@keystrokehq/hosting 0.1.10 → 0.1.11

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+let node_crypto = require("node:crypto");
 let dockerode = require("dockerode");
 dockerode = __toESM(dockerode, 1);
 let node_fs_promises = require("node:fs/promises");
@@ -4831,6 +4832,7 @@ const INFRA_SYSTEM_SLUGS = [
 	"health",
 	"healthcheck",
 	"healthz",
+	"hook-resume",
 	"hooks",
 	"internal",
 	"item",
@@ -4996,14 +4998,14 @@ const OrganizationUserRoleSchema = _enum([
 	"admin",
 	"builder"
 ]);
-const isoDateTime$5 = string().datetime();
+const isoDateTime$7 = string().datetime();
 const OrganizationSchema = object({
 	id: string(),
 	name: string(),
 	slug: OrganizationSlugSchema,
 	verified: boolean(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 const ProjectSchema = object({
 	id: string(),
@@ -5015,8 +5017,8 @@ const ProjectSchema = object({
 	baseUrl: string().nullable(),
 	runtimeId: string().nullable(),
 	lastError: string().nullable(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 object({
 	organization: OrganizationSchema,
@@ -5036,7 +5038,7 @@ const ProjectListMetricsSchema = object({
 	workflowCount: number$1(),
 	skillCount: number$1(),
 	credentialCount: number$1(),
-	lastDeploymentAt: isoDateTime$5.nullable()
+	lastDeploymentAt: isoDateTime$7.nullable()
 });
 record(string(), ProjectListMetricsSchema);
 object({
@@ -5391,6 +5393,130 @@ object({
 	skills: array(StoredRouteManifestSkillSchema).default([]),
 	integrations: array(string()).optional()
 });
+const isoDateTime$6 = string().datetime();
+const subscriptionStatusSchema = _enum([
+	"none",
+	"trialing",
+	"active",
+	"past_due",
+	"canceled"
+]);
+const CreditPackSchema = object({
+	id: string(),
+	usd: number$1(),
+	microCredits: number$1(),
+	label: string()
+});
+const AutoTopupSummarySchema = object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().nullable(),
+	amountMicroCredits: number$1().nullable(),
+	/** A saved payment method exists to charge off-session. */
+	hasPaymentMethod: boolean(),
+	/** A top-up invoice payment is in flight. */
+	pending: boolean()
+});
+/**
+* The plan's resolved limits. Storage overage is billed from the wallet's
+* pushed-down `includedStorageGb`; concurrency, per-pass run timeouts, and
+* API/MCP rate limits are enforced from the wallet (timeouts/concurrency) or
+* plan preset (rate limits). Log retention is configured but not pruned yet.
+*/
+const PlanLimitsSchema = object({
+	includedStorageGb: number$1(),
+	concurrencyLimit: number$1(),
+	agentTimeoutMs: number$1(),
+	workflowTimeoutMs: number$1(),
+	pollTimeoutMs: number$1(),
+	/** Configured retention window; pruning not implemented yet. */
+	logRetentionDays: number$1(),
+	apiRateLimitCapacity: number$1(),
+	apiRateLimitRefillPerSec: number$1(),
+	mcpRateLimitCapacity: number$1(),
+	mcpRateLimitRefillPerSec: number$1()
+});
+object({
+	planKey: string(),
+	subscriptionStatus: subscriptionStatusSchema,
+	planCreditMicroCredits: number$1(),
+	prepaidCreditMicroCredits: number$1(),
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	autoTopup: AutoTopupSummarySchema,
+	creditPacks: array(CreditPackSchema),
+	limits: PlanLimitsSchema
+});
+const BillingUsageMeterSchema = object({
+	/** Meter key (`llm`, `vm_second`, …); null groups uncategorized rows. */
+	meterKey: string().nullable(),
+	/** Charged this period, µc. */
+	microCredits: number$1(),
+	/** Tracked-but-not-charged usage (e.g. BYOK LLM calls), display USD. */
+	unchargedUsd: number$1()
+});
+object({
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	totalMicroCredits: number$1(),
+	byMeter: array(BillingUsageMeterSchema)
+});
+const billingLedgerEntryTypeSchema = _enum([
+	"grant_plan",
+	"grant_prepaid",
+	"expire_plan",
+	"adjustment"
+]);
+object({
+	entries: array(object({
+		id: string(),
+		entryType: billingLedgerEntryTypeSchema,
+		label: string(),
+		/** Signed: positive grants, negative expirations/adjustments. */
+		microCredits: number$1(),
+		bucket: _enum(["plan", "prepaid"]).nullable(),
+		/** Stripe invoice behind the entry, when there is one — powers "View invoice". */
+		stripeInvoiceId: string().nullable(),
+		createdAt: isoDateTime$6
+	})),
+	/** Set only when the latest payment failure is newer than the latest successful payment. */
+	lastPaymentFailureAt: isoDateTime$6.nullable()
+});
+object({ 
+/** Web-app path to land on after Checkout (must be a path, not a URL). */
+returnPath: string().startsWith("/").max(512).optional() });
+object({
+	packId: string(),
+	returnPath: string().startsWith("/").max(512).optional()
+});
+object({ returnPath: string().startsWith("/").max(512).optional() });
+object({ url: string().url() });
+object({
+	/** Hosted invoice page (view, download, receipt). */
+	url: string().url(),
+	/** Direct PDF download when Stripe provides one. */
+	pdf: string().url().nullable()
+});
+object({ 
+/** Stripe Checkout Session id from the `session_id` success-URL param. */
+sessionId: string().min(1).max(255) });
+object({
+	/**
+	* `granted` — credits are in the wallet now; `processing` — payment not
+	* complete yet, the webhook will finish it; `ignored` — not a confirmable
+	* session for this org.
+	*/
+	status: _enum([
+		"granted",
+		"processing",
+		"ignored"
+	]),
+	reason: string().optional()
+});
+object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().int().positive().optional(),
+	packId: string().optional()
+});
 /** Messaging platforms that support agent gateway bindings. */
 const ChannelPlatformKeySchema = _enum(["slack"]);
 const ChannelReactionSupportSchema = _enum([
@@ -5911,7 +6037,11 @@ object({
 	isDefault: boolean().optional(),
 	value: credentialSecretValueSchema.optional()
 }).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
-const CredentialAssignmentTargetTypeSchema = _enum(["workflow", "agent"]);
+const CredentialAssignmentTargetTypeSchema = _enum([
+	"workflow",
+	"agent",
+	"poll"
+]);
 object({ assignments: array(object({
 	id: string(),
 	targetType: CredentialAssignmentTargetTypeSchema,
@@ -6026,7 +6156,11 @@ const ValidationErrorDetailSchema = object({
 	message: string()
 });
 /** Machine-readable codes returned in standard API error bodies. */
-const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum(["needs_org_selection", "org_unverified"]));
+const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum([
+	"needs_org_selection",
+	"org_unverified",
+	"connector_unavailable"
+]));
 object({
 	error: string(),
 	code: ErrorResponseCodeSchema.optional(),
@@ -6137,6 +6271,17 @@ union([
 	SkipResponseSchema,
 	object({ runId: string() })
 ]);
+object({
+	sql: string().min(1),
+	params: array(unknown()).default([]),
+	method: string().min(1).optional()
+});
+object({ migrations: array(object({
+	sql: array(string().min(1)),
+	hash: string().min(1),
+	folderMillis: number$1()
+})) });
+object({ results: array(object({ rows: array(unknown()) })) });
 const RunSourceKindSchema = _enum([
 	"api",
 	"trigger",
@@ -6457,12 +6602,19 @@ const HistoryRunActorSchema = object({
 const HistoryRunUsageLineItemSchema = object({
 	id: string(),
 	label: string(),
-	amountUsd: number$1()
+	/** Amount debited from the org's Keystroke balance for this line. */
+	billedUsd: number$1(),
+	/** Provider cost for LLM usage on the org's API key (informational; not billed by Keystroke). */
+	providerCostUsd: number$1().nullable().optional(),
+	keySource: _enum(["byok", "platform"]).nullable().optional()
 });
 const HistoryRunUsageSchema = object({
 	runDurationMs: number$1().nullable(),
 	lineItems: array(HistoryRunUsageLineItemSchema),
-	totalExcludingDurationUsd: number$1().nullable()
+	/** Sum of `billedUsd` — what Keystroke charged for this run. */
+	totalBilledUsd: number$1().nullable(),
+	/** Sum of BYOK LLM provider costs (billed externally by the org's provider). */
+	externalProviderCostUsd: number$1().nullable().optional()
 });
 const HistoryRunSchema = object({
 	id: string(),
@@ -6593,6 +6745,7 @@ const HistoryRunDetailSchema = discriminatedUnion("kind", [object({
 		attachmentSlug: string().nullable()
 	}).nullable(),
 	messages: array(record(string(), unknown())),
+	live: record(string(), unknown()).nullable().default(null),
 	trace: HistoryTraceSchema.nullable(),
 	ranAs: HistoryRunActorSchema.nullable().optional(),
 	usage: HistoryRunUsageSchema.nullable().optional()
@@ -6882,7 +7035,7 @@ const OrganizationMemberStatusSchema = _enum([
 	"suspended"
 ]);
 const InvitableOrganizationMemberRoleSchema = _enum(["admin", "builder"]);
-const isoDateTime$4 = string().datetime();
+const isoDateTime$5 = string().datetime();
 object({
 	id: string(),
 	name: string(),
@@ -6890,8 +7043,8 @@ object({
 	role: OrganizationMemberRoleSchema,
 	status: OrganizationMemberStatusSchema,
 	avatarUrl: string().optional(),
-	joinedAt: isoDateTime$4.optional(),
-	lastActiveAt: isoDateTime$4.nullable().optional()
+	joinedAt: isoDateTime$5.optional(),
+	lastActiveAt: isoDateTime$5.nullable().optional()
 });
 object({
 	emails: array(string().trim().email()).min(1),
@@ -6918,7 +7071,7 @@ object({
 	role: OrganizationMemberRoleSchema
 });
 object({ success: literal(true) });
-const isoDateTime$3 = string().datetime();
+const isoDateTime$4 = string().datetime();
 const ApiKeyCreatorSchema = object({
 	id: string(),
 	name: string(),
@@ -6931,12 +7084,37 @@ const ApiKeySummarySchema = object({
 	id: string(),
 	name: string(),
 	keyPreview: string(),
-	createdAt: isoDateTime$3,
+	createdAt: isoDateTime$4,
 	createdBy: ApiKeyCreatorSchema,
 	isCreatedByCurrentUser: boolean()
 });
 object({ name: string().trim().min(1).max(128) });
 ApiKeySummarySchema.extend({ secret: string() });
+const isoDateTime$3 = string().datetime();
+const ManagedServiceKindSchema = _enum(["llm"]);
+_enum([
+	"openai",
+	"anthropic",
+	"google",
+	"groq",
+	"xai"
+]);
+object({
+	id: string(),
+	kind: ManagedServiceKindSchema,
+	provider: string(),
+	keyPreview: string(),
+	createdAt: isoDateTime$3,
+	updatedAt: isoDateTime$3,
+	createdBy: ApiKeyCreatorSchema,
+	isCreatedByCurrentUser: boolean()
+});
+object({
+	kind: ManagedServiceKindSchema.default("llm"),
+	provider: string().trim().min(1),
+	apiKey: string().trim().min(1)
+});
+object({ apiKey: string().trim().min(1) });
 const ProjectUserRoleSchema = _enum(["admin", "builder"]);
 const ProjectInvitePermissionSchema = _enum(["admin", "all"]);
 const ProjectMemberStatusSchema = _enum(["active", "invited"]);
@@ -7514,13 +7692,35 @@ function parseOrgArtifactsFromEnv(env = process.env) {
 	});
 }
 //#endregion
+//#region src/org-worker-token.ts
+function sign(secret, organizationId) {
+	return (0, node_crypto.createHmac)("sha256", secret).update(`org-worker:${organizationId}`).digest("base64url");
+}
+/**
+* Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
+* platform can tell which org a machine is calling as, and stateless — verified
+* by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
+*/
+function mintOrgWorkerToken(secret, organizationId) {
+	return `${organizationId}.${sign(secret, organizationId)}`;
+}
+function verifyOrgWorkerToken(secret, token) {
+	if (!secret || !token) return;
+	const separator = token.lastIndexOf(".");
+	if (separator <= 0) return;
+	const organizationId = token.slice(0, separator);
+	const signature = Buffer.from(token.slice(separator + 1));
+	const expected = Buffer.from(sign(secret, organizationId));
+	if (signature.length !== expected.length || !(0, node_crypto.timingSafeEqual)(signature, expected)) return;
+	return { organizationId };
+}
+//#endregion
 //#region src/runtime-env.ts
 const RUNTIME_ENV_KEYS = [
 	"BETTER_AUTH_SECRET",
 	"PUBLIC_PLATFORM_URL",
 	"PUBLIC_PLATFORM_PROXY_URL",
 	"PUBLIC_WEB_URL",
-	"POSTGRES_SSL",
 	"UPSTASH_REDIS_URL",
 	"REDIS_URL",
 	"KEYSTROKE_QUEUE_PREFIX"
@@ -7534,25 +7734,6 @@ const PROVIDER_ENV_KEYS = [
 ];
 /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
 const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-const PROJECT_DATABASE_ENV_KEYS = [
-	"POSTGRES_HOST",
-	"POSTGRES_PORT",
-	"POSTGRES_DB",
-	"POSTGRES_USER",
-	"POSTGRES_PASSWORD",
-	"DATABASE_SEARCH_PATH"
-];
-/** Per-project postgres env injected into every project server container/machine. */
-function projectDatabaseRuntimeEnv(database) {
-	return {
-		POSTGRES_HOST: rewriteLoopbackHost(database.host),
-		POSTGRES_PORT: String(database.port),
-		POSTGRES_DB: database.database,
-		POSTGRES_USER: database.user,
-		POSTGRES_PASSWORD: database.password,
-		DATABASE_SEARCH_PATH: database.searchPath
-	};
-}
 /**
 * Builds the launch spec for an org worker. Each deploy artifact is encoded in
 * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
@@ -7579,10 +7760,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	]);
 	for (const key of RUNTIME_ENV_KEYS) {
 		const value = source[key]?.trim();
-		if (!value) {
-			if (key === "POSTGRES_SSL") throw new Error("POSTGRES_SSL is required");
-			continue;
-		}
+		if (!value) continue;
 		entries.set(key, value);
 	}
 	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
@@ -7591,8 +7769,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	}
 	const worker = resolveWorkerRuntimeConfig(source);
 	entries.set("PLATFORM_URL", worker.platformUrl);
-	entries.set("WORKER_INTERNAL_TOKEN", worker.workerToken);
-	for (const [key, value] of Object.entries(projectDatabaseRuntimeEnv(database))) entries.set(key, value);
+	entries.set("WORKER_INTERNAL_TOKEN", mintOrgWorkerToken(worker.workerToken, database.organizationId));
 	if (extraEnv) for (const [key, value] of Object.entries(extraEnv)) entries.set(key, value);
 	return Object.fromEntries(entries);
 }
@@ -7845,7 +8022,6 @@ async function fetchDeployStatus(baseUrl, options = {}) {
 }
 //#endregion
 exports.DEV_PLATFORM_WORKER_TOKEN = DEV_PLATFORM_WORKER_TOKEN;
-exports.PROJECT_DATABASE_ENV_KEYS = PROJECT_DATABASE_ENV_KEYS;
 exports.PROJECT_SERVER_DEPLOY_STATUS = PROJECT_SERVER_DEPLOY_STATUS;
 exports.PROJECT_SERVER_FRAMEWORK_NODE_MODULES = PROJECT_SERVER_FRAMEWORK_NODE_MODULES;
 exports.PROJECT_SERVER_FRAMEWORK_ROOT = PROJECT_SERVER_FRAMEWORK_ROOT;
@@ -7862,10 +8038,10 @@ exports.dockerPlugin = dockerPlugin;
 exports.encodeOrgArtifacts = encodeOrgArtifacts;
 exports.fetchDeployStatus = fetchDeployStatus;
 exports.formatDockerEnv = formatDockerEnv;
+exports.mintOrgWorkerToken = mintOrgWorkerToken;
 exports.parseOrgArtifactsFromEnv = parseOrgArtifactsFromEnv;
 exports.pingProject = pingProject;
 exports.pingProjectTarget = pingProjectTarget;
-exports.projectDatabaseRuntimeEnv = projectDatabaseRuntimeEnv;
 exports.resolvePlatformWorkerToken = resolvePlatformWorkerToken;
 exports.resolveProjectServerImage = resolveProjectServerImage;
 exports.resolveRuntimeLaunch = resolveRuntimeLaunch;
@@ -7873,6 +8049,7 @@ exports.resolveWorkerPlatformUrl = resolveWorkerPlatformUrl;
 exports.resolveWorkerRuntimeConfig = resolveWorkerRuntimeConfig;
 exports.rewriteLoopbackHost = rewriteLoopbackHost;
 exports.rewriteLoopbackUrl = rewriteLoopbackUrl;
+exports.verifyOrgWorkerToken = verifyOrgWorkerToken;
 exports.waitForHealth = waitForHealth;
 
 //# sourceMappingURL=index.cjs.map