@nylorun/admin 0.2.0-beta

package/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+## 0.2.0-beta
+
+### Minor Changes
+
+- c49efed: **New package:** Admin API client for managing clients (CLI, desktop Runtime panel, CI). Exports `createAdmin` with `createTenant`, `listTenants`, `getTenant`, `deleteTenant`, and `status`. Depends only on `@nylorun/core`. Resolves connection from options, then `NYLORUN_ADMIN_URL`/`NYLORUN_ADMIN_KEY`, then local Host settings (`host.json` + `host-credentials.json`). Developer applications do not depend on this package.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [c49efed]
+- Updated dependencies [c49efed]
+- Updated dependencies [fd9fd87]
+  - @nylorun/core@0.5.0-beta
+
+## 0.1.0-beta
+
+- Package skeleton (Wave 0).

package/LICENSE

@@ -0,0 +1,192 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      Copyright 2026 Nylo
+
+      Licensed under the Apache License, Version 2.0 (the "License");
+      you may not use this file except in compliance with the License.
+      You may obtain a copy of the License at
+
+         http://www.apache.org/licenses/LICENSE-2.0
+
+      Unless required by applicable law or agreed to in writing, software
+      distributed under the License is distributed on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+      See the License for the specific language governing permissions and
+      limitations under the License.

package/README.md

@@ -0,0 +1,37 @@
+# @nylorun/admin
+
+Admin API client for creating, listing, inspecting and deleting Tenants, and
+reading Host service status. Depends only on `@nylorun/core`. Requires Node
+24+. Vocabulary: [runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
+
+```ts
+import { createAdmin } from "@nylorun/admin";
+
+// Resolution: explicit options → NYLORUN_ADMIN_URL + NYLORUN_ADMIN_KEY → local Host
+const admin = createAdmin();
+// or: createAdmin({ url, key }) / createAdmin({ home: "/path/to/host-root" })
+
+const status = await admin.status();
+const { tenant, applicationKey } = await admin.createTenant({ name: "my-app" });
+await admin.listTenants();
+await admin.getTenant(tenant.id);
+await admin.deleteTenant(tenant.id, { activeWork: "refuse" });
+```
+
+`createTenant` generates the Tenant id, principal, application key and
+idempotency key locally; only the key's hash is sent. On network error or
+`5xx` it retries up to three times with identical values. Persist the returned
+`applicationKey` — the Host never sees it in cleartext again.
+
+Local Host resolution reads `host.json` and `host-credentials.json` under
+`NYLORUN_HOME` / `~/.nylorun` (or `options.home`). On POSIX the credentials
+file must be owned by the user and not group- or world-readable. First use
+checks `/health` compatibility and throws `incompatible_host` on mismatch.
+
+Errors are `AdminError` with a registry `code` from `@nylorun/core`
+(`ERROR_CODES`). Re-exports: `PROTOCOL_FEATURES`, `ERROR_CODES`,
+`compareVersions`.
+
+Developer applications do **not** depend on this package — only managing
+clients (CLI, desktop Runtime panel, CI) do. See
+[building a desktop client](../docs/building-a-desktop-client.md).

package/dist/client.d.ts

@@ -0,0 +1,40 @@
+import { type AdminStatus, type AdminTenant, type AdminTenantStatus, type TenantEnvelope } from "@nylorun/core/contracts";
+export type AdminSource = "options" | "environment" | "local-host";
+export interface ResolvedAdmin {
+    url: string;
+    key: string;
+    source: AdminSource;
+    home: string;
+}
+/**
+ * Resolve Admin API connection once: options → environment → local Host.
+ */
+export declare function resolveAdminConnection(options?: {
+    url?: string;
+    key?: string;
+    home?: string;
+}): ResolvedAdmin;
+export declare class AdminClient {
+    readonly url: string;
+    readonly source: AdminSource;
+    private readonly key;
+    private compatible;
+    constructor(resolved: ResolvedAdmin);
+    private clearCompatibilityCache;
+    private adminHeaders;
+    private ensureCompatible;
+    private request;
+    private json;
+    status(): Promise<AdminStatus>;
+    listTenants(): Promise<AdminTenant[]>;
+    getTenant(id: string): Promise<AdminTenantStatus>;
+    deleteTenant(id: string, options?: {
+        activeWork?: "refuse" | "drain" | "cancel";
+    }): Promise<void>;
+    createTenant(options: {
+        name: string;
+    }): Promise<{
+        tenant: TenantEnvelope;
+        applicationKey: string;
+    }>;
+}

package/dist/client.js

@@ -0,0 +1,346 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { AdminStatusSchema, AdminTenantSchema, AdminTenantStatusSchema, RejectedResponseSchema, TenantEnvelopeSchema, } from "@nylorun/core/contracts";
+import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, checkCompatibility, newPrincipalId, newTenantId, } from "@nylorun/core/compatibility";
+import { AdminError } from "./errors.js";
+function env(name) {
+    const value = process.env[name];
+    return value === undefined || value.trim() === "" ? undefined : value;
+}
+function resolveHome(home) {
+    if (home !== undefined && home.trim() !== "")
+        return resolve(home);
+    const fromEnv = env("NYLORUN_HOME");
+    if (fromEnv)
+        return resolve(fromEnv);
+    return resolve(join(homedir(), ".nylorun"));
+}
+function connectionMissing(message) {
+    throw new AdminError("connection_missing", message);
+}
+function sourcesTriedMessage(home) {
+    return (`Tried options (url + key), environment (NYLORUN_ADMIN_URL + NYLORUN_ADMIN_KEY), ` +
+        `and local Host settings (host.json + host-credentials.json under ${home}).`);
+}
+function assertCredentialsSafe(path) {
+    if (process.platform === "win32")
+        return;
+    let stats;
+    try {
+        stats = statSync(path);
+    }
+    catch {
+        return;
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
+    if (uid !== undefined && stats.uid !== uid) {
+        connectionMissing(`host-credentials.json at ${path} is not owned by the current user. ${sourcesTriedMessage(resolve(join(path, "..")))}`);
+    }
+    if ((stats.mode & 0o077) !== 0) {
+        connectionMissing(`host-credentials.json at ${path} is group- or world-readable; fix permissions (chmod 600). ${sourcesTriedMessage(resolve(join(path, "..")))}`);
+    }
+}
+function readLocalHost(home) {
+    const configPath = join(home, "host.json");
+    const credentialsPath = join(home, "host-credentials.json");
+    let config;
+    let credentials;
+    try {
+        config = JSON.parse(readFileSync(configPath, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    try {
+        assertCredentialsSafe(credentialsPath);
+        credentials = JSON.parse(readFileSync(credentialsPath, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof AdminError)
+            throw error;
+        return undefined;
+    }
+    if (!config || typeof config !== "object" || Array.isArray(config)) {
+        return undefined;
+    }
+    if (!credentials ||
+        typeof credentials !== "object" ||
+        Array.isArray(credentials)) {
+        return undefined;
+    }
+    const host = config.host;
+    const port = config.port;
+    const adminKey = credentials.adminKey;
+    if (typeof host !== "string" || typeof port !== "number")
+        return undefined;
+    if (typeof adminKey !== "string" || !/^[0-9a-f]{64}$/.test(adminKey)) {
+        return undefined;
+    }
+    return { url: `http://${host}:${port}`, key: adminKey };
+}
+/**
+ * Resolve Admin API connection once: options → environment → local Host.
+ */
+export function resolveAdminConnection(options) {
+    const home = resolveHome(options?.home);
+    const optionUrl = options?.url?.trim() || undefined;
+    const optionKey = options?.key?.trim() || undefined;
+    if (optionUrl || optionKey) {
+        if (!optionUrl || !optionKey) {
+            connectionMissing(`Incomplete Admin API options: both url and key are required. ${sourcesTriedMessage(home)}`);
+        }
+        return {
+            url: optionUrl.replace(/\/$/, ""),
+            key: optionKey,
+            source: "options",
+            home,
+        };
+    }
+    const envUrl = env("NYLORUN_ADMIN_URL");
+    const envKey = env("NYLORUN_ADMIN_KEY");
+    if (envUrl || envKey) {
+        if (!envUrl || !envKey) {
+            connectionMissing(`Incomplete Admin API environment: both NYLORUN_ADMIN_URL and NYLORUN_ADMIN_KEY are required. ${sourcesTriedMessage(home)}`);
+        }
+        return {
+            url: envUrl.replace(/\/$/, ""),
+            key: envKey,
+            source: "environment",
+            home,
+        };
+    }
+    const local = readLocalHost(home);
+    if (local) {
+        return {
+            url: local.url.replace(/\/$/, ""),
+            key: local.key,
+            source: "local-host",
+            home,
+        };
+    }
+    connectionMissing(`Could not resolve Admin API connection. ${sourcesTriedMessage(home)}`);
+}
+function parseProtocolRange(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    const record = value;
+    if (typeof record.min !== "number" ||
+        typeof record.max !== "number" ||
+        !Array.isArray(record.features) ||
+        !record.features.every((f) => typeof f === "string")) {
+        return undefined;
+    }
+    return {
+        min: record.min,
+        max: record.max,
+        features: record.features,
+    };
+}
+function hashCredential(token) {
+    return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function mintApplicationKey() {
+    return randomBytes(32).toString("hex");
+}
+function throwFromResponse(status, body) {
+    const parsed = RejectedResponseSchema.safeParse(body);
+    if (parsed.success) {
+        throw new AdminError(parsed.data.code, parsed.data.message, {
+            status,
+            details: parsed.data.details,
+        });
+    }
+    if (status === 409) {
+        throw new AdminError("tenant_conflict", `Admin request conflict (${status})`, { status, details: body });
+    }
+    if (status === 404) {
+        throw new AdminError("not_found", `Admin request not found (${status})`, {
+            status,
+            details: body,
+        });
+    }
+    throw new AdminError("not_found", `Admin request failed (${status})`, {
+        status,
+        details: body,
+    });
+}
+async function readBody(response) {
+    const text = await response.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+export class AdminClient {
+    url;
+    source;
+    key;
+    compatible = false;
+    constructor(resolved) {
+        this.url = resolved.url;
+        this.source = resolved.source;
+        this.key = resolved.key;
+    }
+    clearCompatibilityCache() {
+        this.compatible = false;
+    }
+    adminHeaders(init = {}) {
+        const headers = new Headers(init.headers);
+        headers.set("Authorization", `Bearer ${this.key}`);
+        headers.set(PROTOCOL_HEADER, String(PROTOCOL_VERSION));
+        headers.set("Accept", "application/json");
+        if (init.body)
+            headers.set("Content-Type", "application/json");
+        return headers;
+    }
+    async ensureCompatible(signal) {
+        if (this.compatible)
+            return;
+        const response = await fetch(`${this.url}/health`, {
+            method: "GET",
+            redirect: "error",
+            signal,
+        });
+        const body = await readBody(response);
+        if (!response.ok) {
+            throwFromResponse(response.status, body);
+        }
+        const protocol = parseProtocolRange(body && typeof body === "object" && !Array.isArray(body)
+            ? body.protocol
+            : undefined);
+        if (!protocol) {
+            throw new AdminError("incompatible_host", "Host /health did not advertise a protocol range.");
+        }
+        const result = checkCompatibility({ version: PROTOCOL_VERSION, required: [...PROTOCOL_FEATURES] }, protocol);
+        if (!result.ok) {
+            const detail = result.reason === "version"
+                ? `client protocol ${result.client} is outside Host range ${result.host.min}–${result.host.max}`
+                : `Host is missing required features: ${result.missing.join(", ")}`;
+            throw new AdminError("incompatible_host", `Incompatible Host: ${detail}`, { details: result });
+        }
+        this.compatible = true;
+    }
+    async request(path, init = {}, options = {}) {
+        await this.ensureCompatible(init.signal === null ? undefined : init.signal);
+        const response = await fetch(this.url + path, {
+            ...init,
+            headers: this.adminHeaders(init),
+            redirect: "error",
+        });
+        if (response.status === 426) {
+            this.clearCompatibilityCache();
+            if (!options.retried426) {
+                await this.ensureCompatible(init.signal === null ? undefined : init.signal);
+                return this.request(path, init, { retried426: true });
+            }
+            const body = await readBody(response);
+            const protocol = parseProtocolRange(body && typeof body === "object" && !Array.isArray(body)
+                ? body.protocol
+                : undefined);
+            if (protocol) {
+                const result = checkCompatibility({ version: PROTOCOL_VERSION, required: [...PROTOCOL_FEATURES] }, protocol);
+                if (!result.ok) {
+                    throw new AdminError("incompatible_host", "Incompatible Host after protocol upgrade challenge.", { status: 426, details: result });
+                }
+            }
+            throwFromResponse(426, body);
+        }
+        return response;
+    }
+    async json(path, method = "GET", body) {
+        const response = await this.request(path, {
+            method,
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (response.status === 204)
+            return undefined;
+        const parsed = await readBody(response);
+        if (!response.ok)
+            throwFromResponse(response.status, parsed);
+        return parsed;
+    }
+    async status() {
+        const body = await this.json("/v1/admin/status");
+        return AdminStatusSchema.parse(body);
+    }
+    async listTenants() {
+        const body = await this.json("/v1/admin/tenants");
+        if (!Array.isArray(body)) {
+            throw new AdminError("not_found", "Admin list tenants response was not an array.", { details: body });
+        }
+        return body.map((item) => AdminTenantSchema.parse(item));
+    }
+    async getTenant(id) {
+        const body = await this.json(`/v1/admin/tenants/${encodeURIComponent(id)}`);
+        return AdminTenantStatusSchema.parse(body);
+    }
+    async deleteTenant(id, options) {
+        const activeWork = options?.activeWork ?? "refuse";
+        await this.json(`/v1/admin/tenants/${encodeURIComponent(id)}?activeWork=${activeWork}`, "DELETE");
+    }
+    async createTenant(options) {
+        const applicationKey = mintApplicationKey();
+        const body = {
+            tenantId: newTenantId(),
+            name: options.name,
+            principalId: newPrincipalId(),
+            credentialHash: hashCredential(applicationKey),
+            idempotencyKey: randomUUID(),
+        };
+        let lastError;
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            let response;
+            try {
+                response = await this.request("/v1/admin/tenants", {
+                    method: "POST",
+                    body: JSON.stringify(body),
+                    signal: AbortSignal.timeout(15_000),
+                });
+            }
+            catch (error) {
+                if (error instanceof AdminError)
+                    throw error;
+                lastError = error;
+                if (attempt === 2) {
+                    throw new AdminError("not_found", `Could not create Tenant after network errors: ${error instanceof Error ? error.message : String(error)}`, { details: error });
+                }
+                continue;
+            }
+            if (response.status === 409) {
+                const parsed = await readBody(response);
+                throw new AdminError("tenant_conflict", "Tenant id conflict.", {
+                    status: 409,
+                    details: parsed,
+                });
+            }
+            if (response.status >= 500) {
+                lastError = await readBody(response);
+                if (attempt === 2) {
+                    throwFromResponse(response.status, lastError);
+                }
+                continue;
+            }
+            const parsed = await readBody(response);
+            if (response.status !== 201 && response.status !== 200) {
+                throwFromResponse(response.status, parsed);
+            }
+            return {
+                tenant: TenantEnvelopeSchema.parse(parsed),
+                applicationKey,
+            };
+        }
+        throw lastError instanceof AdminError
+            ? lastError
+            : new AdminError("not_found", "Could not create Tenant after retries.", {
+                details: lastError,
+            });
+    }
+}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+import type { ErrorCode } from "@nylorun/core/compatibility";
+export declare class AdminError extends Error {
+    readonly code: ErrorCode;
+    readonly status?: number;
+    readonly details?: unknown;
+    constructor(code: ErrorCode, message: string, options?: {
+        status?: number;
+        details?: unknown;
+    });
+}

package/dist/errors.js

@@ -0,0 +1,12 @@
+export class AdminError extends Error {
+    code;
+    status;
+    details;
+    constructor(code, message, options) {
+        super(message);
+        this.name = "AdminError";
+        this.code = code;
+        this.status = options?.status;
+        this.details = options?.details;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,28 @@
+import type { AdminStatus, AdminTenant, AdminTenantStatus, TenantEnvelope } from "@nylorun/core/contracts";
+import { ERROR_CODES, PROTOCOL_FEATURES, compareVersions, type ErrorCode } from "@nylorun/core/compatibility";
+import { AdminError } from "./errors.js";
+export { ERROR_CODES, PROTOCOL_FEATURES, compareVersions };
+export type { ErrorCode };
+export { AdminError };
+export interface Admin {
+    readonly url: string;
+    readonly source: "options" | "environment" | "local-host";
+    status(): Promise<AdminStatus>;
+    listTenants(): Promise<AdminTenant[]>;
+    getTenant(id: string): Promise<AdminTenantStatus>;
+    deleteTenant(id: string, options?: {
+        activeWork?: "refuse" | "drain" | "cancel";
+    }): Promise<void>;
+    createTenant(options: {
+        name: string;
+    }): Promise<{
+        tenant: TenantEnvelope;
+        applicationKey: string;
+    }>;
+}
+export declare function createAdmin(options?: {
+    url?: string;
+    key?: string;
+    home?: string;
+}): Admin;
+export type { AdminStatus, AdminTenant, AdminTenantStatus, TenantEnvelope };

package/dist/index.js

@@ -0,0 +1,8 @@
+import { ERROR_CODES, PROTOCOL_FEATURES, compareVersions, } from "@nylorun/core/compatibility";
+import { AdminClient, resolveAdminConnection } from "./client.js";
+import { AdminError } from "./errors.js";
+export { ERROR_CODES, PROTOCOL_FEATURES, compareVersions };
+export { AdminError };
+export function createAdmin(options) {
+    return new AdminClient(resolveAdminConnection(options));
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@nylorun/admin",
+  "version": "0.2.0-beta",
+  "description": "Nylorun Admin API client for Tenants and Host status",
+  "type": "module",
+  "license": "Apache-2.0",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "npm run build && npm test && node scripts/check-package.mjs",
+    "test": "vitest run --passWithNoTests",
+    "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\""
+  },
+  "dependencies": {
+    "@nylorun/core": "0.5.0-beta"
+  },
+  "peerDependencies": {
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^5.0.1"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nylorun/harness.git",
+    "directory": "admin"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
+}