@keystrokehq/hosting 0.1.10 → 0.1.11

package/dist/index.d.cts

@@ -140,15 +140,12 @@ declare function defaultHostingPlugin(options?: DockerPluginOptions): HostingPlu
 //#region src/runtime-env.d.ts
 /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
 declare const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-declare const PROJECT_DATABASE_ENV_KEYS: readonly ["POSTGRES_HOST", "POSTGRES_PORT", "POSTGRES_DB", "POSTGRES_USER", "POSTGRES_PASSWORD", "DATABASE_SEARCH_PATH"];
 type RuntimeLaunchSpec = {
   image: string;
   env: Record<string, string>;
   port: number;
   health: typeof PROJECT_SERVER_HEALTH;
 };
-/** Per-project postgres env injected into every project server container/machine. */
-declare function projectDatabaseRuntimeEnv(database: ProjectRuntimeDatabase): Record<(typeof PROJECT_DATABASE_ENV_KEYS)[number], string>;
 /**
  * Builds the launch spec for an org worker. Each deploy artifact is encoded in
  * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
@@ -166,6 +163,18 @@ declare function rewriteLoopbackUrl(url: string): string;
 declare function formatDockerEnv(env: Record<string, string>): string[];
 declare function resolveProjectServerImage(env?: NodeJS.ProcessEnv, override?: string): string;
 //#endregion
+//#region src/org-worker-token.d.ts
+/**
+ * Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
+ * platform can tell which org a machine is calling as, and stateless — verified
+ * by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
+ */
+declare function mintOrgWorkerToken(secret: string, organizationId: string): string;
+type VerifiedOrgWorkerToken = {
+  organizationId: string;
+};
+declare function verifyOrgWorkerToken(secret: string | undefined, token: string | undefined): VerifiedOrgWorkerToken | undefined;
+//#endregion
 //#region src/wait-for-health.d.ts
 type WaitForHealthOptions = {
   timeoutMs?: number;
@@ -217,5 +226,5 @@ type FetchDeployStatusOptions = {
  */
 declare function fetchDeployStatus(baseUrl: string, options?: FetchDeployStatusOptions): Promise<DeployStatusResponse | undefined>;
 //#endregion
-export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_DATABASE_ENV_KEYS, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, projectDatabaseRuntimeEnv, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, waitForHealth };
+export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type VerifiedOrgWorkerToken, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
 //# sourceMappingURL=index.d.cts.map

package/dist/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cC8BzE,yBAAA;AAAA,cAEA,yBAAA;AAAA,KASD,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;AP7CtC;AAAA,iBOiDgB,yBAAA,CACd,QAAA,EAAU,sBAAA,GACT,MAAA,SAAe,yBAAA;;;APnDc;AAEhC;iBOgEgB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;;iBA+Ba,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBAkDa,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;AP1JS;AAAA,iBOyKlC,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAczB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;KCpNU,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AZZF;;;;AAAgC;AAAhC,iBYoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/org-worker-token.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cC8BzE,yBAAA;AAAA,KAED,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;APtCN;AAEhC;;;AAFgC,iBO6ChB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;;iBA+Ba,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBA+Ca,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAezB,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAczB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;;;;AP/LF;;iBQWgB,kBAAA,CAAmB,MAAA,UAAgB,cAAsB;AAAA,KAI7D,sBAAA;EACV,cAAc;AAAA;AAAA,iBAGA,oBAAA,CACd,MAAA,sBACA,KAAA,uBACC,sBAAsB;;;KCjBb,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AbZF;;;;AAAgC;AAAhC,iBaoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}

package/dist/index.d.mts

@@ -140,15 +140,12 @@ declare function defaultHostingPlugin(options?: DockerPluginOptions): HostingPlu
 //#region src/runtime-env.d.ts
 /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
 declare const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-declare const PROJECT_DATABASE_ENV_KEYS: readonly ["POSTGRES_HOST", "POSTGRES_PORT", "POSTGRES_DB", "POSTGRES_USER", "POSTGRES_PASSWORD", "DATABASE_SEARCH_PATH"];
 type RuntimeLaunchSpec = {
   image: string;
   env: Record<string, string>;
   port: number;
   health: typeof PROJECT_SERVER_HEALTH;
 };
-/** Per-project postgres env injected into every project server container/machine. */
-declare function projectDatabaseRuntimeEnv(database: ProjectRuntimeDatabase): Record<(typeof PROJECT_DATABASE_ENV_KEYS)[number], string>;
 /**
  * Builds the launch spec for an org worker. Each deploy artifact is encoded in
  * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
@@ -166,6 +163,18 @@ declare function rewriteLoopbackUrl(url: string): string;
 declare function formatDockerEnv(env: Record<string, string>): string[];
 declare function resolveProjectServerImage(env?: NodeJS.ProcessEnv, override?: string): string;
 //#endregion
+//#region src/org-worker-token.d.ts
+/**
+ * Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
+ * platform can tell which org a machine is calling as, and stateless — verified
+ * by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
+ */
+declare function mintOrgWorkerToken(secret: string, organizationId: string): string;
+type VerifiedOrgWorkerToken = {
+  organizationId: string;
+};
+declare function verifyOrgWorkerToken(secret: string | undefined, token: string | undefined): VerifiedOrgWorkerToken | undefined;
+//#endregion
 //#region src/wait-for-health.d.ts
 type WaitForHealthOptions = {
   timeoutMs?: number;
@@ -217,5 +226,5 @@ type FetchDeployStatusOptions = {
  */
 declare function fetchDeployStatus(baseUrl: string, options?: FetchDeployStatusOptions): Promise<DeployStatusResponse | undefined>;
 //#endregion
-export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_DATABASE_ENV_KEYS, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, projectDatabaseRuntimeEnv, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, waitForHealth };
+export { DEV_PLATFORM_WORKER_TOKEN, type DeployStatusResponse, type DockerPluginOptions, type FetchDeployStatusOptions, type HostingOptions, type HostingPlugin, type OrgArtifactSpec, type OrgProjectDeploy, type OrganizationHostingInput, type OrganizationHostingResult, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, type PingProjectOptions, type ProjectDeployStatus, type ProjectPingTarget, type ProjectRuntime, type ProjectRuntimeDatabase, type ProjectRuntimeDestroyInput, type ProjectRuntimeHosting, type ProjectRuntimeInput, type ProjectRuntimeReconcileInput, type ProjectRuntimeResult, RUNTIME_PING_TIMEOUT_MS, type RuntimeLaunchSpec, type VerifiedOrgWorkerToken, type WaitForHealthOptions, type WorkerRuntimeConfig, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cC8BzE,yBAAA;AAAA,cAEA,yBAAA;AAAA,KASD,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;AP7CtC;AAAA,iBOiDgB,yBAAA,CACd,QAAA,EAAU,sBAAA,GACT,MAAA,SAAe,yBAAA;;;APnDc;AAEhC;iBOgEgB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;;iBA+Ba,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBAkDa,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;AP1JS;AAAA,iBOyKlC,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAczB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;KCpNU,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AZZF;;;;AAAgC;AAAhC,iBYoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/constants.ts","../src/runtime.ts","../src/worker-runtime-config.ts","../src/plugin.ts","../src/docker/create-docker-runtime.ts","../src/docker/plugin.ts","../src/default-plugin.ts","../src/runtime-env.ts","../src/org-worker-token.ts","../src/wait-for-health.ts","../src/runtime-constants.ts","../src/ping-project.ts","../src/ping-project-target.ts","../src/deploy-status.ts"],"mappings":";;;cAAa,oBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,mBAAA;AAAA,cAEA,6BAAA;AAAA,cAEA,qCAAA;AAAA,cAEA,qBAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;AAAA,cAEG,4BAAA;EAAA,SAGH,IAAA;EAAA,SAAA,IAAA;AAAA;;;KClBE,sBAAA;EACV,IAAA;EACA,IAAA;EACA,QAAA;EACA,IAAA;EACA,QAAA;EACA,UAAA;EACA,cAAA,UDLW;ECOX,SAAA;AAAA;AAAA,KAGU,gBAAA;EACV,SAAA;EACA,IAAA;EACA,UAAA;EACA,kBAAA;AAAA;AAAA,KAGU,eAAA;EACV,SAAA;EACA,kBAAkB;AAAA;AAAA,KAGR,qBAAA;EACV,OAAO;AAAA;AAAA,KAGG,mBAAA;EACV,cAAA;EACA,QAAA,EAAU,gBAAA;EACV,QAAA,EAAU,sBAAA;EACV,OAAA,GAAU,qBAAA,EDnBF;ECqBR,GAAA,GAAM,MAAA,kBDrBE;ECuBR,iBAAA;AAAA;;iBAIc,kBAAA,CAAmB,SAA4B,EAAjB,eAAe;AAAA,iBAI7C,wBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,eAAe;AAAA,KAyBN,0BAAA;EACV,SAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,4BAAA;EACV,cAAA;EAEA,aAAA;EACA,OAAA,GAAU,qBAAqB;AAAA;AAAA,KAGrB,oBAAA;EACV,SAAA;EACA,OAAO;AAAA;AAAA,KAGG,cAAA;EACV,KAAA,CAAM,KAAA,EAAO,mBAAA,GAAsB,OAAA,CAAQ,oBAAA;EAC3C,OAAA,EAAS,KAAA,EAAO,0BAAA,GAA6B,OAAA;EAjFpC;AAGX;;;;;EAqFE,SAAA,EAAW,KAAA,EAAO,4BAAA,GAA+B,OAAA;AAAA;AAAA,KAGvC,iBAAA;EACV,OAAA;EACA,SAAS;AAAA;;;;KCnGC,mBAAA;yEAEV,WAAA,UFL+B;EEO/B,WAAW;AAAA;AAAA,cAGA,wBAAA,SAAiC,KAAK;EAAA,SACxC,OAAA;cAEG,OAAA;AAAA;;iBAWE,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAA,GACd,mBAAmB;;;KCvBV,cAAA;EACV,KAAA;EACA,GAAA,GAAM,MAAA,CAAO,UAAA;EACb,SAAA,UAAmB,KAAK;EACxB,eAAA;AAAA;AAAA,KAGU,wBAAA;EACV,cAAA;EACA,IAAI;AAAA;AAAA,KAGM,yBAAA;EACV,OAAO;AAAA;AAAA,KAGG,aAAA;EACV,IAAA,UHhB8B;EGkB9B,aAAA,EAAe,mBAAA;EACf,aAAA,IAAiB,cAAA;EACjB,qBAAA,EAAuB,KAAA,EAAO,wBAAA,GAA2B,OAAA,CAAQ,yBAAA;EACjE,uBAAA,EAAyB,MAAA,EAAQ,yBAAA,GAA4B,OAAA;EAC7D,aAAA,EACE,MAAA,EAAQ,iBAAA,GACP,MAAA;IAAY,OAAA;IAAiB,SAAA;EAAA;EAChC,kBAAA,EAAoB,SAAA,kBAA2B,MAAA;AAAA;;;KCpBrC,eAAA;EACV,QAAA;EACA,aAAa;AAAA;AAAA,KAGH,mBAAA,GAAsB,cAAA;EAChC,MAAA,GAAS,MAAA,EJbqB;EIe9B,eAAA,GAAkB,eAAA,EJfY;EIiB9B,UAAA;AAAA;;;iBCXc,YAAA,CAAa,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;iBCJ9D,oBAAA,CAAqB,OAAA,GAAS,mBAAA,GAA2B,aAAa;;;;cC8BzE,yBAAA;AAAA,KAED,iBAAA;EACV,KAAA;EACA,GAAA,EAAK,MAAA;EACL,IAAA;EACA,MAAA,SAAe,qBAAqB;AAAA;APtCN;AAEhC;;;AAFgC,iBO6ChB,oBAAA,CACd,OAAA,EAAS,cAAA,EACT,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,iBAAA;;iBA+Ba,eAAA,CACd,MAAA,EAAQ,MAAA,CAAO,UAAA,EACf,SAAA,EAAW,eAAA,IACX,QAAA,EAAU,sBAAA,EACV,QAAA,GAAW,MAAA,mBACV,MAAA;AAAA,iBA+Ca,0BAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAezB,wBAAA,CACd,MAAA,GAAQ,MAAA,CAAO,UAAwB;;iBAczB,mBAAA,CAAoB,IAAY;AAAA,iBAQhC,kBAAA,CAAmB,GAAW;;iBAW9B,eAAA,CAAgB,GAA2B,EAAtB,MAAM;AAAA,iBAI3B,yBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAwB,EACpC,QAAA;;;;;;AP/LF;;iBQWgB,kBAAA,CAAmB,MAAA,UAAgB,cAAsB;AAAA,KAI7D,sBAAA;EACV,cAAc;AAAA;AAAA,iBAGA,oBAAA,CACd,MAAA,sBACA,KAAA,uBACC,sBAAsB;;;KCjBb,oBAAA;EACV,SAAA;EACA,UAAA;EACA,SAAA,UAAmB,KAAK;AAAA;AAAA,iBAGJ,aAAA,CACpB,OAAA,UACA,OAAA,GAAS,oBAAA,GACR,OAAO;;;;cCbG,uBAAA;;;KCGD,kBAAA;EACV,SAAA;EACA,SAAA,UAAmB,KAAA;EACnB,SAAA;EACA,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA;AAAA,iBAGM,WAAA,CACpB,OAAA,UACA,OAAA,GAAS,kBAAA,GACR,OAAO;;;iBCVM,oBAAA,CACd,MAAA,EAAQ,iBAAA,EACR,MAAA,GAAS,IAAA,CAAK,aAAA,qBACb,MAAA;EAAY,OAAA;EAAiB,SAAA;AAAA;AAAA,iBAQV,iBAAA,CACpB,MAAA,EAAQ,iBAAA,EACR,OAAA,GAAS,kBAAA;EACP,MAAA,GAAS,IAAA,CAAK,aAAA;AAAA,IAEf,OAAA;;;;KChBS,mBAAA;EACV,SAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,KAGU,oBAAA;EACV,QAAA,EAAU,mBAAmB;AAAA;AAAA,KAGnB,wBAAA;EACV,SAAA,UAAmB,KAAK;EACxB,SAAA;AAAA;AbZF;;;;AAAgC;AAAhC,iBaoBsB,iBAAA,CACpB,OAAA,UACA,OAAA,GAAS,wBAAA,GACR,OAAA,CAAQ,oBAAA"}

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
 import Docker from "dockerode";
 import { mkdir } from "node:fs/promises";
 //#region src/constants.ts
@@ -4807,6 +4808,7 @@ const INFRA_SYSTEM_SLUGS = [
 	"health",
 	"healthcheck",
 	"healthz",
+	"hook-resume",
 	"hooks",
 	"internal",
 	"item",
@@ -4972,14 +4974,14 @@ const OrganizationUserRoleSchema = _enum([
 	"admin",
 	"builder"
 ]);
-const isoDateTime$5 = string().datetime();
+const isoDateTime$7 = string().datetime();
 const OrganizationSchema = object({
 	id: string(),
 	name: string(),
 	slug: OrganizationSlugSchema,
 	verified: boolean(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 const ProjectSchema = object({
 	id: string(),
@@ -4991,8 +4993,8 @@ const ProjectSchema = object({
 	baseUrl: string().nullable(),
 	runtimeId: string().nullable(),
 	lastError: string().nullable(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 object({
 	organization: OrganizationSchema,
@@ -5012,7 +5014,7 @@ const ProjectListMetricsSchema = object({
 	workflowCount: number$1(),
 	skillCount: number$1(),
 	credentialCount: number$1(),
-	lastDeploymentAt: isoDateTime$5.nullable()
+	lastDeploymentAt: isoDateTime$7.nullable()
 });
 record(string(), ProjectListMetricsSchema);
 object({
@@ -5367,6 +5369,130 @@ object({
 	skills: array(StoredRouteManifestSkillSchema).default([]),
 	integrations: array(string()).optional()
 });
+const isoDateTime$6 = string().datetime();
+const subscriptionStatusSchema = _enum([
+	"none",
+	"trialing",
+	"active",
+	"past_due",
+	"canceled"
+]);
+const CreditPackSchema = object({
+	id: string(),
+	usd: number$1(),
+	microCredits: number$1(),
+	label: string()
+});
+const AutoTopupSummarySchema = object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().nullable(),
+	amountMicroCredits: number$1().nullable(),
+	/** A saved payment method exists to charge off-session. */
+	hasPaymentMethod: boolean(),
+	/** A top-up invoice payment is in flight. */
+	pending: boolean()
+});
+/**
+* The plan's resolved limits. Storage overage is billed from the wallet's
+* pushed-down `includedStorageGb`; concurrency, per-pass run timeouts, and
+* API/MCP rate limits are enforced from the wallet (timeouts/concurrency) or
+* plan preset (rate limits). Log retention is configured but not pruned yet.
+*/
+const PlanLimitsSchema = object({
+	includedStorageGb: number$1(),
+	concurrencyLimit: number$1(),
+	agentTimeoutMs: number$1(),
+	workflowTimeoutMs: number$1(),
+	pollTimeoutMs: number$1(),
+	/** Configured retention window; pruning not implemented yet. */
+	logRetentionDays: number$1(),
+	apiRateLimitCapacity: number$1(),
+	apiRateLimitRefillPerSec: number$1(),
+	mcpRateLimitCapacity: number$1(),
+	mcpRateLimitRefillPerSec: number$1()
+});
+object({
+	planKey: string(),
+	subscriptionStatus: subscriptionStatusSchema,
+	planCreditMicroCredits: number$1(),
+	prepaidCreditMicroCredits: number$1(),
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	autoTopup: AutoTopupSummarySchema,
+	creditPacks: array(CreditPackSchema),
+	limits: PlanLimitsSchema
+});
+const BillingUsageMeterSchema = object({
+	/** Meter key (`llm`, `vm_second`, …); null groups uncategorized rows. */
+	meterKey: string().nullable(),
+	/** Charged this period, µc. */
+	microCredits: number$1(),
+	/** Tracked-but-not-charged usage (e.g. BYOK LLM calls), display USD. */
+	unchargedUsd: number$1()
+});
+object({
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	totalMicroCredits: number$1(),
+	byMeter: array(BillingUsageMeterSchema)
+});
+const billingLedgerEntryTypeSchema = _enum([
+	"grant_plan",
+	"grant_prepaid",
+	"expire_plan",
+	"adjustment"
+]);
+object({
+	entries: array(object({
+		id: string(),
+		entryType: billingLedgerEntryTypeSchema,
+		label: string(),
+		/** Signed: positive grants, negative expirations/adjustments. */
+		microCredits: number$1(),
+		bucket: _enum(["plan", "prepaid"]).nullable(),
+		/** Stripe invoice behind the entry, when there is one — powers "View invoice". */
+		stripeInvoiceId: string().nullable(),
+		createdAt: isoDateTime$6
+	})),
+	/** Set only when the latest payment failure is newer than the latest successful payment. */
+	lastPaymentFailureAt: isoDateTime$6.nullable()
+});
+object({ 
+/** Web-app path to land on after Checkout (must be a path, not a URL). */
+returnPath: string().startsWith("/").max(512).optional() });
+object({
+	packId: string(),
+	returnPath: string().startsWith("/").max(512).optional()
+});
+object({ returnPath: string().startsWith("/").max(512).optional() });
+object({ url: string().url() });
+object({
+	/** Hosted invoice page (view, download, receipt). */
+	url: string().url(),
+	/** Direct PDF download when Stripe provides one. */
+	pdf: string().url().nullable()
+});
+object({ 
+/** Stripe Checkout Session id from the `session_id` success-URL param. */
+sessionId: string().min(1).max(255) });
+object({
+	/**
+	* `granted` — credits are in the wallet now; `processing` — payment not
+	* complete yet, the webhook will finish it; `ignored` — not a confirmable
+	* session for this org.
+	*/
+	status: _enum([
+		"granted",
+		"processing",
+		"ignored"
+	]),
+	reason: string().optional()
+});
+object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().int().positive().optional(),
+	packId: string().optional()
+});
 /** Messaging platforms that support agent gateway bindings. */
 const ChannelPlatformKeySchema = _enum(["slack"]);
 const ChannelReactionSupportSchema = _enum([
@@ -5887,7 +6013,11 @@ object({
 	isDefault: boolean().optional(),
 	value: credentialSecretValueSchema.optional()
 }).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
-const CredentialAssignmentTargetTypeSchema = _enum(["workflow", "agent"]);
+const CredentialAssignmentTargetTypeSchema = _enum([
+	"workflow",
+	"agent",
+	"poll"
+]);
 object({ assignments: array(object({
 	id: string(),
 	targetType: CredentialAssignmentTargetTypeSchema,
@@ -6002,7 +6132,11 @@ const ValidationErrorDetailSchema = object({
 	message: string()
 });
 /** Machine-readable codes returned in standard API error bodies. */
-const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum(["needs_org_selection", "org_unverified"]));
+const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum([
+	"needs_org_selection",
+	"org_unverified",
+	"connector_unavailable"
+]));
 object({
 	error: string(),
 	code: ErrorResponseCodeSchema.optional(),
@@ -6113,6 +6247,17 @@ union([
 	SkipResponseSchema,
 	object({ runId: string() })
 ]);
+object({
+	sql: string().min(1),
+	params: array(unknown()).default([]),
+	method: string().min(1).optional()
+});
+object({ migrations: array(object({
+	sql: array(string().min(1)),
+	hash: string().min(1),
+	folderMillis: number$1()
+})) });
+object({ results: array(object({ rows: array(unknown()) })) });
 const RunSourceKindSchema = _enum([
 	"api",
 	"trigger",
@@ -6433,12 +6578,19 @@ const HistoryRunActorSchema = object({
 const HistoryRunUsageLineItemSchema = object({
 	id: string(),
 	label: string(),
-	amountUsd: number$1()
+	/** Amount debited from the org's Keystroke balance for this line. */
+	billedUsd: number$1(),
+	/** Provider cost for LLM usage on the org's API key (informational; not billed by Keystroke). */
+	providerCostUsd: number$1().nullable().optional(),
+	keySource: _enum(["byok", "platform"]).nullable().optional()
 });
 const HistoryRunUsageSchema = object({
 	runDurationMs: number$1().nullable(),
 	lineItems: array(HistoryRunUsageLineItemSchema),
-	totalExcludingDurationUsd: number$1().nullable()
+	/** Sum of `billedUsd` — what Keystroke charged for this run. */
+	totalBilledUsd: number$1().nullable(),
+	/** Sum of BYOK LLM provider costs (billed externally by the org's provider). */
+	externalProviderCostUsd: number$1().nullable().optional()
 });
 const HistoryRunSchema = object({
 	id: string(),
@@ -6569,6 +6721,7 @@ const HistoryRunDetailSchema = discriminatedUnion("kind", [object({
 		attachmentSlug: string().nullable()
 	}).nullable(),
 	messages: array(record(string(), unknown())),
+	live: record(string(), unknown()).nullable().default(null),
 	trace: HistoryTraceSchema.nullable(),
 	ranAs: HistoryRunActorSchema.nullable().optional(),
 	usage: HistoryRunUsageSchema.nullable().optional()
@@ -6858,7 +7011,7 @@ const OrganizationMemberStatusSchema = _enum([
 	"suspended"
 ]);
 const InvitableOrganizationMemberRoleSchema = _enum(["admin", "builder"]);
-const isoDateTime$4 = string().datetime();
+const isoDateTime$5 = string().datetime();
 object({
 	id: string(),
 	name: string(),
@@ -6866,8 +7019,8 @@ object({
 	role: OrganizationMemberRoleSchema,
 	status: OrganizationMemberStatusSchema,
 	avatarUrl: string().optional(),
-	joinedAt: isoDateTime$4.optional(),
-	lastActiveAt: isoDateTime$4.nullable().optional()
+	joinedAt: isoDateTime$5.optional(),
+	lastActiveAt: isoDateTime$5.nullable().optional()
 });
 object({
 	emails: array(string().trim().email()).min(1),
@@ -6894,7 +7047,7 @@ object({
 	role: OrganizationMemberRoleSchema
 });
 object({ success: literal(true) });
-const isoDateTime$3 = string().datetime();
+const isoDateTime$4 = string().datetime();
 const ApiKeyCreatorSchema = object({
 	id: string(),
 	name: string(),
@@ -6907,12 +7060,37 @@ const ApiKeySummarySchema = object({
 	id: string(),
 	name: string(),
 	keyPreview: string(),
-	createdAt: isoDateTime$3,
+	createdAt: isoDateTime$4,
 	createdBy: ApiKeyCreatorSchema,
 	isCreatedByCurrentUser: boolean()
 });
 object({ name: string().trim().min(1).max(128) });
 ApiKeySummarySchema.extend({ secret: string() });
+const isoDateTime$3 = string().datetime();
+const ManagedServiceKindSchema = _enum(["llm"]);
+_enum([
+	"openai",
+	"anthropic",
+	"google",
+	"groq",
+	"xai"
+]);
+object({
+	id: string(),
+	kind: ManagedServiceKindSchema,
+	provider: string(),
+	keyPreview: string(),
+	createdAt: isoDateTime$3,
+	updatedAt: isoDateTime$3,
+	createdBy: ApiKeyCreatorSchema,
+	isCreatedByCurrentUser: boolean()
+});
+object({
+	kind: ManagedServiceKindSchema.default("llm"),
+	provider: string().trim().min(1),
+	apiKey: string().trim().min(1)
+});
+object({ apiKey: string().trim().min(1) });
 const ProjectUserRoleSchema = _enum(["admin", "builder"]);
 const ProjectInvitePermissionSchema = _enum(["admin", "all"]);
 const ProjectMemberStatusSchema = _enum(["active", "invited"]);
@@ -7490,13 +7668,35 @@ function parseOrgArtifactsFromEnv(env = process.env) {
 	});
 }
 //#endregion
+//#region src/org-worker-token.ts
+function sign(secret, organizationId) {
+	return createHmac("sha256", secret).update(`org-worker:${organizationId}`).digest("base64url");
+}
+/**
+* Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
+* platform can tell which org a machine is calling as, and stateless — verified
+* by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
+*/
+function mintOrgWorkerToken(secret, organizationId) {
+	return `${organizationId}.${sign(secret, organizationId)}`;
+}
+function verifyOrgWorkerToken(secret, token) {
+	if (!secret || !token) return;
+	const separator = token.lastIndexOf(".");
+	if (separator <= 0) return;
+	const organizationId = token.slice(0, separator);
+	const signature = Buffer.from(token.slice(separator + 1));
+	const expected = Buffer.from(sign(secret, organizationId));
+	if (signature.length !== expected.length || !timingSafeEqual(signature, expected)) return;
+	return { organizationId };
+}
+//#endregion
 //#region src/runtime-env.ts
 const RUNTIME_ENV_KEYS = [
 	"BETTER_AUTH_SECRET",
 	"PUBLIC_PLATFORM_URL",
 	"PUBLIC_PLATFORM_PROXY_URL",
 	"PUBLIC_WEB_URL",
-	"POSTGRES_SSL",
 	"UPSTASH_REDIS_URL",
 	"REDIS_URL",
 	"KEYSTROKE_QUEUE_PREFIX"
@@ -7510,25 +7710,6 @@ const PROVIDER_ENV_KEYS = [
 ];
 /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
 const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-const PROJECT_DATABASE_ENV_KEYS = [
-	"POSTGRES_HOST",
-	"POSTGRES_PORT",
-	"POSTGRES_DB",
-	"POSTGRES_USER",
-	"POSTGRES_PASSWORD",
-	"DATABASE_SEARCH_PATH"
-];
-/** Per-project postgres env injected into every project server container/machine. */
-function projectDatabaseRuntimeEnv(database) {
-	return {
-		POSTGRES_HOST: rewriteLoopbackHost(database.host),
-		POSTGRES_PORT: String(database.port),
-		POSTGRES_DB: database.database,
-		POSTGRES_USER: database.user,
-		POSTGRES_PASSWORD: database.password,
-		DATABASE_SEARCH_PATH: database.searchPath
-	};
-}
 /**
 * Builds the launch spec for an org worker. Each deploy artifact is encoded in
 * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
@@ -7555,10 +7736,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	]);
 	for (const key of RUNTIME_ENV_KEYS) {
 		const value = source[key]?.trim();
-		if (!value) {
-			if (key === "POSTGRES_SSL") throw new Error("POSTGRES_SSL is required");
-			continue;
-		}
+		if (!value) continue;
 		entries.set(key, value);
 	}
 	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
@@ -7567,8 +7745,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	}
 	const worker = resolveWorkerRuntimeConfig(source);
 	entries.set("PLATFORM_URL", worker.platformUrl);
-	entries.set("WORKER_INTERNAL_TOKEN", worker.workerToken);
-	for (const [key, value] of Object.entries(projectDatabaseRuntimeEnv(database))) entries.set(key, value);
+	entries.set("WORKER_INTERNAL_TOKEN", mintOrgWorkerToken(worker.workerToken, database.organizationId));
 	if (extraEnv) for (const [key, value] of Object.entries(extraEnv)) entries.set(key, value);
 	return Object.fromEntries(entries);
 }
@@ -7820,6 +7997,6 @@ async function fetchDeployStatus(baseUrl, options = {}) {
 	}
 }
 //#endregion
-export { DEV_PLATFORM_WORKER_TOKEN, PROJECT_DATABASE_ENV_KEYS, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, RUNTIME_PING_TIMEOUT_MS, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, projectDatabaseRuntimeEnv, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, waitForHealth };
+export { DEV_PLATFORM_WORKER_TOKEN, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, RUNTIME_PING_TIMEOUT_MS, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
 
 //# sourceMappingURL=index.mjs.map