WIP: move file routes under /$org and reshape auth.me

[RhysSullivan]

WIP: move file routes under /$org and reshape auth.me

WIP: cloud routes under $org, API protected mounts under /api/$org

Cut web routes to /:org and API routes to /api/:org/...

The cloud app moves all protected routes under a URL-addressed organisation:

• App routes mount under /$org/... with a layout component that resolves
  the URL handle against useAuth().organizations, redirects to the first
  membership when the URL handle is unknown, and exposes
  { orgId, orgName, orgHandle } via OrgRouteContext to descendants.
  /$org/-/billing, /$org/-/settings, etc. live in flat-style files
  using the bracket-escape [-] convention so the TanStack generator
  treats the dash as a literal segment instead of an ignore prefix.
• Index route at / redirects to the first membership's /$handle.
  AuthGate routes auth.organizations.length === 0 to onboarding.
• Shell, NavItem, source links, and the org switcher all generate paths via
  useOrgRoute() and TanStack Link params={{ org }}. The legacy
  switchOrganization mutation and organizationsAtom are dropped — the
  switcher now navigates to /$org and the URL is the source of truth.
• Cloud's protected API moves under /api/:org/... via an
  HttpRouter.prefixed wrapper layered onto ProtectedCloudApiLive.
  ExecutionStackMiddleware reads the URL :org segment, resolves it
  through resolveOrgContext, and verifies the session user is a member
  via authorizeOrganization — session.organizationId is no longer
  consulted.
• The frontend executor client sets its base URL to
  ${origin}/api/${orgHandle} once the org layout resolves so existing
  endpoint atoms continue to work unchanged.
• Test harness mirrors the prefix layer, lazily seeds organizations
  rows whose handle equals the requested orgId, and rewrites outgoing
  request URLs to include /api/${orgId}. The x-test-org-id header is
  gone; x-test-user-id remains for tests that need a non-default user.

[RhysSullivan]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• WIP: move file routes under /$org and reshape auth.me #507 : 2 dependent PRs (#508 , #514 ) 👈 (View in Graphite)
• Add scope-stack builders, URL-context resolver, workspace executor #506
• Add workspaces CRUD API under OrgHttpApi #505
• Cut over scope ids to deterministic prefixed form #504
• Add organizations.handle and workspaces table #503
• Add cloud id helpers: prefixed local ids, scope id constructors, handle slugifier #502
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[pkg-pr-new]

Open in StackBlitz

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@507

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@507

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@507

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@507

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@507

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@507

@executor-js/storage-core

npm i https://pkg.pr.new/@executor-js/storage-core@507

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@507

@executor-js/plugin-google-discovery

npm i https://pkg.pr.new/@executor-js/plugin-google-discovery@507

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@507

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@507

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@507

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@507

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@507

executor

npm i https://pkg.pr.new/executor@507

commit: 026d828

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	026d828	Commit Preview URL Branch Preview URL	May 04 2026, 05:15 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	026d828	May 04 2026, 05:15 PM