@nylorun/cli 0.4.2-beta → 0.5.0-beta

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @nylorun/cli
 
+## 0.5.0-beta
+
+### Minor Changes
+
+- db956bc: Studio creates Tenants. While the Host has none, Studio asks for a name and creates the first one. A Tenant with no agents shows **Connect your code**: its model provider, the `npx @nylorun/cli tenant use <id>` command, and `npm run dev`. It switches to the agent list when the first agent registers.
+
+  Every Tenant Studio creates registers the derived principal `project` (`PROJECT_PRINCIPAL_ID` in `@nylorun/admin`). `nylo tenant use` now falls back to that key, derived from the local admin key, so a Project links a Studio-created Tenant with no stored key. When it replaces a one-time application key, it keeps that key as `.nylorun/credentials.<tenantId>.json`, and `nylo tenant use <that id>` switches back. `nylorun up` again offers Studio for creating the first Tenant.
+
+### Patch Changes
+
+- Pin admin to the tested release.
+- Updated dependencies [db956bc]
+  - @nylorun/admin@0.5.0-beta
+
 ## 0.4.2-beta
 
 ### Patch Changes

package/README.md

@@ -10,6 +10,7 @@ independent and never call each other. Depends on `@nylorun/agents` and
 ```sh
 npx nylorun up                        # the local stack (nylorun)
 npx @nylorun/cli tenant create        # this project's Tenant, linked in .nylorun/
+npx @nylorun/cli tenant use <id>      # or: link a Tenant created in Studio
 ```
 
 ## Commands
@@ -47,6 +48,22 @@ Inside a Project (the nearest `.nylorun/` or `package.json`):
 Outside a Project it creates the Tenant and prints the three `NYLORUN_*`
 exports once; the Host keeps only a hash of the application key.
 
+## `nylo tenant use <name-or-id>`
+
+Links the Project to another Tenant on the local Host. It uses the first key
+that the Tenant accepts:
+
+1. The Project's `.nylorun/credentials.json`.
+2. A key it kept when the Project last left that Tenant
+   (`.nylorun/credentials.<tenantId>.json`).
+3. The key of the derived principal `project`, computed from this machine's
+   admin key. Every Tenant created in Studio registers that principal, so
+   Studio's **Connect your code** step needs only this command.
+
+When it replaces an application key (shown only once, when the Tenant was
+created), it keeps that key as `.nylorun/credentials.<tenantId>.json`, so
+`nylo tenant use <that id>` switches back.
+
 ## Project link
 
 A **Project** stores only:

package/dist/cli.js

@@ -12,7 +12,8 @@ const usage = `nylo <tenant|configure|env|doctor>
 
 Runtime client (the local stack's Runtime, or any Runtime by URL and key):
   tenant create [name]                    create a Tenant; in a Project, link it and seed it from .env
-  tenant current|list [--json]|use <name-or-id>|status [--json]|reset|delete
+  tenant use <name-or-id>                 link this Project to a Tenant, e.g. one created in Studio
+  tenant current|list [--json]|status [--json]|reset|delete
   configure                               set the linked Tenant's model provider
   env                                     print the linked Project's NYLORUN_* variables as exports
   doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers

package/dist/project/credentials.d.ts

@@ -9,10 +9,11 @@ export interface ProjectCredentials {
     /** Present only on format 0 files; ignored by version 1. */
     executors?: Record<string, string>;
 }
-export declare function readCredentials(projectRoot: string): Promise<ProjectCredentials | undefined>;
+/** The Project's credentials, or with `tenantId` the key kept for that Tenant. */
+export declare function readCredentials(projectRoot: string, tenantId?: string): Promise<ProjectCredentials | undefined>;
 export declare function writeCredentials(projectRoot: string, credentials: {
     applicationKey: string;
     principalId: string;
     format?: 0 | 1;
-}): Promise<void>;
-export declare function removeCredentials(projectRoot: string): Promise<void>;
+}, tenantId?: string): Promise<void>;
+export declare function removeCredentials(projectRoot: string, tenantId?: string): Promise<void>;

package/dist/project/credentials.js

@@ -2,8 +2,9 @@ import { chmod, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import { CliError } from "../errors.js";
 import { credentialsPath, ensureProjectNylorunDir, } from "./link.js";
-export async function readCredentials(projectRoot) {
-    const path = credentialsPath(projectRoot);
+/** The Project's credentials, or with `tenantId` the key kept for that Tenant. */
+export async function readCredentials(projectRoot, tenantId) {
+    const path = credentialsPath(projectRoot, tenantId);
     try {
         const value = JSON.parse(await readFile(path, "utf8"));
         if (typeof value?.applicationKey !== "string" ||
@@ -40,9 +41,9 @@ export async function readCredentials(projectRoot) {
         throw error;
     }
 }
-export async function writeCredentials(projectRoot, credentials) {
+export async function writeCredentials(projectRoot, credentials, tenantId) {
     await ensureProjectNylorunDir(projectRoot);
-    const path = credentialsPath(projectRoot);
+    const path = credentialsPath(projectRoot, tenantId);
     const temporary = `${path}.${randomUUID()}.tmp`;
     // Version 1 writes format 1 without executors (D§3.7).
     const body = `${JSON.stringify({
@@ -59,6 +60,6 @@ export async function writeCredentials(projectRoot, credentials) {
         await rm(temporary, { force: true });
     }
 }
-export async function removeCredentials(projectRoot) {
-    await rm(credentialsPath(projectRoot), { force: true });
+export async function removeCredentials(projectRoot, tenantId) {
+    await rm(credentialsPath(projectRoot, tenantId), { force: true });
 }

package/dist/project/link.d.ts

@@ -7,7 +7,11 @@ export interface ProjectLink {
 }
 export declare function nylorunDir(projectRoot: string): string;
 export declare function linkPath(projectRoot: string): string;
-export declare function credentialsPath(projectRoot: string): string;
+/**
+ * `.nylorun/credentials.json`, or with `tenantId` the key `nylo tenant use`
+ * kept for a Tenant the Project was linked to before (`credentials.<id>.json`).
+ */
+export declare function credentialsPath(projectRoot: string, tenantId?: string): string;
 /**
  * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.
  * The Project's own `.gitignore` is never edited.

package/dist/project/link.js

@@ -9,8 +9,12 @@ export function nylorunDir(projectRoot) {
 export function linkPath(projectRoot) {
     return join(nylorunDir(projectRoot), "link.json");
 }
-export function credentialsPath(projectRoot) {
-    return join(nylorunDir(projectRoot), "credentials.json");
+/**
+ * `.nylorun/credentials.json`, or with `tenantId` the key `nylo tenant use`
+ * kept for a Tenant the Project was linked to before (`credentials.<id>.json`).
+ */
+export function credentialsPath(projectRoot, tenantId) {
+    return join(nylorunDir(projectRoot), tenantId === undefined ? "credentials.json" : `credentials.${tenantId}.json`);
 }
 /**
  * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.

package/dist/tenant/commands.js

@@ -1,10 +1,10 @@
 import { createInterface } from "node:readline/promises";
 import { randomUUID } from "node:crypto";
-import { createAdmin } from "@nylorun/admin";
+import { PROJECT_PRINCIPAL_ID, createAdmin, } from "@nylorun/admin";
 import { createClient, isTenantId } from "@nylorun/agents";
 import { CliError } from "../errors.js";
 import { resolveHome } from "../home.js";
-import { readCredentials, removeCredentials, } from "../project/credentials.js";
+import { readCredentials, removeCredentials, writeCredentials, } from "../project/credentials.js";
 import { readLink, removeLink, writeLink, } from "../project/link.js";
 import { findProjectRoot, requireProjectRoot } from "../project/root.js";
 import { createProjectTenant, defaultTenantName, } from "../project/create-tenant.js";
@@ -144,20 +144,44 @@ export async function tenantCommand(args) {
         const tenants = await admin.listTenants();
         const selected = matchTenant(tenants, nameOrId);
         console.warn("Sharing a Tenant shares executor registrations across Projects that link to it.");
-        const credentials = await readCredentials(root);
-        if (!credentials) {
-            throw new CliError("No Project credentials. Run nylo tenant create to create a Tenant first, or copy credentials for the target Tenant.", 1);
+        const authorizes = async (key) => {
+            try {
+                await createClient({ url: admin.url, key, tenant: selected.id }).transport.json("/v1/tenant", "GET");
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        const link = await readLink(root);
+        const current = await readCredentials(root);
+        const kept = await readCredentials(root, selected.id);
+        // The Project's own key, then one kept when it last left this Tenant, then
+        // the key derived from this machine's admin key (Tenants Studio creates).
+        let chosen;
+        for (const candidate of [current, kept])
+            if (!chosen && candidate && (await authorizes(candidate.applicationKey)))
+                chosen = candidate;
+        if (!chosen) {
+            const derived = admin.deriveTenantKey(selected.id, PROJECT_PRINCIPAL_ID);
+            if (await authorizes(derived))
+                chosen = { format: 1, applicationKey: derived, principalId: PROJECT_PRINCIPAL_ID };
         }
-        const client = createClient({
-            url: admin.url,
-            key: credentials.applicationKey,
-            tenant: selected.id,
-        });
-        try {
-            await client.transport.json("/v1/tenant", "GET");
+        if (!chosen) {
+            throw new CliError(`No key of this Project authorizes Tenant ${selected.id}, and it has no derived "${PROJECT_PRINCIPAL_ID}" principal (Tenants created in Studio have one). Link a Tenant created in Studio, or create one with nylo tenant create.`, 1);
         }
-        catch {
-            throw new CliError(`Credentials do not authorize Tenant ${selected.id}. Create a new Tenant with nylo tenant create instead of reusing another Project's Tenant without its key.`, 1);
+        if (chosen !== current) {
+            // An application key is shown only once: keep the one being replaced.
+            if (current &&
+                link &&
+                link.tenantId !== selected.id &&
+                current.principalId !== PROJECT_PRINCIPAL_ID) {
+                await writeCredentials(root, current, link.tenantId);
+                console.warn(`Kept the key for Tenant ${link.tenantId} in .nylorun/credentials.${link.tenantId}.json; nylo tenant use ${link.tenantId} switches back.`);
+            }
+            await writeCredentials(root, chosen);
+            if (chosen === kept)
+                await removeCredentials(root, selected.id);
         }
         await writeLink(root, {
             format: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/cli",
-  "version": "0.4.2-beta",
+  "version": "0.5.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Nylorun Runtime client: Tenants, Project links and model providers",
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@nylorun/agents": "0.9.0-beta",
-    "@nylorun/admin": "0.4.1-beta",
+    "@nylorun/admin": "0.5.0-beta",
     "@earendil-works/pi-ai": "0.87.0"
   },
   "devDependencies": {