nylorun 0.5.0-beta → 0.6.0-beta

package/dist/stack/docker.js

@@ -99,3 +99,66 @@ export function parseComposePs(stdout) {
         };
     });
 }
+const UNITS = {
+    b: 1,
+    kb: 1e3,
+    mb: 1e6,
+    gb: 1e9,
+    tb: 1e12,
+    kib: 2 ** 10,
+    mib: 2 ** 20,
+    gib: 2 ** 30,
+    tib: 2 ** 40,
+};
+/** `123.4MiB` (from `docker stats` MemUsage) in bytes; undefined when unreadable. */
+export function parseByteSize(text) {
+    const match = /^([\d.]+)\s*([a-z]+)$/i.exec(text.trim());
+    const unit = match ? UNITS[match[2].toLowerCase()] : undefined;
+    return match && unit ? Number(match[1]) * unit : undefined;
+}
+/** `812 MB`, `2.1 GB`. */
+export function formatBytes(bytes) {
+    return bytes >= 1e9 ? `${(bytes / 1e9).toFixed(1)} GB` : `${Math.round(bytes / 1e6)} MB`;
+}
+/**
+ * Memory in use per Tenant: the sum over its running containers, found by the label
+ * `dev.nylorun.tenant`, from one `docker stats --no-stream`. Undefined when Docker does not
+ * answer; a Tenant with no running container is absent.
+ */
+export async function tenantMemory(docker) {
+    const ps = await docker.run([
+        "ps",
+        "--filter",
+        "label=dev.nylorun.tenant",
+        "--format",
+        '{{.Names}}\t{{.Label "dev.nylorun.tenant"}}',
+    ]);
+    if (ps.code !== 0)
+        return undefined;
+    const owners = new Map(ps.stdout
+        .split(/\r?\n/)
+        .map((line) => line.trim().split("\t"))
+        .filter((cells) => cells.length === 2 && cells[1] !== ""));
+    const memory = new Map();
+    if (owners.size === 0)
+        return memory;
+    const stats = await docker.run([
+        "stats",
+        "--no-stream",
+        "--format",
+        "{{.Name}}\t{{.MemUsage}}",
+        ...owners.keys(),
+    ]);
+    if (stats.code !== 0)
+        return undefined;
+    for (const line of stats.stdout.split(/\r?\n/)) {
+        const [name, usage] = line.trim().split("\t");
+        const tenant = name ? owners.get(name) : undefined;
+        const bytes = usage ? parseByteSize(usage.split("/")[0]) : undefined;
+        if (tenant && bytes !== undefined)
+            memory.set(tenant, (memory.get(tenant) ?? 0) + bytes);
+    }
+    for (const [tenant, bytes] of memory)
+        memory.set(tenant, Math.round(bytes));
+    return memory;
+}

package/dist/stack/env-file.d.ts

@@ -34,6 +34,11 @@ export interface StackEnv {
      * when telemetry is off. Decided again on every start.
      */
     studioAnalyticsId: string;
+    /**
+     * Origins Studio also serves besides localhost and 127.0.0.1 on its port, separated by
+     * spaces: the proxy's `http://<name>.localhost:<port>`, or empty. Decided on every start.
+     */
+    studioPublicOrigins: string;
     /** The Tenant's name, which the Runtime gives the Tenant it creates. */
     tenantName: string;
     /**

package/dist/stack/env-file.js

@@ -24,6 +24,7 @@ const KEYS = {
     studioImage: "NYLORUN_STUDIO_IMAGE",
     studioFrameAncestors: "NYLORUN_STUDIO_FRAME_ANCESTORS",
     studioAnalyticsId: "NYLORUN_STUDIO_ANALYTICS_ID",
+    studioPublicOrigins: "NYLORUN_STUDIO_PUBLIC_ORIGINS",
     tenantName: "NYLORUN_TENANT_NAME",
     derivedPrincipals: "NYLORUN_DERIVED_PRINCIPALS",
 };
@@ -81,6 +82,10 @@ export function renderEnvFile(env) {
         "# it off with nylorun telemetry disable or NYLORUN_TELEMETRY_DISABLED=1.",
         line("studioAnalyticsId"),
         "",
+        "# Studio's address through the proxy (http://<name>.localhost:<port>); empty",
+        "# without the proxy. Set on every start.",
+        line("studioPublicOrigins"),
+        "",
         "# The Tenant's name, which the Runtime gives the Tenant it creates on the first",
         "# start, and the derived principals it registers on that Tenant (keys derived",
         "# from the admin key; `project` is the Project link's).",

package/dist/stack/images.d.ts

@@ -2,12 +2,13 @@
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
  * (local builds, CI images). Postgres, Restate and s2-lite are the official
- * images, pinned here.
+ * images, pinned here, as is Caddy for the machine's Studio proxy.
  */
 export declare const PINNED_IMAGES: {
     readonly postgres: "postgres:17.11";
     readonly restate: "docker.restate.dev/restatedev/restate:1.7.12";
     readonly s2: "ghcr.io/s2-streamstore/s2:0.43.0";
+    readonly proxy: "caddy:2.11.6";
 };
 export interface StackImages {
     runtime: string;
@@ -15,6 +16,7 @@ export interface StackImages {
     postgres: string;
     restate: string;
     s2: string;
+    proxy: string;
 }
 /** `NYLORUN_RUNTIME_IMAGE` names the Runtime image, so its version is unknown here. */
 export declare function runtimeImageOverridden(env: Readonly<Record<string, string | undefined>>): boolean;

package/dist/stack/images.js

@@ -3,12 +3,13 @@ import { pinnedVersion } from "./versions.js";
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
  * (local builds, CI images). Postgres, Restate and s2-lite are the official
- * images, pinned here.
+ * images, pinned here, as is Caddy for the machine's Studio proxy.
  */
 export const PINNED_IMAGES = {
     postgres: "postgres:17.11",
     restate: "docker.restate.dev/restatedev/restate:1.7.12",
     s2: "ghcr.io/s2-streamstore/s2:0.43.0",
+    proxy: "caddy:2.11.6",
 };
 function override(env, name) {
     const value = env[name]?.trim();

package/dist/stack/index.d.ts

@@ -1,8 +1,9 @@
 import { type StackDeps } from "./commands.js";
-export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
+export { ensureStack, isStackCommand, readProxyReport, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
 export type { StackDeps, StackEndpoints, StackStatus, StackTenant } from "./commands.js";
 export { checkDocker } from "./docker.js";
 export type { Check, DockerChecks } from "./docker.js";
+export type { ProxyStatus } from "./proxy.js";
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export declare function defaultStackDeps(env: Readonly<Record<string, string | undefined>>): StackDeps;
 /** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */

package/dist/stack/index.js

@@ -4,7 +4,7 @@ import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
-export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
+export { ensureStack, isStackCommand, readProxyReport, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
 export { checkDocker } from "./docker.js";
 function browserCommand(env) {
     if (process.platform === "darwin")
@@ -21,6 +21,8 @@ const STACK_ENV_OWNED = [
     "NYLORUN_TENANT_NAME",
     "NYLORUN_DERIVED_PRINCIPALS",
     "NYLORUN_STUDIO_ANALYTICS_ID",
+    "NYLORUN_STUDIO_PUBLIC_ORIGINS",
+    "NYLORUN_PROXY_PORT",
 ];
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export function defaultStackDeps(env) {

package/dist/stack/ports.d.ts

@@ -1,4 +1,6 @@
 export declare const DEFAULT_PORTS: {
+    /** The Studio proxy, one per machine (`http://<tenant>.localhost:<port>`). */
+    readonly proxy: 4160;
     readonly runtime: 8787;
     /** The Runtime's operator listener (Admin API). */
     readonly admin: 8788;

package/dist/stack/ports.js

@@ -1,5 +1,7 @@
 import { createServer } from "node:net";
 export const DEFAULT_PORTS = {
+    /** The Studio proxy, one per machine (`http://<tenant>.localhost:<port>`). */
+    proxy: 4160,
     runtime: 8787,
     /** The Runtime's operator listener (Admin API). */
     admin: 8788,

package/dist/stack/prepare.d.ts

@@ -43,4 +43,6 @@ export declare function prepareStack(input: {
     };
     /** The measurement id Studio reports page views to; absent when telemetry is off. */
     studioAnalyticsId?: string;
+    /** Studio's origin through the proxy; absent without the proxy. */
+    studioPublicOrigin?: string;
 }): Promise<PreparedStack>;

package/dist/stack/prepare.js

@@ -77,6 +77,7 @@ export async function prepareStack(input) {
         studioImage: input.images.studio,
         studioFrameAncestors,
         studioAnalyticsId: input.studioAnalyticsId ?? "",
+        studioPublicOrigins: input.studioPublicOrigin ?? "",
         tenantName: input.name,
         derivedPrincipals: (input.derivedPrincipals?.trim()
             ? parseDerivedPrincipals(input.derivedPrincipals, "NYLORUN_DERIVED_PRINCIPALS")
@@ -90,6 +91,6 @@ export async function prepareStack(input) {
         runtimeVersion: input.runtimeVersion,
     });
     await writeFileMode(paths.env, renderEnvFile(env), 0o600);
-    await writeFileMode(paths.compose, renderComposeFile(input.project), 0o644);
+    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name), 0o644);
     return { env, host, adminKey, firstRun };
 }

package/dist/stack/proxy.d.ts

@@ -0,0 +1,78 @@
+import type { DockerRunner } from "./docker.js";
+import { type PortProbe } from "./ports.js";
+/**
+ * The Studio proxy: one small Caddy container per machine that gives each local Tenant's
+ * Studio the address `http://<name>.localhost:<port>`. Browsers keep cookies per host, not
+ * per port, so separate hosts keep the Studios' sessions apart. It routes browsers to Studio
+ * only (programs keep the Runtime's `http://localhost:<port>`: Node's resolver need not
+ * resolve `*.localhost`) and holds no Tenant data: its files are `~/.nylorun/proxy/`
+ * (`compose.yaml`, `Caddyfile`, `.env`), and Caddy's own state is tmpfs.
+ *
+ * The proxy joins each Tenant's network (named after its Compose project) and reaches Studio
+ * by container name, `<project>-studio:3000`. Docker cannot remove a network the proxy is
+ * attached to, so `reset` and `delete` disconnect it first.
+ */
+export declare const PROXY_PROJECT = "nylorun-proxy";
+export declare const PROXY_CONTAINER = "nylorun-proxy";
+export interface ProxyPaths {
+    dir: string;
+    compose: string;
+    caddyfile: string;
+    /** The port, and whether Docker took the `::1` binding. */
+    env: string;
+}
+export declare function proxyPaths(base: string): ProxyPaths;
+/** `NYLORUN_PROXY_DISABLED=1`: no proxy; Studio is `http://localhost:<port>`. */
+export declare function proxyDisabled(env: Readonly<Record<string, string | undefined>>): boolean;
+export declare function proxyOrigin(name: string, port: number): string;
+export interface ProxySettings {
+    port: number;
+    /** Also published on `[::1]` (false once Docker refused it). */
+    ipv6: boolean;
+}
+export declare function readProxySettings(base: string): Promise<ProxySettings | undefined>;
+/**
+ * The proxy's settings. On first use its port is 4160 when free, else a free one outside
+ * `taken`; it is kept after that.
+ */
+export declare function ensureProxySettings(base: string, ports: PortProbe, taken: ReadonlySet<number>): Promise<ProxySettings>;
+/** A Tenant the proxy routes to: its name and Compose project (also its network's name). */
+export interface ProxyRoute {
+    name: string;
+    project: string;
+}
+/**
+ * One site per Tenant. Site addresses carry no port: Caddy listens on 80 in the container,
+ * and its host match ignores the published port in the browser's Host. The browser's Host
+ * (`<name>.localhost:<port>`) reaches Studio unchanged, which Studio checks; a Tenant that is
+ * not running answers 502, and an unknown host 404.
+ */
+export declare function renderCaddyfile(routes: readonly ProxyRoute[]): string;
+export declare function renderProxyCompose(ipv6: boolean): string;
+/** Detach the proxy from a Tenant's network, so Compose can remove it; never fails. */
+export declare function disconnectProxy(docker: DockerRunner, network: string): Promise<void>;
+/**
+ * Write the routes, bring the proxy up (Compose recreates it when its file changed), attach
+ * it to every routed Tenant's network and reload Caddy. Never throws: a problem is warned
+ * once and the caller shows Studio's own port. When Docker refuses `[::1]` (IPv6 off), the
+ * proxy listens on 127.0.0.1 only, and says so once.
+ */
+export declare function startProxy(input: {
+    docker: DockerRunner;
+    base: string;
+    settings: ProxySettings;
+    routes: readonly ProxyRoute[];
+    err(line: string): void;
+    pollMs?: number;
+}): Promise<boolean>;
+/** Rewrite the routes of an existing proxy and reload it (`delete`); never fails. */
+export declare function refreshProxyRoutes(docker: DockerRunner, base: string, routes: readonly ProxyRoute[]): Promise<void>;
+/** Stop the proxy (`stop --all`); true when it stopped. */
+export declare function stopProxy(docker: DockerRunner): Promise<boolean>;
+export interface ProxyStatus {
+    state: "running" | "stopped" | "absent" | "disabled";
+    port?: number;
+    ipv6?: boolean;
+}
+/** The proxy as `nylorun doctor` reports it. */
+export declare function readProxyStatus(docker: DockerRunner, base: string, env: Readonly<Record<string, string | undefined>>): Promise<ProxyStatus>;

package/dist/stack/proxy.js

@@ -0,0 +1,224 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseEnvLines } from "./env-file.js";
+import { PINNED_IMAGES } from "./images.js";
+import { choosePort, DEFAULT_PORTS } from "./ports.js";
+/**
+ * The Studio proxy: one small Caddy container per machine that gives each local Tenant's
+ * Studio the address `http://<name>.localhost:<port>`. Browsers keep cookies per host, not
+ * per port, so separate hosts keep the Studios' sessions apart. It routes browsers to Studio
+ * only (programs keep the Runtime's `http://localhost:<port>`: Node's resolver need not
+ * resolve `*.localhost`) and holds no Tenant data: its files are `~/.nylorun/proxy/`
+ * (`compose.yaml`, `Caddyfile`, `.env`), and Caddy's own state is tmpfs.
+ *
+ * The proxy joins each Tenant's network (named after its Compose project) and reaches Studio
+ * by container name, `<project>-studio:3000`. Docker cannot remove a network the proxy is
+ * attached to, so `reset` and `delete` disconnect it first.
+ */
+export const PROXY_PROJECT = "nylorun-proxy";
+export const PROXY_CONTAINER = "nylorun-proxy";
+export function proxyPaths(base) {
+    const dir = join(base, "proxy");
+    return {
+        dir,
+        compose: join(dir, "compose.yaml"),
+        caddyfile: join(dir, "Caddyfile"),
+        env: join(dir, ".env"),
+    };
+}
+/** `NYLORUN_PROXY_DISABLED=1`: no proxy; Studio is `http://localhost:<port>`. */
+export function proxyDisabled(env) {
+    return /^(1|true)$/i.test(env.NYLORUN_PROXY_DISABLED?.trim() ?? "");
+}
+export function proxyOrigin(name, port) {
+    return `http://${name}.localhost:${port}`;
+}
+export async function readProxySettings(base) {
+    let text;
+    try {
+        text = await readFile(proxyPaths(base).env, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const values = parseEnvLines(text);
+    const port = Number(values.get("NYLORUN_PROXY_PORT"));
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return undefined;
+    return { port, ipv6: values.get("NYLORUN_PROXY_IPV6") !== "false" };
+}
+async function writeAtomic(path, text) {
+    const temporary = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    await writeFile(temporary, text, { mode: 0o644 });
+    await rename(temporary, path);
+}
+async function writeProxySettings(base, settings) {
+    const paths = proxyPaths(base);
+    await mkdir(paths.dir, { recursive: true, mode: 0o755 });
+    await writeAtomic(paths.env, [
+        "# Written by `nylorun start`: the Studio proxy's port, kept from its first start,",
+        "# and whether it is also published on [::1].",
+        `NYLORUN_PROXY_PORT=${settings.port}`,
+        `NYLORUN_PROXY_IPV6=${settings.ipv6}`,
+        "",
+    ].join("\n"));
+}
+/**
+ * The proxy's settings. On first use its port is 4160 when free, else a free one outside
+ * `taken`; it is kept after that.
+ */
+export async function ensureProxySettings(base, ports, taken) {
+    const existing = await readProxySettings(base);
+    if (existing)
+        return existing;
+    const settings = { port: await choosePort(ports, DEFAULT_PORTS.proxy, undefined, taken), ipv6: true };
+    await writeProxySettings(base, settings);
+    return settings;
+}
+/**
+ * One site per Tenant. Site addresses carry no port: Caddy listens on 80 in the container,
+ * and its host match ignores the published port in the browser's Host. The browser's Host
+ * (`<name>.localhost:<port>`) reaches Studio unchanged, which Studio checks; a Tenant that is
+ * not running answers 502, and an unknown host 404.
+ */
+export function renderCaddyfile(routes) {
+    const sites = routes.map(({ name, project }) => `http://${name}.localhost {
+	reverse_proxy ${project}-studio:3000
+	handle_errors {
+		respond \`Tenant ${name} is not running. Run "nylorun start --tenant ${name}".\` 502
+	}
+}
+`);
+    return [
+        `# Written by \`nylorun start\`: a site per Tenant under ~/.nylorun/tenants. Rewritten on every start.
+{
+	auto_https off
+	admin localhost:2019 # inside the container only; \`caddy reload\` uses it
+}
+`,
+        ...sites,
+        `:80 {
+	respond \`No Tenant at {host}. "nylorun ls" lists the Tenants on this machine.\` 404
+}
+`,
+    ].join("\n");
+}
+export function renderProxyCompose(ipv6) {
+    return `# Written by \`nylorun start\`; rewritten on every start. The port lives in .env.
+name: ${PROXY_PROJECT}
+
+services:
+  proxy: # http://<tenant>.localhost:<port>: every local Tenant's Studio
+    image: ${PINNED_IMAGES.proxy}
+    container_name: ${PROXY_CONTAINER}
+    labels:
+      dev.nylorun.proxy: "true"
+    volumes:
+      - .:/etc/caddy:ro # this directory: the Caddyfile, reloaded with \`caddy reload\`
+    tmpfs: [/config, /data] # Caddy's own state; nothing to keep
+    ports:
+      - "127.0.0.1:\${NYLORUN_PROXY_PORT:?run nylorun start}:80"${ipv6
+        ? `
+      - "[::1]:\${NYLORUN_PROXY_PORT:?run nylorun start}:80" # macOS resolves <name>.localhost to ::1 only`
+        : ""}
+    restart: unless-stopped
+
+networks:
+  default:
+    name: ${PROXY_PROJECT}
+    labels:
+      dev.nylorun.proxy: "true"
+`;
+}
+function proxyCompose(paths, ...args) {
+    return ["compose", "--project-name", PROXY_PROJECT, "--file", paths.compose, "--env-file", paths.env, ...args];
+}
+function lastLine(text) {
+    return text.trim().split(/\r?\n/).at(-1) ?? "";
+}
+/** Attach the proxy to a Tenant's network; "already attached" and "no such network" are fine. */
+async function connectProxy(docker, network) {
+    const result = await docker.run(["network", "connect", network, PROXY_CONTAINER]);
+    if (result.code === 0 || /already exists|not found|no such network/i.test(result.stderr))
+        return undefined;
+    return lastLine(result.stderr) || `exit ${result.code}`;
+}
+/** Detach the proxy from a Tenant's network, so Compose can remove it; never fails. */
+export async function disconnectProxy(docker, network) {
+    await docker.run(["network", "disconnect", "--force", network, PROXY_CONTAINER]);
+}
+async function reloadProxy(docker) {
+    return await docker.run(["exec", PROXY_CONTAINER, "caddy", "reload", "--config", "/etc/caddy/Caddyfile"]);
+}
+/**
+ * Write the routes, bring the proxy up (Compose recreates it when its file changed), attach
+ * it to every routed Tenant's network and reload Caddy. Never throws: a problem is warned
+ * once and the caller shows Studio's own port. When Docker refuses `[::1]` (IPv6 off), the
+ * proxy listens on 127.0.0.1 only, and says so once.
+ */
+export async function startProxy(input) {
+    const { docker, base, err } = input;
+    const paths = proxyPaths(base);
+    const warn = (problem) => err(`Warning: the Studio proxy is not available (${problem}); Studio is on its own port. See "nylorun doctor".`);
+    try {
+        await writeAtomic(paths.caddyfile, renderCaddyfile(input.routes));
+        await writeAtomic(paths.compose, renderProxyCompose(input.settings.ipv6));
+    }
+    catch (error) {
+        warn(error instanceof Error ? error.message : String(error));
+        return false;
+    }
+    let up = await docker.run(proxyCompose(paths, "up", "--detach"));
+    if (up.code !== 0 && input.settings.ipv6) {
+        await writeAtomic(paths.compose, renderProxyCompose(false));
+        const ipv4 = await docker.run(proxyCompose(paths, "up", "--detach"));
+        if (ipv4.code === 0) {
+            await writeProxySettings(base, { ...input.settings, ipv6: false });
+            err(`Docker refused the Studio proxy on [::1]:${input.settings.port} (${lastLine(up.stderr)}); it listens on 127.0.0.1 only, so a browser that resolves *.localhost to ::1 alone does not reach it.`);
+        }
+        up = ipv4;
+    }
+    if (up.code !== 0) {
+        warn(`docker compose up: ${lastLine(up.stderr) || `exit ${up.code}`}`);
+        return false;
+    }
+    for (const route of input.routes) {
+        const problem = await connectProxy(docker, route.project);
+        if (problem)
+            err(`Warning: the Studio proxy could not join ${route.project} (${problem}).`);
+    }
+    // A container Compose just created may not take the reload yet.
+    for (let attempt = 1;; attempt += 1) {
+        const reload = await reloadProxy(docker);
+        if (reload.code === 0)
+            return true;
+        if (attempt === 10) {
+            warn(`caddy reload: ${lastLine(reload.stderr) || `exit ${reload.code}`}`);
+            return false;
+        }
+        await new Promise((resolve) => setTimeout(resolve, input.pollMs ?? 500));
+    }
+}
+/** Rewrite the routes of an existing proxy and reload it (`delete`); never fails. */
+export async function refreshProxyRoutes(docker, base, routes) {
+    const paths = proxyPaths(base);
+    if (!existsSync(paths.caddyfile))
+        return;
+    await writeAtomic(paths.caddyfile, renderCaddyfile(routes));
+    await reloadProxy(docker);
+}
+/** Stop the proxy (`stop --all`); true when it stopped. */
+export async function stopProxy(docker) {
+    return (await docker.run(["compose", "--project-name", PROXY_PROJECT, "stop"])).code === 0;
+}
+/** The proxy as `nylorun doctor` reports it. */
+export async function readProxyStatus(docker, base, env) {
+    if (proxyDisabled(env))
+        return { state: "disabled" };
+    const settings = await readProxySettings(base);
+    const inspect = await docker.run(["inspect", "--format", "{{.State.Status}}", PROXY_CONTAINER]);
+    const state = inspect.code !== 0 ? "absent" : inspect.stdout.trim() === "running" ? "running" : "stopped";
+    return { state, ...(settings ? { port: settings.port, ipv6: settings.ipv6 } : {}) };
+}

package/dist/stack/studio-login.d.ts

@@ -1,14 +1,15 @@
 export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
-/** Studio's origin as the CLI opens it: always `localhost` (the cookie's host). */
+/** Studio's published origin: always `localhost` (the cookie's host). */
 export declare function studioOrigin(port: number): string;
 /**
  * Ask the Studio container for a single-use login token with the admin key
- * (`POST /_studio/login-tokens`, Studio §6) and return the URL to open.
+ * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port, or
+ * the proxy's `http://<name>.localhost:<port>`) and return the URL to open there.
  * Accepts `{ loginUrl }`, `{ url }` or `{ token }` in the response.
  */
 export declare function mintStudioLogin(input: {
     fetch: FetchLike;
-    studioPort: number;
+    origin: string;
     adminKey: string;
     timeoutMs?: number;
 }): Promise<string>;

package/dist/stack/studio-login.js

@@ -1,15 +1,16 @@
 import { STACK_CLIENT_HOST } from "./host-files.js";
-/** Studio's origin as the CLI opens it: always `localhost` (the cookie's host). */
+/** Studio's published origin: always `localhost` (the cookie's host). */
 export function studioOrigin(port) {
     return `http://${STACK_CLIENT_HOST}:${port}`;
 }
 /**
  * Ask the Studio container for a single-use login token with the admin key
- * (`POST /_studio/login-tokens`, Studio §6) and return the URL to open.
+ * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port, or
+ * the proxy's `http://<name>.localhost:<port>`) and return the URL to open there.
  * Accepts `{ loginUrl }`, `{ url }` or `{ token }` in the response.
  */
 export async function mintStudioLogin(input) {
-    const origin = studioOrigin(input.studioPort);
+    const { origin } = input;
     const response = await input.fetch(`${origin}/_studio/login-tokens`, {
         method: "POST",
         headers: {
@@ -27,7 +28,7 @@ export async function mintStudioLogin(input) {
     for (const field of ["loginUrl", "url"]) {
         const value = body[field];
         if (typeof value === "string" && value !== "") {
-            // A relative URL is resolved against the published origin.
+            // A relative URL is resolved against the origin it was minted on.
             return new URL(value, origin).toString();
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.5.0-beta",
+  "version": "0.6.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose",
@@ -41,7 +41,7 @@
     "nylorun": "dist/cli.js"
   },
   "nylorun": {
-    "runtime": "0.15.1-beta",
-    "studio": "0.16.0-beta"
+    "runtime": "0.15.2-beta",
+    "studio": "0.17.0-beta"
   }
 }