@keystrokehq/platform 0.1.147 → 0.1.148

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keystrokehq/platform",
-  "version": "0.1.147",
+  "version": "0.1.148",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/keystrokehq/keystroke.git",

package/dist/config-DAIUglcc.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-DAIUglcc.mjs","names":[],"sources":["../../../packages/hosting/dist/docker.mjs","../src/config.ts"],"sourcesContent":["import { a as formatDockerEnv, c as resolveRuntimeLaunch, h as resolveWorkerRuntimeConfig, t as waitForHealth } from \"./wait-for-health-CgCfteR7.mjs\";\nimport { mkdir } from \"node:fs/promises\";\n//#region src/docker/create-docker-runtime.ts\nconst MINIO_DOCKER_NETWORK = process.env.MINIO_DOCKER_NETWORK ?? \"keystroke\";\nasync function resolveDocker(options) {\n\tif (options.docker) return options.docker;\n\tconst { default: DockerCtor } = await import(\"dockerode\");\n\treturn new DockerCtor();\n}\nfunction createDockerRuntime(options = {}) {\n\treturn {\n\t\tasync start(input) {\n\t\t\tif (input.projects.length === 0) throw new Error(\"Docker org runtime requires at least one project deploy\");\n\t\t\tconst docker = await resolveDocker(options);\n\t\t\tlet launch = resolveRuntimeLaunch(options, input.projects.map((project) => ({\n\t\t\t\tprojectId: project.projectId,\n\t\t\t\tartifactStorageKey: project.artifactStorageKey,\n\t\t\t\tartifactId: project.artifactId,\n\t\t\t\tartifactVersion: project.artifactVersion\n\t\t\t})), input.database, input.env);\n\t\t\tif (options.workspacesMount) {\n\t\t\t\tconst { hostPath, containerPath } = options.workspacesMount;\n\t\t\t\tawait mkdir(hostPath, { recursive: true });\n\t\t\t\tlaunch = {\n\t\t\t\t\t...launch,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.env,\n\t\t\t\t\t\tKEYSTROKE_WORKSPACES_ROOT: containerPath\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tawait ensureImage(docker, launch.image);\n\t\t\tawait removeExistingContainer(docker, input.organizationId);\n\t\t\tconst binds = [...options.workspacesMount ? [`${options.workspacesMount.hostPath}:${options.workspacesMount.containerPath}`] : [], ...options.extraBinds ?? []];\n\t\t\tconst container = await docker.createContainer({\n\t\t\t\tImage: launch.image,\n\t\t\t\tname: containerName(input.organizationId),\n\t\t\t\tLabels: {\n\t\t\t\t\t\"keystroke.organization.id\": input.organizationId,\n\t\t\t\t\t\"keystroke.project.ids\": input.projects.map((project) => project.projectId).join(\",\")\n\t\t\t\t},\n\t\t\t\tExposedPorts: { [`${launch.port}/tcp`]: {} },\n\t\t\t\tHostConfig: {\n\t\t\t\t\tExtraHosts: [\"host.docker.internal:host-gateway\"],\n\t\t\t\t\tPortBindings: { [`${launch.port}/tcp`]: [{ HostPort: \"0\" }] },\n\t\t\t\t\t...binds.length > 0 ? { Binds: binds } : {}\n\t\t\t\t},\n\t\t\t\tNetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },\n\t\t\t\tEnv: formatDockerEnv(launch.env)\n\t\t\t});\n\t\t\tawait container.start();\n\t\t\tconst inspect = await container.inspect();\n\t\t\tconst binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];\n\t\t\tif (!binding?.HostPort) throw new Error(\"Failed to resolve org container host port\");\n\t\t\tconst baseUrl = `http://127.0.0.1:${binding.HostPort}`;\n\t\t\tawait waitForHealth(baseUrl, {\n\t\t\t\tfetchImpl: options.fetchImpl,\n\t\t\t\ttimeoutMs: options.healthTimeoutMs\n\t\t\t});\n\t\t\treturn {\n\t\t\t\truntimeId: inspect.Id,\n\t\t\t\tbaseUrl\n\t\t\t};\n\t\t},\n\t\tasync destroy(input) {\n\t\t\ttry {\n\t\t\t\tawait (await resolveDocker(options)).getContainer(input.runtimeId).remove({ force: true });\n\t\t\t} catch {}\n\t\t},\n\t\tasync sleep(input) {\n\t\t\tconst container = (await resolveDocker(options)).getContainer(input.runtimeId);\n\t\t\tconst inspect = await container.inspect().catch(() => null);\n\t\t\tif (!inspect) return;\n\t\t\tif (inspect.State.Running) await container.stop({ t: 10 });\n\t\t},\n\t\tasync wake(input) {\n\t\t\tconst container = (await resolveDocker(options)).getContainer(input.runtimeId);\n\t\t\tif (!(await container.inspect()).State.Running) await container.start();\n\t\t\tconst refreshed = await container.inspect();\n\t\t\tconst ports = refreshed.NetworkSettings.Ports ?? {};\n\t\t\tconst binding = Object.values(ports).flat().find((entry) => entry?.HostPort)?.HostPort;\n\t\t\tif (!binding) throw new Error(`Failed to resolve host port for container ${input.runtimeId}`);\n\t\t\tconst baseUrl = `http://127.0.0.1:${binding}`;\n\t\t\tawait waitForHealth(baseUrl, {\n\t\t\t\tfetchImpl: options.fetchImpl,\n\t\t\t\ttimeoutMs: options.healthTimeoutMs\n\t\t\t});\n\t\t\treturn {\n\t\t\t\truntimeId: refreshed.Id,\n\t\t\t\tbaseUrl\n\t\t\t};\n\t\t}\n\t};\n}\nfunction containerName(organizationId) {\n\treturn `keystroke-org-${organizationId}`;\n}\nasync function removeExistingContainer(docker, organizationId) {\n\ttry {\n\t\tconst existing = docker.getContainer(containerName(organizationId));\n\t\tawait existing.stop({ t: 5 }).catch(() => void 0);\n\t\tawait existing.remove({ force: true });\n\t} catch {}\n}\nasync function ensureImage(docker, image) {\n\ttry {\n\t\tawait docker.getImage(image).inspect();\n\t\treturn;\n\t} catch {}\n\tawait new Promise((resolvePromise, reject) => {\n\t\tdocker.pull(image, (error, stream) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!stream) {\n\t\t\t\treject(/* @__PURE__ */ new Error(`Failed to pull image ${image}`));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tdocker.modem.followProgress(stream, (progressError) => {\n\t\t\t\tif (progressError) {\n\t\t\t\t\treject(progressError);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tresolvePromise();\n\t\t\t});\n\t\t});\n\t});\n}\n//#endregion\n//#region src/docker/plugin.ts\nfunction dockerPlugin(options = {}) {\n\tconst env = options.env ?? process.env;\n\treturn {\n\t\tname: \"docker\",\n\t\tworkerRuntime: resolveWorkerRuntimeConfig(env),\n\t\tcreateRuntime: () => createDockerRuntime({\n\t\t\t...options,\n\t\t\tenv\n\t\t})\n\t};\n}\n//#endregion\n//#region src/default-plugin.ts\n/** Local Docker hosting — default for platform and dev. */\nfunction defaultHostingPlugin(options = {}) {\n\treturn dockerPlugin(options);\n}\n//#endregion\nexport { defaultHostingPlugin, dockerPlugin };\n\n//# sourceMappingURL=docker.mjs.map","import type { HostingPlugin } from \"@keystrokehq/hosting\";\nimport { defaultHostingPlugin } from \"@keystrokehq/hosting/docker\";\nimport {\n  defaultSchedulerPlugin,\n  type JobPayload,\n  type SchedulerPlugin,\n} from \"@keystrokehq/scheduler\";\nimport { minioStoragePlugin, type StoragePlugin } from \"@keystrokehq/storage\";\nimport type { ProjectGitProviderPlugin } from \"@keystrokehq/project-git\";\n\nimport type { OrgRateLimit } from \"@keystrokehq/shared\";\n\nimport type { LlmProxyPlugin } from \"./llm-proxy-plugin\";\nimport type { McpProviderPlugin } from \"@keystrokehq/http\";\nimport {\n  createInProcessProjectDraftNotifier,\n  type ProjectDraftNotifier,\n} from \"./services/project-draft-notifier\";\n\nexport type {\n  HostingOptions,\n  HostingPlugin,\n  OrganizationHostingInput,\n  OrganizationHostingResult,\n} from \"@keystrokehq/hosting\";\n\nexport type {\n  OrganizationStorageInput,\n  OrganizationStorageResult,\n  StoragePlugin,\n} from \"@keystrokehq/storage\";\n\nexport type {\n  LlmProxyHandlerContext,\n  LlmProxyPlugin,\n  LlmProxyWorkerEnvContext,\n} from \"./llm-proxy-plugin\";\n\nexport type { McpProviderPlugin } from \"@keystrokehq/http\";\n\nexport type { ProjectGitProviderPlugin } from \"@keystrokehq/project-git\";\n\nexport type { ProjectDraftNotifier } from \"./services/project-draft-notifier\";\nexport {\n  createInProcessProjectDraftNotifier,\n  publishDraftUpdateBestEffort,\n} from \"./services/project-draft-notifier\";\n\n/**\n * Run-scoped disposable Sprite draft command runner. Cloud injects an\n * implementation backed by `@keystroke-cloud/sprites`; OSS omits it.\n * MCP and platform-agent call this later — public platform never imports cloud.\n */\nexport type DraftCommandRunnerPlugin = {\n  run(input: {\n    remote: { url: string; username: string; password: string };\n    commitSha: string;\n    command: string;\n    /**\n     * Optional working directory relative to the disposable checkout root.\n     * Traversal outside the checkout is rejected by the runner.\n     */\n    cwd?: string;\n    /**\n     * Extra env for the caller command only (after credentials are stripped).\n     * Must not be used to restore Git remotes or askpass secrets — the runner\n     * always clears credential channels around the command.\n     */\n    env?: Record<string, string>;\n    timeoutMs?: number;\n    maxOutputBytes?: number;\n    signal?: AbortSignal;\n    spriteName?: string;\n    commitDiff?: (diff: Uint8Array) => Promise<{ commitSha: string }>;\n  }): Promise<{\n    spriteName: string;\n    exitCode: number;\n    output: string;\n    truncated: boolean;\n    diff: Uint8Array;\n    commitSha?: string;\n  }>;\n};\n\nexport type PlatformWorkerEnvContext = {\n  platformUrl: string;\n  /** Per-org worker token for the org being launched. */\n  workerToken: string;\n};\n\nexport type PlatformConfigInput = {\n  /** Defaults to Docker via {@link defaultHostingPlugin}. */\n  hosting?: HostingPlugin;\n  /**\n   * Per-org object storage. Defaults to {@link minioStoragePlugin} (S3 API against local MinIO).\n   * MinIO is the dev default, not AWS S3 — same `@aws-sdk/client-s3` client works for any S3-compatible\n   * backend; hosted platform swaps in a cloud plugin (e.g. Tigris).\n   */\n  storage?: StoragePlugin;\n  /**\n   * Managed LLM gateway proxy. Omit for BYO provider keys or a direct gateway URL on the platform env.\n   */\n  llmProxy?: LlmProxyPlugin;\n  /** Managed universal MCP plugin. Omit when self-hosting without a provider. */\n  mcp?: McpProviderPlugin;\n  /**\n   * Managed project Git provider. Omit for standalone/local mode without Keystroke-managed repos.\n   */\n  projectGit?: ProjectGitProviderPlugin;\n  /**\n   * Disposable Sprite draft command runner. Omit when Sprites are unavailable\n   * (OSS / local without `SPRITES_TOKEN`).\n   */\n  draftCommandRunner?: DraftCommandRunnerPlugin;\n  /**\n   * Transient draft tip fan-out for SSE. Defaults to an in-process notifier\n   * (OSS / single replica). Cloud injects a Redis-backed implementation when\n   * Redis is available so multi-replica platforms share updates.\n   */\n  draftNotifier?: ProjectDraftNotifier;\n  /** Queue backend for platform runtime routes. Defaults to pg-boss (Postgres) or DB polling (SQLite). */\n  scheduler?: SchedulerPlugin;\n  /** Extra env merged into project worker containers at deploy (cloud hosting plugins). */\n  workerEnv?: (ctx: PlatformWorkerEnvContext) => Record<string, string>;\n  /**\n   * Handler for `maintenance` jobs on the platform queue (cloud injects the\n   * billing daily pass). Unset (standalone default) means such jobs — which\n   * only cloud schedules — are ignored.\n   */\n  maintenanceHandler?: (payload: JobPayload) => Promise<void>;\n  /**\n   * Handler for `image-rollout` jobs on the platform queue (cloud Fly fleet).\n   * Unset (standalone default) means such jobs are ignored.\n   */\n  imageRolloutJobHandler?: (payload: JobPayload) => Promise<void>;\n  /**\n   * Cloud-only platform-agent (Build tab) plugin: mounts organization routes and\n   * handles `platform-agent` jobs on the shared platform queue.\n   */\n  platformAgent?: {\n    mountOrgRoutes: (\n      orgScoped: import(\"hono\").Hono<{\n        Variables: import(\"@keystrokehq/http/auth\").OrganizationVariables;\n      }>,\n    ) => void;\n    handleJob: (payload: JobPayload) => Promise<void>;\n    onCancel?: (runId: string) => void;\n  };\n  /**\n   * Pre-enqueue credit check for interactive agent prompts / workflow runs\n   * (cloud injects the billing wallet check). Unset = never blocked.\n   */\n  promptCreditGate?: (\n    organizationId: string,\n  ) => Promise<{ allow: true } | { allow: false; reason: string }>;\n  /**\n   * Max-projects check for `POST /projects` (cloud injects plan quota).\n   * Unset = unlimited (standalone / OSS).\n   */\n  projectQuotaGate?: (\n    organizationId: string,\n  ) => Promise<{ allow: true } | { allow: false; reason: string }>;\n  /** Per-org API/MCP rate limits (cloud injects Redis token bucket). Unset = unlimited. */\n  orgRateLimit?: OrgRateLimit;\n};\n\nexport type PlatformConfig = PlatformConfigInput & {\n  hosting: HostingPlugin;\n  storage: StoragePlugin;\n  scheduler: SchedulerPlugin;\n};\n\nexport function definePlatformConfig(config: PlatformConfigInput = {}): PlatformConfig {\n  return {\n    ...config,\n    hosting: config.hosting ?? defaultHostingPlugin(),\n    storage: config.storage ?? minioStoragePlugin(),\n    scheduler: config.scheduler ?? defaultSchedulerPlugin(),\n    draftNotifier: config.draftNotifier ?? createInProcessProjectDraftNotifier(),\n  };\n}\n"],"mappings":";;;;AAGA,MAAM,uBAAuB,QAAQ,IAAI,wBAAwB;AACjE,eAAe,cAAc,SAAS;CACrC,IAAI,QAAQ,QAAQ,OAAO,QAAQ;CACnC,MAAM,EAAE,SAAS,eAAe,MAAM,OAAO;CAC7C,OAAO,IAAI,WAAW;AACvB;AACA,SAAS,oBAAoB,UAAU,CAAC,GAAG;CAC1C,OAAO;EACN,MAAM,MAAM,OAAO;GAClB,IAAI,MAAM,SAAS,WAAW,GAAG,MAAM,IAAI,MAAM,yDAAyD;GAC1G,MAAM,SAAS,MAAM,cAAc,OAAO;GAC1C,IAAI,SAAS,qBAAqB,SAAS,MAAM,SAAS,KAAK,aAAa;IAC3E,WAAW,QAAQ;IACnB,oBAAoB,QAAQ;IAC5B,YAAY,QAAQ;IACpB,iBAAiB,QAAQ;GAC1B,EAAE,GAAG,MAAM,UAAU,MAAM,GAAG;GAC9B,IAAI,QAAQ,iBAAiB;IAC5B,MAAM,EAAE,UAAU,kBAAkB,QAAQ;IAC5C,MAAM,MAAM,UAAU,EAAE,WAAW,KAAK,CAAC;IACzC,SAAS;KACR,GAAG;KACH,KAAK;MACJ,GAAG,OAAO;MACV,2BAA2B;KAC5B;IACD;GACD;GACA,MAAM,YAAY,QAAQ,OAAO,KAAK;GACtC,MAAM,wBAAwB,QAAQ,MAAM,cAAc;GAC1D,MAAM,QAAQ,CAAC,GAAG,QAAQ,kBAAkB,CAAC,GAAG,QAAQ,gBAAgB,SAAS,GAAG,QAAQ,gBAAgB,eAAe,IAAI,CAAC,GAAG,GAAG,QAAQ,cAAc,CAAC,CAAC;GAC9J,MAAM,YAAY,MAAM,OAAO,gBAAgB;IAC9C,OAAO,OAAO;IACd,MAAM,cAAc,MAAM,cAAc;IACxC,QAAQ;KACP,6BAA6B,MAAM;KACnC,yBAAyB,MAAM,SAAS,KAAK,YAAY,QAAQ,SAAS,EAAE,KAAK,GAAG;IACrF;IACA,cAAc,GAAG,GAAG,OAAO,KAAK,QAAQ,CAAC,EAAE;IAC3C,YAAY;KACX,YAAY,CAAC,mCAAmC;KAChD,cAAc,GAAG,GAAG,OAAO,KAAK,QAAQ,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE;KAC5D,GAAG,MAAM,SAAS,IAAI,EAAE,OAAO,MAAM,IAAI,CAAC;IAC3C;IACA,kBAAkB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,EAAE;IACpE,KAAK,gBAAgB,OAAO,GAAG;GAChC,CAAC;GACD,MAAM,UAAU,MAAM;GACtB,MAAM,UAAU,MAAM,UAAU,QAAQ;GACxC,MAAM,UAAU,QAAQ,gBAAgB,QAAQ,GAAG,OAAO,KAAK,SAAS;GACxE,IAAI,CAAC,SAAS,UAAU,MAAM,IAAI,MAAM,2CAA2C;GACnF,MAAM,UAAU,oBAAoB,QAAQ;GAC5C,MAAM,cAAc,SAAS;IAC5B,WAAW,QAAQ;IACnB,WAAW,QAAQ;GACpB,CAAC;GACD,OAAO;IACN,WAAW,QAAQ;IACnB;GACD;EACD;EACA,MAAM,QAAQ,OAAO;GACpB,IAAI;IACH,OAAO,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,CAAC;GAC1F,QAAQ,CAAC;EACV;EACA,MAAM,MAAM,OAAO;GAClB,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS;GAC7E,MAAM,UAAU,MAAM,UAAU,QAAQ,EAAE,YAAY,IAAI;GAC1D,IAAI,CAAC,SAAS;GACd,IAAI,QAAQ,MAAM,SAAS,MAAM,UAAU,KAAK,EAAE,GAAG,GAAG,CAAC;EAC1D;EACA,MAAM,KAAK,OAAO;GACjB,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS;GAC7E,IAAI,EAAE,MAAM,UAAU,QAAQ,GAAG,MAAM,SAAS,MAAM,UAAU,MAAM;GACtE,MAAM,YAAY,MAAM,UAAU,QAAQ;GAC1C,MAAM,QAAQ,UAAU,gBAAgB,SAAS,CAAC;GAClD,MAAM,UAAU,OAAO,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,GAAG;GAC9E,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,6CAA6C,MAAM,WAAW;GAC5F,MAAM,UAAU,oBAAoB;GACpC,MAAM,cAAc,SAAS;IAC5B,WAAW,QAAQ;IACnB,WAAW,QAAQ;GACpB,CAAC;GACD,OAAO;IACN,WAAW,UAAU;IACrB;GACD;EACD;CACD;AACD;AACA,SAAS,cAAc,gBAAgB;CACtC,OAAO,iBAAiB;AACzB;AACA,eAAe,wBAAwB,QAAQ,gBAAgB;CAC9D,IAAI;EACH,MAAM,WAAW,OAAO,aAAa,cAAc,cAAc,CAAC;EAClE,MAAM,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,KAAK,CAAC;EAChD,MAAM,SAAS,OAAO,EAAE,OAAO,KAAK,CAAC;CACtC,QAAQ,CAAC;AACV;AACA,eAAe,YAAY,QAAQ,OAAO;CACzC,IAAI;EACH,MAAM,OAAO,SAAS,KAAK,EAAE,QAAQ;EACrC;CACD,QAAQ,CAAC;CACT,MAAM,IAAI,SAAS,gBAAgB,WAAW;EAC7C,OAAO,KAAK,QAAQ,OAAO,WAAW;GACrC,IAAI,OAAO;IACV,OAAO,KAAK;IACZ;GACD;GACA,IAAI,CAAC,QAAQ;IACZ,uBAAuB,IAAI,MAAM,wBAAwB,OAAO,CAAC;IACjE;GACD;GACA,OAAO,MAAM,eAAe,SAAS,kBAAkB;IACtD,IAAI,eAAe;KAClB,OAAO,aAAa;KACpB;IACD;IACA,eAAe;GAChB,CAAC;EACF,CAAC;CACF,CAAC;AACF;AAGA,SAAS,aAAa,UAAU,CAAC,GAAG;CACnC,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,OAAO;EACN,MAAM;EACN,eAAe,2BAA2B,GAAG;EAC7C,qBAAqB,oBAAoB;GACxC,GAAG;GACH;EACD,CAAC;CACF;AACD;;AAIA,SAAS,qBAAqB,UAAU,CAAC,GAAG;CAC3C,OAAO,aAAa,OAAO;AAC5B;;;ACyBA,SAAgB,qBAAqB,SAA8B,CAAC,GAAmB;CACrF,OAAO;EACL,GAAG;EACH,SAAS,OAAO,WAAW,qBAAqB;EAChD,SAAS,OAAO,WAAW,mBAAmB;EAC9C,WAAW,OAAO,aAAa,uBAAuB;EACtD,eAAe,OAAO,iBAAiB,oCAAoC;CAC7E;AACF"}

package/dist/config-fUE8OVTA.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-fUE8OVTA.cjs","names":["resolveRuntimeLaunch","formatDockerEnv","waitForHealth","resolveWorkerRuntimeConfig","minioStoragePlugin","defaultSchedulerPlugin","createInProcessProjectDraftNotifier"],"sources":["../../../packages/hosting/dist/docker.mjs","../src/config.ts"],"sourcesContent":["import { a as formatDockerEnv, c as resolveRuntimeLaunch, h as resolveWorkerRuntimeConfig, t as waitForHealth } from \"./wait-for-health-CgCfteR7.mjs\";\nimport { mkdir } from \"node:fs/promises\";\n//#region src/docker/create-docker-runtime.ts\nconst MINIO_DOCKER_NETWORK = process.env.MINIO_DOCKER_NETWORK ?? \"keystroke\";\nasync function resolveDocker(options) {\n\tif (options.docker) return options.docker;\n\tconst { default: DockerCtor } = await import(\"dockerode\");\n\treturn new DockerCtor();\n}\nfunction createDockerRuntime(options = {}) {\n\treturn {\n\t\tasync start(input) {\n\t\t\tif (input.projects.length === 0) throw new Error(\"Docker org runtime requires at least one project deploy\");\n\t\t\tconst docker = await resolveDocker(options);\n\t\t\tlet launch = resolveRuntimeLaunch(options, input.projects.map((project) => ({\n\t\t\t\tprojectId: project.projectId,\n\t\t\t\tartifactStorageKey: project.artifactStorageKey,\n\t\t\t\tartifactId: project.artifactId,\n\t\t\t\tartifactVersion: project.artifactVersion\n\t\t\t})), input.database, input.env);\n\t\t\tif (options.workspacesMount) {\n\t\t\t\tconst { hostPath, containerPath } = options.workspacesMount;\n\t\t\t\tawait mkdir(hostPath, { recursive: true });\n\t\t\t\tlaunch = {\n\t\t\t\t\t...launch,\n\t\t\t\t\tenv: {\n\t\t\t\t\t\t...launch.env,\n\t\t\t\t\t\tKEYSTROKE_WORKSPACES_ROOT: containerPath\n\t\t\t\t\t}\n\t\t\t\t};\n\t\t\t}\n\t\t\tawait ensureImage(docker, launch.image);\n\t\t\tawait removeExistingContainer(docker, input.organizationId);\n\t\t\tconst binds = [...options.workspacesMount ? [`${options.workspacesMount.hostPath}:${options.workspacesMount.containerPath}`] : [], ...options.extraBinds ?? []];\n\t\t\tconst container = await docker.createContainer({\n\t\t\t\tImage: launch.image,\n\t\t\t\tname: containerName(input.organizationId),\n\t\t\t\tLabels: {\n\t\t\t\t\t\"keystroke.organization.id\": input.organizationId,\n\t\t\t\t\t\"keystroke.project.ids\": input.projects.map((project) => project.projectId).join(\",\")\n\t\t\t\t},\n\t\t\t\tExposedPorts: { [`${launch.port}/tcp`]: {} },\n\t\t\t\tHostConfig: {\n\t\t\t\t\tExtraHosts: [\"host.docker.internal:host-gateway\"],\n\t\t\t\t\tPortBindings: { [`${launch.port}/tcp`]: [{ HostPort: \"0\" }] },\n\t\t\t\t\t...binds.length > 0 ? { Binds: binds } : {}\n\t\t\t\t},\n\t\t\t\tNetworkingConfig: { EndpointsConfig: { [MINIO_DOCKER_NETWORK]: {} } },\n\t\t\t\tEnv: formatDockerEnv(launch.env)\n\t\t\t});\n\t\t\tawait container.start();\n\t\t\tconst inspect = await container.inspect();\n\t\t\tconst binding = inspect.NetworkSettings.Ports?.[`${launch.port}/tcp`]?.[0];\n\t\t\tif (!binding?.HostPort) throw new Error(\"Failed to resolve org container host port\");\n\t\t\tconst baseUrl = `http://127.0.0.1:${binding.HostPort}`;\n\t\t\tawait waitForHealth(baseUrl, {\n\t\t\t\tfetchImpl: options.fetchImpl,\n\t\t\t\ttimeoutMs: options.healthTimeoutMs\n\t\t\t});\n\t\t\treturn {\n\t\t\t\truntimeId: inspect.Id,\n\t\t\t\tbaseUrl\n\t\t\t};\n\t\t},\n\t\tasync destroy(input) {\n\t\t\ttry {\n\t\t\t\tawait (await resolveDocker(options)).getContainer(input.runtimeId).remove({ force: true });\n\t\t\t} catch {}\n\t\t},\n\t\tasync sleep(input) {\n\t\t\tconst container = (await resolveDocker(options)).getContainer(input.runtimeId);\n\t\t\tconst inspect = await container.inspect().catch(() => null);\n\t\t\tif (!inspect) return;\n\t\t\tif (inspect.State.Running) await container.stop({ t: 10 });\n\t\t},\n\t\tasync wake(input) {\n\t\t\tconst container = (await resolveDocker(options)).getContainer(input.runtimeId);\n\t\t\tif (!(await container.inspect()).State.Running) await container.start();\n\t\t\tconst refreshed = await container.inspect();\n\t\t\tconst ports = refreshed.NetworkSettings.Ports ?? {};\n\t\t\tconst binding = Object.values(ports).flat().find((entry) => entry?.HostPort)?.HostPort;\n\t\t\tif (!binding) throw new Error(`Failed to resolve host port for container ${input.runtimeId}`);\n\t\t\tconst baseUrl = `http://127.0.0.1:${binding}`;\n\t\t\tawait waitForHealth(baseUrl, {\n\t\t\t\tfetchImpl: options.fetchImpl,\n\t\t\t\ttimeoutMs: options.healthTimeoutMs\n\t\t\t});\n\t\t\treturn {\n\t\t\t\truntimeId: refreshed.Id,\n\t\t\t\tbaseUrl\n\t\t\t};\n\t\t}\n\t};\n}\nfunction containerName(organizationId) {\n\treturn `keystroke-org-${organizationId}`;\n}\nasync function removeExistingContainer(docker, organizationId) {\n\ttry {\n\t\tconst existing = docker.getContainer(containerName(organizationId));\n\t\tawait existing.stop({ t: 5 }).catch(() => void 0);\n\t\tawait existing.remove({ force: true });\n\t} catch {}\n}\nasync function ensureImage(docker, image) {\n\ttry {\n\t\tawait docker.getImage(image).inspect();\n\t\treturn;\n\t} catch {}\n\tawait new Promise((resolvePromise, reject) => {\n\t\tdocker.pull(image, (error, stream) => {\n\t\t\tif (error) {\n\t\t\t\treject(error);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (!stream) {\n\t\t\t\treject(/* @__PURE__ */ new Error(`Failed to pull image ${image}`));\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tdocker.modem.followProgress(stream, (progressError) => {\n\t\t\t\tif (progressError) {\n\t\t\t\t\treject(progressError);\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tresolvePromise();\n\t\t\t});\n\t\t});\n\t});\n}\n//#endregion\n//#region src/docker/plugin.ts\nfunction dockerPlugin(options = {}) {\n\tconst env = options.env ?? process.env;\n\treturn {\n\t\tname: \"docker\",\n\t\tworkerRuntime: resolveWorkerRuntimeConfig(env),\n\t\tcreateRuntime: () => createDockerRuntime({\n\t\t\t...options,\n\t\t\tenv\n\t\t})\n\t};\n}\n//#endregion\n//#region src/default-plugin.ts\n/** Local Docker hosting — default for platform and dev. */\nfunction defaultHostingPlugin(options = {}) {\n\treturn dockerPlugin(options);\n}\n//#endregion\nexport { defaultHostingPlugin, dockerPlugin };\n\n//# sourceMappingURL=docker.mjs.map","import type { HostingPlugin } from \"@keystrokehq/hosting\";\nimport { defaultHostingPlugin } from \"@keystrokehq/hosting/docker\";\nimport {\n  defaultSchedulerPlugin,\n  type JobPayload,\n  type SchedulerPlugin,\n} from \"@keystrokehq/scheduler\";\nimport { minioStoragePlugin, type StoragePlugin } from \"@keystrokehq/storage\";\nimport type { ProjectGitProviderPlugin } from \"@keystrokehq/project-git\";\n\nimport type { OrgRateLimit } from \"@keystrokehq/shared\";\n\nimport type { LlmProxyPlugin } from \"./llm-proxy-plugin\";\nimport type { McpProviderPlugin } from \"@keystrokehq/http\";\nimport {\n  createInProcessProjectDraftNotifier,\n  type ProjectDraftNotifier,\n} from \"./services/project-draft-notifier\";\n\nexport type {\n  HostingOptions,\n  HostingPlugin,\n  OrganizationHostingInput,\n  OrganizationHostingResult,\n} from \"@keystrokehq/hosting\";\n\nexport type {\n  OrganizationStorageInput,\n  OrganizationStorageResult,\n  StoragePlugin,\n} from \"@keystrokehq/storage\";\n\nexport type {\n  LlmProxyHandlerContext,\n  LlmProxyPlugin,\n  LlmProxyWorkerEnvContext,\n} from \"./llm-proxy-plugin\";\n\nexport type { McpProviderPlugin } from \"@keystrokehq/http\";\n\nexport type { ProjectGitProviderPlugin } from \"@keystrokehq/project-git\";\n\nexport type { ProjectDraftNotifier } from \"./services/project-draft-notifier\";\nexport {\n  createInProcessProjectDraftNotifier,\n  publishDraftUpdateBestEffort,\n} from \"./services/project-draft-notifier\";\n\n/**\n * Run-scoped disposable Sprite draft command runner. Cloud injects an\n * implementation backed by `@keystroke-cloud/sprites`; OSS omits it.\n * MCP and platform-agent call this later — public platform never imports cloud.\n */\nexport type DraftCommandRunnerPlugin = {\n  run(input: {\n    remote: { url: string; username: string; password: string };\n    commitSha: string;\n    command: string;\n    /**\n     * Optional working directory relative to the disposable checkout root.\n     * Traversal outside the checkout is rejected by the runner.\n     */\n    cwd?: string;\n    /**\n     * Extra env for the caller command only (after credentials are stripped).\n     * Must not be used to restore Git remotes or askpass secrets — the runner\n     * always clears credential channels around the command.\n     */\n    env?: Record<string, string>;\n    timeoutMs?: number;\n    maxOutputBytes?: number;\n    signal?: AbortSignal;\n    spriteName?: string;\n    commitDiff?: (diff: Uint8Array) => Promise<{ commitSha: string }>;\n  }): Promise<{\n    spriteName: string;\n    exitCode: number;\n    output: string;\n    truncated: boolean;\n    diff: Uint8Array;\n    commitSha?: string;\n  }>;\n};\n\nexport type PlatformWorkerEnvContext = {\n  platformUrl: string;\n  /** Per-org worker token for the org being launched. */\n  workerToken: string;\n};\n\nexport type PlatformConfigInput = {\n  /** Defaults to Docker via {@link defaultHostingPlugin}. */\n  hosting?: HostingPlugin;\n  /**\n   * Per-org object storage. Defaults to {@link minioStoragePlugin} (S3 API against local MinIO).\n   * MinIO is the dev default, not AWS S3 — same `@aws-sdk/client-s3` client works for any S3-compatible\n   * backend; hosted platform swaps in a cloud plugin (e.g. Tigris).\n   */\n  storage?: StoragePlugin;\n  /**\n   * Managed LLM gateway proxy. Omit for BYO provider keys or a direct gateway URL on the platform env.\n   */\n  llmProxy?: LlmProxyPlugin;\n  /** Managed universal MCP plugin. Omit when self-hosting without a provider. */\n  mcp?: McpProviderPlugin;\n  /**\n   * Managed project Git provider. Omit for standalone/local mode without Keystroke-managed repos.\n   */\n  projectGit?: ProjectGitProviderPlugin;\n  /**\n   * Disposable Sprite draft command runner. Omit when Sprites are unavailable\n   * (OSS / local without `SPRITES_TOKEN`).\n   */\n  draftCommandRunner?: DraftCommandRunnerPlugin;\n  /**\n   * Transient draft tip fan-out for SSE. Defaults to an in-process notifier\n   * (OSS / single replica). Cloud injects a Redis-backed implementation when\n   * Redis is available so multi-replica platforms share updates.\n   */\n  draftNotifier?: ProjectDraftNotifier;\n  /** Queue backend for platform runtime routes. Defaults to pg-boss (Postgres) or DB polling (SQLite). */\n  scheduler?: SchedulerPlugin;\n  /** Extra env merged into project worker containers at deploy (cloud hosting plugins). */\n  workerEnv?: (ctx: PlatformWorkerEnvContext) => Record<string, string>;\n  /**\n   * Handler for `maintenance` jobs on the platform queue (cloud injects the\n   * billing daily pass). Unset (standalone default) means such jobs — which\n   * only cloud schedules — are ignored.\n   */\n  maintenanceHandler?: (payload: JobPayload) => Promise<void>;\n  /**\n   * Handler for `image-rollout` jobs on the platform queue (cloud Fly fleet).\n   * Unset (standalone default) means such jobs are ignored.\n   */\n  imageRolloutJobHandler?: (payload: JobPayload) => Promise<void>;\n  /**\n   * Cloud-only platform-agent (Build tab) plugin: mounts organization routes and\n   * handles `platform-agent` jobs on the shared platform queue.\n   */\n  platformAgent?: {\n    mountOrgRoutes: (\n      orgScoped: import(\"hono\").Hono<{\n        Variables: import(\"@keystrokehq/http/auth\").OrganizationVariables;\n      }>,\n    ) => void;\n    handleJob: (payload: JobPayload) => Promise<void>;\n    onCancel?: (runId: string) => void;\n  };\n  /**\n   * Pre-enqueue credit check for interactive agent prompts / workflow runs\n   * (cloud injects the billing wallet check). Unset = never blocked.\n   */\n  promptCreditGate?: (\n    organizationId: string,\n  ) => Promise<{ allow: true } | { allow: false; reason: string }>;\n  /**\n   * Max-projects check for `POST /projects` (cloud injects plan quota).\n   * Unset = unlimited (standalone / OSS).\n   */\n  projectQuotaGate?: (\n    organizationId: string,\n  ) => Promise<{ allow: true } | { allow: false; reason: string }>;\n  /** Per-org API/MCP rate limits (cloud injects Redis token bucket). Unset = unlimited. */\n  orgRateLimit?: OrgRateLimit;\n};\n\nexport type PlatformConfig = PlatformConfigInput & {\n  hosting: HostingPlugin;\n  storage: StoragePlugin;\n  scheduler: SchedulerPlugin;\n};\n\nexport function definePlatformConfig(config: PlatformConfigInput = {}): PlatformConfig {\n  return {\n    ...config,\n    hosting: config.hosting ?? defaultHostingPlugin(),\n    storage: config.storage ?? minioStoragePlugin(),\n    scheduler: config.scheduler ?? defaultSchedulerPlugin(),\n    draftNotifier: config.draftNotifier ?? createInProcessProjectDraftNotifier(),\n  };\n}\n"],"mappings":";;;;AAGA,MAAM,uBAAuB,QAAQ,IAAI,wBAAwB;AACjE,eAAe,cAAc,SAAS;CACrC,IAAI,QAAQ,QAAQ,OAAO,QAAQ;CACnC,MAAM,EAAE,SAAS,eAAe,MAAM,OAAO;CAC7C,OAAO,IAAI,WAAW;AACvB;AACA,SAAS,oBAAoB,UAAU,CAAC,GAAG;CAC1C,OAAO;EACN,MAAM,MAAM,OAAO;GAClB,IAAI,MAAM,SAAS,WAAW,GAAG,MAAM,IAAI,MAAM,yDAAyD;GAC1G,MAAM,SAAS,MAAM,cAAc,OAAO;GAC1C,IAAI,SAASA,+BAAAA,qBAAqB,SAAS,MAAM,SAAS,KAAK,aAAa;IAC3E,WAAW,QAAQ;IACnB,oBAAoB,QAAQ;IAC5B,YAAY,QAAQ;IACpB,iBAAiB,QAAQ;GAC1B,EAAE,GAAG,MAAM,UAAU,MAAM,GAAG;GAC9B,IAAI,QAAQ,iBAAiB;IAC5B,MAAM,EAAE,UAAU,kBAAkB,QAAQ;IAC5C,OAAA,GAAA,iBAAA,OAAY,UAAU,EAAE,WAAW,KAAK,CAAC;IACzC,SAAS;KACR,GAAG;KACH,KAAK;MACJ,GAAG,OAAO;MACV,2BAA2B;KAC5B;IACD;GACD;GACA,MAAM,YAAY,QAAQ,OAAO,KAAK;GACtC,MAAM,wBAAwB,QAAQ,MAAM,cAAc;GAC1D,MAAM,QAAQ,CAAC,GAAG,QAAQ,kBAAkB,CAAC,GAAG,QAAQ,gBAAgB,SAAS,GAAG,QAAQ,gBAAgB,eAAe,IAAI,CAAC,GAAG,GAAG,QAAQ,cAAc,CAAC,CAAC;GAC9J,MAAM,YAAY,MAAM,OAAO,gBAAgB;IAC9C,OAAO,OAAO;IACd,MAAM,cAAc,MAAM,cAAc;IACxC,QAAQ;KACP,6BAA6B,MAAM;KACnC,yBAAyB,MAAM,SAAS,KAAK,YAAY,QAAQ,SAAS,EAAE,KAAK,GAAG;IACrF;IACA,cAAc,GAAG,GAAG,OAAO,KAAK,QAAQ,CAAC,EAAE;IAC3C,YAAY;KACX,YAAY,CAAC,mCAAmC;KAChD,cAAc,GAAG,GAAG,OAAO,KAAK,QAAQ,CAAC,EAAE,UAAU,IAAI,CAAC,EAAE;KAC5D,GAAG,MAAM,SAAS,IAAI,EAAE,OAAO,MAAM,IAAI,CAAC;IAC3C;IACA,kBAAkB,EAAE,iBAAiB,GAAG,uBAAuB,CAAC,EAAE,EAAE;IACpE,KAAKC,+BAAAA,gBAAgB,OAAO,GAAG;GAChC,CAAC;GACD,MAAM,UAAU,MAAM;GACtB,MAAM,UAAU,MAAM,UAAU,QAAQ;GACxC,MAAM,UAAU,QAAQ,gBAAgB,QAAQ,GAAG,OAAO,KAAK,SAAS;GACxE,IAAI,CAAC,SAAS,UAAU,MAAM,IAAI,MAAM,2CAA2C;GACnF,MAAM,UAAU,oBAAoB,QAAQ;GAC5C,MAAMC,+BAAAA,cAAc,SAAS;IAC5B,WAAW,QAAQ;IACnB,WAAW,QAAQ;GACpB,CAAC;GACD,OAAO;IACN,WAAW,QAAQ;IACnB;GACD;EACD;EACA,MAAM,QAAQ,OAAO;GACpB,IAAI;IACH,OAAO,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS,EAAE,OAAO,EAAE,OAAO,KAAK,CAAC;GAC1F,QAAQ,CAAC;EACV;EACA,MAAM,MAAM,OAAO;GAClB,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS;GAC7E,MAAM,UAAU,MAAM,UAAU,QAAQ,EAAE,YAAY,IAAI;GAC1D,IAAI,CAAC,SAAS;GACd,IAAI,QAAQ,MAAM,SAAS,MAAM,UAAU,KAAK,EAAE,GAAG,GAAG,CAAC;EAC1D;EACA,MAAM,KAAK,OAAO;GACjB,MAAM,aAAa,MAAM,cAAc,OAAO,GAAG,aAAa,MAAM,SAAS;GAC7E,IAAI,EAAE,MAAM,UAAU,QAAQ,GAAG,MAAM,SAAS,MAAM,UAAU,MAAM;GACtE,MAAM,YAAY,MAAM,UAAU,QAAQ;GAC1C,MAAM,QAAQ,UAAU,gBAAgB,SAAS,CAAC;GAClD,MAAM,UAAU,OAAO,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,OAAO,QAAQ,GAAG;GAC9E,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,6CAA6C,MAAM,WAAW;GAC5F,MAAM,UAAU,oBAAoB;GACpC,MAAMA,+BAAAA,cAAc,SAAS;IAC5B,WAAW,QAAQ;IACnB,WAAW,QAAQ;GACpB,CAAC;GACD,OAAO;IACN,WAAW,UAAU;IACrB;GACD;EACD;CACD;AACD;AACA,SAAS,cAAc,gBAAgB;CACtC,OAAO,iBAAiB;AACzB;AACA,eAAe,wBAAwB,QAAQ,gBAAgB;CAC9D,IAAI;EACH,MAAM,WAAW,OAAO,aAAa,cAAc,cAAc,CAAC;EAClE,MAAM,SAAS,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,YAAY,KAAK,CAAC;EAChD,MAAM,SAAS,OAAO,EAAE,OAAO,KAAK,CAAC;CACtC,QAAQ,CAAC;AACV;AACA,eAAe,YAAY,QAAQ,OAAO;CACzC,IAAI;EACH,MAAM,OAAO,SAAS,KAAK,EAAE,QAAQ;EACrC;CACD,QAAQ,CAAC;CACT,MAAM,IAAI,SAAS,gBAAgB,WAAW;EAC7C,OAAO,KAAK,QAAQ,OAAO,WAAW;GACrC,IAAI,OAAO;IACV,OAAO,KAAK;IACZ;GACD;GACA,IAAI,CAAC,QAAQ;IACZ,uBAAuB,IAAI,MAAM,wBAAwB,OAAO,CAAC;IACjE;GACD;GACA,OAAO,MAAM,eAAe,SAAS,kBAAkB;IACtD,IAAI,eAAe;KAClB,OAAO,aAAa;KACpB;IACD;IACA,eAAe;GAChB,CAAC;EACF,CAAC;CACF,CAAC;AACF;AAGA,SAAS,aAAa,UAAU,CAAC,GAAG;CACnC,MAAM,MAAM,QAAQ,OAAO,QAAQ;CACnC,OAAO;EACN,MAAM;EACN,eAAeC,+BAAAA,2BAA2B,GAAG;EAC7C,qBAAqB,oBAAoB;GACxC,GAAG;GACH;EACD,CAAC;CACF;AACD;;AAIA,SAAS,qBAAqB,UAAU,CAAC,GAAG;CAC3C,OAAO,aAAa,OAAO;AAC5B;;;ACyBA,SAAgB,qBAAqB,SAA8B,CAAC,GAAmB;CACrF,OAAO;EACL,GAAG;EACH,SAAS,OAAO,WAAW,qBAAqB;EAChD,SAAS,OAAO,WAAWC,+BAAAA,mBAAmB;EAC9C,WAAW,OAAO,aAAaC,aAAAA,uBAAuB;EACtD,eAAe,OAAO,iBAAiBC,+BAAAA,oCAAoC;CAC7E;AACF"}