@nylorun/admin 0.2.0-beta → 0.3.0-beta

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.3.0-beta
+
+### Minor Changes
+
+- bf1c2da: **Tenants can register a Studio principal.** `CreateTenantRequest` gains optional `studioCredentialHash` behind the new protocol feature `studio-principal`; the Runtime stores it as application principal `studio`, and idempotent create compares it too. `@nylorun/admin` exports `deriveStudioToken(adminKey, tenantId)` (HMAC-SHA256 over `nylorun/studio/v1`, NUL, Tenant id) and `createTenant` sends the hash of that key, so Studio can reach any Tenant's API with a key derived from the admin key. Clients require the new feature, so upgrade the Runtime with them.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [bf1c2da]
+- Updated dependencies [ba1b239]
+- Updated dependencies [bf1c2da]
+- Updated dependencies [bf1c2da]
+- Updated dependencies [bf1c2da]
+  - @nylorun/core@0.6.0-beta
+
 ## 0.2.0-beta
 
 ### Minor Changes

package/README.md

@@ -23,6 +23,11 @@ idempotency key locally; only the key's hash is sent. On network error or
 `5xx` it retries up to three times with identical values. Persist the returned
 `applicationKey` — the Host never sees it in cleartext again.
 
+`createTenant` also registers the Tenant's Studio principal (`studio`) by
+sending the hash of `deriveStudioToken(adminKey, tenantId)`. Studio derives the
+same key from the admin key to call that Tenant's API, so whoever holds the
+admin key can reach every Tenant created this way.
+
 Local Host resolution reads `host.json` and `host-credentials.json` under
 `NYLORUN_HOME` / `~/.nylorun` (or `options.home`). On POSIX the credentials
 file must be owned by the user and not group- or world-readable. First use
@@ -33,5 +38,4 @@ Errors are `AdminError` with a registry `code` from `@nylorun/core`
 `compareVersions`.
 
 Developer applications do **not** depend on this package — only managing
-clients (CLI, desktop Runtime panel, CI) do. See
-[building a desktop client](../docs/building-a-desktop-client.md).
+clients (CLI, desktop Runtime panel, CI) do.

package/dist/client.js

@@ -4,6 +4,7 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { AdminStatusSchema, AdminTenantSchema, AdminTenantStatusSchema, RejectedResponseSchema, TenantEnvelopeSchema, } from "@nylorun/core/contracts";
 import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, checkCompatibility, newPrincipalId, newTenantId, } from "@nylorun/core/compatibility";
+import { deriveStudioToken } from "./derived-credentials.js";
 import { AdminError } from "./errors.js";
 function env(name) {
     const value = process.env[name];
@@ -288,12 +289,14 @@ export class AdminClient {
     }
     async createTenant(options) {
         const applicationKey = mintApplicationKey();
+        const tenantId = newTenantId();
         const body = {
-            tenantId: newTenantId(),
+            tenantId,
             name: options.name,
             principalId: newPrincipalId(),
             credentialHash: hashCredential(applicationKey),
             idempotencyKey: randomUUID(),
+            studioCredentialHash: hashCredential(deriveStudioToken(this.key, tenantId)),
         };
         let lastError;
         for (let attempt = 0; attempt < 3; attempt += 1) {

package/dist/derived-credentials.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Deterministic Studio key for one Tenant, derived from the admin key.
+ * Same admin key and Tenant always produce the same key. Studio derives it in
+ * memory; the Tenant stores only its hash, as principal `studio`.
+ */
+export declare function deriveStudioToken(adminKey: string, tenantId: string): string;

package/dist/derived-credentials.js

@@ -0,0 +1,16 @@
+import { createHmac } from "node:crypto";
+/**
+ * Deterministic Studio key for one Tenant, derived from the admin key.
+ * Same admin key and Tenant always produce the same key. Studio derives it in
+ * memory; the Tenant stores only its hash, as principal `studio`.
+ */
+export function deriveStudioToken(adminKey, tenantId) {
+    const message = Buffer.concat([
+        Buffer.from("nylorun/studio/v1", "utf8"),
+        Buffer.from([0]),
+        Buffer.from(tenantId, "utf8"),
+    ]);
+    return createHmac("sha256", Buffer.from(adminKey, "utf8"))
+        .update(message)
+        .digest("hex");
+}

package/dist/index.d.ts

@@ -1,9 +1,11 @@
 import type { AdminStatus, AdminTenant, AdminTenantStatus, TenantEnvelope } from "@nylorun/core/contracts";
 import { ERROR_CODES, PROTOCOL_FEATURES, compareVersions, type ErrorCode } from "@nylorun/core/compatibility";
+import { deriveStudioToken } from "./derived-credentials.js";
 import { AdminError } from "./errors.js";
 export { ERROR_CODES, PROTOCOL_FEATURES, compareVersions };
 export type { ErrorCode };
 export { AdminError };
+export { deriveStudioToken };
 export interface Admin {
     readonly url: string;
     readonly source: "options" | "environment" | "local-host";

package/dist/index.js

@@ -1,8 +1,10 @@
 import { ERROR_CODES, PROTOCOL_FEATURES, compareVersions, } from "@nylorun/core/compatibility";
 import { AdminClient, resolveAdminConnection } from "./client.js";
+import { deriveStudioToken } from "./derived-credentials.js";
 import { AdminError } from "./errors.js";
 export { ERROR_CODES, PROTOCOL_FEATURES, compareVersions };
 export { AdminError };
+export { deriveStudioToken };
 export function createAdmin(options) {
     return new AdminClient(resolveAdminConnection(options));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/admin",
-  "version": "0.2.0-beta",
+  "version": "0.3.0-beta",
   "description": "Nylorun Admin API client for Tenants and Host status",
   "type": "module",
   "license": "Apache-2.0",
@@ -24,7 +24,7 @@
     "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\""
   },
   "dependencies": {
-    "@nylorun/core": "0.5.0-beta"
+    "@nylorun/core": "0.6.0-beta"
   },
   "peerDependencies": {
     "zod": "^4.6.5"