@keystrokehq/platform 0.1.1 → 0.1.2

package/dist/{dist-COpoWBp6.cjs → dist-DvjFaP47.cjs}

@@ -21,6 +21,8 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
+let dockerode = require("dockerode");
+dockerode = __toESM(dockerode, 1);
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_child_process = require("node:child_process");
@@ -28,6 +30,276 @@ let node_os = require("node:os");
 let zod = require("zod");
 let _aws_sdk_client_s3 = require("@aws-sdk/client-s3");
 let _aws_sdk_s3_request_presigner = require("@aws-sdk/s3-request-presigner");
+//#region ../../packages/hosting/dist/index.mjs
+const PROJECT_SERVER_PORT = 3e3;
+const PROJECT_SERVER_ROOT = "/app";
+const PROJECT_SERVER_FRAMEWORK_NODE_MODULES = `/opt/keystroke/node_modules`;
+const PROJECT_SERVER_HEALTH = {
+	path: "/health",
+	port: PROJECT_SERVER_PORT
+};
+const RUNTIME_ENV_KEYS = [
+	"BETTER_AUTH_SECRET",
+	"PUBLIC_SERVER_URL",
+	"PUBLIC_WEB_URL",
+	"POSTGRES_SSL",
+	"KEYSTROKE_SCHEDULER_MODULE",
+	"UPSTASH_REDIS_URL",
+	"REDIS_URL",
+	"KEYSTROKE_QUEUE_PREFIX"
+];
+/** Provider and gateway env forwarded from the platform into project servers. */
+const PROVIDER_ENV_KEYS = [
+	"ANTHROPIC_API_KEY",
+	"OPENAI_API_KEY",
+	"AI_GATEWAY_API_KEY",
+	"AI_GATEWAY_BASE_URL"
+];
+/** Shared dev token when `PLATFORM_WORKER_TOKEN` is unset (non-production only). */
+const DEV_PLATFORM_WORKER_TOKEN = "dev-platform-worker-token";
+/** Per-project postgres env injected into every project server container/machine. */
+function projectDatabaseRuntimeEnv(database) {
+	return {
+		POSTGRES_HOST: rewriteLoopbackHost(database.host),
+		POSTGRES_PORT: String(database.port),
+		POSTGRES_DB: database.database,
+		POSTGRES_USER: database.user,
+		POSTGRES_PASSWORD: database.password,
+		DATABASE_SEARCH_PATH: database.searchPath
+	};
+}
+/**
+* Builds the launch spec for a single project server. `artifactStorageKey` is the
+* object key for that deploy's built `dist` tarball in the org bucket — there is
+* no base image, so it is required.
+*/
+function resolveRuntimeLaunch(options, artifactStorageKey, database, extraEnv) {
+	if (!artifactStorageKey) throw new Error("Cannot start a project server without an artifact storage key");
+	const env = options.env ?? process.env;
+	return {
+		image: resolveProjectServerImage(env, options.image),
+		env: buildRuntimeEnv(env, artifactStorageKey, database, extraEnv),
+		port: PROJECT_SERVER_PORT,
+		health: PROJECT_SERVER_HEALTH
+	};
+}
+/** Env vars passed into the project server container/machine. */
+function buildRuntimeEnv(source, artifactStorageKey, database, extraEnv) {
+	const entries = new Map([
+		["PORT", String(PROJECT_SERVER_PORT)],
+		["KEYSTROKE_ROOT", PROJECT_SERVER_ROOT],
+		["KEYSTROKE_RUNTIME_NODE_MODULES", PROJECT_SERVER_FRAMEWORK_NODE_MODULES],
+		["ARTIFACT_STORAGE_KEY", artifactStorageKey],
+		["PROJECT_ID", database.projectId],
+		["ORGANIZATION_ID", database.organizationId],
+		["TENANT_ID", database.organizationId]
+	]);
+	for (const key of RUNTIME_ENV_KEYS) {
+		const value = source[key]?.trim();
+		if (!value) {
+			if (key === "POSTGRES_SSL") throw new Error("POSTGRES_SSL is required");
+			continue;
+		}
+		entries.set(key, value);
+	}
+	if (!extraEnv) for (const key of PROVIDER_ENV_KEYS) {
+		const value = source[key]?.trim();
+		if (value) entries.set(key, value);
+	}
+	const worker = resolveWorkerRuntimeConfig(source);
+	entries.set("PLATFORM_URL", worker.platformUrl);
+	entries.set("WORKER_INTERNAL_TOKEN", worker.workerToken);
+	for (const [key, value] of Object.entries(projectDatabaseRuntimeEnv(database))) entries.set(key, value);
+	if (extraEnv) for (const [key, value] of Object.entries(extraEnv)) entries.set(key, value);
+	return Object.fromEntries(entries);
+}
+function resolvePlatformWorkerToken(source = process.env) {
+	const explicit = source.PLATFORM_WORKER_TOKEN?.trim() ?? source.WORKER_INTERNAL_TOKEN?.trim();
+	if (explicit) return explicit;
+	if (source.NODE_ENV === "production") return;
+	return DEV_PLATFORM_WORKER_TOKEN;
+}
+/** Platform API URL reachable from a project-server container. */
+const DEV_PLATFORM_URL = "http://localhost:3002";
+function resolveWorkerPlatformUrl(source = process.env) {
+	const raw = source.PLATFORM_URL?.trim() ?? source.PUBLIC_PLATFORM_URL?.trim() ?? (source.NODE_ENV === "production" ? void 0 : DEV_PLATFORM_URL);
+	if (!raw) return;
+	return rewriteLoopbackUrl(raw);
+}
+/** Rewrite loopback hosts so containers can reach Postgres and other host services. */
+function rewriteLoopbackHost(host) {
+	if (host === "localhost" || host === "127.0.0.1") return "host.docker.internal";
+	return host;
+}
+function rewriteLoopbackUrl(url) {
+	try {
+		const parsed = new URL(url);
+		parsed.hostname = rewriteLoopbackHost(parsed.hostname);
+		return parsed.toString().replace(/\/$/, "");
+	} catch {
+		return url;
+	}
+}
+/** dockerode expects `KEY=value` strings. */
+function formatDockerEnv(env) {
+	return Object.entries(env).map(([key, value]) => `${key}=${value}`);
+}
+function resolveProjectServerImage(env = process.env, override) {
+	return override ?? env.PROJECT_DOCKER_IMAGE ?? env.TENANT_DOCKER_IMAGE ?? "keystroke/project-server:local";
+}
+var WorkerRuntimeConfigError = class extends Error {
+	missing;
+	constructor(missing) {
+		super(`Worker runtime config incomplete (missing: ${missing.join(", ")}). In production set PLATFORM_WORKER_TOKEN and PUBLIC_PLATFORM_URL (or PLATFORM_URL).`);
+		this.name = "WorkerRuntimeConfigError";
+		this.missing = missing;
+	}
+};
+/** Fail fast when the platform cannot start worker-mode project servers. */
+function resolveWorkerRuntimeConfig(source = process.env) {
+	const platformUrl = resolveWorkerPlatformUrl(source);
+	const workerToken = resolvePlatformWorkerToken(source);
+	const missing = [];
+	if (!platformUrl) missing.push("PUBLIC_PLATFORM_URL or PLATFORM_URL");
+	if (!workerToken) missing.push("PLATFORM_WORKER_TOKEN");
+	if (missing.length > 0) throw new WorkerRuntimeConfigError(missing);
+	return {
+		platformUrl,
+		workerToken
+	};
+}
+const DEFAULT_TIMEOUT_MS = 12e4;
+const DEFAULT_INTERVAL_MS = 500;
+async function waitForHealth(baseUrl, options = {}) {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	const intervalMs = options.intervalMs ?? DEFAULT_INTERVAL_MS;
+	const deadline = Date.now() + timeoutMs;
+	const url = new URL(PROJECT_SERVER_HEALTH.path, baseUrl);
+	while (Date.now() < deadline) {
+		try {
+			if ((await fetchImpl(url, { signal: AbortSignal.timeout(2e3) })).ok) return;
+		} catch {}
+		await sleep(intervalMs);
+	}
+	throw new Error(`Project server health check timed out after ${timeoutMs}ms (${url})`);
+}
+function sleep(ms) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, ms);
+	});
+}
+const MINIO_DOCKER_NETWORK = process.env.MINIO_DOCKER_NETWORK ?? "keystroke";
+function createDockerRuntime(options = {}) {
+	const docker = options.docker ?? new dockerode.default();
+	return { async start(input) {
+		const launch = resolveRuntimeLaunch(options, input.artifactStorageKey, input.database, input.env);
+		await ensureImage(docker, launch.image);
+		await removeExistingContainer(docker, input.projectId);
+		const container = await docker.createContainer({
+			Image: launch.image,
+			name: containerName(input.projectId),
+			Labels: {
+				"keystroke.project.id": input.projectId,
+				"keystroke.project.name": input.name
+			},
+			ExposedPorts: { [`${launch.port}/tcp`]: {} },
+			HostConfig: {
+				ExtraHosts: ["host.docker.internal:host-gateway"],
+				PortBindings: { [`${launch.port}/tcp`]: [{ HostPort: "0" }] }
+			},
+			NetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },
+			Env: formatDockerEnv(launch.env)
+		});
+		await container.start();
+		const inspect = await container.inspect();
+		const binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];
+		if (!binding?.HostPort) throw new Error("Failed to resolve project container host port");
+		const baseUrl = `http://127.0.0.1:${binding.HostPort}`;
+		await waitForHealth(baseUrl, {
+			fetchImpl: options.fetchImpl,
+			timeoutMs: options.healthTimeoutMs
+		});
+		return {
+			runtimeId: inspect.Id,
+			baseUrl
+		};
+	} };
+}
+function containerName(projectId) {
+	return `keystroke-project-${projectId}`;
+}
+async function removeExistingContainer(docker, projectId) {
+	try {
+		const existing = docker.getContainer(containerName(projectId));
+		await existing.stop({ t: 5 }).catch(() => void 0);
+		await existing.remove({ force: true });
+	} catch {}
+}
+async function ensureImage(docker, image) {
+	try {
+		await docker.getImage(image).inspect();
+		return;
+	} catch {}
+	await new Promise((resolvePromise, reject) => {
+		docker.pull(image, (error, stream) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			if (!stream) {
+				reject(/* @__PURE__ */ new Error(`Failed to pull image ${image}`));
+				return;
+			}
+			docker.modem.followProgress(stream, (progressError) => {
+				if (progressError) {
+					reject(progressError);
+					return;
+				}
+				resolvePromise();
+			});
+		});
+	});
+}
+function dockerPlugin(options = {}) {
+	const env = options.env ?? process.env;
+	return {
+		name: "docker",
+		workerRuntime: resolveWorkerRuntimeConfig(env),
+		createRuntime: () => createDockerRuntime({
+			...options,
+			env
+		})
+	};
+}
+/** Local Docker hosting — default for platform and dev. */
+function defaultHostingPlugin(options = {}) {
+	return dockerPlugin(options);
+}
+async function pingProject(baseUrl, options = {}) {
+	const timeoutMs = options.timeoutMs ?? 15e3;
+	const headers = options.plugin?.pingRequestHeaders?.(options.runtimeId ?? null) ?? {};
+	try {
+		return (await (options.fetchImpl ?? fetch)(new URL(PROJECT_SERVER_HEALTH.path, baseUrl), {
+			signal: AbortSignal.timeout(timeoutMs),
+			headers
+		})).ok;
+	} catch {
+		return false;
+	}
+}
+function canPingProjectTarget(target, plugin) {
+	if (plugin?.canPingTarget) return plugin.canPingTarget(target);
+	return !!target.baseUrl;
+}
+async function pingProjectTarget(target, options = {}) {
+	if (!canPingProjectTarget(target, options.plugin)) return false;
+	return pingProject(target.baseUrl, {
+		...options,
+		runtimeId: target.runtimeId
+	});
+}
+//#endregion
 //#region ../../packages/shared/dist/index.mjs
 const ACTIVE_ORG_HEADER = "x-keystroke-org-id";
 /** Auth, session, and account-entry URL segments. */
@@ -583,27 +855,8 @@ const OrganizationSlugSchema = zod.z.string().trim().toLowerCase().min(2, "Slug
 * fail to load.
 */
 const ClaimableOrganizationSlugSchema = OrganizationSlugSchema.refine((slug) => !RESERVED_ORGANIZATION_SLUGS.has(slug), "This slug is reserved");
-const ORGANIZATION_NAME_APOSTROPHE_PATTERN = /[''\u2018\u2019]/g;
-/** Normalize a display name into slug-shaped text (may be empty or too short to claim). */
-function normalizeOrganizationNameToSlugBase(name) {
-	return name.trim().toLowerCase().replace(ORGANIZATION_NAME_APOSTROPHE_PATTERN, "").replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
-}
-/** Derive a URL slug from a display name (not guaranteed unique). */
-function slugifyOrganizationName(name) {
-	const base = normalizeOrganizationNameToSlugBase(name);
-	if (!base) return "org";
-	const parsed = OrganizationSlugSchema.safeParse(base);
-	return parsed.success ? parsed.data : "org";
-}
 /** Same format as organization slugs — org-scoped, no global reserved list. */
 const ProjectSlugSchema = OrganizationSlugSchema;
-/** Derive a URL slug from a project display name (not guaranteed unique within the org). */
-function slugifyProjectName(name) {
-	const base = normalizeOrganizationNameToSlugBase(name);
-	if (!base) return "project";
-	const parsed = ProjectSlugSchema.safeParse(base);
-	return parsed.success ? parsed.data : "project";
-}
 /** TCP port to bind for a local server, derived from a public URL. */
 function listenPortFromUrl(url, fallback) {
 	const parsed = new URL(url);
@@ -1148,8 +1401,6 @@ function isCredentialInput(value) {
 	return typeof candidate.key === "string" && CredentialAuthKindSchema.safeParse(candidate.kind).success && candidate.schema instanceof zod.z.ZodType;
 }
 const credentialInputSchema = zod.z.custom((value) => isCredentialInput(value), "must be a credential requirement");
-/** Canonical copy for slug collision errors (API + UI). */
-const ORGANIZATION_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
 const PROJECT_SLUG_TAKEN_MESSAGE = "That slug is already taken.";
 const OrganizationSlugErrorCodeSchema = zod.z.enum([
 	"slug_taken",
@@ -2191,44 +2442,6 @@ const PresignOrgLogoResponseSchema = zod.z.object({
 	uploadUrl: zod.z.url(),
 	storageKey: zod.z.string().min(1)
 });
-const DEFAULT_ORGANIZATION_SIDEBAR_BRANDING = {
-	customLogoEnabled: false,
-	customLogoExplicitlyDisabled: false,
-	logoLightUrl: null,
-	logoDarkUrl: null,
-	logoHeightPx: 20
-};
-function normalizeLogoUrl(value) {
-	if (typeof value !== "string") return null;
-	try {
-		const url = new URL(value);
-		if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-		return url.toString();
-	} catch {
-		return null;
-	}
-}
-function normalizeCustomLogoEnabled(value, branding) {
-	const hasCustomLogo = Boolean(normalizeLogoUrl(branding.logoLightUrl) || normalizeLogoUrl(branding.logoDarkUrl));
-	if (branding.customLogoExplicitlyDisabled === true) return false;
-	if (typeof value === "boolean") return value || hasCustomLogo;
-	return hasCustomLogo;
-}
-function normalizeLogoHeightPx(value) {
-	if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_ORGANIZATION_SIDEBAR_BRANDING.logoHeightPx;
-	return Math.min(32, Math.max(14, Math.round(value)));
-}
-function normalizeOrganizationSidebarBranding(value) {
-	if (!value || typeof value !== "object") return DEFAULT_ORGANIZATION_SIDEBAR_BRANDING;
-	const branding = value;
-	return OrganizationSidebarBrandingSchema.parse({
-		customLogoEnabled: normalizeCustomLogoEnabled(branding.customLogoEnabled, branding),
-		customLogoExplicitlyDisabled: branding.customLogoExplicitlyDisabled === true,
-		logoLightUrl: normalizeLogoUrl(branding.logoLightUrl),
-		logoDarkUrl: normalizeLogoUrl(branding.logoDarkUrl),
-		logoHeightPx: normalizeLogoHeightPx(branding.logoHeightPx)
-	});
-}
 const ProjectArtifactStatusSchema = zod.z.enum(["pending", "ready"]);
 const isoDateTime$1 = zod.z.string().datetime();
 const ProjectArtifactSchema = zod.z.object({
@@ -2528,19 +2741,6 @@ function storageAdminConfigFromEnv(env = process.env) {
 		forcePathStyle: env.STORAGE_FORCE_PATH_STYLE === void 0 ? true : env.STORAGE_FORCE_PATH_STYLE === "true"
 	};
 }
-/** Endpoint for presigned URLs fetched inside project-server containers (e.g. `http://minio:9000`). */
-function containerPresignEndpointFromEnv(hostEndpoint, env = process.env) {
-	const override = readEnv$1(env, "STORAGE_CONTAINER_ENDPOINT");
-	if (override) return override;
-	try {
-		const url = new URL(hostEndpoint);
-		if (url.hostname === "localhost" || url.hostname === "127.0.0.1") {
-			const port = url.port || (url.protocol === "https:" ? "443" : "9000");
-			return `${url.protocol}//minio:${port}`;
-		}
-	} catch {}
-	return hostEndpoint;
-}
 const DEFAULT_PRESIGN_TTL_SECONDS = 900;
 function createStorage(config) {
 	const client = new _aws_sdk_client_s3.S3Client(toClientConfig(config));
@@ -2899,12 +3099,6 @@ Object.defineProperty(exports, "AgentSummarySchema", {
 		return AgentSummarySchema;
 	}
 });
-Object.defineProperty(exports, "ClaimableOrganizationSlugSchema", {
-	enumerable: true,
-	get: function() {
-		return ClaimableOrganizationSlugSchema;
-	}
-});
 Object.defineProperty(exports, "CompleteProjectArtifactResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -3103,12 +3297,6 @@ Object.defineProperty(exports, "ListProjectsResponseSchema", {
 		return ListProjectsResponseSchema;
 	}
 });
-Object.defineProperty(exports, "ORGANIZATION_SLUG_TAKEN_MESSAGE", {
-	enumerable: true,
-	get: function() {
-		return ORGANIZATION_SLUG_TAKEN_MESSAGE;
-	}
-});
 Object.defineProperty(exports, "OrganizationSidebarBrandingPatchSchema", {
 	enumerable: true,
 	get: function() {
@@ -3121,12 +3309,6 @@ Object.defineProperty(exports, "OrganizationSidebarBrandingSchema", {
 		return OrganizationSidebarBrandingSchema;
 	}
 });
-Object.defineProperty(exports, "OrganizationSlugSchema", {
-	enumerable: true,
-	get: function() {
-		return OrganizationSlugSchema;
-	}
-});
 Object.defineProperty(exports, "PLATFORM_RESOURCE_UNSUPPORTED_TEXT", {
 	enumerable: true,
 	get: function() {
@@ -3205,24 +3387,12 @@ Object.defineProperty(exports, "ProjectSlugAvailabilityResponseSchema", {
 		return ProjectSlugAvailabilityResponseSchema;
 	}
 });
-Object.defineProperty(exports, "ProjectSlugSchema", {
-	enumerable: true,
-	get: function() {
-		return ProjectSlugSchema;
-	}
-});
 Object.defineProperty(exports, "ProjectSourceResourcesSchema", {
 	enumerable: true,
 	get: function() {
 		return ProjectSourceResourcesSchema;
 	}
 });
-Object.defineProperty(exports, "RESERVED_ORGANIZATION_SLUGS", {
-	enumerable: true,
-	get: function() {
-		return RESERVED_ORGANIZATION_SLUGS;
-	}
-});
 Object.defineProperty(exports, "RecentResourceListResponseSchema", {
 	enumerable: true,
 	get: function() {
@@ -3409,28 +3579,22 @@ Object.defineProperty(exports, "buildCredentialInstanceLabel", {
 		return buildCredentialInstanceLabel;
 	}
 });
-Object.defineProperty(exports, "containerPresignEndpointFromEnv", {
-	enumerable: true,
-	get: function() {
-		return containerPresignEndpointFromEnv;
-	}
-});
 Object.defineProperty(exports, "createAssetsStorageClient", {
 	enumerable: true,
 	get: function() {
 		return createAssetsStorageClient;
 	}
 });
-Object.defineProperty(exports, "createStorage", {
+Object.defineProperty(exports, "credentialInputSchema", {
 	enumerable: true,
 	get: function() {
-		return createStorage;
+		return credentialInputSchema;
 	}
 });
-Object.defineProperty(exports, "credentialInputSchema", {
+Object.defineProperty(exports, "defaultHostingPlugin", {
 	enumerable: true,
 	get: function() {
-		return credentialInputSchema;
+		return defaultHostingPlugin;
 	}
 });
 Object.defineProperty(exports, "displayCredentialAppName", {
@@ -3553,12 +3717,6 @@ Object.defineProperty(exports, "minioStoragePlugin", {
 		return minioStoragePlugin;
 	}
 });
-Object.defineProperty(exports, "normalizeOrganizationSidebarBranding", {
-	enumerable: true,
-	get: function() {
-		return normalizeOrganizationSidebarBranding;
-	}
-});
 Object.defineProperty(exports, "normalizeUserPreferences", {
 	enumerable: true,
 	get: function() {
@@ -3589,6 +3747,12 @@ Object.defineProperty(exports, "parseStoredRouteManifest", {
 		return parseStoredRouteManifest;
 	}
 });
+Object.defineProperty(exports, "pingProjectTarget", {
+	enumerable: true,
+	get: function() {
+		return pingProjectTarget;
+	}
+});
 Object.defineProperty(exports, "projectArtifactKey", {
 	enumerable: true,
 	get: function() {
@@ -3619,18 +3783,6 @@ Object.defineProperty(exports, "resolveUniqueCredentialInstanceLabel", {
 		return resolveUniqueCredentialInstanceLabel;
 	}
 });
-Object.defineProperty(exports, "slugifyOrganizationName", {
-	enumerable: true,
-	get: function() {
-		return slugifyOrganizationName;
-	}
-});
-Object.defineProperty(exports, "slugifyProjectName", {
-	enumerable: true,
-	get: function() {
-		return slugifyProjectName;
-	}
-});
 Object.defineProperty(exports, "userAvatarStorageKey", {
 	enumerable: true,
 	get: function() {
@@ -3644,4 +3796,4 @@ Object.defineProperty(exports, "validationErrorResponse", {
 	}
 });
 
-//# sourceMappingURL=dist-COpoWBp6.cjs.map
+//# sourceMappingURL=dist-DvjFaP47.cjs.map