nylorun 0.13.0-beta → 0.15.0-beta

package/dist/client/target.js

@@ -0,0 +1,65 @@
+/**
+ * The installation a client command acts on. `--tenant <name>` names a local Tenant. Without it,
+ * `NYLORUN_RUNTIME_URL` with the key the API needs names a remote installation:
+ * `NYLORUN_MANAGEMENT_KEY` for the Management API (`nylorun tenant`), `NYLORUN_SERVER_KEY` or an
+ * identity provider's token in `NYLORUN_TOKEN` for the Runtime API (`NYLORUN_RUNTIME_URL` alone is
+ * an app's, as for `createAdmin`). Otherwise the local
+ * Tenant the Project link names, else the default one, while it runs (`runningTenantApi`: the
+ * Project's keys while they authenticate, else the Host root's own).
+ */
+import { createManagementClient } from "@nylorun/admin";
+import { CliError } from "../errors.js";
+import { runningTenantApi } from "../stack/commands.js";
+function variable(env, name) {
+    const value = env[name]?.trim();
+    return value ? value : undefined;
+}
+/** The remote installation the environment names for `api`, if it names one. */
+export function remoteConnection(env, api) {
+    const url = variable(env, "NYLORUN_RUNTIME_URL");
+    const managementKey = variable(env, "NYLORUN_MANAGEMENT_KEY");
+    const applicationKey = variable(env, "NYLORUN_SERVER_KEY");
+    const token = variable(env, "NYLORUN_TOKEN");
+    if (!url || (api === "management" ? !managementKey : !applicationKey && !token))
+        return undefined;
+    return {
+        label: url,
+        url: url.replace(/\/$/, ""),
+        local: false,
+        ...(applicationKey ? { applicationKey } : {}),
+        ...(managementKey ? { managementKey } : {}),
+        // A token is a person's: it wins over the key for the Runtime API.
+        ...(token && api === "runtime" ? { token } : {}),
+    };
+}
+/** The installation to act on for `api` (module comment). */
+export async function connect(deps, api, tenant) {
+    if (tenant === undefined) {
+        const remote = remoteConnection(deps.env, api);
+        if (remote)
+            return remote;
+    }
+    const local = await runningTenantApi(deps, tenant === undefined ? {} : { name: tenant });
+    return {
+        label: `Tenant ${local.name}`,
+        url: local.runtimeUrl,
+        local: true,
+        tenant: local.name,
+        applicationKey: local.applicationKey,
+        managementKey: local.managementKey,
+    };
+}
+/** The Management API client of `connection`, through `deps.fetch`. */
+export function managementClient(deps, connection) {
+    if (!connection.managementKey)
+        throw new CliError(`No management key for ${connection.label}: set NYLORUN_MANAGEMENT_KEY, or on the Runtime's machine run "nylorun tenant keys put <id> --management".`, 1);
+    return createManagementClient({
+        url: connection.url,
+        key: connection.managementKey,
+        fetch: (input, init) => deps.fetch(input instanceof Request ? input.url : String(input), init),
+    });
+}
+/** `error`'s message, ending in one full stop. */
+export function messageOf(error) {
+    return (error instanceof Error ? error.message : String(error)).replace(/\.?$/, ".");
+}

package/dist/client/tenant.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `nylorun tenant`: the Management API (`/v1/tenant/*`) of the installation's one Tenant, with a
+ * management key (`target.ts` picks the installation). Issuing a management key is the one
+ * exception: only the Runtime's machine does it, through `nylorun-operate` (`stack/keys.ts`).
+ */
+import type { ManagementClient } from "@nylorun/admin";
+import { type StackDeps } from "../stack/commands.js";
+import { type Connection } from "./target.js";
+export declare const tenantUsage = "nylorun tenant <command>\n\nThe Management API of the installation's one Tenant, with a management key: the local Tenant\n--tenant names (else the linked project's, else the default one), or the installation that\nNYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.\n\n  reset [--sessions|--environments|--all] [--yes] [--tenant <name>]\n                                      clear the Tenant's sessions, Environments or all its data\n                                      (the Project link and keys stay)\n  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once\n  signing-keys list [--tenant <name>]\n                                      the Tenant's token signing keys\n  signing-keys rotate [--force] [--tenant <name>]\n                                      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid> [--tenant <name>]\n                                      revoke a previous or standby key\n  models catalog [--tenant <name>] [--json]\n                                      every provider and model the Runtime knows\n  models providers [--tenant <name>] [--json]\n                                      the providers with a credential, and the one in use\n  models get [--tenant <name>] [--json]\n                                      the Tenant's model\n  models set [--tenant <name>]        sign in to a model provider and set the Tenant's model\n  models set --provider <id> --model <id> [--base-url <url>] [--tenant <name>]\n                                      the same with an API key piped in on stdin (CI)\n  models select <provider> [--model <id>] [--tenant <name>]\n                                      use a provider that has a credential (default: its model)\n  usage [--scope tenant|agent|turn] [--id <id>] [--period day|month|total] [--tenant <name>]\n                                      what the model calls used and cost (JSON)\n  calls [--after <cursor>] [--limit <n>] [--tenant <name>]\n                                      every recorded model call, one JSON line each, until\n                                      caught up; prints the cursor to resume from on stderr\n  budgets [get | put <file|->] [--tenant <name>]\n                                      the model spend caps; put replaces them all\n  tool-policy [get | put <file|->] [--tenant <name>]\n                                      the Tool Gate's rules; put replaces them all\n  settings sandbox [get | put <file|->] [--tenant <name>]\n                                      the Environment settings: limits, stop grace, placement\n  settings artifacts [get | put <file|->] [--tenant <name>]\n                                      the artifact store's limits\n  coverage --agent <id> [--environment <id>] [--tenant <name>] [--json]\n                                      which secret of the Environment each of the agent's MCP\n                                      servers and HTTP tools would get\n  mcp inspect <url> [--server <name>] [--environment <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools, with Environment <id>'s\n                                      credential for <url> (none without it): model names, schema\n                                      sizes, renames, or that it needs a person's sign-in (the\n                                      Runtime calls no tool)\n\nA put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what\nbudgets, tool-policy and settings artifacts get print, put takes back. An API key is read from\nstdin, never from the arguments.";
+/** The Management API client of the installation `--tenant` (or the environment) names. */
+export declare function tenantClient(deps: StackDeps, tenant: string | undefined): Promise<{
+    connection: Connection;
+    admin: ManagementClient;
+}>;
+/**
+ * `nylorun status` for an installation the environment names (`NYLORUN_RUNTIME_URL` and
+ * `NYLORUN_MANAGEMENT_KEY`): the Tenant, its checks and counts. A local Tenant's status is the
+ * stack's (`stack/commands.ts`).
+ */
+export declare function remoteStatus(deps: StackDeps, args: readonly string[]): Promise<number>;
+/** `nylorun tenant <group> ...` */
+export declare function tenantCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/client/tenant.js

@@ -0,0 +1,176 @@
+import { CliError } from "../errors.js";
+import { parseStackFlags } from "../stack/commands.js";
+import { keyCommand, keyUsage } from "../stack/keys.js";
+import { printJson, printTable } from "./io.js";
+import { mcpCommand, mcpUsage } from "./mcp.js";
+import { callsCommand, modelsCommand, modelsUsage, usageCommand, usageUsage } from "./models.js";
+import { budgetsCommand, coverageCommand, settingsCommand, settingsUsage, toolPolicyCommand, } from "./settings.js";
+import { signingKeysCommand, signingKeysUsage } from "./signing-keys.js";
+import { connect, managementClient, messageOf, remoteConnection } from "./target.js";
+export const tenantUsage = `nylorun tenant <command>
+
+The Management API of the installation's one Tenant, with a management key: the local Tenant
+--tenant names (else the linked project's, else the default one), or the installation that
+NYLORUN_RUNTIME_URL and NYLORUN_MANAGEMENT_KEY name.
+
+  reset [--sessions|--environments|--all] [--yes] [--tenant <name>]
+                                      clear the Tenant's sessions, Environments or all its data
+                                      (the Project link and keys stay)
+${keyUsage}
+${signingKeysUsage}
+${modelsUsage}
+${usageUsage}
+${settingsUsage}
+${mcpUsage}
+
+A put reads a JSON body from a file, or from stdin for -, and replaces the whole document; what
+budgets, tool-policy and settings artifacts get print, put takes back. An API key is read from
+stdin, never from the arguments.`;
+const usageError = (message) => new CliError(message, 2);
+/** The Management API client of the installation `--tenant` (or the environment) names. */
+export async function tenantClient(deps, tenant) {
+    const connection = await connect(deps, "management", tenant);
+    return { connection, admin: managementClient(deps, connection) };
+}
+/**
+ * `nylorun status` for an installation the environment names (`NYLORUN_RUNTIME_URL` and
+ * `NYLORUN_MANAGEMENT_KEY`): the Tenant, its checks and counts. A local Tenant's status is the
+ * stack's (`stack/commands.ts`).
+ */
+export async function remoteStatus(deps, args) {
+    const usage = "nylorun status [--tenant <name>] [--json]";
+    const flags = parseStackFlags(args, { booleans: ["--json"] }, usage);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${usage}`);
+    const { connection, admin } = await tenantClient(deps, undefined);
+    let body;
+    try {
+        body = await admin.tenant.status();
+    }
+    catch (error) {
+        throw new CliError(`${messageOf(error)} The installation at ${connection.url} did not answer.`, 1);
+    }
+    if (flags.booleans.has("--json")) {
+        deps.out(JSON.stringify(body, null, 2));
+        return 0;
+    }
+    deps.out(`${body.tenant.name}  ${body.tenant.id}`);
+    deps.out(`runtime  ${connection.url}`);
+    deps.out(`path     ${body.path}`);
+    deps.out(`checks   ${Object.entries(body.checks)
+        .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
+        .join(" ")}`);
+    deps.out(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
+    deps.out(`sandbox  ${body.sandbox.backend ?? "none"}`);
+    return 0;
+}
+const RESET_USAGE = "nylorun tenant reset [--sessions|--environments|--all] [--yes] [--tenant <name>]";
+const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
+/** `nylorun tenant reset`; `--all` asks first. */
+async function reset(deps, args) {
+    const flags = parseStackFlags(args, { booleans: ["--yes", ...Object.keys(SCOPES)], values: ["--tenant"], aliases: { "-y": "--yes" } }, RESET_USAGE);
+    if (flags.rest.length)
+        throw usageError(`Usage: ${RESET_USAGE}`);
+    const chosen = Object.keys(SCOPES).filter((flag) => flags.booleans.has(flag));
+    if (chosen.length > 1)
+        throw usageError("Pass only one of --sessions, --environments, --all.");
+    const scope = chosen.length ? SCOPES[chosen[0]] : "sessions";
+    const { connection, admin } = await tenantClient(deps, flags.values.get("--tenant"));
+    if (scope === "all" && !flags.booleans.has("--yes")) {
+        if (!deps.confirm)
+            throw usageError("Confirmation required; pass --yes for non-interactive use.");
+        if (!(await deps.confirm(`Reset ALL data of ${connection.label}? The Project link and keys are kept. [y/N] `))) {
+            deps.err("Cancelled.");
+            return 1;
+        }
+    }
+    try {
+        await admin.tenant.reset({ scope, activeWork: "drain" });
+    }
+    catch (error) {
+        throw new CliError(`Tenant reset failed: ${messageOf(error)}`, 1);
+    }
+    deps.out(`Reset ${connection.label} (${scope}).`);
+    return 0;
+}
+/**
+ * `nylorun tenant keys`: through the Management API on an installation the environment names
+ * (application keys only), else on the local Tenant through `nylorun-operate`.
+ */
+async function keys(deps, args) {
+    if (args.includes("--tenant") || !remoteConnection(deps.env, "management"))
+        return keyCommand(deps, args);
+    const [verb, ...rest] = args;
+    const { admin, connection } = await tenantClient(deps, undefined);
+    if (verb === "put") {
+        const usage = "nylorun tenant keys put <id>";
+        const flags = parseStackFlags(rest, { booleans: ["--management"] }, usage);
+        if (flags.booleans.has("--management"))
+            throw new CliError("Management keys are issued only on the Runtime's machine: run nylorun tenant keys put <id> --management there.", 2);
+        if (flags.rest.length !== 1)
+            throw usageError(`Usage: ${usage}`);
+        const key = await admin.keys.put(flags.rest[0]);
+        deps.out(key.key);
+        deps.err(`${key.rotated ? "Rotated" : "Created"} application key ${key.id} on ${connection.label}${key.rotated ? " (the previous key no longer works)" : ""}. Store it now: it is not shown again.`);
+        return 0;
+    }
+    if (verb === "list" || verb === "ls") {
+        const usage = "nylorun tenant keys list [--json]";
+        const flags = parseStackFlags(rest, { booleans: ["--json"] }, usage);
+        if (flags.rest.length)
+            throw usageError(`Usage: ${usage}`);
+        const list = await admin.keys.list();
+        if (flags.booleans.has("--json"))
+            printJson(deps, list);
+        else
+            printTable(deps, [["ID", "ROLE", "CREATED"], ...list.map((key) => [key.id, key.role, key.createdAt])]);
+        return 0;
+    }
+    if (verb === "rm" || verb === "delete") {
+        const usage = "nylorun tenant keys rm <id>";
+        const flags = parseStackFlags(rest, {}, usage);
+        if (flags.rest.length !== 1)
+            throw usageError(`Usage: ${usage}`);
+        const id = flags.rest[0];
+        if (!(await admin.keys.delete(id))) {
+            deps.err(`No key ${id} on ${connection.label}.`);
+            return 1;
+        }
+        deps.out(`Deleted key ${id}: it no longer works.`);
+        return 0;
+    }
+    throw usageError(`Usage:\n${keyUsage}`);
+}
+/** `nylorun tenant <group> ...` */
+export async function tenantCommand(deps, args) {
+    const [group, ...rest] = args;
+    if (group === "--help" || group === "-h") {
+        deps.out(tenantUsage);
+        return 0;
+    }
+    if (!group)
+        throw usageError(tenantUsage);
+    if (group === "reset")
+        return reset(deps, rest);
+    if (group === "keys" || group === "key")
+        return keys(deps, rest);
+    if (group === "signing-keys")
+        return signingKeysCommand(deps, rest);
+    if (group === "models" || group === "model")
+        return modelsCommand(deps, rest);
+    if (group === "usage")
+        return usageCommand(deps, rest);
+    if (group === "calls")
+        return callsCommand(deps, rest);
+    if (group === "budgets")
+        return budgetsCommand(deps, rest);
+    if (group === "tool-policy")
+        return toolPolicyCommand(deps, rest);
+    if (group === "settings")
+        return settingsCommand(deps, rest);
+    if (group === "coverage")
+        return coverageCommand(deps, rest);
+    if (group === "mcp")
+        return mcpCommand(deps, rest);
+    throw usageError(`Unknown tenant command ${group}.\n${tenantUsage}`);
+}

package/dist/doctor.js

@@ -75,7 +75,7 @@ export async function doctorStack(options) {
                     ? `- ${local.name} stopped (Compose project ${local.project}): run nylorun up`
                     : local.runtime.healthy
                         ? `✓ ${local.name} running (Compose project ${local.project})`
-                        : `✗ ${local.name} running, but the Runtime does not answer: see nylorun status and nylorun logs runtime`,
+                        : `✗ ${local.name} running, but the Runtime does not answer: see nylorun status and nylorun local logs runtime`,
         ]);
         if (local.state === "running") {
             rows.push([
@@ -88,7 +88,7 @@ export async function doctorStack(options) {
                 "gateway",
                 local.gateway.healthy
                     ? `✓ ${local.gateway.state} · combined packing (runtime: core,loop; gateway: gates)`
-                    : `✗ ${local.gateway.state}: model calls fail; see nylorun logs gateway`,
+                    : `✗ ${local.gateway.state}: model calls fail; see nylorun local logs gateway`,
             ]);
             rows.push([
                 "harness",
@@ -96,7 +96,7 @@ export async function doctorStack(options) {
                     ? "- in-process (NYLORUN_HARNESS=in-process in .env)"
                     : local.harness.healthy
                         ? `✓ ${local.harness.state} · remote (agent turns, MCP servers, workspaces)`
-                        : `✗ ${local.harness.state}: turns do not run; see nylorun logs harness`,
+                        : `✗ ${local.harness.state}: turns do not run; see nylorun local logs harness`,
             ]);
             if (local.tenant)
                 rows.push([

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
+/** Exit codes are part of both commands' contract; see cli/nylorun/README.md ("Exit codes"). */
 export declare class CliError extends Error {
     readonly exitCode: number;
     constructor(message: string, exitCode?: number);

package/dist/errors.js

@@ -1,4 +1,4 @@
-/** Exit codes are part of both commands' contract; see nylorun/README.md ("Exit codes"). */
+/** Exit codes are part of both commands' contract; see cli/nylorun/README.md ("Exit codes"). */
 export class CliError extends Error {
     exitCode;
     constructor(message, exitCode = 1) {

package/dist/nylo.js

@@ -1,9 +1,25 @@
 #!/usr/bin/env node
 import "./baseline.js";
 import { runCommand } from "./command.js";
-// `nylo`, the Runtime client (client/). `nylorun`'s entry never imports it, so `npx nylorun start`
-// loads none of it, nor @nylorun/admin.
+import { CliError } from "./errors.js";
+/**
+ * `nylo` became part of `nylorun`. For one release this command names the `nylorun` command that
+ * replaces each of its own and exits 2; a later release removes it.
+ */
+const REPLACEMENTS = {
+    status: "nylorun status",
+    reset: "nylorun tenant reset",
+    access: "nylorun tenant signing-keys list|rotate|revoke",
+    configure: "nylorun tenant models set",
+    doctor: "nylorun doctor sandbox",
+    env: 'nothing: the SDKs read the Project link themselves; for a process outside the project, "nylorun tenant keys put <id>" and the Runtime URL "nylorun status" prints',
+};
+function nyloMessage(argv) {
+    const replacement = REPLACEMENTS[argv[0] ?? ""];
+    return replacement
+        ? `nylo is part of nylorun now: nylo ${argv[0]} is ${replacement}.`
+        : "nylo is part of nylorun now: run nylorun --help.";
+}
 runCommand(async () => {
-    const { main } = await import("./client/cli.js");
-    await main(process.argv.slice(2));
+    throw new CliError(nyloMessage(process.argv.slice(2)), 2);
 });

package/dist/sandbox/cluster-file.d.ts

@@ -1,6 +1,6 @@
 /**
  * `<Host root>/sandboxes/`: what the sandboxes service mounts read-only. `cluster.json`
- * records the cluster `nylorun sandbox enable` installed into; `token` is the
+ * records the cluster `nylorun local sandbox enable` installed into; `token` is the
  * ServiceAccount token (0600). Only the sandboxes container reads them: the runtime
  * container sees an empty mount there.
  */

package/dist/sandbox/commands.d.ts

@@ -37,5 +37,5 @@ export declare function installCluster(deps: SandboxDeps, input: {
         egress: number;
     };
 }): Promise<InstallResult>;
-/** `nylorun sandbox <enable|disable|status>`. */
+/** `nylorun local sandbox <enable|disable|status>`. */
 export declare function runSandboxCommand(args: readonly string[], deps: SandboxDeps): Promise<number>;

package/dist/sandbox/commands.js

@@ -16,7 +16,7 @@ export const sandboxUsage = `  sandbox enable --context <name> [--tenant <name>]
                                       stop the sandboxes service and forget the cluster
   sandbox status [--tenant <name>] [--json]
                                       the cluster, the sandboxes service's readiness and what it reports`;
-const ENABLE_USAGE = "nylorun sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]";
+const ENABLE_USAGE = "nylorun local sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]";
 /** The default workload image (D36), pre-pulled with the Runtime image. */
 export const DEFAULT_SANDBOX_IMAGE = "python:3.13-slim";
 /** Preferred host ports for the Harness API, gates and egress (pods reach them). */
@@ -141,7 +141,7 @@ async function enable(deps, args) {
         throw usageError(`Usage: ${ENABLE_USAGE}`);
     const context = flags.values.get("--context");
     if (!context)
-        throw usageError(`nylorun sandbox enable needs --context <name>: the kubeconfig context to run pods in (never the current one implicitly). Usage: ${ENABLE_USAGE}`);
+        throw usageError(`nylorun local sandbox enable needs --context <name>: the kubeconfig context to run pods in (never the current one implicitly). Usage: ${ENABLE_USAGE}`);
     const hostAddress = flags.values.get("--host-address");
     const bindAddress = flags.values.get("--bind-address");
     if (hostAddress)
@@ -191,7 +191,7 @@ async function enable(deps, args) {
     await restartTenant(stack, { name: tenant.name, sandboxes: settings });
     const ready = await stack.docker.stream(tenant.compose("up", "--detach", "--wait", "--wait-timeout", "120", "sandboxes"));
     if (ready !== 0)
-        throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun logs sandboxes" and "nylorun sandbox status".`, 7);
+        throw new CliError(`The sandboxes service did not become ready (image ${images.sandboxes}). See "nylorun local logs sandboxes" and "nylorun local sandbox status".`, 7);
     const c = installed.cluster;
     stack.out(`Sandboxes ${tenant.name}  enabled on ${c.context} (namespace ${c.namespace}, agent-sandbox ${c.controllerVersion})`);
     stack.out(`Pods reach ${c.hostAddress} on ports ${c.ports.harness}, ${c.ports.gates}, ${c.ports.egress}; NetworkPolicy enforced (probed ${c.networkPolicy.probedAt})`);
@@ -199,7 +199,7 @@ async function enable(deps, args) {
 }
 async function disable(deps, args) {
     const { stack } = deps;
-    const usage = "nylorun sandbox disable [--tenant <name>] [--delete-namespace]";
+    const usage = "nylorun local sandbox disable [--tenant <name>] [--delete-namespace]";
     const flags = parseStackFlags(args, { booleans: ["--delete-namespace"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -229,7 +229,7 @@ async function disable(deps, args) {
 const INFO_SCRIPT = "fetch(process.env.NYLORUN_SANDBOXES_URL+'/v1/info',{headers:{authorization:'Bearer '+process.env.NYLORUN_SANDBOXES_TOKEN},signal:AbortSignal.timeout(5000)}).then(async r=>{process.stdout.write(await r.text());process.exit(r.ok?0:1)},()=>process.exit(1))";
 async function status(deps, args) {
     const { stack } = deps;
-    const usage = "nylorun sandbox status [--tenant <name>] [--json]";
+    const usage = "nylorun local sandbox status [--tenant <name>] [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -240,7 +240,7 @@ async function status(deps, args) {
         if (flags.booleans.has("--json"))
             stack.out(JSON.stringify({ enabled: false }, null, 2));
         else
-            stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}. Run "nylorun sandbox enable --context <name>".`);
+            stack.out(`Sandboxes are not enabled for Tenant ${tenant.name}. Run "nylorun local sandbox enable --context <name>".`);
         return 3;
     }
     await dockerPreflight(stack.docker);
@@ -271,7 +271,7 @@ const COMMANDS = {
     disable,
     status,
 };
-/** `nylorun sandbox <enable|disable|status>`. */
+/** `nylorun local sandbox <enable|disable|status>`. */
 export async function runSandboxCommand(args, deps) {
     const [name, ...rest] = args;
     const command = name === undefined ? undefined : COMMANDS[name];

package/dist/sandbox/manifests.d.ts

@@ -1,5 +1,5 @@
 /**
- * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
  * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */

package/dist/sandbox/manifests.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 /**
- * What `nylorun sandbox enable` installs into a cluster. The agent-sandbox controller is
+ * What `nylorun local sandbox enable` installs into a cluster. The agent-sandbox controller is
  * pinned (D32, Experiment 2): v1.0.5, API agents.x-k8s.io/v1beta1, its release manifest
  * verified by sha256 before it is applied. It is never upgraded or uninstalled here.
  */

package/dist/sandbox/probe.d.ts

@@ -2,7 +2,7 @@ import type { DockerRunner } from "../stack/docker.js";
 import type { PortProbe } from "../stack/ports.js";
 import type { Kube } from "./kubectl.js";
 /**
- * The NetworkPolicy probe `nylorun sandbox enable` runs before it trusts a cluster (D32), in
+ * The NetworkPolicy probe `nylorun local sandbox enable` runs before it trusts a cluster (D32), in
  * a throwaway namespace `nylorun-sbx-probe-<random>`:
  *
  * - a `control` pod (no policy) must reach a `peer` pod and the allowed host port, which

package/dist/stack/commands.d.ts

@@ -5,7 +5,7 @@ import type { PortProbe } from "./ports.js";
 import { type FetchLike } from "./studio-login.js";
 import { type OperateEndpoint } from "./operator-keys.js";
 export declare const STACK_SERVICES: readonly ["postgres", "restate", "s2-lite", "rustfs", "gateway", "runtime", "harness", "studio"];
-export declare const stackUsage: string;
+export declare const stackUsage = "  up|start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]\n                                      start the project's Tenant, creating it and the Project link (.nylorun/link.json,\n                                      credentials.json) on the first run; print the Runtime and Studio URLs (it opens no\n                                      browser). --tenant attaches to (or creates) a named Tenant; --no-link\n                                      starts the default Tenant (or --tenant's) without linking the current directory;\n                                      --restate-ui (or NYLORUN_RESTATE_UI=1) publishes Restate's UI on loopback for debugging\n  down|stop [--tenant <name> | --all] stop the Tenant's containers (--all: every Tenant's); keep volumes\n  status [--tenant <name>] [--json]   the Tenant, its id, services, endpoints and Runtime health\n  studio [--tenant <name>] [--no-open]\n                                      sign a browser in to Studio on the Tenant; --no-open prints the login URL; start the Tenant if it is stopped";
 export interface StackDeps {
     /** Environment snapshot (NYLORUN_HOME, NYLORUN_TENANT, image overrides, NYLORUN_COMPOSE_PROJECT). */
     env: Readonly<Record<string, string | undefined>>;
@@ -22,6 +22,11 @@ export interface StackDeps {
     confirm?(question: string): Promise<boolean>;
     /** A developer is at a terminal. */
     interactive?: boolean;
+    /** Standard input, for a body or a secret piped in; undefined when there is none. */
+    stdin?: {
+        isTTY: boolean;
+        text(): Promise<string>;
+    };
     /** Open `url` in a browser; false when no browser could be started. */
     openBrowser(url: string): Promise<boolean>;
     /** Is this process id alive? (launcher-managed Runtime detection) */
@@ -137,7 +142,7 @@ export interface StackEndpoints {
     /** This call started the Runtime (it was not running before). */
     started: boolean;
 }
-/** The running Tenant's APIs and their keys (`nylorun sandbox`). */
+/** The running Tenant's APIs and their keys (`nylorun local sandbox`). */
 export interface TenantApi {
     /** The Tenant's name. */
     name: string;
@@ -179,7 +184,7 @@ export declare function ensureStack(deps: StackDeps, options: {
     studio: boolean;
     name?: string;
 }): Promise<StackEndpoints>;
-/** A started Tenant as `nylorun sandbox` sees it. */
+/** A started Tenant as `nylorun local sandbox` sees it. */
 export interface SelectedTenant {
     name: string;
     paths: StackPaths;
@@ -187,7 +192,7 @@ export interface SelectedTenant {
     /** `docker compose` arguments for this Tenant's project and files. */
     compose(...args: string[]): string[];
 }
-/** The Tenant `nylorun sandbox` acts on; it must have been started once. */
+/** The Tenant `nylorun local sandbox` acts on; it must have been started once. */
 export declare function selectTenant(deps: StackDeps, options?: {
     name?: string;
 }): Promise<SelectedTenant>;