nylorun 0.4.0-beta → 0.6.0-beta

package/dist/stack/prepare.js

@@ -21,7 +21,7 @@ async function readText(path) {
         return undefined;
     }
 }
-/** Read the persisted stack settings without writing anything. */
+/** Read the persisted Compose settings without writing anything. */
 export async function readStackEnv(paths) {
     const text = await readText(paths.env);
     return text === undefined ? undefined : parsePersisted(text);
@@ -76,7 +76,9 @@ export async function prepareStack(input) {
         runtimeImage: input.images.runtime,
         studioImage: input.images.studio,
         studioFrameAncestors,
-        stackName: input.name,
+        studioAnalyticsId: input.studioAnalyticsId ?? "",
+        studioPublicOrigins: input.studioPublicOrigin ?? "",
+        tenantName: input.name,
         derivedPrincipals: (input.derivedPrincipals?.trim()
             ? parseDerivedPrincipals(input.derivedPrincipals, "NYLORUN_DERIVED_PRINCIPALS")
             : (persisted.derivedPrincipals ?? ["project"])).join(","),
@@ -89,6 +91,6 @@ export async function prepareStack(input) {
         runtimeVersion: input.runtimeVersion,
     });
     await writeFileMode(paths.env, renderEnvFile(env), 0o600);
-    await writeFileMode(paths.compose, renderComposeFile(input.project), 0o644);
+    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name), 0o644);
     return { env, host, adminKey, firstRun };
 }

package/dist/stack/proxy.d.ts

@@ -0,0 +1,78 @@
+import type { DockerRunner } from "./docker.js";
+import { type PortProbe } from "./ports.js";
+/**
+ * The Studio proxy: one small Caddy container per machine that gives each local Tenant's
+ * Studio the address `http://<name>.localhost:<port>`. Browsers keep cookies per host, not
+ * per port, so separate hosts keep the Studios' sessions apart. It routes browsers to Studio
+ * only (programs keep the Runtime's `http://localhost:<port>`: Node's resolver need not
+ * resolve `*.localhost`) and holds no Tenant data: its files are `~/.nylorun/proxy/`
+ * (`compose.yaml`, `Caddyfile`, `.env`), and Caddy's own state is tmpfs.
+ *
+ * The proxy joins each Tenant's network (named after its Compose project) and reaches Studio
+ * by container name, `<project>-studio:3000`. Docker cannot remove a network the proxy is
+ * attached to, so `reset` and `delete` disconnect it first.
+ */
+export declare const PROXY_PROJECT = "nylorun-proxy";
+export declare const PROXY_CONTAINER = "nylorun-proxy";
+export interface ProxyPaths {
+    dir: string;
+    compose: string;
+    caddyfile: string;
+    /** The port, and whether Docker took the `::1` binding. */
+    env: string;
+}
+export declare function proxyPaths(base: string): ProxyPaths;
+/** `NYLORUN_PROXY_DISABLED=1`: no proxy; Studio is `http://localhost:<port>`. */
+export declare function proxyDisabled(env: Readonly<Record<string, string | undefined>>): boolean;
+export declare function proxyOrigin(name: string, port: number): string;
+export interface ProxySettings {
+    port: number;
+    /** Also published on `[::1]` (false once Docker refused it). */
+    ipv6: boolean;
+}
+export declare function readProxySettings(base: string): Promise<ProxySettings | undefined>;
+/**
+ * The proxy's settings. On first use its port is 4160 when free, else a free one outside
+ * `taken`; it is kept after that.
+ */
+export declare function ensureProxySettings(base: string, ports: PortProbe, taken: ReadonlySet<number>): Promise<ProxySettings>;
+/** A Tenant the proxy routes to: its name and Compose project (also its network's name). */
+export interface ProxyRoute {
+    name: string;
+    project: string;
+}
+/**
+ * One site per Tenant. Site addresses carry no port: Caddy listens on 80 in the container,
+ * and its host match ignores the published port in the browser's Host. The browser's Host
+ * (`<name>.localhost:<port>`) reaches Studio unchanged, which Studio checks; a Tenant that is
+ * not running answers 502, and an unknown host 404.
+ */
+export declare function renderCaddyfile(routes: readonly ProxyRoute[]): string;
+export declare function renderProxyCompose(ipv6: boolean): string;
+/** Detach the proxy from a Tenant's network, so Compose can remove it; never fails. */
+export declare function disconnectProxy(docker: DockerRunner, network: string): Promise<void>;
+/**
+ * Write the routes, bring the proxy up (Compose recreates it when its file changed), attach
+ * it to every routed Tenant's network and reload Caddy. Never throws: a problem is warned
+ * once and the caller shows Studio's own port. When Docker refuses `[::1]` (IPv6 off), the
+ * proxy listens on 127.0.0.1 only, and says so once.
+ */
+export declare function startProxy(input: {
+    docker: DockerRunner;
+    base: string;
+    settings: ProxySettings;
+    routes: readonly ProxyRoute[];
+    err(line: string): void;
+    pollMs?: number;
+}): Promise<boolean>;
+/** Rewrite the routes of an existing proxy and reload it (`delete`); never fails. */
+export declare function refreshProxyRoutes(docker: DockerRunner, base: string, routes: readonly ProxyRoute[]): Promise<void>;
+/** Stop the proxy (`stop --all`); true when it stopped. */
+export declare function stopProxy(docker: DockerRunner): Promise<boolean>;
+export interface ProxyStatus {
+    state: "running" | "stopped" | "absent" | "disabled";
+    port?: number;
+    ipv6?: boolean;
+}
+/** The proxy as `nylorun doctor` reports it. */
+export declare function readProxyStatus(docker: DockerRunner, base: string, env: Readonly<Record<string, string | undefined>>): Promise<ProxyStatus>;

package/dist/stack/proxy.js

@@ -0,0 +1,224 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseEnvLines } from "./env-file.js";
+import { PINNED_IMAGES } from "./images.js";
+import { choosePort, DEFAULT_PORTS } from "./ports.js";
+/**
+ * The Studio proxy: one small Caddy container per machine that gives each local Tenant's
+ * Studio the address `http://<name>.localhost:<port>`. Browsers keep cookies per host, not
+ * per port, so separate hosts keep the Studios' sessions apart. It routes browsers to Studio
+ * only (programs keep the Runtime's `http://localhost:<port>`: Node's resolver need not
+ * resolve `*.localhost`) and holds no Tenant data: its files are `~/.nylorun/proxy/`
+ * (`compose.yaml`, `Caddyfile`, `.env`), and Caddy's own state is tmpfs.
+ *
+ * The proxy joins each Tenant's network (named after its Compose project) and reaches Studio
+ * by container name, `<project>-studio:3000`. Docker cannot remove a network the proxy is
+ * attached to, so `reset` and `delete` disconnect it first.
+ */
+export const PROXY_PROJECT = "nylorun-proxy";
+export const PROXY_CONTAINER = "nylorun-proxy";
+export function proxyPaths(base) {
+    const dir = join(base, "proxy");
+    return {
+        dir,
+        compose: join(dir, "compose.yaml"),
+        caddyfile: join(dir, "Caddyfile"),
+        env: join(dir, ".env"),
+    };
+}
+/** `NYLORUN_PROXY_DISABLED=1`: no proxy; Studio is `http://localhost:<port>`. */
+export function proxyDisabled(env) {
+    return /^(1|true)$/i.test(env.NYLORUN_PROXY_DISABLED?.trim() ?? "");
+}
+export function proxyOrigin(name, port) {
+    return `http://${name}.localhost:${port}`;
+}
+export async function readProxySettings(base) {
+    let text;
+    try {
+        text = await readFile(proxyPaths(base).env, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const values = parseEnvLines(text);
+    const port = Number(values.get("NYLORUN_PROXY_PORT"));
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return undefined;
+    return { port, ipv6: values.get("NYLORUN_PROXY_IPV6") !== "false" };
+}
+async function writeAtomic(path, text) {
+    const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    await writeFile(temporary, text, { mode: 0o644 });
+    await rename(temporary, path);
+}
+async function writeProxySettings(base, settings) {
+    const paths = proxyPaths(base);
+    await mkdir(paths.dir, { recursive: true, mode: 0o755 });
+    await writeAtomic(paths.env, [
+        "# Written by `nylorun start`: the Studio proxy's port, kept from its first start,",
+        "# and whether it is also published on [::1].",
+        `NYLORUN_PROXY_PORT=${settings.port}`,
+        `NYLORUN_PROXY_IPV6=${settings.ipv6}`,
+        "",
+    ].join("\n"));
+}
+/**
+ * The proxy's settings. On first use its port is 4160 when free, else a free one outside
+ * `taken`; it is kept after that.
+ */
+export async function ensureProxySettings(base, ports, taken) {
+    const existing = await readProxySettings(base);
+    if (existing)
+        return existing;
+    const settings = { port: await choosePort(ports, DEFAULT_PORTS.proxy, undefined, taken), ipv6: true };
+    await writeProxySettings(base, settings);
+    return settings;
+}
+/**
+ * One site per Tenant. Site addresses carry no port: Caddy listens on 80 in the container,
+ * and its host match ignores the published port in the browser's Host. The browser's Host
+ * (`<name>.localhost:<port>`) reaches Studio unchanged, which Studio checks; a Tenant that is
+ * not running answers 502, and an unknown host 404.
+ */
+export function renderCaddyfile(routes) {
+    const sites = routes.map(({ name, project }) => `http://${name}.localhost {
+	reverse_proxy ${project}-studio:3000
+	handle_errors {
+		respond \`Tenant ${name} is not running. Run "nylorun start --tenant ${name}".\` 502
+	}
+}
+`);
+    return [
+        `# Written by \`nylorun start\`: a site per Tenant under ~/.nylorun/tenants. Rewritten on every start.
+{
+	auto_https off
+	admin localhost:2019 # inside the container only; \`caddy reload\` uses it
+}
+`,
+        ...sites,
+        `:80 {
+	respond \`No Tenant at {host}. "nylorun ls" lists the Tenants on this machine.\` 404
+}
+`,
+    ].join("\n");
+}
+export function renderProxyCompose(ipv6) {
+    return `# Written by \`nylorun start\`; rewritten on every start. The port lives in .env.
+name: ${PROXY_PROJECT}
+
+services:
+  proxy: # http://<tenant>.localhost:<port>: every local Tenant's Studio
+    image: ${PINNED_IMAGES.proxy}
+    container_name: ${PROXY_CONTAINER}
+    labels:
+      dev.nylorun.proxy: "true"
+    volumes:
+      - .:/etc/caddy:ro # this directory: the Caddyfile, reloaded with \`caddy reload\`
+    tmpfs: [/config, /data] # Caddy's own state; nothing to keep
+    ports:
+      - "127.0.0.1:\${NYLORUN_PROXY_PORT:?run nylorun start}:80"${ipv6
+        ? `
+      - "[::1]:\${NYLORUN_PROXY_PORT:?run nylorun start}:80" # macOS resolves <name>.localhost to ::1 only`
+        : ""}
+    restart: unless-stopped
+
+networks:
+  default:
+    name: ${PROXY_PROJECT}
+    labels:
+      dev.nylorun.proxy: "true"
+`;
+}
+function proxyCompose(paths, ...args) {
+    return ["compose", "--project-name", PROXY_PROJECT, "--file", paths.compose, "--env-file", paths.env, ...args];
+}
+function lastLine(text) {
+    return text.trim().split(/\r?\n/).at(-1) ?? "";
+}
+/** Attach the proxy to a Tenant's network; "already attached" and "no such network" are fine. */
+async function connectProxy(docker, network) {
+    const result = await docker.run(["network", "connect", network, PROXY_CONTAINER]);
+    if (result.code === 0 || /already exists|not found|no such network/i.test(result.stderr))
+        return undefined;
+    return lastLine(result.stderr) || `exit ${result.code}`;
+}
+/** Detach the proxy from a Tenant's network, so Compose can remove it; never fails. */
+export async function disconnectProxy(docker, network) {
+    await docker.run(["network", "disconnect", "--force", network, PROXY_CONTAINER]);
+}
+async function reloadProxy(docker) {
+    return await docker.run(["exec", PROXY_CONTAINER, "caddy", "reload", "--config", "/etc/caddy/Caddyfile"]);
+}
+/**
+ * Write the routes, bring the proxy up (Compose recreates it when its file changed), attach
+ * it to every routed Tenant's network and reload Caddy. Never throws: a problem is warned
+ * once and the caller shows Studio's own port. When Docker refuses `[::1]` (IPv6 off), the
+ * proxy listens on 127.0.0.1 only, and says so once.
+ */
+export async function startProxy(input) {
+    const { docker, base, err } = input;
+    const paths = proxyPaths(base);
+    const warn = (problem) => err(`Warning: the Studio proxy is not available (${problem}); Studio is on its own port. See "nylorun doctor".`);
+    try {
+        await writeAtomic(paths.caddyfile, renderCaddyfile(input.routes));
+        await writeAtomic(paths.compose, renderProxyCompose(input.settings.ipv6));
+    }
+    catch (error) {
+        warn(error instanceof Error ? error.message : String(error));
+        return false;
+    }
+    let up = await docker.run(proxyCompose(paths, "up", "--detach"));
+    if (up.code !== 0 && input.settings.ipv6) {
+        await writeAtomic(paths.compose, renderProxyCompose(false));
+        const ipv4 = await docker.run(proxyCompose(paths, "up", "--detach"));
+        if (ipv4.code === 0) {
+            await writeProxySettings(base, { ...input.settings, ipv6: false });
+            err(`Docker refused the Studio proxy on [::1]:${input.settings.port} (${lastLine(up.stderr)}); it listens on 127.0.0.1 only, so a browser that resolves *.localhost to ::1 alone does not reach it.`);
+        }
+        up = ipv4;
+    }
+    if (up.code !== 0) {
+        warn(`docker compose up: ${lastLine(up.stderr) || `exit ${up.code}`}`);
+        return false;
+    }
+    for (const route of input.routes) {
+        const problem = await connectProxy(docker, route.project);
+        if (problem)
+            err(`Warning: the Studio proxy could not join ${route.project} (${problem}).`);
+    }
+    // A container Compose just created may not take the reload yet.
+    for (let attempt = 1;; attempt += 1) {
+        const reload = await reloadProxy(docker);
+        if (reload.code === 0)
+            return true;
+        if (attempt === 10) {
+            warn(`caddy reload: ${lastLine(reload.stderr) || `exit ${reload.code}`}`);
+            return false;
+        }
+        await new Promise((resolve) => setTimeout(resolve, input.pollMs ?? 500));
+    }
+}
+/** Rewrite the routes of an existing proxy and reload it (`delete`); never fails. */
+export async function refreshProxyRoutes(docker, base, routes) {
+    const paths = proxyPaths(base);
+    if (!existsSync(paths.caddyfile))
+        return;
+    await writeAtomic(paths.caddyfile, renderCaddyfile(routes));
+    await reloadProxy(docker);
+}
+/** Stop the proxy (`stop --all`); true when it stopped. */
+export async function stopProxy(docker) {
+    return (await docker.run(["compose", "--project-name", PROXY_PROJECT, "stop"])).code === 0;
+}
+/** The proxy as `nylorun doctor` reports it. */
+export async function readProxyStatus(docker, base, env) {
+    if (proxyDisabled(env))
+        return { state: "disabled" };
+    const settings = await readProxySettings(base);
+    const inspect = await docker.run(["inspect", "--format", "{{.State.Status}}", PROXY_CONTAINER]);
+    const state = inspect.code !== 0 ? "absent" : inspect.stdout.trim() === "running" ? "running" : "stopped";
+    return { state, ...(settings ? { port: settings.port, ipv6: settings.ipv6 } : {}) };
+}

package/dist/stack/stacks.d.ts

@@ -1,47 +1,50 @@
 /**
- * The machine's local stacks (tenancy.md §6): one installation per stack, each with its own
- * Host root `~/.nylorun/stacks/<name>/`, Compose project `nylorun-<name>`, ports and volumes.
- * `~/.nylorun` itself held the single stack of older releases (the legacy stack).
+ * The machine's local Tenants (tenancy.md §6): one installation per Tenant, each with its own
+ * Host root `~/.nylorun/tenants/<name>/`, Compose project `nylorun-<name>`, ports and volumes.
  */
-/** A stack name: also part of its Compose project, so Compose's rules apply. */
-export declare const STACK_NAME: RegExp;
-/** `~/.nylorun`: the stacks, and the legacy stack's files. Tests pass another directory. */
+/** The Tenant a command acts on outside a project when nothing names one. */
+export declare const DEFAULT_TENANT = "default";
+/** A Tenant name: also part of its Compose project, so Compose's rules apply. */
+export declare const TENANT_NAME: RegExp;
+/** `~/.nylorun`: the Tenants and the machine's settings. Tests pass another directory. */
 export declare function defaultNylorunRoot(): string;
-export declare function stacksDir(base: string): string;
-export declare function stackRoot(base: string, name: string): string;
-export declare function assertStackName(name: string, source: string): string;
-/** A directory name as a stack name: lowercased, other characters as `-`, trimmed. */
-export declare function sanitizeStackName(raw: string): string;
-/** `stack.json` in a Host root: the stack's name and the project it was created for. */
-export interface StackRecord {
+export declare function tenantsDir(base: string): string;
+export declare function tenantRoot(base: string, name: string): string;
+export declare function assertTenantName(name: string, source: string): string;
+/** A directory name as a Tenant name: lowercased, other characters as `-`, trimmed. */
+export declare function sanitizeTenantName(raw: string): string;
+/** `tenant.json` in a Host root: the Tenant's name and the project it was created for. */
+export interface TenantRecord {
     format: 1;
     name: string;
-    /** The project directory `nylorun start` created the stack in; absent outside a project. */
+    /** The project directory `nylorun start` created the Tenant in; absent outside a project. */
     project?: string;
 }
-export declare function stackRecordPath(root: string): string;
-export declare function readStackRecord(root: string): Promise<StackRecord | undefined>;
-export declare function writeStackRecord(root: string, record: Omit<StackRecord, "format">): Promise<void>;
-export interface StackEntry {
+export declare function tenantRecordPath(root: string): string;
+export declare function readTenantRecord(root: string): Promise<TenantRecord | undefined>;
+export declare function writeTenantRecord(root: string, record: Omit<TenantRecord, "format">): Promise<void>;
+export interface TenantEntry {
     name: string;
     root: string;
-    record?: StackRecord;
+    record: TenantRecord;
 }
-/** The stacks under `<base>/stacks`, by name. */
-export declare function listStacks(base: string): Promise<StackEntry[]>;
 /**
- * The stack name for a project without a link: the directory's name, or the first `-2`,
- * `-3`, … suffix that no stack of another project directory holds. A stack this project
+ * The Tenants under `<base>/tenants`, by name: directories with a `tenant.json` (releases
+ * before 0.4 kept other directories there).
+ */
+export declare function listTenants(base: string): Promise<TenantEntry[]>;
+/**
+ * The Tenant name for a project without a link: the directory's name, or the first `-2`,
+ * `-3`, … suffix that no Tenant of another project directory holds. A Tenant this project
  * directory created keeps its name.
  */
-export declare function chooseStackName(base: string, projectDir: string): Promise<string>;
-/** The single stack of older releases: Compose project `nylorun`, Host root `~/.nylorun`. */
-export interface LegacyStack {
-    root: string;
-    project: "nylorun";
-    compose: string;
-    env: string;
-}
-export declare function legacyStack(base: string): LegacyStack | undefined;
-/** What `nylorun legacy delete` removes from `~/.nylorun`: the old layout only, never `stacks/`. */
-export declare const LEGACY_ENTRIES: readonly ["host.json", "host-credentials.json", "host-state.json", "stack", "tenants", "home", "tmp", "trash"];
+export declare function chooseTenantName(base: string, projectDir: string): Promise<string>;
+/**
+ * Move the Host roots of nylorun 0.4 (`~/.nylorun/stacks/<name>/`) to `tenants/<name>/`, when
+ * that is free: `stack.json` becomes `tenant.json`, and `NYLORUN_STACK_NAME` becomes
+ * `NYLORUN_TENANT_NAME` in `docker/.env` (and `docker/compose.yaml`, until the next start
+ * rewrites it). `stacks/` goes when empty. They move rather than start fresh because Compose
+ * project names do not change: a fresh Host root under the same name would reuse the old
+ * volumes with new keys.
+ */
+export declare function moveStackRoots(base: string, err: (line: string) => void): Promise<void>;

package/dist/stack/stacks.js

@@ -1,47 +1,52 @@
 import { existsSync } from "node:fs";
-import { readdir, readFile, rename, writeFile } from "node:fs/promises";
+import { mkdir, readdir, readFile, rename, rm, rmdir, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import { homedir } from "node:os";
-import { basename, join, resolve } from "node:path";
+import { basename, join, resolve, sep } from "node:path";
 import { CliError } from "../errors.js";
 /**
- * The machine's local stacks (tenancy.md §6): one installation per stack, each with its own
- * Host root `~/.nylorun/stacks/<name>/`, Compose project `nylorun-<name>`, ports and volumes.
- * `~/.nylorun` itself held the single stack of older releases (the legacy stack).
+ * The machine's local Tenants (tenancy.md §6): one installation per Tenant, each with its own
+ * Host root `~/.nylorun/tenants/<name>/`, Compose project `nylorun-<name>`, ports and volumes.
  */
-/** A stack name: also part of its Compose project, so Compose's rules apply. */
-export const STACK_NAME = /^[a-z0-9][a-z0-9_-]*$/;
-/** `~/.nylorun`: the stacks, and the legacy stack's files. Tests pass another directory. */
+/** The Tenant a command acts on outside a project when nothing names one. */
+export const DEFAULT_TENANT = "default";
+/** A Tenant name: also part of its Compose project, so Compose's rules apply. */
+export const TENANT_NAME = /^[a-z0-9][a-z0-9_-]*$/;
+/** `~/.nylorun`: the Tenants and the machine's settings. Tests pass another directory. */
 export function defaultNylorunRoot() {
     return resolve(join(homedir(), ".nylorun"));
 }
-export function stacksDir(base) {
-    return join(base, "stacks");
+export function tenantsDir(base) {
+    return join(base, "tenants");
 }
-export function stackRoot(base, name) {
-    return join(stacksDir(base), name);
+export function tenantRoot(base, name) {
+    return join(tenantsDir(base), name);
 }
-export function assertStackName(name, source) {
-    if (!STACK_NAME.test(name))
+export function assertTenantName(name, source) {
+    // A Tenant id, such as a NYLORUN_TENANT kept from an older release.
+    if (/^tn_/i.test(name))
+        throw new CliError(`${source} must be a Tenant's name, not a Tenant id: ${name}. "nylorun ls" lists the Tenants on this machine.`, 2);
+    if (!TENANT_NAME.test(name))
         throw new CliError(`${source} must be lowercase letters, digits, "-" or "_", starting with a letter or digit: ${name}`, 2);
     return name;
 }
-/** A directory name as a stack name: lowercased, other characters as `-`, trimmed. */
-export function sanitizeStackName(raw) {
+/** A directory name as a Tenant name: lowercased, other characters as `-`, trimmed. */
+export function sanitizeTenantName(raw) {
     const name = raw
         .toLowerCase()
         .replace(/[^a-z0-9_-]+/g, "-")
         .replace(/-{2,}/g, "-")
-        .replace(/^[-_]+|[-_]+$/g, "");
-    return name === "" ? "stack" : name;
+        .replace(/^[-_]+|[-_]+$/g, "")
+        .replace(/^tn_/, "tn-");
+    return name === "" ? "tenant" : name;
 }
-export function stackRecordPath(root) {
-    return join(root, "stack.json");
+export function tenantRecordPath(root) {
+    return join(root, "tenant.json");
 }
-export async function readStackRecord(root) {
+export async function readTenantRecord(root) {
     try {
-        const value = JSON.parse(await readFile(stackRecordPath(root), "utf8"));
-        if (typeof value?.name !== "string" || !STACK_NAME.test(value.name))
+        const value = JSON.parse(await readFile(tenantRecordPath(root), "utf8"));
+        if (typeof value?.name !== "string" || !TENANT_NAME.test(value.name))
             return undefined;
         return {
             format: 1,
@@ -53,64 +58,93 @@ export async function readStackRecord(root) {
         return undefined;
     }
 }
-export async function writeStackRecord(root, record) {
-    const path = stackRecordPath(root);
+export async function writeTenantRecord(root, record) {
+    const path = tenantRecordPath(root);
     const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
     const body = { format: 1, name: record.name, ...(record.project ? { project: record.project } : {}) };
     await writeFile(temporary, `${JSON.stringify(body, null, 2)}\n`, { mode: 0o600 });
     await rename(temporary, path);
 }
-/** The stacks under `<base>/stacks`, by name. */
-export async function listStacks(base) {
+/**
+ * The Tenants under `<base>/tenants`, by name: directories with a `tenant.json` (releases
+ * before 0.4 kept other directories there).
+ */
+export async function listTenants(base) {
     let entries;
     try {
-        entries = await readdir(stacksDir(base), { withFileTypes: true });
+        entries = await readdir(tenantsDir(base), { withFileTypes: true });
     }
     catch {
         return [];
     }
-    const stacks = [];
+    const tenants = [];
     for (const entry of entries) {
-        if (!entry.isDirectory() || !STACK_NAME.test(entry.name))
+        if (!entry.isDirectory() || !TENANT_NAME.test(entry.name))
             continue;
-        const root = stackRoot(base, entry.name);
-        const record = await readStackRecord(root);
-        stacks.push({ name: entry.name, root, ...(record ? { record } : {}) });
+        const root = tenantRoot(base, entry.name);
+        const record = await readTenantRecord(root);
+        if (record)
+            tenants.push({ name: entry.name, root, record });
     }
-    return stacks.sort((a, b) => a.name.localeCompare(b.name));
+    return tenants.sort((a, b) => a.name.localeCompare(b.name));
 }
 /**
- * The stack name for a project without a link: the directory's name, or the first `-2`,
- * `-3`, … suffix that no stack of another project directory holds. A stack this project
+ * The Tenant name for a project without a link: the directory's name, or the first `-2`,
+ * `-3`, … suffix that no Tenant of another project directory holds. A Tenant this project
  * directory created keeps its name.
  */
-export async function chooseStackName(base, projectDir) {
-    const name = sanitizeStackName(basename(projectDir));
-    const stacks = await listStacks(base);
+export async function chooseTenantName(base, projectDir) {
+    const name = sanitizeTenantName(basename(projectDir));
+    const tenants = await listTenants(base);
     const candidate = new RegExp(`^${name}(?:-[0-9]+)?$`);
-    const own = stacks.find((stack) => candidate.test(stack.name) && stack.record?.project === projectDir);
+    const own = tenants.find((tenant) => candidate.test(tenant.name) && tenant.record.project === projectDir);
     if (own)
         return own.name;
     for (let suffix = 1;; suffix += 1) {
         const next = suffix === 1 ? name : `${name}-${suffix}`;
-        if (!existsSync(stackRoot(base, next)))
+        if (!existsSync(tenantRoot(base, next)))
             return next;
     }
 }
-export function legacyStack(base) {
-    const compose = join(base, "stack", "compose.yaml");
-    if (!existsSync(compose))
-        return undefined;
-    return { root: base, project: "nylorun", compose, env: join(base, "stack", ".env") };
+/**
+ * Move the Host roots of nylorun 0.4 (`~/.nylorun/stacks/<name>/`) to `tenants/<name>/`, when
+ * that is free: `stack.json` becomes `tenant.json`, and `NYLORUN_STACK_NAME` becomes
+ * `NYLORUN_TENANT_NAME` in `docker/.env` (and `docker/compose.yaml`, until the next start
+ * rewrites it). `stacks/` goes when empty. They move rather than start fresh because Compose
+ * project names do not change: a fresh Host root under the same name would reuse the old
+ * volumes with new keys.
+ */
+export async function moveStackRoots(base, err) {
+    const stacks = join(base, "stacks");
+    let names;
+    try {
+        names = (await readdir(stacks, { withFileTypes: true }))
+            .filter((entry) => entry.isDirectory() && TENANT_NAME.test(entry.name))
+            .map((entry) => entry.name);
+    }
+    catch {
+        return;
+    }
+    const moved = [];
+    for (const name of names.sort()) {
+        const root = tenantRoot(base, name);
+        if (existsSync(root))
+            continue;
+        await mkdir(tenantsDir(base), { recursive: true, mode: 0o700 });
+        await rename(join(stacks, name), root);
+        await rename(join(root, "stack.json"), tenantRecordPath(root)).catch(() => { });
+        for (const file of [join(root, "docker", ".env"), join(root, "docker", "compose.yaml")]) {
+            const text = await readFile(file, "utf8").catch(() => undefined);
+            if (text?.includes("NYLORUN_STACK_NAME"))
+                await writeFile(file, text.replaceAll("NYLORUN_STACK_NAME", "NYLORUN_TENANT_NAME"));
+        }
+        moved.push(name);
+    }
+    // A marker file of 0.4.
+    await rm(join(stacks, ".legacy-noted"), { force: true });
+    await rmdir(stacks).catch(() => { });
+    if (moved.length) {
+        const tilde = (path) => path.startsWith(homedir() + sep) ? `~${path.slice(homedir().length)}` : path;
+        err(`Moved Tenants ${moved.join(", ")} from ${tilde(stacks)} to ${tilde(tenantsDir(base))}.`);
+    }
 }
-/** What `nylorun legacy delete` removes from `~/.nylorun`: the old layout only, never `stacks/`. */
-export const LEGACY_ENTRIES = [
-    "host.json",
-    "host-credentials.json",
-    "host-state.json",
-    "stack",
-    "tenants",
-    "home",
-    "tmp",
-    "trash",
-];

package/dist/stack/studio-login.d.ts

@@ -1,14 +1,15 @@
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
-/** Studio's origin as the CLI opens it: always `localhost` (the cookie's host). */
+/** Studio's published origin: always `localhost` (the cookie's host). */
 export declare function studioOrigin(port: number): string;
 /**
  * Ask the Studio container for a single-use login token with the admin key
- * (`POST /_studio/login-tokens`, Studio §6) and return the URL to open.
+ * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port, or
+ * the proxy's `http://<name>.localhost:<port>`) and return the URL to open there.
  * Accepts `{ loginUrl }`, `{ url }` or `{ token }` in the response.
  */
 export declare function mintStudioLogin(input: {
     fetch: FetchLike;
-    studioPort: number;
+    origin: string;
     adminKey: string;
     timeoutMs?: number;
 }): Promise<string>;