@keystrokehq/hosting 0.1.9 → 0.1.11

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
 import Docker from "dockerode";
 import { mkdir } from "node:fs/promises";
 //#region src/constants.ts
@@ -621,6 +622,7 @@ const string$1 = (params) => {
 const integer = /^-?\d+$/;
 const number$2 = /^-?\d+(?:\.\d+)?$/;
 const boolean$1 = /^(?:true|false)$/i;
+const _null$2 = /^null$/i;
 const lowercase = /^[^A-Z]*$/;
 const uppercase = /^[^a-z]*$/;
 //#endregion
@@ -1433,6 +1435,22 @@ const $ZodBoolean = /* @__PURE__ */ $constructor("$ZodBoolean", (inst, def) => {
 		return payload;
 	};
 });
+const $ZodNull = /* @__PURE__ */ $constructor("$ZodNull", (inst, def) => {
+	$ZodType.init(inst, def);
+	inst._zod.pattern = _null$2;
+	inst._zod.values = new Set([null]);
+	inst._zod.parse = (payload, _ctx) => {
+		const input = payload.value;
+		if (input === null) return payload;
+		payload.issues.push({
+			expected: "null",
+			code: "invalid_type",
+			input,
+			inst
+		});
+		return payload;
+	};
+});
 const $ZodUnknown = /* @__PURE__ */ $constructor("$ZodUnknown", (inst, def) => {
 	$ZodType.init(inst, def);
 	inst._zod.parse = (payload) => payload;
@@ -2679,6 +2697,13 @@ function _boolean(Class, params) {
 	});
 }
 /* @__NO_SIDE_EFFECTS__ */
+function _null$1(Class, params) {
+	return new Class({
+		type: "null",
+		...normalizeParams(params)
+	});
+}
+/* @__NO_SIDE_EFFECTS__ */
 function _unknown(Class) {
 	return new Class({ type: "unknown" });
 }
@@ -3227,6 +3252,13 @@ const numberProcessor = (schema, ctx, _json, _params) => {
 const booleanProcessor = (_schema, _ctx, json, _params) => {
 	json.type = "boolean";
 };
+const nullProcessor = (_schema, ctx, json, _params) => {
+	if (ctx.target === "openapi-3.0") {
+		json.type = "string";
+		json.nullable = true;
+		json.enum = [null];
+	} else json.type = "null";
+};
 const neverProcessor = (_schema, _ctx, json, _params) => {
 	json.not = {};
 };
@@ -3926,6 +3958,14 @@ const ZodBoolean = /* @__PURE__ */ $constructor("ZodBoolean", (inst, def) => {
 function boolean(params) {
 	return /* @__PURE__ */ _boolean(ZodBoolean, params);
 }
+const ZodNull = /* @__PURE__ */ $constructor("ZodNull", (inst, def) => {
+	$ZodNull.init(inst, def);
+	ZodType.init(inst, def);
+	inst._zod.processJSONSchema = (ctx, json, params) => nullProcessor(inst, ctx, json, params);
+});
+function _null(params) {
+	return /* @__PURE__ */ _null$1(ZodNull, params);
+}
 const ZodUnknown = /* @__PURE__ */ $constructor("ZodUnknown", (inst, def) => {
 	$ZodUnknown.init(inst, def);
 	ZodType.init(inst, def);
@@ -4768,6 +4808,7 @@ const INFRA_SYSTEM_SLUGS = [
 	"health",
 	"healthcheck",
 	"healthz",
+	"hook-resume",
 	"hooks",
 	"internal",
 	"item",
@@ -4933,14 +4974,14 @@ const OrganizationUserRoleSchema = _enum([
 	"admin",
 	"builder"
 ]);
-const isoDateTime$5 = string().datetime();
+const isoDateTime$7 = string().datetime();
 const OrganizationSchema = object({
 	id: string(),
 	name: string(),
 	slug: OrganizationSlugSchema,
 	verified: boolean(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 const ProjectSchema = object({
 	id: string(),
@@ -4952,8 +4993,8 @@ const ProjectSchema = object({
 	baseUrl: string().nullable(),
 	runtimeId: string().nullable(),
 	lastError: string().nullable(),
-	createdAt: isoDateTime$5,
-	updatedAt: isoDateTime$5
+	createdAt: isoDateTime$7,
+	updatedAt: isoDateTime$7
 });
 object({
 	organization: OrganizationSchema,
@@ -4973,7 +5014,7 @@ const ProjectListMetricsSchema = object({
 	workflowCount: number$1(),
 	skillCount: number$1(),
 	credentialCount: number$1(),
-	lastDeploymentAt: isoDateTime$5.nullable()
+	lastDeploymentAt: isoDateTime$7.nullable()
 });
 record(string(), ProjectListMetricsSchema);
 object({
@@ -5328,6 +5369,130 @@ object({
 	skills: array(StoredRouteManifestSkillSchema).default([]),
 	integrations: array(string()).optional()
 });
+const isoDateTime$6 = string().datetime();
+const subscriptionStatusSchema = _enum([
+	"none",
+	"trialing",
+	"active",
+	"past_due",
+	"canceled"
+]);
+const CreditPackSchema = object({
+	id: string(),
+	usd: number$1(),
+	microCredits: number$1(),
+	label: string()
+});
+const AutoTopupSummarySchema = object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().nullable(),
+	amountMicroCredits: number$1().nullable(),
+	/** A saved payment method exists to charge off-session. */
+	hasPaymentMethod: boolean(),
+	/** A top-up invoice payment is in flight. */
+	pending: boolean()
+});
+/**
+* The plan's resolved limits. Storage overage is billed from the wallet's
+* pushed-down `includedStorageGb`; concurrency, per-pass run timeouts, and
+* API/MCP rate limits are enforced from the wallet (timeouts/concurrency) or
+* plan preset (rate limits). Log retention is configured but not pruned yet.
+*/
+const PlanLimitsSchema = object({
+	includedStorageGb: number$1(),
+	concurrencyLimit: number$1(),
+	agentTimeoutMs: number$1(),
+	workflowTimeoutMs: number$1(),
+	pollTimeoutMs: number$1(),
+	/** Configured retention window; pruning not implemented yet. */
+	logRetentionDays: number$1(),
+	apiRateLimitCapacity: number$1(),
+	apiRateLimitRefillPerSec: number$1(),
+	mcpRateLimitCapacity: number$1(),
+	mcpRateLimitRefillPerSec: number$1()
+});
+object({
+	planKey: string(),
+	subscriptionStatus: subscriptionStatusSchema,
+	planCreditMicroCredits: number$1(),
+	prepaidCreditMicroCredits: number$1(),
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	autoTopup: AutoTopupSummarySchema,
+	creditPacks: array(CreditPackSchema),
+	limits: PlanLimitsSchema
+});
+const BillingUsageMeterSchema = object({
+	/** Meter key (`llm`, `vm_second`, …); null groups uncategorized rows. */
+	meterKey: string().nullable(),
+	/** Charged this period, µc. */
+	microCredits: number$1(),
+	/** Tracked-but-not-charged usage (e.g. BYOK LLM calls), display USD. */
+	unchargedUsd: number$1()
+});
+object({
+	periodStart: isoDateTime$6.nullable(),
+	periodEnd: isoDateTime$6.nullable(),
+	totalMicroCredits: number$1(),
+	byMeter: array(BillingUsageMeterSchema)
+});
+const billingLedgerEntryTypeSchema = _enum([
+	"grant_plan",
+	"grant_prepaid",
+	"expire_plan",
+	"adjustment"
+]);
+object({
+	entries: array(object({
+		id: string(),
+		entryType: billingLedgerEntryTypeSchema,
+		label: string(),
+		/** Signed: positive grants, negative expirations/adjustments. */
+		microCredits: number$1(),
+		bucket: _enum(["plan", "prepaid"]).nullable(),
+		/** Stripe invoice behind the entry, when there is one — powers "View invoice". */
+		stripeInvoiceId: string().nullable(),
+		createdAt: isoDateTime$6
+	})),
+	/** Set only when the latest payment failure is newer than the latest successful payment. */
+	lastPaymentFailureAt: isoDateTime$6.nullable()
+});
+object({ 
+/** Web-app path to land on after Checkout (must be a path, not a URL). */
+returnPath: string().startsWith("/").max(512).optional() });
+object({
+	packId: string(),
+	returnPath: string().startsWith("/").max(512).optional()
+});
+object({ returnPath: string().startsWith("/").max(512).optional() });
+object({ url: string().url() });
+object({
+	/** Hosted invoice page (view, download, receipt). */
+	url: string().url(),
+	/** Direct PDF download when Stripe provides one. */
+	pdf: string().url().nullable()
+});
+object({ 
+/** Stripe Checkout Session id from the `session_id` success-URL param. */
+sessionId: string().min(1).max(255) });
+object({
+	/**
+	* `granted` — credits are in the wallet now; `processing` — payment not
+	* complete yet, the webhook will finish it; `ignored` — not a confirmable
+	* session for this org.
+	*/
+	status: _enum([
+		"granted",
+		"processing",
+		"ignored"
+	]),
+	reason: string().optional()
+});
+object({
+	enabled: boolean(),
+	thresholdMicroCredits: number$1().int().positive().optional(),
+	packId: string().optional()
+});
 /** Messaging platforms that support agent gateway bindings. */
 const ChannelPlatformKeySchema = _enum(["slack"]);
 const ChannelReactionSupportSchema = _enum([
@@ -5848,7 +6013,11 @@ object({
 	isDefault: boolean().optional(),
 	value: credentialSecretValueSchema.optional()
 }).refine((input) => input.label !== void 0 || input.isDefault !== void 0 || input.value !== void 0, { message: "At least one field is required" });
-const CredentialAssignmentTargetTypeSchema = _enum(["workflow", "agent"]);
+const CredentialAssignmentTargetTypeSchema = _enum([
+	"workflow",
+	"agent",
+	"poll"
+]);
 object({ assignments: array(object({
 	id: string(),
 	targetType: CredentialAssignmentTargetTypeSchema,
@@ -5963,7 +6132,11 @@ const ValidationErrorDetailSchema = object({
 	message: string()
 });
 /** Machine-readable codes returned in standard API error bodies. */
-const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum(["needs_org_selection", "org_unverified"]));
+const ErrorResponseCodeSchema = OrganizationSlugErrorCodeSchema.or(_enum([
+	"needs_org_selection",
+	"org_unverified",
+	"connector_unavailable"
+]));
 object({
 	error: string(),
 	code: ErrorResponseCodeSchema.optional(),
@@ -6074,6 +6247,17 @@ union([
 	SkipResponseSchema,
 	object({ runId: string() })
 ]);
+object({
+	sql: string().min(1),
+	params: array(unknown()).default([]),
+	method: string().min(1).optional()
+});
+object({ migrations: array(object({
+	sql: array(string().min(1)),
+	hash: string().min(1),
+	folderMillis: number$1()
+})) });
+object({ results: array(object({ rows: array(unknown()) })) });
 const RunSourceKindSchema = _enum([
 	"api",
 	"trigger",
@@ -6394,12 +6578,19 @@ const HistoryRunActorSchema = object({
 const HistoryRunUsageLineItemSchema = object({
 	id: string(),
 	label: string(),
-	amountUsd: number$1()
+	/** Amount debited from the org's Keystroke balance for this line. */
+	billedUsd: number$1(),
+	/** Provider cost for LLM usage on the org's API key (informational; not billed by Keystroke). */
+	providerCostUsd: number$1().nullable().optional(),
+	keySource: _enum(["byok", "platform"]).nullable().optional()
 });
 const HistoryRunUsageSchema = object({
 	runDurationMs: number$1().nullable(),
 	lineItems: array(HistoryRunUsageLineItemSchema),
-	totalExcludingDurationUsd: number$1().nullable()
+	/** Sum of `billedUsd` — what Keystroke charged for this run. */
+	totalBilledUsd: number$1().nullable(),
+	/** Sum of BYOK LLM provider costs (billed externally by the org's provider). */
+	externalProviderCostUsd: number$1().nullable().optional()
 });
 const HistoryRunSchema = object({
 	id: string(),
@@ -6530,6 +6721,7 @@ const HistoryRunDetailSchema = discriminatedUnion("kind", [object({
 		attachmentSlug: string().nullable()
 	}).nullable(),
 	messages: array(record(string(), unknown())),
+	live: record(string(), unknown()).nullable().default(null),
 	trace: HistoryTraceSchema.nullable(),
 	ranAs: HistoryRunActorSchema.nullable().optional(),
 	usage: HistoryRunUsageSchema.nullable().optional()
@@ -6819,7 +7011,7 @@ const OrganizationMemberStatusSchema = _enum([
 	"suspended"
 ]);
 const InvitableOrganizationMemberRoleSchema = _enum(["admin", "builder"]);
-const isoDateTime$4 = string().datetime();
+const isoDateTime$5 = string().datetime();
 object({
 	id: string(),
 	name: string(),
@@ -6827,8 +7019,8 @@ object({
 	role: OrganizationMemberRoleSchema,
 	status: OrganizationMemberStatusSchema,
 	avatarUrl: string().optional(),
-	joinedAt: isoDateTime$4.optional(),
-	lastActiveAt: isoDateTime$4.nullable().optional()
+	joinedAt: isoDateTime$5.optional(),
+	lastActiveAt: isoDateTime$5.nullable().optional()
 });
 object({
 	emails: array(string().trim().email()).min(1),
@@ -6855,7 +7047,7 @@ object({
 	role: OrganizationMemberRoleSchema
 });
 object({ success: literal(true) });
-const isoDateTime$3 = string().datetime();
+const isoDateTime$4 = string().datetime();
 const ApiKeyCreatorSchema = object({
 	id: string(),
 	name: string(),
@@ -6868,12 +7060,37 @@ const ApiKeySummarySchema = object({
 	id: string(),
 	name: string(),
 	keyPreview: string(),
-	createdAt: isoDateTime$3,
+	createdAt: isoDateTime$4,
 	createdBy: ApiKeyCreatorSchema,
 	isCreatedByCurrentUser: boolean()
 });
 object({ name: string().trim().min(1).max(128) });
 ApiKeySummarySchema.extend({ secret: string() });
+const isoDateTime$3 = string().datetime();
+const ManagedServiceKindSchema = _enum(["llm"]);
+_enum([
+	"openai",
+	"anthropic",
+	"google",
+	"groq",
+	"xai"
+]);
+object({
+	id: string(),
+	kind: ManagedServiceKindSchema,
+	provider: string(),
+	keyPreview: string(),
+	createdAt: isoDateTime$3,
+	updatedAt: isoDateTime$3,
+	createdBy: ApiKeyCreatorSchema,
+	isCreatedByCurrentUser: boolean()
+});
+object({
+	kind: ManagedServiceKindSchema.default("llm"),
+	provider: string().trim().min(1),
+	apiKey: string().trim().min(1)
+});
+object({ apiKey: string().trim().min(1) });
 const ProjectUserRoleSchema = _enum(["admin", "builder"]);
 const ProjectInvitePermissionSchema = _enum(["admin", "all"]);
 const ProjectMemberStatusSchema = _enum(["active", "invited"]);
@@ -6923,6 +7140,14 @@ object({
 	uploadUrl: url(),
 	storageKey: string().min(1)
 });
+function isValidIanaTimezone(value) {
+	try {
+		Intl.DateTimeFormat(void 0, { timeZone: value });
+		return true;
+	} catch {
+		return false;
+	}
+}
 const UserInterfaceThemeSchema = _enum([
 	"system",
 	"light",
@@ -6942,22 +7167,25 @@ const UserWorkspaceFavoriteSchema = object({
 	]),
 	resourceId: string().min(1)
 });
+const UserSidebarPreferencesSchema = object({
+	navIconVisibility: UserSidebarNavIconVisibilitySchema,
+	footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema,
+	hiddenNavItemIds: array(string()),
+	topNavItemOrderIds: array(string()),
+	workspaceNavItemOrderIds: array(string())
+});
+const UserTimezoneSchema = string().refine(isValidIanaTimezone, { message: "Invalid IANA timezone" });
 object({
 	interfaceTheme: UserInterfaceThemeSchema,
 	surfaceContrast: UserSurfaceContrastSchema,
 	layoutMode: UserWorkspaceLayoutModeSchema,
 	fontSize: UserWorkspaceFontSizeSchema,
-	sidebar: object({
-		navIconVisibility: UserSidebarNavIconVisibilitySchema,
-		footerChatRowVisibility: UserSidebarFooterChatRowVisibilitySchema,
-		hiddenNavItemIds: array(string()),
-		topNavItemOrderIds: array(string()),
-		workspaceNavItemOrderIds: array(string())
-	}),
+	sidebar: UserSidebarPreferencesSchema,
 	favorites: array(UserWorkspaceFavoriteSchema),
 	projectOrderIds: array(string()),
 	projectDotColors: record(string(), string()),
-	onboardingTabVisible: boolean()
+	onboardingTabVisible: boolean(),
+	timezone: union([UserTimezoneSchema, _null()])
 });
 const UserSidebarPreferencesPatchSchema = object({
 	navIconVisibility: UserSidebarNavIconVisibilitySchema.optional(),
@@ -6975,8 +7203,9 @@ object({
 	favorites: array(UserWorkspaceFavoriteSchema).optional(),
 	projectOrderIds: array(string()).optional(),
 	projectDotColors: record(string(), string()).optional(),
-	onboardingTabVisible: boolean().optional()
-}).refine((value) => value.interfaceTheme !== void 0 || value.surfaceContrast !== void 0 || value.layoutMode !== void 0 || value.fontSize !== void 0 || value.sidebar !== void 0 || value.favorites !== void 0 || value.projectOrderIds !== void 0 || value.projectDotColors !== void 0 || value.onboardingTabVisible !== void 0, { message: "At least one preference field is required" });
+	onboardingTabVisible: boolean().optional(),
+	timezone: union([UserTimezoneSchema, _null()]).optional()
+}).refine((value) => value.interfaceTheme !== void 0 || value.surfaceContrast !== void 0 || value.layoutMode !== void 0 || value.fontSize !== void 0 || value.sidebar !== void 0 || value.favorites !== void 0 || value.projectOrderIds !== void 0 || value.projectDotColors !== void 0 || value.onboardingTabVisible !== void 0 || value.timezone !== void 0, { message: "At least one preference field is required" });
 const OrganizationLogoVariantSchema = _enum(["light", "dark"]);
 object({
 	customLogoEnabled: boolean(),
@@ -7439,13 +7668,35 @@ function parseOrgArtifactsFromEnv(env = process.env) {
 	});
 }
 //#endregion
+//#region src/org-worker-token.ts
+function sign(secret, organizationId) {
+	return createHmac("sha256", secret).update(`org-worker:${organizationId}`).digest("base64url");
+}
+/**
+* Per-org worker token: `{organizationId}.{hmac}`. Self-describing so the
+* platform can tell which org a machine is calling as, and stateless — verified
+* by re-signing with the shared `PLATFORM_WORKER_TOKEN` secret.
+*/
+function mintOrgWorkerToken(secret, organizationId) {
+	return `${organizationId}.${sign(secret, organizationId)}`;
+}
+function verifyOrgWorkerToken(secret, token) {
+	if (!secret || !token) return;
+	const separator = token.lastIndexOf(".");
+	if (separator <= 0) return;
+	const organizationId = token.slice(0, separator);
+	const signature = Buffer.from(token.slice(separator + 1));
+	const expected = Buffer.from(sign(secret, organizationId));
+	if (signature.length !== expected.length || !timingSafeEqual(signature, expected)) return;
+	return { organizationId };
+}
+//#endregion
 //#region src/runtime-env.ts
 const RUNTIME_ENV_KEYS = [
 	"BETTER_AUTH_SECRET",
 	"PUBLIC_PLATFORM_URL",
 	"PUBLIC_PLATFORM_PROXY_URL",
 	"PUBLIC_WEB_URL",
-	"POSTGRES_SSL",
 	"UPSTASH_REDIS_URL",
 	"REDIS_URL",
 	"KEYSTROKE_QUEUE_PREFIX"
@@ -7459,25 +7710,6 @@ const PROVIDER_ENV_KEYS = [
 ];
 /** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
 const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
-const PROJECT_DATABASE_ENV_KEYS = [
-	"POSTGRES_HOST",
-	"POSTGRES_PORT",
-	"POSTGRES_DB",
-	"POSTGRES_USER",
-	"POSTGRES_PASSWORD",
-	"DATABASE_SEARCH_PATH"
-];
-/** Per-project postgres env injected into every project server container/machine. */
-function projectDatabaseRuntimeEnv(database) {
-	return {
-		POSTGRES_HOST: rewriteLoopbackHost(database.host),
-		POSTGRES_PORT: String(database.port),
-		POSTGRES_DB: database.database,
-		POSTGRES_USER: database.user,
-		POSTGRES_PASSWORD: database.password,
-		DATABASE_SEARCH_PATH: database.searchPath
-	};
-}
 /**
 * Builds the launch spec for an org worker. Each deploy artifact is encoded in
 * `KEYSTROKE_ORG_ARTIFACTS` — there is no base image, so at least one artifact is required.
@@ -7504,10 +7736,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	]);
 	for (const key of RUNTIME_ENV_KEYS) {
 		const value = source[key]?.trim();
-		if (!value) {
-			if (key === "POSTGRES_SSL") throw new Error("POSTGRES_SSL is required");
-			continue;
-		}
+		if (!value) continue;
 		entries.set(key, value);
 	}
 	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
@@ -7516,8 +7745,7 @@ function buildRuntimeEnv(source, artifacts, database, extraEnv) {
 	}
 	const worker = resolveWorkerRuntimeConfig(source);
 	entries.set("PLATFORM_URL", worker.platformUrl);
-	entries.set("WORKER_INTERNAL_TOKEN", worker.workerToken);
-	for (const [key, value] of Object.entries(projectDatabaseRuntimeEnv(database))) entries.set(key, value);
+	entries.set("WORKER_INTERNAL_TOKEN", mintOrgWorkerToken(worker.workerToken, database.organizationId));
 	if (extraEnv) for (const [key, value] of Object.entries(extraEnv)) entries.set(key, value);
 	return Object.fromEntries(entries);
 }
@@ -7605,55 +7833,63 @@ function sleep(ms) {
 const MINIO_DOCKER_NETWORK = process.env.MINIO_DOCKER_NETWORK ?? "keystroke";
 function createDockerRuntime(options = {}) {
 	const docker = options.docker ?? new Docker();
-	return { async start(input) {
-		if (input.projects.length === 0) throw new Error("Docker org runtime requires at least one project deploy");
-		let launch = resolveRuntimeLaunch(options, input.projects.map((project) => ({
-			projectId: project.projectId,
-			artifactStorageKey: project.artifactStorageKey
-		})), input.database, input.env);
-		if (options.workspacesMount) {
-			const { hostPath, containerPath } = options.workspacesMount;
-			await mkdir(hostPath, { recursive: true });
-			launch = {
-				...launch,
-				env: {
-					...launch.env,
-					KEYSTROKE_WORKSPACES_ROOT: containerPath
-				}
+	return {
+		async start(input) {
+			if (input.projects.length === 0) throw new Error("Docker org runtime requires at least one project deploy");
+			let launch = resolveRuntimeLaunch(options, input.projects.map((project) => ({
+				projectId: project.projectId,
+				artifactStorageKey: project.artifactStorageKey
+			})), input.database, input.env);
+			if (options.workspacesMount) {
+				const { hostPath, containerPath } = options.workspacesMount;
+				await mkdir(hostPath, { recursive: true });
+				launch = {
+					...launch,
+					env: {
+						...launch.env,
+						KEYSTROKE_WORKSPACES_ROOT: containerPath
+					}
+				};
+			}
+			await ensureImage(docker, launch.image);
+			await removeExistingContainer(docker, input.organizationId);
+			const binds = [...options.workspacesMount ? [`${options.workspacesMount.hostPath}:${options.workspacesMount.containerPath}`] : [], ...options.extraBinds ?? []];
+			const container = await docker.createContainer({
+				Image: launch.image,
+				name: containerName(input.organizationId),
+				Labels: {
+					"keystroke.organization.id": input.organizationId,
+					"keystroke.project.ids": input.projects.map((project) => project.projectId).join(",")
+				},
+				ExposedPorts: { [`${launch.port}/tcp`]: {} },
+				HostConfig: {
+					ExtraHosts: ["host.docker.internal:host-gateway"],
+					PortBindings: { [`${launch.port}/tcp`]: [{ HostPort: "0" }] },
+					...binds.length > 0 ? { Binds: binds } : {}
+				},
+				NetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },
+				Env: formatDockerEnv(launch.env)
+			});
+			await container.start();
+			const inspect = await container.inspect();
+			const binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];
+			if (!binding?.HostPort) throw new Error("Failed to resolve org container host port");
+			const baseUrl = `http://127.0.0.1:${binding.HostPort}`;
+			await waitForHealth(baseUrl, {
+				fetchImpl: options.fetchImpl,
+				timeoutMs: options.healthTimeoutMs
+			});
+			return {
+				runtimeId: inspect.Id,
+				baseUrl
 			};
+		},
+		async destroy(input) {
+			try {
+				await docker.getContainer(input.runtimeId).remove({ force: true });
+			} catch {}
 		}
-		await ensureImage(docker, launch.image);
-		await removeExistingContainer(docker, input.organizationId);
-		const container = await docker.createContainer({
-			Image: launch.image,
-			name: containerName(input.organizationId),
-			Labels: {
-				"keystroke.organization.id": input.organizationId,
-				"keystroke.project.ids": input.projects.map((project) => project.projectId).join(",")
-			},
-			ExposedPorts: { [`${launch.port}/tcp`]: {} },
-			HostConfig: {
-				ExtraHosts: ["host.docker.internal:host-gateway"],
-				PortBindings: { [`${launch.port}/tcp`]: [{ HostPort: "0" }] },
-				...options.workspacesMount ? { Binds: [`${options.workspacesMount.hostPath}:${options.workspacesMount.containerPath}`] } : {}
-			},
-			NetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },
-			Env: formatDockerEnv(launch.env)
-		});
-		await container.start();
-		const inspect = await container.inspect();
-		const binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];
-		if (!binding?.HostPort) throw new Error("Failed to resolve org container host port");
-		const baseUrl = `http://127.0.0.1:${binding.HostPort}`;
-		await waitForHealth(baseUrl, {
-			fetchImpl: options.fetchImpl,
-			timeoutMs: options.healthTimeoutMs
-		});
-		return {
-			runtimeId: inspect.Id,
-			baseUrl
-		};
-	} };
+	};
 }
 function containerName(organizationId) {
 	return `keystroke-org-${organizationId}`;
@@ -7761,6 +7997,6 @@ async function fetchDeployStatus(baseUrl, options = {}) {
 	}
 }
 //#endregion
-export { DEV_PLATFORM_WORKER_TOKEN, PROJECT_DATABASE_ENV_KEYS, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, RUNTIME_PING_TIMEOUT_MS, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, projectDatabaseRuntimeEnv, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, waitForHealth };
+export { DEV_PLATFORM_WORKER_TOKEN, PROJECT_SERVER_DEPLOY_STATUS, PROJECT_SERVER_FRAMEWORK_NODE_MODULES, PROJECT_SERVER_FRAMEWORK_ROOT, PROJECT_SERVER_HEALTH, PROJECT_SERVER_IMAGE, PROJECT_SERVER_PORT, PROJECT_SERVER_ROOT, RUNTIME_PING_TIMEOUT_MS, WorkerRuntimeConfigError, buildRuntimeEnv, canPingProjectTarget, defaultHostingPlugin, dockerPlugin, encodeOrgArtifacts, fetchDeployStatus, formatDockerEnv, mintOrgWorkerToken, parseOrgArtifactsFromEnv, pingProject, pingProjectTarget, resolvePlatformWorkerToken, resolveProjectServerImage, resolveRuntimeLaunch, resolveWorkerPlatformUrl, resolveWorkerRuntimeConfig, rewriteLoopbackHost, rewriteLoopbackUrl, verifyOrgWorkerToken, waitForHealth };
 
 //# sourceMappingURL=index.mjs.map