@nurix/nustack 0.10.0-dev.10

package/dist/spec_schema.json

@@ -0,0 +1,422 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/nurixlabs/NuStack/dev/packages/contracts/spec/schema.json",
+  "title": "nustack.service.json",
+  "description": "Manifest grammar v1 for an NuStack repo. Declares repo identity plus one or more service entries.",
+  "type": "object",
+  "required": ["spec", "name", "description", "repository", "services"],
+  "not": { "required": ["nustackApp", "nustackWorkspace"] },
+  "additionalProperties": false,
+  "properties": {
+    "$schema": { "type": "string" },
+    "spec": {
+      "type": "string",
+      "enum": ["nustack.dev/v1"],
+      "description": "Grammar version. Bump on breaking changes."
+    },
+    "name": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "Repo slug, globally unique."
+    },
+    "description": { "type": "string", "minLength": 1 },
+    "repository": { "type": "string", "format": "uri" },
+    "homepage": { "type": "string", "format": "uri" },
+    "owner": { "type": "string" },
+    "tags": { "type": "array", "items": { "type": "string" } },
+    "services": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/definitions/service" }
+    },
+    "nustackApp": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["appId", "workspaceId"],
+      "description": "The v1 App binding, still accepted from a manifest written before AD-025. `workspaceId` here is the TENANT. Additive — services[]/consumes[] are never replaced by it.",
+      "properties": {
+        "appId": { "type": "string", "minLength": 1 },
+        "workspaceId": { "type": "string", "minLength": 1 }
+      }
+    },
+    "nustackWorkspace": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["v", "workspaceId", "organizationId"],
+      "description": "The v2 Workspace binding the CLI writes (AD-025). `workspaceId` here is the WORKSPACE, not the tenant — `v` is what tells the two apart from nustackApp's identically named key. A manifest carrying both blocks is refused.",
+      "properties": {
+        "v": { "const": 2 },
+        "workspaceId": { "type": "string", "minLength": 1 },
+        "organizationId": { "type": "string", "minLength": 1 }
+      }
+    },
+    "toolkit": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "version"],
+      "description": "Toolkit identity, pairing with .nustack/app.json's toolkit name/version (F-026).",
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "version": { "type": "string", "minLength": 1 }
+      }
+    }
+  },
+
+  "definitions": {
+    "service": {
+      "type": "object",
+      "required": ["name", "kind", "type", "description"],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]*(/[a-z0-9-]+)*$",
+          "description": "Service slug, globally unique across NuStack. May be namespaced with '/' when a repo ships a family of sibling services (e.g. acme-suite/billing)."
+        },
+        "kind": {
+          "type": "string",
+          "enum": ["library", "service", "worker", "application", "documentation", "infra"],
+          "description": "Structural discriminator — selects the required sub-block (npm/http/mcp/worker/application/vault/infra)."
+        },
+        "type": {
+          "type": "string",
+          "enum": ["app", "service", "platform-service", "sdk", "library", "tool"],
+          "description": "Catalogue taxonomy — how the registry classifies the service, orthogonal to kind."
+        },
+        "version": { "type": "string" },
+        "description": { "type": "string", "minLength": 1 },
+        "status": {
+          "type": "string",
+          "enum": ["active", "experimental", "deprecated", "planned"],
+          "default": "active"
+        },
+        "owner": { "type": "string" },
+        "tags": { "type": "array", "items": { "type": "string" } },
+        "tier": {
+          "type": "string",
+          "enum": ["primitive", "composite"],
+          "description": "Service-only attribute. Primitives are infra-close; composites wrap primitives."
+        },
+        "environmentKey": {
+          "type": "string",
+          "enum": ["dev", "production"],
+          "description": "The dev/production value axis (F-034). Omitted means dev semantics at seed time."
+        },
+        "hosting": {
+          "type": "string",
+          "enum": ["cloudflare", "remote", "external"],
+          "description": "Where the service runs. Required on kind: service. cloudflare = a Worker on the platform account that reads the shared api-keys registry directly; remote = ours, hosted elsewhere, verifying keys through the auth service; external = a third-party vendor the platform brokers a credential for."
+        },
+        "tenancy": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["bucket"],
+          "description": "Declares that the service holds a top-level container per consumer and implements the fixed bucket contract (POST/DELETE /nustack/buckets). Never on hosting: external.",
+          "properties": {
+            "bucket": { "type": "string", "minLength": 1, "description": "The service's own noun for its container: application, knowledge-base, tenant, app." }
+          }
+        },
+
+        "npm":         { "$ref": "#/definitions/npm" },
+        "http":        { "$ref": "#/definitions/http" },
+        "mcp":         { "$ref": "#/definitions/mcp" },
+        "worker":      { "$ref": "#/definitions/worker" },
+        "application": { "$ref": "#/definitions/application" },
+        "vault":       { "$ref": "#/definitions/vault" },
+        "infra":       { "$ref": "#/definitions/infra" },
+
+        "consumes":  { "$ref": "#/definitions/consumes" },
+        "aiSurface": { "$ref": "#/definitions/aiSurface" },
+        "auth":      { "$ref": "#/definitions/auth" },
+        "env":       { "$ref": "#/definitions/env" }
+      },
+
+      "allOf": [
+        {
+          "if": { "properties": { "kind": { "const": "library" } }, "required": ["kind"] },
+          "then": { "required": ["npm"] }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "service" } }, "required": ["kind"] },
+          "then": {
+            "anyOf": [
+              { "required": ["http"] },
+              { "required": ["mcp"] }
+            ]
+          }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "worker" } }, "required": ["kind"] },
+          "then": { "required": ["worker"] }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "application" } }, "required": ["kind"] },
+          "then": { "required": ["application"] }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "documentation" } }, "required": ["kind"] },
+          "then": { "required": ["vault"] }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "infra" } }, "required": ["kind"] },
+          "then": { "required": ["infra"] }
+        },
+        {
+          "if": {
+            "properties": { "kind": { "not": { "const": "service" } } },
+            "required": ["kind"]
+          },
+          "then": { "not": { "required": ["tier"] } }
+        },
+        {
+          "if": { "properties": { "kind": { "const": "service" } }, "required": ["kind"] },
+          "then": { "required": ["hosting"] }
+        },
+        {
+          "if": { "properties": { "hosting": { "const": "external" } }, "required": ["hosting"] },
+          "then": { "not": { "required": ["tenancy"] } }
+        }
+      ]
+    },
+
+    "npm": {
+      "type": "object",
+      "required": ["package"],
+      "additionalProperties": false,
+      "properties": {
+        "package": { "type": "string", "pattern": "^(@[a-z0-9-]+/)?[a-z0-9-]+$" },
+        "registry": { "type": "string", "format": "uri" },
+        "access": { "type": "string", "enum": ["public", "restricted"] },
+        "subpaths": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["path"],
+            "properties": {
+              "path": { "type": "string" },
+              "summary": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
+
+    "http": {
+      "type": "object",
+      "additionalProperties": false,
+      "dependencies": { "instances": ["endpoints"] },
+      "properties": {
+        "endpoints": {
+          "type": "object",
+          "additionalProperties": { "type": "string", "format": "uri" }
+        },
+        "instances": {
+          "type": "array",
+          "minItems": 1,
+          "description": "Every deployment of this service the platform may bind a workspace to, one entry per deployment per plane. Omitted, the service has one deployment at endpoints.production on both planes. Requires endpoints beside it.",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["slug", "environment", "url"],
+            "properties": {
+              "slug": { "type": "string", "pattern": "^[a-z][a-z0-9-]*$" },
+              "environment": { "type": "string", "enum": ["dev", "production"] },
+              "url": { "type": "string", "format": "uri" },
+              "default": { "type": "boolean", "description": "The deployment a new workspace binds to on this plane. Exactly one per plane." }
+            }
+          }
+        },
+        "wellKnown": { "type": "string" },
+        "openapi": { "type": "string" },
+        "oidc": { "type": "string" },
+        "health": { "type": "string" }
+      }
+    },
+
+    "mcp": {
+      "type": "object",
+      "required": ["servers"],
+      "additionalProperties": false,
+      "properties": {
+        "servers": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": ["name", "url"],
+            "additionalProperties": false,
+            "properties": {
+              "name": { "type": "string" },
+              "url": { "type": "string", "format": "uri" },
+              "transport": { "type": "string", "enum": ["sse", "stdio", "http"] },
+              "summary": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
+
+    "worker": {
+      "type": "object",
+      "required": ["engine"],
+      "additionalProperties": false,
+      "properties": {
+        "engine": { "type": "string", "enum": ["temporal", "restate", "inngest", "custom"] },
+        "taskQueue": { "type": "string" },
+        "activities": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name"],
+            "additionalProperties": false,
+            "properties": {
+              "name": { "type": "string" },
+              "calls": { "type": "string" },
+              "via": { "type": "string", "enum": ["http", "mcp"] },
+              "idempotent": { "type": "boolean" },
+              "summary": { "type": "string" }
+            }
+          }
+        },
+        "workflows": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name"],
+            "additionalProperties": false,
+            "properties": {
+              "name": { "type": "string" },
+              "summary": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
+
+    "application": {
+      "type": "object",
+      "required": ["ui"],
+      "additionalProperties": false,
+      "properties": {
+        "ui": { "type": "string", "enum": ["spa", "ssr", "static"] },
+        "entryRoute": { "type": "string" }
+      }
+    },
+
+    "vault": {
+      "type": "object",
+      "required": ["type"],
+      "additionalProperties": false,
+      "properties": {
+        "type": { "type": "string", "enum": ["obsidian", "site"] },
+        "path": { "type": "string" },
+        "entry": { "type": "string" },
+        "url": { "type": "string", "format": "uri" }
+      }
+    },
+
+    "infra": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "compose": { "type": "string" },
+        "components": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name"],
+            "properties": {
+              "name": { "type": "string" },
+              "url": { "type": "string", "format": "uri" },
+              "summary": { "type": "string" }
+            }
+          }
+        },
+        "targets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name"],
+            "properties": {
+              "name": { "type": "string" },
+              "platform": { "type": "string" },
+              "namespace": { "type": "string" },
+              "summary": { "type": "string" }
+            }
+          }
+        },
+        "discoveryUrl": { "type": "string" }
+      }
+    },
+
+    "consumes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["service", "via"],
+        "additionalProperties": false,
+        "properties": {
+          "service": { "type": "string" },
+          "via": { "type": "string", "enum": ["npm", "http", "mcp", "worker"] },
+          "subpath": { "type": "string" },
+          "endpoint": { "type": "string" }
+        }
+      }
+    },
+
+    "aiSurface": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "promptHints": { "type": "string" },
+        "intents": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["id", "summary", "via"],
+            "additionalProperties": false,
+            "properties": {
+              "id": { "type": "string", "pattern": "^[a-z][a-z0-9_]*$" },
+              "summary": { "type": "string" },
+              "inputs": { "type": "object" },
+              "outputs": { "type": "object" },
+              "via": {
+                "type": "object",
+                "required": ["transport"],
+                "properties": {
+                  "transport": { "type": "string", "enum": ["http", "mcp", "npm", "cli"] },
+                  "method": { "type": "string" },
+                  "path": { "type": "string" },
+                  "tool": { "type": "string" },
+                  "command": { "type": "string" }
+                }
+              },
+              "auth": { "type": "string" },
+              "idempotent": { "type": "boolean" },
+              "sideEffects": { "type": "string", "enum": ["none", "read", "write", "external"] }
+            }
+          }
+        }
+      }
+    },
+
+    "auth": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "type": { "type": "string", "enum": ["none", "jwt", "oauth2", "apiKey", "platformKey"], "description": "platformKey = an opaque key minted by the auth service into the shared api-keys registry." },
+        "issuer": { "type": "string", "format": "uri" },
+        "audience": { "type": "string" }
+      }
+    },
+
+    "env": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "required": { "type": "array", "items": { "type": "string" } },
+        "optional": { "type": "array", "items": { "type": "string" } }
+      }
+    }
+  }
+}

package/dist/wire/auth.js

@@ -0,0 +1 @@
+export {};

package/dist/wire/sync-paths.js

@@ -0,0 +1,25 @@
+export const FIXTURE_ENTRIES = [
+    { pattern: "docs/architecture/domain-model.md", kind: "exact", direction: "bidirectional" },
+    { pattern: "docs/memory/**", kind: "glob", direction: "bidirectional" },
+    { pattern: "docs/features/*.md", kind: "glob", direction: "bidirectional" },
+];
+export const PATH_FIXTURE_CORPUS = [
+    { path: "docs/architecture/domain-model.md", outcome: "allow", note: "exact entry" },
+    { path: "docs/memory/session-1.md", outcome: "allow", note: "glob ** one level" },
+    { path: "docs/memory/a/b/c.md", outcome: "allow", note: "glob ** deep" },
+    { path: "docs/features/auth.md", outcome: "allow", note: "single-segment * glob" },
+    { path: "docs/features/nested/auth.md", outcome: "deny_unlisted", note: "* does not cross a segment" },
+    { path: "docs/architecture/other.md", outcome: "deny_unlisted", note: "unlisted sibling of an exact entry" },
+    { path: "README.md", outcome: "deny_unlisted", note: "top-level unlisted" },
+    { path: ".env", outcome: "protected", note: "protected env file" },
+    { path: ".env.local", outcome: "protected", note: "protected env variant" },
+    { path: "config/.env", outcome: "protected", note: "protected env file in a subdirectory" },
+    { path: ".git/config", outcome: "protected", note: "protected .git tree" },
+    { path: ".nustack/recovery/bundle.json", outcome: "protected", note: "protected recovery bundle" },
+    { path: "../escape.md", outcome: "invalid", note: "traversal segment" },
+    { path: "/etc/passwd", outcome: "invalid", note: "absolute path" },
+    { path: "C:/win.md", outcome: "invalid", note: "drive-qualified" },
+    { path: "docs\\memory\\x.md", outcome: "invalid", note: "backslash separator" },
+    { path: "docs//memory.md", outcome: "invalid", note: "empty segment" },
+    { path: "docs/memory/\u0000.md", outcome: "invalid", note: "NUL byte" },
+];

package/dist/wire/telemetry.js

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@nurix/nustack",
+  "version": "0.10.0-dev.10",
+  "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
+  "type": "module",
+  "private": false,
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nurixlabs/NuStack.git",
+    "directory": "packages/cli"
+  },
+  "bin": {
+    "nustack": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "dependencies": {
+    "@clack/prompts": "^0.11.0",
+    "ajv": "^8.17.1",
+    "ajv-formats": "^3.0.1",
+    "commander": "^14.0.0"
+  },
+  "optionalDependencies": {
+    "@nurix/codegraph": "0.2.1"
+  },
+  "devDependencies": {
+    "@ngneat/falso": "^8.0.2",
+    "@types/node": "^22.19.20",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.11",
+    "@nurix/nustack.studio": "0.0.0",
+    "@nurix/nustack.ui": "0.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/copy_schema.mjs",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}