systemprompt-cloud 0.25.0

Cloud API client, credentials, OAuth, and tenant management for systemprompt.io AI governance deployments. Remote sync and multi-tenant orchestration for the MCP governance pipeline.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190

//! Compile-time constants for the cloud layer: container paths, callback ports
//! and timeouts, API endpoints, deploy regions, and on-disk file/profile names.
//!
//! Grouped into submodules by concern (`oauth`, `checkout`, `credentials`,
//! `docker`, `api`, `regions`, `paths`, `profile`, `env_vars`); path-name and
//! storage constants are re-exported from `systemprompt_models`.
//!
//! Copyright (c) systemprompt.io — Business Source License 1.1.
//! See <https://systemprompt.io> for licensing details.

pub use systemprompt_models::paths::constants::{build, dir_names, file_names, storage};

pub mod container {
    use systemprompt_models::paths::constants::cloud_container;

    pub const APP: &str = cloud_container::APP_ROOT;
    pub const APP_ROOT: &str = cloud_container::APP_ROOT;
    pub const BIN: &str = cloud_container::BIN;
    pub const LOGS: &str = cloud_container::LOGS;
    pub const SERVICES: &str = cloud_container::SERVICES;
    pub const STORAGE: &str = cloud_container::STORAGE;
    pub const WEB: &str = cloud_container::WEB;
    pub const WEB_DIST: &str = cloud_container::WEB_DIST;
    pub const WEB_CONFIG: &str = cloud_container::WEB_CONFIG;
    pub const PROFILES: &str = cloud_container::PROFILES;
    pub const TEMPLATES: &str = cloud_container::TEMPLATES;
    pub const ASSETS: &str = cloud_container::ASSETS;
}

pub const CALLBACK_TIMEOUT_SECS: u64 = 300;

pub mod oauth {
    pub const CALLBACK_PORT: u16 = 8765;
    pub const CALLBACK_TIMEOUT_SECS: u64 = super::CALLBACK_TIMEOUT_SECS;
}

pub mod checkout {
    pub const CALLBACK_PORT: u16 = 8766;
    pub const CALLBACK_TIMEOUT_SECS: u64 = super::CALLBACK_TIMEOUT_SECS;
    pub const PROVISIONING_POLL_INTERVAL_MS: u64 = 2000;
}

pub mod credentials {
    use super::{dir_names, file_names};

    pub const DEFAULT_DIR_NAME: &str = dir_names::SYSTEMPROMPT;
    pub const DEFAULT_FILE_NAME: &str = file_names::CREDENTIALS;

    /// Cached validation TTL for `/api/v1/auth/me`.
    ///
    /// Skip the round-trip when on-disk credentials were validated within this
    /// window — short enough that a revoked token is rejected on the next demo
    /// turn, long enough to absorb back-to-back CLI invocations.
    pub const VALIDATION_TTL_SECS: i64 = 900;
}

pub mod tenants {
    use super::{dir_names, file_names};

    pub const DEFAULT_DIR_NAME: &str = dir_names::SYSTEMPROMPT;
    pub const DEFAULT_FILE_NAME: &str = file_names::TENANTS;
}

pub mod cli_session {
    use super::{dir_names, file_names};

    pub const DEFAULT_DIR_NAME: &str = dir_names::SYSTEMPROMPT;
    pub const DEFAULT_FILE_NAME: &str = file_names::SESSION;
}

pub mod docker {
    pub const CONTAINER_NAME_PREFIX: &str = "systemprompt-postgres";
    pub const COMPOSE_PATH: &str = "infrastructure/docker";

    pub fn container_name(env_name: &str) -> String {
        format!("{}-{}", CONTAINER_NAME_PREFIX, env_name)
    }
}

pub mod api {
    pub const PRODUCTION_URL: &str = "https://api.systemprompt.io";
    pub const SANDBOX_URL: &str = "https://api-sandbox.systemprompt.io";
    pub const DB_PRODUCTION_HOST: &str = "db.systemprompt.io";
    pub const DB_SANDBOX_HOST: &str = "db-sandbox.systemprompt.io";
}

pub mod regions {
    pub const AVAILABLE: &[(&str, &str)] = &[
        ("iad", "US East (Virginia)"),
        ("lhr", "Europe (London)"),
        ("fra", "Europe (Frankfurt)"),
        ("ams", "Europe (Amsterdam)"),
        ("sin", "Asia (Singapore)"),
        ("nrt", "Asia (Tokyo)"),
        ("syd", "Australia (Sydney)"),
        ("gru", "South America (São Paulo)"),
    ];
}

pub mod paths {
    use super::{dir_names, file_names};

    pub const ROOT_DIR: &str = dir_names::SYSTEMPROMPT;
    pub const PROFILES_DIR: &str = dir_names::PROFILES;
    pub const DOCKER_DIR: &str = dir_names::DOCKER;
    pub const STORAGE_DIR: &str = dir_names::STORAGE;
    pub const DOCKERFILE: &str = file_names::DOCKERFILE;
    pub const PROFILE_CONFIG: &str = file_names::PROFILE_CONFIG;
    pub const PROFILE_SECRETS: &str = file_names::PROFILE_SECRETS;
    pub const CREDENTIALS_FILE: &str = file_names::CREDENTIALS;
    pub const TENANTS_FILE: &str = file_names::TENANTS;
    pub const SESSION_FILE: &str = file_names::SESSION;
    pub const PROFILE_DOCKER_DIR: &str = dir_names::DOCKER;
    pub const ENTRYPOINT: &str = file_names::ENTRYPOINT;
    pub const DOCKERIGNORE: &str = file_names::DOCKERIGNORE;
    pub const COMPOSE_FILE: &str = file_names::COMPOSE;
}

pub mod profile {
    use super::container;

    pub const DEFAULT_DB_TYPE: &str = "postgres";
    pub const DEFAULT_PORT: u16 = 8080;
    pub const LOCAL_HOST: &str = "127.0.0.1";
    pub const CLOUD_HOST: &str = "0.0.0.0";
    pub const DEFAULT_CLOUD_URL: &str = "https://cloud.systemprompt.io";
    pub const LOCAL_ISSUER: &str = "systemprompt-local";
    pub const CLOUD_ISSUER: &str = "systemprompt";
    pub const ACCESS_TOKEN_EXPIRATION: i64 = 2_592_000;
    pub const REFRESH_TOKEN_EXPIRATION: i64 = 15_552_000;
    pub const CLOUD_APP_PATH: &str = container::APP_ROOT;
    pub const CREDENTIALS_PATH: &str = "../../credentials.json";
    pub const TENANTS_PATH: &str = "../../tenants.json";
}

pub mod proxies {
    pub const PRIVATE_RANGES: &[&str] = &[
        "127.0.0.0/8",
        "::1/128",
        "10.0.0.0/8",
        "172.16.0.0/12",
        "192.168.0.0/16",
    ];

    pub const FLY_PRIVATE_RANGES: &[&str] = &["fc00::/7"];

    pub const FLY_PUBLIC_RANGES: &[&str] = &["66.241.64.0/18"];

    pub const CLOUDFLARE_RANGES: &[&str] = &[
        "173.245.48.0/20",
        "103.21.244.0/22",
        "103.22.200.0/22",
        "103.31.4.0/22",
        "141.101.64.0/18",
        "108.162.192.0/18",
        "190.93.240.0/20",
        "188.114.96.0/20",
        "197.234.240.0/22",
        "198.41.128.0/17",
        "162.158.0.0/15",
        "104.16.0.0/13",
        "104.24.0.0/14",
        "172.64.0.0/13",
        "131.0.72.0/22",
        "2400:cb00::/32",
        "2606:4700::/32",
        "2803:f800::/32",
        "2405:b500::/32",
        "2405:8100::/32",
        "2a06:98c0::/29",
        "2c0f:f248::/32",
    ];
}

pub mod env_vars {
    pub use systemprompt_models::paths::constants::env_vars::CUSTOM_SECRETS;

    pub const SYSTEM_MANAGED: &[&str] = &["FLY_APP_NAME", "FLY_MACHINE_ID"];

    pub const CLI_SYNCED: &[&str] = &[
        "SYSTEMPROMPT_API_TOKEN",
        "SYSTEMPROMPT_USER_EMAIL",
        "SYSTEMPROMPT_CLI_REMOTE",
        "SYSTEMPROMPT_PROFILE",
    ];

    pub fn is_system_managed(key: &str) -> bool {
        SYSTEM_MANAGED.iter().any(|&k| k.eq_ignore_ascii_case(key))
    }
}