nylorun 0.14.0-beta → 0.15.1-beta

package/dist/stack/compose-file.js

@@ -42,7 +42,7 @@ import { PINNED_IMAGES } from "./images.js";
  * gateway receive it (NYLORUN_OBJECT_STORE_*). The runtime creates the bucket at boot and
  * reaches the store through its `s3` BlobStore.
  *
- * With `sandboxes` (after `nylorun sandbox enable`, F7.2) the `sandboxes` service runs the
+ * With `sandboxes` (after `nylorun local sandbox enable`, F7.2) the `sandboxes` service runs the
  * agent-sandbox driver: the only container holding the cluster credentials
  * (`<Host root>/sandboxes`, read-only), not published, reached by the runtime alone with
  * NYLORUN_SANDBOXES_TOKEN. The runtime gets an empty read-only mount over that directory.
@@ -143,7 +143,7 @@ ${restateUi ? RESTATE_UI : RESTATE_CLOSED}    healthcheck:
       RUSTFS_ACCESS_KEY: nylorun
       RUSTFS_SECRET_KEY: \${NYLORUN_OBJECT_STORE_SECRET_KEY:?run nylorun start}
       RUSTFS_CONSOLE_ENABLE: "false" # no web console: clients go through the Runtime
-      RUSTFS_OBS_LOG_DIRECTORY: "" # log to stdout (nylorun logs rustfs)
+      RUSTFS_OBS_LOG_DIRECTORY: "" # log to stdout (nylorun local logs rustfs)
     # The image runs as uid 10001 and owns /data, which Docker copies into the new volume.
     volumes:
       - rustfs:/data
@@ -378,21 +378,21 @@ const IDENTITY_RUNTIME_ENV = `
       # Trusted issuers (<Host root>/identity.yaml): JWTs from the operator's identity provider.
       NYLORUN_IDENTITY_FILE: /nylorun/identity.yaml`;
 const SANDBOXES_RUNTIME_ENV = `
-      # The sandboxes service (nylorun sandbox enable): pods on the Tenant's cluster.
+      # The sandboxes service (nylorun local sandbox enable): pods on the Tenant's cluster.
       NYLORUN_SANDBOXES_URL: http://sandboxes:4300
-      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun sandbox enable}
+      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun local sandbox enable}
       NYLORUN_SANDBOX_HARNESS_IMAGE: \${NYLORUN_RUNTIME_IMAGE:?run nylorun start} # pods copy the engine from it`;
 /** Pods join and connect to the Harness API at the Docker host's address. */
-const SANDBOXES_HARNESS_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun sandbox enable}";
+const SANDBOXES_HARNESS_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun local sandbox enable}";
 /** The Harness API, published for sandbox pods. */
 const SANDBOXES_RUNTIME_PORT = `
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun sandbox enable}:4200" # Harness API, for sandbox pods`;
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_HARNESS_PORT:?run nylorun local sandbox enable}:4200" # Harness API, for sandbox pods`;
 /** The gates accept the pods' Host; their calls carry run tokens. */
-const SANDBOXES_GATES_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun sandbox enable}";
+const SANDBOXES_GATES_HOST = ",\${NYLORUN_SANDBOX_HOST_ADDRESS:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun local sandbox enable}";
 /** The gates and egress-gate, published for sandbox pods. */
 const SANDBOXES_GATES_PORT = `    ports:
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun sandbox enable}:4100" # gates, for sandbox pods (run tokens)
-      - "\${NYLORUN_SANDBOX_BIND:?run nylorun sandbox enable}:\${NYLORUN_SANDBOX_EGRESS_PORT:?run nylorun sandbox enable}:4200" # egress-gate, for sandbox pods (egress tokens)
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_GATES_PORT:?run nylorun local sandbox enable}:4100" # gates, for sandbox pods (run tokens)
+      - "\${NYLORUN_SANDBOX_BIND:?run nylorun local sandbox enable}:\${NYLORUN_SANDBOX_EGRESS_PORT:?run nylorun local sandbox enable}:4200" # egress-gate, for sandbox pods (egress tokens)
 `;
 /** egress-gate (F7.2): pods' CONNECT proxy in the gateway. */
 const SANDBOXES_GATEWAY_ENV = `
@@ -405,19 +405,19 @@ const SANDBOXES_RUNTIME_MOUNT = `
         read_only: true
         tmpfs: { size: 4096, mode: 0755 } # empty, and listable by the runtime user`;
 /**
- * The sandboxes service. The pod-facing ports `nylorun sandbox enable` records
+ * The sandboxes service. The pod-facing ports `nylorun local sandbox enable` records
  * (NYLORUN_SANDBOX_*_PORT in .env), the Harness API's, the gates' and egress-gate's, are
  * published by the runtime and the gateway (above).
  */
 function sandboxesService(project) {
     return `
   sandboxes: # agent-sandbox driver; the only holder of the cluster credentials; not published
-    image: \${NYLORUN_SANDBOXES_IMAGE:?run nylorun sandbox enable}
+    image: \${NYLORUN_SANDBOXES_IMAGE:?run nylorun local sandbox enable}
     container_name: ${project}-sandboxes
     labels: *tenant
     user: "\${NYLORUN_UID:?run nylorun start}:\${NYLORUN_GID:?run nylorun start}" # reads the 0600 token
     environment:
-      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun sandbox enable}
+      NYLORUN_SANDBOXES_TOKEN: \${NYLORUN_SANDBOXES_TOKEN:?run nylorun local sandbox enable}
       NYLORUN_SANDBOXES_DIR: /run/nylorun/sandboxes
       NYLORUN_SANDBOXES_LISTEN: ":4300"
     extra_hosts:

package/dist/stack/env-file.d.ts

@@ -8,7 +8,7 @@ export declare const DEFAULT_STUDIO_FRAME_ANCESTORS: readonly string[];
  * persist; the Restate identity public key is derived from `restate-identity.pem`.
  */
 export interface StackEnv {
-    /** Published Runtime port (loopback): the Tenant API. */
+    /** Published Runtime port (loopback): the Runtime and Management APIs. */
     runtimePort: number;
     /** Published Studio port (loopback). */
     studioPort: number;
@@ -55,11 +55,11 @@ export interface StackEnv {
     studioAnalyticsId: string;
     /** The Tenant's name, which the Runtime gives the Tenant it creates. */
     tenantName: string;
-    /** Present once `nylorun sandbox enable` ran for the Tenant (F7.2). */
+    /** Present once `nylorun local sandbox enable` ran for the Tenant (F7.2). */
     sandboxes?: SandboxStackEnv;
 }
 /**
- * The sandboxes service's settings (`nylorun sandbox enable`): its bearer token (only the
+ * The sandboxes service's settings (`nylorun local sandbox enable`): its bearer token (only the
  * runtime presents it), its image, and the host ports pods reach (Harness API, gates,
  * egress) on the host address, published on the bind address. The ports persist.
  */

package/dist/stack/env-file.js

@@ -102,7 +102,7 @@ export function renderEnvFile(env) {
         line("studioFrameAncestors"),
         "",
         "# Studio's anonymous usage analytics; empty when off. Set on every start: turn",
-        "# it off with nylorun telemetry disable or NYLORUN_TELEMETRY_DISABLED=1.",
+        "# it off with nylorun local telemetry disable or NYLORUN_TELEMETRY_DISABLED=1.",
         line("studioAnalyticsId"),
         "",
         "# The Tenant's name, which the Runtime gives the Tenant it creates on the first",
@@ -111,7 +111,7 @@ export function renderEnvFile(env) {
         "",
         ...(sandboxes
             ? [
-                "# Sandboxes (nylorun sandbox enable): the runtime's token for the sandboxes",
+                "# Sandboxes (nylorun local sandbox enable): the runtime's token for the sandboxes",
                 "# service, its image, and the host ports pods reach on the host address.",
                 sandboxLine("token"),
                 sandboxLine("image"),

package/dist/stack/images.d.ts

@@ -1,7 +1,7 @@
 /**
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
- * (local builds, CI images). The sandboxes service (`nylorun sandbox enable`) is
+ * (local builds, CI images). The sandboxes service (`nylorun local sandbox enable`) is
  * versioned with the Runtime: `ghcr.io/nylorun/sandboxes:<runtime pin>`, or
  * `NYLORUN_SANDBOXES_IMAGE`. Postgres, Restate, s2-lite and RustFS are the
  * official images, pinned here; RustFS (the Object store, D35) by digest as well, so

package/dist/stack/images.js

@@ -2,7 +2,7 @@ import { pinnedVersion } from "./versions.js";
 /**
  * Images a local Tenant runs. The Runtime and Studio tags are pinned by this
  * CLI release; `NYLORUN_RUNTIME_IMAGE` and `NYLORUN_STUDIO_IMAGE` override them
- * (local builds, CI images). The sandboxes service (`nylorun sandbox enable`) is
+ * (local builds, CI images). The sandboxes service (`nylorun local sandbox enable`) is
  * versioned with the Runtime: `ghcr.io/nylorun/sandboxes:<runtime pin>`, or
  * `NYLORUN_SANDBOXES_IMAGE`. Postgres, Restate, s2-lite and RustFS are the
  * official images, pinned here; RustFS (the Object store, D35) by digest as well, so

package/dist/stack/index.d.ts

@@ -5,17 +5,8 @@ export { checkDocker } from "./docker.js";
 export type { Check, DockerChecks } from "./docker.js";
 /** Real dependencies: docker on PATH, global fetch, the terminal. */
 export declare function defaultStackDeps(env: Readonly<Record<string, string | undefined>>): StackDeps;
-/** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */
+/** Entry for `nylorun start|stop|status|studio` and `nylorun local logs|reset|ls|delete`. */
 export declare function stackCommand(name: string, args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-/** Entry for `nylorun sandbox ls|rm`. */
-export declare function sandboxCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun key put|list|rm`. */
-export declare function keyCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { keyUsage } from "./keys.js";
-/** Entry for `nylorun mcp inspect`. */
-export declare function mcpCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>): Promise<number>;
-export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export declare function studioCommand(args: readonly string[], env: Readonly<Record<string, string | undefined>>, options?: {
     next?: string;

package/dist/stack/index.js

@@ -1,10 +1,8 @@
 import { spawn } from "node:child_process";
 import { createInterface } from "node:readline/promises";
+import { text } from "node:stream/consumers";
 import { runStackCommand, runStudioCommand } from "./commands.js";
 import { spawnDocker } from "./docker.js";
-import { keyCommand as runKeyCommand } from "./keys.js";
-import { mcpCommand as runMcpCommand } from "./mcp.js";
-import { sandboxCommand as runSandboxCommand } from "./sandbox.js";
 import { pinnedVersion } from "./versions.js";
 import { loopbackPorts } from "./ports.js";
 export { ensureStack, isStackCommand, readStackStatus, stackUsage, studioLoginUrl, tenantStudioPath, STACK_SERVICES, } from "./commands.js";
@@ -52,6 +50,7 @@ export function defaultStackDeps(env) {
             }
             : {}),
         interactive,
+        stdin: { isTTY: Boolean(process.stdin.isTTY), text: () => text(process.stdin) },
         openBrowser: async (url) => {
             const command = browserCommand(env);
             return await new Promise((resolve) => {
@@ -77,25 +76,10 @@ export function defaultStackDeps(env) {
         },
     };
 }
-/** Entry for `nylorun start|stop|status|logs|reset|studio|ls|delete`. */
+/** Entry for `nylorun start|stop|status|studio` and `nylorun local logs|reset|ls|delete`. */
 export async function stackCommand(name, args, env) {
     return await runStackCommand(name, args, defaultStackDeps(env));
 }
-/** Entry for `nylorun sandbox ls|rm`. */
-export async function sandboxCommand(args, env) {
-    return await runSandboxCommand(defaultStackDeps(env), args);
-}
-export { sandboxUsage } from "./sandbox.js";
-/** Entry for `nylorun key put|list|rm`. */
-export async function keyCommand(args, env) {
-    return await runKeyCommand(defaultStackDeps(env), args);
-}
-export { keyUsage } from "./keys.js";
-/** Entry for `nylorun mcp inspect`. */
-export async function mcpCommand(args, env) {
-    return await runMcpCommand(defaultStackDeps(env), args);
-}
-export { mcpUsage } from "./mcp.js";
 /** `nylorun studio`, landing on `next` when given, else on the Tenant's page. */
 export async function studioCommand(args, env, options = {}) {
     return await runStudioCommand(args, defaultStackDeps(env), options);

package/dist/stack/keys.d.ts

@@ -1,4 +1,4 @@
 import { type StackDeps } from "./commands.js";
-export declare const keyUsage = "  key put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a management key), or\n                                      rotate it (the old key stops working); prints the key once\n  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)\n  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
-/** `nylorun key <put|list|rm> ...` */
+export declare const keyUsage = "  keys put <id> [--management] [--tenant <name>]\n                                      create the Tenant's application key <id> (--management: a\n                                      management key, on the Runtime's machine only), or rotate it\n                                      (the old key stops working); prints the key once\n  keys list [--tenant <name>] [--json]\n                                      the Tenant's keys: id, role, when issued (never the keys)\n  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once";
+/** `nylorun tenant keys <put|list|rm> ...` on a local Tenant. */
 export declare function keyCommand(deps: StackDeps, args: readonly string[]): Promise<number>;

package/dist/stack/keys.js

@@ -1,20 +1,23 @@
 /**
- * `nylorun key put | list | rm`: the running local Tenant's keys, through `nylorun-operate` in its
- * runtime container. Revocable application keys by name, for app servers and other clients, and
+ * `nylorun tenant keys put | list | rm` on a local Tenant: its keys, through `nylorun-operate` in
+ * its runtime container (`client/tenant.ts` takes a remote installation's application keys
+ * through the Management API). Revocable application keys by name, for app servers and other clients, and
  * management keys (`--management`), which only this machine issues; none of these starts the
  * Tenant.
  */
 import { CliError } from "../errors.js";
 import { parseStackFlags, runningOperate } from "./commands.js";
 import { deleteOperatorKey, listOperatorKeys, putOperatorKey } from "./operator-keys.js";
-export const keyUsage = `  key put <id> [--management] [--tenant <name>]
-                                      create the Tenant's application key <id> (--management: a management key), or
-                                      rotate it (the old key stops working); prints the key once
-  key list [--tenant <name>] [--json] the Tenant's keys: id, role, when issued (never the keys)
-  key rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
+export const keyUsage = `  keys put <id> [--management] [--tenant <name>]
+                                      create the Tenant's application key <id> (--management: a
+                                      management key, on the Runtime's machine only), or rotate it
+                                      (the old key stops working); prints the key once
+  keys list [--tenant <name>] [--json]
+                                      the Tenant's keys: id, role, when issued (never the keys)
+  keys rm <id> [--tenant <name>]      delete key <id>: it stops working at once`;
 const usageError = (message) => new CliError(message, 2);
 async function put(deps, args) {
-    const usage = "nylorun key put <id> [--management] [--tenant <name>]";
+    const usage = "nylorun tenant keys put <id> [--management] [--tenant <name>]";
     const flags = parseStackFlags(args, { booleans: ["--management"], values: ["--tenant"] }, usage);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${usage}`);
@@ -28,7 +31,7 @@ async function put(deps, args) {
     return 0;
 }
 async function list(deps, args) {
-    const usage = "nylorun key list [--tenant <name>] [--json]";
+    const usage = "nylorun tenant keys list [--tenant <name>] [--json]";
     const flags = parseStackFlags(args, { booleans: ["--json"], values: ["--tenant"] }, usage);
     if (flags.rest.length)
         throw usageError(`Usage: ${usage}`);
@@ -47,7 +50,7 @@ async function list(deps, args) {
     return 0;
 }
 async function rm(deps, args) {
-    const usage = "nylorun key rm <id> [--tenant <name>]";
+    const usage = "nylorun tenant keys rm <id> [--tenant <name>]";
     const flags = parseStackFlags(args, { values: ["--tenant"] }, usage);
     if (flags.rest.length !== 1)
         throw usageError(`Usage: ${usage}`);
@@ -61,7 +64,7 @@ async function rm(deps, args) {
     deps.out(`Deleted key ${id}: it no longer works.`);
     return 0;
 }
-/** `nylorun key <put|list|rm> ...` */
+/** `nylorun tenant keys <put|list|rm> ...` on a local Tenant. */
 export async function keyCommand(deps, args) {
     const [sub, ...rest] = args;
     if (sub === "put")

package/dist/stack/paths.d.ts

@@ -10,7 +10,7 @@ export interface StackPaths {
     state: string;
     /**
      * cli-credentials.json: the operator key `cli` that `nylorun` commands use outside a linked
-     * project (`nylorun sandbox`), mode 0600.
+     * project (`nylorun local sandbox`), mode 0600.
      */
     cliCredentials: string;
     /**

package/dist/stack/prepare.d.ts

@@ -43,7 +43,7 @@ export declare function prepareStack(input: {
     /** The measurement id Studio reports page views to; absent when telemetry is off. */
     studioAnalyticsId?: string;
     /**
-     * The sandboxes settings (`nylorun sandbox enable`); null removes them (`disable`).
+     * The sandboxes settings (`nylorun local sandbox enable`); null removes them (`disable`).
      * Undefined keeps the persisted ones while `sandboxes/cluster.json` exists.
      */
     sandboxes?: SandboxStackEnv | null;

package/dist/stack/stacks.js

@@ -25,7 +25,7 @@ export function tenantRoot(base, name) {
 export function assertTenantName(name, source) {
     // A Tenant id, such as a NYLORUN_TENANT kept from an older release.
     if (/^tn_/i.test(name))
-        throw new CliError(`${source} must be a Tenant's name, not a Tenant id: ${name}. "nylorun ls" lists the Tenants on this machine.`, 2);
+        throw new CliError(`${source} must be a Tenant's name, not a Tenant id: ${name}. "nylorun local ls" lists the Tenants on this machine.`, 2);
     if (!TENANT_NAME.test(name))
         throw new CliError(`${source} must be lowercase letters, digits, "-" or "_", starting with a letter or digit: ${name}`, 2);
     return name;

package/dist/telemetry.d.ts

@@ -8,7 +8,7 @@ export declare const STUDIO_ANALYTICS_ID = "G-K6RPDFH6Q6";
 /** `~/.nylorun/telemetry.json`: the developer's choice, for every Tenant on the machine. */
 export interface TelemetryFile {
     format: 1;
-    /** False after `nylorun telemetry disable`; absent until a choice is made. */
+    /** False after `nylorun local telemetry disable`; absent until a choice is made. */
     enabled?: boolean;
     /** When `nylorun start` showed the notice (ISO time); it is shown once. */
     noticeShown?: string;
@@ -23,7 +23,7 @@ export declare function readTelemetry(nylorunRoot: string): Promise<TelemetryFil
 export declare function writeTelemetry(nylorunRoot: string, file: TelemetryFile): Promise<void>;
 /** On unless the environment or the developer's choice turns it off. */
 export declare function telemetryDecision(env: Readonly<Record<string, string | undefined>>, file: TelemetryFile): TelemetryDecision;
-/** `nylorun telemetry [status|enable|disable]`. */
+/** `nylorun local telemetry [status|enable|disable]`. */
 export declare function telemetryCommand(args: readonly string[], context: {
     nylorunRoot: string;
     env: Readonly<Record<string, string | undefined>>;

package/dist/telemetry.js

@@ -12,7 +12,7 @@ export const STUDIO_ANALYTICS_ID = "G-K6RPDFH6Q6";
 export const TELEMETRY_NOTICE = [
     "Studio collects anonymous usage data: which pages are opened, with every",
     "Tenant, agent and session id removed. Nothing you send to agents is collected.",
-    'Turn it off with "nylorun telemetry disable" or NYLORUN_TELEMETRY_DISABLED=1.',
+    'Turn it off with "nylorun local telemetry disable" or NYLORUN_TELEMETRY_DISABLED=1.',
     "Learn more: https://github.com/nylorun/agents/blob/main/nylorun/README.md#telemetry",
 ].join("\n");
 export function telemetryPath(nylorunRoot) {
@@ -56,11 +56,11 @@ export function telemetryDecision(env, file) {
     if (flag(env.CI))
         return { enabled: false, reason: "CI is set" };
     if (file.enabled === false)
-        return { enabled: false, reason: 'turned off with "nylorun telemetry disable"' };
+        return { enabled: false, reason: 'turned off with "nylorun local telemetry disable"' };
     return { enabled: true, reason: "on by default" };
 }
-const USAGE = "Usage: nylorun telemetry [status|enable|disable]";
-/** `nylorun telemetry [status|enable|disable]`. */
+const USAGE = "Usage: nylorun local telemetry [status|enable|disable]";
+/** `nylorun local telemetry [status|enable|disable]`. */
 export async function telemetryCommand(args, context) {
     const [action = "status", ...rest] = args;
     if (rest.length || !["status", "enable", "disable"].includes(action))

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "nylorun",
-  "version": "0.14.0-beta",
+  "version": "0.15.1-beta",
   "type": "module",
   "license": "Apache-2.0",
-  "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose (nylorun), and the Runtime client of the linked installation (nylo)",
+  "description": "Set up and run local Nylorun Tenants (Runtime and Studio) with Docker Compose, and act on a Tenant through its Runtime and Management APIs",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/nylorun/agents.git",
@@ -30,8 +30,9 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/core": "0.20.0-beta",
-    "@nylorun/admin": "0.16.0-beta"
+    "@nylorun/admin": "0.17.1-beta",
+    "@nylorun/agents": "0.22.0-beta",
+    "@nylorun/core": "0.22.0-beta"
   },
   "devDependencies": {
     "@earendil-works/pi-ai": "0.99.1",
@@ -45,7 +46,7 @@
     "nylo": "dist/nylo.js"
   },
   "nylorun": {
-    "runtime": "0.24.0-beta",
-    "studio": "0.24.0-beta"
+    "runtime": "0.26.0-beta",
+    "studio": "0.25.1-beta"
   }
 }

package/dist/client/access/commands.d.ts

@@ -1,8 +0,0 @@
-/**
- * `nylo access`: the linked Tenant's signing keys, which sign capability links and run tokens,
- * through the Management API with the Project's management key. (Subject tokens, the
- * access policy, browser keys and revocations left the Runtime in protocol 7.)
- */
-import type { ManagementClient } from "@nylorun/admin";
-export declare const accessUsage = "nylo access signing-keys <list|rotate|revoke>\n\n  signing-keys list                  list the signing keys\n  signing-keys rotate [--force]      rotate; --force ends outstanding links and run tokens\n  signing-keys revoke <kid>          revoke a previous or standby key";
-export declare function accessCommand(input: readonly string[], client?: () => Promise<ManagementClient>): Promise<void>;

package/dist/client/access/commands.js

@@ -1,33 +0,0 @@
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../../errors.js";
-import { linkedConnection, managementClient } from "../project/connection.js";
-export const accessUsage = `nylo access signing-keys <list|rotate|revoke>
-
-  signing-keys list                  list the signing keys
-  signing-keys rotate [--force]      rotate; --force ends outstanding links and run tokens
-  signing-keys revoke <kid>          revoke a previous or standby key`;
-const usageError = (message = accessUsage) => new CliError(message, 2);
-async function linkedClient() {
-    return managementClient(await linkedConnection(findProjectRoot() ?? process.cwd()));
-}
-const print = (value) => console.log(JSON.stringify(value, null, 2));
-export async function accessCommand(input, client = linkedClient) {
-    const [topic, action, ...args] = input;
-    if (topic === "signing-keys") {
-        const keys = async () => (await client()).signingKeys;
-        if (action === "list" && args.length === 0)
-            return print(await (await keys()).list());
-        if (action === "rotate") {
-            const force = args[0] === "--force";
-            if (args.length > (force ? 1 : 0))
-                throw usageError();
-            return print(await (await keys()).rotate({ force }));
-        }
-        if (action === "revoke" && args.length === 1)
-            return print(await (await keys()).revoke(args[0]));
-        throw usageError();
-    }
-    if (topic === "policy" || topic === "keys" || topic === "revoke" || topic === "token")
-        throw usageError(`nylo access ${topic} was removed: the Runtime no longer mints subject tokens or keeps an access policy, browser keys or revocations (protocol 7). Trust your identity provider's tokens with an identity file, and give servers an application key (nylorun key put <id>).`);
-    throw usageError();
-}

package/dist/client/cli.d.ts

@@ -1,2 +0,0 @@
-/** `nylo <command> [...args]`. */
-export declare function main(argv: readonly string[]): Promise<void>;

package/dist/client/cli.js

@@ -1,106 +0,0 @@
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../errors.js";
-import { refuseNativeWindows } from "../command.js";
-import { printLinkedEnvExports } from "./project/env.js";
-import { linkedConnection, managementClient } from "./project/connection.js";
-import { accessCommand } from "./access/commands.js";
-import { resetCommand, statusCommand } from "./installation/commands.js";
-const usage = `nylo <status|reset|access|configure|env|doctor>
-
-Runtime client for the linked installation and its one Tenant (the Project link that
-npx nylorun start writes, or NYLORUN_RUNTIME_URL with NYLORUN_SERVER_KEY, and
-NYLORUN_MANAGEMENT_KEY for status, reset, access, configure and doctor):
-  status [--json]                         the Tenant, its checks and counts
-  reset [--sessions|--environments|--all] [--yes]
-                                          clear the Tenant's sessions, Environments or all its data
-  access signing-keys list|rotate|revoke  the Tenant's token signing keys (nylo access --help)
-  configure                               set the linked Tenant's model provider
-  env                                     print the linked Project's NYLORUN_* variables as exports
-  doctor sandbox [--json]                 show which sandbox backend this Tenant's Host offers
-
-nylo status and reset go through the Management API, to a local or a remote installation.
-Local Tenants are nylorun's, the other command of this package: npx nylorun start in a
-project creates its Tenant and the Project link, and nylorun status and reset act on the
-local Tenant's containers and volumes.`;
-/** Local Tenant commands, which `nylorun` runs. */
-const LOCAL_COMMANDS = new Set([
-    "up", "down", "start", "stop", "logs", "studio", "runtime", "restart", "run",
-]);
-const TENANT_REMOVED = `nylo tenant was removed: an installation serves one Tenant.
-Run "npx nylorun start" in your project to create its Tenant and the Project link.
-Then use nylo status and nylo reset on the linked installation.`;
-const ENDPOINTS_REMOVED = `nylo endpoints was removed: the Runtime runs agents from their manifests alone,
-so there are no Action endpoints. An agent's tools are http() tools and remote MCP servers
-(see MIGRATION.md).`;
-const usageError = (message) => new CliError(message, 2);
-/** `nylo <command> [...args]`. */
-export async function main(argv) {
-    const [command, ...args] = argv;
-    if (!command || command === "--help" || command === "-h")
-        return void console.log(usage);
-    refuseNativeWindows();
-    if (command === "tenant")
-        throw usageError(TENANT_REMOVED);
-    if (command === "status")
-        return await statusCommand(args);
-    if (command === "reset")
-        return await resetCommand(args);
-    if (command === "endpoints")
-        throw usageError(ENDPOINTS_REMOVED);
-    if (command === "access") {
-        if (args[0] === "--help" || args[0] === "-h" || args.length === 0) {
-            const { accessUsage } = await import("./access/commands.js");
-            return void console.log(accessUsage);
-        }
-        return await accessCommand(args);
-    }
-    if (command === "env") {
-        if (args.length)
-            throw usageError("Usage: nylo env");
-        await printLinkedEnvExports(findProjectRoot() ?? process.cwd());
-        return;
-    }
-    if (command === "doctor") {
-        const [topic, ...options] = args;
-        if (topic !== "sandbox" || options.some((option) => option !== "--json"))
-            throw usageError("Usage: nylo doctor sandbox [--json]. Check the local Tenant with npx nylorun doctor.");
-        const { doctorSandbox } = await import("./doctor.js");
-        await doctorSandbox({ json: options.includes("--json") });
-        return;
-    }
-    if (command === "dev")
-        throw usageError('nylorun dev was removed: run "npx nylorun start" once in your project, then your project\'s npm run dev.');
-    if (LOCAL_COMMANDS.has(command))
-        throw usageError(`Local Tenants are nylorun's: npx nylorun ${command}`);
-    if (command === "configure") {
-        for (const arg of args) {
-            if (arg === "--global" || arg === "--db")
-                throw usageError(`${arg} was removed. Use the Runtime Host root (NYLORUN_HOME) and a Project link instead.`);
-            if (arg.startsWith("-"))
-                throw usageError(usage);
-        }
-        if (args.length)
-            throw usageError(usage);
-        const projectRoot = findProjectRoot() ?? process.cwd();
-        const auth = await linkedConnection(projectRoot);
-        const admin = managementClient(auth);
-        // The provider login flows (pi-ai) load only here.
-        const { ConfigurationCancelled, configureProvider, fetchModelCatalog } = await import("./model/configure.js");
-        const { putHostModel } = await import("./model/host-model.js");
-        const controller = new AbortController();
-        const cancel = (signal) => controller.abort(new ConfigurationCancelled(signal));
-        process.once("SIGINT", () => cancel("SIGINT"));
-        process.once("SIGTERM", () => cancel("SIGTERM"));
-        const health = await fetch(`${auth.url}/health`).catch(() => undefined);
-        if (!health?.ok)
-            throw new CliError(`No Runtime is listening at ${auth.url}. Start the local Tenant with "npx nylorun start".`, 6);
-        const catalog = await fetchModelCatalog(admin);
-        const prompted = await configureProvider({
-            signal: controller.signal,
-            catalog,
-        });
-        await putHostModel(admin, prompted);
-        return;
-    }
-    throw usageError(usage);
-}

package/dist/client/installation/commands.d.ts

@@ -1,7 +0,0 @@
-/**
- * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
- * answer: `npx nylorun status` reports why.
- */
-export declare function statusCommand(args: readonly string[]): Promise<void>;
-/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
-export declare function resetCommand(args: readonly string[]): Promise<void>;

package/dist/client/installation/commands.js

@@ -1,82 +0,0 @@
-/**
- * `nylo status` and `nylo reset`: the linked installation's one Tenant, through the Management
- * API (the Project's management key).
- */
-import { createInterface } from "node:readline/promises";
-import { findProjectRoot } from "@nylorun/core/project";
-import { CliError } from "../../errors.js";
-import { linkedConnection, managementClient } from "../project/connection.js";
-const projectRoot = () => findProjectRoot() ?? process.cwd();
-/**
- * `nylo status [--json]`: the Tenant, its checks and counts. A Tenant that is not open does not
- * answer: `npx nylorun status` reports why.
- */
-export async function statusCommand(args) {
-    const json = args.includes("--json");
-    if (args.some((a) => a !== "--json"))
-        throw new CliError("Usage: nylo status [--json]", 2);
-    const root = projectRoot();
-    const connection = await linkedConnection(root);
-    const admin = managementClient(connection);
-    let body;
-    try {
-        body = await admin.tenant.status();
-    }
-    catch (error) {
-        throw new CliError(`${(error instanceof Error ? error.message : `The Tenant at ${connection.url} is not reachable`).replace(/\.?$/, ".")} Run "npx nylorun status" to see the Tenant's state and why it is not open.`, 1);
-    }
-    if (json) {
-        console.log(JSON.stringify(body, null, 2));
-        return;
-    }
-    console.log(`${body.tenant.name}  ${body.tenant.id}`);
-    console.log(`runtime  ${connection.url}`);
-    console.log(`path     ${body.path}`);
-    console.log(`checks   ${Object.entries(body.checks)
-        .map(([k, v]) => `${k}=${v ? "ok" : "fail"}`)
-        .join(" ")}`);
-    console.log(`counts   sessions=${body.counts.sessions} running=${body.counts.runningSessions} uncertain=${body.counts.uncertainEffects}`);
-    console.log(`sandbox  ${body.sandbox.backend ?? "none"}`);
-}
-const RESET_USAGE = "Usage: nylo reset [--sessions|--environments|--all] [--yes]";
-const SCOPES = { "--sessions": "sessions", "--environments": "environments", "--all": "all" };
-/** `nylo reset [--sessions|--environments|--all] [--yes]`; `--all` asks first. */
-export async function resetCommand(args) {
-    const yes = args.includes("--yes");
-    const flags = args.filter((a) => a !== "--yes");
-    if (flags.includes("--sandboxes"))
-        throw new CliError("--sandboxes is now --environments (protocol 11): nylo reset --environments deletes the Tenant's Environments, their vaults and files.", 2);
-    if (flags.some((f) => !(f in SCOPES)) || args.filter((a) => a === "--yes").length > 1)
-        throw new CliError(RESET_USAGE, 2);
-    if (flags.length > 1)
-        throw new CliError("Pass only one of --sessions, --environments, --all.", 2);
-    const scope = flags.length ? SCOPES[flags[0]] : "sessions";
-    const connection = await linkedConnection(projectRoot());
-    const tenant = connection.link?.tenant;
-    const target = tenant ? `Tenant ${tenant} (${connection.url})` : `the Tenant on ${connection.url}`;
-    const admin = managementClient(connection);
-    if (scope === "all" && !yes)
-        await confirmOrThrow(`Reset ALL data of ${target}? The Project link and credentials are kept. [y/N] `);
-    try {
-        await admin.tenant.reset({ scope, activeWork: "drain" });
-    }
-    catch (error) {
-        throw new CliError(error instanceof Error ? error.message : `Tenant reset failed: ${String(error)}`, 1);
-    }
-    console.log(`Reset ${target} (${scope}).`);
-}
-async function confirmOrThrow(prompt) {
-    if (!process.stdin.isTTY || !process.stdout.isTTY) {
-        throw new CliError("Confirmation required; pass --yes for non-interactive use.", 2);
-    }
-    const rl = createInterface({ input: process.stdin, output: process.stdout });
-    try {
-        const answer = (await rl.question(prompt)).trim().toLowerCase();
-        if (answer !== "y" && answer !== "yes") {
-            throw new CliError("Cancelled.", 1);
-        }
-    }
-    finally {
-        rl.close();
-    }
-}