@keystrokehq/hosting 0.0.0-staging-20260717081204

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/LICENSE +13 -0
  2. package/dist/index.cjs +8408 -0
  3. package/dist/index.cjs.map +1 -0
  4. package/dist/index.d.cts +232 -0
  5. package/dist/index.d.cts.map +1 -0
  6. package/dist/index.d.mts +232 -0
  7. package/dist/index.d.mts.map +1 -0
  8. package/dist/index.mjs +8354 -0
  9. package/dist/index.mjs.map +1 -0
  10. package/package.json +52 -0
package/dist/index.d.cts ADDED
@@ -0,0 +1,232 @@
1
+ import Docker from "dockerode";
2
+
3
+ //#region src/constants.d.ts
4
+ declare const PROJECT_SERVER_IMAGE = "keystroke/project-server:local";
5
+ declare const PROJECT_SERVER_PORT = 3000;
6
+ declare const PROJECT_SERVER_ROOT = "/app";
7
+ declare const PROJECT_SERVER_FRAMEWORK_ROOT = "/opt/keystroke";
8
+ declare const PROJECT_SERVER_FRAMEWORK_NODE_MODULES = "/opt/keystroke/node_modules";
9
+ declare const PROJECT_SERVER_HEALTH: {
10
+ readonly path: "/health";
11
+ readonly port: 3000;
12
+ };
13
+ declare const PROJECT_SERVER_DEPLOY_STATUS: {
14
+ readonly path: "/deploy-status";
15
+ readonly port: 3000;
16
+ };
17
+ //#endregion
18
+ //#region src/runtime.d.ts
19
+ type ProjectRuntimeDatabase = {
20
+ host: string;
21
+ port: number;
22
+ database: string;
23
+ user: string;
24
+ password: string;
25
+ searchPath: string;
26
+ organizationId: string; /** @deprecated Per-project workers only — org workers omit this. */
27
+ projectId?: string;
28
+ };
29
+ type OrgProjectDeploy = {
30
+ projectId: string;
31
+ name: string;
32
+ artifactId: string;
33
+ artifactStorageKey: string;
34
+ };
35
+ type OrgArtifactSpec = {
36
+ projectId: string;
37
+ artifactStorageKey: string;
38
+ };
39
+ type ProjectRuntimeHosting = {
40
+ appName: string;
41
+ };
42
+ type ProjectRuntimeInput = {
43
+ organizationId: string;
44
+ projects: OrgProjectDeploy[];
45
+ database: ProjectRuntimeDatabase;
46
+ hosting?: ProjectRuntimeHosting; /** Extra env merged into the project server launch spec (e.g. from an llmProxy plugin). */
47
+ env?: Record<string, string>; /** Previous runtime to retire after a successful cutover. */
48
+ previousRuntimeId?: string | null;
49
+ };
50
+ /** Builds base64 `KEYSTROKE_ORG_ARTIFACTS` payload for org worker containers. */
51
+ declare function encodeOrgArtifacts(artifacts: OrgArtifactSpec[]): string;
52
+ declare function parseOrgArtifactsFromEnv(env?: NodeJS.ProcessEnv): OrgArtifactSpec[] | undefined;
53
+ type ProjectRuntimeDestroyInput = {
54
+ runtimeId: string;
55
+ hosting?: ProjectRuntimeHosting;
56
+ };
57
+ type ProjectRuntimeReconcileInput = {
58
+ organizationId: string; /** The runtime to keep — every other runtime belonging to this org should be destroyed. */
59
+ keepRuntimeId: string;
60
+ hosting?: ProjectRuntimeHosting;
61
+ };
62
+ type ProjectRuntimeResult = {
63
+ runtimeId: string;
64
+ baseUrl: string;
65
+ };
66
+ type ProjectRuntime = {
67
+ start(input: ProjectRuntimeInput): Promise<ProjectRuntimeResult>;
68
+ destroy?(input: ProjectRuntimeDestroyInput): Promise<void>;
69
+ /**
70
+ * Sweep away every runtime for this org except `keepRuntimeId`, retrying
71
+ * transient failures instead of giving up after one attempt. This catches
72
+ * orphans that a single {@link destroy} call missed (e.g. a previous deploy's
73
+ * destroy failed silently), not just the one runtime recorded as "previous."
74
+ */
75
+ reconcile?(input: ProjectRuntimeReconcileInput): Promise<void>;
76
+ };
77
+ type ProjectPingTarget = {
78
+ baseUrl: string | null;
79
+ runtimeId: string | null;
80
+ };
81
+ //#endregion
82
+ //#region src/worker-runtime-config.d.ts
83
+ /** Resolved platform ↔ project-server worker auth contract. */
84
+ type WorkerRuntimeConfig = {
85
+ /** Platform API base URL reachable from the project-server runtime. */platformUrl: string; /** Bearer token for platform `/internal` routes. */
86
+ workerToken: string;
87
+ };
88
+ declare class WorkerRuntimeConfigError extends Error {
89
+ readonly missing: readonly string[];
90
+ constructor(missing: string[]);
91
+ }
92
+ /** Fail fast when the platform cannot start worker-mode project servers. */
93
+ declare function resolveWorkerRuntimeConfig(source?: NodeJS.ProcessEnv): WorkerRuntimeConfig;
94
+ //#endregion
95
+ //#region src/plugin.d.ts
96
+ type HostingOptions = {
97
+ image?: string;
98
+ env?: NodeJS.ProcessEnv;
99
+ fetchImpl?: typeof fetch;
100
+ healthTimeoutMs?: number;
101
+ };
102
+ type OrganizationHostingInput = {
103
+ organizationId: string;
104
+ name: string;
105
+ };
106
+ type OrganizationHostingResult = {
107
+ appName: string;
108
+ };
109
+ type HostingPlugin = {
110
+ name: string; /** Validated at plugin creation — shared by platform internal routes and project-server containers. */
111
+ workerRuntime: WorkerRuntimeConfig;
112
+ createRuntime(): ProjectRuntime;
113
+ provisionOrganization?(input: OrganizationHostingInput): Promise<OrganizationHostingResult>;
114
+ deprovisionOrganization?(result: OrganizationHostingResult): Promise<void>;
115
+ canPingTarget?(target: ProjectPingTarget): target is {
116
+ baseUrl: string;
117
+ runtimeId: string | null;
118
+ };
119
+ pingRequestHeaders?(runtimeId: string | null): Record<string, string>;
120
+ };
121
+ //#endregion
122
+ //#region src/docker/create-docker-runtime.d.ts
123
+ type WorkspacesMount = {
124
+ hostPath: string;
125
+ containerPath: string;
126
+ };
127
+ type DockerPluginOptions = HostingOptions & {
128
+ docker?: Docker; /** Bind a shared host workspace dir into dev workers (VM sandbox proxy mount path). */
129
+ workspacesMount?: WorkspacesMount; /** Additional Docker bind mounts (`host:container[:options]`). */
130
+ extraBinds?: string[];
131
+ };
132
+ //#endregion
133
+ //#region src/docker/plugin.d.ts
134
+ declare function dockerPlugin(options?: DockerPluginOptions): HostingPlugin;
135
+ //#endregion
136
+ //#region src/default-plugin.d.ts
137
+ /** Local Docker hosting — default for platform and dev. */
138
+ declare function defaultHostingPlugin(options?: DockerPluginOptions): HostingPlugin;
139
+ //#endregion
140
+ //#region src/runtime-env.d.ts
141
+ /** Env keys that must never be forwarded into untrusted org workers. */
142
+ declare const FORBIDDEN_WORKER_ENV_KEYS: readonly ["BETTER_AUTH_SECRET", "DATABASE_URL", "POSTHOG_API_KEY", "POSTGRES_PASSWORD", "PLATFORM_WORKER_TOKEN", "STRIPE_SECRET_KEY", "CREDENTIAL_ENCRYPTION_KEY"];
143
+ /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
144
+ declare const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
145
+ type RuntimeLaunchSpec = {
146
+ image: string;
147
+ env: Record<string, string>;
148
+ port: number;
149
+ health: typeof PROJECT_SERVER_HEALTH;
150
+ };
151
+ /**
152
+ * Builds the launch spec for an org worker. Each deploy artifact is encoded in
153
+ * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
154
+ */
155
+ declare function resolveRuntimeLaunch(options: HostingOptions, artifacts: OrgArtifactSpec[], database: ProjectRuntimeDatabase, extraEnv?: Record<string, string>): RuntimeLaunchSpec;
156
+ /** Env vars passed into the org worker container/machine. */
157
+ declare function buildRuntimeEnv(source: NodeJS.ProcessEnv, artifacts: OrgArtifactSpec[], database: ProjectRuntimeDatabase, extraEnv?: Record<string, string>): Record<string, string>;
158
+ declare function resolvePlatformWorkerToken(source?: NodeJS.ProcessEnv): string | undefined;
159
+ /** Platform API URL reachable from a project-server container. */
160
+ declare function resolveWorkerPlatformUrl(source?: NodeJS.ProcessEnv): string | undefined;
161
+ /** Rewrite loopback hosts so containers can reach Postgres and other host services. */
162
+ declare function rewriteLoopbackHost(host: string): string;
163
+ declare function rewriteLoopbackUrl(url: string): string;
164
+ /** dockerode expects `KEY=value` strings. */
165
+ declare function formatDockerEnv(env: Record<string, string>): string[];
166
+ declare function resolveProjectServerImage(env?: NodeJS.ProcessEnv, override?: string): string;
167
+ //#endregion
168
+ //#region src/org-worker-token.d.ts
169
+ /**
170
+ * Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
171
+ * platform can tell which org a machine is calling as, and stateless — verified
172
+ * by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
173
+ */
174
+ declare function mintOrgWorkerToken(secret: string, organizationId: string): string;
175
+ type VerifiedOrgWorkerToken = {
176
+ organizationId: string;
177
+ };
178
+ declare function verifyOrgWorkerToken(secret: string | undefined, token: string | undefined): VerifiedOrgWorkerToken | undefined;
179
+ //#endregion
180
+ //#region src/wait-for-health.d.ts
181
+ type WaitForHealthOptions = {
182
+ timeoutMs?: number;
183
+ intervalMs?: number;
184
+ fetchImpl?: typeof fetch;
185
+ };
186
+ declare function waitForHealth(baseUrl: string, options?: WaitForHealthOptions): Promise<void>;
187
+ //#endregion
188
+ //#region src/runtime-constants.d.ts
189
+ /** Timeout for a single project runtime `/health` probe. */
190
+ declare const RUNTIME_PING_TIMEOUT_MS = 15000;
191
+ //#endregion
192
+ //#region src/ping-project.d.ts
193
+ type PingProjectOptions = {
194
+ runtimeId?: string | null;
195
+ fetchImpl?: typeof fetch;
196
+ timeoutMs?: number;
197
+ plugin?: Pick<HostingPlugin, "pingRequestHeaders">;
198
+ };
199
+ declare function pingProject(baseUrl: string, options?: PingProjectOptions): Promise<boolean>;
200
+ //#endregion
201
+ //#region src/ping-project-target.d.ts
202
+ declare function canPingProjectTarget(target: ProjectPingTarget, plugin?: Pick<HostingPlugin, "canPingTarget">): target is {
203
+ baseUrl: string;
204
+ runtimeId: string | null;
205
+ };
206
+ declare function pingProjectTarget(target: ProjectPingTarget, options?: PingProjectOptions & {
207
+ plugin?: Pick<HostingPlugin, "canPingTarget" | "pingRequestHeaders">;
208
+ }): Promise<boolean>;
209
+ //#endregion
210
+ //#region src/deploy-status.d.ts
211
+ /** Per-project bootstrap outcome reported by an org runtime machine. */
212
+ type ProjectDeployStatus = {
213
+ projectId: string;
214
+ ok: boolean;
215
+ error?: string;
216
+ };
217
+ type DeployStatusResponse = {
218
+ projects: ProjectDeployStatus[];
219
+ };
220
+ type FetchDeployStatusOptions = {
221
+ fetchImpl?: typeof fetch;
222
+ timeoutMs?: number;
223
+ };
224
+ /**
225
+ * Ask a running org machine which projects bootstrapped and which failed.
226
+ * Best-effort: returns undefined on any error so callers can fall back to
227
+ * treating every project as healthy (preserving pre-existing behavior).
228
+ */
229
+ declare function fetchDeployStatus(baseUrl: string, options?: FetchDeployStatusOptions): Promise<DeployStatusResponse | undefined>;
230
+ //#endregion
231
+ export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, FORBIDDEN_WORKER_ENV_KEYS, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type VerifiedOrgWorkerToken, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
232
+ //# sourceMappingURL=index.d.cts.map
package/dist/index.d.cts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.cts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/org-worker-token.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cCkCzE,yBAAA;;cAmBA,yBAAA;AAAA,KAED,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;;;;AP3DN;iBOkEhB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;APnEH;AAAA,iBOkGgB,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBA2Da,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAezB,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;APjLzC;AAAA,iBO+LgB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;;;;APlOF;;iBQWgB,kBAAA,CAAmB,MAAA,UAAgB,cAAsB;AAAA,KAI7D,sBAAA;EACV,cAAc;AAAA;AAAA,iBAGA,oBAAA,CACd,MAAA,sBACA,KAAA,uBACC,sBAAsB;;;KCjBb,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AbZF;;;;AAAgC;AAAhC,iBaoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}
package/dist/index.d.mts ADDED
@@ -0,0 +1,232 @@
1
+ import Docker from "dockerode";
2
+
3
+ //#region src/constants.d.ts
4
+ declare const PROJECT_SERVER_IMAGE = "keystroke/project-server:local";
5
+ declare const PROJECT_SERVER_PORT = 3000;
6
+ declare const PROJECT_SERVER_ROOT = "/app";
7
+ declare const PROJECT_SERVER_FRAMEWORK_ROOT = "/opt/keystroke";
8
+ declare const PROJECT_SERVER_FRAMEWORK_NODE_MODULES = "/opt/keystroke/node_modules";
9
+ declare const PROJECT_SERVER_HEALTH: {
10
+ readonly path: "/health";
11
+ readonly port: 3000;
12
+ };
13
+ declare const PROJECT_SERVER_DEPLOY_STATUS: {
14
+ readonly path: "/deploy-status";
15
+ readonly port: 3000;
16
+ };
17
+ //#endregion
18
+ //#region src/runtime.d.ts
19
+ type ProjectRuntimeDatabase = {
20
+ host: string;
21
+ port: number;
22
+ database: string;
23
+ user: string;
24
+ password: string;
25
+ searchPath: string;
26
+ organizationId: string; /** @deprecated Per-project workers only — org workers omit this. */
27
+ projectId?: string;
28
+ };
29
+ type OrgProjectDeploy = {
30
+ projectId: string;
31
+ name: string;
32
+ artifactId: string;
33
+ artifactStorageKey: string;
34
+ };
35
+ type OrgArtifactSpec = {
36
+ projectId: string;
37
+ artifactStorageKey: string;
38
+ };
39
+ type ProjectRuntimeHosting = {
40
+ appName: string;
41
+ };
42
+ type ProjectRuntimeInput = {
43
+ organizationId: string;
44
+ projects: OrgProjectDeploy[];
45
+ database: ProjectRuntimeDatabase;
46
+ hosting?: ProjectRuntimeHosting; /** Extra env merged into the project server launch spec (e.g. from an llmProxy plugin). */
47
+ env?: Record<string, string>; /** Previous runtime to retire after a successful cutover. */
48
+ previousRuntimeId?: string | null;
49
+ };
50
+ /** Builds base64 `KEYSTROKE_ORG_ARTIFACTS` payload for org worker containers. */
51
+ declare function encodeOrgArtifacts(artifacts: OrgArtifactSpec[]): string;
52
+ declare function parseOrgArtifactsFromEnv(env?: NodeJS.ProcessEnv): OrgArtifactSpec[] | undefined;
53
+ type ProjectRuntimeDestroyInput = {
54
+ runtimeId: string;
55
+ hosting?: ProjectRuntimeHosting;
56
+ };
57
+ type ProjectRuntimeReconcileInput = {
58
+ organizationId: string; /** The runtime to keep — every other runtime belonging to this org should be destroyed. */
59
+ keepRuntimeId: string;
60
+ hosting?: ProjectRuntimeHosting;
61
+ };
62
+ type ProjectRuntimeResult = {
63
+ runtimeId: string;
64
+ baseUrl: string;
65
+ };
66
+ type ProjectRuntime = {
67
+ start(input: ProjectRuntimeInput): Promise<ProjectRuntimeResult>;
68
+ destroy?(input: ProjectRuntimeDestroyInput): Promise<void>;
69
+ /**
70
+ * Sweep away every runtime for this org except `keepRuntimeId`, retrying
71
+ * transient failures instead of giving up after one attempt. This catches
72
+ * orphans that a single {@link destroy} call missed (e.g. a previous deploy's
73
+ * destroy failed silently), not just the one runtime recorded as "previous."
74
+ */
75
+ reconcile?(input: ProjectRuntimeReconcileInput): Promise<void>;
76
+ };
77
+ type ProjectPingTarget = {
78
+ baseUrl: string | null;
79
+ runtimeId: string | null;
80
+ };
81
+ //#endregion
82
+ //#region src/worker-runtime-config.d.ts
83
+ /** Resolved platform ↔ project-server worker auth contract. */
84
+ type WorkerRuntimeConfig = {
85
+ /** Platform API base URL reachable from the project-server runtime. */platformUrl: string; /** Bearer token for platform `/internal` routes. */
86
+ workerToken: string;
87
+ };
88
+ declare class WorkerRuntimeConfigError extends Error {
89
+ readonly missing: readonly string[];
90
+ constructor(missing: string[]);
91
+ }
92
+ /** Fail fast when the platform cannot start worker-mode project servers. */
93
+ declare function resolveWorkerRuntimeConfig(source?: NodeJS.ProcessEnv): WorkerRuntimeConfig;
94
+ //#endregion
95
+ //#region src/plugin.d.ts
96
+ type HostingOptions = {
97
+ image?: string;
98
+ env?: NodeJS.ProcessEnv;
99
+ fetchImpl?: typeof fetch;
100
+ healthTimeoutMs?: number;
101
+ };
102
+ type OrganizationHostingInput = {
103
+ organizationId: string;
104
+ name: string;
105
+ };
106
+ type OrganizationHostingResult = {
107
+ appName: string;
108
+ };
109
+ type HostingPlugin = {
110
+ name: string; /** Validated at plugin creation — shared by platform internal routes and project-server containers. */
111
+ workerRuntime: WorkerRuntimeConfig;
112
+ createRuntime(): ProjectRuntime;
113
+ provisionOrganization?(input: OrganizationHostingInput): Promise<OrganizationHostingResult>;
114
+ deprovisionOrganization?(result: OrganizationHostingResult): Promise<void>;
115
+ canPingTarget?(target: ProjectPingTarget): target is {
116
+ baseUrl: string;
117
+ runtimeId: string | null;
118
+ };
119
+ pingRequestHeaders?(runtimeId: string | null): Record<string, string>;
120
+ };
121
+ //#endregion
122
+ //#region src/docker/create-docker-runtime.d.ts
123
+ type WorkspacesMount = {
124
+ hostPath: string;
125
+ containerPath: string;
126
+ };
127
+ type DockerPluginOptions = HostingOptions & {
128
+ docker?: Docker; /** Bind a shared host workspace dir into dev workers (VM sandbox proxy mount path). */
129
+ workspacesMount?: WorkspacesMount; /** Additional Docker bind mounts (`host:container[:options]`). */
130
+ extraBinds?: string[];
131
+ };
132
+ //#endregion
133
+ //#region src/docker/plugin.d.ts
134
+ declare function dockerPlugin(options?: DockerPluginOptions): HostingPlugin;
135
+ //#endregion
136
+ //#region src/default-plugin.d.ts
137
+ /** Local Docker hosting — default for platform and dev. */
138
+ declare function defaultHostingPlugin(options?: DockerPluginOptions): HostingPlugin;
139
+ //#endregion
140
+ //#region src/runtime-env.d.ts
141
+ /** Env keys that must never be forwarded into untrusted org workers. */
142
+ declare const FORBIDDEN_WORKER_ENV_KEYS: readonly ["BETTER_AUTH_SECRET", "DATABASE_URL", "POSTHOG_API_KEY", "POSTGRES_PASSWORD", "PLATFORM_WORKER_TOKEN", "STRIPE_SECRET_KEY", "CREDENTIAL_ENCRYPTION_KEY"];
143
+ /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
144
+ declare const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
145
+ type RuntimeLaunchSpec = {
146
+ image: string;
147
+ env: Record<string, string>;
148
+ port: number;
149
+ health: typeof PROJECT_SERVER_HEALTH;
150
+ };
151
+ /**
152
+ * Builds the launch spec for an org worker. Each deploy artifact is encoded in
153
+ * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
154
+ */
155
+ declare function resolveRuntimeLaunch(options: HostingOptions, artifacts: OrgArtifactSpec[], database: ProjectRuntimeDatabase, extraEnv?: Record<string, string>): RuntimeLaunchSpec;
156
+ /** Env vars passed into the org worker container/machine. */
157
+ declare function buildRuntimeEnv(source: NodeJS.ProcessEnv, artifacts: OrgArtifactSpec[], database: ProjectRuntimeDatabase, extraEnv?: Record<string, string>): Record<string, string>;
158
+ declare function resolvePlatformWorkerToken(source?: NodeJS.ProcessEnv): string | undefined;
159
+ /** Platform API URL reachable from a project-server container. */
160
+ declare function resolveWorkerPlatformUrl(source?: NodeJS.ProcessEnv): string | undefined;
161
+ /** Rewrite loopback hosts so containers can reach Postgres and other host services. */
162
+ declare function rewriteLoopbackHost(host: string): string;
163
+ declare function rewriteLoopbackUrl(url: string): string;
164
+ /** dockerode expects `KEY=value` strings. */
165
+ declare function formatDockerEnv(env: Record<string, string>): string[];
166
+ declare function resolveProjectServerImage(env?: NodeJS.ProcessEnv, override?: string): string;
167
+ //#endregion
168
+ //#region src/org-worker-token.d.ts
169
+ /**
170
+ * Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
171
+ * platform can tell which org a machine is calling as, and stateless — verified
172
+ * by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
173
+ */
174
+ declare function mintOrgWorkerToken(secret: string, organizationId: string): string;
175
+ type VerifiedOrgWorkerToken = {
176
+ organizationId: string;
177
+ };
178
+ declare function verifyOrgWorkerToken(secret: string | undefined, token: string | undefined): VerifiedOrgWorkerToken | undefined;
179
+ //#endregion
180
+ //#region src/wait-for-health.d.ts
181
+ type WaitForHealthOptions = {
182
+ timeoutMs?: number;
183
+ intervalMs?: number;
184
+ fetchImpl?: typeof fetch;
185
+ };
186
+ declare function waitForHealth(baseUrl: string, options?: WaitForHealthOptions): Promise<void>;
187
+ //#endregion
188
+ //#region src/runtime-constants.d.ts
189
+ /** Timeout for a single project runtime `/health` probe. */
190
+ declare const RUNTIME_PING_TIMEOUT_MS = 15000;
191
+ //#endregion
192
+ //#region src/ping-project.d.ts
193
+ type PingProjectOptions = {
194
+ runtimeId?: string | null;
195
+ fetchImpl?: typeof fetch;
196
+ timeoutMs?: number;
197
+ plugin?: Pick<HostingPlugin, "pingRequestHeaders">;
198
+ };
199
+ declare function pingProject(baseUrl: string, options?: PingProjectOptions): Promise<boolean>;
200
+ //#endregion
201
+ //#region src/ping-project-target.d.ts
202
+ declare function canPingProjectTarget(target: ProjectPingTarget, plugin?: Pick<HostingPlugin, "canPingTarget">): target is {
203
+ baseUrl: string;
204
+ runtimeId: string | null;
205
+ };
206
+ declare function pingProjectTarget(target: ProjectPingTarget, options?: PingProjectOptions & {
207
+ plugin?: Pick<HostingPlugin, "canPingTarget" | "pingRequestHeaders">;
208
+ }): Promise<boolean>;
209
+ //#endregion
210
+ //#region src/deploy-status.d.ts
211
+ /** Per-project bootstrap outcome reported by an org runtime machine. */
212
+ type ProjectDeployStatus = {
213
+ projectId: string;
214
+ ok: boolean;
215
+ error?: string;
216
+ };
217
+ type DeployStatusResponse = {
218
+ projects: ProjectDeployStatus[];
219
+ };
220
+ type FetchDeployStatusOptions = {
221
+ fetchImpl?: typeof fetch;
222
+ timeoutMs?: number;
223
+ };
224
+ /**
225
+ * Ask a running org machine which projects bootstrapped and which failed.
226
+ * Best-effort: returns undefined on any error so callers can fall back to
227
+ * treating every project as healthy (preserving pre-existing behavior).
228
+ */
229
+ declare function fetchDeployStatus(baseUrl: string, options?: FetchDeployStatusOptions): Promise<DeployStatusResponse | undefined>;
230
+ //#endregion
231
+ export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, FORBIDDEN_WORKER_ENV_KEYS, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type VerifiedOrgWorkerToken, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
232
+ //# sourceMappingURL=index.d.mts.map
package/dist/index.d.mts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.mts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/org-worker-token.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cCkCzE,yBAAA;;cAmBA,yBAAA;AAAA,KAED,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;;;;AP3DN;iBOkEhB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;APnEH;AAAA,iBOkGgB,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBA2Da,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAezB,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;APjLzC;AAAA,iBO+LgB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;;;;APlOF;;iBQWgB,kBAAA,CAAmB,MAAA,UAAgB,cAAsB;AAAA,KAI7D,sBAAA;EACV,cAAc;AAAA;AAAA,iBAGA,oBAAA,CACd,MAAA,sBACA,KAAA,uBACC,sBAAsB;;;KCjBb,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AbZF;;;;AAAgC;AAAhC,iBaoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}