@nylorun/cli 0.2.1-beta → 0.4.0-beta

package/dist/project/credentials.js

@@ -0,0 +1,64 @@
+import { chmod, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { CliError } from "../errors.js";
+import { credentialsPath, ensureProjectNylorunDir, } from "./link.js";
+export async function readCredentials(projectRoot) {
+    const path = credentialsPath(projectRoot);
+    try {
+        const value = JSON.parse(await readFile(path, "utf8"));
+        if (typeof value?.applicationKey !== "string" ||
+            !/^[0-9a-f]{64}$/.test(value.applicationKey) ||
+            typeof value?.principalId !== "string" ||
+            value.principalId.length === 0) {
+            throw new CliError(`Invalid Project credentials at ${path}. Remove .nylorun/credentials.json and run nylo tenant create.`, 1);
+        }
+        const format = value.format === undefined || value.format === 0
+            ? 0
+            : value.format === 1
+                ? 1
+                : undefined;
+        if (format === undefined) {
+            throw new CliError(`Project credentials at ${path} have an unsupported format. Upgrade the CLI.`, 1);
+        }
+        await chmod(path, 0o600);
+        const executors = format === 0 &&
+            value.executors &&
+            typeof value.executors === "object" &&
+            !Array.isArray(value.executors)
+            ? value.executors
+            : undefined;
+        return {
+            format,
+            applicationKey: value.applicationKey,
+            principalId: value.principalId,
+            ...(executors ? { executors } : {}),
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+export async function writeCredentials(projectRoot, credentials) {
+    await ensureProjectNylorunDir(projectRoot);
+    const path = credentialsPath(projectRoot);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    // Version 1 writes format 1 without executors (D§3.7).
+    const body = `${JSON.stringify({
+        format: credentials.format ?? 1,
+        applicationKey: credentials.applicationKey,
+        principalId: credentials.principalId,
+    }, null, 2)}\n`;
+    try {
+        await writeFile(temporary, body, { mode: 0o600 });
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export async function removeCredentials(projectRoot) {
+    await rm(credentialsPath(projectRoot), { force: true });
+}

package/dist/project/env.d.ts

@@ -0,0 +1,3 @@
+/** Three `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+export declare function printLinkedEnvExports(projectRoot?: string): Promise<void>;
+export declare function shellQuote(value: string): string;

package/dist/project/env.js

@@ -0,0 +1,21 @@
+import { readCredentials } from "./credentials.js";
+import { readLink } from "./link.js";
+import { findProjectRoot } from "./root.js";
+/** Three `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+export async function printLinkedEnvExports(projectRoot = process.cwd()) {
+    const root = findProjectRoot(projectRoot) ?? projectRoot;
+    const link = await readLink(root);
+    const credentials = await readCredentials(root);
+    if (!link || !credentials) {
+        console.log("# No Project link in this directory. Run nylo tenant create to create one.");
+        return;
+    }
+    console.log(`export NYLORUN_RUNTIME_URL=${shellQuote(link.hostUrl)}`);
+    console.log(`export NYLORUN_SERVER_KEY=${shellQuote(credentials.applicationKey)}`);
+    console.log(`export NYLORUN_TENANT=${shellQuote(link.tenantId)}`);
+}
+export function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:-]+$/.test(value))
+        return value;
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}

package/dist/project/link.d.ts

@@ -0,0 +1,20 @@
+/** Project-local link to a Runtime Host Tenant (D§3.7, format 0|1). */
+export interface ProjectLink {
+    format: 0 | 1;
+    hostUrl: string;
+    hostId: string;
+    tenantId: string;
+}
+export declare function nylorunDir(projectRoot: string): string;
+export declare function linkPath(projectRoot: string): string;
+export declare function credentialsPath(projectRoot: string): string;
+/**
+ * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.
+ * The Project's own `.gitignore` is never edited.
+ */
+export declare function ensureProjectNylorunDir(projectRoot: string): Promise<string>;
+export declare function readLink(projectRoot: string): Promise<ProjectLink | undefined>;
+export declare function writeLink(projectRoot: string, link: Omit<ProjectLink, "format"> & {
+    format?: 0 | 1;
+}): Promise<void>;
+export declare function removeLink(projectRoot: string): Promise<void>;

package/dist/project/link.js

@@ -0,0 +1,77 @@
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { isTenantId } from "@nylorun/agents";
+import { CliError } from "../errors.js";
+export function nylorunDir(projectRoot) {
+    return join(projectRoot, ".nylorun");
+}
+export function linkPath(projectRoot) {
+    return join(nylorunDir(projectRoot), "link.json");
+}
+export function credentialsPath(projectRoot) {
+    return join(nylorunDir(projectRoot), "credentials.json");
+}
+/**
+ * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.
+ * The Project's own `.gitignore` is never edited.
+ */
+export async function ensureProjectNylorunDir(projectRoot) {
+    const dir = nylorunDir(projectRoot);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await writeFile(join(dir, ".gitignore"), "*\n", { mode: 0o600 }).catch(async () => {
+        await writeFile(join(dir, ".gitignore"), "*\n", { mode: 0o600 });
+    });
+    return dir;
+}
+export async function readLink(projectRoot) {
+    try {
+        const value = JSON.parse(await readFile(linkPath(projectRoot), "utf8"));
+        if (typeof value?.hostUrl !== "string" ||
+            typeof value?.hostId !== "string" ||
+            typeof value?.tenantId !== "string" ||
+            !isTenantId(value.tenantId)) {
+            throw new CliError(`Invalid Project link at ${linkPath(projectRoot)}. Remove .nylorun/link.json and run nylo tenant create.`, 1);
+        }
+        const format = value.format === undefined || value.format === 0
+            ? 0
+            : value.format === 1
+                ? 1
+                : undefined;
+        if (format === undefined) {
+            throw new CliError(`Project link at ${linkPath(projectRoot)} has an unsupported format. Upgrade the CLI.`, 1);
+        }
+        return {
+            format,
+            hostUrl: value.hostUrl.replace(/\/$/, ""),
+            hostId: value.hostId,
+            tenantId: value.tenantId,
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+export async function writeLink(projectRoot, link) {
+    await ensureProjectNylorunDir(projectRoot);
+    const path = linkPath(projectRoot);
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    const body = `${JSON.stringify({
+        format: link.format ?? 1,
+        hostUrl: link.hostUrl.replace(/\/$/, ""),
+        hostId: link.hostId,
+        tenantId: link.tenantId,
+    }, null, 2)}\n`;
+    try {
+        await writeFile(temporary, body, { mode: 0o600 });
+        await rename(temporary, path);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+export async function removeLink(projectRoot) {
+    await rm(linkPath(projectRoot), { force: true });
+}

package/dist/project/root.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The nearest `.nylorun` wins so an initialised Project keeps working from a
+ * subdirectory; otherwise the nearest package.json defines the Project. The
+ * walk stops at the home directory because `~/.nylorun` is the Host root, never
+ * a Project root.
+ */
+export declare function findProjectRoot(cwd?: string): string | undefined;
+/** Require a Project root or throw a usage-oriented error. */
+export declare function requireProjectRoot(cwd?: string): string;

package/dist/project/root.js

@@ -0,0 +1,52 @@
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, parse, resolve } from "node:path";
+/**
+ * The nearest `.nylorun` wins so an initialised Project keeps working from a
+ * subdirectory; otherwise the nearest package.json defines the Project. The
+ * walk stops at the home directory because `~/.nylorun` is the Host root, never
+ * a Project root.
+ */
+export function findProjectRoot(cwd = process.cwd()) {
+    const stop = (() => {
+        try {
+            return realpathSync(homedir());
+        }
+        catch {
+            return homedir();
+        }
+    })();
+    let directory = resolve(cwd);
+    try {
+        directory = realpathSync(directory);
+    }
+    catch {
+        /* unresolvable cwd falls through */
+    }
+    const root = parse(directory).root;
+    let fallback;
+    for (;;) {
+        // The home directory is never a Project, but a package.json below it is.
+        if (directory === stop)
+            return fallback;
+        if (existsSync(join(directory, ".nylorun")))
+            return directory;
+        if (!fallback && existsSync(join(directory, "package.json")))
+            fallback = directory;
+        if (directory === root)
+            break;
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    return fallback;
+}
+/** Require a Project root or throw a usage-oriented error. */
+export function requireProjectRoot(cwd = process.cwd()) {
+    const root = findProjectRoot(cwd);
+    if (!root) {
+        throw new Error("No Project found (looked for package.json or .nylorun/). Run this from a Project directory.");
+    }
+    return root;
+}

package/dist/project/seed.d.ts

@@ -0,0 +1,25 @@
+export interface SeedOptions {
+    hostUrl: string;
+    tenantId: string;
+    applicationKey: string;
+    projectRoot: string;
+    /** Pre-loaded env map; when omitted, read `.env` without mutating process.env. */
+    env?: Readonly<Record<string, string>>;
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+    /**
+     * Seed the Tenant-level fixture model (`fixtureModel: true`, Host feature
+     * `tenant-fixture-model`) and skip the Project's model credential.
+     */
+    fixtureModel?: boolean;
+}
+/**
+ * Seed non-secret Tenant config via `PUT /v1/tenant/config/seed`.
+ * Model secrets go through the model route into the Tenant vault (F3).
+ * `.env` is read as a value map only — never written back or applied to process.env.
+ */
+export declare function seedTenantFromProject(options: SeedOptions): Promise<{
+    applied: string[];
+    kept: string[];
+    model?: string;
+}>;

package/dist/project/seed.js

@@ -0,0 +1,96 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER, } from "@nylorun/agents";
+import { CliError } from "../errors.js";
+import { putHostModel } from "../model/host-model.js";
+import { loadProjectEnvironment } from "../environment.js";
+function tenantHeaders(applicationKey, tenantId) {
+    return {
+        authorization: `Bearer ${applicationKey}`,
+        [TENANT_HEADER]: tenantId,
+        [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+    };
+}
+/**
+ * Seed non-secret Tenant config via `PUT /v1/tenant/config/seed`.
+ * Model secrets go through the model route into the Tenant vault (F3).
+ * `.env` is read as a value map only — never written back or applied to process.env.
+ */
+export async function seedTenantFromProject(options) {
+    const env = options.env ?? loadProjectEnvironment(options.projectRoot);
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const sandboxRaw = env.NYLORUN_SANDBOX?.trim();
+    const sandbox = sandboxRaw === "auto" || sandboxRaw === "virtual"
+        ? { backend: sandboxRaw }
+        : undefined;
+    let applied = [];
+    let kept = [];
+    if (sandbox || options.fixtureModel) {
+        const response = await fetchImpl(`${options.hostUrl.replace(/\/$/, "")}/v1/tenant/config/seed`, {
+            method: "PUT",
+            headers: {
+                ...tenantHeaders(options.applicationKey, options.tenantId),
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                requestId: randomUUID(),
+                ...(sandbox ? { sandbox } : {}),
+                ...(options.fixtureModel ? { fixtureModel: true } : {}),
+            }),
+            signal: options.signal ?? AbortSignal.timeout(15_000),
+        });
+        if (!response.ok) {
+            throw new CliError(`Tenant config seed failed (${response.status}): ${await response
+                .text()
+                .catch(() => "")}`, 1);
+        }
+        const body = (await response.json());
+        applied = body.applied ?? [];
+        kept = body.kept ?? [];
+    }
+    // A fixture-model Tenant never calls a real model: its credential stays out of it.
+    let model;
+    if (!options.fixtureModel && env.NYLORUN_DEV_MODEL?.trim() !== "fixture") {
+        const seeded = modelFromEnv(env, options.projectRoot);
+        if (seeded) {
+            await putHostModel(options.hostUrl, options.applicationKey, seeded, options.tenantId);
+            model = `${seeded.provider}/${seeded.model}`;
+        }
+    }
+    return { applied, kept, ...(model ? { model } : {}) };
+}
+function modelFromEnv(env, projectRoot) {
+    const provider = env.MODEL_PROVIDER?.trim();
+    const model = env.MODEL?.trim();
+    if (!provider || !model)
+        return undefined;
+    const baseUrl = env.MODEL_PROVIDER_BASE_URL?.trim();
+    const key = env.MODEL_PROVIDER_API_KEY;
+    if (key) {
+        return {
+            provider,
+            model,
+            ...(baseUrl ? { baseUrl } : {}),
+            auth: { type: "api_key", key },
+        };
+    }
+    for (const relative of [".nylorun/auth.json", ".env/auth.json"]) {
+        try {
+            const all = JSON.parse(readFileSync(join(projectRoot, relative), "utf8"));
+            const credential = all[provider];
+            if (credential?.type === "api_key" || credential?.type === "oauth") {
+                return {
+                    provider,
+                    model,
+                    ...(baseUrl ? { baseUrl } : {}),
+                    auth: credential,
+                };
+            }
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return undefined;
+}

package/dist/tenant/commands.d.ts

@@ -0,0 +1,4 @@
+import { type AdminTenant } from "@nylorun/admin";
+/** Exact-and-unique name or id match. */
+export declare function matchTenant(tenants: readonly AdminTenant[], nameOrId: string): AdminTenant;
+export declare function tenantCommand(args: readonly string[]): Promise<void>;