nylorun 0.6.0-beta → 0.8.0-beta

package/dist/stack/images.js

@@ -2,14 +2,17 @@ import { pinnedVersion } from "./versions.js";
 /**
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
- * (local builds, CI images). Postgres, Restate and s2-lite are the official
- * images, pinned here, as is Caddy for the machine's Studio proxy.
+ * (local builds, CI images). The sandboxes service (`nylorun sandbox enable`) is
+ * versioned with the Runtime: `ghcr.io/nylorun/sandboxes:<runtime pin>`, or
+ * `NYLORUN_SANDBOXES_IMAGE`. Postgres, Restate, s2-lite and RustFS are the
+ * official images, pinned here; RustFS (the Object store, D35) by digest as well, so
+ * it is upgraded only on purpose.
  */
 export const PINNED_IMAGES = {
     postgres: "postgres:17.11",
     restate: "docker.restate.dev/restatedev/restate:1.7.12",
     s2: "ghcr.io/s2-streamstore/s2:0.43.0",
-    proxy: "caddy:2.11.6",
+    rustfs: "rustfs/rustfs:1.0.1@sha256:1803faef57627e2d9c2e7d89d655d712ddded5389040054987163043fecb6a3c",
 };
 function override(env, name) {
     const value = env[name]?.trim();
@@ -28,6 +31,8 @@ export function stackImages(env, versions = {
             `ghcr.io/nylorun/runtime:${versions.runtime}`,
         studio: override(env, "NYLORUN_STUDIO_IMAGE") ??
             `ghcr.io/nylorun/studio:${versions.studio}`,
+        sandboxes: override(env, "NYLORUN_SANDBOXES_IMAGE") ??
+            `ghcr.io/nylorun/sandboxes:${versions.runtime}`,
         ...PINNED_IMAGES,
     };
 }

package/dist/stack/index.d.ts

@@ -1,13 +1,15 @@
 import { type StackDeps } from "./commands.js";
-export { ensureStack, isStackCommand, readProxyReport, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
+export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
 export type { StackDeps, StackEndpoints, StackStatus, StackTenant } from "./commands.js";
 export { checkDocker } from "./docker.js";
 export type { Check, DockerChecks } from "./docker.js";
-export type { ProxyStatus } from "./proxy.js";
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export declare function defaultStackDeps(env: Readonly<Record<string, string | undefined>>): StackDeps;
 /** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */
 export declare function stackCommand(name: string, args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
+/** Entry for `nylorun sandbox ls|rm`. */
+export declare function sandboxCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
+export { sandboxUsage } from "./sandbox.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function studioCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>, options?: {
     next?: string;

package/dist/stack/index.js

@@ -2,9 +2,10 @@ import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
+import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
-export { ensureStack, isStackCommand, readProxyReport, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
+export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
 export { checkDocker } from "./docker.js";
 function browserCommand(env) {
     if (process.platform === "darwin")
@@ -21,8 +22,6 @@ const STACK_ENV_OWNED = [
     "NYLORUN_TENANT_NAME",
     "NYLORUN_DERIVED_PRINCIPALS",
     "NYLORUN_STUDIO_ANALYTICS_ID",
-    "NYLORUN_STUDIO_PUBLIC_ORIGINS",
-    "NYLORUN_PROXY_PORT",
 ];
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export function defaultStackDeps(env) {
@@ -81,6 +80,11 @@ export function defaultStackDeps(env) {
 export async function stackCommand(name, args, env) {
     return await runStackCommand(name, args, defaultStackDeps(env));
 }
+/** Entry for `nylorun sandbox ls|rm`. */
+export async function sandboxCommand(args, env) {
+    return await runSandboxCommand(defaultStackDeps(env), args);
+}
+export { sandboxUsage } from "./sandbox.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/paths.d.ts

@@ -12,6 +12,21 @@ export interface StackPaths {
     record: string;
     /** The Tenant directory: homes, sandboxes, plugin data, logs. */
     tenant: string;
+    /**
+     * The Tenant directory's parts the harness container mounts (F6.2): workspaces, plugin data,
+     * and the home and temporary directory of MCP stdio servers.
+     */
+    harness: {
+        sandboxes: string;
+        pluginData: string;
+        home: string;
+        tmp: string;
+    };
+    /**
+     * Plugin roots on this machine (`plugins/`), mounted read-only at the same path into the
+     * runtime and harness containers, so a stdio MCP server's plugin root resolves there.
+     */
+    plugins: string;
     /** The keys directory, mounted only into the gateway (F4.2). */
     keys: string;
     /** The Tenant's vault key (KEK), `keys/vault-kek`. */

package/dist/stack/paths.js

@@ -9,6 +9,13 @@ export function stackPaths(hostRoot) {
         state: join(root, "host-state.json"),
         record: join(root, "tenant.json"),
         tenant: join(root, "tenant"),
+        harness: {
+            sandboxes: join(root, "tenant", "sandboxes"),
+            pluginData: join(root, "tenant", "plugin-data"),
+            home: join(root, "tenant", "home"),
+            tmp: join(root, "tenant", "tmp"),
+        },
+        plugins: join(root, "plugins"),
         keys: join(root, "keys"),
         vaultKey: join(root, "keys", "vault-kek"),
         home: join(root, "home"),

package/dist/stack/ports.d.ts

@@ -1,6 +1,4 @@
 export declare const DEFAULT_PORTS: {
-    /** The Studio proxy, one per machine (`http://<tenant>.localhost:<port>`). */
-    readonly proxy: 4160;
     readonly runtime: 8787;
     /** The Runtime's operator listener (Admin API). */
     readonly admin: 8788;

package/dist/stack/ports.js

@@ -1,7 +1,5 @@
 import { createServer } from "node:net";
 export const DEFAULT_PORTS = {
-    /** The Studio proxy, one per machine (`http://<tenant>.localhost:<port>`). */
-    proxy: 4160,
     runtime: 8787,
     /** The Runtime's operator listener (Admin API). */
     admin: 8788,

package/dist/stack/prepare.d.ts

@@ -1,4 +1,4 @@
-import { type StackEnv } from "./env-file.js";
+import { type SandboxStackEnv, type StackEnv } from "./env-file.js";
 import { type HostConfigFile } from "./host-files.js";
 import type { StackImages } from "./images.js";
 import type { StackPaths } from "./paths.js";
@@ -16,7 +16,8 @@ export declare function readStackEnv(paths: Pick<StackPaths, "env">): Promise<im
  * Write everything `docker compose up` needs under the Host root:
  * host.json, host-credentials.json (0600), docker/compose.yaml,
  * docker/.env (0600) and docker/restate-identity.pem (0600). Ports and the
- * Postgres password persist in .env; the identity key persists in its PEM.
+ * Postgres password persist in .env; the identity key persists in its PEM. The harness token
+ * and mode persist too; whether Restate's UI is published is decided on every start.
  */
 export declare function prepareStack(input: {
     paths: StackPaths;
@@ -43,6 +44,11 @@ export declare function prepareStack(input: {
     };
     /** The measurement id Studio reports page views to; absent when telemetry is off. */
     studioAnalyticsId?: string;
-    /** Studio's origin through the proxy; absent without the proxy. */
-    studioPublicOrigin?: string;
+    /**
+     * The sandboxes settings (`nylorun sandbox enable`); null removes them (`disable`).
+     * Undefined keeps the persisted ones while `sandboxes/cluster.json` exists.
+     */
+    sandboxes?: SandboxStackEnv | null;
+    /** Publish Restate's UI and admin port (`start --restate-ui`); undefined keeps the last start's choice. */
+    restateUi?: boolean;
 }): Promise<PreparedStack>;

package/dist/stack/prepare.js

@@ -4,6 +4,7 @@ import { renderComposeFile } from "./compose-file.js";
 import { parseFrameAncestors } from "@nylorun/core/contracts";
 import { CliError } from "../errors.js";
 import { DEFAULT_STUDIO_FRAME_ANCESTORS, parseDerivedPrincipals, parsePersisted, renderEnvFile, } from "./env-file.js";
+import { sandboxesEnabled } from "../sandbox/cluster-file.js";
 import { ensureHostCredentials, ensureVaultKey, ensureHostLayout, writeStackHostConfig, } from "./host-files.js";
 import { choosePort, DEFAULT_PORTS } from "./ports.js";
 import { ensureIdentityKey } from "./restate-identity.js";
@@ -30,7 +31,8 @@ export async function readStackEnv(paths) {
  * Write everything `docker compose up` needs under the Host root:
  * host.json, host-credentials.json (0600), docker/compose.yaml,
  * docker/.env (0600) and docker/restate-identity.pem (0600). Ports and the
- * Postgres password persist in .env; the identity key persists in its PEM.
+ * Postgres password persist in .env; the identity key persists in its PEM. The harness token
+ * and mode persist too; whether Restate's UI is published is decided on every start.
  */
 export async function prepareStack(input) {
     const { paths } = input;
@@ -69,6 +71,12 @@ export async function prepareStack(input) {
         postgresPassword: persisted.postgresPassword ?? randomBytes(24).toString("hex"),
         // Kept across starts: a new token would recreate the runtime and gateway containers.
         gatesToken: persisted.gatesToken ?? randomBytes(32).toString("hex"),
+        // Kept across starts: a new token would recreate the runtime and harness containers.
+        harnessToken: persisted.harnessToken ?? randomBytes(32).toString("hex"),
+        harness: persisted.harness ?? "remote",
+        restateUi: input.restateUi ?? persisted.restateUi ?? false,
+        // Kept across starts: a new key would recreate the runtime, gateway and rustfs containers.
+        objectStoreSecretKey: persisted.objectStoreSecretKey ?? randomBytes(32).toString("hex"),
         restateIdentityKey: identity.publicKey,
         uid: input.uid,
         gid: input.gid,
@@ -77,12 +85,17 @@ export async function prepareStack(input) {
         studioImage: input.images.studio,
         studioFrameAncestors,
         studioAnalyticsId: input.studioAnalyticsId ?? "",
-        studioPublicOrigins: input.studioPublicOrigin ?? "",
         tenantName: input.name,
         derivedPrincipals: (input.derivedPrincipals?.trim()
             ? parseDerivedPrincipals(input.derivedPrincipals, "NYLORUN_DERIVED_PRINCIPALS")
             : (persisted.derivedPrincipals ?? ["project"])).join(","),
     };
+    const sandboxes = input.sandboxes === null
+        ? undefined
+        : (input.sandboxes ?? (sandboxesEnabled(paths.root) ? persisted.sandboxes : undefined));
+    // The sandboxes image follows the Runtime's, like the runtime image, on every start.
+    if (sandboxes)
+        env.sandboxes = { ...sandboxes, image: input.images.sandboxes };
     const { adminKey } = await ensureHostCredentials(paths);
     await ensureVaultKey(paths);
     const host = await writeStackHostConfig(paths, {
@@ -91,6 +104,10 @@ export async function prepareStack(input) {
         runtimeVersion: input.runtimeVersion,
     });
     await writeFileMode(paths.env, renderEnvFile(env), 0o600);
-    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name), 0o644);
+    await writeFileMode(paths.compose, renderComposeFile(input.project, input.name, {
+        harness: env.harness,
+        ...(env.sandboxes ? { sandboxes: true } : {}),
+        ...(env.restateUi ? { restateUi: true } : {}),
+    }), 0o644);
     return { env, host, adminKey, firstRun };
 }

package/dist/stack/sandbox.d.ts

@@ -0,0 +1,4 @@
+import { type StackDeps } from "./commands.js";
+export declare const sandboxUsage = "  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]\n                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels\n  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)\n  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
+/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
+export declare function sandboxCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/sandbox.js

@@ -0,0 +1,106 @@
+/**
+ * `nylorun sandbox ls | rm`: the running local Tenant's sandbox resources (Host feature
+ * `sandboxes`), through its Tenant API as the Project's derived principal. Neither starts the
+ * Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster, F7.2) live in
+ * `../sandbox/commands.ts`.
+ */
+import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
+import { CliError } from "../errors.js";
+import { runSandboxCommand, sandboxUsage as clusterUsage } from "../sandbox/commands.js";
+import { spawnKubectl } from "../sandbox/kubectl.js";
+import { parseStackFlags, runningTenantApi } from "./commands.js";
+export const sandboxUsage = `  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]
+                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels
+  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)
+${clusterUsage}`;
+const usageError = (message) => new CliError(message, 2);
+async function call(deps, api, method, path) {
+    const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
+        method,
+        headers: {
+            authorization: `Bearer ${api.applicationKey}`,
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+            accept: "application/json",
+        },
+        redirect: "error",
+        signal: AbortSignal.timeout(15_000),
+    });
+    const body = (await response.json().catch(() => ({})));
+    if (response.status === 404 && path === "/v1/sandboxes")
+        throw new CliError(`Tenant ${api.name} runs a Runtime without sandboxes. Update it: npx nylorun@latest start.`, 1);
+    if (!response.ok && response.status !== 404)
+        throw new CliError(`${method} ${path} returned ${response.status}${typeof body.message === "string" ? `: ${body.message}` : ""}`, 1);
+    return { status: response.status, body };
+}
+function labelsText(labels) {
+    const entries = Object.entries(labels);
+    return entries.length === 0 ? "-" : entries.map(([key, value]) => `${key}=${value}`).join(",");
+}
+async function ls(deps, args) {
+    const usage = "nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"], lists: ["--label"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const query = new URLSearchParams();
+    for (const label of flags.lists.get("--label") ?? []) {
+        if (label.indexOf("=") <= 0)
+            throw usageError(`--label must be key=value, not ${label}`);
+        query.append("label", label);
+    }
+    const name = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
+    const search = query.toString();
+    const { body } = await call(deps, api, "GET", `/v1/sandboxes${search ? `?${search}` : ""}`);
+    const sandboxes = (body.sandboxes ?? []);
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(sandboxes, null, 2));
+        return 0;
+    }
+    if (sandboxes.length === 0) {
+        deps.out(`No sandboxes on Tenant ${api.name}.`);
+        return 0;
+    }
+    const rows = [
+        ["ID", "KIND", "STATE", "SESSIONS", "LABELS"],
+        ...sandboxes.map((sandbox) => [
+            sandbox.id,
+            sandbox.kind,
+            sandbox.state,
+            String(sandbox.sessions.length),
+            labelsText(sandbox.labels),
+        ]),
+    ];
+    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+    for (const row of rows)
+        deps.out(row
+            .map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column])))
+            .join("  "));
+    return 0;
+}
+async function rm(deps, args) {
+    const usage = "nylorun sandbox rm <id> [--tenant <name>]";
+    const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
+    if (flags.rest.length !== 1)
+        throw usageError(`Usage: ${usage}`);
+    const id = flags.rest[0];
+    const name = flags.values.get("--tenant");
+    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
+    const { status, body } = await call(deps, api, "DELETE", `/v1/sandboxes/${encodeURIComponent(id)}`);
+    if (status === 404 || body.deleted !== true) {
+        deps.err(`No sandbox ${id} on Tenant ${api.name}.`);
+        return 1;
+    }
+    deps.out(`Deleted sandbox ${id} and its files.`);
+    return 0;
+}
+/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
+export async function sandboxCommand(deps, args) {
+    const [sub, ...rest] = args;
+    if (sub === "ls" || sub === "list")
+        return ls(deps, rest);
+    if (sub === "rm" || sub === "delete")
+        return rm(deps, rest);
+    if (sub === "enable" || sub === "disable" || sub === "status")
+        return runSandboxCommand(args, { stack: deps, kubectl: spawnKubectl(deps.env) });
+    throw usageError(`Usage:\n${sandboxUsage}`);
+}

package/dist/stack/stacks.d.ts

@@ -1,3 +1,4 @@
+import type { DockerRunner } from "./docker.js";
 /**
  * The machine's local Tenants (tenancy.md §6): one installation per Tenant, each with its own
  * Host root `~/.nylorun/tenants/<name>/`, Compose project `nylorun-<name>`, ports and volumes.
@@ -48,3 +49,10 @@ export declare function chooseTenantName(base: string, projectDir: string): Prom
  * volumes with new keys.
  */
 export declare function moveStackRoots(base: string, err: (line: string) => void): Promise<void>;
+/**
+ * Remove the Studio proxy of nylorun 0.6 (a Caddy container `nylorun-proxy` on its own network,
+ * files in `~/.nylorun/proxy/`). Removing the container also detaches it from the Tenants'
+ * networks, so their `docker compose down` works again. The directory goes last, once Docker
+ * removed both (or never had them), so a Docker that does not answer is retried next time.
+ */
+export declare function removeOldProxy(docker: DockerRunner, base: string, err: (line: string) => void): Promise<void>;

package/dist/stack/stacks.js

@@ -148,3 +148,22 @@ export async function moveStackRoots(base, err) {
         err(`Moved Tenants ${moved.join(", ")} from ${tilde(stacks)} to ${tilde(tenantsDir(base))}.`);
     }
 }
+/**
+ * Remove the Studio proxy of nylorun 0.6 (a Caddy container `nylorun-proxy` on its own network,
+ * files in `~/.nylorun/proxy/`). Removing the container also detaches it from the Tenants'
+ * networks, so their `docker compose down` works again. The directory goes last, once Docker
+ * removed both (or never had them), so a Docker that does not answer is retried next time.
+ */
+export async function removeOldProxy(docker, base, err) {
+    const dir = join(base, "proxy");
+    if (!existsSync(dir))
+        return;
+    const container = await docker.run(["rm", "--force", "nylorun-proxy"]);
+    if (container.code !== 0 && !/no such container/i.test(container.stderr))
+        return;
+    const network = await docker.run(["network", "rm", "nylorun-proxy"]);
+    if (network.code !== 0 && !/not found|no such network/i.test(network.stderr))
+        return;
+    await rm(dir, { recursive: true, force: true });
+    err("Removed the Studio proxy of nylorun 0.6 (nylorun-proxy); each Studio is on its own localhost port again (\"nylorun studio\" opens it).");
+}

package/dist/stack/studio-login.d.ts

@@ -3,8 +3,8 @@ export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>
 export declare function studioOrigin(port: number): string;
 /**
  * Ask the Studio container for a single-use login token with the admin key
- * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port, or
- * the proxy's `http://<name>.localhost:<port>`) and return the URL to open there.
+ * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port)
+ * and return the URL to open there.
  * Accepts `{ loginUrl }`, `{ url }` or `{ token }` in the response.
  */
 export declare function mintStudioLogin(input: {

package/dist/stack/studio-login.js

@@ -5,8 +5,8 @@ export function studioOrigin(port) {
 }
 /**
  * Ask the Studio container for a single-use login token with the admin key
- * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port, or
- * the proxy's `http://<name>.localhost:<port>`) and return the URL to open there.
+ * (`POST /_studio/login-tokens`, Studio §6) on `origin` (its published port)
+ * and return the URL to open there.
  * Accepts `{ loginUrl }`, `{ url }` or `{ token }` in the response.
  */
 export async function mintStudioLogin(input) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nylorun",
-  "version": "0.6.0-beta",
+  "version": "0.8.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose",
@@ -30,18 +30,18 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.11.0-beta"
+    "@nylorun/core": "0.12.0-beta"
   },
   "devDependencies": {
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "@types/node": "^26.5.0",
-    "vitest": "^5.0.1"
+    "vitest": "^5.0.2"
   },
   "bin": {
     "nylorun": "dist/cli.js"
   },
   "nylorun": {
-    "runtime": "0.15.2-beta",
-    "studio": "0.17.0-beta"
+    "runtime": "0.16.0-beta",
+    "studio": "0.19.0-beta"
   }
 }

package/dist/stack/proxy.d.ts

@@ -1,78 +0,0 @@
-import type { DockerRunner } from "./docker.js";
-import { type PortProbe } from "./ports.js";
-/**
- * The Studio proxy: one small Caddy container per machine that gives each local Tenant's
- * Studio the address `http://<name>.localhost:<port>`. Browsers keep cookies per host, not
- * per port, so separate hosts keep the Studios' sessions apart. It routes browsers to Studio
- * only (programs keep the Runtime's `http://localhost:<port>`: Node's resolver need not
- * resolve `*.localhost`) and holds no Tenant data: its files are `~/.nylorun/proxy/`
- * (`compose.yaml`, `Caddyfile`, `.env`), and Caddy's own state is tmpfs.
- *
- * The proxy joins each Tenant's network (named after its Compose project) and reaches Studio
- * by container name, `<project>-studio:3000`. Docker cannot remove a network the proxy is
- * attached to, so `reset` and `delete` disconnect it first.
- */
-export declare const PROXY_PROJECT = "nylorun-proxy";
-export declare const PROXY_CONTAINER = "nylorun-proxy";
-export interface ProxyPaths {
-    dir: string;
-    compose: string;
-    caddyfile: string;
-    /** The port, and whether Docker took the `::1` binding. */
-    env: string;
-}
-export declare function proxyPaths(base: string): ProxyPaths;
-/** `NYLORUN_PROXY_DISABLED=1`: no proxy; Studio is `http://localhost:<port>`. */
-export declare function proxyDisabled(env: Readonly<Record<string, string | undefined>>): boolean;
-export declare function proxyOrigin(name: string, port: number): string;
-export interface ProxySettings {
-    port: number;
-    /** Also published on `[::1]` (false once Docker refused it). */
-    ipv6: boolean;
-}
-export declare function readProxySettings(base: string): Promise<ProxySettings | undefined>;
-/**
- * The proxy's settings. On first use its port is 4160 when free, else a free one outside
- * `taken`; it is kept after that.
- */
-export declare function ensureProxySettings(base: string, ports: PortProbe, taken: ReadonlySet<number>): Promise<ProxySettings>;
-/** A Tenant the proxy routes to: its name and Compose project (also its network's name). */
-export interface ProxyRoute {
-    name: string;
-    project: string;
-}
-/**
- * One site per Tenant. Site addresses carry no port: Caddy listens on 80 in the container,
- * and its host match ignores the published port in the browser's Host. The browser's Host
- * (`<name>.localhost:<port>`) reaches Studio unchanged, which Studio checks; a Tenant that is
- * not running answers 502, and an unknown host 404.
- */
-export declare function renderCaddyfile(routes: readonly ProxyRoute[]): string;
-export declare function renderProxyCompose(ipv6: boolean): string;
-/** Detach the proxy from a Tenant's network, so Compose can remove it; never fails. */
-export declare function disconnectProxy(docker: DockerRunner, network: string): Promise<void>;
-/**
- * Write the routes, bring the proxy up (Compose recreates it when its file changed), attach
- * it to every routed Tenant's network and reload Caddy. Never throws: a problem is warned
- * once and the caller shows Studio's own port. When Docker refuses `[::1]` (IPv6 off), the
- * proxy listens on 127.0.0.1 only, and says so once.
- */
-export declare function startProxy(input: {
-    docker: DockerRunner;
-    base: string;
-    settings: ProxySettings;
-    routes: readonly ProxyRoute[];
-    err(line: string): void;
-    pollMs?: number;
-}): Promise<boolean>;
-/** Rewrite the routes of an existing proxy and reload it (`delete`); never fails. */
-export declare function refreshProxyRoutes(docker: DockerRunner, base: string, routes: readonly ProxyRoute[]): Promise<void>;
-/** Stop the proxy (`stop --all`); true when it stopped. */
-export declare function stopProxy(docker: DockerRunner): Promise<boolean>;
-export interface ProxyStatus {
-    state: "running" | "stopped" | "absent" | "disabled";
-    port?: number;
-    ipv6?: boolean;
-}
-/** The proxy as `nylorun doctor` reports it. */
-export declare function readProxyStatus(docker: DockerRunner, base: string, env: Readonly<Record<string, string | undefined>>): Promise<ProxyStatus>;