The tebako command, verb by verb.

The lean and fat mode names stay accepted as deprecated aliases of shared-runtime and self-contained. A suite presses one package with N commands:

--emit-recipe renders the feedstock recipe for the press that just succeeded, which is the graduation path from a directory press to a feedstock repository. The rendered document names the engine, the entry point, the mode, the image format, the vendored lockfile, the resolved runtime pair together with the factory release the pair came from, the platform leg the press proved and the executable the payload provides. The bare flag writes Tebakofile at the project root; a value writes the document to that path. A file the command did not generate is never overwritten, because an authored recipe is the author’s property.

Signing at press resolves through the settings registry — the CLI flag wins, then the environment, then the compose document. Only the CLI may name a key. The task-oriented walkthrough is the Package a Ruby app guide.

Everything after -- reaches the payload verbatim; the flags before it shape this run only. When the first token names no existing file it is read as an engine reference and boots that runtime directly — the bare form runs the interpreter, the colon form a command the runtime declares. The guide is Run a packaged app.

The trace verbs form the interception-bus toolkit; the task-oriented walkthrough is the Trace a packaged app guide.

tebako trace run runs a package under the record policy with the trace bus armed and synthesizes a suggested manifest — commented YAML on stdout, never applied:

tebako trace cover subtracts the inside stream from an outside capture and reports the escapes (exit 0 clean, 1 escapes, 2 error):

tebako trace import procmon converts a procmon CSV export into the retrace-shaped JSON that cover consumes (exit 0 converted, 1 zero entries, 2 error):

tebako trace explain replays a capture into the hop chain and names the first red hop (exit 0 clean, 1 red hop, 2 error):

The verb runs the payload’s in-image acceptance checks against a name, an image, a package, or a compose document:

The guide is Check a payload.

tebako install installs a payload and registers its shims, and the engine form pre-stages that engine’s runtime and registers a runtime-own shim instead (the bare form registers the interpreter’s own name, the colon form the declared command’s name). tebako uninstall removes the shims and the cache entry. tebako info reports on the store and its contents — the topics are system, runtimes, payloads, shims, registries, and store. tebako inspect reads a single artifact; --contract prints the contract card: the era, the contract versions, mount_root, the ABI, and the trust verdict. The guide is info & inspect.

tebako add-registry registers a tpkg-registry.yaml; tebako update-registries refreshes the dispatch-time registry cache. The guides are Publish to your own registry and Curate a local library.

tebako registry validate runs the reader every install and dispatch path runs, together with the stricter checks a pipeline gate wants collected in one report, and the exit code is the verdict: zero for a valid document and 65 for an invalid one. tebako registry retire removes one version row from a local registry file, refusing while the removal would strand a runtime edge, dangle the payload’s default, or delete the payload’s last row; --force overrides each refusal loudly.

tebako registry doctor extends the document gate to the host that serves it. The reference is parsed into its transport class, the document is validated, and every row is resolved for the host platform through the same resolver an install runs. An artifact the host does not serve, a digest that disagrees with the row’s pin, and a signature that does not verify are problems; a platform the payload is not published for is a note, because the platform matrix belongs to each payload. --full downloads the resolved artifacts, which makes the digest and signature checks real; it samples one version per payload unless --sample names a larger count. The exit code is zero for a conformant registry and one when problems were found, and --json emits a registry_doctor_schema document for pipelines.

The publisher’s GitHub releases are the storage; the command writes the index consumers add. The walkthrough is the publish guide.

The verb assembles an offline bundle: the payload’s whole dependency closure plus the runtimes it needs, gathered into one directory (optionally archived) that installs and runs with no network. Bundling draws from the local store and refuses a partial set by name — the closure is cached first.

The verb is the read-only diagnostics surface: five sections (store, dispatch, network, trust, registries) carry a named verdict on every check, with exit 0 when healthy and 1 with a problem count. --json prints the same report as a machine-readable document. The dispatch section is the tebako-shim doctor report rendered in place.

See also: Exit codes · Environment variables · Install tebako