@nylorun/cli 0.5.0-beta → 0.7.0-beta

package/CHANGELOG.md

@@ -1,5 +1,172 @@
 # @nylorun/cli
 
+## 0.7.0-beta
+
+### Major Changes
+
+- 5ca1923: **Clients for one Tenant per installation: a stack per project, nothing selects a Tenant.** Upgrade these with the Runtime; they speak protocol 5. Existing stacks are left as they are: see MIGRATION.md.
+
+  - **Breaking (`nylorun`): one stack per project.** `nylorun start` in a project creates the project's stack (named after the project directory, or `--name`; Host root `~/.nylorun/stacks/<name>/`, Compose project `nylorun-<name>`, its own free ports and volumes), waits for its Runtime to create the stack's Tenant, writes the Project link (`.nylorun/link.json` format 2: `stack`, `hostUrl`, `hostId`, `tenantId`) and `.nylorun/credentials.json` (the key of the derived principal `project`, derived from the stack's admin key), and seeds the model provider from the project's `.env`. `nylorun ls` lists the machine's stacks and `nylorun delete <name>` removes one with its volumes and Host root. `nylorun status` shows the stack's Tenant; `nylorun studio` opens it. The old single stack under `~/.nylorun` is never touched: `start` notes it, and `nylorun legacy stop|delete` handles it. Every stack command takes `--name <stack>` (or `NYLORUN_STACK`, or the Project link's stack); `start --no-link` starts a stack without linking the directory; `nylorun reset` resets the selected stack only. The runtime container's healthcheck is now `/health`, so a Tenant that cannot open is reported by `start` from the Admin status at once instead of after a 300 s wait. `NYLORUN_HOME` still overrides the Host root. Stacks start and stop only when you say so.
+  - **Breaking (`@nylorun/cli`): no Tenant commands.** `nylo tenant create|use|list|current|delete` are removed; `nylo status`, `nylo reset` and `nylo endpoints` replace `nylo tenant status|reset|endpoints` on the linked installation. `nylo env` prints `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` only. `nylo` no longer writes Project links.
+  - **Breaking (`@nylorun/agents`): no Tenant to name.** The `tenant` option (`createClient`, `Transport`, `resolveConnection`, `createActionHandler({ runtime })`, `JwksCache`) and `NYLORUN_TENANT` are gone, and no request sends `Nylorun-Tenant`; a connection is a URL and a key. A Project link of format 0 or 1 is refused with `connection_missing`, naming `npx nylorun start`. `verifyDeliveryToken`'s `tenantId` is optional: without it any Tenant issuer is accepted, since the installation's keys bind it. `TENANT_HEADER` is no longer re-exported.
+  - **Breaking (`@nylorun/admin`): status only.** `createTenant`, `listTenants`, `getTenant` and `deleteTenant` are removed; `status().tenant` names the Host's Tenant, and `deriveTenantKey` / `deriveStudioToken` derive its keys. Local Host resolution reads the stack's Host root (`stack` option, `NYLORUN_STACK`, or the Project link's `stack`); `NYLORUN_HOME` and `home` still override it. `stackHostRoot(name)` is exported.
+  - **Breaking (`@nylorun/studio`): Studio serves its installation's Tenant.** The Tenant picker, list and create are gone, with `/_studio/tenants`; `/` opens `/tenants/<id>`. The `/tenants/:tenant` routes and the login token's `tenant` claim stay for embedders and must name that Tenant. The proxy sends no `Nylorun-Tenant`.
+  - **`@nylorun/create-agent`:** the next steps are `npx nylorun start`, then `npm run dev`.
+  - `@nylorun/core`: `ProjectLinkFileSchema` accepts format 2 with `stack`, and `tenantId` is optional; `ERROR_CODES` loses `tenant_conflict` and `active_work`.
+
+- 5ca1923: **One Tenant per installation: a database per Tenant, protocol 5.** A Runtime serves exactly one Tenant, the one its Postgres database holds. Two Tenants are two installations.
+
+  - **Breaking: fresh start.** The Tenant's state is in the fixed schema `nylorun` of its own database and its record in `nylorun_streams`, keyed by session (no `tenant_id`). A database written by an earlier Runtime (`tenant_<id>` schemas, or a record keyed by Tenant) is refused: the Host stays up but not ready, and `/v1/admin/status` names the cause `database-layout-old`. Point the Runtime at a new database (with the local stack, a new stack); the old one is never changed.
+  - **The Host creates its Tenant** on first start, in the migration transaction: `NYLORUN_TENANT_ID` (default a new id), `NYLORUN_TENANT_NAME` (default `default`), the Studio principal and the derived principals of `NYLORUN_DERIVED_PRINCIPALS` (comma-separated, default `project`), whose keys the admin key derives (`deriveTenantKey`). Later starts open the same Tenant and add derived principals configured since.
+  - **Breaking: no Tenant catalog.** `/v1/admin/tenants` and `/v1/admin/tenants/{tenantId}` are gone (404). `AdminStatus.tenants[]` is replaced by `AdminStatus.tenant` (`id`, `name`, `state: open | unavailable`, `envelope`, and `cause` when it could not be opened). `CreateTenantRequestSchema`, `AdminTenantSchema`, `AdminTenantStatusSchema`, `AdminTenantListSchema` and `QuarantineSchema` leave `@nylorun/core`; `HostTenantSchema` and `TenantCauseSchema` replace them. `@nylorun/admin`'s `listTenants`, `getTenant`, `deleteTenant` and `createTenant` are removed (see below).
+  - **Readiness instead of quarantine.** A Tenant that cannot be opened (`schema-too-new`, `kek-missing`, `migration-failed`, `envelope-invalid`, `database-layout-old`, …) fails `/ready` (check `tenant`, which replaces `discovery`) and is reported with its repair in `/v1/admin/status` and the log; every Tenant request gets the opaque 404. A failure outside it (Postgres unreachable) is retried.
+  - **Protocol 5.** `PROTOCOL_VERSION = 5`; the Host serves protocols 4 and 5 for one release. Clients no longer require `runtime-tenants`; the Host still advertises it. No request needs `Nylorun-Tenant`: a request without it reaches the Host's Tenant, and one naming another Tenant (or a malformed one), or a publishable key of another Tenant, gets the opaque 404. The OpenAPI documents drop the header parameter and the Admin Tenant routes.
+  - **Paths.** The Tenant directory is `<Host root>/tenant/` (was `tenants/<id>/`); `trash/` and the SQLite move to it are gone. The gates service serves its database's Tenant, and its `Nylorun-Tenant` header is optional (when sent, it must name that Tenant).
+  - **Breaking: `startEphemeralRuntime` needs a database; the in-memory Session Store is removed.** `StartEphemeralRuntimeOptions.database` is required: a Postgres URL, for which the Runtime opens a pool and ends it on `close()`, or a pool the caller ends. It creates its Tenant in that database through the same bootstrap as a Host, or serves the Tenant the database already holds; the data stays after `close()`, so give each test Tenant a database of its own. Durable Streams and scheduling stay in process. See `MIGRATION.md`.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [5ca1923]
+- Updated dependencies [5ca1923]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.11.0-beta
+  - @nylorun/admin@0.7.0-beta
+
+## 0.6.0-beta
+
+### Minor Changes
+
+- 4282d5f: **Breaking: executors are removed; protocol 3.** The Runtime delivers every Action (tool, hook, `fn`, `verify`) to the Action endpoint an agent registers. It no longer offers Actions for executors to claim. See `MIGRATION.md`, "Action endpoints replace executors".
+
+  - **Core.** `PROTOCOL_VERSION` is 3 and a Host serves only protocol 3. `action-endpoints` is a protocol feature instead of an optional Host feature. Removed:
+
+    - the executor, claim and Action-list schemas;
+    - `action_result` from `SessionCommandSchema`;
+    - the `claimed` Action status, `claimId` and `leaseExpiresAt`.
+
+    New: `ActionResultReceiptSchema`, the receipt of `POST /v1/actions/:id/result`, which is `AcceptedResponse` without `requestId`.
+
+  - **Runtime.** Removed:
+
+    - `PUT`/`GET /v1/executors`, `DELETE /v1/executors/:agentId`, `GET /v1/executors/connect`;
+    - `GET /v1/actions`, `POST /v1/actions/:id/claim`, and the executor form of `POST /v1/actions/:id/heartbeat`;
+    - the `tenant/work` stream;
+    - claim expiry;
+    - executor credentials.
+
+    `POST /v1/actions/:id/sandbox/:tool` takes the delivery token only. Tenant summaries report `inFlightDeliveries` instead of `connectedExecutors`. Tenant status lists each agent's endpoint and has an `endpoints` check instead of `executors`.
+
+    Postgres migration 6 drops the `executors` table. Actions an executor had claimed are handled like lost deliveries: a tool becomes `uncertain`, and a hook, `fn` or `verify` is delivered again.
+
+  - **Agents.** Removed: `connectAgents`, the `@nylorun/agents/executor` subpath, derived executor keys and `NYLORUN_EXECUTOR_KEY`. Serve agents with `createActionHandler` and call `register({ url })`.
+  - **CLI.** Executor keys are gone from Project credentials. `nylo tenant endpoints` shows each endpoint and its health.
+
+- 82d95ef: **Action endpoints: background tools, CLI and Studio.**
+
+  - **Background tools (core, agents).** `tool({ …, background: true })` marks a tool that runs longer than an endpoint's timeout. The option is code-only and never serialized into the manifest. `createActionHandler` answers its delivery at once with `202`, runs the tool, heartbeats on the deadline the Runtime returns (each time with the newest delivery token), and posts the outcome. A heartbeat answered `409` (cancelled, lost or sent again) aborts the tool's `ctx.signal`, and nothing is posted. The new `waitUntil` option hands the background work to platforms that end a request's work with its response.
+  - **CLI.** `nylo tenant endpoints [--json]` lists each agent's Action endpoint and how it is doing, and `nylo tenant endpoints ping <agent>` pings one through the Runtime.
+  - **Studio.** Shows `action.delivered` ("Action delivered") and `action.delivery_failed` ("Delivery failed", with the endpoint's error and when it retries).
+
+- 50d0fb5: **Browser access: web pages and apps call the Runtime with a publishable key.** A page ships a publishable key and gets subject tokens from its app server; the Runtime answers it directly, with CORS (optional Host feature `browser-access`).
+
+  - **Publishable keys.** `nr_pub_<tenantId>_…`, sent in `Nylorun-Key`, name the Tenant and one app, with an origin allowlist (exact origins, or `http://localhost:*` and `http://127.0.0.1:*` for development; none for native apps). `GET`/`POST /v1/access/publishable-keys`, `PUT`/`DELETE …/:id`. A key alone grants the policy's `anon` role, at most the public agent list, and reaches no session or vault. Postgres migration 4.
+  - **Host.** With browser access on, requests with an `Origin` reach Tenant routes; `/health`, `/ready` and admin routes still refuse them. Preflights for browser routes (agents, sessions, vaults, AG-UI, JWKS) are answered from the route alone and grant no credentials; the actual request must carry a publishable key whose allowlist names the origin, and only then do responses (JSON, errors, `401`, `429`, event streams) carry CORS headers. A disallowed origin or unknown key gets the opaque `404`. Tenant and executor keys sent with an `Origin` are refused before they are looked up. `Nylorun-Tenant` may be left out when `Nylorun-Key` names the Tenant; both must agree when both are sent. Browser access is on in the stack (`NYLORUN_BROWSER_ACCESS=off` turns it off) and off for a Host started from `host.json` unless `browserAccess` is true.
+  - **JWKS.** `GET /v1/access/jwks` is readable by any caller that reaches the Tenant.
+  - **Agents SDK.** `@nylorun/agents/browser`: `createBrowserClient({ url, publishableKey, token })` keeps subject tokens in memory, refreshes them a minute before expiry or after `401 token_expired`, one fetch at a time, and creates sessions and vaults owned by the token's subject; it loads no Node module. `createTokenEndpoint()` is the app server's token route. `client.access.publishableKeys` manages keys. The transport accepts a `token` source and a `publishableKey`, and event streams the Runtime ends at token expiry reconnect at once. The Tenant API client classes move to a module with no Node imports; `@nylorun/agents` and `/client` export the same names.
+  - **CLI.** `nylo access keys list|create|set-origins|revoke`.
+
+- 6ab4c59: **Long sessions on any model: compaction.** A session whose history outgrows the model's context window keeps going, on a 16k local model as on a 1M hosted one.
+
+  - **Compaction.**
+    - **When.** Before each model call the engine estimates the prompt: the last reported usage, plus about four characters per token for what came after. If the estimate would not leave room for the reply, the engine first compacts: it asks the model to summarize the older history, then keeps about the newest 20,000 tokens (at most 30% of the window) verbatim.
+    - **What it keeps.** The cut never separates a tool call from its result. The current turn's request is always kept. A later compaction merges with the earlier summary.
+    - **Overflow.** If a provider still reports a context overflow, the engine compacts once and asks again.
+    - **Storage.** The summary is a `compaction` transcript entry that replaces the older entries in the session state; the event log keeps the full history. The summary call is a journaled model effect, so replays are deterministic.
+    - **New event.** `context.compacted` (`trigger`, `tokensBefore`, `tokensAfter`).
+  - **Custom endpoints.**
+    - **Settings.** Model Settings take `settings: { contextWindow, maxTokens, reasoning, compat }` for a custom OpenAI-compatible provider (vLLM, SGLang, llama.cpp, Ollama, LM Studio). `compat` is passed to pi-ai: `thinkingFormat`, `thinkingTokenBudgetField`, `chatTemplateKwargs` and the rest.
+    - **Defaults.** Without settings, a custom endpoint is assumed to have a 32k window and an 8k output limit. They used to be 128k and 16k.
+    - **Where to set them.** `nylo configure` asks for the window and output limit. Studio's Model Settings shows all four fields.
+  - **Storage.**
+    - Model effects no longer journal the model request next to the call, so each call's prompt is stored once.
+    - When a turn ends, its model effects are slimmed to their identity and status; the transcript holds the answers.
+    - Session storage now grows with the window, not with the square of the session's length.
+  - **Core.**
+    - `TranscriptEntry` adds `compaction` (`TranscriptCompactionEntry`).
+    - `ModelAdapterContext.compaction` marks a summary call.
+    - `CustomModelSettings` / `CustomModelSettingsSchema` describe the custom endpoint settings.
+
+- 50d0fb5: **Subject tokens: a person's own credential for the Runtime.** An app server mints a short-lived token for one signed-in person, and their app calls the Runtime directly (optional Host feature `subject-tokens`). Requests with application keys and subject headers are unchanged.
+
+  - **Runtime.** `POST /v1/tokens` (application key only) mints an ES256 JWT for a subject and a role, valid 60–900 seconds. The Tenant API accepts it as a bearer and resolves its scopes and agents from the role on every request. Forged, foreign or malformed tokens get the opaque `404`; an expired token, a revoked subject, a revoked key or a removed role gets `401 token_expired` with `WWW-Authenticate`. Tokens carry only `agents:read`, `sessions:own` and `vaults:own`; they may not set session `info`, send `message.manifest` or store OAuth refresh credentials, and `GET /v1/agents` shows them `{ agentId, name, description }` of their role's agents only.
+  - **Access policy.** `GET`/`PUT /v1/access/policy`: roles with token scopes, an agent allowlist and limits (`turnsPerHour`, `concurrentTurns`, answered with `429 limit_exceeded` and `Retry-After`). Without roles nothing is minted.
+  - **Signing keys.** Per Tenant, the private key sealed with the vault KEK: `GET /v1/access/signing-keys`, `POST …/rotate` (refused while the previous key may still verify live tokens; `force` for incidents), `POST …/:kid/revoke`, `GET /v1/access/jwks`. A Tenant with signing keys and no KEK is quarantined `kek-missing`.
+  - **Revocation.** `POST /v1/access/revocations` ends a subject's tokens; their open event streams end with `event: nylorun.closed` on every process. A stream opened with a token also ends when the token expires.
+  - Postgres migration 3 adds `signing_keys`, `subject_epochs`, `subject_usage` and an index on the session owner and status. New error codes `token_expired` and `limit_exceeded`.
+  - **Agents SDK.** `client.tokens.create()`, `client.access.getPolicy()`/`putPolicy()`/`revokeSubject()`/`jwks()` and `client.access.signingKeys.list()`/`rotate()`/`revoke()`, each checking the Host feature first.
+  - **CLI.** `nylo access policy get|set|init`, `nylo access signing-keys list|rotate|revoke`, `nylo access revoke <subject>` and `nylo access token` for trying the API.
+
+### Patch Changes
+
+- f39b79f: **`nylo doctor sandbox` shows the Tenant's default sandbox**: `none`, `virtual`, or a Tenant sandbox that sessions naming no sandbox get.
+- 6ab4c59: **Model calls don't strand sessions.** A model provider failure is now a known outcome, not a lost call. The Runtime retries what can be retried, and otherwise fails the turn with `model.<code>`, so the session accepts the next message instead of sitting `uncertain` until it is cancelled.
+
+  - **Runtime.**
+
+    - **Upgrade.** The model adapter moves to pi-ai 0.99.1 and always streams.
+    - **Per-call settings.**
+      - Every call carries the session id, so OpenAI and other providers reuse the prompt cache and route to the same backend.
+      - Provider auth no longer reads the process environment.
+      - Rate limits, overloads, timeouts and transient errors are retried: 3 attempts with backoff, honouring `Retry-After`.
+      - A stream that produces nothing for 300 s is aborted and retried. `TenantConfig.modelCall` sets attempts, backoff, the idle timeout and the request timeout.
+    - **Failures.** Anything else fails the turn with one of these codes:
+
+      - `model.context_overflow`, `model.rate_limited`, `model.overloaded`, `model.timeout`, `model.transient`
+      - `model.content_policy`, `model.auth` (whose message says where to fix the credential)
+      - `model.invalid_request`, `model.invalid_output`
+
+      Only a call whose outcome was lost, such as a Worker dying mid-call, is still `uncertain`.
+
+    - **Structured output.** A structured final answer is repaired (control characters, a Markdown code fence) before it is parsed.
+    - **Model history.** Replayed history keeps the model that produced each message, so a model switch no longer sends one model's signatures or tool-call ids to another. Reasoning from OpenAI-compatible servers (`reasoning_content`, `reasoning`) is sent back only within the turn that produced it.
+
+  - **Events.**
+    - `message.assistant` adds `model` (`provider`, `model`), `finishReason` and `usage`.
+    - A new `model.failed` transcript event (`code`, `message`, `retryable`) is written instead of `message.assistant` when a call fails.
+  - **Core and harness.**
+    - New types and helpers: `ModelFailureOutcome`, `ModelFailureCode`, `MODEL_FAILURE_CODES`, `isModelFailureOutcome`, `ModelProducer`.
+    - `PromptItem` assistant messages may carry `producer`.
+    - `ModelUsage` adds `cacheWriteTokens`.
+    - A model adapter may return a failure outcome.
+    - The durable engine version is `hosted-3`: a turn that is running when the Runtime is upgraded fails once with `execution.incompatible`, and the next message works.
+  - **CLI.**
+    - `nylo configure` passes a stable installation id to OAuth logins that need one (OpenAI "Sign in with ChatGPT"), stored as `cli-installation-id` in the Host root.
+    - A custom OpenAI-compatible provider now prompts for its API key instead of failing.
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [c7614a4]
+- Updated dependencies [5f23047]
+- Updated dependencies [4282d5f]
+- Updated dependencies [82d95ef]
+- Updated dependencies [e28b8a9]
+- Updated dependencies [50d0fb5]
+- Updated dependencies [50d0fb5]
+- Updated dependencies [c121144]
+- Updated dependencies [50d0fb5]
+- Updated dependencies [c121144]
+- Updated dependencies [9546ac7]
+- Updated dependencies [9d52189]
+- Updated dependencies [9d52189]
+- Updated dependencies [50d0fb5]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.10.0-beta
+  - @nylorun/admin@0.6.0-beta
+
 ## 0.5.0-beta
 
 ### Minor Changes

package/README.md

@@ -1,84 +1,75 @@
 # @nylorun/cli
 
-The Runtime client, command `nylo`: it acts on a Runtime's Tenants, the local
-stack's or any Runtime reachable by URL and key. Setting up and running the
-local stack is [`nylorun`](../nylorun/README.md)'s job; the two packages are
-independent and never call each other. Depends on `@nylorun/agents` and
-`@nylorun/admin` only among Nylorun packages. Vocabulary:
+The Runtime client, command `nylo`: it acts on the one Tenant of an
+installation, a local stack or any Runtime reachable by URL and key. Setting up
+and running the local stack is [`nylorun`](../nylorun/README.md)'s job; the two
+packages are independent and never call each other. Depends on
+`@nylorun/agents` and `@nylorun/admin` only among Nylorun packages. Vocabulary:
 [runtime/src/CONTEXT.md](../runtime/src/CONTEXT.md).
 
 ```sh
-npx nylorun up                        # the local stack (nylorun)
-npx @nylorun/cli tenant create        # this project's Tenant, linked in .nylorun/
-npx @nylorun/cli tenant use <id>      # or: link a Tenant created in Studio
+npx nylorun start                     # in the project: its stack, its Tenant and the Project link
+npx @nylorun/cli status               # the linked Tenant
 ```
 
 ## Commands
 
 ```sh
-nylo tenant create [name]             # create a Tenant; in a Project, link it and seed it from .env
-nylo tenant current|list [--json]|use <name-or-id>|status [--json]|reset|delete
-nylo configure                        # set or replace the model provider on the linked Tenant
+nylo status [--json]                  # the Tenant, its checks and counts, and the link's stack
+nylo reset [--sessions|--sandboxes|--all] [--yes]
+nylo endpoints [--json]|ping <agent>  # the registered Action endpoints and their health
+nylo access …                         # access policy, publishable and signing keys, subject tokens
+nylo configure                        # set or replace the Tenant's model provider
 nylo env                              # export lines for the linked Project
 nylo doctor sandbox [--json]          # sandbox backend via the Tenant API
 ```
 
-Local stack commands (`up`, `down`, `start`, `stop`, `status`, `logs`,
-`studio`, `reset`) exit 2 naming `npx nylorun <command>`. `nylorun dev` was
-removed: link once with `nylo tenant create`, then run the project's own
-`npm run dev` (`tsx watch src/main.ts`).
+Every command acts on the linked installation: the Project link and
+credentials (below), or `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` when the
+Project has no link. An installation serves one Tenant, so nothing selects it.
 
-## `nylo tenant create`
+Local stack commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
+naming `npx nylorun <command>`. `nylo tenant …` exits 2: `npx nylorun start`
+creates the stack, its Tenant and the link, and `nylo status|reset|endpoints`
+replace `nylo tenant status|reset|endpoints`. `nylorun dev` was removed: run
+`npx nylorun start` once, then the project's own `npm run dev`
+(`tsx watch src/main.ts`).
 
-The Admin API connection resolves from `NYLORUN_ADMIN_URL` and
-`NYLORUN_ADMIN_KEY`, else from the local Host root (`NYLORUN_HOME` or
-`~/.nylorun`: `host.json` and the admin key that `nylorun up` wrote). With no
-Runtime answering, it exits 6 and names `npx nylorun up`.
+## `nylo status`
 
-Inside a Project (the nearest `.nylorun/` or `package.json`):
+Reads the Tenant API status (`GET /v1/tenant`) and prints the Tenant, the
+stack the link names, the Runtime URL, the checks, the counts and the sandbox
+backend. When the Tenant is not open it does not answer; `nylo status` then
+asks the Admin API (`/v1/admin/status`, through the local stack's Host root or
+`NYLORUN_ADMIN_URL` and `NYLORUN_ADMIN_KEY`) and prints why, with the repair.
 
-1. Creates the Tenant, named after `package.json` unless a name is given.
-2. Writes the format-1 link and credentials (see below). A Project that is
-   already linked is refused: use `nylo tenant use` or `nylo tenant delete`.
-3. Seeds the Tenant from `.env`: `NYLORUN_SANDBOX`, and the model provider from
-   `MODEL_PROVIDER`, `MODEL`, `MODEL_PROVIDER_API_KEY` (or a credential in
-   `.nylorun/auth.json`) into the Tenant vault. Without them it says to set the
-   provider in Studio or with `nylo configure`.
+## `nylo reset`
 
-Outside a Project it creates the Tenant and prints the three `NYLORUN_*`
-exports once; the Host keeps only a hash of the application key.
-
-## `nylo tenant use <name-or-id>`
-
-Links the Project to another Tenant on the local Host. It uses the first key
-that the Tenant accepts:
-
-1. The Project's `.nylorun/credentials.json`.
-2. A key it kept when the Project last left that Tenant
-   (`.nylorun/credentials.<tenantId>.json`).
-3. The key of the derived principal `project`, computed from this machine's
-   admin key. Every Tenant created in Studio registers that principal, so
-   Studio's **Connect your code** step needs only this command.
-
-When it replaces an application key (shown only once, when the Tenant was
-created), it keeps that key as `.nylorun/credentials.<tenantId>.json`, so
-`nylo tenant use <that id>` switches back.
+Clears the Tenant's sessions (the default), its sandboxes, or all its data
+(`--all`), after draining work in flight. `--all` asks first; pass `--yes` when
+not in a terminal. The Project link and credentials are kept.
 
 ## Project link
 
-A **Project** stores only:
+`npx nylorun start` writes it; `nylo` only reads it. A **Project** stores only:
 
-- `.nylorun/link.json`: `{ format, hostUrl, hostId, tenantId }`
-- `.nylorun/credentials.json`: application key and principal id (0600), no
-  executor tokens
+- `.nylorun/link.json`: `{ format: 2, stack, hostUrl, hostId, tenantId }`
+  (`tenantId` is information)
+- `.nylorun/credentials.json`: the key of the derived principal `project` and
+  its id (0600)
 - `.nylorun/.gitignore` containing `*`
 
-`connectAgents` in `@nylorun/agents` reads the link (or the three variables),
-so the project's `npm run dev` and `npm start` need no Nylorun tool.
+A format 0 or 1 link named a Tenant on an older multi-Tenant Host: `nylo`
+refuses it and says to run `npx nylorun start`, which starts the project's own
+stack and links it again.
+
+`createActionHandler` and `createClient` in `@nylorun/agents` read the link (or
+the two variables), so the project's `npm run dev` and `npm start` need no
+Nylorun tool.
 
 ```sh
 eval "$(npx @nylorun/cli env)"
-# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY, NYLORUN_TENANT
+# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY
 ```
 
 ## Exit codes
@@ -95,8 +86,9 @@ eval "$(npx @nylorun/cli env)"
 
 | Symptom | What to do |
 | --- | --- |
-| No Runtime answers | `npx nylorun up`, then `npx nylorun status` |
-| Quarantined Tenant | `nylo tenant status` shows the reason and `repair` |
+| No Runtime answers | `npx nylorun start`, then `npx nylorun status` |
+| Tenant not open | `nylo status` shows the cause and its `repair` |
+| Old Project link refused | `npx nylorun start` in the project |
 | `426` from the Runtime | Upgrade the CLI, or pin a matching older set |
 
 See [MIGRATION.md](../MIGRATION.md).

package/dist/access/commands.d.ts

@@ -0,0 +1,24 @@
+import { type AgentsClient } from "@nylorun/agents";
+export declare const accessUsage = "nylo access <policy|keys|signing-keys|revoke|token>\n\n  policy get                         print the access policy\n  policy set <file>                  replace it with a JSON file\n  policy init                        write a starter \"user\" role (sessions:own agents:read, every agent,\n                                     60 turns per hour, 2 at once)\n  signing-keys list                  list the signing keys\n  signing-keys rotate [--force]      rotate; --force signs outstanding tokens out\n  signing-keys revoke <kid>          revoke a previous or standby key\n  keys list                          list the publishable keys\n  keys create --name <n> [--origin <o>]\u2026\n                                     a publishable key for a web page or an app\n                                     (origins: https://app.example.com or http://localhost:*)\n  keys set-origins <id> [<o>\u2026]       replace a key's origins ([] for native apps only)\n  keys revoke <id>                   revoke a publishable key\n  revoke <subject>                   end a subject's tokens and open streams\n  token --subject <s> --role <r> [--ttl <seconds>]\n                                     mint a subject token (for trying the API with curl)";
+/** The starter policy `policy init` writes. */
+export declare const STARTER_POLICY: {
+    version: 1;
+    roles: {
+        user: {
+            scopes: ("agents:read" | "sessions:own")[];
+            agents: "*";
+            limits: {
+                turnsPerHour: number;
+                concurrentTurns: number;
+            };
+        };
+    };
+    anon: {
+        scopes: never[];
+        agents: never[];
+    };
+    tokens: {
+        maxTtlSeconds: number;
+    };
+};
+export declare function accessCommand(input: readonly string[], client?: () => Promise<AgentsClient>): Promise<void>;

package/dist/access/commands.js

@@ -0,0 +1,144 @@
+/**
+ * `nylo access`: the linked Tenant's access policy, signing keys and revocations, and a
+ * development command that mints a subject token (Host feature `subject-tokens`). Uses the
+ * Project's application key, like every other Tenant command.
+ */
+import { readFile } from "node:fs/promises";
+import { createClient, resolveConnection, } from "@nylorun/agents";
+import { CliError } from "../errors.js";
+export const accessUsage = `nylo access <policy|keys|signing-keys|revoke|token>
+
+  policy get                         print the access policy
+  policy set <file>                  replace it with a JSON file
+  policy init                        write a starter "user" role (sessions:own agents:read, every agent,
+                                     60 turns per hour, 2 at once)
+  signing-keys list                  list the signing keys
+  signing-keys rotate [--force]      rotate; --force signs outstanding tokens out
+  signing-keys revoke <kid>          revoke a previous or standby key
+  keys list                          list the publishable keys
+  keys create --name <n> [--origin <o>]…
+                                     a publishable key for a web page or an app
+                                     (origins: https://app.example.com or http://localhost:*)
+  keys set-origins <id> [<o>…]       replace a key's origins ([] for native apps only)
+  keys revoke <id>                   revoke a publishable key
+  revoke <subject>                   end a subject's tokens and open streams
+  token --subject <s> --role <r> [--ttl <seconds>]
+                                     mint a subject token (for trying the API with curl)`;
+/** The starter policy `policy init` writes. */
+export const STARTER_POLICY = {
+    version: 1,
+    roles: {
+        user: {
+            scopes: ["sessions:own", "agents:read"],
+            agents: "*",
+            limits: { turnsPerHour: 60, concurrentTurns: 2 },
+        },
+    },
+    anon: { scopes: [], agents: [] },
+    tokens: { maxTtlSeconds: 600 },
+};
+const usageError = (message = accessUsage) => new CliError(message, 2);
+async function linkedClient() {
+    let connection;
+    try {
+        connection = await resolveConnection();
+    }
+    catch (error) {
+        throw new CliError(error instanceof Error ? error.message : String(error), 1);
+    }
+    return createClient({ url: connection.url, key: connection.key });
+}
+const print = (value) => console.log(JSON.stringify(value, null, 2));
+function option(args, name) {
+    const index = args.indexOf(name);
+    if (index === -1)
+        return undefined;
+    const value = args[index + 1];
+    if (!value || value.startsWith("--"))
+        throw usageError(`${name} requires a value.`);
+    args.splice(index, 2);
+    return value;
+}
+export async function accessCommand(input, client = linkedClient) {
+    const [topic, action, ...rest] = input;
+    const args = [...rest];
+    if (topic === "policy") {
+        if (action === "get" && args.length === 0)
+            return print(await (await client()).access.getPolicy());
+        if (action === "init" && args.length === 0)
+            return print(await (await client()).access.putPolicy(STARTER_POLICY));
+        if (action === "set" && args.length === 1) {
+            let parsed;
+            try {
+                parsed = JSON.parse(await readFile(args[0], "utf8"));
+            }
+            catch (error) {
+                throw new CliError(`Could not read ${args[0]}: ${error instanceof Error ? error.message : String(error)}`, 1);
+            }
+            // Accept the file as the policy itself or as `{ policy }`, as `policy get` prints it.
+            const candidate = parsed && typeof parsed === "object" && "policy" in parsed
+                ? parsed.policy
+                : parsed;
+            // The Runtime validates it and names what is wrong.
+            return print(await (await client()).access.putPolicy(candidate));
+        }
+        throw usageError();
+    }
+    if (topic === "signing-keys") {
+        const keys = async () => (await client()).access.signingKeys;
+        if (action === "list" && args.length === 0)
+            return print(await (await keys()).list());
+        if (action === "rotate") {
+            const force = args[0] === "--force";
+            if (args.length > (force ? 1 : 0))
+                throw usageError();
+            return print(await (await keys()).rotate({ force }));
+        }
+        if (action === "revoke" && args.length === 1)
+            return print(await (await keys()).revoke(args[0]));
+        throw usageError();
+    }
+    if (topic === "keys") {
+        const keys = async () => (await client()).access.publishableKeys;
+        if (action === "list" && args.length === 0)
+            return print(await (await keys()).list());
+        if (action === "create") {
+            const name = option(args, "--name");
+            const origins = [];
+            for (let origin = option(args, "--origin"); origin; origin = option(args, "--origin"))
+                origins.push(origin);
+            if (!name || args.length > 0)
+                throw usageError();
+            return print(await (await keys()).create({ name, origins }));
+        }
+        if (action === "set-origins" && args.length >= 1) {
+            const [keyId, ...origins] = args;
+            return print(await (await keys()).update(keyId, { origins }));
+        }
+        if (action === "revoke" && args.length === 1)
+            return print(await (await keys()).revoke(args[0]));
+        throw usageError();
+    }
+    if (topic === "revoke") {
+        if (!action || args.length > 0)
+            throw usageError();
+        return print(await (await client()).access.revokeSubject(action));
+    }
+    if (topic === "token") {
+        const all = [action, ...args].filter((arg) => arg !== undefined);
+        const subject = option(all, "--subject");
+        const role = option(all, "--role");
+        const ttl = option(all, "--ttl");
+        if (!subject || !role || all.length > 0)
+            throw usageError();
+        const ttlSeconds = ttl === undefined ? undefined : Number(ttl);
+        if (ttlSeconds !== undefined && !Number.isInteger(ttlSeconds))
+            throw usageError("--ttl must be a whole number of seconds.");
+        return print(await (await client()).tokens.create({
+            subject,
+            role,
+            ...(ttlSeconds === undefined ? {} : { ttlSeconds }),
+        }));
+    }
+    throw usageError();
+}

package/dist/cli.js

@@ -5,24 +5,35 @@ import { putHostModel } from "./model/host-model.js";
 import { CliError } from "./errors.js";
 import { findProjectRoot } from "./project/root.js";
 import { printLinkedEnvExports } from "./project/env.js";
-import { readLink as readProjectLink } from "./project/link.js";
-import { readCredentials as readProjectCredentials } from "./project/credentials.js";
-import { tenantCommand } from "./tenant/commands.js";
-const usage = `nylo <tenant|configure|env|doctor>
+import { linkedConnection } from "./project/connection.js";
+import { accessCommand } from "./access/commands.js";
+import { endpointsCommand, resetCommand, statusCommand, } from "./installation/commands.js";
+const usage = `nylo <status|reset|endpoints|access|configure|env|doctor>
 
-Runtime client (the local stack's Runtime, or any Runtime by URL and key):
-  tenant create [name]                    create a Tenant; in a Project, link it and seed it from .env
-  tenant use <name-or-id>                 link this Project to a Tenant, e.g. one created in Studio
-  tenant current|list [--json]|status [--json]|reset|delete
+Runtime client for the linked installation and its one Tenant (the Project link that
+npx nylorun start writes, or NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY):
+  status [--json]                         the Tenant, its checks and counts, and the stack
+  reset [--sessions|--sandboxes|--all] [--yes]
+                                          clear the Tenant's sessions, sandboxes or all its data
+  endpoints [--json]|ping <agent>         the registered Action endpoints and their health
+  access policy get|set <file>|init       the access policy for subject tokens (nylo access --help)
+  access keys list|create|set-origins|revoke  publishable keys for web pages and apps
+  access signing-keys list|rotate|revoke  the Tenant's token signing keys
+  access revoke <subject>                 end a subject's tokens and open streams
+  access token --subject <s> --role <r>   mint a subject token for trying the API
   configure                               set the linked Tenant's model provider
   env                                     print the linked Project's NYLORUN_* variables as exports
   doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
 
-The local stack is managed by the nylorun package: npx nylorun up|down|status|logs|studio`;
+The local stack is managed by the nylorun package: npx nylorun start in a project creates
+its stack, its Tenant and the Project link.`;
 /** Local stack commands, which moved to the nylorun package. */
 const STACK_COMMANDS = new Set([
-    "up", "down", "start", "stop", "status", "logs", "studio", "reset", "stack", "runtime", "restart", "run",
+    "up", "down", "start", "stop", "logs", "studio", "stack", "runtime", "restart", "run",
 ]);
+const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
+Run "npx nylorun start" in your project to create its stack, its Tenant and the Project link.
+Then use nylo status, nylo reset and nylo endpoints on the linked installation.`;
 function parseFlags(args, allowed = {}) {
     const booleans = new Set();
     const values = new Map();
@@ -58,25 +69,6 @@ function parseFlags(args, allowed = {}) {
     return { rest, booleans, values };
 }
 const usageError = (message) => new CliError(message, 2);
-async function resolveLinkedAuth(projectRoot) {
-    const link = await readProjectLink(projectRoot);
-    const credentials = await readProjectCredentials(projectRoot);
-    if (link && credentials) {
-        return {
-            url: link.hostUrl,
-            key: credentials.applicationKey,
-            tenantId: link.tenantId,
-            tenantName: link.tenantId,
-        };
-    }
-    const url = process.env.NYLORUN_RUNTIME_URL?.trim();
-    const key = process.env.NYLORUN_SERVER_KEY?.trim();
-    const tenantId = process.env.NYLORUN_TENANT?.trim();
-    if (url && key && tenantId) {
-        return { url, key, tenantId, tenantName: tenantId };
-    }
-    throw new CliError(`No Project link in ${projectRoot}. Run nylo tenant create, or set NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY and NYLORUN_TENANT.`, 1);
-}
 async function main() {
     const [command, ...args] = process.argv.slice(2);
     if (!command || command === "--help" || command === "-h")
@@ -84,7 +76,20 @@ async function main() {
     if (process.platform === "win32")
         throw new CliError("Nylorun does not run on native Windows. Use WSL2: install Node 24 and Docker (Docker Desktop's WSL integration) inside your WSL distribution and run nylorun there (https://learn.microsoft.com/windows/wsl/install).", 1);
     if (command === "tenant")
-        return await tenantCommand(args);
+        throw usageError(TENANT_REMOVED);
+    if (command === "status")
+        return await statusCommand(args);
+    if (command === "reset")
+        return await resetCommand(args);
+    if (command === "endpoints")
+        return await endpointsCommand(args);
+    if (command === "access") {
+        if (args[0] === "--help" || args[0] === "-h" || args.length === 0) {
+            const { accessUsage } = await import("./access/commands.js");
+            return void console.log(accessUsage);
+        }
+        return await accessCommand(args);
+    }
     if (command === "env") {
         if (args.length)
             throw usageError("Usage: nylo env");
@@ -100,7 +105,7 @@ async function main() {
         return;
     }
     if (command === "dev")
-        throw usageError("nylorun dev was removed: run nylo tenant create once in your project, then your project's npm run dev.");
+        throw usageError('nylorun dev was removed: run "npx nylorun start" once in your project, then your project\'s npm run dev.');
     if (STACK_COMMANDS.has(command))
         throw usageError(`The local stack moved to the nylorun package: npx nylorun ${command}`);
     if (command === "configure") {
@@ -108,24 +113,20 @@ async function main() {
         if (flags.rest.length)
             throw usageError(usage);
         const projectRoot = findProjectRoot() ?? process.cwd();
-        const auth = await resolveLinkedAuth(projectRoot);
+        const auth = await linkedConnection(projectRoot);
         const controller = new AbortController();
         const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
         process.once("SIGINT", () => cancel("SIGINT"));
         process.once("SIGTERM", () => cancel("SIGTERM"));
         const health = await fetch(`${auth.url}/health`).catch(() => undefined);
         if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local stack with "npx nylorun up".`, 6);
-        const catalog = await fetchModelCatalog({
-            url: auth.url,
-            key: auth.key,
-            tenantId: auth.tenantId,
-        });
+            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local stack with "npx nylorun start".`, 6);
+        const catalog = await fetchModelCatalog({ url: auth.url, key: auth.key });
         const prompted = await configureProvider({
             signal: controller.signal,
             catalog,
         });
-        await putHostModel(auth.url, auth.key, prompted, auth.tenantId);
+        await putHostModel(auth.url, auth.key, prompted);
         return;
     }
     throw usageError(usage);