nylorun 0.13.0-beta → 0.15.0-beta

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "nylorun",
-  "version": "0.13.0-beta",
+  "version": "0.15.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose (nylorun), and the Runtime client of the linked installation (nylo)",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nylorun/agents.git",
-    "directory": "nylorun"
+    "directory": "cli/nylorun"
   },
   "files": [
     "dist",
@@ -23,21 +23,22 @@
     "node": ">=24.0.0"
   },
   "scripts": {
-    "build": "npm run clean && node ../scripts/check-typescript-version.mjs && tsc -p tsconfig.json",
+    "build": "npm run clean && node ../../scripts/check-typescript-version.mjs && tsc -p tsconfig.json",
     "clean": "node -e \"import('node:fs').then(({rmSync})=>rmSync('dist',{recursive:true,force:true}))\"",
     "check": "npm run build && npm test && node scripts/check-package.mjs",
     "test": "vitest run --passWithNoTests",
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.19.0-beta",
-    "@nylorun/admin": "0.15.0-beta"
+    "@nylorun/admin": "0.17.0-beta",
+    "@nylorun/agents": "0.21.0-beta",
+    "@nylorun/core": "0.21.0-beta"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "0.99.1",
-    "@nylorun/agents": "file:../agents",
+    "@nylorun/agents": "file:../../sdks/agents",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "@types/node": "^26.5.0",
+    "@types/node": "^26.6.4",
     "vitest": "^5.0.2"
   },
   "bin": {
@@ -45,7 +46,7 @@
     "nylo": "dist/nylo.js"
   },
   "nylorun": {
-    "runtime": "0.23.0-beta",
-    "studio": "0.23.3-beta"
+    "runtime": "0.25.0-beta",
+    "studio": "0.25.0-beta"
   }
 }

package/dist/client/access/commands.d.ts

@@ -1,8 +0,0 @@
-/**
- * `nylo access`: the linked Tenant's signing keys, which sign capability links and run tokens,
- * through the Management API with the Project's management key. (Subject tokens, the
- * access policy, browser keys and revocations left the Runtime in protocol 7.)
- */
-import type { ManagementClient } from "@nylorun/admin";
-export declare const accessUsage = "nylo access signing-keys <list|rotate|revoke>\n\n  signing-keys list                  list the signing keys\n  signing-keys rotate [--force]      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid>          revoke a previous or standby key";
-export declare function accessCommand(input: readonly string[], client?: () => Promise<ManagementClient>): Promise<void>;

package/dist/client/access/commands.js

@@ -1,33 +0,0 @@
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../../errors.js";
-import { linkedConnection, managementClient } from "../project/connection.js";
-export const accessUsage = `nylo access signing-keys <list|rotate|revoke>
-
-  signing-keys list                  list the signing keys
-  signing-keys rotate [--force]      rotate; --force ends outstanding links and run tokens
-  signing-keys revoke <kid>          revoke a previous or standby key`;
-const usageError = (message = accessUsage) => new CliError(message, 2);
-async function linkedClient() {
-    return managementClient(await linkedConnection(findProjectRoot() ?? process.cwd()));
-}
-const print = (value) => console.log(JSON.stringify(value, null, 2));
-export async function accessCommand(input, client = linkedClient) {
-    const [topic, action, ...args] = input;
-    if (topic === "signing-keys") {
-        const keys = async () => (await client()).signingKeys;
-        if (action === "list" && args.length === 0)
-            return print(await (await keys()).list());
-        if (action === "rotate") {
-            const force = args[0] === "--force";
-            if (args.length > (force ? 1 : 0))
-                throw usageError();
-            return print(await (await keys()).rotate({ force }));
-        }
-        if (action === "revoke" && args.length === 1)
-            return print(await (await keys()).revoke(args[0]));
-        throw usageError();
-    }
-    if (topic === "policy" || topic === "keys" || topic === "revoke" || topic === "token")
-        throw usageError(`nylo access ${topic} was removed: the Runtime no longer mints subject tokens or keeps an access policy, browser keys or revocations (protocol 7). Trust your identity provider's tokens with an identity file, and give servers an application key (nylorun key put <id>).`);
-    throw usageError();
-}

package/dist/client/cli.d.ts

@@ -1,2 +0,0 @@
-/** `nylo <command> [...args]`. */
-export declare function main(argv: readonly string[]): Promise<void>;

package/dist/client/cli.js

@@ -1,106 +0,0 @@
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../errors.js";
-import { refuseNativeWindows } from "../command.js";
-import { printLinkedEnvExports } from "./project/env.js";
-import { linkedConnection, managementClient } from "./project/connection.js";
-import { accessCommand } from "./access/commands.js";
-import { resetCommand, statusCommand } from "./installation/commands.js";
-const usage = `nylo <status|reset|access|configure|env|doctor>
-
-Runtime client for the linked installation and its one Tenant (the Project link that
-npx nylorun start writes, or NYLORUN_RUNTIME_URL with NYLORUN_SERVER_KEY, and
-NYLORUN_MANAGEMENT_KEY for status, reset, access, configure and doctor):
-  status [--json]                         the Tenant, its checks and counts
-  reset [--sessions|--sandboxes|--all] [--yes]
-                                          clear the Tenant's sessions, sandboxes or all its data
-  access signing-keys list|rotate|revoke  the Tenant's token signing keys (nylo access --help)
-  configure                               set the linked Tenant's model provider
-  env                                     print the linked Project's NYLORUN_* variables as exports
-  doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
-
-nylo status and reset go through the Management API, to a local or a remote installation.
-Local Tenants are nylorun's, the other command of this package: npx nylorun start in a
-project creates its Tenant and the Project link, and nylorun status and reset act on the
-local Tenant's containers and volumes.`;
-/** Local Tenant commands, which `nylorun` runs. */
-const LOCAL_COMMANDS = new Set([
-    "up", "down", "start", "stop", "logs", "studio", "runtime", "restart", "run",
-]);
-const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
-Run "npx nylorun start" in your project to create its Tenant and the Project link.
-Then use nylo status and nylo reset on the linked installation.`;
-const ENDPOINTS_REMOVED = `nylo endpoints was removed: the Runtime runs no code of yours during a session,
-so there are no Action endpoints. An agent's tools are http() tools and remote MCP servers
-(see MIGRATION.md).`;
-const usageError = (message) => new CliError(message, 2);
-/** `nylo <command> [...args]`. */
-export async function main(argv) {
-    const [command, ...args] = argv;
-    if (!command || command === "--help" || command === "-h")
-        return void console.log(usage);
-    refuseNativeWindows();
-    if (command === "tenant")
-        throw usageError(TENANT_REMOVED);
-    if (command === "status")
-        return await statusCommand(args);
-    if (command === "reset")
-        return await resetCommand(args);
-    if (command === "endpoints")
-        throw usageError(ENDPOINTS_REMOVED);
-    if (command === "access") {
-        if (args[0] === "--help" || args[0] === "-h" || args.length === 0) {
-            const { accessUsage } = await import("./access/commands.js");
-            return void console.log(accessUsage);
-        }
-        return await accessCommand(args);
-    }
-    if (command === "env") {
-        if (args.length)
-            throw usageError("Usage: nylo env");
-        await printLinkedEnvExports(findProjectRoot() ?? process.cwd());
-        return;
-    }
-    if (command === "doctor") {
-        const [topic, ...options] = args;
-        if (topic !== "sandbox" || options.some((option) => option !== "--json"))
-            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local Tenant with npx nylorun doctor.");
-        const { doctorSandbox } = await import("./doctor.js");
-        await doctorSandbox({ json: options.includes("--json") });
-        return;
-    }
-    if (command === "dev")
-        throw usageError('nylorun dev was removed: run "npx nylorun start" once in your project, then your project\'s npm run dev.');
-    if (LOCAL_COMMANDS.has(command))
-        throw usageError(`Local Tenants are nylorun's: npx nylorun ${command}`);
-    if (command === "configure") {
-        for (const arg of args) {
-            if (arg === "--global" || arg === "--db")
-                throw usageError(`${arg} was removed. Use the Runtime Host root (NYLORUN_HOME) and a Project link instead.`);
-            if (arg.startsWith("-"))
-                throw usageError(usage);
-        }
-        if (args.length)
-            throw usageError(usage);
-        const projectRoot = findProjectRoot() ?? process.cwd();
-        const auth = await linkedConnection(projectRoot);
-        const admin = managementClient(auth);
-        // The provider login flows (pi-ai) load only here.
-        const { ConfigurationCancelled, configureProvider, fetchModelCatalog } = await import("./model/configure.js");
-        const { putHostModel } = await import("./model/host-model.js");
-        const controller = new AbortController();
-        const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
-        process.once("SIGINT", () => cancel("SIGINT"));
-        process.once("SIGTERM", () => cancel("SIGTERM"));
-        const health = await fetch(`${auth.url}/health`).catch(() => undefined);
-        if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local Tenant with "npx nylorun start".`, 6);
-        const catalog = await fetchModelCatalog(admin);
-        const prompted = await configureProvider({
-            signal: controller.signal,
-            catalog,
-        });
-        await putHostModel(admin, prompted);
-        return;
-    }
-    throw usageError(usage);
-}

package/dist/client/installation/commands.d.ts

@@ -1,7 +0,0 @@
-/**
- * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
- * answer: `npx nylorun status` reports why.
- */
-export declare function statusCommand(args: readonly string[]): Promise<void>;
-/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
-export declare function resetCommand(args: readonly string[]): Promise<void>;

package/dist/client/installation/commands.js

@@ -1,80 +0,0 @@
-/**
- * `nylo status` and `nylo reset`: the linked installation's one Tenant, through the Management
- * API (the Project's management key).
- */
-import { createInterface } from "node:readline/promises";
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../../errors.js";
-import { linkedConnection, managementClient } from "../project/connection.js";
-const projectRoot = () => findProjectRoot() ?? process.cwd();
-/**
- * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
- * answer: `npx nylorun status` reports why.
- */
-export async function statusCommand(args) {
-    const json = args.includes("--json");
-    if (args.some((a) => a !== "--json"))
-        throw new CliError("Usage: nylo status [--json]", 2);
-    const root = projectRoot();
-    const connection = await linkedConnection(root);
-    const admin = managementClient(connection);
-    let body;
-    try {
-        body = await admin.tenant.status();
-    }
-    catch (error) {
-        throw new CliError(`${(error instanceof Error ? error.message : `The Tenant at ${connection.url} is not reachable`).replace(/\.?$/, ".")} Run "npx nylorun status" to see the Tenant's state and why it is not open.`, 1);
-    }
-    if (json) {
-        console.log(JSON.stringify(body, null, 2));
-        return;
-    }
-    console.log(`${body.tenant.name}  ${body.tenant.id}`);
-    console.log(`runtime  ${connection.url}`);
-    console.log(`path     ${body.path}`);
-    console.log(`checks   ${Object.entries(body.checks)
-        .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
-        .join(" ")}`);
-    console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
-    console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
-}
-const RESET_USAGE = "Usage: nylo reset [--sessions|--sandboxes|--all] [--yes]";
-const SCOPES = { "--sessions": "sessions", "--sandboxes": "sandboxes", "--all": "all" };
-/** `nylo reset [--sessions|--sandboxes|--all] [--yes]`; `--all` asks first. */
-export async function resetCommand(args) {
-    const yes = args.includes("--yes");
-    const flags = args.filter((a) => a !== "--yes");
-    if (flags.some((f) => !(f in SCOPES)) || args.filter((a) => a === "--yes").length > 1)
-        throw new CliError(RESET_USAGE, 2);
-    if (flags.length > 1)
-        throw new CliError("Pass only one of --sessions, --sandboxes, --all.", 2);
-    const scope = flags.length ? SCOPES[flags[0]] : "sessions";
-    const connection = await linkedConnection(projectRoot());
-    const tenant = connection.link?.tenant;
-    const target = tenant ? `Tenant ${tenant} (${connection.url})` : `the Tenant on ${connection.url}`;
-    const admin = managementClient(connection);
-    if (scope === "all" && !yes)
-        await confirmOrThrow(`Reset ALL data of ${target}? The Project link and credentials are kept. [y/N] `);
-    try {
-        await admin.tenant.reset({ scope, activeWork: "drain" });
-    }
-    catch (error) {
-        throw new CliError(error instanceof Error ? error.message : `Tenant reset failed: ${String(error)}`, 1);
-    }
-    console.log(`Reset ${target} (${scope}).`);
-}
-async function confirmOrThrow(prompt) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new CliError("Confirmation required; pass --yes for non-interactive use.", 2);
-    }
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        const answer = (await rl.question(prompt)).trim().toLowerCase();
-        if (answer !== "y" && answer !== "yes") {
-            throw new CliError("Cancelled.", 1);
-        }
-    }
-    finally {
-        rl.close();
-    }
-}

package/dist/client/project/connection.d.ts

@@ -1,36 +0,0 @@
-import { type ManagementClient } from "@nylorun/admin";
-import { type ProjectCredentials, type ProjectLink as LinkFile } from "@nylorun/core/project";
-/**
- * The Project link (format 3), which `nylorun start` writes and `nylo` only reads with
- * `@nylorun/core/project`'s reader. `tenantId` is information: the installation serves one
- * Tenant, so nothing selects it.
- */
-export type ProjectLink = LinkFile & {
-    format: 3;
-};
-/** The Project's link; one of an older nylorun (formats 0 to 2) is refused. */
-export declare function readLink(projectRoot: string): Promise<ProjectLink | undefined>;
-/**
- * The Project's credentials (mode 0600), which `nylorun start` writes beside the link: the
- * application key and its principal, and the management key and its principal when it issued
- * one. A format 0 file's legacy `executors` map is ignored.
- */
-export declare function readCredentials(projectRoot: string): Promise<ProjectCredentials | undefined>;
-/** The installation `nylo` acts on: a Runtime URL, an application key and a management key. */
-export interface LinkedConnection {
-    url: string;
-    /** The application key (Runtime API); absent when only a management key is set. */
-    key?: string;
-    /** The management key (Management API), when there is one. */
-    managementKey?: string;
-    /** The Project link it came from, when it came from one. */
-    link?: ProjectLink;
-}
-/**
- * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` with `NYLORUN_SERVER_KEY`, or
- * `NYLORUN_MANAGEMENT_KEY`, or both; `NYLORUN_MANAGEMENT_KEY` also stands in for a Project
- * credentials file without one. The installation serves one Tenant, so nothing names it.
- */
-export declare function linkedConnection(projectRoot: string, env?: Readonly<Record<string, string | undefined>>): Promise<LinkedConnection>;
-/** The Management API client of `connection`; refused without a management key. */
-export declare function managementClient(connection: LinkedConnection): ManagementClient;

package/dist/client/project/connection.js

@@ -1,80 +0,0 @@
-import { chmod } from "node:fs/promises";
-import { createManagementClient } from "@nylorun/admin";
-import { ProjectFileError, projectCredentialsPath, projectLinkPath, readProjectCredentials, readProjectLink, } from "@nylorun/core/project";
-import { CliError } from "../../errors.js";
-/** The Project's link; one of an older nylorun (formats 0 to 2) is refused. */
-export async function readLink(projectRoot) {
-    const path = projectLinkPath(projectRoot);
-    let link;
-    try {
-        link = readProjectLink(projectRoot);
-    }
-    catch (error) {
-        if (!(error instanceof ProjectFileError))
-            throw error;
-        throw new CliError(error.reason === "newer"
-            ? `Project link at ${path} has an unsupported format. Upgrade nylorun.`
-            : `Invalid Project link at ${path}. Remove .nylorun/link.json and run "npx nylorun start".`, 1);
-    }
-    if (link === undefined)
-        return undefined;
-    if (link.format !== 3)
-        throw new CliError(`The Project link at ${path} is from an older nylorun. Run "npx nylorun start" in this project to link it again.`, 1);
-    return { ...link, format: 3 };
-}
-/**
- * The Project's credentials (mode 0600), which `nylorun start` writes beside the link: the
- * application key and its principal, and the management key and its principal when it issued
- * one. A format 0 file's legacy `executors` map is ignored.
- */
-export async function readCredentials(projectRoot) {
-    const path = projectCredentialsPath(projectRoot);
-    let credentials;
-    try {
-        credentials = readProjectCredentials(projectRoot);
-    }
-    catch (error) {
-        if (!(error instanceof ProjectFileError))
-            throw error;
-        throw new CliError(error.reason === "newer"
-            ? `Project credentials at ${path} have an unsupported format. Upgrade nylorun.`
-            : `Invalid Project credentials at ${path}. Remove .nylorun/credentials.json and run "npx nylorun start".`, 1);
-    }
-    if (credentials)
-        await chmod(path, 0o600);
-    return credentials;
-}
-/**
- * The Project's link and credentials, else `NYLORUN_RUNTIME_URL` with `NYLORUN_SERVER_KEY`, or
- * `NYLORUN_MANAGEMENT_KEY`, or both; `NYLORUN_MANAGEMENT_KEY` also stands in for a Project
- * credentials file without one. The installation serves one Tenant, so nothing names it.
- */
-export async function linkedConnection(projectRoot, env = process.env) {
-    const link = await readLink(projectRoot);
-    const credentials = await readCredentials(projectRoot);
-    const managementKey = env.NYLORUN_MANAGEMENT_KEY?.trim();
-    if (link && credentials) {
-        const management = credentials.managementKey ?? managementKey;
-        return {
-            url: link.hostUrl,
-            key: credentials.applicationKey,
-            ...(management ? { managementKey: management } : {}),
-            link,
-        };
-    }
-    const url = env.NYLORUN_RUNTIME_URL?.trim();
-    const key = env.NYLORUN_SERVER_KEY?.trim();
-    if (url && (key || managementKey))
-        return {
-            url: url.replace(/\/$/, ""),
-            ...(key ? { key } : {}),
-            ...(managementKey ? { managementKey } : {}),
-        };
-    throw new CliError(`No Project link in ${projectRoot}. Run "npx nylorun start" in this project to start its Tenant and link it, or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY (or NYLORUN_MANAGEMENT_KEY).`, 1);
-}
-/** The Management API client of `connection`; refused without a management key. */
-export function managementClient(connection) {
-    if (!connection.managementKey)
-        throw new CliError(`No management key for the Tenant at ${connection.url}: run npx nylorun start, or set NYLORUN_MANAGEMENT_KEY.`, 1);
-    return createManagementClient({ url: connection.url, key: connection.managementKey });
-}

package/dist/client/project/env.d.ts

@@ -1,3 +0,0 @@
-/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
-export declare function printLinkedEnvExports(projectRoot?: string): Promise<void>;
-export declare function shellQuote(value: string): string;

package/dist/client/project/env.js

@@ -1,19 +0,0 @@
-import { findProjectRoot } from "@nylorun/core/project";
-import { readCredentials, readLink } from "./connection.js";
-/** Two `export` lines for `nylo env` (was `nylorun status --env`, F2-7). */
-export async function printLinkedEnvExports(projectRoot = process.cwd()) {
-    const root = findProjectRoot(projectRoot) ?? projectRoot;
-    const link = await readLink(root);
-    const credentials = await readCredentials(root);
-    if (!link || !credentials) {
-        console.log('# No Project link in this directory. Run "npx nylorun start" in this project to start its Tenant and link it.');
-        return;
-    }
-    console.log(`export NYLORUN_RUNTIME_URL=${shellQuote(link.hostUrl)}`);
-    console.log(`export NYLORUN_SERVER_KEY=${shellQuote(credentials.applicationKey)}`);
-}
-export function shellQuote(value) {
-    if (/^[A-Za-z0-9_./:-]+$/.test(value))
-        return value;
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}

package/dist/stack/mcp.d.ts

@@ -1,9 +0,0 @@
-import type { McpPreview } from "@nylorun/core/contracts";
-import { type StackDeps } from "./commands.js";
-export declare const mcpUsage = "  mcp inspect <url> [--server <name>] [--vault <id>] [--sse] [--tenant <name>] [--json]\n                                      list a remote MCP server's tools with the installation vault's\n                                      credential for <url>: model names, schema sizes, renames, or\n                                      that it needs a person's sign-in (the Runtime calls no tool)";
-/** What the removed `connect` subcommand says since protocol 10. */
-export declare const MCP_CONNECT_REMOVED = "The connect subcommand of nylorun mcp was removed with MCP OAuth (protocol 10): add the server's key to an installation vault as a bearer or headers credential (Studio's Credentials page, or @nylorun/admin), or reach a server that needs a person's sign-in through a gateway (a credential with via). See its tools with nylorun mcp inspect <url>.";
-/** A preview as a person reads it: the server, a table of tools, the renames, or the sign-in hint. */
-export declare function previewLines(preview: McpPreview): string[];
-/** `nylorun mcp <inspect|connect> ...` */
-export declare function mcpCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/sandbox.d.ts

@@ -1,4 +0,0 @@
-import { type StackDeps } from "./commands.js";
-export declare const sandboxUsage = "  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]\n                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels\n  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)\n  sandbox enable --context <name> [--tenant <name>] [--host-address <ip>] [--bind-address <ip>] [--no-pull]\n                                      run the Tenant's sandboxes as pods on that kubeconfig context (agent-sandbox v1.0.5)\n  sandbox disable [--tenant <name>] [--delete-namespace]\n                                      stop the sandboxes service and forget the cluster\n  sandbox status [--tenant <name>] [--json]\n                                      the cluster, the sandboxes service's readiness and what it reports";
-/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
-export declare function sandboxCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/sandbox.js

@@ -1,106 +0,0 @@
-/**
- * `nylorun sandbox ls | rm`: the running local Tenant's sandbox resources (Host feature
- * `sandboxes`), through its Tenant API with an operator key (`runningTenantApi`). Neither starts the
- * Tenant. `nylorun sandbox enable|disable|status` (sandbox pods on a cluster, F7.2) live in
- * `../sandbox/commands.ts`.
- */
-import { PROTOCOL_HEADER, PROTOCOL_VERSION } from "@nylorun/core/compatibility";
-import { CliError } from "../errors.js";
-import { runSandboxCommand, sandboxUsage as clusterUsage } from "../sandbox/commands.js";
-import { spawnKubectl } from "../sandbox/kubectl.js";
-import { parseStackFlags, runningTenantApi } from "./commands.js";
-export const sandboxUsage = `  sandbox ls [--tenant <name>] [--label <key=value>]... [--json]
-                                      the Tenant's sandboxes: id, kind, state, attached sessions and labels
-  sandbox rm <id> [--tenant <name>]   delete a sandbox and its files (refused while a turn runs in it)
-${clusterUsage}`;
-const usageError = (message) => new CliError(message, 2);
-async function call(deps, api, method, path) {
-    const response = await deps.fetch(`${api.runtimeUrl}${path}`, {
-        method,
-        headers: {
-            authorization: `Bearer ${api.applicationKey}`,
-            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-            accept: "application/json",
-        },
-        redirect: "error",
-        signal: AbortSignal.timeout(15_000),
-    });
-    const body = (await response.json().catch(() => ({})));
-    if (response.status === 404 && path === "/v1/sandboxes")
-        throw new CliError(`Tenant ${api.name} runs a Runtime without sandboxes. Update it: npx nylorun@latest start.`, 1);
-    if (!response.ok && response.status !== 404)
-        throw new CliError(`${method} ${path} returned ${response.status}${typeof body.message === "string" ? `: ${body.message}` : ""}`, 1);
-    return { status: response.status, body };
-}
-function labelsText(labels) {
-    const entries = Object.entries(labels);
-    return entries.length === 0 ? "-" : entries.map(([key, value]) => `${key}=${value}`).join(",");
-}
-async function ls(deps, args) {
-    const usage = "nylorun sandbox ls [--tenant <name>] [--label <key=value>]... [--json]";
-    const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"], lists: ["--label"] }, usage);
-    if (flags.rest.length)
-        throw usageError(`Usage: ${usage}`);
-    const query = new URLSearchParams();
-    for (const label of flags.lists.get("--label") ?? []) {
-        if (label.indexOf("=") <= 0)
-            throw usageError(`--label must be key=value, not ${label}`);
-        query.append("label", label);
-    }
-    const name = flags.values.get("--tenant");
-    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
-    const search = query.toString();
-    const { body } = await call(deps, api, "GET", `/v1/sandboxes${search ? `?${search}` : ""}`);
-    const sandboxes = (body.sandboxes ?? []);
-    if (flags.booleans.has("--json")) {
-        deps.out(JSON.stringify(sandboxes, null, 2));
-        return 0;
-    }
-    if (sandboxes.length === 0) {
-        deps.out(`No sandboxes on Tenant ${api.name}.`);
-        return 0;
-    }
-    const rows = [
-        ["ID", "KIND", "STATE", "SESSIONS", "LABELS"],
-        ...sandboxes.map((sandbox) => [
-            sandbox.id,
-            sandbox.kind,
-            sandbox.state,
-            String(sandbox.sessions.length),
-            labelsText(sandbox.labels),
-        ]),
-    ];
-    const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
-    for (const row of rows)
-        deps.out(row
-            .map((cell, column) => (column === row.length - 1 ? cell : cell.padEnd(widths[column])))
-            .join("  "));
-    return 0;
-}
-async function rm(deps, args) {
-    const usage = "nylorun sandbox rm <id> [--tenant <name>]";
-    const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
-    if (flags.rest.length !== 1)
-        throw usageError(`Usage: ${usage}`);
-    const id = flags.rest[0];
-    const name = flags.values.get("--tenant");
-    const api = await runningTenantApi(deps, name === undefined ? {} : { name });
-    const { status, body } = await call(deps, api, "DELETE", `/v1/sandboxes/${encodeURIComponent(id)}`);
-    if (status === 404 || body.deleted !== true) {
-        deps.err(`No sandbox ${id} on Tenant ${api.name}.`);
-        return 1;
-    }
-    deps.out(`Deleted sandbox ${id} and its files.`);
-    return 0;
-}
-/** `nylorun sandbox <ls|rm|enable|disable|status> ...` */
-export async function sandboxCommand(deps, args) {
-    const [sub, ...rest] = args;
-    if (sub === "ls" || sub === "list")
-        return ls(deps, rest);
-    if (sub === "rm" || sub === "delete")
-        return rm(deps, rest);
-    if (sub === "enable" || sub === "disable" || sub === "status")
-        return runSandboxCommand(args, { stack: deps, kubectl: spawnKubectl(deps.env) });
-    throw usageError(`Usage:\n${sandboxUsage}`);
-}