> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enfinitos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox CLI

> Use the EnfinitOS CLI to drive the sandbox from your terminal — provision, run demos, fetch packs, verify offline.

<Note>
  The `@enfinitos/cli` ships at the April 2027 launch. Today, the published
  tool is the auditor SDK (`@enfinitos/sdk-auditor` on npm / PyPI / crates) —
  see the [quickstart](/quickstart) — and you can drive the full `/api/v1`
  surface from the [integration playground](https://enfinitos.com/developers/playground).
  The commands below document the CLI's planned `sandbox` subcommand group.
</Note>

The `@enfinitos/cli` will include a `sandbox` subcommand group that
mirrors the web console. Identical actions; cookie jar persisted to
`~/.enfinitos/sandbox/cookies.txt`.

## Quickstart

```sh theme={null}
# Available at launch:
npm install -g @enfinitos/cli

# Provision a sandbox tenant
enfinitos sandbox provision

# Fire a synthetic demo
enfinitos sandbox demo --count 12

# List sealed packs
enfinitos sandbox list

# Fetch and save a specific pack
enfinitos sandbox get <packId> --save pack.json

# Verify a downloaded pack offline
enfinitos sandbox verify pack.json
```

## Commands

### `sandbox provision`

```
enfinitos sandbox provision [--api-url <url>]
```

Provisions a fresh sandbox tenant. The response Set-Cookie is
persisted to `~/.enfinitos/sandbox/cookies.txt` so subsequent
commands scope to the same tenant.

### `sandbox demo`

```
enfinitos sandbox demo [--count N] [--api-url <url>]
```

Fires N synthetic delivery events (default 12, max 100) across
the tenant's active rights and seals a proof pack.

### `sandbox list`

```
enfinitos sandbox list [--api-url <url>]
```

Lists all sealed packs. Newest last.

### `sandbox get`

```
enfinitos sandbox get <packId> [--save <path>] [--api-url <url>]
```

Fetches a single pack. With `--save`, writes the pack JSON to disk
(stripping the `verificationKey` field — verifier should fetch
keys from `/api/sandbox/runtime-keys` or pin them).

### `sandbox verify`

```
enfinitos sandbox verify <pack.json> [--keys <path>] [--api-url <url>]
```

Verifies a downloaded sandbox pack locally using
`@enfinitos/sdk-auditor`'s `verifyAll`. If `--keys` is omitted,
the CLI fetches the current key set from `/api/sandbox/runtime-keys`
and runs verification against it; with `--keys`, the auditor uses
the pinned local snapshot.

Exit codes:

* `0` — verification succeeded.
* `5` — verification failed. The pack is reported with status
  `INVALID` and the failing step is named.

## Common flows

### Audit roundtrip in three commands

```sh theme={null}
enfinitos sandbox provision
enfinitos sandbox demo
enfinitos sandbox list
# pick the latest pack id
enfinitos sandbox get pak_xyz --save my-pack.json
enfinitos sandbox verify my-pack.json
```

### Verify a pack a colleague emailed you

```sh theme={null}
# You don't need a sandbox tenant of your own — the pack is
# self-contained. The CLI fetches the public sandbox key
# directory once.
enfinitos sandbox verify ./pack-from-colleague.json
```

### Use against a self-hosted sandbox preview

```sh theme={null}
enfinitos sandbox provision --api-url http://localhost:3000
enfinitos sandbox demo --api-url http://localhost:3000
```

## Output

All commands respect the CLI's global `--format json|yaml|table`
flag. Default is `table`; `--format json` is the right choice for
piping into `jq`.