withruntime 0.11.2 → 0.14.0

package/dist/network-cli.d.ts

@@ -8,8 +8,10 @@ type Args = {
     positional: string[];
     flags: Map<string, string[]>;
 };
-export declare const NETWORK_PRODUCTS: readonly ["domain", "port", "address", "tunnel", "network"];
+export declare const NETWORK_PRODUCTS: readonly ["domains", "ports", "ips", "wireguard", "networks"];
 export type NetworkProduct = (typeof NETWORK_PRODUCTS)[number];
+/** The command each is typed as: WireGuard is inside networks. */
+export declare const NETWORK_COMMAND: Record<NetworkProduct, string>;
 export declare const NETWORK_HELP: Record<NetworkProduct, string>;
 export declare function networkProductCommand(product: NetworkProduct, argv: string[], args: Args, out: Out, client: () => Promise<Runtime>): Promise<number>;
 export {};

package/dist/network-cli.js

@@ -14,9 +14,17 @@ function fundingState(value) {
         ? `Funded until ${value.fundedUntil}.`
         : "Funding active; no deadline reported.";
 }
-export const NETWORK_PRODUCTS = ["domain", "port", "address", "tunnel", "network"];
+export const NETWORK_PRODUCTS = ["domains", "ports", "ips", "wireguard", "networks"];
+/** The command each is typed as: WireGuard is inside networks. */
+export const NETWORK_COMMAND = {
+    domains: "domains",
+    ports: "ports",
+    ips: "ips",
+    wireguard: "networks wireguard",
+    networks: "networks",
+};
 export const NETWORK_HELP = {
-    domain: `runtime domain <command>
+    domains: `runtime domains <command>
 
   add <hostname> <sandbox> <port>        Serve a sandbox's port at your own hostname, with HTTPS
                                          Prints the DNS records to set: a TXT that proves the
@@ -27,7 +35,7 @@ export const NETWORK_HELP = {
   rm <hostname>                          Stop serving it
   Needs a kept top-up. The first visit gets the certificate, in a few seconds.
 `,
-    port: `runtime port <command>
+    ports: `runtime ports <command>
 
   open <sandbox> <port>                  A public TCP port to a port in the sandbox: Postgres,
                                          Redis, a game server, anything that is not HTTP
@@ -36,7 +44,7 @@ export const NETWORK_HELP = {
   close <portId>                         Close one, its open connections too
   Needs a kept top-up. TCP, carried as it is: use your service's own password and TLS.
 `,
-    address: `runtime address <command>
+    ips: `runtime ips <command>
 
   reserve [--ipv6]                       A dedicated outbound address: every sandbox of your
                                          account sends from it, for allow-lists
@@ -44,7 +52,7 @@ export const NETWORK_HELP = {
   release <addressId>                    Give it back; sandboxes use the shared addresses again
   Needs credit on the account.
 `,
-    tunnel: `runtime tunnel <command>
+    wireguard: `runtime networks wireguard <command>
 
   create [--subnet 10.250.0.0/16]        A WireGuard tunnel from your network into your sandboxes
   get                                    The tunnel, its peers, and each sandbox's address in it
@@ -58,7 +66,9 @@ export const NETWORK_HELP = {
   peer rm <peerId>                       Remove it; its tunnel ends within seconds
   --route: your own ranges behind the peer that sandboxes may reach. Needs a kept top-up.
 `,
-    network: `runtime network <command>
+    networks: `runtime networks <command>
+  wireguard <command>                    A WireGuard tunnel from your network into your
+                                         sandboxes: runtime networks wireguard help
 
   upstream-proxy set <http://host:port|https://host:port> [--secret NAME] [--host <host>]...
                                          Send your sandboxes' outbound connections through your
@@ -76,6 +86,12 @@ export const NETWORK_HELP = {
   private off                            They stop; open connections between them are cut
   private status                         On or off
   Only your own sandboxes answer. Needs a kept top-up; free.
+
+  signed-requests on                     Your sandboxes can get Runtime's Web Bot Auth signature
+                                         for outbound HTTP requests (https://withruntime.com/docs/egress)
+  signed-requests off                    New signatures stop at once; given ones expire within 5 minutes
+  signed-requests status                 On or off
+  Needs credit on the account; free.
 `,
 };
 function usage(product, message) {
@@ -83,7 +99,7 @@ function usage(product, message) {
         message,
         code: "usage",
         status: 0,
-        hint: `Run \`${named("runtime")} ${product} help\`.`,
+        hint: `Run \`${named("runtime")} ${NETWORK_COMMAND[product]} help\`.`,
     });
 }
 function table(rows) {
@@ -127,7 +143,7 @@ async function prepareOutput(path, privateKey) {
     try {
         const info = await lstat(path);
         if (!info.isFile() || info.isSymbolicLink())
-            throw usage("tunnel", "The output must be a regular file, not a directory or symbolic link.");
+            throw usage("wireguard", "The output must be a regular file, not a directory or symbolic link.");
     }
     catch (error) {
         if (error.code !== "ENOENT")
@@ -181,7 +197,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
         return 0;
     }
     const runtime = await client();
-    if (product === "domain") {
+    if (product === "domains") {
         const records = (domain) => table([
             ["TYPE", "NAME", "VALUE"],
             ...domain.records.map((record) => [record.type, record.name, record.value]),
@@ -214,7 +230,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                             String(d.port),
                         ]),
                     ])
-                    : named("No domains. Add one: runtime domain add app.example.com <sandbox> 3000"), all);
+                    : named("No domains. Add one: runtime domains add app.example.com <sandbox> 3000"), all);
                 return 0;
             }
             case "get": {
@@ -230,7 +246,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
             }
         }
     }
-    if (product === "port") {
+    if (product === "ports") {
         switch (verb) {
             case "open": {
                 const opened = await runtime.ports.open({
@@ -251,7 +267,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                         ["ID", "CONNECT", "SANDBOX", "PORT"],
                         ...all.map((p) => [p.id, p.connect, p.sandboxId, String(p.port)]),
                     ])
-                    : named("No open ports. Open one: runtime port open <sandbox> 5432"), all);
+                    : named("No open ports. Open one: runtime ports open <sandbox> 5432"), all);
                 return 0;
             }
             case "close":
@@ -262,10 +278,10 @@ export async function networkProductCommand(product, argv, args, out, client) {
             }
         }
     }
-    if (product === "address") {
+    if (product === "ips") {
         switch (verb) {
             case "reserve": {
-                const reserved = await runtime.addresses.reserve({ family: has("ipv6") ? 6 : 4 });
+                const reserved = await runtime.ips.reserve({ family: has("ipv6") ? 6 : 4 });
                 if (!out.json)
                     out.error(reserved.funded === true
                         ? `Every sandbox of this account sends from it. ${fundingState(reserved)}`
@@ -275,24 +291,24 @@ export async function networkProductCommand(product, argv, args, out, client) {
             }
             case "ls":
             case "list": {
-                const all = await runtime.addresses.list();
+                const all = await runtime.ips.list();
                 print(all.length
                     ? table([
                         ["ID", "ADDRESS", "FAMILY", "FUNDING"],
                         ...all.map((a) => [a.id, a.address, `IPv${a.family}`, fundingState(a)]),
                     ])
-                    : named("No dedicated address. Reserve one: runtime address reserve"), all);
+                    : named("No dedicated address. Reserve one: runtime ips reserve"), all);
                 return 0;
             }
             case "release":
             case "rm": {
-                const gone = await runtime.addresses.release(need(rest[0], "an address id"));
+                const gone = await runtime.ips.release(need(rest[0], "an address id"));
                 print(`Released ${gone.address}.`, gone);
                 return 0;
             }
         }
     }
-    if (product === "tunnel") {
+    if (product === "wireguard") {
         const view = (tunnel) => [
             fundingState(tunnel),
             `Endpoint ${tunnel.endpoint}, subnet ${tunnel.subnet}, gateway key ${tunnel.gatewayPublicKey ?? "(starting)"}`,
@@ -302,7 +318,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                     ["PEER", "NAME", "ADDRESS", "ROUTES"],
                     ...tunnel.peers.map((p) => [p.id, p.name, p.address, p.routes.join(",") || "-"]),
                 ])
-                : named("No peers. Add one: runtime tunnel peer add office --route 10.0.0.0/16"),
+                : named("No peers. Add one: runtime networks wireguard peer add office --route 10.0.0.0/16"),
             "",
             tunnel.sandboxes.length
                 ? table([
@@ -313,19 +329,19 @@ export async function networkProductCommand(product, argv, args, out, client) {
         ].join("\n");
         switch (verb) {
             case "create": {
-                const made = await runtime.tunnel.create(flag("subnet") ? { subnet: flag("subnet") } : {});
+                const made = await runtime.networks.wireguard.create(flag("subnet") ? { subnet: flag("subnet") } : {});
                 print(view(made), made);
                 return 0;
             }
             case "get":
             case "ls": {
-                const found = await runtime.tunnel.get();
+                const found = await runtime.networks.wireguard.get();
                 print(view(found), found);
                 return 0;
             }
             case "rm":
             case "delete": {
-                const gone = await runtime.tunnel.delete();
+                const gone = await runtime.networks.wireguard.delete();
                 print(`Deleted the tunnel ${gone.id}.`, gone);
                 return 0;
             }
@@ -343,14 +359,14 @@ export async function networkProductCommand(product, argv, args, out, client) {
                     const prepared = path ? await prepareOutput(path, pair?.privateKey) : undefined;
                     try {
                         const answer = action === "add"
-                            ? await runtime.tunnel.addPeer({
+                            ? await runtime.networks.wireguard.addPeer({
                                 name: argument,
                                 publicKey,
                                 routes: args.flags.get("route") ?? [],
                             })
-                            : await runtime.tunnel.rotatePeer(argument, { publicKey });
+                            : await runtime.networks.wireguard.rotatePeer(argument, { publicKey });
                         const configReady = answer.configReady ?? !!answer.config;
-                        const draftHint = "Keep this file: it preserves your private key. Read runtime tunnel get when the gateway is ready, replace PublicKey in [Peer] with gatewayPublicKey, then run wg-quick up.";
+                        const draftHint = "Keep this file: it preserves your private key. Read runtime networks wireguard get when the gateway is ready, replace PublicKey in [Peer] with gatewayPublicKey, then run wg-quick up.";
                         // Older servers returned no config while the gateway was starting.
                         // Preserve the locally generated key in a draft rather than discard it.
                         const supplied = answer.config ??
@@ -361,7 +377,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                                 `Address = ${answer.peer.address}/32`,
                                 "",
                                 "[Peer]",
-                                `PublicKey = ${answer.tunnel.gatewayPublicKey ?? "<gatewayPublicKey from runtime tunnel get>"}`,
+                                `PublicKey = ${answer.tunnel.gatewayPublicKey ?? "<gatewayPublicKey from runtime networks wireguard get>"}`,
                                 `Endpoint = ${answer.tunnel.endpoint}`,
                                 `AllowedIPs = ${answer.tunnel.subnet}`,
                                 "PersistentKeepalive = 25",
@@ -398,7 +414,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                     }
                 }
                 if (action === "rm" || action === "remove") {
-                    const after = await runtime.tunnel.removePeer(need(rest[1], "a peer id"));
+                    const after = await runtime.networks.wireguard.removePeer(need(rest[1], "a peer id"));
                     print(`Removed. ${after.peers.length} peer(s) left.`, after);
                     return 0;
                 }
@@ -406,32 +422,58 @@ export async function networkProductCommand(product, argv, args, out, client) {
             }
         }
     }
-    if (product === "network" && verb === "private") {
+    if (product === "networks" && verb === "private") {
         const describe = (state) => state.enabled
             ? "On: your sandboxes reach each other at <name>.sandbox.internal:<port> over TCP."
             : state.allowed
-                ? "Off. Turn it on: runtime network private on"
+                ? "Off. Turn it on: runtime networks private on"
                 : "Off. Reaching your sandboxes by name needs a kept top-up.";
         switch (rest[0]) {
             case "on":
             case "off": {
-                const state = await runtime.network.private.set({ enabled: rest[0] === "on" });
+                const state = await runtime.networks.private.set({ enabled: rest[0] === "on" });
                 print(state.enabled ? describe(state) : "Off. Open connections between your sandboxes are cut.", state);
                 return 0;
             }
             case "status":
             case undefined: {
-                const state = await runtime.network.private.get();
+                const state = await runtime.networks.private.get();
                 print(describe(state), state);
                 return 0;
             }
         }
         throw usage(product, "private takes on, off or status.");
     }
-    if (product === "network") {
+    if (product === "networks" && verb === "signed-requests") {
+        const describe = (state) => state.enabled
+            ? "On. Each site's headers: https://withruntime.com/docs/egress"
+            : state.allowed
+                ? "Off. Turn it on: runtime networks signed-requests on"
+                : state.why === "no_credit"
+                    ? "Needs credit on the account."
+                    : `Not available (${state.why ?? "unknown"}).`;
+        switch (rest[0]) {
+            case "on":
+            case "off": {
+                const state = await runtime.networks.signedRequests.set({ enabled: rest[0] === "on" });
+                print(state.enabled
+                    ? describe(state)
+                    : "Off. New signatures stop at once; ones already given expire within 5 minutes.", state);
+                return 0;
+            }
+            case "status":
+            case undefined: {
+                const state = await runtime.networks.signedRequests.get();
+                print(describe(state), state);
+                return 0;
+            }
+        }
+        throw usage(product, "signed-requests takes on, off or status.");
+    }
+    if (product === "networks") {
         if (verb !== "upstream-proxy")
-            throw usage(product, `Unknown network command ${verb}.`);
-        const upstream = runtime.network.upstreamProxy;
+            throw usage(product, `Unknown networks command ${verb}.`);
+        const upstream = runtime.networks.upstreamProxy;
         const describe = (proxy) => [
             `Outbound connections${proxy.hosts?.length ? ` to ${proxy.hosts.join(", ")}` : ""} go through ${proxy.url}.`,
             ...(proxy.secret ? [`${proxy.secret} is sent as Proxy-Authorization.`] : []),
@@ -462,7 +504,7 @@ export async function networkProductCommand(product, argv, args, out, client) {
                 catch (error) {
                     if (!(error instanceof RuntimeError) || error.code !== "not_found")
                         throw error;
-                    print(named("No upstream proxy. Set one: runtime network upstream-proxy set http://proxy.example.com:3128"), null);
+                    print(named("No upstream proxy. Set one: runtime networks upstream-proxy set http://proxy.example.com:3128"), null);
                     return 0;
                 }
                 print(describe(found), found);
@@ -477,5 +519,5 @@ export async function networkProductCommand(product, argv, args, out, client) {
         }
         throw usage(product, "upstream-proxy takes set, get or remove.");
     }
-    throw usage(product, `Unknown ${product} command ${verb}.`);
+    throw usage(product, `Unknown ${NETWORK_COMMAND[product]} command ${verb}.`);
 }

package/dist/networks/index.d.ts

@@ -0,0 +1,11 @@
+/** `withruntime/networks`: Networks alone. The account's networks: WireGuard in, sandboxes by name, your proxy out.
+ *
+ *   import { networks } from "withruntime/networks";
+ *   const client = networks(); // RUNTIME_API_KEY, or this machine's saved connection
+ */
+import { Runtime, type RuntimeOptions } from "../client.js";
+export type { Tunnel, TunnelPeer, TunnelPeerCreated, UpstreamProxy, SetUpstreamProxy, } from "../products/network-products.js";
+export type { PrivateNetwork } from "../products/private-network.js";
+export type { SignedRequests } from "../products/signed-requests.js";
+/** `runtime.networks` of a client made with `options`. */
+export declare function networks(options?: RuntimeOptions): Runtime["networks"];

package/dist/networks/index.js

@@ -0,0 +1,10 @@
+/** `withruntime/networks`: Networks alone. The account's networks: WireGuard in, sandboxes by name, your proxy out.
+ *
+ *   import { networks } from "withruntime/networks";
+ *   const client = networks(); // RUNTIME_API_KEY, or this machine's saved connection
+ */
+import { Runtime } from "../client.js";
+/** `runtime.networks` of a client made with `options`. */
+export function networks(options) {
+    return new Runtime(options).networks;
+}

package/dist/ports/index.d.ts

@@ -0,0 +1,9 @@
+/** `withruntime/ports`: Ports alone. A public TCP port to a sandbox's port.
+ *
+ *   import { ports } from "withruntime/ports";
+ *   const client = ports(); // RUNTIME_API_KEY, or this machine's saved connection
+ */
+import { Runtime, type RuntimeOptions } from "../client.js";
+export type { TcpPort } from "../products/network-products.js";
+/** `runtime.ports` of a client made with `options`. */
+export declare function ports(options?: RuntimeOptions): Runtime["ports"];

package/dist/ports/index.js

@@ -0,0 +1,10 @@
+/** `withruntime/ports`: Ports alone. A public TCP port to a sandbox's port.
+ *
+ *   import { ports } from "withruntime/ports";
+ *   const client = ports(); // RUNTIME_API_KEY, or this machine's saved connection
+ */
+import { Runtime } from "../client.js";
+/** `runtime.ports` of a client made with `options`. */
+export function ports(options) {
+    return new Runtime(options).ports;
+}

package/dist/product-names.d.ts

@@ -0,0 +1,52 @@
+/** CLOUD.md section 4: one plural word per product on every interface (Marc,
+ * 6 October 2026). The API path `/v1/<name>`, the SDK's `runtime.<name>`, the
+ * CLI's `runtime <name>` and the MCP's `runtime_<name>` all use `name` below;
+ * the CLI also takes `singular` as a typing shortcut, and nothing else does.
+ *
+ * An old name keeps working for ALIAS_DAYS after the rename ships, with a
+ * warning naming the new one, then fails with `name_retired` and a hint. Its
+ * `retires` is null until the deploy that ships the rename sets it: the date
+ * is the deploy's, never a guess made before it.
+ *
+ * This is the one table of product names. PRODUCT_LAUNCHES in mcp-groups.ts
+ * says whether a product is open; this says what it is called. */
+export declare const ALIAS_DAYS = 30;
+/** CLOUD.md section 2's seven engines. */
+export type Engine = "machine" | "disk" | "record" | "address" | "identity" | "meter" | "database";
+export type OldName = {
+    /** The old word, as it appeared on any interface: `sandbox` stands for
+     * `/v1/sandbox`, `runtime.sandbox`, `runtime sandbox` and
+     * `runtime_sandbox_*`. Separators are compared as one (`-` and `_`). */
+    readonly name: string;
+    /** ISO date (UTC midnight) on which the old name stops working; null until
+     * the rename's deploy sets it to that day plus ALIAS_DAYS. */
+    readonly retires: string | null;
+    /** Where the old word's things now live inside the product, when not at
+     * its root: the WireGuard tunnel was `tunnel` and is `networks/wireguard`,
+     * leaving `/v1/networks` free to list private networks. */
+    readonly under?: string;
+};
+export type ProductName = {
+    /** The plural word on every interface. */
+    readonly name: string;
+    /** What a customer reads in a title. */
+    readonly title: string;
+    readonly engine: Engine;
+    /** The CLI-only shortcut; absent when the name has no singular. */
+    readonly singular?: string;
+    readonly old: readonly OldName[];
+};
+/** Every product, in CLOUD.md section 2's order. Old names are only the ones a
+ * customer could have called: a planned name that never shipped has none. */
+export declare const PRODUCT_NAMES: readonly ProductName[];
+/** CLOUD.md section 4: what spans products, at the top level, as it is. */
+export declare const TOP_LEVEL: readonly string[];
+/** `-` and `_` are one separator: the API path says `web-analytics`, the MCP
+ * tool `runtime_web_analytics`. */
+export declare function wordOf(name: string): string;
+/** The table's own rules: each word means one thing. No shortcut or old name
+ * is a product's name. An old name may equal a shortcut: its own product's
+ * (`sandbox`, silent in the CLI, a warning elsewhere) or another's (`tunnel`,
+ * whose old name wins until it retires, and then the shortcut takes over).
+ * Returns the problems found. */
+export declare function validateProductNames(table?: readonly ProductName[]): string[];

package/dist/product-names.js

@@ -0,0 +1,164 @@
+/** CLOUD.md section 4: one plural word per product on every interface (Marc,
+ * 6 October 2026). The API path `/v1/<name>`, the SDK's `runtime.<name>`, the
+ * CLI's `runtime <name>` and the MCP's `runtime_<name>` all use `name` below;
+ * the CLI also takes `singular` as a typing shortcut, and nothing else does.
+ *
+ * An old name keeps working for ALIAS_DAYS after the rename ships, with a
+ * warning naming the new one, then fails with `name_retired` and a hint. Its
+ * `retires` is null until the deploy that ships the rename sets it: the date
+ * is the deploy's, never a guess made before it.
+ *
+ * This is the one table of product names. PRODUCT_LAUNCHES in mcp-groups.ts
+ * says whether a product is open; this says what it is called. */
+export const ALIAS_DAYS = 30;
+/** The batch of 6 October 2026: shared by every old name it retired. Set at
+ * its deploy to that day plus ALIAS_DAYS. */
+const RENAME_OF_6_OCTOBER = null;
+const was = (...names) => names.map((name) => ({ name, retires: RENAME_OF_6_OCTOBER }));
+/** Every product, in CLOUD.md section 2's order. Old names are only the ones a
+ * customer could have called: a planned name that never shipped has none. */
+export const PRODUCT_NAMES = [
+    // Machine
+    {
+        name: "sandboxes",
+        title: "Sandboxes",
+        engine: "machine",
+        singular: "sandbox",
+        old: was("sandbox"),
+    },
+    { name: "browsers", title: "Browsers", engine: "machine", singular: "browser", old: [] },
+    { name: "desktops", title: "Desktops", engine: "machine", singular: "desktop", old: [] },
+    { name: "apps", title: "Apps", engine: "machine", singular: "app", old: [] },
+    { name: "functions", title: "Functions", engine: "machine", singular: "function", old: [] },
+    { name: "containers", title: "Containers", engine: "machine", singular: "container", old: [] },
+    { name: "jobs", title: "Jobs", engine: "machine", singular: "job", old: was("job") },
+    { name: "workflows", title: "Workflows", engine: "machine", singular: "workflow", old: [] },
+    { name: "builds", title: "Builds", engine: "machine", singular: "build", old: [] },
+    // Disk
+    { name: "volumes", title: "Volumes", engine: "disk", singular: "volume", old: was("volume") },
+    {
+        name: "snapshots",
+        title: "Snapshots",
+        engine: "disk",
+        singular: "snapshot",
+        old: was("snapshot"),
+    },
+    { name: "images", title: "Images", engine: "disk", singular: "image", old: was("image") },
+    { name: "buckets", title: "Buckets", engine: "disk", singular: "bucket", old: [] },
+    { name: "backups", title: "Backups", engine: "disk", singular: "backup", old: [] },
+    // Record
+    { name: "queues", title: "Queues", engine: "record", singular: "queue", old: [] },
+    { name: "streams", title: "Streams", engine: "record", singular: "stream", old: [] },
+    { name: "realtime", title: "Realtime", engine: "record", old: [] },
+    { name: "events", title: "Events", engine: "record", old: [] },
+    { name: "webhooks", title: "Webhooks", engine: "record", singular: "webhook", old: [] },
+    { name: "logs", title: "Logs", engine: "record", singular: "log", old: [] },
+    { name: "traces", title: "Traces", engine: "record", singular: "trace", old: [] },
+    { name: "alerts", title: "Alerts", engine: "record", singular: "alert", old: [] },
+    // Address. `networks` is the private network, which the guides called
+    // `runtime tunnel` (WireGuard) and `runtime network`; `tunnels` is incoming
+    // tunnels, ngrok's kind. Static IPs were `runtime address`.
+    { name: "domains", title: "Domains", engine: "address", singular: "domain", old: was("domain") },
+    { name: "dns", title: "DNS", engine: "address", old: [] },
+    { name: "balancers", title: "Load balancers", engine: "address", singular: "balancer", old: [] },
+    { name: "cdn", title: "CDN", engine: "address", old: [] },
+    {
+        name: "networks",
+        title: "Private networks",
+        engine: "address",
+        singular: "network",
+        old: [...was("network"), { name: "tunnel", retires: RENAME_OF_6_OCTOBER, under: "wireguard" }],
+    },
+    { name: "tunnels", title: "Tunnels", engine: "address", singular: "tunnel", old: [] },
+    {
+        name: "ips",
+        title: "Static IPs",
+        engine: "address",
+        singular: "ip",
+        old: was("address", "addresses"),
+    },
+    { name: "ports", title: "Public ports", engine: "address", singular: "port", old: was("port") },
+    { name: "firewall", title: "Firewall", engine: "address", old: [] },
+    { name: "uptime", title: "Uptime checks", engine: "address", old: [] },
+    // Identity
+    { name: "teams", title: "Teams", engine: "identity", singular: "team", old: [] },
+    { name: "keys", title: "API keys", engine: "identity", singular: "key", old: [] },
+    { name: "sso", title: "Single sign-on", engine: "identity", old: [] },
+    { name: "secrets", title: "Secrets", engine: "identity", singular: "secret", old: [] },
+    { name: "audit", title: "Audit log", engine: "identity", old: [] },
+    { name: "tokens", title: "Identity tokens", engine: "identity", singular: "token", old: [] },
+    // Meter
+    { name: "usage", title: "Usage", engine: "meter", old: [] },
+    { name: "billing", title: "Billing", engine: "meter", old: [] },
+    { name: "metrics", title: "Metrics", engine: "meter", old: [] },
+    // Database (not now: CLOUD.md section 2)
+    { name: "postgres", title: "Postgres", engine: "database", old: [] },
+    { name: "mysql", title: "MySQL", engine: "database", old: [] },
+    { name: "redis", title: "Redis", engine: "database", old: [] },
+    { name: "vector", title: "Vector", engine: "database", old: [] },
+    { name: "search", title: "Search", engine: "database", old: [] },
+    { name: "analytics", title: "Analytics", engine: "database", old: [] },
+    { name: "web-analytics", title: "Web analytics", engine: "database", old: [] },
+];
+/** CLOUD.md section 4: what spans products, at the top level, as it is. */
+export const TOP_LEVEL = [
+    "account",
+    "billing",
+    "usage",
+    "compare",
+    "keys",
+    "secrets",
+    "events",
+    "webhooks",
+    "ls",
+    "feedback",
+    "support",
+];
+/** `-` and `_` are one separator: the API path says `web-analytics`, the MCP
+ * tool `runtime_web_analytics`. */
+export function wordOf(name) {
+    return name.toLowerCase().replaceAll("_", "-");
+}
+/** The table's own rules: each word means one thing. No shortcut or old name
+ * is a product's name. An old name may equal a shortcut: its own product's
+ * (`sandbox`, silent in the CLI, a warning elsewhere) or another's (`tunnel`,
+ * whose old name wins until it retires, and then the shortcut takes over).
+ * Returns the problems found. */
+export function validateProductNames(table = PRODUCT_NAMES) {
+    const problems = [];
+    const current = new Map();
+    for (const product of table) {
+        const word = wordOf(product.name);
+        if (word !== product.name)
+            problems.push(`${product.name}: write the name in its API form`);
+        if (current.has(word))
+            problems.push(`${word}: named twice`);
+        current.set(word, product.name);
+    }
+    const shortcuts = new Map();
+    for (const product of table) {
+        if (!product.singular)
+            continue;
+        const word = wordOf(product.singular);
+        if (current.has(word))
+            problems.push(`${product.name}: shortcut ${word} is a product's name`);
+        if (shortcuts.has(word))
+            problems.push(`${word}: shortcut of two products`);
+        shortcuts.set(word, product.name);
+    }
+    const olds = new Set();
+    for (const product of table) {
+        for (const old of product.old) {
+            const word = wordOf(old.name);
+            if (current.has(word))
+                problems.push(`${product.name}: old name ${word} is a product's name`);
+            if (olds.has(word))
+                problems.push(`${word}: old name of two products`);
+            if (old.retires !== null && !/^\d{4}-\d{2}-\d{2}$/.test(old.retires)) {
+                problems.push(`${word}: retires must be a date, YYYY-MM-DD`);
+            }
+            olds.add(word);
+        }
+    }
+    return problems;
+}