@domesystems/templates 0.3.7 → 0.4.0

package/README.md

@@ -34,7 +34,7 @@ templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry
 templates publish [--dry-run] [--server <URL>|--registry <URL>]
 ```
 
-`pull` only accepts scoped package names, verifies the Registry SHA-256 before extraction, accepts only the archive's `template/` root, writes `.dome-template-lock.yaml`, and never overwrites a non-empty directory. `generate` reads `catalog` in `template.yaml` and writes a `dome.tf` with the matching Gateway, connections, model pool, agent, Rules, Guards, quotas, and runtime key. Generated model pools are non-default so templates can be installed into workspaces that already have a default pool. It never replaces an existing file unless you pass `--force`; review the generated Terraform before importing it. `up` is local-only and never downloads or updates a release. When it provisions an unconfigured runtime, it reveals the import's one-time agent token, resolves the workspace default Gateway, and writes only `DOME_TOKEN` and `DOME_GATEWAY_URL` to the ignored `.env` before starting Docker. Pass `--debug` to enable safe runtime diagnostics for that Compose run; it logs outbound Dome endpoint, status/outcome, and timing but not secrets or request content. `publish` reads the scoped name and SemVer version from `template.yaml`, requires a clean Git checkout, and cannot replace a published version.
+`pull` only accepts scoped package names, verifies the Registry SHA-256 before extraction, accepts only the archive's `template/` root, writes `.dome-template-lock.yaml`, and never overwrites a non-empty directory. `generate` reads `catalog` in `template.yaml` and writes a `dome.tf` with the matching Gateway, connections, model pool, agent, Rules, Guards, quotas, and runtime key. Generated model pools are non-default so templates can be installed into workspaces that already have a default pool. It never replaces an existing file unless you pass `--force`; review the generated Terraform before importing it. `up` is local-only and never downloads or updates a release. When it provisions an unconfigured runtime, it reveals the import's one-time agent token, resolves the workspace default Gateway, and writes only `DOME_TOKEN` and `DOME_GATEWAY_URL` to the ignored `.env` before refreshing the configured runtime image and starting Docker. Pass `--debug` to enable safe runtime diagnostics for that Compose run; it logs outbound Dome endpoint, status/outcome, and timing but not secrets or request content. `publish` reads the scoped name and SemVer version from `template.yaml`, requires a clean Git checkout, and cannot replace a published version.
 
 ## Publishing from a GitHub organization
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@domesystems/templates",
-  "version": "0.3.7",
+  "version": "0.4.0",
   "description": "Pull, publish, and run versioned Dome templates.",
   "repository": {
     "type": "git",

package/src/cli.mjs

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { spawn, spawnSync } from "node:child_process";
+import { parse as parseYAML } from "yaml";
 import { readManifest, readPublishManifest } from "./manifest.mjs";
 import { generateDomeTerraform } from "./generate.mjs";
 import { imageForRuntime, renderCompose } from "./runtime.mjs";
@@ -10,15 +11,15 @@ import { DEFAULT_REGISTRY, clearSelectedTarget, deleteProfile, directRegistry, d
 
 function ansi(code, value, options) { return options.color && process.stdout.isTTY ? `\u001B[${code}m${value}\u001B[0m` : value; }
 function line(kind, value, options) { const styles = { info: ["•", "36"], success: ["✓", "32"], warning: ["!", "33"], error: ["✗", "31"] }; const [mark, code] = styles[kind]; return `${ansi(code, mark, options)} ${value}`; }
-function usage() { return "Usage:\n  templates login [--server <Dome application URL>|--registry <Registry URL>] [--github]\n  templates logout [--server <Dome application URL>|--registry <Registry URL>]\n  templates doctor <pull|up|publish> [package] [--dir <directory>] [--server <URL>|--registry <URL>] [--json]\n  templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>|--registry <URL>]\n  templates generate [--dir <directory>] [--output <file>] [--force]\n  templates up [--dir <directory>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach] [--debug] [--verbose]\n  templates publish [--dir <directory>] [--dry-run] [--server <Dome application URL>|--registry <Registry URL>]\n"; }
+function usage() { return "Usage:\n  templates login [--server <Dome application URL>|--registry <Registry URL>] [--github]\n  templates logout [--server <Dome application URL>|--registry <Registry URL>]\n  templates doctor <pull|up|publish> [package] [--dir <directory>] [--server <URL>|--registry <URL>] [--json]\n  templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>|--registry <URL>]\n  templates generate [--dir <directory>] [--output <file>] [--force]\n  templates up [--dir <directory>] [--agent <agent-name>] [--port <host-port>] [--server <URL>|--registry <URL>] [--import-job <job-id>] [--skip-provision|--provision] [--no-start] [--detach] [--debug] [--verbose]\n  templates publish [--dir <directory>] [--dry-run] [--server <Dome application URL>|--registry <Registry URL>]\n"; }
 function parse(argv) {
   if (!argv.length || argv.includes("--help") || argv.includes("-h")) return { help: true };
   const [command, ...rest] = argv;
-  const options = { server: undefined, directory: undefined, output: "dome.tf", force: false, port: 3000, dryRun: false, json: false, github: false, importJob: undefined, provision: true, forceProvision: false, start: true, detach: false, debug: false, verbose: false, color: !process.env.NO_COLOR };
+  const options = { server: undefined, directory: undefined, output: "dome.tf", force: false, port: 3000, dryRun: false, json: false, github: false, importJob: undefined, agent: undefined, provision: true, forceProvision: false, start: true, detach: false, debug: false, verbose: false, color: !process.env.NO_COLOR };
   const values = [];
   for (let i = 0; i < rest.length; i += 1) {
     const arg = rest[i];
-    if (arg === "--server" || arg === "--registry" || arg === "--dir" || arg === "--output" || arg === "--port" || arg === "--color" || arg === "--import-job") { const value = rest[++i]; if (!value) throw new Error(`${arg} requires a value.`); if (arg === "--server") options.server = normalizeServer(value); else if (arg === "--registry") options.registry = normalizeServer(value); else if (arg === "--dir") options.directory = value; else if (arg === "--output") options.output = value; else if (arg === "--import-job") options.importJob = value; else if (arg === "--color") { if (!["auto", "always", "never"].includes(value)) throw new Error("--color must be auto, always, or never."); options.color = value === "always" || (value === "auto" && !process.env.NO_COLOR); } else { options.port = Number(value); if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) throw new Error("--port requires an integer from 1 to 65535."); } }
+    if (arg === "--server" || arg === "--registry" || arg === "--dir" || arg === "--output" || arg === "--port" || arg === "--color" || arg === "--import-job" || arg === "--agent") { const value = rest[++i]; if (!value) throw new Error(`${arg} requires a value.`); if (arg === "--server") options.server = normalizeServer(value); else if (arg === "--registry") options.registry = normalizeServer(value); else if (arg === "--dir") options.directory = value; else if (arg === "--output") options.output = value; else if (arg === "--import-job") options.importJob = value; else if (arg === "--agent") options.agent = value; else if (arg === "--color") { if (!["auto", "always", "never"].includes(value)) throw new Error("--color must be auto, always, or never."); options.color = value === "always" || (value === "auto" && !process.env.NO_COLOR); } else { options.port = Number(value); if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) throw new Error("--port requires an integer from 1 to 65535."); } }
     else if (arg === "--github") options.github = true; else if (arg === "--dry-run") options.dryRun = true; else if (arg === "--json") options.json = true; else if (arg === "--force") options.force = true; else if (arg === "--skip-provision") options.provision = false; else if (arg === "--provision") options.forceProvision = true; else if (arg === "--no-start") options.start = false; else if (arg === "--detach") options.detach = true; else if (arg === "--debug") options.debug = true; else if (arg === "--verbose") options.verbose = true; else if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`); else values.push(arg);
   }
   if (options.server && options.registry) throw new Error("Use either --server or --registry, not both.");
@@ -59,7 +60,29 @@ function generate(options, output) {
   const file = generateDomeTerraform(target, { output: options.output, force: options.force, manifest });
   output(line("success", `Generated ${file}`, options));
 }
+function runtimeFor(directory, manifest, selectedAgent) {
+  const candidates = selectedAgent ? manifest.agents.filter((agent) => agent.name === selectedAgent) : manifest.agents.filter((agent) => agent.type === "external");
+  if (candidates.length !== 1) throw new Error(`templates up requires exactly one external agent; found ${candidates.length}. Pass --agent <name> to select one.`);
+  const agent = candidates[0];
+  if (agent.type !== "external") throw new Error(`templates up cannot start managed agent ${agent.name}; Dome runs its loop.`);
+  const configPath = path.join("agents", agent.name);
+  const configFile = path.join(directory, configPath, "agent.yaml");
+  if (!fs.existsSync(configFile)) throw new Error(`External agent ${agent.name} needs ${configPath}/agent.yaml.`);
+  const runner = parseYAML(fs.readFileSync(configFile, "utf8"))?.runner;
+  if (!runner?.pattern || !runner?.language) throw new Error(`${configPath}/agent.yaml needs runner.pattern and runner.language.`);
+  const keys = agent.keys ?? [];
+  const key = keys.find((candidate) => candidate.name === "local") ?? (keys.length === 1 ? keys[0] : null);
+  if (!key) throw new Error(`External agent ${agent.name} needs exactly one key or a key named local for templates up.`);
+  return { ...agent, runtime: runner, configPath, localKey: key.name };
+}
 function run(command, args, cwd) { const result = spawnSync(command, args, { cwd, stdio: "inherit" }); if (result.error || result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed.`); }
+export function composeCommands({ detach = false } = {}) {
+  const prefix = ["compose", "-f", ".dome-compose.yaml"];
+  return {
+    pull: [...prefix, "pull"],
+    up: [...prefix, "up", ...(detach ? ["--detach"] : [])],
+  };
+}
 function json(text, command) { try { return JSON.parse(text.slice(text.indexOf("{"))); } catch { throw new Error(`${command} did not return valid JSON.`); } }
 function runJSON(command, args, cwd, { reveal = false } = {}) {
   return new Promise((resolve, reject) => {
@@ -87,8 +110,27 @@ function configured(target) { const env = path.join(target, ".env"); return fs.e
 export function importMadeNoChanges(job) { const summary = job?.plan_summary ?? job?.planSummary; if (!summary) return false; return ["create_count", "update_count", "import_count"].every((key) => Number(summary[key] ?? summary[key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase())] ?? 0) === 0); }
 export function importHasPendingOutputs(job) { return (job?.outputs_state ?? job?.outputsState) === "pending"; }
 export function importCreatedResources(job) { const summary = job?.plan_summary ?? job?.planSummary; return Number(summary?.create_count ?? summary?.createCount ?? 0) > 0; }
-async function configureRuntime(target, jobID, options, output) { const gateways = await runJSON("dome", ["gateways", "list", "--json"], target); const gatewayURL = gateways?.data?.gateways?.find((candidate) => candidate.is_default)?.endpoints?.gateway_url; if (!gatewayURL) throw new Error("The import did not configure a default Gateway for the runtime."); const revealed = await runJSON("dome", ["import", "outputs", jobID, "--json"], target); const tokens = Object.entries(revealed?.data?.outputs ?? {}).filter(([key, value]) => key.endsWith("_token") && typeof value === "string"); if (tokens.length !== 1) throw new Error("The import did not produce exactly one runtime agent token."); writeRuntimeEnvironment(target, { DOME_TOKEN: tokens[0][1], DOME_GATEWAY_URL: gatewayURL }); output(line("success", "Configured the runtime with the imported agent credentials.", options)); }
-async function up(options, output) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readManifest(target); const needsCredentials = !configured(target); output(line("info", `Checking ${target}`, options)); fs.writeFileSync(path.join(target, ".dome-compose.yaml"), renderCompose(manifest.app.runtime, options.port, { debug: options.debug })); if (options.importJob) { output(line("info", "Saving credentials from the selected Dome import", options)); await configureRuntime(target, options.importJob, options, output); } else if (options.provision && (needsCredentials || options.forceProvision)) { output(line("info", "Setting up Dome resources", options)); let imported; try { imported = await runJSON("dome", ["import", "dome.tf", "--json"], target); } catch (caught) { const dashboardURL = importDashboardURL(target); const details = dashboardURL ? ` View the import details: ${dashboardURL}` : ""; throw new Error(`${caught.message}${details}`); } const job = imported?.data?.job; if (!job?.id) throw new Error("Dome import did not return a job ID."); if (importCreatedResources(job) && importHasPendingOutputs(job)) await configureRuntime(target, job.id, options, output); else if (needsCredentials) throw new Error(`Dome matched existing resources and did not create a new runtime token. Recover a pending import with templates up --dir ${options.directory ?? "."} --import-job <job-id>, or rotate the runtime key and set DOME_TOKEN and DOME_GATEWAY_URL in .env.`); else output(line("success", "Dome resources are already up to date; keeping the existing runtime credentials.", options)); } if (options.start) { output(line("info", `Starting app at http://localhost:${options.port}`, options)); run("docker", ["compose", "-f", ".dome-compose.yaml", "up", ...(options.detach ? ["--detach"] : [])], target); } }
+async function configureRuntime(target, jobID, agentName, keyName, options, output) { const gateways = await runJSON("dome", ["gateways", "list", "--json"], target); const gatewayURL = gateways?.data?.gateways?.find((candidate) => candidate.is_default)?.endpoints?.gateway_url; if (!gatewayURL) throw new Error("The import did not configure a default Gateway for the runtime."); const revealed = await runJSON("dome", ["import", "outputs", jobID, "--json"], target); const tokenKey = `${agentName.replace(/[^A-Za-z0-9_]/g, "_").replace(/^[^A-Za-z_]/, "_")}_${keyName.replace(/[^A-Za-z0-9_]/g, "_").replace(/^[^A-Za-z_]/, "_")}_token`; const token = revealed?.data?.outputs?.[tokenKey]; if (typeof token !== "string") throw new Error(`The import did not produce the ${keyName} key for ${agentName}.`); writeRuntimeEnvironment(target, { DOME_TOKEN: token, DOME_GATEWAY_URL: gatewayURL }); output(line("success", `Configured the ${agentName} runtime with its imported credentials.`, options)); }
+async function up(options, output) {
+  const target = path.resolve(process.cwd(), options.directory ?? ".");
+  const manifest = readManifest(target);
+  const runtimeAgent = runtimeFor(target, manifest, options.agent);
+  const needsCredentials = !configured(target);
+  output(line("info", `Checking ${target}`, options));
+  fs.writeFileSync(path.join(target, ".dome-compose.yaml"), renderCompose(runtimeAgent.runtime, options.port, { debug: options.debug, configPath: runtimeAgent.configPath }));
+  if (options.importJob) await configureRuntime(target, options.importJob, runtimeAgent.name, runtimeAgent.localKey, options, output);
+  else if (options.provision && (needsCredentials || options.forceProvision)) {
+    output(line("info", "Setting up Dome resources", options));
+    let imported;
+    try { imported = await runJSON("dome", ["import", "dome.tf", "--json"], target); }
+    catch (caught) { const dashboardURL = importDashboardURL(target); throw new Error(`${caught.message}${dashboardURL ? ` View the import details: ${dashboardURL}` : ""}`); }
+    const job = imported?.data?.job;
+    if (!job?.id) throw new Error("Dome import did not return a job ID.");
+    if (importCreatedResources(job) && importHasPendingOutputs(job)) await configureRuntime(target, job.id, runtimeAgent.name, runtimeAgent.localKey, options, output);
+    else if (needsCredentials) throw new Error(`Dome matched existing resources and did not create a new runtime token. Recover a pending import with templates up --dir ${options.directory ?? "."} --import-job <job-id>, or rotate the local agent key and set DOME_TOKEN and DOME_GATEWAY_URL in .env.`);
+  }
+  if (options.start) { const compose = composeCommands(options); run("docker", compose.pull, target); run("docker", compose.up, target); }
+}
 async function publish(options, output, fetchImplementation) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readPublishManifest(target); const source = publishSource(target); const name = manifest.metadata.name; const [scope, slug] = name.split("/"); const archive = options.dryRun ? null : createArchive(source); output(line("info", `Checking ${name}@${manifest.metadata.version}`, options)); const payload = { name, version: manifest.metadata.version, title: manifest.metadata.title, summary: manifest.metadata.summary ?? "", sha256: archive?.sha256, size_bytes: archive?.buffer.length, source: { repository: manifest.metadata.source.repository, path: manifest.metadata.source.path, commit: source.commit, remote: source.remote, files: source.files } };
   const remote = remoteTarget(options); let registry; let attempt;
   try { ({ target: registry, body: attempt } = await registryRequest(remote, "/v1/publish-attempts", { method: "POST", body: { ...payload, dry_run: options.dryRun }, authenticated: true, fetchImplementation })); } catch (caught) {

package/src/generate.mjs

@@ -8,213 +8,121 @@ const label = (value) => {
 };
 const q = (value) => JSON.stringify(String(value));
 const attr = (name, value) => `${name.padEnd(19)} = ${value}`;
-const block = (type, name, body) => `resource ${q(type)} ${q(name)} {\n${body.map((line) => `  ${line}`).join("\n")}\n}`;
-const variable = (name) => `variable ${q(name)} {\n  type      = string\n  sensitive = true\n}`;
-const nameFor = (prefix, value) => `${prefix}_${label(value)}`;
+const block = (type, name, body) => `resource ${q(type)} ${q(name)} {\n${body.map((line) => line === "" ? "" : `  ${line}`).join("\n")}\n}`;
+const required = (object, key, message) => { if (object?.[key] === undefined || object[key] === "") throw new Error(message); return object[key]; };
+const expression = (value) => typeof value === "string" && /^(var|dome_[a-z_]+\.)[A-Za-z0-9_.]+$/.test(value) ? value : q(value);
 
-function required(object, key, message) {
-  if (!object?.[key]) throw new Error(message);
-  return object[key];
-}
-
-function secretVariable(secret) {
-  return secret?.variable ? label(secret.variable) : null;
-}
-
-function connectionBlocks(connection, gatewayLabel, variables) {
-  const connectionLabel = label(required(connection, "name", "Every catalog connection needs a name."));
-  const auth = connection.auth ?? { method: "none" };
-  const lines = [
-    attr("workspace_id", "var.workspace_id"),
-    attr("name", q(connection.name)),
-    attr("protocol", q(required(connection, "protocol", `Connection ${connection.name} needs a protocol.`))),
-    attr("url", q(required(connection, "url", `Connection ${connection.name} needs a URL.`))),
-    attr("auth_method", q(auth.method)),
-  ];
-  if (auth.credential) lines.push(attr("credential_type", q(auth.credential)));
-  if (auth.oauth) {
-    const oauth = Object.entries(auth.oauth).map(([key, value]) => {
-      const destination = key === "scopes" ? "default_scopes" : key;
-      return `${destination} = ${Array.isArray(value) ? `[${value.map(q).join(", ")}]` : q(value)}`;
-    });
-    lines.push(`oauth = { ${oauth.join(", ")} }`);
-  }
-  const secret = auth.secret;
-  if (secretVariable(secret)) {
-    const key = auth.header ?? "Authorization";
-    variables.add(secretVariable(secret));
-    lines.push(attr("secret_values", `{ ${q(key)} = var.${secretVariable(secret)} }`));
-  }
-  const output = [block("dome_mcp_connection", connectionLabel, lines)];
-  for (const tool of [...(connection.permit ?? []), ...(connection.forbid ?? [])]) {
-    output.push(block("dome_gateway_tool", nameFor(connectionLabel, tool), [
-      attr("workspace_id", "var.workspace_id"),
-      attr("gateway", `dome_gateway.${gatewayLabel}.name`),
-      attr("mcp_connection", `dome_mcp_connection.${connectionLabel}.name`),
-      attr("tool", q(tool)),
-    ]));
-  }
-  return output;
-}
-
-function modelBlocks(model, pool, gatewayLabel, variables) {
-  const modelLabel = label(required(model, "name", "catalog.model needs a name."));
-  const poolLabel = label(required(pool, "name", "catalog.pool needs a name."));
-  const secret = model.secret;
-  const modelLines = [
-    attr("workspace_id", "var.workspace_id"),
-    attr("name", q(model.name)),
-    attr("provider_id", q(required(model, "provider", "catalog.model needs a provider."))),
-    attr("provider_config", `jsonencode({ model = ${q(required(model, "model_id", "catalog.model needs a model_id."))} })`),
-  ];
-  if (secretVariable(secret)) {
-    const variableName = secretVariable(secret);
-    // Dome shared API-key credentials are stored against the provider's
-    // managed header.  Its default is x-api-key; Authorization is not a
-    // substitute and is rejected by the Management API.
-    const secretHeader = model.secret_header ?? "x-api-key";
-    variables.add(variableName);
-    modelLines.push(
-      attr("auth_method", q("api-key")),
-      attr("credential_type", q("shared")),
-      attr("managed_header_name", q(secretHeader)),
-      attr("secret_values", `{ ${q(secretHeader)} = var.${variableName} }`),
-    );
-  }
-  return [
-    block("dome_llm_connection", modelLabel, modelLines),
-    block("dome_llm_pool", poolLabel, [
-      attr("workspace_id", "var.workspace_id"),
-      attr("name", q(pool.name)),
-      // Generated templates must coexist with any pool already installed in
-      // the target workspace.  A workspace permits only one default pool, so
-      // never make a reusable template's pool the default during provisioning.
-      attr("is_default", "false"),
-    ]),
-    block("dome_llm_pool_member", modelLabel, [
-      attr("workspace_id", "var.workspace_id"),
-      attr("pool", `dome_llm_pool.${poolLabel}.name`),
-      attr("llm_connection", `dome_llm_connection.${modelLabel}.name`),
-    ]),
-    block("dome_gateway_llm_pool", poolLabel, [
-      attr("workspace_id", "var.workspace_id"),
-      attr("gateway", `dome_gateway.${gatewayLabel}.name`),
-      attr("llm_pool", `dome_llm_pool.${poolLabel}.name`),
-    ]),
-  ];
+function variableBlocks(variables) {
+  return Object.entries(variables).map(([name, definition]) => {
+    const value = definition && typeof definition === "object" ? definition : {};
+    return `variable ${q(name)} {\n  type      = string${value.sensitive ? "\n  sensitive = true" : ""}\n}`;
+  });
 }
 
-function rulesBlock(root, rules, agentLabel) {
-  if (!rules?.file) return [];
-  const file = path.resolve(root, rules.file);
-  if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`Rules file not found: ${rules.file}.`);
-  const filename = path.basename(rules.file);
-  const contents = fs.readFileSync(file, "utf8").trimEnd();
-  return [block("dome_agent_rules_bundle", agentLabel, [
-    attr("workspace_id", "var.workspace_id"),
-    attr("agent", `dome_agent.${agentLabel}.name`),
-    "files = {",
-    `  ${q(filename)} = <<-CEDAR`,
-    ...contents.split("\n").map((line) => `  ${line}`),
-    "  CEDAR",
-    "}",
-  ])];
+function rulesBlock(agent, resourceType, agentLabel) {
+  const files = agent.rules?.files;
+  if (!files || !Object.keys(files).length) return [];
+  const body = [attr("workspace_id", "var.workspace_id"), attr("agent", `${resourceType}.${agentLabel}.name`), "files = {"];
+  for (const [name, file] of Object.entries(files)) body.push(`  ${q(name)} = <<-CEDAR`, ...file.content.split("\n").map((line) => line.trimEnd() ? `  ${line.trimEnd()}` : ""), "  CEDAR");
+  body.push("}");
+  return [block("dome_agent_rules_bundle", agentLabel, body)];
 }
 
-function guardBlocks(root, guards, refs) {
-  const filters = guards?.filters ?? [];
+function filterBlocks(filters) {
   const blocks = [];
   const bindings = new Map();
   for (const filter of filters) {
-    const filterLabel = label(required(filter, "name", "Every Guard filter needs a name."));
-    let config;
-    if (filter.redact_ssn) config = "jsonencode({ text = { components = [{ action = \"FILTER_ACTION_REDACT\", matchers = [{ ssn = {} }] }] } })";
-    else if (filter.config) {
-      const file = path.resolve(root, filter.config);
-      if (!fs.statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`Guard config not found: ${filter.config}.`);
-      config = `jsonencode(jsondecode(<<-JSON\n${fs.readFileSync(file, "utf8").trimEnd()}\nJSON\n))`;
-    } else throw new Error(`Guard ${filter.name} needs config or redact_ssn.`);
-    blocks.push(block("dome_filter", filterLabel, [attr("workspace_id", "var.workspace_id"), attr("name", q(filter.name)), attr("description", q(filter.description ?? filter.name)), attr("config", config)]));
-    const binding = required(filter, "bind", `Guard ${filter.name} needs a bind target.`);
-    const kind = binding.model ? "model" : binding.tool ? "tool" : null;
-    if (!kind) throw new Error(`Guard ${filter.name} must bind to a model or tool.`);
-    const target = kind === "model" ? label(binding.model) : label(binding.tool);
-    const key = `${kind}:${target}:${binding.direction ?? "request"}`;
-    bindings.set(key, [...(bindings.get(key) ?? []), filterLabel]);
+    const filterLabel = label(required(filter, "name", "Every filter needs a name."));
+    if (!filter.config || typeof filter.config !== "object") throw new Error(`Filter ${filter.name} needs config.`);
+    blocks.push(block("dome_filter", filterLabel, [attr("workspace_id", "var.workspace_id"), attr("name", q(filter.name)), attr("description", q(filter.description ?? filter.name)), attr("config", `jsonencode(${JSON.stringify(filter.config)})`)]));
+    for (const binding of filter.bindings ?? []) {
+      const kind = binding.llm_connection ? "llm" : binding.tool_connection ? "tool" : null;
+      if (!kind) throw new Error(`Filter ${filter.name} bindings must name llm_connection or tool_connection.`);
+      const connection = binding.llm_connection ?? binding.tool_connection;
+      const direction = binding.direction ?? "request";
+      const key = `${kind}:${connection}:${direction}`;
+      bindings.set(key, [...(bindings.get(key) ?? []), filterLabel]);
+    }
   }
-  for (const [key, filterLabels] of bindings) {
-    const [kind, target, direction] = key.split(":");
-    const resource = kind === "model" ? "dome_llm_connection_filters" : "dome_mcp_connection_filters";
-    const attribute = kind === "model" ? "llm_connection" : "mcp_connection";
-    blocks.push(block(resource, `${target}_${direction}`, [
-      attr("workspace_id", "var.workspace_id"),
-      attr(attribute, `${kind === "model" ? "dome_llm_connection" : "dome_mcp_connection"}.${target}.name`),
-      attr("direction", q(direction)),
-      attr("filters", `[${filterLabels.map((item) => `dome_filter.${item}.name`).join(", ")}]`),
-    ]));
+  for (const [key, names] of bindings) {
+    const [kind, connection, direction] = key.split(":");
+    const resource = kind === "llm" ? "dome_llm_connection_filters" : "dome_mcp_connection_filters";
+    const attribute = kind === "llm" ? "llm_connection" : "mcp_connection";
+    const target = kind === "llm" ? "dome_llm_connection" : "dome_mcp_connection";
+    blocks.push(block(resource, `${label(connection)}_${direction}`, [attr("workspace_id", "var.workspace_id"), attr(attribute, `${target}.${label(connection)}.name`), attr("direction", q(direction)), attr("filters", `[${names.map((name) => `dome_filter.${name}.name`).join(", ")}]`)]));
   }
   return blocks;
 }
 
-function quotaBlocks(quotas, refs) {
-  return (quotas ?? []).map((quota) => {
-    const subject = required(quota, "subject", "Every quota needs a subject.");
-    const target = subject === "agent" ? quota.agent : subject === "model" ? quota.model : quota.connection ?? String(quota.tool ?? "").split("/")[0];
-    if (!target) throw new Error(`Quota ${quota.name ?? ""} needs a target.`);
-    const resource = subject === "agent" ? "dome_agent" : subject === "model" ? "dome_llm_connection" : "dome_mcp_connection";
-    const type = subject === "agent" ? "agent" : subject === "model" ? "model" : "tool_connection";
-    const amount = quota.unit === "dome_usd" ? Math.round(Number(quota.limit) * 1_000_000) : Number(quota.limit);
-    if (!Number.isFinite(amount)) throw new Error(`Quota ${quota.name ?? ""} needs a numeric limit.`);
-    return block("dome_quota", label(quota.name ?? `${subject}_${target}`), [
-      attr("workspace_id", "var.workspace_id"),
-      attr("dimension", q(type === "tool_connection" ? "tool" : "llm")),
-      attr("unit", q(required(quota, "unit", "Every quota needs a unit."))),
-      attr("subject_type", q(type)),
-      attr("subject", `${resource}.${label(target)}.name`),
-      attr("scope", q(quota.per_caller ? "per_caller" : "total")),
-      attr("window", q(required(quota, "window", "Every quota needs a window."))),
-      attr("limit_amount", String(amount)),
-      attr("name", q(required(quota, "name", "Every quota needs a name."))),
-    ]);
+function quotaBlocks(quotas, agents) {
+  return quotas.map((quota) => {
+    const subjectType = required(quota, "subject_type", "Every quota needs subject_type.");
+    const subject = required(quota, "subject", "Every quota needs subject.");
+    const resource = subjectType === "agent" ? (agents.get(subject) === "managed" ? "dome_managed_agent" : "dome_agent") : subjectType === "tool_connection" ? "dome_mcp_connection" : subjectType === "model" ? "dome_llm_connection" : null;
+    if (!resource) throw new Error(`Quota ${quota.name ?? ""} has unsupported subject_type ${subjectType}.`);
+    return block("dome_quota", label(required(quota, "name", "Every quota needs a name.")), [attr("workspace_id", "var.workspace_id"), attr("dimension", q(required(quota, "dimension", "Every quota needs dimension."))), attr("unit", q(required(quota, "unit", "Every quota needs unit."))), attr("subject_type", q(subjectType)), attr("subject", `${resource}.${label(subject)}.name`), attr("scope", q(quota.scope ?? "total")), attr("window", q(required(quota, "window", "Every quota needs window."))), attr("limit_amount", String(required(quota, "limit_amount", "Every quota needs limit_amount."))), attr("name", q(quota.name))]);
   });
 }
 
-export function renderDomeTerraform(manifest, root) {
-  const catalog = required(manifest, "catalog", "template.yaml must declare catalog to generate dome.tf.");
-  const gateway = required(catalog, "gateway", "catalog.gateway is required to generate dome.tf.");
-  const agent = required(catalog, "agent", "catalog.agent is required to generate dome.tf.");
-  const gatewayLabel = label(required(gateway, "name", "catalog.gateway needs a name."));
-  const agentLabel = label(required(agent, "name", "catalog.agent needs a name."));
-  const variables = new Set();
-  const blocks = [
-    block("dome_gateway", gatewayLabel, [
-      attr("workspace_id", "var.workspace_id"), attr("name", q(gateway.name)),
-      ...(gateway.description ? [attr("description", q(gateway.description))] : []), attr("is_default", String(Boolean(gateway.default))),
-    ]),
-    ...(catalog.connections ?? []).flatMap((connection) => connectionBlocks(connection, gatewayLabel, variables)),
-  ];
-  if (catalog.model || catalog.pool) {
-    if (!catalog.model || !catalog.pool) throw new Error("catalog.model and catalog.pool must be declared together.");
-    blocks.push(...modelBlocks(catalog.model, catalog.pool, gatewayLabel, variables));
+export function renderDomeTerraform(manifest) {
+  if (!manifest.gateways.length) throw new Error("template.yaml must declare at least one gateway.");
+  const blocks = [];
+  for (const gateway of manifest.gateways) {
+    const gatewayLabel = label(gateway.name);
+    blocks.push(block("dome_gateway", gatewayLabel, [attr("workspace_id", "var.workspace_id"), attr("name", q(required(gateway, "name", "Every gateway needs a name."))), ...(gateway.description ? [attr("description", q(gateway.description))] : []), attr("is_default", String(Boolean(gateway.is_default)))]));
+    for (const group of gateway.tools ?? []) for (const tool of group.tools ?? []) blocks.push(block("dome_gateway_tool", `${gatewayLabel}_${label(group.tool_connection)}_${label(tool)}`, [attr("workspace_id", "var.workspace_id"), attr("gateway", `dome_gateway.${gatewayLabel}.name`), attr("mcp_connection", `dome_mcp_connection.${label(required(group, "tool_connection", "Gateway tools need tool_connection."))}.name`), attr("tool", q(tool))]));
+    for (const pool of gateway.pools ?? []) blocks.push(block("dome_gateway_llm_pool", `${gatewayLabel}_${label(pool)}`, [attr("workspace_id", "var.workspace_id"), attr("gateway", `dome_gateway.${gatewayLabel}.name`), attr("llm_pool", `dome_llm_pool.${label(pool)}.name`)]));
+  }
+  for (const connection of manifest.tool_connections) {
+    const auth = connection.auth_method ?? "none";
+    const lines = [attr("workspace_id", "var.workspace_id"), attr("name", q(connection.name)), attr("protocol", q(required(connection, "protocol", `Tool connection ${connection.name} needs protocol.`))), attr("url", q(required(connection, "url", `Tool connection ${connection.name} needs url.`))), attr("auth_method", q(auth)), attr("credential_type", q(connection.credential_type ?? (auth === "none" ? "none" : "shared")))];
+    if (connection.managed_header_name) lines.push(attr("managed_header_name", q(connection.managed_header_name)));
+    if (connection.secret_values) lines.push(attr("secret_values", `{ ${Object.entries(connection.secret_values).map(([key, value]) => `${q(key)} = ${expression(value)}`).join(", ")} }`));
+    if (connection.oauth) lines.push(attr("oauth", `jsonencode(${JSON.stringify(connection.oauth)})`));
+    blocks.push(block("dome_mcp_connection", label(connection.name), lines));
+  }
+  for (const model of manifest.models) {
+    const lines = [attr("workspace_id", "var.workspace_id"), attr("name", q(model.name)), attr("provider_id", q(required(model, "provider_id", `Model ${model.name} needs provider_id.`))), attr("provider_config", `jsonencode(${JSON.stringify(required(model, "provider_config", `Model ${model.name} needs provider_config.`))})`)];
+    for (const key of ["auth_method", "credential_type", "managed_header_name"]) if (model[key]) lines.push(attr(key, q(model[key])));
+    if (model.secret_values) lines.push(attr("secret_values", `{ ${Object.entries(model.secret_values).map(([key, value]) => `${q(key)} = ${expression(value)}`).join(", ")} }`));
+    blocks.push(block("dome_llm_connection", label(model.name), lines));
+  }
+  for (const pool of manifest.pools) {
+    const poolLabel = label(pool.name);
+    blocks.push(block("dome_llm_pool", poolLabel, [attr("workspace_id", "var.workspace_id"), attr("name", q(pool.name)), attr("is_default", String(Boolean(pool.is_default)))]));
+    for (const member of pool.members ?? []) blocks.push(block("dome_llm_pool_member", `${poolLabel}_${label(member)}`, [attr("workspace_id", "var.workspace_id"), attr("pool", `dome_llm_pool.${poolLabel}.name`), attr("llm_connection", `dome_llm_connection.${label(member)}.name`)]));
   }
-  const actAs = agent.act_as;
-  const agentLines = [attr("workspace_id", "var.workspace_id"), attr("name", q(agent.name)), attr("allowed_gateways", `[dome_gateway.${gatewayLabel}.name]`)];
-  if (actAs?.method && actAs.method !== "none") {
-    agentLines.push(attr("act_as", `{ method = ${q(actAs.method)}, required = ${String(Boolean(actAs.required))} }`));
-    if (actAs.secret) { const variableName = label(actAs.secret); variables.add(variableName); agentLines.push(attr("act_as_hmac_secret", `var.${variableName}`)); }
-    if (actAs.allowed_subjects) agentLines.push(attr("actas_allowed_subjects", `[${actAs.allowed_subjects.map(q).join(", ")}]`));
+  for (const agent of manifest.agents) {
+    const agentLabel = label(agent.name); const managed = agent.type === "managed"; const resourceType = managed ? "dome_managed_agent" : "dome_agent";
+    const lines = [attr("workspace_id", "var.workspace_id"), attr("name", q(agent.name)), attr("allowed_gateways", `[${(agent.allowed_gateways ?? []).map((gateway) => `dome_gateway.${label(gateway)}.name`).join(", ")}]`)];
+    if (!managed && agent.act_as) {
+      const { method, required: actAsRequired, hmac_secret: hmacSecret, allowed_subjects: allowedSubjects } = agent.act_as;
+      if (!method) throw new Error(`Agent ${agent.name} act_as needs method.`);
+      lines.push(attr("act_as", `{ method = ${q(method)}, required = ${Boolean(actAsRequired)} }`));
+      if (hmacSecret) lines.push(attr("act_as_hmac_secret", expression(hmacSecret)));
+      if (allowedSubjects) lines.push(attr("actas_allowed_subjects", `[${allowedSubjects.map(q).join(", ")}]`));
+    }
+    if (managed) {
+      if (!agent.system_prompt?.path || !agent.default_model) throw new Error(`Managed agent ${agent.name} needs system_prompt.path and default_model.`);
+      lines.push(attr("system_prompt", `file("${'${path.module}'}/${agent.system_prompt.path}")`), attr("default_model", `dome_llm_pool.${label(agent.default_model)}.name`));
+      const trigger = agent.trigger ?? {}; const config = { ...(trigger.manual === undefined ? {} : { manual: { enabled: Boolean(trigger.manual) } }), ...(trigger.webhook === undefined ? {} : { webhook: { enabled: Boolean(trigger.webhook) } }), ...(trigger.schedule ? { schedule: trigger.schedule } : {}) };
+      if (Object.keys(config).length) lines.push(attr("trigger_config", `jsonencode(${JSON.stringify(config)})`));
+    }
+    blocks.push(block(resourceType, agentLabel, lines), ...rulesBlock(agent, resourceType, agentLabel));
+    if (!managed) for (const key of agent.keys ?? []) blocks.push(block("dome_agent_key", `${agentLabel}_${label(required(key, "name", `Agent ${agent.name} keys need a name.`))}`, [attr("workspace_id", "var.workspace_id"), attr("agent", `dome_agent.${agentLabel}.name`), attr("name", q(key.name))]));
   }
-  blocks.push(block("dome_agent", agentLabel, agentLines), ...rulesBlock(root, catalog.rules, agentLabel), ...guardBlocks(root, catalog.guards, {}), ...quotaBlocks(catalog.quotas, {}));
-  blocks.push(block("dome_agent_key", "runtime", [attr("workspace_id", "var.workspace_id"), attr("agent", `dome_agent.${agentLabel}.name`), attr("name", q("runtime"))]));
-  const header = `terraform {\n  required_providers {\n    dome = { source = ${q("dome-systems/dome")}, version = ${q(">= 0.1.0")} }\n  }\n}\n\nvariable "workspace_id" { type = string }`;
-  const secretDeclarations = [...variables].sort().map(variable).join("\n\n");
-  const output = `output ${q(`${agentLabel}_token`)} {\n  value     = dome_agent_key.runtime.token\n  sensitive = true\n}`;
-  return [header, secretDeclarations, blocks.join("\n\n"), output].filter(Boolean).join("\n\n") + "\n";
+  blocks.push(...filterBlocks(manifest.filters), ...quotaBlocks(manifest.quotas, new Map(manifest.agents.map((agent) => [agent.name, agent.type]))));
+  const header = `# Generated by @domesystems/templates from template.yaml. Do not edit.\nterraform {\n  required_providers {\n    dome = { source = ${q("dome-systems/dome")}, version = ${q(">= 0.1.0")} }\n  }\n}\n\nvariable "workspace_id" { type = string }`;
+  const outputs = manifest.agents.filter((agent) => agent.type === "external").flatMap((agent) => (agent.keys ?? []).map((key) => {
+    const agentLabel = label(agent.name); const keyLabel = label(key.name);
+    return `output ${q(`${agentLabel}_${keyLabel}_token`)} {\n  value     = dome_agent_key.${agentLabel}_${keyLabel}.token\n  sensitive = true\n}`;
+  }));
+  return [header, variableBlocks(manifest.variables).join("\n\n"), blocks.join("\n\n"), outputs.join("\n\n")].filter(Boolean).join("\n\n") + "\n";
 }
 
 export function generateDomeTerraform(directory, { output = "dome.tf", force = false, manifest }) {
   const target = path.resolve(directory, output);
   if (fs.existsSync(target) && !force) throw new Error(`${target} already exists. Use --force to replace it.`);
-  fs.writeFileSync(target, renderDomeTerraform(manifest, directory));
+  fs.writeFileSync(target, renderDomeTerraform(manifest));
   return target;
 }

package/src/manifest.mjs

@@ -2,23 +2,99 @@ import fs from "node:fs";
 import path from "node:path";
 import { parseDocument } from "yaml";
 
-export function readManifest(templateDirectory) {
-  const manifestPath = path.join(templateDirectory, "template.yaml");
-  if (!fs.statSync(manifestPath, { throwIfNoEntry: false })?.isFile()) {
-    throw new Error(`No template.yaml found in ${templateDirectory}.`);
-  }
+function parseYAML(file, label) {
+  const document = parseDocument(fs.readFileSync(file, "utf8"));
+  if (document.errors.length) throw new Error(`Invalid ${label}: ${document.errors.map((error) => error.message).join("; ")}`);
+  return document.toJS() ?? {};
+}
+
+function sourcePath(root, reference, label) {
+  if (typeof reference !== "string" || !reference.trim()) throw new Error(`${label} path must be a non-empty string.`);
+  const target = path.resolve(root, reference);
+  if (target !== root && !target.startsWith(`${root}${path.sep}`)) throw new Error(`${label} path must stay inside the template directory.`);
+  if (!fs.statSync(target, { throwIfNoEntry: false })?.isFile()) throw new Error(`${label} path does not exist: ${reference}.`);
+  return target;
+}
+
+function expandAgent(root, entry, index) {
+  if (!entry || typeof entry !== "object") throw new Error(`agents[${index}] must be an object or path.`);
+  if (entry.path === undefined) return entry;
+  if (Object.keys(entry).length !== 1) throw new Error(`agents[${index}] cannot combine path with other fields.`);
+  const agent = parseYAML(sourcePath(root, entry.path, `agents[${index}]`), `agent fragment ${entry.path}`);
+  if (!agent || typeof agent !== "object" || Array.isArray(agent)) throw new Error(`Agent fragment ${entry.path} must be an object.`);
+  return agent;
+}
+
+function expandFilters(root, filters) {
+  if (filters === undefined) return [];
+  if (!Array.isArray(filters)) throw new Error("filters must be a list.");
+  return filters.flatMap((entry, index) => {
+    if (!entry || typeof entry !== "object") throw new Error(`filters[${index}] must be an object or path.`);
+    if (entry.path === undefined) return [entry];
+    if (Object.keys(entry).length !== 1) throw new Error(`filters[${index}] cannot combine path with other fields.`);
+    const parsed = parseYAML(sourcePath(root, entry.path, `filters[${index}]`), `filter fragment ${entry.path}`);
+    const items = Array.isArray(parsed) ? parsed : parsed.filters;
+    if (!Array.isArray(items)) throw new Error(`filters[${index}] fragment must contain a filters list.`);
+    return items;
+  });
+}
 
-  const document = parseDocument(fs.readFileSync(manifestPath, "utf8"));
-  if (document.errors.length) {
-    throw new Error(`Invalid template.yaml: ${document.errors.map((error) => error.message).join("; ")}`);
+function normalizeFilterConfigs(root, filters) {
+  return filters.map((filter, index) => {
+    if (!filter?.config?.path) return filter;
+    if (Object.keys(filter.config).length !== 1) throw new Error(`filters[${index}].config cannot combine path with other fields.`);
+    const file = sourcePath(root, filter.config.path, `filters[${index}].config`);
+    try {
+      return { ...filter, config: JSON.parse(fs.readFileSync(file, "utf8")) };
+    } catch (error) {
+      throw new Error(`filters[${index}].config path must contain JSON: ${error.message}`);
+    }
+  });
+}
+
+function normalizeRuleFiles(root, agent, index) {
+  const files = agent.rules?.files;
+  if (files === undefined) return agent;
+  if (!files || typeof files !== "object" || Array.isArray(files)) throw new Error(`agents[${index}].rules.files must be a filename map.`);
+  const normalized = {};
+  for (const [name, source] of Object.entries(files)) {
+    if (!source || typeof source !== "object" || Array.isArray(source)) throw new Error(`agents[${index}].rules.files.${name} must declare path or inline.`);
+    const hasPath = typeof source.path === "string";
+    const hasInline = typeof source.inline === "string";
+    if (hasPath === hasInline) throw new Error(`agents[${index}].rules.files.${name} must declare exactly one of path or inline.`);
+    normalized[name] = hasPath ? { content: fs.readFileSync(sourcePath(root, source.path, `agents[${index}].rules.files.${name}`), "utf8"), source: source.path } : { content: source.inline, source: "inline" };
   }
+  return { ...agent, rules: { ...agent.rules, files: normalized } };
+}
 
-  const manifest = document.toJS() ?? {};
-  const runtime = manifest.app?.runtime;
-  if (!runtime?.pattern || !runtime?.language) {
-    throw new Error("template.yaml must declare app.runtime.pattern and app.runtime.language.");
+function named(items, label) {
+  const names = new Set();
+  for (const item of items ?? []) {
+    if (typeof item?.name !== "string" || !item.name.trim()) throw new Error(`${label} entries need a name.`);
+    if (names.has(item.name)) throw new Error(`${label} names must be unique; ${item.name} appears more than once.`);
+    names.add(item.name);
   }
-  return manifest;
+}
+
+export function readManifest(templateDirectory) {
+  const root = path.resolve(templateDirectory);
+  const manifestPath = path.join(root, "template.yaml");
+  if (!fs.statSync(manifestPath, { throwIfNoEntry: false })?.isFile()) throw new Error(`No template.yaml found in ${templateDirectory}.`);
+  const manifest = parseYAML(manifestPath, "template.yaml");
+  if (manifest.apiVersion !== "templates.domesystems.ai/v1" || manifest.kind !== "Template") throw new Error("template.yaml must declare apiVersion templates.domesystems.ai/v1 and kind Template.");
+  if (!Array.isArray(manifest.agents) || manifest.agents.length === 0) throw new Error("template.yaml must declare at least one agent.");
+  const agents = manifest.agents.map((entry, index) => {
+    const agent = normalizeRuleFiles(root, expandAgent(root, entry, index), index);
+    if (typeof agent.name !== "string" || !agent.name.trim()) throw new Error(`agents[${index}].name is required.`);
+    const type = agent.type;
+    if (!type) throw new Error(`agents[${index}].type is required.`);
+    if (!["external", "managed"].includes(type)) throw new Error(`agents[${index}].type must be external or managed.`);
+    if (type === "managed" && agent.keys?.length) throw new Error(`agents[${index}] is managed and cannot declare keys.`);
+    return { ...agent, type };
+  });
+  const filters = normalizeFilterConfigs(root, expandFilters(root, manifest.filters));
+  named(agents, "agents"); named(manifest.gateways ?? [], "gateways"); named(manifest.tool_connections ?? [], "tool_connections"); named(manifest.models ?? [], "models"); named(manifest.pools ?? [], "pools"); named(filters, "filters");
+  return { ...manifest, variables: manifest.variables ?? {}, gateways: manifest.gateways ?? [], tool_connections: manifest.tool_connections ?? [], models: manifest.models ?? [], pools: manifest.pools ?? [], filters, quotas: manifest.quotas ?? [], agents };
 }
 
 const PACKAGE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
@@ -26,30 +102,11 @@ const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.
 
 export function readPublishManifest(templateDirectory) {
   const manifest = readManifest(templateDirectory);
-  if (manifest.apiVersion !== "templates.domesystems.ai/v1" || manifest.kind !== "Template") {
-    throw new Error("template.yaml must declare apiVersion templates.domesystems.ai/v1 and kind Template.");
-  }
   const metadata = manifest.metadata ?? {};
-  if (!PACKAGE_NAME.test(metadata.name ?? "")) {
-    throw new Error("template.yaml metadata.name must be a lowercase scoped name such as im2nguyen/tinyfish.");
-  }
-  if (!VERSION.test(metadata.version ?? "")) {
-    throw new Error("template.yaml metadata.version must be a valid SemVer version.");
-  }
-  if (typeof metadata.title !== "string" || !metadata.title.trim()) {
-    throw new Error("template.yaml metadata.title is required to publish a template.");
-  }
+  if (!PACKAGE_NAME.test(metadata.name ?? "")) throw new Error("template.yaml metadata.name must be a lowercase scoped name such as im2nguyen/tinyfish.");
+  if (!VERSION.test(metadata.version ?? "")) throw new Error("template.yaml metadata.version must be a valid SemVer version.");
+  if (typeof metadata.title !== "string" || !metadata.title.trim()) throw new Error("template.yaml metadata.title is required to publish a template.");
   const source = metadata.source;
-  if (!source || typeof source.repository !== "string" || typeof source.path !== "string" || !source.path.trim()) {
-    throw new Error("template.yaml metadata.source.repository and metadata.source.path are required to publish a template.");
-  }
-  let repository;
-  try { repository = new URL(source.repository); } catch { throw new Error("metadata.source.repository must be a GitHub HTTPS URL."); }
-  if (repository.protocol !== "https:" || repository.hostname !== "github.com" || !/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/?$/.test(repository.pathname)) {
-    throw new Error("metadata.source.repository must be a public https://github.com/<owner>/<repository> URL.");
-  }
-  if (source.path.split(/[\\/]+/).some((part) => !part || part === "." || part === "..")) {
-    throw new Error("metadata.source.path must be a relative repository path without traversal.");
-  }
+  if (!source || typeof source.repository !== "string" || typeof source.path !== "string" || !source.path.trim()) throw new Error("template.yaml metadata.source.repository and metadata.source.path are required to publish a template.");
   return manifest;
 }

package/src/runtime.mjs

@@ -6,18 +6,30 @@ const runtimeImages = {
 };
 
 export function imageForRuntime(runtime) {
-  if (runtime.image) return runtime.image;
   const key = `${runtime.language}:${runtime.pattern}`;
   const image = runtimeImages[key];
-  if (!image) {
-    const supported = Object.keys(runtimeImages).join(", ");
-    throw new Error(`Unsupported runtime ${key}. Set app.runtime.image explicitly, or use one of: ${supported}.`);
-  }
-  return `${image}:${runtime.image_tag ?? "latest"}`;
+  if (!image) throw new Error(`Unsupported runtime ${key}. Use one of: ${Object.keys(runtimeImages).join(", ")}.`);
+  return `${image}:latest`;
 }
 
-export function renderCompose(runtime, hostPort = 3000, { debug = false } = {}) {
+export function renderCompose(runtime, hostPort = 3000, { debug = false, configPath = "app" } = {}) {
   const image = imageForRuntime(runtime);
   const diagnostics = debug ? "    environment:\n      DOME_DEBUG: \"true\"\n" : "";
-  return `# Generated by @domesystems/templates. Do not edit; update template.yaml instead.\nservices:\n  app:\n    image: ${image}\n    env_file: .env\n${diagnostics}    volumes:\n      - ./app:/config:ro\n      - ./template.yaml:/template.yaml:ro\n    ports:\n      - \"${hostPort}:3000\"\n    healthcheck:\n      test: [\"CMD\", \"python\", \"-c\", \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:3000/health', timeout=2)\"]\n      interval: 30s\n      timeout: 3s\n      start_period: 10s\n      retries: 3\n`;
+  return `# Generated by @domesystems/templates. Do not edit; update template.yaml instead.
+services:
+  app:
+    image: ${image}
+    env_file: .env
+${diagnostics}    volumes:
+      - ./${configPath}:/config:ro
+      - ./template.yaml:/template.yaml:ro
+    ports:
+      - "${hostPort}:3000"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:3000/health', timeout=2)"]
+      interval: 30s
+      timeout: 3s
+      start_period: 10s
+      retries: 3
+`;
 }