verulla-cli 0.0.2__tar.gz → 0.0.3__tar.gz

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: verulla-cli
-Version: 0.0.2
+Version: 0.0.3
 Requires-Python: >=3.12
 Requires-Dist: docker>=7
 Requires-Dist: httpx>=0.27

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "verulla-cli"
-version = "0.0.2"
+version = "0.0.3"
 requires-python = ">=3.12"
 dependencies = [
   "verulla-manifest==0.0.2",

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/tests/test_apps_client.py

@@ -1,10 +1,11 @@
 from __future__ import annotations
 
+import hashlib
 import httpx
 import pytest
 
 from verulla_cli.apps_client import (
-    AppsError, activate_app, delete_app, delete_customer, export_customers, get_app_logs, get_auth_policy,
+    AppsError, activate_app, create_signup, delete_app, delete_customer, export_customers, get_app_logs, get_auth_policy,
     get_spend_summary, invite_customer, list_apps, list_customers, lock_customer,
     get_sketch_events, rollback_app, set_auth_policy, unlock_customer,
 )
@@ -25,6 +26,30 @@ def response(status, body):
     return httpx.Response(status, json=body, request=req)
 
 
+def test_create_signup_solves_pow_and_sends_idempotency_header():
+    class Client:
+        calls = []
+
+        def get(self, url):
+            self.calls.append(("GET", url, None, None))
+            return response(200, {"prefix": "challenge-prefix", "difficulty": 2, "challenge_id": "c-1"})
+
+        def post(self, url, *, headers, json):
+            self.calls.append(("POST", url, headers, json))
+            return response(201, {"tenant": {"slug": "demo"}})
+
+    client = Client()
+    result = create_signup("http://api.test", "demo", "Demo", "owner@example.test", "idempotency-key-123456", client)
+    assert result == {"tenant": {"slug": "demo"}}
+    assert client.calls[0][:2] == ("GET", "http://api.test/v1/signup/challenge")
+    method, url, headers, body = client.calls[1]
+    assert (method, url) == ("POST", "http://api.test/v1/signup")
+    assert headers == {"Idempotency-Key": "idempotency-key-123456"}
+    assert hashlib.sha256(f"challenge-prefix{body['nonce']}".encode()).hexdigest().startswith("00")
+    assert body == {"slug": "demo", "display_name": "Demo", "owner_email": "owner@example.test",
+                    "challenge_id": "c-1", "nonce": body["nonce"]}
+
+
 def test_list_apps_uses_authenticated_apps_endpoint():
     client = FakeClient(response(200, {"apps": [{"app": "demo"}]}))
     assert list_apps("http://api.test", "token", client) == [{"app": "demo"}]
@@ -32,6 +57,16 @@ def test_list_apps_uses_authenticated_apps_endpoint():
 
 
 
+def test_get_deployment_uses_id_scoped_endpoint():
+    from verulla_cli.apps_client import get_deployment
+
+    client = FakeClient(response(200, {"id": "dep-1", "status": "building"}))
+    assert get_deployment("http://api.test", "token", "dep-1", client)["status"] == "building"
+    assert client.calls[0][:3] == (
+        "GET", "http://api.test/v1/deployments/dep-1", {"Authorization": "Bearer token"}
+    )
+
+
 def test_sketch_events_passes_cursor_and_limit_without_changing_contract():
     body = {
         "events": [{

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/tests/test_main.py

@@ -14,6 +14,7 @@ def test_auth_and_customer_commands_are_registered() -> None:
     result = runner.invoke(app, ["--help"])
     assert result.exit_code == 0
     assert "auth" in result.output and "customers" in result.output
+    assert "signup" in result.output
     for command in ("wallet", "spend", "usage", "pricing", "topup"):
         assert command in result.output
     for command in ("show", "set"):
@@ -22,6 +23,81 @@ def test_auth_and_customer_commands_are_registered() -> None:
         assert command in runner.invoke(app, ["customers", "--help"]).output
 
 
+def test_signup_stores_key_privately_and_redacts_output(tmp_path, monkeypatch) -> None:
+    import stat
+
+    path = tmp_path / ".verulla" / "credentials.json"
+    monkeypatch.setattr("verulla_cli.main.CREDENTIALS_PATH", path)
+    pending = tmp_path / ".verulla" / "signup-pending.json"
+    monkeypatch.setattr("verulla_cli.main._SIGNUP_PENDING_PATH", pending)
+    monkeypatch.setattr("verulla_cli.main.create_signup", lambda *args: {
+        "tenant": {"slug": "safe-demo", "display_name": "Demo", "schema_name": "tenant_safe_demo"},
+        "api_key": {"token": "vrl_secret-key", "scopes": ["tenant:read"]},
+        "owner_claim": {"claim_url": "https://account.verulla.com/claim#claim-secret", "expires_at": "expires"},
+    })
+    result = runner.invoke(app, ["signup", "--api-url", "https://api.example", "--owner-email", "owner@example.test",
+                                 "--display-name", "Demo", "--slug", "safe-demo"])
+    assert result.exit_code == 0, result.output
+    assert path.exists() and stat.S_IMODE(path.stat().st_mode) == 0o600
+    assert "vrl_secret-key" not in result.output
+    assert "owner@example.test" not in result.output
+    assert "0123456789abcdef" * 4 not in result.output
+    assert "claim-secret" in result.output
+    assert not pending.exists()
+
+
+def test_signup_recovers_interrupted_request_with_same_idempotency_key(tmp_path, monkeypatch) -> None:
+    import stat
+    from verulla_cli.apps_client import AppsError
+
+    credentials = tmp_path / ".verulla" / "credentials.json"
+    pending = tmp_path / ".verulla" / "signup-pending.json"
+    monkeypatch.setattr("verulla_cli.main.CREDENTIALS_PATH", credentials)
+    monkeypatch.setattr("verulla_cli.main._SIGNUP_PENDING_PATH", pending)
+    attempts = []
+
+    def fake_signup(*args):
+        attempts.append(args)
+        if len(attempts) == 1:
+            raise AppsError("network interruption")
+        return {
+            "tenant": {"slug": "safe-demo", "display_name": "Demo"},
+            "api_key": {"token": "vrl_secret-key"},
+            "owner_claim": {"claim_url": "https://account.verulla.com/claim#claim-secret", "expires_at": "expires"},
+        }
+
+    monkeypatch.setattr("verulla_cli.main.create_signup", fake_signup)
+    initial = runner.invoke(app, ["signup", "--api-url", "https://api.example", "--owner-email", "owner@example.test",
+                                  "--display-name", "Demo", "--slug", "safe-demo"])
+    assert initial.exit_code == 1
+    assert pending.exists() and stat.S_IMODE(pending.stat().st_mode) == 0o600
+    saved_pending = json.loads(pending.read_text())
+    generated_key = attempts[0][-1]
+    assert saved_pending["idempotency_key"] == generated_key
+    assert len(bytes.fromhex(generated_key)) == 32
+    assert len(set(bytes.fromhex(generated_key))) > 16
+    wrong_server = runner.invoke(app, ["signup", "--recover", "--api-url", "https://other.example"])
+    assert wrong_server.exit_code == 1 and len(attempts) == 1 and pending.exists()
+    recovered = runner.invoke(app, ["signup", "--recover", "--api-url", "https://api.example", "--json"])
+    assert recovered.exit_code == 0, recovered.output
+    assert attempts[0] == attempts[1]
+    assert not pending.exists()
+    assert "vrl_secret-key" not in recovered.output
+    assert "owner@example.test" not in recovered.output
+    assert "123456789abcdef0" * 4 not in recovered.output
+    assert json.loads(recovered.output)["tenant"]["slug"] == "safe-demo"
+
+
+def test_signup_rejects_user_supplied_repeating_recovery_key() -> None:
+    repeated_key = "0001020304050607" * 4
+    result = runner.invoke(app, [
+        "signup", "--api-url", "https://api.example", "--owner-email", "owner@example.test",
+        "--display-name", "Demo", "--idempotency-key", repeated_key,
+    ])
+    assert result.exit_code == 2
+    assert repeated_key not in result.output
+
+
 def test_usage_accepts_optional_app_and_prints_term_contract(monkeypatch) -> None:
     monkeypatch.setattr("verulla_cli.main.get_token", lambda: "api-token")
     monkeypatch.setattr("verulla_cli.auth.load_credentials", lambda: None)
@@ -240,6 +316,64 @@ def test_deploy_success_prints_deployment(tmp_path, monkeypatch) -> None:
     assert recorded["tarball"].startswith(b"\x1f\x8b")
 
 
+def test_deploy_wait_success_prints_sketch_handoff(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("verulla_cli.main.get_token", lambda: "tok")
+    monkeypatch.setattr("verulla_cli.main.create_deployment", lambda *args: {
+        "id": "d-wait", "app": "demo-app", "url": "https://demo.verulla.app", "status": "queued",
+    })
+    states = iter([
+        {"status": "building", "build_log_tail": ""},
+        {"status": "deployed", "build_log_tail": ""},
+    ])
+    monkeypatch.setattr("verulla_cli.main.get_deployment", lambda *args: next(states))
+    monkeypatch.setattr("verulla_cli.main.get_sketch_status", lambda *args: {
+        "app": "demo-app", "status": "deployed", "url": "https://demo.verulla.app",
+        "expires_at": "2026-11-06T12:00:00Z", "claim_status": "pending",
+        "limits_url": "https://verulla.com/#pricing", "console_url": "https://account.verulla.com/",
+    })
+    monkeypatch.setattr("verulla_cli.main.time.sleep", lambda _: None)
+    result = runner.invoke(app, ["deploy", str(_valid_project(tmp_path)), "--api-url", "http://api.test", "--wait"])
+    assert result.exit_code == 0, result.output
+    assert "https://demo.verulla.app" in result.output
+    assert "2026-11-06T12:00:00Z" in result.output
+    assert "72 hours" in result.output
+    assert "custom domain" in result.output.lower()
+    assert "verulla sketch status demo-app" in result.output
+    assert "owner claim status: pending" in result.output.lower()
+
+
+def test_deploy_wait_failure_exits_nonzero_and_shows_build_log_tail(tmp_path, monkeypatch) -> None:
+    monkeypatch.setattr("verulla_cli.main.get_token", lambda: "tok")
+    monkeypatch.setattr("verulla_cli.main.create_deployment", lambda *args: {
+        "id": "d-fail", "app": "demo-app", "status": "queued",
+    })
+    monkeypatch.setattr("verulla_cli.main.get_deployment", lambda *args: {
+        "id": "d-fail", "status": "apply_failed", "error": "apply failed",
+    })
+    monkeypatch.setattr("verulla_cli.main.get_app_logs", lambda *args: {
+        "deployment_id": "d-fail", "build_log_tail": "build output tail",
+    })
+    result = runner.invoke(app, ["deploy", str(_valid_project(tmp_path)), "--api-url", "http://api.test", "--wait"])
+    assert result.exit_code == 1
+    assert "verulla logs demo-app" in result.output
+    assert "build output tail" in result.output
+    assert "Runtime/pod logs are not available yet" in result.output
+
+
+def test_deploy_wait_timeout_exits_nonzero_with_inspection_action(tmp_path, monkeypatch) -> None:
+    import verulla_cli.main as cli_main
+
+    monkeypatch.setattr(cli_main, "get_token", lambda: "tok")
+    monkeypatch.setattr(cli_main, "create_deployment", lambda *args: {"id": "d-slow", "app": "demo-app", "status": "queued"})
+    monkeypatch.setattr(cli_main, "get_deployment", lambda *args: {"status": "building"})
+    monkeypatch.setattr(cli_main.time, "monotonic", iter([0.0, 0.0, 2.0]).__next__)
+    monkeypatch.setattr(cli_main.time, "sleep", lambda _: None)
+    result = runner.invoke(app, ["deploy", str(_valid_project(tmp_path)), "--api-url", "http://api.test", "--wait", "--wait-timeout", "1"])
+    assert result.exit_code == 1
+    assert "Timed out after 1s" in result.output
+    assert "verulla logs demo-app" in result.output
+
+
 def test_deploy_logged_in_unreachable_api_fails_cleanly(tmp_path, monkeypatch) -> None:
     monkeypatch.setattr(
         "verulla_cli.main.get_token", lambda: "tok"

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/verulla_cli/__init__.py

@@ -4,4 +4,4 @@ Human + agent entry point: login (OIDC device flow), dev (local Docker
 emulation via verulla_manifest), deploy, secrets, logs.
 """
 
-__version__ = "0.0.2"
+__version__ = "0.0.3"

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/verulla_cli/apps_client.py

@@ -53,10 +53,51 @@ def _request(api_url: str, token: str, method: str, path: str, client=None, *, e
             http.close()
 
 
+def create_signup(api_url: str, slug: str, display_name: str, owner_email: str,
+                  idempotency_key: str, client=None) -> dict:
+    """Submit signup with a recovery key from 32 CSPRNG-generated bytes.
+
+    Encode the key as 64 lowercase hex characters. It authorizes recovery of
+    the bootstrap response and must never be derived from user input.
+    """
+    import hashlib
+
+    owns = client is None
+    http = client or httpx.Client(timeout=20)
+    try:
+        challenge_response = http.get(f"{api_url}/v1/signup/challenge")
+        challenge_response.raise_for_status()
+        challenge = challenge_response.json()
+        prefix, difficulty = challenge["prefix"], challenge["difficulty"]
+        nonce = 0
+        while not hashlib.sha256(f"{prefix}{nonce}".encode()).hexdigest().startswith("0" * difficulty):
+            nonce += 1
+        response = http.post(
+            f"{api_url}/v1/signup",
+            headers={"Idempotency-Key": idempotency_key},
+            json={"slug": slug, "display_name": display_name, "owner_email": owner_email,
+                  "challenge_id": challenge["challenge_id"], "nonce": str(nonce)},
+        )
+        response.raise_for_status()
+        return response.json()
+    except httpx.HTTPStatusError as exc:
+        raise AppsError(f"signup failed ({exc.response.status_code}); check the request and retry safely") from None
+    except (httpx.HTTPError, KeyError, TypeError, ValueError) as exc:
+        raise AppsError(f"signup request could not be completed ({type(exc).__name__}); retry with the same idempotency key") from None
+    finally:
+        if owns:
+            http.close()
+
+
 def list_apps(api_url: str, token: str, client=None) -> list[dict]:
     return _request(api_url, token, "GET", "/v1/apps", client)["apps"]
 
 
+def get_deployment(api_url: str, token: str, deployment_id: str, client=None) -> dict:
+    from urllib.parse import quote
+    return _request(api_url, token, "GET", f"/v1/deployments/{quote(deployment_id, safe='')}", client)
+
+
 def get_app(api_url: str, token: str, name: str, client=None) -> dict:
     return _request(api_url, token, "GET", f"/v1/apps/{name}", client)
 

{verulla_cli-0.0.2 → verulla_cli-0.0.3}/verulla_cli/main.py

@@ -4,20 +4,23 @@ from pathlib import Path
 import json
 import os
 import re
-import shutil
+import secrets
 import tempfile
+import time
 import uuid
 
 import typer
 
-from verulla_cli.auth import DeviceLoginError, get_token, run_device_login
+from verulla_cli.auth import CREDENTIALS_PATH, DeviceLoginError, get_token, run_device_login, save_credentials
 from verulla_manifest import load_manifest, translate
 from verulla_cli.apps_client import (
     AppsError,
+    create_signup,
     activate_app,
     delete_app as api_delete_app,
     delete_customer as api_delete_customer,
     export_customers as api_export_customers,
+    get_deployment,
     get_app,
     get_app_logs,
 
@@ -92,6 +95,109 @@ def login(
     typer.echo("Logged in.")
 
 
+_SIGNUP_PENDING_PATH = Path.home() / ".verulla" / "signup-pending.json"
+_SIGNUP_IDEMPOTENCY_KEY = re.compile(r"[0-9a-f]{64}\Z")
+
+
+def _valid_signup_idempotency_key(value: str) -> bool:
+    if not _SIGNUP_IDEMPOTENCY_KEY.fullmatch(value):
+        return False
+    key = bytes.fromhex(value)
+    return not any(all(key[index] == key[index % period] for index in range(period, len(key)))
+                   for period in range(1, 17))
+
+
+def _write_signup_pending(path: Path, payload: dict) -> None:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, temporary = tempfile.mkstemp(prefix=f".{path.name}.", suffix=".tmp", dir=path.parent)
+    try:
+        os.fchmod(descriptor, 0o600)
+        with os.fdopen(descriptor, "w", encoding="utf-8") as stream:
+            json.dump(payload, stream)
+            stream.flush()
+            os.fsync(stream.fileno())
+        os.replace(temporary, path)
+    except BaseException:
+        try:
+            os.unlink(temporary)
+        except FileNotFoundError:
+            pass
+        raise
+
+
+@app.command()
+def signup(
+    owner_email: str | None = typer.Option(None, "--owner-email", help="Verified owner email to bind the claim to."),
+    display_name: str | None = typer.Option(None, "--display-name", help="Tenant display name."),
+    slug: str | None = typer.Option(None, "--slug", help="Safe tenant slug; generated when omitted."),
+    recover: bool = typer.Option(False, "--recover", help="Retry the saved interrupted signup request."),
+    api_url: str = typer.Option(..., "--api-url", envvar="VERULLA_API_URL", help="Verulla control plane URL."),
+    json_output: bool = typer.Option(False, "--json", help="Print a redacted JSON receipt."),
+) -> None:
+    """Create a tenant and owner hand-off without a browser or interactive prompts."""
+    pending_path = _SIGNUP_PENDING_PATH
+    if recover:
+        if any((owner_email, display_name, slug)):
+            typer.echo("Do not pass new signup values with --recover.", err=True)
+            raise typer.Exit(code=2)
+        try:
+            pending = json.loads(pending_path.read_text(encoding="utf-8"))
+            if not isinstance(pending, dict) or not all(pending.get(key) for key in
+                    ("owner_email", "display_name", "slug", "idempotency_key", "api_url")):
+                raise ValueError("invalid pending request")
+            if not isinstance(pending.get("idempotency_key"), str) or not _valid_signup_idempotency_key(pending["idempotency_key"]):
+                raise ValueError("invalid pending idempotency key")
+            if pending["api_url"].rstrip("/") != api_url.rstrip("/"):
+                raise ValueError("API URL does not match the pending signup")
+        except (OSError, ValueError) as exc:
+            typer.echo("No valid interrupted signup is available to recover.", err=True)
+            raise typer.Exit(code=1) from exc
+    else:
+        if not owner_email or not display_name:
+            typer.echo("--owner-email and --display-name are required unless --recover is used.", err=True)
+            raise typer.Exit(code=2)
+        if pending_path.exists():
+            typer.echo("An interrupted signup is pending; use `verulla signup --recover` first.", err=True)
+            raise typer.Exit(code=1)
+        pending = {
+            "owner_email": owner_email, "display_name": display_name,
+            "slug": slug or f"agent-{secrets.token_hex(4)}",
+            "idempotency_key": secrets.token_hex(32),
+            "api_url": api_url.rstrip("/"),
+        }
+        try:
+            _write_signup_pending(pending_path, pending)
+        except OSError as exc:
+            typer.echo(f"Could not securely save signup recovery state: {exc}", err=True)
+            raise typer.Exit(code=1) from exc
+
+    api_url = api_url.rstrip("/")
+    try:
+        result = create_signup(api_url, pending["slug"], pending["display_name"],
+                               pending["owner_email"], pending["idempotency_key"])
+        api_key = result["api_key"]["token"]
+        save_credentials({"access_token": api_key, "expires_in": 7 * 24 * 60 * 60},
+                         api_url, "signup", path=CREDENTIALS_PATH)
+        pending_path.unlink(missing_ok=True)
+    except (AppsError, KeyError, ValueError, OSError) as exc:
+        typer.echo(f"Signup failed; retry with `verulla signup --recover`. ({type(exc).__name__})", err=True)
+        raise typer.Exit(code=1) from None
+
+    receipt = {
+        "tenant": result.get("tenant", {}),
+        "owner_claim": result.get("owner_claim", {}),
+    }
+    if json_output:
+        typer.echo(json.dumps(receipt))
+    else:
+        tenant = receipt["tenant"]
+        claim = receipt["owner_claim"]
+        typer.echo(f"Tenant: {tenant.get('display_name')} ({tenant.get('slug')})")
+        typer.echo(f"Owner claim: {claim.get('claim_url')}")
+        typer.echo(f"Claim expires: {claim.get('expires_at')}")
+        typer.echo("Bootstrap API key saved to your private Verulla credentials file.")
+
+
 @app.command()
 def dev(
     path: str = typer.Argument(".", help="Path to the directory containing verulla.yml"),
@@ -232,6 +338,9 @@ def deploy(
         envvar="VERULLA_API_URL",
         help="Verulla control plane base URL.",
     ),
+    wait: bool = typer.Option(False, "--wait", help="Wait for build/apply to finish, then print the Sketch hand-off."),
+    wait_timeout: int = typer.Option(600, "--wait-timeout", min=1, max=3600,
+                                    help="Maximum seconds to wait (1-3600; default 600)."),
 ) -> None:
     """Deploy the app described by verulla.yml to your Verulla tenant."""
     base_dir = Path(path).resolve()
@@ -267,6 +376,54 @@ def deploy(
         typer.echo(deployment["url"])
     for fn in deployment.get("functions", []):
         typer.echo(f"  {fn['name']} ({fn['adapter']})")
+    if wait:
+        terminal = {"deployed", "build_failed", "apply_failed", "failed", "deleted", "delete_failed", "superseded", "suspended"}
+        deadline = time.monotonic() + wait_timeout
+        while True:
+            try:
+                latest = get_deployment(api_url.rstrip("/"), token, deployment["id"])
+            except AppsError as exc:
+                typer.echo(f"Error checking deployment status: {exc}", err=True)
+                raise typer.Exit(code=1) from exc
+            status = latest.get("status")
+            if status in terminal:
+                break
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                typer.echo(
+                    f"Timed out after {wait_timeout}s waiting for deployment {deployment['id']} (last status: {status}). "
+                    f"Inspect with: verulla logs {deployment['app']}", err=True,
+                )
+                raise typer.Exit(code=1)
+            time.sleep(min(2, remaining))
+        if status != "deployed":
+            typer.echo(f"Deployment {deployment['id']} ended with status {status}.", err=True)
+            if latest.get("error"):
+                typer.echo(f"Error: {latest['error']}", err=True)
+            try:
+                logs = get_app_logs(api_url.rstrip("/"), token, deployment["app"])
+            except AppsError:
+                logs = {}
+            log_url = f"{api_url.rstrip('/')}/v1/apps/{deployment['app']}/logs"
+            typer.echo(f"Build logs: {log_url} (authenticated); inspect with: verulla logs {deployment['app']}", err=True)
+            typer.echo("build_log_tail:", err=True)
+            tail = logs.get("build_log_tail") if logs.get("deployment_id") == deployment["id"] else None
+            typer.echo(tail or "(no matching build log available)", err=True)
+            typer.echo("Runtime/pod logs are not available yet.", err=True)
+            raise typer.Exit(code=1)
+        try:
+            receipt = _safe_sketch_receipt(get_sketch_status(api_url.rstrip("/"), token, deployment["app"]))
+        except AppsError as exc:
+            typer.echo(f"Deployment succeeded, but the Sketch receipt could not be loaded: {exc}", err=True)
+            raise typer.Exit(code=1) from exc
+        typer.echo("\nSketch hand-off")
+        typer.echo(f"Public URL: {receipt.get('url') or deployment.get('url') or '(not provided)'}")
+        typer.echo(f"Expires at: {receipt.get('expires_at') or '(expiry not provided by API)'}")
+        typer.echo(f"Owner claim status: {receipt.get('claim_status') or '(not provided)'}")
+        typer.echo("Trial: free for 72 hours from first successful deployment; no custom domain.")
+        if receipt.get("limits_url"):
+            typer.echo(f"Limits: {receipt['limits_url']}")
+        typer.echo(f"Next: share the public URL with the verified owner, then run `verulla sketch status {deployment['app']}` before expiry.")
 
 
 secrets_app = typer.Typer(help="Manage per-tenant secrets and environment variables.")