Sandbox CLI

Use the EnfinitOS CLI to drive the sandbox from your terminal — provision, run demos, fetch packs, verify offline.

The published @enfinitos/cli includes a sandbox subcommand group that mirrors the web console. Identical actions; cookie jar persisted to ~/.enfinitos/sandbox/cookies.txt.

Quickstart

npm install -g @enfinitos/cli

# Provision a sandbox tenant
enfinitos sandbox provision

# Fire a synthetic demo
enfinitos sandbox demo --count 12

# List sealed packs
enfinitos sandbox list

# Fetch and save a specific pack
enfinitos sandbox get <packId> --save pack.json

# Verify a downloaded pack offline
enfinitos sandbox verify pack.json

Commands

sandbox provision

enfinitos sandbox provision [--api-url <url>]

Provisions a fresh sandbox tenant. The response Set-Cookie is persisted to ~/.enfinitos/sandbox/cookies.txt so subsequent commands scope to the same tenant.

sandbox demo

enfinitos sandbox demo [--count N] [--api-url <url>]

Fires N synthetic delivery events (default 12, max 100) across the tenant’s active rights and seals a proof pack.

sandbox list

enfinitos sandbox list [--api-url <url>]

Lists all sealed packs. Newest last.

sandbox get

enfinitos sandbox get <packId> [--save <path>] [--api-url <url>]

Fetches a single pack. With --save, writes the pack JSON to disk (stripping the verificationKey field — verifier should fetch keys from /api/sandbox/runtime-keys or pin them).

sandbox verify

enfinitos sandbox verify <pack.json> [--keys <path>] [--api-url <url>]

Verifies a downloaded sandbox pack locally using @enfinitos/sdk-auditor’s verifyAll. If --keys is omitted, the CLI fetches the current key set from /api/sandbox/runtime-keys and runs verification against it; with --keys, the auditor uses the pinned local snapshot.

Exit codes:

• 0 — verification succeeded.
• 5 — verification failed. The pack is reported with status INVALID and the failing step is named.

Common flows

Audit roundtrip in three commands

enfinitos sandbox provision
enfinitos sandbox demo
enfinitos sandbox list
# pick the latest pack id
enfinitos sandbox get pak_xyz --save my-pack.json
enfinitos sandbox verify my-pack.json

Verify a pack a colleague emailed you

# You don't need a sandbox tenant of your own — the pack is
# self-contained. The CLI fetches the public sandbox key
# directory once.
enfinitos sandbox verify ./pack-from-colleague.json

Use against a self-hosted sandbox preview

enfinitos sandbox provision --api-url http://localhost:3000
enfinitos sandbox demo --api-url http://localhost:3000

Output

All commands respect the CLI’s global --format json|yaml|table flag. Default is table; --format json is the right choice for piping into jq.