@nylorun/cli 0.6.0-beta → 0.8.0-beta

package/dist/model/host-model.js

@@ -1,38 +1,12 @@
 import { randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER, } from "@nylorun/agents";
-import { configureProvider } from "./configure.js";
-import { loadProjectEnvironment } from "../environment.js";
-function tenantHeaders(serverKey, tenantId) {
-    return {
-        authorization: `Bearer ${serverKey}`,
-        [TENANT_HEADER]: tenantId,
-        [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-    };
-}
-function resolveTenantId(explicit) {
-    const tenant = explicit?.trim() || process.env.NYLORUN_TENANT?.trim();
-    if (!tenant) {
-        throw new Error("Set NYLORUN_TENANT (or pass tenant via Project link) before calling Tenant model routes");
-    }
-    return tenant;
-}
-export async function getHostModel(runtimeUrl, serverKey, tenantId) {
-    const tenant = resolveTenantId(tenantId);
-    const response = await fetch(`${runtimeUrl}/v1/tenant/model`, {
-        headers: tenantHeaders(serverKey, tenant),
-    });
-    if (!response.ok)
-        throw new Error(`Runtime model status returned ${response.status}`);
-    return response.json();
-}
-export async function putHostModel(runtimeUrl, serverKey, model, tenantId) {
-    const tenant = resolveTenantId(tenantId);
-    const response = await fetch(`${runtimeUrl}/v1/tenant/model`, {
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/agents";
+/** Set the installation's Tenant model provider (`PUT /v1/tenant/model`). */
+export async function putHostModel(runtimeUrl, serverKey, model, fetchImpl = fetch) {
+    const response = await fetchImpl(`${runtimeUrl}/v1/tenant/model`, {
         method: "PUT",
         headers: {
-            ...tenantHeaders(serverKey, tenant),
+            authorization: `Bearer ${serverKey}`,
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
             "content-type": "application/json",
         },
         body: JSON.stringify({
@@ -50,57 +24,3 @@ export async function putHostModel(runtimeUrl, serverKey, model, tenantId) {
         throw new Error(body.message ?? `Runtime rejected the model provider (${response.status})`);
     return body;
 }
-export async function ensureHostModel(options) {
-    const current = await getHostModel(options.runtimeUrl, options.serverKey, options.tenantId);
-    if (current.configured)
-        return;
-    const env = options.env ?? loadProjectEnvironment(options.root ?? process.cwd());
-    if (env.NYLORUN_DEV_MODEL?.trim() === "fixture")
-        return;
-    const seeded = seedFromEnv(env, options.root ?? process.cwd());
-    if (seeded) {
-        await putHostModel(options.runtimeUrl, options.serverKey, seeded, options.tenantId);
-        return;
-    }
-    if (process.stdin.isTTY && process.stdout.isTTY) {
-        const prompted = await configureProvider({
-            root: options.root,
-            signal: options.signal,
-        });
-        await putHostModel(options.runtimeUrl, options.serverKey, prompted, options.tenantId);
-        return;
-    }
-    throw new Error("Model provider is not configured. Run nylo configure in a terminal to set it up, or open Studio.");
-}
-function seedFromEnv(env, root) {
-    const provider = env.MODEL_PROVIDER?.trim();
-    const model = env.MODEL?.trim();
-    if (!provider || !model)
-        return undefined;
-    const baseUrl = env.MODEL_PROVIDER_BASE_URL?.trim();
-    const key = env.MODEL_PROVIDER_API_KEY;
-    const auth = key
-        ? { type: "api_key", key }
-        : legacyCredential(root, provider);
-    if (!auth)
-        return undefined;
-    return {
-        provider,
-        model,
-        ...(baseUrl ? { baseUrl } : {}),
-        auth,
-    };
-}
-function legacyCredential(root, provider) {
-    for (const relative of [".nylorun/auth.json", ".env/auth.json"]) {
-        try {
-            const all = JSON.parse(readFileSync(join(root, relative), "utf8"));
-            const credential = all[provider];
-            if (credential?.type === "api_key" || credential?.type === "oauth")
-                return credential;
-        }
-        catch {
-            /* A project without a legacy credential file is set up interactively. */
-        }
-    }
-}

package/dist/project/connection.d.ts

@@ -0,0 +1,13 @@
+import { type ProjectLink } from "./link.js";
+/** The installation `nylo` acts on: a Runtime URL and an application key. */
+export interface LinkedConnection {
+    url: string;
+    key: string;
+    /** The Project link it came from, when it came from one. */
+    link?: ProjectLink;
+}
+/**
+ * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY`. The
+ * installation serves one Tenant, so nothing names it.
+ */
+export declare function linkedConnection(projectRoot: string, env?: Readonly<Record<string, string | undefined>>): Promise<LinkedConnection>;

package/dist/project/connection.js

@@ -0,0 +1,18 @@
+import { CliError } from "../errors.js";
+import { readCredentials } from "./credentials.js";
+import { readLink } from "./link.js";
+/**
+ * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY`. The
+ * installation serves one Tenant, so nothing names it.
+ */
+export async function linkedConnection(projectRoot, env = process.env) {
+    const link = await readLink(projectRoot);
+    const credentials = await readCredentials(projectRoot);
+    if (link && credentials)
+        return { url: link.hostUrl, key: credentials.applicationKey, link };
+    const url = env.NYLORUN_RUNTIME_URL?.trim();
+    const key = env.NYLORUN_SERVER_KEY?.trim();
+    if (url && key)
+        return { url: url.replace(/\/$/, ""), key };
+    throw new CliError(`No Project link in ${projectRoot}. Run "npx nylorun start" in this project to start its Tenant and link it, or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY.`, 1);
+}

package/dist/project/credentials.d.ts

@@ -7,11 +7,5 @@ export interface ProjectCredentials {
     applicationKey: string;
     principalId: string;
 }
-/** The Project's credentials, or with `tenantId` the key kept for that Tenant. */
-export declare function readCredentials(projectRoot: string, tenantId?: string): Promise<ProjectCredentials | undefined>;
-export declare function writeCredentials(projectRoot: string, credentials: {
-    applicationKey: string;
-    principalId: string;
-    format?: 0 | 1;
-}, tenantId?: string): Promise<void>;
-export declare function removeCredentials(projectRoot: string, tenantId?: string): Promise<void>;
+/** The Project's credentials, which `nylorun start` writes beside the link. */
+export declare function readCredentials(projectRoot: string): Promise<ProjectCredentials | undefined>;

package/dist/project/credentials.js

@@ -1,17 +1,16 @@
-import { chmod, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { randomUUID } from "node:crypto";
+import { chmod, readFile } from "node:fs/promises";
 import { CliError } from "../errors.js";
-import { credentialsPath, ensureProjectNylorunDir, } from "./link.js";
-/** The Project's credentials, or with `tenantId` the key kept for that Tenant. */
-export async function readCredentials(projectRoot, tenantId) {
-    const path = credentialsPath(projectRoot, tenantId);
+import { credentialsPath } from "./link.js";
+/** The Project's credentials, which `nylorun start` writes beside the link. */
+export async function readCredentials(projectRoot) {
+    const path = credentialsPath(projectRoot);
     try {
         const value = JSON.parse(await readFile(path, "utf8"));
         if (typeof value?.applicationKey !== "string" ||
             !/^[0-9a-f]{64}$/.test(value.applicationKey) ||
             typeof value?.principalId !== "string" ||
             value.principalId.length === 0) {
-            throw new CliError(`Invalid Project credentials at ${path}. Remove .nylorun/credentials.json and run nylo tenant create.`, 1);
+            throw new CliError(`Invalid Project credentials at ${path}. Remove .nylorun/credentials.json and run "npx nylorun start".`, 1);
         }
         const format = value.format === undefined || value.format === 0
             ? 0
@@ -34,25 +33,3 @@ export async function readCredentials(projectRoot, tenantId) {
         throw error;
     }
 }
-export async function writeCredentials(projectRoot, credentials, tenantId) {
-    await ensureProjectNylorunDir(projectRoot);
-    const path = credentialsPath(projectRoot, tenantId);
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    // Version 1 writes format 1 with only the application key and principal (D§3.7).
-    const body = `${JSON.stringify({
-        format: credentials.format ?? 1,
-        applicationKey: credentials.applicationKey,
-        principalId: credentials.principalId,
-    }, null, 2)}\n`;
-    try {
-        await writeFile(temporary, body, { mode: 0o600 });
-        await rename(temporary, path);
-        await chmod(path, 0o600);
-    }
-    finally {
-        await rm(temporary, { force: true });
-    }
-}
-export async function removeCredentials(projectRoot, tenantId) {
-    await rm(credentialsPath(projectRoot, tenantId), { force: true });
-}

package/dist/project/env.d.ts

@@ -1,3 +1,3 @@
-/** Three `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
 export declare function printLinkedEnvExports(projectRoot?: string): Promise<void>;
 export declare function shellQuote(value: string): string;

package/dist/project/env.js

@@ -1,18 +1,17 @@
 import { readCredentials } from "./credentials.js";
 import { readLink } from "./link.js";
 import { findProjectRoot } from "./root.js";
-/** Three `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
+/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
 export async function printLinkedEnvExports(projectRoot = process.cwd()) {
     const root = findProjectRoot(projectRoot) ?? projectRoot;
     const link = await readLink(root);
     const credentials = await readCredentials(root);
     if (!link || !credentials) {
-        console.log("# No Project link in this directory. Run nylo tenant create to create one.");
+        console.log('# No Project link in this directory. Run "npx nylorun start" in this project to start its Tenant and link it.');
         return;
     }
     console.log(`export NYLORUN_RUNTIME_URL=${shellQuote(link.hostUrl)}`);
     console.log(`export NYLORUN_SERVER_KEY=${shellQuote(credentials.applicationKey)}`);
-    console.log(`export NYLORUN_TENANT=${shellQuote(link.tenantId)}`);
 }
 export function shellQuote(value) {
     if (/^[A-Za-z0-9_./:-]+$/.test(value))

package/dist/project/link.d.ts

@@ -1,24 +1,17 @@
-/** Project-local link to a Runtime Host Tenant (D§3.7, format 0|1). */
+/**
+ * Project-local link to an installation (format 3). `nylorun start` writes it; `nylo` only
+ * reads it. `tenantId` is information: the installation serves one Tenant, so nothing selects it.
+ */
 export interface ProjectLink {
-    format: 0 | 1;
+    format: 3;
+    /** The local Tenant the link names (`~/.nylorun/tenants/<tenant>/`). */
+    tenant?: string;
     hostUrl: string;
     hostId: string;
-    tenantId: string;
+    tenantId?: string;
 }
 export declare function nylorunDir(projectRoot: string): string;
 export declare function linkPath(projectRoot: string): string;
-/**
- * `.nylorun/credentials.json`, or with `tenantId` the key `nylo tenant use`
- * kept for a Tenant the Project was linked to before (`credentials.<id>.json`).
- */
-export declare function credentialsPath(projectRoot: string, tenantId?: string): string;
-/**
- * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.
- * The Project's own `.gitignore` is never edited.
- */
-export declare function ensureProjectNylorunDir(projectRoot: string): Promise<string>;
+/** `.nylorun/credentials.json`. */
+export declare function credentialsPath(projectRoot: string): string;
 export declare function readLink(projectRoot: string): Promise<ProjectLink | undefined>;
-export declare function writeLink(projectRoot: string, link: Omit<ProjectLink, "format"> & {
-    format?: 0 | 1;
-}): Promise<void>;
-export declare function removeLink(projectRoot: string): Promise<void>;

package/dist/project/link.js

@@ -1,7 +1,5 @@
-import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { isTenantId } from "@nylorun/agents";
 import { CliError } from "../errors.js";
 export function nylorunDir(projectRoot) {
     return join(projectRoot, ".nylorun");
@@ -9,73 +7,46 @@ export function nylorunDir(projectRoot) {
 export function linkPath(projectRoot) {
     return join(nylorunDir(projectRoot), "link.json");
 }
-/**
- * `.nylorun/credentials.json`, or with `tenantId` the key `nylo tenant use`
- * kept for a Tenant the Project was linked to before (`credentials.<id>.json`).
- */
-export function credentialsPath(projectRoot, tenantId) {
-    return join(nylorunDir(projectRoot), tenantId === undefined ? "credentials.json" : `credentials.${tenantId}.json`);
-}
-/**
- * Create `.nylorun/` mode 0700 with a private `.gitignore` containing `*`.
- * The Project's own `.gitignore` is never edited.
- */
-export async function ensureProjectNylorunDir(projectRoot) {
-    const dir = nylorunDir(projectRoot);
-    await mkdir(dir, { recursive: true, mode: 0o700 });
-    await writeFile(join(dir, ".gitignore"), "*\n", { mode: 0o600 }).catch(async () => {
-        await writeFile(join(dir, ".gitignore"), "*\n", { mode: 0o600 });
-    });
-    return dir;
+/** `.nylorun/credentials.json`. */
+export function credentialsPath(projectRoot) {
+    return join(nylorunDir(projectRoot), "credentials.json");
 }
 export async function readLink(projectRoot) {
+    const path = linkPath(projectRoot);
+    let value;
+    let raw;
     try {
-        const value = JSON.parse(await readFile(linkPath(projectRoot), "utf8"));
-        if (typeof value?.hostUrl !== "string" ||
-            typeof value?.hostId !== "string" ||
-            typeof value?.tenantId !== "string" ||
-            !isTenantId(value.tenantId)) {
-            throw new CliError(`Invalid Project link at ${linkPath(projectRoot)}. Remove .nylorun/link.json and run nylo tenant create.`, 1);
-        }
-        const format = value.format === undefined || value.format === 0
-            ? 0
-            : value.format === 1
-                ? 1
-                : undefined;
-        if (format === undefined) {
-            throw new CliError(`Project link at ${linkPath(projectRoot)} has an unsupported format. Upgrade the CLI.`, 1);
-        }
-        return {
-            format,
-            hostUrl: value.hostUrl.replace(/\/$/, ""),
-            hostId: value.hostId,
-            tenantId: value.tenantId,
-        };
+        raw = await readFile(path, "utf8");
     }
     catch (error) {
         if (error.code === "ENOENT")
             return undefined;
         throw error;
     }
-}
-export async function writeLink(projectRoot, link) {
-    await ensureProjectNylorunDir(projectRoot);
-    const path = linkPath(projectRoot);
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    const body = `${JSON.stringify({
-        format: link.format ?? 1,
-        hostUrl: link.hostUrl.replace(/\/$/, ""),
-        hostId: link.hostId,
-        tenantId: link.tenantId,
-    }, null, 2)}\n`;
     try {
-        await writeFile(temporary, body, { mode: 0o600 });
-        await rename(temporary, path);
+        value = JSON.parse(raw);
     }
-    finally {
-        await rm(temporary, { force: true });
+    catch {
+        throw new CliError(`Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
     }
-}
-export async function removeLink(projectRoot) {
-    await rm(linkPath(projectRoot), { force: true });
+    // Formats 0 to 2 are from older releases.
+    if (value?.format === undefined ||
+        value.format === 0 ||
+        value.format === 1 ||
+        value.format === 2)
+        throw new CliError(`The Project link at ${path} is from an older nylorun. Run "npx nylorun start" in this project to link it again.`, 1);
+    if (value.format !== 3)
+        throw new CliError(`Project link at ${path} has an unsupported format. Upgrade the CLI.`, 1);
+    if (typeof value.hostUrl !== "string" ||
+        typeof value.hostId !== "string" ||
+        (value.tenant !== undefined && typeof value.tenant !== "string") ||
+        (value.tenantId !== undefined && typeof value.tenantId !== "string"))
+        throw new CliError(`Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
+    return {
+        format: 3,
+        ...(value.tenant ? { tenant: value.tenant } : {}),
+        hostUrl: value.hostUrl.replace(/\/$/, ""),
+        hostId: value.hostId,
+        ...(value.tenantId ? { tenantId: value.tenantId } : {}),
+    };
 }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@nylorun/cli",
-  "version": "0.6.0-beta",
+  "version": "0.8.0-beta",
   "type": "module",
   "license": "Apache-2.0",
-  "description": "Nylorun Runtime client: Tenants, Project links and model providers",
+  "description": "Nylorun Runtime client: the linked installation's Tenant, its access and its model provider",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nylorun/agents.git",
@@ -30,8 +30,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/agents": "0.10.0-beta",
-    "@nylorun/admin": "0.6.0-beta",
+    "@nylorun/agents": "0.12.0-beta",
+    "@nylorun/admin": "0.8.0-beta",
     "@earendil-works/pi-ai": "0.99.1"
   },
   "devDependencies": {

package/dist/project/create-tenant.d.ts

@@ -1,28 +0,0 @@
-import { type Admin } from "@nylorun/admin";
-import { type ProjectCredentials } from "./credentials.js";
-import { type ProjectLink } from "./link.js";
-export interface CreateTenantOptions {
-    /** Prefer an already-resolved Admin (local Host or explicit). */
-    admin: Admin;
-    hostId: string;
-    projectRoot: string;
-    name?: string;
-    /** Override Host URL written into the link (defaults to admin.url). */
-    hostUrl?: string;
-}
-export interface CreateTenantResult {
-    link: ProjectLink;
-    credentials: ProjectCredentials;
-    envelope: {
-        id: string;
-        name: string;
-    };
-}
-/** The Project's `package.json` name, else its directory name. */
-export declare function defaultTenantName(projectRoot: string): Promise<string>;
-/**
- * Create a Tenant via `@nylorun/admin` and write format-1 link + credentials.
- */
-export declare function createProjectTenant(options: CreateTenantOptions): Promise<CreateTenantResult>;
-/** Resolve Admin from the local Host root (host.json and the admin key). */
-export declare function localAdmin(home?: string): Admin;

package/dist/project/create-tenant.js

@@ -1,66 +0,0 @@
-import { readFile } from "node:fs/promises";
-import { basename, join } from "node:path";
-import { createAdmin } from "@nylorun/admin";
-import { newPrincipalId } from "@nylorun/agents";
-import { CliError } from "../errors.js";
-import { writeCredentials, } from "./credentials.js";
-import { writeLink } from "./link.js";
-/** The Project's `package.json` name, else its directory name. */
-export async function defaultTenantName(projectRoot) {
-    try {
-        const pkg = JSON.parse(await readFile(join(projectRoot, "package.json"), "utf8"));
-        if (typeof pkg.name === "string" && pkg.name.trim())
-            return pkg.name.trim();
-    }
-    catch {
-        /* fall through */
-    }
-    const base = basename(projectRoot);
-    return base && base.length > 0 ? base : "project";
-}
-/**
- * Create a Tenant via `@nylorun/admin` and write format-1 link + credentials.
- */
-export async function createProjectTenant(options) {
-    const name = options.name ?? (await defaultTenantName(options.projectRoot));
-    const admin = options.admin;
-    let created;
-    try {
-        created = await admin.createTenant({ name });
-    }
-    catch (error) {
-        throw new CliError(error instanceof Error
-            ? error.message
-            : `Could not create Tenant: ${String(error)}`, 1);
-    }
-    const hostUrl = (options.hostUrl ?? admin.url).replace(/\/$/, "");
-    // CLIENTS-CCR: admin.createTenant should also return principalId (D§4.2 /
-    // credentials.json). Until then, mint a local id for the credentials file;
-    // agents resolveConnection only needs applicationKey.
-    const principalId = "principalId" in created &&
-        typeof created.principalId === "string"
-        ? created.principalId
-        : newPrincipalId();
-    const credentials = {
-        format: 1,
-        applicationKey: created.applicationKey,
-        principalId,
-    };
-    const link = {
-        format: 1,
-        hostUrl,
-        hostId: options.hostId,
-        tenantId: created.tenant.id,
-    };
-    await writeCredentials(options.projectRoot, credentials);
-    await writeLink(options.projectRoot, link);
-    return {
-        link,
-        credentials,
-        envelope: { id: created.tenant.id, name: created.tenant.name },
-    };
-}
-/** Resolve Admin from the local Host root (host.json and the admin key). */
-export function localAdmin(home) {
-    return createAdmin(home ? { home } : undefined);
-}

package/dist/project/seed.d.ts

@@ -1,25 +0,0 @@
-export interface SeedOptions {
-    hostUrl: string;
-    tenantId: string;
-    applicationKey: string;
-    projectRoot: string;
-    /** Pre-loaded env map; when omitted, read `.env` without mutating process.env. */
-    env?: Readonly<Record<string, string>>;
-    fetchImpl?: typeof fetch;
-    signal?: AbortSignal;
-    /**
-     * Seed the Tenant-level fixture model (`fixtureModel: true`, Host feature
-     * `tenant-fixture-model`) and skip the Project's model credential.
-     */
-    fixtureModel?: boolean;
-}
-/**
- * Seed non-secret Tenant config via `PUT /v1/tenant/config/seed`.
- * Model secrets go through the model route into the Tenant vault (F3).
- * `.env` is read as a value map only — never written back or applied to process.env.
- */
-export declare function seedTenantFromProject(options: SeedOptions): Promise<{
-    applied: string[];
-    kept: string[];
-    model?: string;
-}>;

package/dist/project/seed.js

@@ -1,96 +0,0 @@
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { randomUUID } from "node:crypto";
-import { PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER, } from "@nylorun/agents";
-import { CliError } from "../errors.js";
-import { putHostModel } from "../model/host-model.js";
-import { loadProjectEnvironment } from "../environment.js";
-function tenantHeaders(applicationKey, tenantId) {
-    return {
-        authorization: `Bearer ${applicationKey}`,
-        [TENANT_HEADER]: tenantId,
-        [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-    };
-}
-/**
- * Seed non-secret Tenant config via `PUT /v1/tenant/config/seed`.
- * Model secrets go through the model route into the Tenant vault (F3).
- * `.env` is read as a value map only — never written back or applied to process.env.
- */
-export async function seedTenantFromProject(options) {
-    const env = options.env ?? loadProjectEnvironment(options.projectRoot);
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const sandboxRaw = env.NYLORUN_SANDBOX?.trim();
-    const sandbox = sandboxRaw === "auto" || sandboxRaw === "virtual"
-        ? { backend: sandboxRaw }
-        : undefined;
-    let applied = [];
-    let kept = [];
-    if (sandbox || options.fixtureModel) {
-        const response = await fetchImpl(`${options.hostUrl.replace(/\/$/, "")}/v1/tenant/config/seed`, {
-            method: "PUT",
-            headers: {
-                ...tenantHeaders(options.applicationKey, options.tenantId),
-                "content-type": "application/json",
-            },
-            body: JSON.stringify({
-                requestId: randomUUID(),
-                ...(sandbox ? { sandbox } : {}),
-                ...(options.fixtureModel ? { fixtureModel: true } : {}),
-            }),
-            signal: options.signal ?? AbortSignal.timeout(15_000),
-        });
-        if (!response.ok) {
-            throw new CliError(`Tenant config seed failed (${response.status}): ${await response
-                .text()
-                .catch(() => "")}`, 1);
-        }
-        const body = (await response.json());
-        applied = body.applied ?? [];
-        kept = body.kept ?? [];
-    }
-    // A fixture-model Tenant never calls a real model: its credential stays out of it.
-    let model;
-    if (!options.fixtureModel && env.NYLORUN_DEV_MODEL?.trim() !== "fixture") {
-        const seeded = modelFromEnv(env, options.projectRoot);
-        if (seeded) {
-            await putHostModel(options.hostUrl, options.applicationKey, seeded, options.tenantId);
-            model = `${seeded.provider}/${seeded.model}`;
-        }
-    }
-    return { applied, kept, ...(model ? { model } : {}) };
-}
-function modelFromEnv(env, projectRoot) {
-    const provider = env.MODEL_PROVIDER?.trim();
-    const model = env.MODEL?.trim();
-    if (!provider || !model)
-        return undefined;
-    const baseUrl = env.MODEL_PROVIDER_BASE_URL?.trim();
-    const key = env.MODEL_PROVIDER_API_KEY;
-    if (key) {
-        return {
-            provider,
-            model,
-            ...(baseUrl ? { baseUrl } : {}),
-            auth: { type: "api_key", key },
-        };
-    }
-    for (const relative of [".nylorun/auth.json", ".env/auth.json"]) {
-        try {
-            const all = JSON.parse(readFileSync(join(projectRoot, relative), "utf8"));
-            const credential = all[provider];
-            if (credential?.type === "api_key" || credential?.type === "oauth") {
-                return {
-                    provider,
-                    model,
-                    ...(baseUrl ? { baseUrl } : {}),
-                    auth: credential,
-                };
-            }
-        }
-        catch {
-            /* absent */
-        }
-    }
-    return undefined;
-}

package/dist/tenant/commands.d.ts

@@ -1,18 +0,0 @@
-import { type AdminTenant } from "@nylorun/admin";
-/** Exact-and-unique name or id match. */
-export declare function matchTenant(tenants: readonly AdminTenant[], nameOrId: string): AdminTenant;
-export declare function tenantCommand(args: readonly string[]): Promise<void>;
-/** One line of `nylo tenant endpoints`: the agent, its URL and version, and how it is doing. */
-export declare function endpointLine(endpoint: {
-    agentId: string;
-    url: string;
-    implementationVersion: string;
-    health: {
-        consecutiveFailures: number;
-        lastSuccessAt?: string;
-        lastError?: {
-            code: string;
-            message: string;
-        };
-    };
-}): string;