchema, at as CreateProjectArtifactResponseSchema, b as publicKeystrokeAssetsObjectUrl, bn as SlugAvailabilityQuerySchema, br as mapProjectDeployment, bt as GraphqlDiscoverRequestSchema, c as isKeystrokeAssetsOrgLogoPublicUrl, cn as ProjectReachabilityResponseSchema, cr as buildCredentialInstanceLabel, ct as DEFAULT_CLOUD_PLATFORM_ORIGIN, d as isStorageNotFoundError$1, dn as ProjectSlugAvailabilityQuerySchema, dr as displayCredentialAppName, dt as DEFAULT_WORKFLOW_OVERVIEW_MODEL, en as PresignChatAttachmentRequestSchema, er as WorkspaceTriggerDetailSchema, et as CreateCredentialsResponseSchema, f as isUserAvatarStorageKey, fn as ProjectSlugAvailabilityResponseSchema, fr as isAllowedChatAttachmentMediaType, ft as DbProxyMigrateRequestSchema, gn as RecentResourceSchema, gr as mapOrganizationInvitation, gt as DownloadActiveProjectSourceResponseSchema, h as loadProjectSourceFiles, hn as RecentResourceListResponseSchema, hr as listenPortFromPublicUrl, ht as DownloadActiveProjectArtifactResponseSchema, i as ensureKeystrokeAssetsBucket, in as PresignProjectSourceRequestSchema, ir as WorkspaceTriggerRunListResponseSchema, it as CreateOrganizationResponseSchema, j as discoverOpenApiApp, jn as UpdateCredentialRequestSchema, jr as resolveExternalPlatformOrigin, jt as ListAgentWorkspaceFilesResponseSchema, k as discoverGraphqlApp, kn as TriggerAttachmentUpdateRequestSchema, kr as parseStoredRouteManifest, kt as InviteProjectMembersResponseSchema, l as isOrgLogoStorageKey, ln as ProjectResponseSchema, lr as chatAttachmentExtension, lt as DEFAULT_TRIGGER_OVERVIEW_MODEL, m as keystrokeAssetsOrgLogoKeyFromPublicUrl, mn as PublicModelsResponseSchema, mr as jsonSchemaToWorkflowInputSchema, mt as DeclineOrganizationInvitationResponseSchema, n as chatAttachmentStorageKey, nn as PresignOrgLogoRequestSchema, nr as WorkspaceTriggerListResponseSchema, nt as CreateCustomAppResponseSchema, o as isChatAttachmentStorageKey, on as PresignUserAvatarRequestSchema, or as agentMemoryFileId, ot as CreateProjectRequestSchema, p as keystrokeAssetsAvatarKeyFromPublicUrl, pn as ProjectSourceResourcesSchema, pr as isLlmProviderSlug, pt as DbProxyQueryRequestSchema, q as AppSlugAvailabilityQuerySchema, qn as WorkflowCanvasRunSchema, qt as McpDiscoverResponseSchema, r as createAssetsStorageClient, rn as PresignOrgLogoResponseSchema, rr as WorkspaceTriggerOverviewSchema, rt as CreateOrganizationRequestSchema, s as isKeystrokeAssetsAvatarPublicUrl, sn as PresignUserAvatarResponseSchema, sr as agentWorkspaceFileId, st as CreateProjectResponseSchema, t as RouteManifestNotFoundError, tn as PresignChatAttachmentResponseSchema, tr as WorkspaceTriggerFileSchema, tt as CreateCustomAppRequestSchema, u as isStorageBucketNotFoundError, un as ProjectSettingsResponseSchema, ur as deriveCredentialInstanceSlug, ut as DEFAULT_WORKFLOW_CANVAS_MODEL, v as projectArtifactKey, vn as SkillSummaryListResponseSchema, vr as mapProject, vt as GetCredentialResponseSchema, w as cronPayloadSchema, wn as StoredProjectSourceManifestSchema, wr as mergeUserPreferences, wt as HistoryRunListQuerySchema, x as userAvatarStorageKey, xn as SlugAvailabilityResponseSchema, xr as mapProjectMember, xt as GraphqlDiscoverResponseSchema, y as projectSourceBlobKey, yn as SkillSummarySchema, yr as mapProjectArtifact, yt as GetCustomAppResponseSchema, z as ACTIVE_ORG_HEADER, zn as UpdateProjectSettingsRequestSchema, zt as ListProjectDeploymentsResponseSchema } from "./dist-n3wzpgC3.mjs";
+import { a as verifyOrgWorkerToken, i as pingProjectTarget, n as fetchDeployStatus, r as mintOrgWorkerToken } from "./dist-xE6TWIG_.mjs";
 import "./chunk-BZUGFHVS-B2NchobP.mjs";
 import { n as d$4, t as _$1 } from "./chunk-TN7HHBQW-B8PYcKz5.mjs";
-import { t as withProjectScope } from "./with-project-scope-DWwbN8Qs.mjs";
+import { n as readWorkerTokenFromRequest, r as requireWorkerToken, t as withProjectScope } from "./with-project-scope-C6387HzP.mjs";
 import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import "node:fs/promises";
-import { buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, deleteCredentialInstanceById, findHistoryRunCore, getProjectScopeId, getServerTenantScopeId, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, listReplayEvents, listTriggersByIds, listWorkspaceTriggerRunRows, listWorkspaceTriggers, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentBySlug, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectTriggerById, selectWorkflowCanvasAnnotations, selectWorkflowLastRunAtByIds, selectWorkflowOverview, selectWorkflowRunById, selectWorkflowRunForWorkflow, selectWorkflowRunInputValues, setTriggerAttachmentEnabledState, setTriggerOverviewGenerating, setWorkflowCanvasAnnotationsGenerating, setWorkflowOverviewGenerating, storedTriggerSourceFromRow, touchResourceActivity, updateTriggerOverview, updateWorkflowCanvasAnnotations, updateWorkflowOverview, updateWorkflowRunInputValues, upsertCredentialInstance } from "@keystrokehq/database";
+import { acquireProjectDatabasePool, buildHistoryAgentSessionDetail, buildHistoryWorkflowRunDetail, cancelAgentSession, cancelWorkflowRun, clearCredentialInstanceDefaults, deleteCredentialInstanceById, findHistoryRunCore, getProjectScopeId, getServerTenantScopeId, listActiveAgents, listActiveSkills, listActiveWorkflows, listAllCredentialInstances, listCredentialInstancesByConnectionId, listHistoryRuns, listRecentResourceActivity, listReplayEvents, listTriggersByIds, listWorkspaceTriggerRunRows, listWorkspaceTriggers, releaseProjectDatabasePool, runWithProjectDatabase, runWithProjectScope, runWithTenantScope, selectActiveAgentById, selectActiveAgentsByIds, selectActiveSkillById, selectActiveSkillsByIds, selectActiveWorkflowById, selectActiveWorkflowsByIds, selectAgentBySlug, selectAgentLastRunAtByIds, selectAgentSessionById, selectCredentialInstanceById, selectCredentialInstancesForScope, selectEphemeralTriggerAttachments, selectProjectResourceCounts, selectTriggerById, selectWorkflowCanvasAnnotations, selectWorkflowLastRunAtByIds, selectWorkflowOverview, selectWorkflowRunById, selectWorkflowRunForWorkflow, selectWorkflowRunInputValues, setTriggerAttachmentEnabledState, setTriggerOverviewGenerating, setWorkflowCanvasAnnotationsGenerating, setWorkflowOverviewGenerating, storedTriggerSourceFromRow, touchResourceActivity, updateTriggerOverview, updateWorkflowCanvasAnnotations, updateWorkflowOverview, updateWorkflowRunInputValues, upsertCredentialInstance } from "@keystrokehq/database";
 import { ZodError, z } from "zod";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CannotModifyOwnerError, OrgAppSlugTakenError, OrgPlatformApiKeyNotFoundError, OrganizationInvitationExpiredError, OrganizationInvitationForbiddenError, OrganizationInvitationNotFoundError, OrganizationMemberNotFoundError, OrganizationSlugTakenError, OrganizationSlugTakenError as OrganizationSlugTakenError$1, ProjectMemberNotFoundError, ProjectSlugTakenError, acceptInvitation, checkOrgAppSlugAvailability, checkOrganizationSlugAvailability, checkProjectSlugAvailability, completeProjectArtifact, createOrgAgentStorageClient, createOrgApp, createOrgPlatformApiKey, createOrgStorageClient, createOrganizationForUser, createProjectForOrganization, declineInvitation, deleteOAuthConnectionById, deleteProjectForOrganization, encryptCredentialPayload as encryptCredentialPayload$1, ensureProjectPgBossGrants, ensureWebhookApiKeyForRoute, ensureWebhookApiKeys, getManagedServiceCredential, hasCredentialFieldTemplate, initDatabase, insertProjectArtifact, inviteOrganizationMembers, inviteProjectMembers, isOrganizationStorageBucketInUse, listAppsForOrganization, listManagedServiceCredentialsForOrganization, listOrgPlatformApiKeysForOrganization, listOrgPlatformApiKeysForUser, listWebhookApiKeys, listWebhookApiKeysForProject, loadOrgPlatformApiKeyUser, mapOrgPlatformApiKeyCreator, mapOrgPlatformApiKeyCreatorOrDeleted, orgSchedulerRuntimeEnv, orgWorkspacesRuntimeEnv, organizationRowToSidebarBranding, promoteProjectArtifact, removeOrganizationMember, removeProjectMember, resolveNewOrganizationIdentity, resolveOrgProjectDatabaseOptions, resolveOrgRuntimeDatabase, revokeOrgPlatformApiKey, runWithOrganizationScope, runWithWorkspaceContext, selectActiveArtifactManifestForProject, selectActiveArtifactSourceManifestForProject, selectActiveProjectArtifactForProject, selectAppForOrganization, selectLastDeploymentAtByProject, selectManagedServiceCredentialById, selectOAuthConnectionsByIds, selectOrgPlatformApiKeyForOrganization, selectOrganizationById, selectOrganizationMembers, selectPendingInvitationsForUser, selectProjectArtifactById, selectProjectArtifactForProject, selectProjectById, selectProjectDeployments, selectProjectForOrganization, selectProjectForOrganizationBySlug, selectProjectIdsForUser, selectProjectMembers, selectProjectsByOrganizationId, selectUserById, selectUserOrganizationMembership, selectUserOrganizations, selectUserProjectMembership, selectUsersByIds, updateOrganizationActive, updateOrganizationFailed, updateOrganizationMemberRole, updateOrganizationName, updateOrganizationSidebarBranding, updateOrganizationSlug, updateProjectActive, updateProjectArtifactManifest, updateProjectArtifactSourceManifest, updateProjectFailed, updateProjectForOrganization, updateProjectMemberRole, updateProjectSettings, updateUserById, verifyOrgPlatformApiKeySecret } from "@keystrokehq/platform-database";
-import { createHash } from "node:crypto";
 import "node:fs";
 import { basename, join, normalize, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
@@ -22871,43 +22872,43 @@ var tt = [
 	},
 	{
 		name: "cat",
-		load: async () => (await import("./cat-TSFMZVYS-_P4t1grN.mjs")).catCommand
+		load: async () => (await import("./cat-TSFMZVYS-B2pEgqfx.mjs")).catCommand
 	},
 	{
 		name: "printf",
-		load: async () => (await import("./printf-TWGXF445-CFdLOO7W.mjs")).printfCommand
+		load: async () => (await import("./printf-TWGXF445-C4XURAFD.mjs")).printfCommand
 	},
 	{
 		name: "ls",
-		load: async () => (await import("./ls-ZJGQER7M-qsnDp7Cd.mjs")).lsCommand
+		load: async () => (await import("./ls-ZJGQER7M-D-5XVT_t.mjs")).lsCommand
 	},
 	{
 		name: "mkdir",
-		load: async () => (await import("./mkdir-MEPGZOB6-DPsM58SX.mjs")).mkdirCommand
+		load: async () => (await import("./mkdir-MEPGZOB6-D5wyeAZU.mjs")).mkdirCommand
 	},
 	{
 		name: "rmdir",
-		load: async () => (await import("./rmdir-OC4ZLPYA-DCHxah99.mjs")).rmdirCommand
+		load: async () => (await import("./rmdir-OC4ZLPYA-t2j-2qTf.mjs")).rmdirCommand
 	},
 	{
 		name: "touch",
-		load: async () => (await import("./touch-UA33VN3N--2WSdwPu.mjs")).touchCommand
+		load: async () => (await import("./touch-UA33VN3N-lLlL75xu.mjs")).touchCommand
 	},
 	{
 		name: "rm",
-		load: async () => (await import("./rm-SSGETQVQ-dEV4Y3ni.mjs")).rmCommand
+		load: async () => (await import("./rm-SSGETQVQ-CMfZGpP7.mjs")).rmCommand
 	},
 	{
 		name: "cp",
-		load: async () => (await import("./cp-BISAAS7A-DOes4Hvy.mjs")).cpCommand
+		load: async () => (await import("./cp-BISAAS7A-CFaBUCS_.mjs")).cpCommand
 	},
 	{
 		name: "mv",
-		load: async () => (await import("./mv-W5BIQ646-Br51zxas.mjs")).mvCommand
+		load: async () => (await import("./mv-W5BIQ646-1-b5c58P.mjs")).mvCommand
 	},
 	{
 		name: "ln",
-		load: async () => (await import("./ln-4LGSXXGD-BYt_Jm67.mjs")).lnCommand
+		load: async () => (await import("./ln-4LGSXXGD-Cg1BaXAY.mjs")).lnCommand
 	},
 	{
 		name: "chmod",
@@ -22923,15 +22924,15 @@ var tt = [
 	},
 	{
 		name: "head",
-		load: async () => (await import("./head-442HYESI-Ch7PCV9u.mjs")).headCommand
+		load: async () => (await import("./head-442HYESI-CUW1cJCn.mjs")).headCommand
 	},
 	{
 		name: "tail",
-		load: async () => (await import("./tail-R4PCA2C4-DdF1DSLe.mjs")).tailCommand
+		load: async () => (await import("./tail-R4PCA2C4-B3yEmx6J.mjs")).tailCommand
 	},
 	{
 		name: "wc",
-		load: async () => (await import("./wc-LF7NU4LA-DtGpuB_1.mjs")).wcCommand
+		load: async () => (await import("./wc-LF7NU4LA-CQqwx__m.mjs")).wcCommand
 	},
 	{
 		name: "stat",
@@ -22939,95 +22940,95 @@ var tt = [
 	},
 	{
 		name: "grep",
-		load: async () => (await import("./grep-V3LQVMRQ-BKuD8_-n.mjs")).grepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-CAog-whs.mjs")).grepCommand
 	},
 	{
 		name: "fgrep",
-		load: async () => (await import("./grep-V3LQVMRQ-BKuD8_-n.mjs")).fgrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-CAog-whs.mjs")).fgrepCommand
 	},
 	{
 		name: "egrep",
-		load: async () => (await import("./grep-V3LQVMRQ-BKuD8_-n.mjs")).egrepCommand
+		load: async () => (await import("./grep-V3LQVMRQ-CAog-whs.mjs")).egrepCommand
 	},
 	{
 		name: "rg",
-		load: async () => (await import("./rg-S4FXYXWB-CYYTczwS.mjs")).rgCommand
+		load: async () => (await import("./rg-S4FXYXWB-BU09MYZd.mjs")).rgCommand
 	},
 	{
 		name: "sed",
-		load: async () => (await import("./sed-S5UIK574-CwxPWXOK.mjs")).sedCommand
+		load: async () => (await import("./sed-S5UIK574-Da376UD_.mjs")).sedCommand
 	},
 	{
 		name: "awk",
-		load: async () => (await import("./awk2-LA3USKJP-BKpYBhCq.mjs")).awkCommand2
+		load: async () => (await import("./awk2-LA3USKJP-COeIINTX.mjs")).awkCommand2
 	},
 	{
 		name: "sort",
-		load: async () => (await import("./sort-SW2YEO5B-Ddct_1Pz.mjs")).sortCommand
+		load: async () => (await import("./sort-SW2YEO5B-DHY8HafY.mjs")).sortCommand
 	},
 	{
 		name: "uniq",
-		load: async () => (await import("./uniq-XSIZR6PB-DOVYyWW1.mjs")).uniqCommand
+		load: async () => (await import("./uniq-XSIZR6PB-D7gp7Anb.mjs")).uniqCommand
 	},
 	{
 		name: "comm",
-		load: async () => (await import("./comm-VV2LDX2J-DXysDls5.mjs")).commCommand
+		load: async () => (await import("./comm-VV2LDX2J-kD1sglqu.mjs")).commCommand
 	},
 	{
 		name: "cut",
-		load: async () => (await import("./cut-OKARJCCV-CWQykrKH.mjs")).cutCommand
+		load: async () => (await import("./cut-OKARJCCV-Db-5eS9I.mjs")).cutCommand
 	},
 	{
 		name: "paste",
-		load: async () => (await import("./paste-7JC6S4DX-CdJj-cJI.mjs")).pasteCommand
+		load: async () => (await import("./paste-7JC6S4DX-iCiRRowi.mjs")).pasteCommand
 	},
 	{
 		name: "tr",
-		load: async () => (await import("./tr-36LHWFRQ-BsmlOeIS.mjs")).trCommand
+		load: async () => (await import("./tr-36LHWFRQ-D9Cq56K4.mjs")).trCommand
 	},
 	{
 		name: "rev",
-		load: async () => (await import("./rev-5EHFX4EJ-hwUj0q3P.mjs")).rev
+		load: async () => (await import("./rev-5EHFX4EJ-6revLkqi.mjs")).rev
 	},
 	{
 		name: "nl",
-		load: async () => (await import("./nl-WSDW7I4O-DC2kRPJz.mjs")).nl
+		load: async () => (await import("./nl-WSDW7I4O-5BJZqLHX.mjs")).nl
 	},
 	{
 		name: "fold",
-		load: async () => (await import("./fold-4TQNYMSW-DZ55VvYj.mjs")).fold
+		load: async () => (await import("./fold-4TQNYMSW-B5h-AMVx.mjs")).fold
 	},
 	{
 		name: "expand",
-		load: async () => (await import("./expand-JSPG6VOP-ttcSq3Mp.mjs")).expand
+		load: async () => (await import("./expand-JSPG6VOP-BFcwehai.mjs")).expand
 	},
 	{
 		name: "unexpand",
-		load: async () => (await import("./unexpand-CADSA4VO-BsnuqR9R.mjs")).unexpand
+		load: async () => (await import("./unexpand-CADSA4VO-9zcEZRXf.mjs")).unexpand
 	},
 	{
 		name: "strings",
-		load: async () => (await import("./strings-6WDHLGMX-BIHR-Oic.mjs")).strings
+		load: async () => (await import("./strings-6WDHLGMX-BaHk50QP.mjs")).strings
 	},
 	{
 		name: "split",
-		load: async () => (await import("./split-4KKZZXXE-BEJyVNsf.mjs")).split
+		load: async () => (await import("./split-4KKZZXXE-Ci8BT8-z.mjs")).split
 	},
 	{
 		name: "column",
-		load: async () => (await import("./column-XT6UFXNQ-DHEQS2GF.mjs")).column
+		load: async () => (await import("./column-XT6UFXNQ-iPRSOasb.mjs")).column
 	},
 	{
 		name: "join",
-		load: async () => (await import("./join-TBRGI3LQ-B8IO8JE_.mjs")).join
+		load: async () => (await import("./join-TBRGI3LQ-C9n88HlW.mjs")).join
 	},
 	{
 		name: "tee",
-		load: async () => (await import("./tee-YUZ2FKCJ-BQC8HOFI.mjs")).teeCommand
+		load: async () => (await import("./tee-YUZ2FKCJ-Dd4bK2cr.mjs")).teeCommand
 	},
 	{
 		name: "find",
-		load: async () => (await import("./find-INTH3OLC-aFwVFFAB.mjs")).findCommand
+		load: async () => (await import("./find-INTH3OLC-aEynORdR.mjs")).findCommand
 	},
 	{
 		name: "basename",
@@ -23039,19 +23040,19 @@ var tt = [
 	},
 	{
 		name: "tree",
-		load: async () => (await import("./tree-YLD52CNT-D4dMPqQt.mjs")).treeCommand
+		load: async () => (await import("./tree-YLD52CNT-BN9bSe6p.mjs")).treeCommand
 	},
 	{
 		name: "du",
-		load: async () => (await import("./du-572XNP42-DQdhgiDu.mjs")).duCommand
+		load: async () => (await import("./du-572XNP42-DgMHEwz0.mjs")).duCommand
 	},
 	{
 		name: "env",
-		load: async () => (await import("./env-36M5BO7M-8lRqqbej.mjs")).envCommand
+		load: async () => (await import("./env-36M5BO7M-B5Y2xF7k.mjs")).envCommand
 	},
 	{
 		name: "printenv",
-		load: async () => (await import("./env-36M5BO7M-8lRqqbej.mjs")).printenvCommand
+		load: async () => (await import("./env-36M5BO7M-B5Y2xF7k.mjs")).printenvCommand
 	},
 	{
 		name: "alias",
@@ -23067,7 +23068,7 @@ var tt = [
 	},
 	{
 		name: "xargs",
-		load: async () => (await import("./xargs-MGZPH7AX-DkExQfH-.mjs")).xargsCommand
+		load: async () => (await import("./xargs-MGZPH7AX-BJThEzeV.mjs")).xargsCommand
 	},
 	{
 		name: "true",
@@ -23083,23 +23084,23 @@ var tt = [
 	},
 	{
 		name: "bash",
-		load: async () => (await import("./bash-YZ33HQZQ-BXIQsuYx.mjs")).bashCommand
+		load: async () => (await import("./bash-YZ33HQZQ-N0zD0_4M.mjs")).bashCommand
 	},
 	{
 		name: "sh",
-		load: async () => (await import("./bash-YZ33HQZQ-BXIQsuYx.mjs")).shCommand
+		load: async () => (await import("./bash-YZ33HQZQ-N0zD0_4M.mjs")).shCommand
 	},
 	{
 		name: "jq",
-		load: async () => (await import("./jq-4XLYLOS5-CLIHFVFj.mjs")).jqCommand
+		load: async () => (await import("./jq-4XLYLOS5-CK8Z9vQm.mjs")).jqCommand
 	},
 	{
 		name: "base64",
-		load: async () => (await import("./base64-C2AIWVNC-B03A3RGy.mjs")).base64Command
+		load: async () => (await import("./base64-C2AIWVNC-BAxca331.mjs")).base64Command
 	},
 	{
 		name: "diff",
-		load: async () => (await import("./diff-MWJFIG7X-WDZxzXoa.mjs")).diffCommand
+		load: async () => (await import("./diff-MWJFIG7X-DQIdBSfs.mjs")).diffCommand
 	},
 	{
 		name: "date",
@@ -23107,15 +23108,15 @@ var tt = [
 	},
 	{
 		name: "sleep",
-		load: async () => (await import("./sleep-X22JJINO-DhLUU2PM.mjs")).sleepCommand
+		load: async () => (await import("./sleep-X22JJINO-BetuZXZ0.mjs")).sleepCommand
 	},
 	{
 		name: "timeout",
-		load: async () => (await import("./timeout-YDCRSLPQ-C7CNkf1N.mjs")).timeoutCommand
+		load: async () => (await import("./timeout-YDCRSLPQ-CB1HuEoO.mjs")).timeoutCommand
 	},
 	{
 		name: "time",
-		load: async () => (await import("./time-D4LNBSWX-CYzen7kN.mjs")).timeCommand
+		load: async () => (await import("./time-D4LNBSWX-DXQbAEcT.mjs")).timeCommand
 	},
 	{
 		name: "seq",
@@ -23123,19 +23124,19 @@ var tt = [
 	},
 	{
 		name: "expr",
-		load: async () => (await import("./expr-5JAACS4X-D9wogLfS.mjs")).exprCommand
+		load: async () => (await import("./expr-5JAACS4X-DenrreBF.mjs")).exprCommand
 	},
 	{
 		name: "md5sum",
-		load: async () => (await import("./md5sum-SPU24VSG-dMIUV5CQ.mjs")).md5sumCommand
+		load: async () => (await import("./md5sum-SPU24VSG-BoM3CJhj.mjs")).md5sumCommand
 	},
 	{
 		name: "sha1sum",
-		load: async () => (await import("./sha1sum-2PTOAFR6-DGJWinX9.mjs")).sha1sumCommand
+		load: async () => (await import("./sha1sum-2PTOAFR6-CsCx87rr.mjs")).sha1sumCommand
 	},
 	{
 		name: "sha256sum",
-		load: async () => (await import("./sha256sum-NS7D3IXX-DELyNXeL.mjs")).sha256sumCommand
+		load: async () => (await import("./sha256sum-NS7D3IXX-ClcqLXpk.mjs")).sha256sumCommand
 	},
 	{
 		name: "file",
@@ -23143,11 +23144,11 @@ var tt = [
 	},
 	{
 		name: "html-to-markdown",
-		load: async () => (await import("./html-to-markdown-JW4MSQZO-DP2L09BX.mjs")).htmlToMarkdownCommand
+		load: async () => (await import("./html-to-markdown-JW4MSQZO-CgthY8Q9.mjs")).htmlToMarkdownCommand
 	},
 	{
 		name: "help",
-		load: async () => (await import("./help-HZ6M2CKN-DbsB_kKH.mjs")).helpCommand
+		load: async () => (await import("./help-HZ6M2CKN-BIWGeuQS.mjs")).helpCommand
 	},
 	{
 		name: "which",
@@ -23155,7 +23156,7 @@ var tt = [
 	},
 	{
 		name: "tac",
-		load: async () => (await import("./tac-2STMMJYW-DN6xIAaj.mjs")).tac
+		load: async () => (await import("./tac-2STMMJYW-Ch-yVMJm.mjs")).tac
 	},
 	{
 		name: "hostname",
@@ -23167,49 +23168,49 @@ var tt = [
 	},
 	{
 		name: "od",
-		load: async () => (await import("./od-WOKFDJTP-WHD7o2Sj.mjs")).od
+		load: async () => (await import("./od-WOKFDJTP-7FoQYKIp.mjs")).od
 	},
 	{
 		name: "gzip",
-		load: async () => (await import("./gzip-O5ASJAFY-CV-D3pVh.mjs")).gzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BBGQgiu9.mjs")).gzipCommand
 	},
 	{
 		name: "gunzip",
-		load: async () => (await import("./gzip-O5ASJAFY-CV-D3pVh.mjs")).gunzipCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BBGQgiu9.mjs")).gunzipCommand
 	},
 	{
 		name: "zcat",
-		load: async () => (await import("./gzip-O5ASJAFY-CV-D3pVh.mjs")).zcatCommand
+		load: async () => (await import("./gzip-O5ASJAFY-BBGQgiu9.mjs")).zcatCommand
 	}
 ];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (tt.push({
 	name: "tar",
-	load: async () => (await import("./tar-STHHZTZ6-DCcIG6Cv.mjs")).tarCommand
+	load: async () => (await import("./tar-STHHZTZ6-Cqi-mYPI.mjs")).tarCommand
 }), tt.push({
 	name: "yq",
-	load: async () => (await import("./yq-4QJW3EQG-CTS00zxI.mjs")).yqCommand
+	load: async () => (await import("./yq-4QJW3EQG-C4U4Cp_b.mjs")).yqCommand
 }), tt.push({
 	name: "xan",
-	load: async () => (await import("./xan-Y6WF3IRG-ZMwjkD4r.mjs")).xanCommand
+	load: async () => (await import("./xan-Y6WF3IRG-Bh-MBcAz.mjs")).xanCommand
 }), tt.push({
 	name: "sqlite3",
-	load: async () => (await import("./sqlite3-CGOEFJAO-gHSY7dKq.mjs")).sqlite3Command
+	load: async () => (await import("./sqlite3-CGOEFJAO-HUn9a6wW.mjs")).sqlite3Command
 }));
 var Yt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Yt.push({
 	name: "python3",
-	load: async () => (await import("./python3-POMOR4OA-NwucWAHw.mjs")).python3Command
+	load: async () => (await import("./python3-POMOR4OA-amB0VBNE.mjs")).python3Command
 }), Yt.push({
 	name: "python",
-	load: async () => (await import("./python3-POMOR4OA-NwucWAHw.mjs")).pythonCommand
+	load: async () => (await import("./python3-POMOR4OA-amB0VBNE.mjs")).pythonCommand
 }));
 var Qt = [];
 (typeof __BROWSER__ > "u" || !__BROWSER__) && (Qt.push({
 	name: "js-exec",
-	load: async () => (await import("./js-exec-N5KEZBH7-CgXIs_Pr.mjs")).jsExecCommand
+	load: async () => (await import("./js-exec-N5KEZBH7--CJAf2PU.mjs")).jsExecCommand
 }), Qt.push({
 	name: "node",
-	load: async () => (await import("./js-exec-N5KEZBH7-CgXIs_Pr.mjs")).nodeStubCommand
+	load: async () => (await import("./js-exec-N5KEZBH7--CJAf2PU.mjs")).nodeStubCommand
 }));
 new TextEncoder();
 Object.freeze({
@@ -24295,7 +24296,8 @@ const webhookSourceSchema = z.object({
 const cronSourceSchema = z.object({
 	kind: z.literal("cron"),
 	...baseSourceShape,
-	schedule: cronScheduleSchema
+	schedule: cronScheduleSchema,
+	payload: cronPayloadSchema.optional()
 });
 const pollSourceSchema = z.object({
 	kind: z.literal("poll"),
@@ -28675,29 +28677,6 @@ function mountAccountRoutes(options) {
 	return account;
 }
 //#endregion
-//#region src/middleware/require-worker-token.ts
-/** Worker auth from Bearer or x-api-key (Anthropic SDK uses the latter). */
-function readWorkerTokenFromRequest(c) {
-	const authorization = c.req.header("authorization");
-	if (authorization?.startsWith("Bearer ")) return authorization.slice(7).trim();
-	const apiKey = c.req.header("x-api-key")?.trim();
-	if (apiKey) return apiKey;
-}
-function requireWorkerToken(expectedToken) {
-	return async (c, next) => {
-		if (!expectedToken) return c.json({
-			error: "worker_auth_unconfigured",
-			message: "Worker auth is not configured."
-		}, 503);
-		const token = readWorkerTokenFromRequest(c);
-		if (!token || token !== expectedToken) return c.json({
-			error: "unauthorized",
-			message: "Invalid worker token."
-		}, 401);
-		await next();
-	};
-}
-//#endregion
 //#region src/routes/internal/web-search-proxy.ts
 const EXA_API_ORIGIN = "https://api.exa.ai";
 async function proxyExaWebSearchRequest(options) {
@@ -28728,11 +28707,129 @@ const EnsureWebhookRouteBodySchema = z.object({
 	route: z.string().trim().min(1),
 	attachmentSlugs: z.array(z.string().trim().min(1)).min(1)
 });
+async function runOrgDatabaseQuery(options, query) {
+	const handle = await acquireProjectDatabasePool(options);
+	try {
+		if (handle.dialect !== "postgres") throw new Error("DB proxy requires postgres");
+		return { rows: (await handle.pool.query({
+			text: query.sql,
+			values: query.params,
+			rowMode: query.method === "all" ? "array" : void 0
+		})).rows };
+	} finally {
+		releaseProjectDatabasePool(options);
+	}
+}
+async function runOrgDatabaseMigrations(options, migrations, lockKey) {
+	const handle = await acquireProjectDatabasePool(options);
+	try {
+		if (handle.dialect !== "postgres") throw new Error("DB proxy requires postgres");
+		const client = await handle.pool.connect();
+		try {
+			await client.query("BEGIN");
+			await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [lockKey]);
+			await client.query(`
+        CREATE TABLE IF NOT EXISTS "__drizzle_migrations" (
+          id SERIAL PRIMARY KEY,
+          hash text NOT NULL,
+          created_at numeric
+        )
+      `);
+			const journal = await client.query(`SELECT created_at FROM "__drizzle_migrations" ORDER BY created_at DESC LIMIT 1`);
+			const lastMigrationMillis = journal.rows[0]?.created_at === void 0 || journal.rows[0]?.created_at === null ? void 0 : Number(journal.rows[0].created_at);
+			const results = [];
+			for (const migration of migrations) {
+				if (lastMigrationMillis !== void 0 && lastMigrationMillis >= migration.folderMillis) continue;
+				for (const statement of migration.sql) {
+					const result = await client.query(statement);
+					results.push({ rows: result.rows });
+				}
+				await client.query(`INSERT INTO "__drizzle_migrations" ("hash", "created_at") VALUES ($1, $2)`, [migration.hash, migration.folderMillis]);
+			}
+			await client.query("COMMIT");
+			return results;
+		} catch (error) {
+			await client.query("ROLLBACK").catch(() => void 0);
+			throw error;
+		} finally {
+			client.release();
+		}
+	} finally {
+		releaseProjectDatabasePool(options);
+	}
+}
 function mountInternalRoutes(workerToken, tokenRefresh, llmProxy, mcp) {
 	const internal = new Hono();
 	const protect = requireWorkerToken(workerToken);
 	const materialize = createCredentialMaterializeHandler(tokenRefresh);
+	internal.use("/orgs/:organizationId/db/*", async (c, next) => {
+		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
+		if (!verified || verified.organizationId !== c.req.param("organizationId")) return c.json({
+			error: "unauthorized",
+			message: "Invalid database proxy token."
+		}, 401);
+		await next();
+	});
+	internal.post("/orgs/:organizationId/db/query", async (c) => {
+		const organizationId = c.req.param("organizationId");
+		const organization = await selectOrganizationById(organizationId);
+		if (!organization) return c.json({ error: "Organization not found" }, 404);
+		const parsed = DbProxyQueryRequestSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			error: "Invalid request body",
+			details: parsed.error.flatten()
+		}, 400);
+		const options = resolveOrgProjectDatabaseOptions(organization);
+		try {
+			return c.json(await runOrgDatabaseQuery(options, parsed.data));
+		} catch (error) {
+			console.error("Database proxy query failed", {
+				organizationId,
+				error
+			});
+			const message = error instanceof Error ? error.message : "Database proxy query failed.";
+			return c.json({
+				error: "db_proxy_query_failed",
+				message
+			}, 500);
+		}
+	});
+	internal.post("/orgs/:organizationId/db/migrate", async (c) => {
+		const organizationId = c.req.param("organizationId");
+		const organization = await selectOrganizationById(organizationId);
+		if (!organization) return c.json({ error: "Organization not found" }, 404);
+		const parsed = DbProxyMigrateRequestSchema.safeParse(await c.req.json().catch(() => null));
+		if (!parsed.success) return c.json({
+			error: "Invalid request body",
+			details: parsed.error.flatten()
+		}, 400);
+		const options = resolveOrgProjectDatabaseOptions(organization);
+		try {
+			return c.json({ results: await runOrgDatabaseMigrations(options, parsed.data.migrations, organizationId) });
+		} catch (error) {
+			console.error("Database proxy migration failed", {
+				organizationId,
+				error
+			});
+			const message = error instanceof Error ? error.message : "Database proxy migration failed.";
+			return c.json({
+				error: "db_proxy_migrate_failed",
+				message
+			}, 500);
+		}
+	});
 	internal.use("/*", protect);
+	internal.use("/projects/:projectId/*", async (c, next) => {
+		const verified = verifyOrgWorkerToken(workerToken, readWorkerTokenFromRequest(c));
+		if (verified) {
+			const project = await selectProjectById(c.req.param("projectId"));
+			if (project && project.organizationId !== verified.organizationId) return c.json({
+				error: "unauthorized",
+				message: "Token org mismatch."
+			}, 401);
+		}
+		await next();
+	});
 	internal.get("/projects/:projectId/connect-context", async (c) => {
 		const project = await selectProjectById(c.req.param("projectId"));
 		if (!project) return c.json({ error: "Project not found" }, 404);
@@ -29009,6 +29106,7 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 			if (!organization) throw new Error(`Organization ${job.organizationId} not found`);
 			const database = await resolveOrgRuntimeDatabase(job.organizationId);
 			const workerRuntime = platformConfig.hosting.workerRuntime;
+			const orgWorkerToken = mintOrgWorkerToken(workerRuntime.workerToken, job.organizationId);
 			return {
 				organizationId: job.organizationId,
 				projects: [],
@@ -29021,11 +29119,11 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 					...orgSchedulerRuntimeEnv(organization, process.env),
 					...platformConfig.llmProxy?.workerEnv({
 						platformUrl: workerRuntime.platformUrl,
-						workerToken: workerRuntime.workerToken
+						workerToken: orgWorkerToken
 					}),
 					...platformConfig.workerEnv?.({
 						platformUrl: workerRuntime.platformUrl,
-						workerToken: workerRuntime.workerToken
+						workerToken: orgWorkerToken
 					})
 				},
 				hosting: organization.hostingAppName ? { appName: organization.hostingAppName } : void 0,
@@ -29071,4 +29169,4 @@ async function startPlatformServer(platformConfig, hooks = {}) {
 //#endregion
 export { r1 as S, o as _, c as a, b$1 as b, a$1 as c, c$1 as d, r as f, e as g, u as h, n$1 as i, d$1 as l, b as m, n, p as o, r$1 as p, i as r, x as s, startPlatformServer as t, x$1 as u, r$3 as v, I1 as x, h as y };
 
-//# sourceMappingURL=start-CVrMV6Nm.mjs.map
+//# sourceMappingURL=start-MLNBN7iD.mjs.map