nylorun 0.3.0-beta → 0.5.0-beta

package/dist/project/derived-key.d.ts

@@ -0,0 +1,8 @@
+/** The derived principal a Project uses; the local Runtime registers it on its Tenant. */
+export declare const PROJECT_PRINCIPAL_ID = "project";
+/**
+ * Key of a derived principal on the local Tenant, from the admin key. A copy of
+ * `deriveTenantKey` in `@nylorun/admin` (nylorun depends on `@nylorun/core` only); both are
+ * tested against the same fixed vector.
+ */
+export declare function deriveTenantKey(adminKey: string, tenantId: string, principalId: string): string;

package/dist/project/derived-key.js

@@ -0,0 +1,18 @@
+import { createHmac } from "node:crypto";
+/** The derived principal a Project uses; the local Runtime registers it on its Tenant. */
+export const PROJECT_PRINCIPAL_ID = "project";
+/**
+ * Key of a derived principal on the local Tenant, from the admin key. A copy of
+ * `deriveTenantKey` in `@nylorun/admin` (nylorun depends on `@nylorun/core` only); both are
+ * tested against the same fixed vector.
+ */
+export function deriveTenantKey(adminKey, tenantId, principalId) {
+    const message = Buffer.concat([
+        Buffer.from("nylorun/principal/v1", "utf8"),
+        Buffer.from([0]),
+        Buffer.from(principalId, "utf8"),
+        Buffer.from([0]),
+        Buffer.from(tenantId, "utf8"),
+    ]);
+    return createHmac("sha256", Buffer.from(adminKey, "utf8")).update(message).digest("hex");
+}

package/dist/project/link.d.ts

@@ -1,6 +1,34 @@
 /**
- * The linked Project's Tenant id, read from `.nylorun/link.json`, or undefined
- * outside a linked Project. nylorun only reads the link: `@nylorun/cli` writes
- * it when it creates or chooses a Tenant.
+ * The Project link (`.nylorun/link.json`) and credentials (`.nylorun/credentials.json`).
+ * `nylorun start` writes both, format 3: the local Tenant's name, its URL and Host id, and
+ * the Tenant id as information (nothing in a request selects a Tenant). `start` replaces a link
+ * of an older format.
  */
-export declare function linkedTenantId(cwd?: string): Promise<string | undefined>;
+export interface ProjectLink {
+    format: 0 | 1 | 2 | 3;
+    /** The local Tenant's name (format 3). */
+    tenant?: string;
+    hostUrl: string;
+    hostId: string;
+    tenantId?: string;
+}
+export declare function linkPath(projectRoot: string): string;
+export declare function credentialsPath(projectRoot: string): string;
+/** The Project's link, or undefined when it has none. An unreadable link is an error. */
+export declare function readProjectLink(projectRoot: string): Promise<ProjectLink | undefined>;
+export declare function writeProjectLink(projectRoot: string, link: {
+    tenant: string;
+    hostUrl: string;
+    hostId: string;
+    tenantId: string;
+}): Promise<void>;
+/** The Project's application key and principal, or undefined when absent or unreadable. */
+export declare function readProjectCredentials(projectRoot: string): Promise<{
+    applicationKey: string;
+    principalId: string;
+} | undefined>;
+/** `.nylorun/credentials.json` (format 1, mode 0600). */
+export declare function writeProjectCredentials(projectRoot: string, credentials: {
+    applicationKey: string;
+    principalId: string;
+}): Promise<void>;

package/dist/project/link.js

@@ -1,21 +1,90 @@
-import { readFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { isTenantId } from "@nylorun/core/compatibility";
-import { findProjectRoot } from "./root.js";
-/**
- * The linked Project's Tenant id, read from `.nylorun/link.json`, or undefined
- * outside a linked Project. nylorun only reads the link: `@nylorun/cli` writes
- * it when it creates or chooses a Tenant.
- */
-export async function linkedTenantId(cwd = process.cwd()) {
-    const root = findProjectRoot(cwd);
-    if (!root)
-        return undefined;
+import { ProjectLinkFileSchema } from "@nylorun/core/contracts";
+import { CliError } from "../errors.js";
+export function linkPath(projectRoot) {
+    return join(projectRoot, ".nylorun", "link.json");
+}
+export function credentialsPath(projectRoot) {
+    return join(projectRoot, ".nylorun", "credentials.json");
+}
+/** The Project's link, or undefined when it has none. An unreadable link is an error. */
+export async function readProjectLink(projectRoot) {
+    let text;
+    try {
+        text = await readFile(linkPath(projectRoot), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        value = undefined;
+    }
+    const parsed = ProjectLinkFileSchema.safeParse(value);
+    if (!parsed.success)
+        throw new CliError(`Invalid or newer Project link at ${linkPath(projectRoot)}. Upgrade nylorun, or remove the file and run "npx nylorun start" again.`, 1);
+    const link = parsed.data;
+    return {
+        format: link.format,
+        ...(link.format === 3 && link.tenant ? { tenant: link.tenant } : {}),
+        hostUrl: link.hostUrl.replace(/\/$/, ""),
+        hostId: link.hostId,
+        ...(link.tenantId ? { tenantId: link.tenantId } : {}),
+    };
+}
+async function writePrivate(path, value) {
+    const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
     try {
-        const link = JSON.parse(await readFile(join(root, ".nylorun", "link.json"), "utf8"));
-        return isTenantId(link.tenantId) ? link.tenantId : undefined;
+        await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        await rename(temporary, path);
+        await chmod(path, 0o600);
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}
+/** `.nylorun/` mode 0700 with its own `.gitignore` of `*`; the Project's is never edited. */
+async function ensureProjectDir(projectRoot) {
+    const dir = join(projectRoot, ".nylorun");
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    await chmod(dir, 0o700);
+    await writeFile(join(dir, ".gitignore"), "*\n", { mode: 0o600 });
+}
+export async function writeProjectLink(projectRoot, link) {
+    await ensureProjectDir(projectRoot);
+    await writePrivate(linkPath(projectRoot), {
+        format: 3,
+        tenant: link.tenant,
+        hostUrl: link.hostUrl.replace(/\/$/, ""),
+        hostId: link.hostId,
+        tenantId: link.tenantId,
+    });
+}
+/** The Project's application key and principal, or undefined when absent or unreadable. */
+export async function readProjectCredentials(projectRoot) {
+    try {
+        const value = JSON.parse(await readFile(credentialsPath(projectRoot), "utf8"));
+        return typeof value.applicationKey === "string" && typeof value.principalId === "string"
+            ? { applicationKey: value.applicationKey, principalId: value.principalId }
+            : undefined;
     }
     catch {
         return undefined;
     }
 }
+/** `.nylorun/credentials.json` (format 1, mode 0600). */
+export async function writeProjectCredentials(projectRoot, credentials) {
+    await ensureProjectDir(projectRoot);
+    await writePrivate(credentialsPath(projectRoot), {
+        format: 1,
+        applicationKey: credentials.applicationKey,
+        principalId: credentials.principalId,
+    });
+}

package/dist/project/seed.d.ts

@@ -0,0 +1,27 @@
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface SeedResult {
+    /** Settings the seed set, and the ones the Tenant already had. */
+    applied: string[];
+    kept: string[];
+    /** `provider/model` stored in the Tenant's vault. */
+    model?: string;
+}
+/**
+ * The Project's `.env` as a value map. It is never applied to this process or written back:
+ * a Project's `.env` never configures the Host.
+ */
+export declare function readProjectEnv(projectRoot: string): Record<string, string>;
+/**
+ * Seed a new Project's Tenant from the Project's `.env`: the sandbox backend
+ * (`NYLORUN_SANDBOX=auto|virtual`, `PUT /v1/tenant/config/seed`, which keeps settings the
+ * Tenant has) and the model credential (`MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY`,
+ * `MODEL_PROVIDER_BASE_URL`, or `.nylorun/auth.json`), stored in the Tenant's vault unless the
+ * Tenant has a model or `NYLORUN_DEV_MODEL=fixture`.
+ */
+export declare function seedTenant(input: {
+    fetch: FetchLike;
+    runtimeUrl: string;
+    applicationKey: string;
+    projectRoot: string;
+}): Promise<SeedResult>;
+export {};

package/dist/project/seed.js

@@ -0,0 +1,111 @@
+import { randomUUID } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { parseEnv } from "node:util";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+/**
+ * The Project's `.env` as a value map. It is never applied to this process or written back:
+ * a Project's `.env` never configures the Host.
+ */
+export function readProjectEnv(projectRoot) {
+    const file = join(projectRoot, ".env");
+    try {
+        if (!statSync(file).isFile())
+            return {};
+        const result = {};
+        for (const [key, value] of Object.entries(parseEnv(readFileSync(file, "utf8"))))
+            if (value !== undefined)
+                result[key] = value;
+        return result;
+    }
+    catch {
+        return {};
+    }
+}
+function modelFromEnv(env, projectRoot) {
+    const provider = env.MODEL_PROVIDER?.trim();
+    const model = env.MODEL?.trim();
+    if (!provider || !model)
+        return undefined;
+    const baseUrl = env.MODEL_PROVIDER_BASE_URL?.trim();
+    const base = { provider, model, ...(baseUrl ? { baseUrl } : {}) };
+    const key = env.MODEL_PROVIDER_API_KEY;
+    if (key)
+        return { ...base, auth: { type: "api_key", key } };
+    for (const relative of [".nylorun/auth.json", ".env/auth.json"]) {
+        try {
+            const all = JSON.parse(readFileSync(join(projectRoot, relative), "utf8"));
+            const credential = all[provider];
+            if (credential?.type === "api_key" || credential?.type === "oauth")
+                return { ...base, auth: credential };
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return undefined;
+}
+async function call(fetch, url, applicationKey, init = {}) {
+    const response = await fetch(url, {
+        ...(init.method ? { method: init.method } : {}),
+        headers: {
+            authorization: `Bearer ${applicationKey}`,
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+            accept: "application/json",
+            ...(init.body === undefined ? {} : { "content-type": "application/json" }),
+        },
+        ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
+        redirect: "error",
+        signal: AbortSignal.timeout(15_000),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (!response.ok)
+        throw new Error(`${init.method ?? "GET"} ${new URL(url).pathname} returned ${response.status}${typeof body.message === "string" ? `: ${body.message}` : ""}`);
+    return body;
+}
+/**
+ * Seed a new Project's Tenant from the Project's `.env`: the sandbox backend
+ * (`NYLORUN_SANDBOX=auto|virtual`, `PUT /v1/tenant/config/seed`, which keeps settings the
+ * Tenant has) and the model credential (`MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY`,
+ * `MODEL_PROVIDER_BASE_URL`, or `.nylorun/auth.json`), stored in the Tenant's vault unless the
+ * Tenant has a model or `NYLORUN_DEV_MODEL=fixture`.
+ */
+export async function seedTenant(input) {
+    const env = readProjectEnv(input.projectRoot);
+    const base = input.runtimeUrl.replace(/\/$/, "");
+    const result = { applied: [], kept: [] };
+    const sandbox = env.NYLORUN_SANDBOX?.trim();
+    if (sandbox === "auto" || sandbox === "virtual") {
+        const body = (await call(input.fetch, `${base}/v1/tenant/config/seed`, input.applicationKey, {
+            method: "PUT",
+            body: { requestId: randomUUID(), sandbox: { backend: sandbox } },
+        }));
+        if (Array.isArray(body.applied))
+            result.applied = body.applied.map(String);
+        if (Array.isArray(body.kept))
+            result.kept = body.kept.map(String);
+    }
+    if (env.NYLORUN_DEV_MODEL?.trim() === "fixture")
+        return result;
+    const seeded = modelFromEnv(env, input.projectRoot);
+    if (!seeded)
+        return result;
+    const current = (await call(input.fetch, `${base}/v1/tenant/model`, input.applicationKey));
+    if (current.configured === true) {
+        result.kept.push("model");
+        return result;
+    }
+    await call(input.fetch, `${base}/v1/tenant/model`, input.applicationKey, {
+        method: "PUT",
+        body: {
+            requestId: randomUUID(),
+            idempotencyKey: randomUUID(),
+            provider: seeded.provider,
+            model: seeded.model,
+            ...(seeded.baseUrl ? { baseUrl: seeded.baseUrl } : {}),
+            auth: seeded.auth,
+        },
+    });
+    result.model = `${seeded.provider}/${seeded.model}`;
+    return result;
+}

package/dist/stack/commands.d.ts

@@ -1,10 +1,11 @@
+import type { HostTenant } from "@nylorun/core/contracts";
 import { type ComposeService, type DockerRunner } from "./docker.js";
 import type { PortProbe } from "./ports.js";
 import { type FetchLike } from "./studio-login.js";
-export declare const STACK_SERVICES: readonly ["postgres", "restate", "s2", "runtime", "studio"];
+export declare const STACK_SERVICES: readonly ["postgres", "restate", "s2", "gateway", "runtime", "studio"];
 export declare const stackUsage: string;
 export interface StackDeps {
-    /** Environment snapshot (NYLORUN_HOME, image overrides, NYLORUN_STACK_PROJECT). */
+    /** Environment snapshot (NYLORUN_HOME, NYLORUN_TENANT, image overrides, NYLORUN_COMPOSE_PROJECT). */
     env: Readonly<Record<string, string | undefined>>;
     docker: DockerRunner;
     fetch: FetchLike;
@@ -23,14 +24,19 @@ export interface StackDeps {
     openBrowser(url: string): Promise<boolean>;
     /** Is this process id alive? (launcher-managed Runtime detection) */
     pidAlive(pid: number): boolean;
+    /** Where the project is looked for (default: the process's working directory). */
+    cwd?: string;
+    /** `~/.nylorun`: the Tenants (tests use a temporary directory). */
+    nylorunRoot?: string;
     /** Delay between health polls; tests shorten it. */
     pollMs?: number;
-    /** How long `start` waits for the Runtime's /health after Compose. */
+    /** How long `start` waits for the Runtime's /health, and then its Tenant, after Compose. */
     healthTimeoutMs?: number;
     /** How long a Studio login is retried before warning. */
     loginTimeoutMs?: number;
 }
-export declare function stackProject(env: StackDeps["env"]): string;
+/** The Compose project of Tenant `name`: `nylorun-<name>`, or `NYLORUN_COMPOSE_PROJECT`. */
+export declare function stackProject(env: StackDeps["env"], name: string): string;
 interface Flags {
     rest: string[];
     booleans: Set<string>;
@@ -44,23 +50,28 @@ export declare function parseStackFlags(args: readonly string[], allowed: {
     lists?: readonly string[];
     aliases?: Record<string, string>;
 }, usage: string): Flags;
+/** The Host's one Tenant as `/v1/admin/status` reports it (no envelope). */
+export type StackTenant = Pick<HostTenant, "id" | "name" | "state" | "cause">;
 /** Printed by `start` when it does not open Studio itself. */
 export declare const STUDIO_SIGN_IN_HINT = "To sign a browser in to Studio, run \"npx nylorun studio\".";
-/** Printed by `start` while the Host has no Tenant: nylorun never creates one. */
-export declare const TENANT_HINT = "No Tenant yet. Create one in Studio, or run `npx @nylorun/cli tenant create` in your project.";
 export interface StackStatus {
+    /** The Tenant's name. */
+    name: string;
+    /** The Compose project. */
     project: string;
+    /** The Host root. */
     home: string;
     state: "running" | "stopped" | "absent";
     runtime: {
         url?: string;
-        /** The Admin API (operator listener), when the stack publishes one. */
+        /** The Admin API (operator listener), when the Tenant publishes one. */
         adminUrl?: string;
         healthy: boolean;
         version?: string;
         hostId?: string;
-        tenants?: number;
     };
+    /** The Tenant as the Runtime reports it, while it answers. */
+    tenant?: StackTenant;
     studio: {
         url?: string;
         state: string;
@@ -70,16 +81,27 @@ export interface StackStatus {
     restate: {
         url?: string;
     };
+    /** The gateway container (the Model Gate), in the combined packing. */
+    gateway: {
+        state: string;
+        healthy: boolean;
+    };
     services: ComposeService[];
 }
 /** What `nylorun status` reports, as data (`nylorun doctor`). */
-export declare function readStackStatus(deps: StackDeps): Promise<StackStatus>;
-/** The running stack as clients reach it. */
+export declare function readStackStatus(deps: StackDeps, options?: {
+    name?: string;
+}): Promise<StackStatus>;
+/** The running Tenant as clients reach it. */
 export interface StackEndpoints {
-    /** The Host root (`NYLORUN_HOME` or `~/.nylorun`). */
+    /** The Tenant's name. */
+    name: string;
+    /** The Host root. */
     home: string;
     /** `http://localhost:<port>` */
     runtimeUrl: string;
+    /** The operator listener (Admin API). */
+    adminUrl: string;
     hostId: string;
     adminKey: string;
     studioPort: number;
@@ -89,27 +111,28 @@ export interface StackEndpoints {
     started: boolean;
 }
 /**
- * Start the stack unless it is already running (`nylorun studio`): the
- * `start` code path without its own output. Compose progress
- * still streams, since the first run pulls images.
+ * Start the selected Tenant unless it is already running (`nylorun studio`): the
+ * `start` code path without its output, its Tenant wait or the Project link. Compose
+ * progress still streams, since the first run pulls images.
  */
 export declare function ensureStack(deps: StackDeps, options: {
     studio: boolean;
+    name?: string;
 }): Promise<StackEndpoints>;
 /** Add Studio's `next` path (e.g. `/tenants/<id>`) to a login URL. */
 export declare function withNext(loginUrl: string, next: string | undefined): string;
-/** The Studio page for one Tenant, as a login `next` path. */
+/** The Tenant's Studio page, as a login `next` path. */
 export declare function tenantStudioPath(tenantId: string): string;
 /**
- * Mint a fresh Studio login URL on a running stack, landing on `next`.
+ * Mint a fresh Studio login URL on a running Tenant, landing on `next`.
  * Undefined (after a warning) when Studio does not answer.
  */
-export declare function studioLoginUrl(deps: StackDeps, stack: Pick<StackEndpoints, "studioPort" | "adminKey">, next?: string): Promise<string | undefined>;
-/** `nylorun studio`, landing on `next` (the linked Project's Tenant) when given. */
+export declare function studioLoginUrl(deps: StackDeps, running: Pick<StackEndpoints, "studioPort" | "adminKey">, next?: string): Promise<string | undefined>;
+/** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function runStudioCommand(args: readonly string[], deps: StackDeps, options?: {
     next?: string;
 }): Promise<number>;
 export declare function isStackCommand(name: string | undefined): boolean;
-/** Run one stack command (`up`/`start`, `down`/`stop`, `status`, `logs`, `reset`, `studio`). */
+/** Run one Tenant command (`up`/`start`, `down`/`stop`, `status`, `logs`, `reset`, `studio`, `ls`, `delete`). */
 export declare function runStackCommand(name: string, args: readonly string[], deps: StackDeps): Promise<number>;
 export {};