Serve tenant-level product reads to organization API keys

[RhysSullivan]

Reworked per review: instead of a parallel /api/admin/integrations endpoint, an org-scoped API key now works on the EXISTING product paths for reads. GET /api/integrations — the exact call the customer's backend already makes — plus every other tenant-level GET (integration detail, tools, policies, org-owned connections) accepts the org key with one credential.

How it works:

• The neutral identity seam resolves a credential to Principal | PlatformPrincipal — the platform shape has no accountId, mirroring the resolution layer's existing ApiKeyOwner split, so nothing can bind an org key to a subject by accident.
• The shared execution-stack middleware routes a platform principal to a subject-less, write-refusing platform executor (makePlatformExecutor — storage policy denies all writes, ordinary surfaces keep bound reach so no member's personal rows resolve, and no subject row is minted). Non-GET requests are refused up front with a typed 403 (read_only_credential) before any handler runs.
• AuthContext.accountId is now honestly string | null; the two member-only readers gained explicit guards.
• The fixed-executor host (local) refuses platform credentials — it has no platform view.
• Cloud renders the new refusal as { error, code } JSON like its other identity failures; the shared text strategy covers it too.

What an org key gets vs. doesn't:

• ✅ tenant catalog, tools list/schema, org-owned connection listings, policies — all read-only, tenant-scoped by storage policy
• ❌ any write (403 before dispatch), any member's personal connections (no subject binds), MCP sessions (unchanged rejection), executions (no engine; paused-execution reads answer empty)

Tested: new platform-credential.test.ts drives the shared middleware end-to-end over the real router (catalog read succeeds, member rows invisible, writes 403 pre-handler, no phantom subject row); cloud auth unit tests updated for the resolve-not-reject behavior; api/selfhost/cloud suites green (3 pre-existing org-api-key-revoke failures reproduce on clean main, flagged separately); cloud e2e admin-users + surface-reachability + connections-credentials green.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	de26d64	Commit Preview URL Branch Preview URL	Aug 05 2026, 11:25 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	de26d64	Aug 05 2026, 11:27 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1544

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1544

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1544

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1544

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1544

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1544

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1544

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1544

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1544

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1544

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1544

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1544

executor

npm i https://pkg.pr.new/executor@1544

commit: de26d64