@hyperscale0/cli 1.0.329 → 1.0.330

package/AGENTS.md

@@ -31,16 +31,24 @@ and product IDs come from the login and the selected product. Lists accept
 pass `--idempotency-key` to retry safely. Without a TTY a missing required flag
 exits 2 and names the flag.
 
-Start with `hyperscale auth login --no-open --json`. The URL and code go to
-stderr. A person approves them in the browser. Rerun to resume a pending login.
-Verify with `hyperscale whoami --json`. To create an account, pipe the
+Check `hyperscale whoami --json` first. To sign in a founder who has an
+account, pipe their password on stdin to `auth login --email <email> --json`;
+it mails a six-digit code and exits. Ask the founder for the code, then run
+`auth login --code <code> --json`. To approve in a browser instead, run
+`auth login --no-open --json`: the first stdout line is `approval_needed` with
+the code and URL, and the last is `signed_in`. Rerun to resume a pending login.
+For CI, pipe a `hyperscale_pat_` token to `auth login --with-token`. To create an account, pipe the
 founder's password on stdin to `auth signup --email <email> --name <name>
 --company <company> --json`; it mails a six-digit code and exits. Ask the
 founder for the code, then run `auth signup --code <code> --json`. The account
 starts in sandbox. `auth verify` confirms an existing account's email the same
 way. Do not print or persist credentials in project files.
 
-Browser login creates a named agent member with its own CLI grant. Access
+Either login creates a named agent member with its own CLI grant. In sandbox
+it acts as the founder, `--on-behalf-of` included; `whoami` shows the
+founder's team role. The grant ends after 30 days, or 7 days unused, and so do
+sandbox keys `key create --name <name>` makes from it. `doctor` names where the
+token is stored. Access
 tokens last ten minutes; the CLI rotates the refresh token and keeps both in
 Keychain or a mode 0600 file. Logout removes them locally. Revoke the member or
 grant in the browser; `--revoke` only revokes a human PAT. Sandbox work within

package/README.md

@@ -24,6 +24,20 @@ Approve the URL and code in your browser. The CLI saves your login on this
 device. Use `--no-open` to approve on another device. A pending sign-in resumes
 when you run the command again.
 
+On a machine with no browser, sign in with your password and an emailed code:
+`hyperscale auth login --email you@example.com`. Without a terminal, pipe the
+password and finish in a second call:
+
+```sh
+printf '%s\n' "$PASSWORD" | hyperscale auth login --email you@example.com --json
+hyperscale auth login --code 123456 --json
+```
+
+A login ends after 30 days, or 7 days unused. `whoami` shows when.
+`hyperscale doctor` names where the token is stored: the macOS Keychain or a
+private file in the config folder. For CI, pipe a personal access token to
+`hyperscale auth login --with-token`, or set `HYPERSCALE_TOKEN`.
+
 To create an account without a browser, run `hyperscale auth signup`. It asks
 for your name, work email, company and a password, solves a short proof of work,
 and mails a six-digit code. Type the code and the CLI is signed in to the new
@@ -93,20 +107,20 @@ step that fails:
 ```json
 {
   "scenario": "A first rental",
-  "customers": { "maya": { "name": "Maya Brooks", "fund": "100000" } },
+  "customers": { "maya": { "name": "Maya Brooks", "fund": "1000" } },
   "steps": [
     {
       "create": "rental",
       "as": "camera",
       "by": "maya",
-      "fields": { "item": "Camera", "renter": "Maya", "price": "75000" }
+      "fields": { "item": "Camera", "renter": "Maya", "price": "750" }
     },
     { "run": "agree_rental", "on": "camera", "by": "maya" },
     { "advance": "4d" },
-    { "fund": "maya", "amount": "5000" },
+    { "fund": "maya", "amount": "50" },
     {
       "name": "Maya has her change",
-      "expect": { "balances": { "maya": { "settled": "30000" } } }
+      "expect": { "balances": { "maya": { "settled": "300.00" } } }
     }
   ]
 }
@@ -116,9 +130,10 @@ Each customer is created, given a sandbox account and funded first. `create`
 makes an object, `run` runs an action on it, `fund` adds sandbox money,
 `advance` moves the sandbox clock (`30m`, `4h`, `2d`, `1w` or an ISO time) and
 `expect` checks balances. A plain balance compares to `available`; an object
-can name `available`, `settled` or `pending`. Amounts are minor-unit strings,
-as in the API. Funding and actions need the Product key in
-`HYPERSCALE_API_KEY`. `scenario init` writes a working example for the
+can name `available`, `settled` or `pending`. Amounts are major units, as
+`fund` takes them (`"750"` or `"750.50"` in SAR), in money fields and action
+input too; the runner sends the API minor units. Funding and actions need the
+Product key in `HYPERSCALE_API_KEY`. `scenario init` writes a working example for the
 Product.
 
 ```sh
@@ -137,7 +152,7 @@ with the `whsec_` secret it prints. The secret stays the same for a profile,
 so your handler keeps verifying across restarts. `log tail` reads the developer
 log of your API calls with their request ids; `log explain` shows one call's
 inputs, error, fix and receipt with secrets redacted. `doctor` checks the CLI,
-config directory, API, login, Product and sandbox clock and prints a fix for
+config directory, API, login, token store, Product and sandbox clock and prints a fix for
 each failure. `export records` prints transfers, receipts or one account's
 statements as CSV.
 
@@ -180,6 +195,10 @@ hyperscale architect chat --brief "Review this product" --json
 hyperscale open
 ```
 
+`key create --name` names the key, and `key list` shows each name and expiry.
+A key made from a CLI login ends when that login ends; `key create` prints the
+date. A key made in the browser lasts 90 days.
+
 API access covers all published operations. A request that needs browser
 review prints a URL and a saved reference. Approve it, then use `api resume`.
 Approval alone does not mean the request completed.