@nylorun/cli 0.7.0-beta → 0.9.0-beta

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @nylorun/cli
 
+## 0.9.0-beta
+
+### Major Changes
+
+- b352feb: **File artifacts, message parts and capability links (protocol 6).** Upgrade these with the Runtime: they speak protocol 6, which this Runtime serves beside 4 and 5. See MIGRATION.md.
+
+  - **`@nylorun/runtime`: file artifacts.** A file is an artifact: an `af_` id, a name and numbered immutable versions, with rows in the new `artifacts` and `artifact_versions` tables (migration `0004_artifacts`) and bytes in the Object store (`BlobStore`). `POST /v1/artifacts?name=&sessionId=` uploads a file in one streamed request and `POST /v1/artifacts/{id}/versions` adds a version, within the Tenant's limits (`GET`/`PUT /v1/tenant/artifacts`: 100 MiB per file and 10 GiB in all by default); a body past either is `413 limit_exceeded`, refused mid-stream with nothing stored. `GET /v1/artifacts` lists them (by session), `GET /v1/artifacts/{id}` reads one with its versions, `GET /v1/artifacts/{id}/versions/{n|latest}/content` downloads through the Runtime with HTTP Range (`206`, `Content-Range`, `416`), and `DELETE /v1/artifacts/{id}` deletes it with its bytes. A session's artifacts go with it on a sessions reset, and appear in its history as `artifact.created`, `artifact.version.created` and `artifact.deleted` (new in the event catalog). A subject reaches only the artifacts of their own sessions.
+  - **`@nylorun/runtime`: capability links.** `POST /v1/artifacts/{id}/links` mints a short-lived path, `/v1/artifact-links/<token>`, that downloads one version (with Range) with no credential and no `Nylorun-Protocol`: an ES256 JWT (`typ: nylorun-artifact+jwt`) signed with the Tenant's signing key, at most 15 minutes, and dead once the artifact is deleted. The Host logs its path without the token.
+  - **Breaking (`@nylorun/core`, `@nylorun/runtime`): message `parts`.** A user message may carry `parts`: `text`, and `file` by `artifactId` (and `version`, else the latest, pinned when the message is accepted). Model-gate reads the file from the Object store: an image goes to the model as image input, a text file as text, and any other file fails the call (`invalid_request`). The record and the transcript hold only the reference. The gateway builds its `BlobStore` from `NYLORUN_OBJECT_STORE_*` (the Tenant's `fs` store without it). `PROTOCOL_VERSION` is 6; `HOST_PROTOCOL` is 4–6 and protocol 6 clients require the feature `artifacts`.
+  - **`@nylorun/runtime`: `save_artifact`.** A session with a sandbox gets the `nylorun.artifacts` capability, whose `save_artifact` tool saves a sandbox file (`path`) or text (`content`) as an artifact of the session, carrying the turn and tool call on its event.
+  - **Breaking (`@nylorun/runtime`): `MediaStore` is removed.** `MediaStore` and `localMedia` leave `@nylorun/runtime/node`, and `piModel` takes `files` (a resolver from an artifact reference to its bytes) instead of `media`; images are file artifacts. The image checks (`decodeImageBase64`, `validateImageBytes`, `IMAGE_MEDIA_TYPES`, `MAX_IMAGE_BYTES`) stay.
+  - **`@nylorun/agents`:** `client.artifacts` (`upload`, `uploadVersion`, `list`, `get`, `download` with a range, `link`, `delete`), also on `BrowserClient`, and `session.inputParts(parts)`. A request with a body of its own type keeps it.
+  - `@nylorun/admin`, `@nylorun/cli`, `nylorun`, `@nylorun/studio`: speak protocol 6.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [b352feb]
+- Updated dependencies [6077272]
+- Updated dependencies [926711b]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.13.0-beta
+  - @nylorun/admin@0.9.0-beta
+
+## 0.8.0-beta
+
+### Minor Changes
+
+- 4b9906f: **Breaking: "Tenant" replaces "stack", and `nylorun start` works anywhere.** Each local installation holds one Tenant, and its name is the Tenant's name, so help, output, errors and docs say Tenant. See MIGRATION.md.
+
+  - **Breaking (`nylorun`): selection.** Every command acts on the Tenant `--tenant <name>` names (replaces `--name`, which is removed), else `NYLORUN_TENANT` (replaces `NYLORUN_STACK`), else the Project link's `tenant`; `start` in a project names a new one after the project directory. Outside a project, or with `start --no-link`, commands act on the Tenant `default`. In a project without a link, commands other than `start` exit 2 and list the machine's Tenants. A name starting with `tn_` (a Tenant id) is refused.
+  - **Breaking (`nylorun`): files.** Host roots are under `~/.nylorun/tenants/<name>/` (was `~/.nylorun/stacks/<name>/`) with `tenant.json` (was `stack.json`); the `.env` key is `NYLORUN_TENANT_NAME` (was `NYLORUN_STACK_NAME`); `NYLORUN_COMPOSE_PROJECT` replaces `NYLORUN_STACK_PROJECT`. Compose projects stay `nylorun-<name>`. Every command first moves 0.4 Host roots from `~/.nylorun/stacks/` to `~/.nylorun/tenants/` (renaming `stack.json` and the `.env` key), so they keep their volumes and keys. `nylorun ls` lists only directories with `tenant.json`.
+  - **Breaking (`nylorun`): removed.** `nylorun legacy` and all handling of the single stack of releases before 0.4; the hidden `nylorun stack <cmd>` alias; `nylorun doctor stack|runtime`. Output says Tenant: `ls` prints `TENANT` and JSON `{ "tenants": [...] }`, `status` prints the Tenant id on its own line, and `doctor`'s row is `tenant`.
+  - **Breaking: Project link format 3.** `.nylorun/link.json` is `{ "format": 3, "tenant", "tenantId", "hostUrl", "hostId" }`; `tenant` replaces `stack`. `@nylorun/agents`, `@nylorun/cli` and `@nylorun/admin` refuse an older link and name `npx nylorun start`, which rewrites it. `@nylorun/core`'s `ProjectLinkFileSchema` parses formats 0–3 with `tenant`.
+  - **Breaking (`@nylorun/admin`):** `createAdmin({ tenant })` replaces `{ stack }`, `tenantHostRoot(name)` replaces `stackHostRoot(name)`, and local resolution reads `NYLORUN_TENANT` and the link's `tenant`.
+  - `@nylorun/cli`: `status` and `endpoints` drop the `stack` line and JSON key; messages say Tenant. `@nylorun/agents`: a Runtime too old for the client says "update the Runtime (npx nylorun@latest start)". `@nylorun/studio`: setup hints say Tenant. `@nylorun/create-agent`: the next steps describe `npx nylorun@beta start` as this project's Tenant and its link.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [4b9906f]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.12.0-beta
+  - @nylorun/admin@0.8.0-beta
+
 ## 0.7.0-beta
 
 ### Major Changes

package/README.md

@@ -1,21 +1,21 @@
 # @nylorun/cli
 
 The Runtime client, command `nylo`: it acts on the one Tenant of an
-installation, a local stack or any Runtime reachable by URL and key. Setting up
-and running the local stack is [`nylorun`](../nylorun/README.md)'s job; the two
+installation, a local Tenant or any Runtime reachable by URL and key. Setting up
+and running local Tenants is [`nylorun`](../nylorun/README.md)'s job; the two
 packages are independent and never call each other. Depends on
 `@nylorun/agents` and `@nylorun/admin` only among Nylorun packages. Vocabulary:
 [runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
 
 ```sh
-npx nylorun start                     # in the project: its stack, its Tenant and the Project link
+npx nylorun start                     # in the project: its Tenant and the Project link
 npx @nylorun/cli status               # the linked Tenant
 ```
 
 ## Commands
 
 ```sh
-nylo status [--json]                  # the Tenant, its checks and counts, and the link's stack
+nylo status [--json]                  # the Tenant, its checks and counts
 nylo reset [--sessions|--sandboxes|--all] [--yes]
 nylo endpoints [--json]|ping <agent>  # the registered Action endpoints and their health
 nylo access …                         # access policy, publishable and signing keys, subject tokens
@@ -28,9 +28,9 @@ Every command acts on the linked installation: the Project link and
 credentials (below), or `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` when the
 Project has no link. An installation serves one Tenant, so nothing selects it.
 
-Local stack commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
+Local Tenant commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
 naming `npx nylorun <command>`. `nylo tenant …` exits 2: `npx nylorun start`
-creates the stack, its Tenant and the link, and `nylo status|reset|endpoints`
+creates the project's Tenant and the link, and `nylo status|reset|endpoints`
 replace `nylo tenant status|reset|endpoints`. `nylorun dev` was removed: run
 `npx nylorun start` once, then the project's own `npm run dev`
 (`tsx watch src/main.ts`).
@@ -38,9 +38,9 @@ replace `nylo tenant status|reset|endpoints`. `nylorun dev` was removed: run
 ## `nylo status`
 
 Reads the Tenant API status (`GET /v1/tenant`) and prints the Tenant, the
-stack the link names, the Runtime URL, the checks, the counts and the sandbox
+Runtime URL, the checks, the counts and the sandbox
 backend. When the Tenant is not open it does not answer; `nylo status` then
-asks the Admin API (`/v1/admin/status`, through the local stack's Host root or
+asks the Admin API (`/v1/admin/status`, through the local Tenant's Host root or
 `NYLORUN_ADMIN_URL` and `NYLORUN_ADMIN_KEY`) and prints why, with the repair.
 
 ## `nylo reset`
@@ -53,15 +53,14 @@ not in a terminal. The Project link and credentials are kept.
 
 `npx nylorun start` writes it; `nylo` only reads it. A **Project** stores only:
 
-- `.nylorun/link.json`: `{ format: 2, stack, hostUrl, hostId, tenantId }`
-  (`tenantId` is information)
+- `.nylorun/link.json`: `{ format: 3, tenant, hostUrl, hostId, tenantId }`
+  (`tenant` is the local Tenant's name; `tenantId` is information)
 - `.nylorun/credentials.json`: the key of the derived principal `project` and
   its id (0600)
 - `.nylorun/.gitignore` containing `*`
 
-A format 0 or 1 link named a Tenant on an older multi-Tenant Host: `nylo`
-refuses it and says to run `npx nylorun start`, which starts the project's own
-stack and links it again.
+A link from an older nylorun (format 0 to 2): `nylo` refuses it and says to run
+`npx nylorun start`, which links the project again.
 
 `createActionHandler` and `createClient` in `@nylorun/agents` read the link (or
 the two variables), so the project's `npm run dev` and `npm start` need no

package/dist/cli.js

@@ -12,7 +12,7 @@ const usage = `nylo <status|reset|endpoints|access|configure|env|doctor>
 
 Runtime client for the linked installation and its one Tenant (the Project link that
 npx nylorun start writes, or NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY):
-  status [--json]                         the Tenant, its checks and counts, and the stack
+  status [--json]                         the Tenant, its checks and counts
   reset [--sessions|--sandboxes|--all] [--yes]
                                           clear the Tenant's sessions, sandboxes or all its data
   endpoints [--json]|ping <agent>         the registered Action endpoints and their health
@@ -25,14 +25,14 @@ npx nylorun start writes, or NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY):
   env                                     print the linked Project's NYLORUN_* variables as exports
   doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
 
-The local stack is managed by the nylorun package: npx nylorun start in a project creates
-its stack, its Tenant and the Project link.`;
-/** Local stack commands, which moved to the nylorun package. */
-const STACK_COMMANDS = new Set([
-    "up", "down", "start", "stop", "logs", "studio", "stack", "runtime", "restart", "run",
+Local Tenants are run by the nylorun package: npx nylorun start in a project creates its
+Tenant and the Project link.`;
+/** Local Tenant commands, which the nylorun package runs. */
+const LOCAL_COMMANDS = new Set([
+    "up", "down", "start", "stop", "logs", "studio", "runtime", "restart", "run",
 ]);
 const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
-Run "npx nylorun start" in your project to create its stack, its Tenant and the Project link.
+Run "npx nylorun start" in your project to create its Tenant and the Project link.
 Then use nylo status, nylo reset and nylo endpoints on the linked installation.`;
 function parseFlags(args, allowed = {}) {
     const booleans = new Set();
@@ -99,15 +99,15 @@ async function main() {
     if (command === "doctor") {
         const [topic, ...options] = args;
         if (topic !== "sandbox" || options.some((option) => option !== "--json"))
-            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local stack with npx nylorun doctor.");
+            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local Tenant with npx nylorun doctor.");
         const { doctorSandbox } = await import("./doctor.js");
         await doctorSandbox({ json: options.includes("--json") });
         return;
     }
     if (command === "dev")
         throw usageError('nylorun dev was removed: run "npx nylorun start" once in your project, then your project\'s npm run dev.');
-    if (STACK_COMMANDS.has(command))
-        throw usageError(`The local stack moved to the nylorun package: npx nylorun ${command}`);
+    if (LOCAL_COMMANDS.has(command))
+        throw usageError(`Local Tenants are run by the nylorun package: npx nylorun ${command}`);
     if (command === "configure") {
         const flags = parseFlags(args);
         if (flags.rest.length)
@@ -120,7 +120,7 @@ async function main() {
         process.once("SIGTERM", () => cancel("SIGTERM"));
         const health = await fetch(`${auth.url}/health`).catch(() => undefined);
         if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local stack with "npx nylorun start".`, 6);
+            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local Tenant with "npx nylorun start".`, 6);
         const catalog = await fetchModelCatalog({ url: auth.url, key: auth.key });
         const prompted = await configureProvider({
             signal: controller.signal,

package/dist/home.d.ts

@@ -1,6 +1,6 @@
 /**
  * Where `nylo` keeps its own files (the installation id): an explicit home,
- * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local stacks' Host roots
- * (`stacks/<name>/`). `@nylorun/admin` resolves a stack's Host root itself.
+ * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local Tenants' Host roots
+ * (`tenants/<name>/`). `@nylorun/admin` resolves a Tenant's Host root itself.
  */
 export declare function resolveHome(home?: string, env?: Readonly<Record<string, string | undefined>>): string;

package/dist/home.js

@@ -2,8 +2,8 @@ import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 /**
  * Where `nylo` keeps its own files (the installation id): an explicit home,
- * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local stacks' Host roots
- * (`stacks/<name>/`). `@nylorun/admin` resolves a stack's Host root itself.
+ * `NYLORUN_HOME`, or `~/.nylorun`, which holds the local Tenants' Host roots
+ * (`tenants/<name>/`). `@nylorun/admin` resolves a Tenant's Host root itself.
  */
 export function resolveHome(home, env = process.env) {
     if (home !== undefined && home.trim() !== "")

package/dist/installation/commands.js

@@ -18,17 +18,14 @@ export async function statusCommand(args) {
         throw new CliError("Usage: nylo status [--json]", 2);
     const root = projectRoot();
     const connection = await linkedConnection(root);
-    const stack = connection.link?.stack;
     let reason;
     try {
         const body = await clientFor(connection).transport.json("/v1/tenant", "GET");
         if (json) {
-            console.log(JSON.stringify({ ...(stack ? { stack } : {}), ...body }, null, 2));
+            console.log(JSON.stringify(body, null, 2));
             return;
         }
         console.log(`${body.tenant.name}  ${body.tenant.id}`);
-        if (stack)
-            console.log(`stack    ${stack}`);
         console.log(`runtime  ${connection.url}`);
         console.log(`path     ${body.path}`);
         console.log(`checks   ${Object.entries(body.checks)
@@ -52,12 +49,10 @@ export async function statusCommand(args) {
             : `The Tenant at ${connection.url} is not reachable.`, 1);
     }
     if (json) {
-        console.log(JSON.stringify({ ...(stack ? { stack } : {}), tenant }, null, 2));
+        console.log(JSON.stringify({ tenant }, null, 2));
         return;
     }
     console.log(`${tenant.name ?? "(unreadable)"}  ${tenant.id ?? "(unknown)"}  ${tenant.state}`);
-    if (stack)
-        console.log(`stack    ${stack}`);
     console.log(`runtime  ${connection.url}`);
     if (tenant.cause) {
         console.log(`reason   ${tenant.cause.code}: ${tenant.cause.message}`);
@@ -76,10 +71,10 @@ export async function resetCommand(args) {
         throw new CliError("Pass only one of --sessions, --sandboxes, --all.", 2);
     const scope = flags.length ? SCOPES[flags[0]] : "sessions";
     const connection = await linkedConnection(projectRoot());
-    const stack = connection.link?.stack;
-    const where = stack ? `stack ${stack} (${connection.url})` : connection.url;
+    const tenant = connection.link?.tenant;
+    const target = tenant ? `Tenant ${tenant} (${connection.url})` : `the Tenant on ${connection.url}`;
     if (scope === "all" && !yes)
-        await confirmOrThrow(`Reset ALL data of the Tenant on ${where}? The Project link and credentials are kept. [y/N] `);
+        await confirmOrThrow(`Reset ALL data of ${target}? The Project link and credentials are kept. [y/N] `);
     try {
         await clientFor(connection).transport.json("/v1/tenant/reset", "POST", {
             requestId: randomUUID(),
@@ -90,7 +85,7 @@ export async function resetCommand(args) {
     catch (error) {
         throw new CliError(error instanceof Error ? error.message : `Tenant reset failed: ${String(error)}`, 1);
     }
-    console.log(`Reset the Tenant on ${where} (${scope}).`);
+    console.log(`Reset ${target} (${scope}).`);
 }
 async function confirmOrThrow(prompt) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {

package/dist/project/connection.js

@@ -14,5 +14,5 @@ export async function linkedConnection(projectRoot, env = process.env) {
     const key = env.NYLORUN_SERVER_KEY?.trim();
     if (url && key)
         return { url: url.replace(/\/$/, ""), key };
-    throw new CliError(`No Project link in ${projectRoot}. Run "npx nylorun start" in this project to start its stack and link it, or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY.`, 1);
+    throw new CliError(`No Project link in ${projectRoot}. Run "npx nylorun start" in this project to start its Tenant and link it, or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY.`, 1);
 }

package/dist/project/env.js

@@ -7,7 +7,7 @@ export async function printLinkedEnvExports(projectRoot = process.cwd()) {
     const link = await readLink(root);
     const credentials = await readCredentials(root);
     if (!link || !credentials) {
-        console.log('# No Project link in this directory. Run "npx nylorun start" in this project to start its stack and link it.');
+        console.log('# No Project link in this directory. Run "npx nylorun start" in this project to start its Tenant and link it.');
         return;
     }
     console.log(`export NYLORUN_RUNTIME_URL=${shellQuote(link.hostUrl)}`);

package/dist/project/link.d.ts

@@ -1,11 +1,11 @@
 /**
- * Project-local link to an installation (format 2). `nylorun start` writes it; `nylo` only
+ * Project-local link to an installation (format 3). `nylorun start` writes it; `nylo` only
  * reads it. `tenantId` is information: the installation serves one Tenant, so nothing selects it.
  */
 export interface ProjectLink {
-    format: 2;
-    /** The local stack the link names (`~/.nylorun/stacks/<stack>/`). */
-    stack?: string;
+    format: 3;
+    /** The local Tenant the link names (`~/.nylorun/tenants/<tenant>/`). */
+    tenant?: string;
     hostUrl: string;
     hostId: string;
     tenantId?: string;

package/dist/project/link.js

@@ -29,19 +29,22 @@ export async function readLink(projectRoot) {
     catch {
         throw new CliError(`Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
     }
-    // Formats 0 and 1 named a Tenant on a multi-Tenant Host of an older Runtime.
-    if (value?.format === undefined || value.format === 0 || value.format === 1)
-        throw new CliError(`The Project link at ${path} is for a stack of an older Runtime, before one Tenant per installation. Run "npx nylorun start" in this project to start its own stack and link it again.`, 1);
-    if (value.format !== 2)
+    // Formats 0 to 2 are from older releases.
+    if (value?.format === undefined ||
+        value.format === 0 ||
+        value.format === 1 ||
+        value.format === 2)
+        throw new CliError(`The Project link at ${path} is from an older nylorun. Run "npx nylorun start" in this project to link it again.`, 1);
+    if (value.format !== 3)
         throw new CliError(`Project link at ${path} has an unsupported format. Upgrade the CLI.`, 1);
     if (typeof value.hostUrl !== "string" ||
         typeof value.hostId !== "string" ||
-        (value.stack !== undefined && typeof value.stack !== "string") ||
+        (value.tenant !== undefined && typeof value.tenant !== "string") ||
         (value.tenantId !== undefined && typeof value.tenantId !== "string"))
         throw new CliError(`Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
     return {
-        format: 2,
-        ...(value.stack ? { stack: value.stack } : {}),
+        format: 3,
+        ...(value.tenant ? { tenant: value.tenant } : {}),
         hostUrl: value.hostUrl.replace(/\/$/, ""),
         hostId: value.hostId,
         ...(value.tenantId ? { tenantId: value.tenantId } : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/cli",
-  "version": "0.7.0-beta",
+  "version": "0.9.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Nylorun Runtime client: the linked installation's Tenant, its access and its model provider",
@@ -30,14 +30,14 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/agents": "0.11.0-beta",
-    "@nylorun/admin": "0.7.0-beta",
+    "@nylorun/agents": "0.13.0-beta",
+    "@nylorun/admin": "0.9.0-beta",
     "@earendil-works/pi-ai": "0.99.1"
   },
   "devDependencies": {
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "@types/node": "^26.5.0",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.2"
   },
   "bin": {
     "nylo": "dist/cli.js"