Metadata-Version: 2.4
Name: nkx-runtime
Version: 2.2.1
Summary: Nakodax customer runtime SDK — credential chain, KEK exchange, protected module loader
License: Proprietary
Project-URL: Homepage, https://nakodax.com
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: cryptography>=42
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == "dev"

# nkx-runtime

Runtime SDK for applications protected by Nakodax. Decrypts protected
modules in memory at import time — nothing is written to disk in plaintext.

## Install

```bash
pip install nkx-runtime
```

## Use

```python
from nkx_runtime import RuntimeClient

RuntimeClient.from_env().install()
```

Or, with no source change — swap your process's start command:

```bash
nkx-run app.py
nkx-run -m myapp.cli   # module mode, e.g. gunicorn/celery workers
```

## Configuration

The client reads its credentials and endpoint from environment variables
(`NKX_LICENSE_KEY`, `NKX_LICENSE_PUBLIC_KEY`, `NKX_KEK_URL`, and a
one-time `NKX_REGISTER_TOKEN` for first boot). Your Nakodax dashboard's
Connect page for a protected repository gives you the exact values and
commands for your deployment.

## CI builds (SQL, or a bundled TypeScript/JS build step)

Code protected at the `prebuild` tier needs a decrypt step ahead of your
own compiler, migration runner, or bundler — this is a separate,
dependency-free CLI, not part of this package:

```bash
brew install nakodax/tap/nkx   # or see https://github.com/nakodax/nkx-cli
nkx materialize ./repo --into /dev/shm/build
```

Your Nakodax dashboard's Connect page for the repository has the exact
commands and credentials for your CI setup, including the re-encrypt step
for a compiled TypeScript/JS output.
