nylorun 0.8.0-beta → 0.11.0-beta

package/dist/stack/commands.d.ts

@@ -1,9 +1,9 @@
-import type { HostTenant } from "@nylorun/core/contracts";
 import { type ComposeService, type DockerRunner } from "./docker.js";
 import type { HarnessMode, SandboxStackEnv } from "./env-file.js";
 import { type StackPaths } from "./paths.js";
 import type { PortProbe } from "./ports.js";
 import { type FetchLike } from "./studio-login.js";
+import { type OperateEndpoint } from "./operator-keys.js";
 export declare const STACK_SERVICES: readonly ["postgres", "restate", "s2-lite", "rustfs", "gateway", "runtime", "harness", "studio"];
 export declare const stackUsage: string;
 export interface StackDeps {
@@ -20,7 +20,7 @@ export interface StackDeps {
     err(line: string): void;
     /** Ask a yes/no question on the terminal; undefined when not interactive. */
     confirm?(question: string): Promise<boolean>;
-    /** A developer is at a terminal: `start` may open a browser. */
+    /** A developer is at a terminal. */
     interactive?: boolean;
     /** Open `url` in a browser; false when no browser could be started. */
     openBrowser(url: string): Promise<boolean>;
@@ -52,10 +52,20 @@ export declare function parseStackFlags(args: readonly string[], allowed: {
     lists?: readonly string[];
     aliases?: Record<string, string>;
 }, usage: string): Flags;
-/** The Host's one Tenant as `/v1/admin/status` reports it (no envelope). */
-export type StackTenant = Pick<HostTenant, "id" | "name" | "state" | "cause">;
-/** Printed by `start` when it does not open Studio itself. */
+/** The Host's one Tenant as `nylorun-operate status --json` reports it. */
+export interface StackTenant {
+    /** Null until the Tenant row has been read. */
+    id: string | null;
+    name: string | null;
+    state: "open" | "unavailable";
+    /** Why it cannot open (`schema-too-new`, `database-layout-old`, …); `message` says more. */
+    cause?: string;
+    message?: string;
+}
+/** Printed by `start`, which prints Studio's URL and opens no browser. */
 export declare const STUDIO_SIGN_IN_HINT = "To sign a browser in to Studio, run \"npx nylorun studio\".";
+/** Printed last by `start`. */
+export declare const HELP_HINT = "Run \"npx nylorun --help\" to see what else nylorun can do.";
 export interface StackStatus {
     /** The Tenant's name. */
     name: string;
@@ -66,13 +76,13 @@ export interface StackStatus {
     state: "running" | "stopped" | "absent";
     runtime: {
         url?: string;
-        /** The Admin API (operator listener), when the Tenant publishes one. */
-        adminUrl?: string;
         healthy: boolean;
+        /** `/ready`: the Tenant is open and the Runtime's stores answer. */
+        ready: boolean;
         version?: string;
         hostId?: string;
     };
-    /** The Tenant as the Runtime reports it, while it answers. */
+    /** The Tenant as `nylorun-operate status` reports it, while the runtime container runs. */
     tenant?: StackTenant;
     studio: {
         /** `http://localhost:<port>`: also what an embedding app frames (same site as its own localhost). */
@@ -116,9 +126,8 @@ export interface StackEndpoints {
     home: string;
     /** `http://localhost:<port>` */
     runtimeUrl: string;
-    /** The operator listener (Admin API). */
-    adminUrl: string;
     hostId: string;
+    /** The admin key (host-credentials.json): it mints Studio logins. */
     adminKey: string;
     studioPort: number;
     /** `http://localhost:<studio port>` */
@@ -128,14 +137,32 @@ export interface StackEndpoints {
     /** This call started the Runtime (it was not running before). */
     started: boolean;
 }
-/** The running Tenant's API, reached as the Project's derived principal (`nylorun sandbox`). */
+/** The running Tenant's APIs and their keys (`nylorun sandbox`, `nylorun mcp`). */
 export interface TenantApi {
     /** The Tenant's name. */
     name: string;
     runtimeUrl: string;
-    /** The `project` derived principal's key, derived from the admin key; never stored. */
+    /**
+     * The linked project's keys (`.nylorun/credentials.json`) when both reach the Tenant, else
+     * the keys `cli` and `cli-management` the Host root keeps (`cli-credentials.json`).
+     */
     applicationKey: string;
+    managementKey: string;
 }
+/** The selected Tenant's `nylorun-operate` while it runs: `nylorun key` and `runningTenantApi`. */
+export interface RunningOperate extends OperateEndpoint {
+    /** The Tenant's name. */
+    name: string;
+    runtimeUrl: string;
+    paths: StackPaths;
+}
+/**
+ * The selected Tenant's `nylorun-operate` while it runs; exit 3 when it is not running, 7 when
+ * it is not open.
+ */
+export declare function runningOperate(deps: StackDeps, options?: {
+    name?: string;
+}): Promise<RunningOperate>;
 /**
  * The selected Tenant's API while it runs: commands that read or change the Tenant's data never
  * start it. Exit 3 when it is not running, 7 when it is not open.

package/dist/stack/commands.js

@@ -1,10 +1,9 @@
 import { existsSync } from "node:fs";
 import { mkdir, readFile, rm } from "node:fs/promises";
 import { basename, resolve } from "node:path";
-import { compareVersions, PROTOCOL_HEADER, PROTOCOL_VERSION, } from "@nylorun/core/compatibility";
+import { compareVersions } from "@nylorun/core/compatibility";
 import { CliError } from "../errors.js";
-import { deriveTenantKey, PROJECT_PRINCIPAL_ID } from "../project/derived-key.js";
-import { readProjectCredentials, readProjectLink, writeProjectCredentials, writeProjectLink, } from "../project/link.js";
+import { credentialsPath, readCredentialsFile, readProjectCredentials, readProjectLink, writeProjectCredentials, writeProjectLink, } from "../project/link.js";
 import { findProjectRoot } from "../project/root.js";
 import { seedTenant } from "../project/seed.js";
 import { readTelemetry, STUDIO_ANALYTICS_ID, TELEMETRY_NOTICE, telemetryDecision, writeTelemetry, } from "../telemetry.js";
@@ -15,6 +14,7 @@ import { stackPaths } from "./paths.js";
 import { prepareStack, readStackEnv } from "./prepare.js";
 import { assertTenantName, chooseTenantName, DEFAULT_TENANT, defaultNylorunRoot, listTenants, moveStackRoots, readTenantRecord, removeOldProxy, sanitizeTenantName, tenantRoot, tenantsDir, writeTenantRecord, } from "./stacks.js";
 import { mintStudioLogin, studioOrigin } from "./studio-login.js";
+import { CLI_KEY_ID, hostKey, keyAuthenticates, PROJECT_KEY_ID, } from "./operator-keys.js";
 export const STACK_SERVICES = [
     "postgres",
     "restate",
@@ -30,10 +30,10 @@ const CORE_SERVICES = ["postgres", "restate", "s2-lite", "rustfs", "gateway", "r
 function coreServices(harness) {
     return CORE_SERVICES.filter((service) => service !== "harness" || harness === "remote");
 }
-export const stackUsage = `  up|start [--tenant <name>] [--no-link] [--no-studio] [--no-open] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]
+export const stackUsage = `  up|start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]
                                       start the project's Tenant, creating it and the Project link (.nylorun/link.json,
-                                      credentials.json) on the first run; print the Runtime and Studio URLs and open Studio
-                                      signed in (in a terminal). --tenant attaches to (or creates) a named Tenant; --no-link
+                                      credentials.json) on the first run; print the Runtime and Studio URLs (it opens no
+                                      browser). --tenant attaches to (or creates) a named Tenant; --no-link
                                       starts the default Tenant (or --tenant's) without linking the current directory;
                                       --restate-ui (or NYLORUN_RESTATE_UI=1) publishes Restate's UI on loopback for debugging
   down|stop [--tenant <name> | --all] stop the Tenant's containers (--all: every Tenant's); keep volumes
@@ -147,6 +147,13 @@ function composeArgs(ctx, ...args) {
         ...args,
     ];
 }
+/** `nylorun-operate` in the Tenant's runtime container (`docker compose exec`), for its keys. */
+function operateEndpoint(ctx) {
+    return {
+        fetch: ctx.deps.fetch,
+        operate: (args) => ctx.deps.docker.run(composeArgs(ctx, "exec", "-T", "runtime", "nylorun-operate", ...args)),
+    };
+}
 function requireStackFiles(ctx) {
     if (!existsSync(ctx.paths.compose) || !existsSync(ctx.paths.env))
         throw new CliError(`No Tenant ${ctx.name} under ${ctx.paths.root}. Run "nylorun start" first.`, 3);
@@ -221,34 +228,21 @@ async function waitForHealth(ctx, runtimeUrl, hostId) {
         await sleep(ctx.deps.pollMs ?? 500);
     }
 }
-/** `/v1/admin/status` on the operator listener; undefined when it does not answer. */
-async function fetchAdminStatus(deps, adminUrl, adminKey) {
-    if (!adminKey)
-        return undefined;
+/** The Runtime's `/ready` (503 while not ready, same body); undefined when it does not answer. */
+async function fetchReady(deps, runtimeUrl) {
     try {
-        const response = await deps.fetch(`${adminUrl}/v1/admin/status`, {
-            headers: {
-                authorization: `Bearer ${adminKey}`,
-                [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
-                accept: "application/json",
-            },
+        const response = await deps.fetch(`${runtimeUrl}/ready`, {
+            headers: { accept: "application/json" },
             signal: AbortSignal.timeout(3000),
             redirect: "error",
         });
-        if (!response.ok)
-            return undefined;
         const body = (await response.json());
-        const tenant = body.tenant;
-        if (!tenant || (tenant.state !== "open" && tenant.state !== "unavailable"))
+        if (body.status !== "ready" && body.status !== "not_ready")
             return undefined;
-        const harness = body.aggregate?.harness;
+        const harness = body.harness;
         return {
-            tenant: {
-                id: typeof tenant.id === "string" ? tenant.id : null,
-                name: typeof tenant.name === "string" ? tenant.name : null,
-                state: tenant.state,
-                ...(tenant.cause ? { cause: tenant.cause } : {}),
-            },
+            ready: body.status === "ready",
+            tenant: body.checks?.tenant === true,
             ...((harness?.mode === "remote" || harness?.mode === "in-process") &&
                 typeof harness.connected === "number"
                 ? { harness: { mode: harness.mode, connected: harness.connected } }
@@ -259,32 +253,59 @@ async function fetchAdminStatus(deps, adminUrl, adminKey) {
         return undefined;
     }
 }
-/** `/v1/admin/status`'s Tenant on the operator listener; undefined when it does not answer. */
-async function fetchTenant(deps, adminUrl, adminKey) {
-    return (await fetchAdminStatus(deps, adminUrl, adminKey))?.tenant;
+/**
+ * `nylorun-operate status --json` in the runtime container (exit 0 open, 2 not open): the
+ * Tenant's id and name, and why it cannot open. Undefined when it does not answer.
+ */
+async function operateStatus(ctx) {
+    const result = await operateEndpoint(ctx).operate(["status", "--json"]);
+    if (result.code !== 0 && result.code !== 2)
+        return undefined;
+    let tenant;
+    try {
+        tenant = JSON.parse(result.stdout).tenant;
+    }
+    catch {
+        return undefined;
+    }
+    if (!tenant || (tenant.state !== "open" && tenant.state !== "unavailable"))
+        return undefined;
+    return {
+        id: typeof tenant.id === "string" ? tenant.id : null,
+        name: typeof tenant.name === "string" ? tenant.name : null,
+        state: tenant.state,
+        ...(typeof tenant.cause === "string" ? { cause: tenant.cause } : {}),
+        ...(typeof tenant.message === "string" ? { message: tenant.message } : {}),
+    };
 }
-/** Why the Tenant is unavailable, with the repair the Runtime names. */
+/** Why the Tenant is unavailable, as `nylorun-operate status` names it. */
 function tenantCauseMessage(ctx, tenant) {
-    const cause = tenant.cause;
-    const hint = cause.code === "schema-too-new"
+    const hint = tenant.cause === "schema-too-new"
         ? ` This nylorun pins Runtime ${ctx.deps.runtimeVersion}, older than the Tenant's database: update nylorun (npx nylorun@latest start).`
         : "";
-    return `Tenant ${ctx.name} is unavailable (${cause.code}): ${cause.message} ${cause.repair}${hint} See "nylorun logs runtime".`;
+    const message = tenant.message ? `: ${tenant.message.replace(/\.?$/, ".")}` : ".";
+    return `Tenant ${ctx.name} is unavailable (${tenant.cause})${message}${hint} See "nylorun logs runtime".`;
 }
 /**
- * Wait until the Tenant is open: the Runtime creates it on the first start and opens
- * it on later ones. A Tenant that could not be opened has a cause; report it.
+ * Wait until the Tenant is open (`/ready`'s `tenant` check): the Runtime creates it on the
+ * first start and opens it on later ones. Then `nylorun-operate status` gives its id. While it
+ * is not open, `nylorun-operate status` is asked now and then: it names a cause only when the
+ * Tenant cannot open (`schema-too-new`, `database-layout-old`), which ends the wait.
  */
-async function waitForTenant(ctx, adminUrl, adminKey) {
+async function waitForTenant(ctx, runtimeUrl) {
     const deadline = Date.now() + (ctx.deps.healthTimeoutMs ?? 60_000);
-    for (;;) {
-        const tenant = await fetchTenant(ctx.deps, adminUrl, adminKey);
-        if (tenant?.state === "open" && tenant.id)
-            return { ...tenant, id: tenant.id };
-        if (tenant?.cause)
-            throw new CliError(tenantCauseMessage(ctx, tenant), 7);
-        if (Date.now() > deadline)
-            throw new CliError(`Tenant ${ctx.name} did not open (${adminUrl}/v1/admin/status: ${tenant ? tenant.state : "no answer"}). See "nylorun status" and "nylorun logs runtime".`, 7);
+    for (let poll = 1;; poll += 1) {
+        const open = (await fetchReady(ctx.deps, runtimeUrl))?.tenant === true;
+        const late = Date.now() > deadline;
+        if (open || late || poll % 10 === 0) {
+            const tenant = await operateStatus(ctx);
+            if (tenant?.state === "open" && tenant.id)
+                return { ...tenant, id: tenant.id };
+            if (!open && tenant?.cause)
+                throw new CliError(tenantCauseMessage(ctx, tenant), 7);
+            if (late)
+                throw new CliError(`Tenant ${ctx.name} did not open (${runtimeUrl}/ready: ${open ? "open, but nylorun-operate status did not answer" : "not open"})${tenant?.message ? `: ${tenant.message.replace(/\.$/, "")}` : ""}. See "nylorun status" and "nylorun logs runtime".`, 7);
+        }
         await sleep(ctx.deps.pollMs ?? 500);
     }
 }
@@ -353,7 +374,6 @@ async function tenantPorts(base, except) {
         const persisted = await readStackEnv(paths);
         for (const port of [
             persisted?.runtimePort,
-            persisted?.adminPort,
             persisted?.studioPort,
             persisted?.restatePort,
         ])
@@ -392,9 +412,6 @@ async function bringUp(ctx, options) {
         runtimeVersion: overridden ? undefined : deps.runtimeVersion,
         ports: deps.ports,
         reserved: await reservedPorts(ctx),
-        ...(deps.env.NYLORUN_DERIVED_PRINCIPALS?.trim()
-            ? { derivedPrincipals: deps.env.NYLORUN_DERIVED_PRINCIPALS }
-            : {}),
         ...(options.studioEmbedOrigins ? { studioEmbedOrigins: options.studioEmbedOrigins } : {}),
         ...(analytics ? { studioAnalyticsId: STUDIO_ANALYTICS_ID } : {}),
         ...(options.sandboxes !== undefined ? { sandboxes: options.sandboxes } : {}),
@@ -411,14 +428,13 @@ async function bringUp(ctx, options) {
     if (prepared.firstRun)
         deps.err(`Created Tenant ${ctx.name} under ${ctx.paths.root} (Runtime port ${prepared.env.runtimePort}, Studio port ${prepared.env.studioPort}).`);
     const runtimeUrl = `http://${STACK_CLIENT_HOST}:${prepared.env.runtimePort}`;
-    const adminUrl = `http://${STACK_CLIENT_HOST}:${prepared.env.adminPort}`;
     const up = await deps.docker.stream(
     // --remove-orphans: a service this start's file no longer has (the harness after a rollback
     // to NYLORUN_HARNESS=in-process, sandboxes after disable) is removed, not left running.
     composeArgs(ctx, "up", "--detach", "--wait", "--wait-timeout", "300", "--remove-orphans", ...coreServices(prepared.env.harness)));
     if (up !== 0) {
-        // A Runtime whose Tenant cannot open fails readiness; its status names the cause.
-        const tenant = await fetchTenant(deps, adminUrl, prepared.adminKey);
+        // A Runtime whose Tenant cannot open fails readiness; nylorun-operate names the cause.
+        const tenant = await operateStatus(ctx);
         if (tenant?.cause)
             throw new CliError(tenantCauseMessage(ctx, tenant), 7);
         throw new CliError(`docker compose up failed (exit ${up}). See "nylorun logs runtime", "nylorun logs gateway", "nylorun logs harness" and "nylorun status".`, 7);
@@ -439,7 +455,6 @@ async function bringUp(ctx, options) {
     }
     return {
         runtimeUrl,
-        adminUrl,
         hostId: prepared.host.hostId,
         studioPort: prepared.env.studioPort,
         studioUrl: studioOrigin(prepared.env.studioPort),
@@ -471,12 +486,10 @@ async function tryStudioLogin(ctx, studioPort, adminKey) {
     deps.err(`Warning: Studio at ${origin} is not reachable for a login (${lastError}).`);
     return undefined;
 }
-/** Printed by `start` when it does not open Studio itself. */
+/** Printed by `start`, which prints Studio's URL and opens no browser. */
 export const STUDIO_SIGN_IN_HINT = 'To sign a browser in to Studio, run "npx nylorun studio".';
-/** `start` opens Studio only for a developer at a terminal, outside CI. */
-function opensBrowser(deps, flags) {
-    return Boolean(deps.interactive) && !deps.env.CI && !flags.booleans.has("--no-open");
-}
+/** Printed last by `start`. */
+export const HELP_HINT = 'Run "npx nylorun --help" to see what else nylorun can do.';
 /**
  * Open a Studio login in the browser, or print it when no browser starts.
  * The login URL carries a single-use token, so it is printed only as a fallback.
@@ -487,13 +500,18 @@ async function openLogin(ctx, login) {
 }
 /**
  * Link the project to the Tenant: `.nylorun/link.json` (format 3) and
- * `.nylorun/credentials.json` with the key of the derived principal `project`. The link is
- * rewritten only when it is older, or the Tenant's name, URL, Host or id changed; a new link
- * seeds the Tenant from the project's `.env`.
+ * `.nylorun/credentials.json`. The link is rewritten only when it is older, or the Tenant's
+ * name, URL, Host or id changed; a new link seeds the Tenant from the project's `.env`.
+ *
+ * The credentials file is kept while both its keys still reach the Tenant (one authenticated
+ * read each). Otherwise it gets the keys `project` (application) and `project-management`
+ * (management): the ones the Host root keeps for the projects linked to this Tenant
+ * (`project-credentials.json`), or new ones put through `nylorun-operate`. Every checkout linked
+ * to the Tenant shares them, so linking one never rotates another's keys. A file from before
+ * management keys keeps its application key and gains the management key.
  */
 async function linkProject(ctx, started, tenantId) {
     const { deps, projectDir, link } = ctx;
-    const applicationKey = deriveTenantKey(started.adminKey, tenantId, PROJECT_PRINCIPAL_ID);
     const fresh = link?.format !== 3 ||
         link.tenant !== ctx.name ||
         link.hostUrl !== started.runtimeUrl ||
@@ -506,14 +524,28 @@ async function linkProject(ctx, started, tenantId) {
             hostId: started.hostId,
             tenantId,
         });
-    const credentials = await readProjectCredentials(projectDir);
-    if (fresh ||
-        credentials?.applicationKey !== applicationKey ||
-        credentials.principalId !== PROJECT_PRINCIPAL_ID)
-        await writeProjectCredentials(projectDir, {
-            applicationKey,
-            principalId: PROJECT_PRINCIPAL_ID,
+    const reaches = (key) => keyAuthenticates(deps.fetch, started.runtimeUrl, key);
+    const existing = await readProjectCredentials(projectDir);
+    const kept = existing && (await reaches(existing.applicationKey)) ? existing : undefined;
+    let credentials = kept;
+    if (!kept?.management ||
+        // A project key from before operator keys becomes the one the Host root keeps.
+        (kept.principalId === PROJECT_KEY_ID &&
+            (await readCredentialsFile(ctx.paths.projectCredentials))?.applicationKey !== kept.applicationKey) ||
+        !(await reaches(kept.management.key))) {
+        const keys = await hostKey({
+            endpoint: operateEndpoint(ctx),
+            runtimeUrl: started.runtimeUrl,
+            id: PROJECT_KEY_ID,
+            file: ctx.paths.projectCredentials,
+            lock: ctx.paths.keysLock,
+            ...(kept?.principalId === PROJECT_KEY_ID ? { adopt: kept } : {}),
         });
+        credentials = kept ? { ...kept, management: keys.management } : keys;
+        await writeProjectCredentials(projectDir, credentials);
+        if (existing && !kept && !fresh)
+            deps.err(`Replaced the project's key, which no longer reaches Tenant ${ctx.name} (.nylorun/credentials.json).`);
+    }
     if (!fresh)
         return;
     deps.err(`Linked ${projectDir} to Tenant ${ctx.name} (.nylorun/link.json, .nylorun/credentials.json).`);
@@ -521,7 +553,7 @@ async function linkProject(ctx, started, tenantId) {
         const seeded = await seedTenant({
             fetch: deps.fetch,
             runtimeUrl: started.runtimeUrl,
-            applicationKey,
+            managementKey: credentials.management.key,
             projectRoot: projectDir,
         });
         const set = [...seeded.applied, ...(seeded.model ? [`model ${seeded.model}`] : [])];
@@ -532,11 +564,12 @@ async function linkProject(ctx, started, tenantId) {
         deps.err(`Warning: could not seed the Tenant from .env (${error instanceof Error ? error.message : String(error)}). Set the model in Studio or with "npx @nylorun/cli configure".`);
     }
 }
-const START_USAGE = "nylorun start [--tenant <name>] [--no-link] [--no-studio] [--no-open] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]";
+const START_USAGE = "nylorun start [--tenant <name>] [--no-link] [--no-studio] [--allow-downgrade] [--studio-embed-origin <origin>]... [--studio-embed-origin-reset] [--restate-ui]";
 async function start(deps, args) {
     const flags = parseStackFlags(args, {
         booleans: [
             "--no-studio",
+            // Accepted and ignored: start no longer opens a browser.
             "--no-open",
             "--no-link",
             "--allow-downgrade",
@@ -564,7 +597,7 @@ async function start(deps, args) {
             ? { studioEmbedOrigins: { add: embedOrigins, reset: resetEmbed } }
             : {}),
     });
-    const tenant = await waitForTenant(ctx, started.adminUrl, started.adminKey);
+    const tenant = await waitForTenant(ctx, started.runtimeUrl);
     if (ctx.projectDir)
         await linkProject({ ...ctx, projectDir: ctx.projectDir }, started, tenant.id);
     deps.out(`Tenant    ${ctx.name}  (${tenant.id})`);
@@ -573,15 +606,10 @@ async function start(deps, args) {
         deps.out(`Restate   ${started.restateUrl}  (UI and admin, unauthenticated; for debugging)`);
     if (started.studioStarted) {
         deps.out(`Studio    ${started.studioUrl}`);
-        if (opensBrowser(deps, flags)) {
-            const login = await tryStudioLogin(ctx, started.studioPort, started.adminKey);
-            if (login)
-                await openLogin(ctx, withNext(login, tenantStudioPath(tenant.id)));
-        }
-        else
-            deps.err(STUDIO_SIGN_IN_HINT);
+        deps.err(STUDIO_SIGN_IN_HINT);
     }
     await alsoRunning(ctx);
+    deps.err(HELP_HINT);
     return 0;
 }
 /** After `start`: the machine's other running Tenants and their memory, on stderr. */
@@ -649,7 +677,7 @@ async function stackStatus(ctx) {
         project: ctx.project,
         home: ctx.paths.root,
         state: "absent",
-        runtime: { healthy: false },
+        runtime: { healthy: false, ready: false },
         studio: { state: "absent" },
         restate: { published: false },
         gateway: { state: "absent", healthy: false },
@@ -667,14 +695,11 @@ async function stackStatus(ctx) {
     const health = runtimeUrl ? await fetchHealth(ctx.deps, runtimeUrl) : undefined;
     const host = await readHostConfig(ctx.paths);
     const healthy = health?.status === "ok" && (host === undefined || health.hostId === host.hostId);
-    // The Admin API answers on the operator port; an older Host root has only the Runtime port.
-    const adminUrl = persisted.adminPort
-        ? `http://${STACK_CLIENT_HOST}:${persisted.adminPort}`
-        : runtimeUrl;
-    const answered = healthy && adminUrl
-        ? await fetchAdminStatus(ctx.deps, adminUrl, await readAdminKey(ctx.paths))
+    const ready = healthy && runtimeUrl ? await fetchReady(ctx.deps, runtimeUrl) : undefined;
+    // nylorun-operate answers while the container runs, also when the Tenant cannot open.
+    const tenant = services.some((s) => s.service === "runtime" && s.state === "running")
+        ? await operateStatus(ctx)
         : undefined;
-    const tenant = answered?.tenant;
     const studio = services.find((s) => s.service === "studio");
     const gateway = services.find((s) => s.service === "gateway");
     const harness = services.find((s) => s.service === "harness");
@@ -684,8 +709,8 @@ async function stackStatus(ctx) {
         state: services.some((s) => s.state === "running") ? "running" : "stopped",
         runtime: {
             ...(runtimeUrl ? { url: runtimeUrl } : {}),
-            ...(persisted.adminPort && adminUrl ? { adminUrl } : {}),
             healthy,
+            ready: ready?.ready ?? false,
             ...(health?.version ? { version: health.version } : {}),
             ...(health?.hostId ? { hostId: health.hostId } : {}),
         },
@@ -705,10 +730,10 @@ async function stackStatus(ctx) {
             healthy: isUp(services, "gateway"),
         },
         harness: {
-            mode: answered?.harness?.mode ?? harnessMode,
+            mode: ready?.harness?.mode ?? harnessMode,
             state: harness ? [harness.state, harness.health].filter(Boolean).join(", ") : "absent",
             healthy: isUp(services, "harness"),
-            ...(answered?.harness ? { connected: answered.harness.connected } : {}),
+            ...(ready?.harness ? { connected: ready.harness.connected } : {}),
         },
         services,
     };
@@ -722,9 +747,8 @@ function describeTenant(tenant) {
     const who = `${tenant.id ?? "(no id yet)"}${tenant.name ? ` (${tenant.name})` : ""}`;
     if (tenant.state === "open")
         return `${who}  open`;
-    return tenant.cause
-        ? `${who}  unavailable: ${tenant.cause.code}: ${tenant.cause.message} ${tenant.cause.repair}`
-        : `${who}  unavailable (opening)`;
+    const why = [tenant.cause, tenant.message].filter(Boolean).join(": ");
+    return `${who}  unavailable${why ? `: ${why}` : " (opening)"}`;
 }
 async function status(deps, args) {
     const usage = "nylorun status [--tenant <name>] [--json]";
@@ -745,11 +769,9 @@ async function status(deps, args) {
         if (result.tenant)
             out(`Tenant id   ${describeTenant(result.tenant)}`);
         const runtimeDetail = result.runtime.healthy
-            ? `healthy, ${result.runtime.version ?? "?"}, ${result.runtime.hostId ?? "?"}`
+            ? `healthy, ${result.runtime.ready ? "ready" : "not ready"}, ${result.runtime.version ?? "?"}, ${result.runtime.hostId ?? "?"}`
             : "not answering";
         out(`Runtime     ${result.runtime.url ?? "?"}  ${runtimeDetail}`);
-        if (result.runtime.adminUrl)
-            out(`Admin API   ${result.runtime.adminUrl}  (operators only, never proxied)`);
         out(`Studio      ${result.studio.url ?? "?"}  ${result.studio.state} (log in with "nylorun studio")`);
         if (result.studio.embedOrigins?.length)
             out(`Embeds      ${result.studio.embedOrigins.join(" ")}  (may show Studio in a frame)`);
@@ -860,7 +882,6 @@ async function ls(deps, args) {
             ...(persisted.studioPort ? { studioUrl: studioOrigin(persisted.studioPort) } : {}),
             ports: {
                 ...(persisted.runtimePort ? { runtime: persisted.runtimePort } : {}),
-                ...(persisted.adminPort ? { admin: persisted.adminPort } : {}),
                 ...(persisted.studioPort ? { studio: persisted.studioPort } : {}),
                 ...(persisted.restatePort ? { restate: persisted.restatePort } : {}),
             },
@@ -940,9 +961,6 @@ async function runningStack(ctx, options) {
         name: ctx.name,
         home: ctx.paths.root,
         runtimeUrl,
-        adminUrl: persisted.adminPort
-            ? `http://${STACK_CLIENT_HOST}:${persisted.adminPort}`
-            : runtimeUrl,
         hostId: host.hostId,
         adminKey,
         studioPort: persisted.studioPort,
@@ -962,7 +980,6 @@ async function ensureSelected(ctx, options) {
         name: ctx.name,
         home: ctx.paths.root,
         runtimeUrl: started.runtimeUrl,
-        adminUrl: started.adminUrl,
         hostId: started.hostId,
         adminKey: started.adminKey,
         studioPort: started.studioPort,
@@ -971,25 +988,60 @@ async function ensureSelected(ctx, options) {
         started: !runtimeWasUp,
     };
 }
-/**
- * The selected Tenant's API while it runs: commands that read or change the Tenant's data never
- * start it. Exit 3 when it is not running, 7 when it is not open.
- */
-export async function runningTenantApi(deps, options = {}) {
+async function runningSelected(deps, options) {
     const ctx = await selectStack(deps, options);
     requireStackFiles(ctx);
     await dockerPreflight(deps.docker);
     const running = await runningStack(ctx, { studio: false });
     if (!running)
         throw new CliError(`Tenant ${ctx.name} is not running. Run "nylorun start" first.`, 3);
-    const tenant = await fetchTenant(deps, running.adminUrl, running.adminKey);
-    if (!tenant?.id || tenant.state !== "open")
+    if ((await fetchReady(deps, running.runtimeUrl))?.tenant !== true)
         throw new CliError(`Tenant ${ctx.name} is not open. See "nylorun status".`, 7);
     return {
+        ctx,
+        running: {
+            name: ctx.name,
+            runtimeUrl: running.runtimeUrl,
+            paths: ctx.paths,
+            ...operateEndpoint(ctx),
+        },
+    };
+}
+/**
+ * The selected Tenant's `nylorun-operate` while it runs; exit 3 when it is not running, 7 when
+ * it is not open.
+ */
+export async function runningOperate(deps, options = {}) {
+    return (await runningSelected(deps, options)).running;
+}
+/**
+ * The selected Tenant's API while it runs: commands that read or change the Tenant's data never
+ * start it. Exit 3 when it is not running, 7 when it is not open.
+ */
+export async function runningTenantApi(deps, options = {}) {
+    const { ctx, running } = await runningSelected(deps, options);
+    const api = (applicationKey, managementKey) => ({
         name: ctx.name,
         runtimeUrl: running.runtimeUrl,
-        applicationKey: deriveTenantKey(running.adminKey, tenant.id, PROJECT_PRINCIPAL_ID),
-    };
+        applicationKey,
+        managementKey,
+    });
+    const reaches = (key) => keyAuthenticates(deps.fetch, running.runtimeUrl, key);
+    if (ctx.projectDir && ctx.link?.format === 3 && ctx.link.tenant === ctx.name) {
+        const project = await readCredentialsFile(credentialsPath(ctx.projectDir));
+        if (project?.management &&
+            (await reaches(project.applicationKey)) &&
+            (await reaches(project.management.key)))
+            return api(project.applicationKey, project.management.key);
+    }
+    const keys = await hostKey({
+        endpoint: running,
+        runtimeUrl: running.runtimeUrl,
+        id: CLI_KEY_ID,
+        file: ctx.paths.cliCredentials,
+        lock: ctx.paths.keysLock,
+    });
+    return api(keys.applicationKey, keys.management.key);
 }
 /**
  * Start the selected Tenant unless it is already running (`nylorun studio`): the
@@ -1067,7 +1119,7 @@ async function studio(deps, args, options = {}) {
     // Studio serves the one Tenant; the link's Tenant id stands in while it is opening.
     let next = options.next;
     if (next === undefined) {
-        const tenant = await fetchTenant(deps, running.adminUrl, running.adminKey);
+        const tenant = await operateStatus(ctx);
         const linked = ctx.link?.tenant === ctx.name ? ctx.link.tenantId : undefined;
         const tenantId = tenant?.id ?? linked;
         if (tenantId)