@easybits.cloud/cli 0.4.1 → 0.5.1

package/dist/index.js

@@ -1,170 +1,636 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import {
-  EasybitsError,
-  writeRcConfig,
-  resolveApiKey,
-  resolveBaseUrl,
-  createClientFromEnv
-} from "@easybits.cloud/sdk";
-import { readFileSync, existsSync, statSync, mkdirSync, writeFileSync } from "fs";
-function flag(name) {
-  const i = process.argv.indexOf(name);
-  return i > -1 ? process.argv[i + 1] : void 0;
-}
-async function getClient() {
+import { parseArgs } from "util";
+
+// src/commands/account.ts
+import { resolveBaseUrl as resolveBaseUrl3 } from "@easybits.cloud/sdk";
+
+// src/errors.ts
+import { EasybitsError } from "@easybits.cloud/sdk";
+var EXIT = { OK: 0, API: 1, USAGE: 2, AUTH: 3 };
+var CliError = class extends Error {
+  constructor(message, exitCode = EXIT.API, hint, code = "error", status) {
+    super(message);
+    this.exitCode = exitCode;
+    this.hint = hint;
+    this.code = code;
+    this.status = status;
+  }
+  exitCode;
+  hint;
+  code;
+  status;
+};
+function usageError(message, usage2) {
+  return new CliError(
+    message,
+    EXIT.USAGE,
+    usage2 ? `Usage: ${usage2}` : "Run: easybits --help",
+    "usage"
+  );
+}
+function notLoggedIn() {
+  return new CliError(
+    "Not logged in.",
+    EXIT.AUTH,
+    "Run: easybits login   (or: easybits login <api-key>, or set EASYBITS_API_KEY)",
+    "not_logged_in"
+  );
+}
+function apiMessage(body) {
   try {
-    return await createClientFromEnv();
+    const j = JSON.parse(body);
+    if (typeof j.error === "string" && typeof j.message === "string") return { message: `${j.error}: ${j.message}`, kind: j.error };
+    if (typeof j.code === "string" && typeof j.error === "string") return { message: `${j.code}: ${j.error}`, kind: j.code };
+    const msg = j.message ?? j.error ?? j.detail;
+    if (typeof msg === "string") return { message: msg };
+    if (msg) return { message: JSON.stringify(msg) };
   } catch {
-    console.error("Not logged in. Run: easybits login <api-key>");
-    process.exit(1);
   }
+  return { message: body.trim() || "empty response" };
 }
-async function login() {
-  const key = process.argv[3];
-  if (!key) {
-    console.error("Usage: easybits login <api-key>");
-    process.exit(1);
+var KIND_HINTS = {
+  SandboxBusy: "A snapshot or fork is running on this sandbox. Wait a few minutes and retry (easybits sb get <id> shows `activity`).",
+  SandboxUnreachable: "The sandbox is not answering inside. Wait and retry; if it persists, destroy it.",
+  SandboxHostTimeout: "The operation may still be running. Check `easybits sb get <id>` and retry in a few minutes.",
+  SandboxHostError: "The sandbox host failed. Retry; if it persists, contact support.",
+  SQL_ERROR: "Fix the SQL statement.",
+  DATABASE_STORAGE_MISSING: "This database has no storage; its data is unavailable. Delete it (easybits db rm) and create a new one.",
+  DATABASE_BACKEND_ERROR: "The database backend failed. Retry in a moment."
+};
+function toCliError(err) {
+  if (err instanceof CliError) return err;
+  if (err instanceof EasybitsError) {
+    const { message: message2, kind } = apiMessage(err.body);
+    if (err.status === 401) {
+      return new CliError(
+        `Credentials rejected (401): ${message2}`,
+        EXIT.AUTH,
+        "Run: easybits login   (or pass a valid API key from https://www.easybits.cloud/dash/developer)",
+        "unauthorized",
+        401
+      );
+    }
+    const hint = (kind && KIND_HINTS[kind]) ?? (err.status === 403 ? "Your key may lack the scope for this action (READ/WRITE/DELETE)." : err.status === 404 ? "Check the id. List what you have with the matching `ls` command." : err.status === 402 ? "Plan limit reached. See: easybits usage" : void 0);
+    return new CliError(`API error ${err.status}: ${message2}`, EXIT.API, hint, "api_error", err.status);
   }
-  await writeRcConfig({ apiKey: key });
-  console.log("Saved API key to ~/.easybitsrc");
+  const message = err instanceof Error ? err.message : String(err);
+  return new CliError(message, EXIT.API);
+}
+
+// src/args.ts
+function need(ctx, i, name, usage2) {
+  const v = ctx.args[i];
+  if (v == null || v === "") throw usageError(`Missing <${name}>.`, usage2);
+  return v;
+}
+function str(ctx, key) {
+  const v = ctx.opts[key];
+  return typeof v === "string" ? v : void 0;
+}
+function bool(ctx, key) {
+  return ctx.opts[key] === true;
+}
+function list(ctx, key) {
+  const v = ctx.opts[key];
+  return Array.isArray(v) ? v : typeof v === "string" ? [v] : [];
+}
+function int(ctx, key, usage2) {
+  const v = str(ctx, key);
+  if (v == null) return void 0;
+  const n = Number(v);
+  if (!Number.isInteger(n) || n < 0) throw usageError(`--${key} must be a non-negative integer.`, usage2);
+  return n;
 }
-async function filesList() {
-  const client = await getClient();
+function pairs(items, usage2) {
+  const out = {};
+  for (const item of items) {
+    const eq = item.indexOf("=");
+    if (eq < 1) throw usageError(`Expected KEY=VALUE, got "${item}".`, usage2);
+    out[item.slice(0, eq)] = item.slice(eq + 1);
+  }
+  return out;
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(c);
+  return Buffer.concat(chunks);
+}
+
+// src/output.ts
+function emit(ctx, data, human) {
+  if (ctx.json) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+  else human();
+}
+function fmtBytes(n) {
+  if (n == null) return "-";
+  if (n < 1024) return `${n}B`;
+  if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+  if (n < 1024 ** 3) return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+  return `${(n / 1024 ** 3).toFixed(2)}GB`;
+}
+function fmtDate(s) {
+  if (!s) return "-";
+  const d = new Date(s);
+  return Number.isNaN(d.getTime()) ? s : d.toISOString().slice(0, 16).replace("T", " ");
+}
+function table(rows, cols, empty = "Nothing here yet.") {
+  if (rows.length === 0) {
+    console.log(empty);
+    return;
+  }
+  const cell = (v) => v == null || v === "" ? "-" : String(v);
+  const widths = cols.map(
+    ([k, label]) => Math.min(48, Math.max(label.length, ...rows.map((r) => cell(r[k]).length)))
+  );
+  const line = (vals) => vals.map((v, i) => i === vals.length - 1 ? v : v.slice(0, widths[i]).padEnd(widths[i])).join("  ").trimEnd();
+  console.log(line(cols.map(([, l]) => l)));
+  for (const r of rows) console.log(line(cols.map(([k]) => cell(r[k]))));
+}
+
+// src/client.ts
+import { EasybitsClient, resolveBaseUrl as resolveBaseUrl2 } from "@easybits.cloud/sdk";
+
+// src/auth.ts
+import { createHash, randomBytes } from "crypto";
+import { createServer } from "http";
+import { spawn } from "child_process";
+import { chmodSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+import { resolveBaseUrl } from "@easybits.cloud/sdk";
+var CLIENT_ID = "easybits-cli";
+var LOGIN_TIMEOUT_MS = 5 * 6e4;
+var RC_PATH = join(homedir(), ".easybitsrc");
+function readRc() {
   try {
-    const data = await client.listFiles();
-    if (data.items.length === 0) {
-      console.log("No files found");
-      return;
-    }
-    console.log(
-      `${"Name".padEnd(30)} ${"Size".padEnd(10)} ${"Status".padEnd(10)} ID`
-    );
-    console.log("-".repeat(70));
-    for (const f of data.items) {
-      const size = f.size < 1024 * 1024 ? `${(f.size / 1024).toFixed(1)}KB` : `${(f.size / (1024 * 1024)).toFixed(1)}MB`;
-      console.log(
-        `${f.name.slice(0, 29).padEnd(30)} ${size.padEnd(10)} ${f.status.padEnd(10)} ${f.id}`
-      );
-    }
-  } catch (err) {
-    if (err instanceof EasybitsError) {
-      console.error(`Error ${err.status}: ${err.body}`);
-      process.exit(1);
-    }
-    throw err;
-  }
-}
-async function filesUpload() {
-  const fileName = process.argv[4];
-  if (!fileName) {
-    console.error("Usage: easybits files upload <filename>");
-    process.exit(1);
-  }
-  if (!existsSync(fileName)) {
-    console.error(`File not found: ${fileName}`);
-    process.exit(1);
-  }
-  const stat = statSync(fileName);
-  const ext = fileName.split(".").pop() || "";
-  const mimeMap = {
-    pdf: "application/pdf",
-    png: "image/png",
-    jpg: "image/jpeg",
-    jpeg: "image/jpeg",
-    mp4: "video/mp4",
-    zip: "application/zip"
-  };
-  const contentType = mimeMap[ext] || "application/octet-stream";
-  const client = await getClient();
+    return JSON.parse(readFileSync(RC_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeRc(rc) {
+  writeFileSync(RC_PATH, JSON.stringify(rc, null, 2) + "\n", { mode: 384 });
+  chmodSync(RC_PATH, 384);
+}
+var interactive = (ctx) => Boolean(process.stdin.isTTY && process.stderr.isTTY) && !ctx.json;
+var b64url = (buf) => buf.toString("base64url");
+var info = (s) => process.stderr.write(s + "\n");
+function openUrl(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
   try {
-    const data = await client.uploadFile({
-      fileName: fileName.split("/").pop(),
-      contentType,
-      size: stat.size
+    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {
+    }).unref();
+  } catch {
+  }
+}
+async function tokenRequest(base, form) {
+  const res = await fetch(`${base}/oauth/token`, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams(form)
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.access_token) {
+    throw new CliError(`Login failed (${body.error ?? res.status}).`, EXIT.AUTH, "Run: easybits login", "login_failed", res.status);
+  }
+  return body;
+}
+var FAIL_PAGE = (base) => `<!doctype html><html lang="es"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>EasyBits CLI</title><body style="font-family:system-ui,sans-serif;background:#0b0b0f;color:#f4f5fb;display:grid;place-items:center;min-height:100vh;margin:0;padding:16px;box-sizing:border-box">
+<div style="text-align:center;max-width:420px">
+<img src="${base}/logo-purple.svg" alt="EasyBits" width="96" height="96" style="display:block;margin:0 auto 20px">
+<h1 style="font-size:26px;margin:0 0 8px">No se pudo entrar</h1>
+<p style="margin:0;color:#a1a1aa;line-height:1.5">Vuelve a la terminal y corre <code style="color:#fbbf24">easybits login</code> otra vez.</p></div>`;
+async function fetchEmail(token) {
+  const base = (await resolveBaseUrl()).replace(/\/+$/, "");
+  const res = await fetch(`${base}/api/v2/me`, { headers: { authorization: `Bearer ${token}` } });
+  if (res.status === 401) {
+    throw new CliError("Credentials rejected (401).", EXIT.AUTH, "Check the key at https://www.easybits.cloud/dash/developer", "unauthorized", 401);
+  }
+  if (!res.ok) return void 0;
+  return (await res.json().catch(() => ({}))).email;
+}
+async function oauthLogin(ctx, opts = {}) {
+  const base = (await resolveBaseUrl()).replace(/\/+$/, "");
+  const verifier = b64url(randomBytes(32));
+  const challenge = b64url(createHash("sha256").update(verifier).digest());
+  const state = b64url(randomBytes(16));
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const port = server.address().port;
+  const redirectUri = `http://127.0.0.1:${port}/cb`;
+  try {
+    const clientId = CLIENT_ID;
+    const url = `${base}/oauth/authorize?` + new URLSearchParams({
+      response_type: "code",
+      client_id: clientId,
+      redirect_uri: redirectUri,
+      scope: "mcp",
+      state,
+      code_challenge: challenge,
+      code_challenge_method: "S256"
+    });
+    const code = await new Promise((resolve, reject) => {
+      const timer = setTimeout(
+        () => reject(new CliError("Login timed out after 5 minutes.", EXIT.AUTH, "Run: easybits login", "login_timeout")),
+        LOGIN_TIMEOUT_MS
+      );
+      server.on("request", (req, res) => {
+        const u = new URL(req.url ?? "/", "http://127.0.0.1");
+        if (u.pathname !== "/cb") {
+          res.writeHead(404).end();
+          return;
+        }
+        const got = u.searchParams.get("code");
+        const ok = u.searchParams.get("state") === state && !!got;
+        clearTimeout(timer);
+        if (ok) {
+          res.writeHead(302, { location: `${base}/oauth/listo` }).end();
+          resolve(got);
+        } else {
+          res.writeHead(400, { "content-type": "text/html; charset=utf-8" }).end(FAIL_PAGE(base));
+          reject(
+            new CliError(`Login was not completed (${u.searchParams.get("error") ?? "state mismatch"}).`, EXIT.AUTH, "Run: easybits login", "login_failed")
+          );
+        }
+      });
+      if (ctx.json) process.stdout.write(JSON.stringify({ event: "login_url", url }) + "\n");
+      if (opts.openBrowser !== false) {
+        info("Opening your browser to sign in to EasyBits\u2026");
+        openUrl(url);
+      }
+      info(`If it doesn't open, visit:
+  ${url}`);
+      info("Waiting for the browser\u2026");
     });
-    const fileBuffer = readFileSync(fileName);
-    const uploadRes = await fetch(data.putUrl, {
-      method: "PUT",
-      body: fileBuffer,
-      headers: { "Content-Type": contentType }
+    const tok = await tokenRequest(base, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: redirectUri,
+      client_id: clientId,
+      code_verifier: verifier
     });
-    if (uploadRes.ok) {
-      console.log(`Uploaded: ${data.file.id}`);
-    } else {
-      console.error(`Upload failed: ${uploadRes.status}`);
-    }
-  } catch (err) {
-    if (err instanceof EasybitsError) {
-      console.error(`Error ${err.status}: ${err.body}`);
-      process.exit(1);
+    const session = {
+      clientId,
+      accessToken: tok.access_token,
+      refreshToken: tok.refresh_token,
+      expiresAt: Date.now() + (tok.expires_in ?? 3600) * 1e3
+    };
+    writeRc({ ...readRc(), oauth: session });
+    return session;
+  } finally {
+    server.close();
+  }
+}
+async function refreshSession(s) {
+  if (!s.refreshToken) return null;
+  try {
+    const tok = await tokenRequest((await resolveBaseUrl()).replace(/\/+$/, ""), {
+      grant_type: "refresh_token",
+      refresh_token: s.refreshToken,
+      client_id: s.clientId
+    });
+    const next = {
+      ...s,
+      accessToken: tok.access_token,
+      refreshToken: tok.refresh_token ?? s.refreshToken,
+      expiresAt: Date.now() + (tok.expires_in ?? 3600) * 1e3
+    };
+    writeRc({ ...readRc(), oauth: next });
+    return next;
+  } catch {
+    return null;
+  }
+}
+
+// src/client.ts
+function resolveApiKey(ctx) {
+  return process.env.EASYBITS_API_KEY || ctx.token || readRc().apiKey;
+}
+var fromSession = false;
+var usedSession = () => fromSession;
+async function forceRefresh() {
+  const s = readRc().oauth;
+  return Boolean(s && await refreshSession(s));
+}
+async function resolveCredential(ctx) {
+  fromSession = false;
+  const explicit = process.env.EASYBITS_API_KEY || ctx.token;
+  if (explicit) return explicit;
+  const rc = readRc();
+  if (rc.oauth?.accessToken) {
+    fromSession = true;
+    if (rc.oauth.expiresAt - Date.now() > 6e4) return rc.oauth.accessToken;
+    const next = await refreshSession(rc.oauth);
+    if (next) return next.accessToken;
+    fromSession = false;
+    if (rc.apiKey) return rc.apiKey;
+    if (!interactive(ctx)) {
+      throw new CliError("Your session expired.", EXIT.AUTH, "Run: easybits login   (or set EASYBITS_API_KEY)", "session_expired");
     }
-    throw err;
+  } else if (rc.apiKey) {
+    return rc.apiKey;
+  } else if (!interactive(ctx)) {
+    throw notLoggedIn();
   }
+  process.stderr.write("Not logged in yet \u2014 let's fix that.\n");
+  fromSession = true;
+  return (await oauthLogin(ctx)).accessToken;
+}
+async function getClient(ctx) {
+  const apiKey = await resolveCredential(ctx);
+  return new EasybitsClient({ apiKey, baseUrl: await resolveBaseUrl2() });
 }
-async function filesDelete() {
-  const fileId = process.argv[4];
-  if (!fileId) {
-    console.error("Usage: easybits files delete <file-id>");
-    process.exit(1);
+
+// src/commands/account.ts
+var login = {
+  name: "login",
+  group: "Account",
+  summary: "Sign in with your browser (or save an API key)",
+  synopsis: "login [api-key]",
+  leaf: {
+    summary: "Sign in with your browser (OAuth2 + PKCE), or save an API key instead",
+    usage: "easybits login [api-key] [--no-browser]",
+    options: {
+      "no-browser": { type: "boolean", description: "Only print the sign-in URL (e.g. for an agent to relay it)" }
+    },
+    examples: [
+      "easybits login                        # opens the browser; waits for you",
+      'easybits login --json                 # agents: prints {"event":"login_url"} first',
+      "easybits login eb_sk_live_xxxxxxxx    # API key instead of the browser (validated first)"
+    ],
+    async run(ctx) {
+      const key = ctx.args[0];
+      if (key) {
+        const email2 = await fetchEmail(key);
+        const { oauth: _drop, ...rest } = readRc();
+        writeRc({ ...rest, apiKey: key });
+        if (ctx.json) process.stdout.write(JSON.stringify({ event: "logged_in", email: email2, method: "apiKey" }) + "\n");
+        else console.log(`Logged in${email2 ? ` as ${email2}` : ""}. API key saved to ~/.easybitsrc`);
+        return;
+      }
+      const session = await oauthLogin(ctx, { openBrowser: !bool(ctx, "no-browser") });
+      const email = await fetchEmail(session.accessToken);
+      if (ctx.json) process.stdout.write(JSON.stringify({ event: "logged_in", email, method: "oauth" }) + "\n");
+      else console.log(`Logged in${email ? ` as ${email}` : ""}. Session saved to ~/.easybitsrc`);
+    }
   }
-  const client = await getClient();
-  try {
-    await client.deleteFile(fileId);
-    console.log("Deleted");
-  } catch (err) {
-    if (err instanceof EasybitsError) {
-      console.error(`Error ${err.status}: ${err.body}`);
-      process.exit(1);
+};
+var logout = {
+  name: "logout",
+  group: "Account",
+  summary: "Forget the saved session and API key",
+  synopsis: "logout",
+  leaf: {
+    summary: "Remove the browser session and the API key from ~/.easybitsrc",
+    usage: "easybits logout",
+    examples: ["easybits logout"],
+    async run(ctx) {
+      const { oauth: _o, apiKey: _k, ...rest } = readRc();
+      writeRc(rest);
+      emit(ctx, { ok: true }, () => console.log("Logged out. Removed credentials from ~/.easybitsrc"));
     }
-    throw err;
-  }
-}
-async function providersList() {
-  console.log("Default provider: Tigris (platform)");
-  console.log("Use the Developer Dashboard to add custom providers.");
-}
-async function printMcpConfig() {
-  const apiKey = await resolveApiKey();
-  const baseUrl = await resolveBaseUrl();
-  const config = {
-    mcpServers: {
-      easybits: {
-        type: "streamable-http",
-        url: `${baseUrl}/api/mcp`,
-        headers: {
-          Authorization: `Bearer ${apiKey || "eb_sk_live_YOUR_KEY"}`
-        }
+  }
+};
+var usage = {
+  name: "usage",
+  group: "Account",
+  summary: "Show your plan, storage and resource counts",
+  synopsis: "usage",
+  leaf: {
+    summary: "Show your plan, storage and resource counts",
+    usage: "easybits usage",
+    examples: ["easybits usage", "easybits usage --json"],
+    async run(ctx) {
+      const eb = await getClient(ctx);
+      const u = await eb.getUsageStats();
+      emit(ctx, u, () => {
+        console.log(`Plan:     ${u.plan}`);
+        console.log(
+          `Storage:  ${fmtBytes(u.storage.usedBytes)} of ${fmtBytes(u.storage.maxBytes)} (${u.storage.percentUsed}%)`
+        );
+        console.log(
+          `Files:    ${u.counts.files}  (trash: ${u.counts.deletedFiles})
+Websites: ${u.counts.websites}
+Webhooks: ${u.counts.webhooks}`
+        );
+      });
+    }
+  }
+};
+var websites = {
+  name: "websites",
+  group: "Storage",
+  summary: "List your static websites",
+  synopsis: "websites",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your static websites",
+      usage: "easybits websites ls",
+      examples: ["easybits websites ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const { items } = await eb.listWebsites();
+        emit(
+          ctx,
+          items,
+          () => table(
+            items.map((w) => ({ ...w, size: fmtBytes(w.totalSize), createdAt: fmtDate(w.createdAt) })),
+            [["id", "ID"], ["name", "NAME"], ["status", "STATUS"], ["fileCount", "FILES"], ["size", "SIZE"], ["url", "URL"]],
+            "No websites yet."
+          )
+        );
       }
     }
-  };
-  console.log(JSON.stringify(config, null, 2));
-}
-function printMcpStdioConfig() {
-  const config = {
-    mcpServers: {
-      easybits: {
-        command: "npx",
-        args: ["-y", "@easybits.cloud/mcp"],
-        env: {
-          EASYBITS_API_KEY: "eb_sk_live_YOUR_KEY"
-        }
+  },
+  defaultSub: "ls"
+};
+var providers = {
+  name: "providers",
+  group: "Storage",
+  summary: "Show storage providers",
+  synopsis: "providers",
+  leaf: {
+    summary: "Show storage providers",
+    usage: "easybits providers [list]",
+    async run(ctx) {
+      const data = {
+        defaultProvider: "tigris",
+        note: "Use the Developer Dashboard to add custom providers."
+      };
+      emit(ctx, data, () => {
+        console.log("Default provider: Tigris (platform)");
+        console.log("Use the Developer Dashboard to add custom providers.");
+      });
+    }
+  }
+};
+var config = {
+  name: "config",
+  group: "MCP",
+  summary: "Print MCP config JSON (streamable HTTP)",
+  synopsis: "config",
+  leaf: {
+    summary: "Print MCP config JSON (streamable HTTP) with your key",
+    usage: "easybits config",
+    examples: ["easybits config > .mcp.json"],
+    async run(ctx) {
+      const apiKey = resolveApiKey(ctx);
+      const baseUrl = await resolveBaseUrl3();
+      console.log(
+        JSON.stringify(
+          {
+            mcpServers: {
+              easybits: {
+                type: "streamable-http",
+                url: `${baseUrl}/api/mcp`,
+                headers: { Authorization: `Bearer ${apiKey || "eb_sk_live_YOUR_KEY"}` }
+              }
+            }
+          },
+          null,
+          2
+        )
+      );
+    }
+  }
+};
+var mcp = {
+  name: "mcp",
+  group: "MCP",
+  summary: "Print MCP stdio config JSON",
+  synopsis: "mcp",
+  leaf: {
+    summary: "Print MCP stdio config JSON (npx @easybits.cloud/mcp)",
+    usage: "easybits mcp",
+    async run() {
+      console.log(
+        JSON.stringify(
+          {
+            mcpServers: {
+              easybits: {
+                command: "npx",
+                args: ["-y", "@easybits.cloud/mcp"],
+                env: { EASYBITS_API_KEY: "eb_sk_live_YOUR_KEY" }
+              }
+            }
+          },
+          null,
+          2
+        )
+      );
+    }
+  }
+};
+
+// src/commands/files.ts
+import { existsSync, readFileSync as readFileSync2, statSync } from "fs";
+import { basename, extname } from "path";
+var MIME = {
+  pdf: "application/pdf",
+  png: "image/png",
+  jpg: "image/jpeg",
+  jpeg: "image/jpeg",
+  webp: "image/webp",
+  gif: "image/gif",
+  svg: "image/svg+xml",
+  mp4: "video/mp4",
+  mp3: "audio/mpeg",
+  zip: "application/zip",
+  gz: "application/gzip",
+  json: "application/json",
+  txt: "text/plain",
+  md: "text/markdown",
+  html: "text/html",
+  csv: "text/csv"
+};
+var files = {
+  name: "files",
+  group: "Storage",
+  summary: "Your files in EasyBits storage",
+  synopsis: "files",
+  defaultSub: "ls",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your files",
+      usage: "easybits files ls",
+      examples: ["easybits files ls", "easybits files ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const data = await eb.listFiles();
+        emit(
+          ctx,
+          data.items,
+          () => table(
+            data.items.map((f) => ({ ...f, size: fmtBytes(f.size) })),
+            [["name", "NAME"], ["size", "SIZE"], ["status", "STATUS"], ["id", "ID"]],
+            "No files found"
+          )
+        );
+      }
+    },
+    upload: {
+      summary: "Upload a local file",
+      usage: "easybits files upload <path>",
+      examples: ["easybits files upload ./report.pdf", "easybits files upload ./logo.png --json"],
+      async run(ctx) {
+        const path = need(ctx, 0, "path", this.usage);
+        if (!existsSync(path)) throw usageError(`File not found: ${path}`, this.usage);
+        const size = statSync(path).size;
+        const contentType = MIME[extname(path).slice(1).toLowerCase()] || "application/octet-stream";
+        const eb = await getClient(ctx);
+        const data = await eb.uploadFile({ fileName: basename(path), contentType, size });
+        const res = await fetch(data.putUrl, {
+          method: "PUT",
+          body: readFileSync2(path),
+          headers: { "Content-Type": contentType }
+        });
+        if (!res.ok) throw new CliError(`Upload failed: storage answered ${res.status}`, 1, void 0, "upload_failed", res.status);
+        emit(ctx, data.file, () => console.log(`Uploaded: ${data.file.id}`));
+      }
+    },
+    delete: {
+      aliases: ["rm"],
+      summary: "Delete a file (soft delete, 7-day trash)",
+      usage: "easybits files delete <file-id>",
+      examples: ["easybits files delete 6650f0c2a1b2c3d4e5f60718"],
+      async run(ctx) {
+        const id = need(ctx, 0, "file-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.deleteFile(id);
+        emit(ctx, r, () => console.log("Deleted"));
       }
     }
-  };
-  console.log(JSON.stringify(config, null, 2));
-}
-async function init() {
-  const appDir = flag("--app-dir") ?? "/srv/app";
-  const port = flag("--port") ?? "3000";
-  if (!existsSync("package.json")) {
-    console.error(
-      "Aqu\xED no hay package.json. Corre esto en la ra\xEDz del repo de tu app."
-    );
-    process.exit(1);
-  }
-  const workflow = `# Despliegue a EasyBits en cada push a main.
+  }
+};
+
+// src/commands/init.ts
+import { existsSync as existsSync2, mkdirSync, writeFileSync as writeFileSync2 } from "fs";
+var init = {
+  name: "init",
+  group: "Hosting",
+  summary: "Write the GitHub Actions deploy workflow for this repo",
+  synopsis: "init",
+  leaf: {
+    summary: "Write the GitHub Actions workflow that deploys this repo on every push to main",
+    usage: "easybits init [--app-dir /srv/app] [--port 3000]",
+    options: {
+      "app-dir": { type: "string", value: "dir", description: "Where the app lives in the machine (default /srv/app)" },
+      port: { type: "string", value: "port", description: "Port your app listens on (default 3000)" }
+    },
+    examples: ["easybits init", "easybits init --app-dir /srv/app --port 8080"],
+    async run(ctx) {
+      const appDir = str(ctx, "app-dir") ?? "/srv/app";
+      const port = str(ctx, "port") ?? "3000";
+      if (!existsSync2("package.json")) {
+        throw usageError("No package.json here. Run this at the root of your app's repo.", this.usage);
+      }
+      const workflow = `# Despliegue a EasyBits en cada push a main.
 #
 # El build ocurre AQU\xCD, no dentro de la m\xE1quina: as\xED la caja s\xF3lo descarga y
 # arranca, y el sitio cabe en un tier peque\xF1o. Si el build falla, no llega a
@@ -205,237 +671,1098 @@ jobs:
           EASYBITS_PORT: "${port}"
         run: node .github/scripts/easybits-deploy.mjs
 `;
-  const script = [
-    "// Empaqueta lo que hace falta para servir y lo manda a la m\xE1quina.",
-    "// Lo genera 'easybits init'; aj\xFAstalo si tu app necesita otros archivos.",
-    "",
-    'import { createReadStream, statSync } from "node:fs";',
-    'import { execFileSync } from "node:child_process";',
-    "",
-    'const API = process.env.EASYBITS_API || "https://www.easybits.cloud/api/v2";',
-    "const KEY = process.env.EASYBITS_API_KEY;",
-    "const MACHINE = process.env.EASYBITS_SANDBOX_ID;",
-    'const APP_DIR = process.env.EASYBITS_APP_DIR || "' + appDir + '";',
-    "const PORT = Number(process.env.EASYBITS_PORT || " + port + ");",
-    'const TARBALL = "/tmp/easybits-build.tgz";',
-    'const SHA = (process.env.GITHUB_SHA || "manual").slice(0, 7);',
-    "",
-    "if (!KEY || !MACHINE) {",
-    '  console.error("Faltan EASYBITS_API_KEY o EASYBITS_SANDBOX_ID en los secretos del repo.");',
-    "  process.exit(1);",
-    "}",
-    "",
-    "async function api(path, body) {",
-    "  const res = await fetch(API + path, {",
-    '    method: "POST",',
-    '    headers: { Authorization: "Bearer " + KEY, "Content-Type": "application/json" },',
-    "    body: JSON.stringify(body),",
-    "  });",
-    "  const text = await res.text();",
-    "  let data;",
-    "  try { data = JSON.parse(text); } catch { data = {}; }",
-    "  if (!res.ok) {",
-    '    console.error("x " + path + " respondio " + res.status);',
-    "    console.error(data.message || data.error || text);",
-    "    process.exit(1);",
-    "  }",
-    "  return data;",
-    "}",
-    "",
-    "// Servir no necesita vite ni los compiladores: podarlos es la diferencia",
-    "// entre mandar 170 MB por deploy y mandar lo que la maquina ejecuta.",
-    'console.log("-> podando dependencias de desarrollo");',
-    'execFileSync("npm", ["prune", "--omit=dev"], { stdio: "inherit" });',
-    "",
-    'console.log("-> empaquetando");',
-    'execFileSync("tar", [',
-    '  "czf", TARBALL, "--exclude=.git", "--exclude=node_modules/.cache",',
-    '  "build", "node_modules", "package.json", "package-lock.json",',
-    "]);",
-    "const size = statSync(TARBALL).size;",
-    'console.log("   " + (size / 1048576).toFixed(1) + " MB");',
-    "",
-    "// Publico y de vida corta: la caja lo baja con curl, sin credenciales. No",
-    "// lleva secretos: esos los inyecta EasyBits desde la boveda, ya dentro.",
-    'console.log("-> subiendo");',
-    'const up = await api("/files", {',
-    '  fileName: "build-" + SHA + ".tgz",',
-    '  contentType: "application/gzip",',
-    "  size,",
-    '  access: "public",',
-    "});",
-    "const put = await fetch(up.putUrl, {",
-    '  method: "PUT",',
-    '  headers: { "Content-Type": "application/gzip", "Content-Length": String(size) },',
-    "  body: createReadStream(TARBALL),",
-    '  duplex: "half",',
-    "});",
-    "if (!put.ok) {",
-    '  console.error("x la subida devolvio " + put.status);',
-    "  process.exit(1);",
-    "}",
-    "",
-    "// prebuilt: la caja no reconstruye nada, solo descomprime y arranca.",
-    'console.log("-> desplegando");',
-    'const out = await api("/machines/launch", {',
-    "  sandboxId: MACHINE,",
-    "  archiveUrl: up.file.url,",
-    "  prebuilt: true,",
-    "  appDir: APP_DIR,",
-    "  port: PORT,",
-    '  message: "deploy " + SHA,',
-    "});",
-    "",
-    "if (out.exitCode !== 0) {",
-    '  console.error("x termino con codigo " + out.exitCode);',
-    '  console.error(out.buildOutput || out.startOutput || "");',
-    "  process.exit(1);",
-    "}",
-    'console.log("OK desplegado - version " + out.version);',
-    'console.log("   " + out.url);',
-    ""
-  ].join("\n");
-  mkdirSync(".github/workflows", { recursive: true });
-  mkdirSync(".github/scripts", { recursive: true });
-  writeFileSync(".github/workflows/easybits-deploy.yml", workflow);
-  writeFileSync(".github/scripts/easybits-deploy.mjs", script);
-  console.log(`Listo. Escrib\xED:
+      const script = [
+        "// Empaqueta lo que hace falta para servir y lo manda a la m\xE1quina.",
+        "// Lo genera 'easybits init'; aj\xFAstalo si tu app necesita otros archivos.",
+        "",
+        'import { createReadStream, statSync } from "node:fs";',
+        'import { execFileSync } from "node:child_process";',
+        "",
+        'const API = process.env.EASYBITS_API || "https://www.easybits.cloud/api/v2";',
+        "const KEY = process.env.EASYBITS_API_KEY;",
+        "const MACHINE = process.env.EASYBITS_SANDBOX_ID;",
+        'const APP_DIR = process.env.EASYBITS_APP_DIR || "' + appDir + '";',
+        "const PORT = Number(process.env.EASYBITS_PORT || " + port + ");",
+        'const TARBALL = "/tmp/easybits-build.tgz";',
+        'const SHA = (process.env.GITHUB_SHA || "manual").slice(0, 7);',
+        "",
+        "if (!KEY || !MACHINE) {",
+        '  console.error("Faltan EASYBITS_API_KEY o EASYBITS_SANDBOX_ID en los secretos del repo.");',
+        "  process.exit(1);",
+        "}",
+        "",
+        "async function api(path, body) {",
+        "  const res = await fetch(API + path, {",
+        '    method: "POST",',
+        '    headers: { Authorization: "Bearer " + KEY, "Content-Type": "application/json" },',
+        "    body: JSON.stringify(body),",
+        "  });",
+        "  const text = await res.text();",
+        "  let data;",
+        "  try { data = JSON.parse(text); } catch { data = {}; }",
+        "  if (!res.ok) {",
+        '    console.error("x " + path + " respondio " + res.status);',
+        "    console.error(data.message || data.error || text);",
+        "    process.exit(1);",
+        "  }",
+        "  return data;",
+        "}",
+        "",
+        "// Servir no necesita vite ni los compiladores: podarlos es la diferencia",
+        "// entre mandar 170 MB por deploy y mandar lo que la maquina ejecuta.",
+        'console.log("-> podando dependencias de desarrollo");',
+        'execFileSync("npm", ["prune", "--omit=dev"], { stdio: "inherit" });',
+        "",
+        'console.log("-> empaquetando");',
+        'execFileSync("tar", [',
+        '  "czf", TARBALL, "--exclude=.git", "--exclude=node_modules/.cache",',
+        '  "build", "node_modules", "package.json", "package-lock.json",',
+        "]);",
+        "const size = statSync(TARBALL).size;",
+        'console.log("   " + (size / 1048576).toFixed(1) + " MB");',
+        "",
+        "// Publico y de vida corta: la caja lo baja con curl, sin credenciales. No",
+        "// lleva secretos: esos los inyecta EasyBits desde la boveda, ya dentro.",
+        'console.log("-> subiendo");',
+        'const up = await api("/files", {',
+        '  fileName: "build-" + SHA + ".tgz",',
+        '  contentType: "application/gzip",',
+        "  size,",
+        '  access: "public",',
+        "});",
+        "const put = await fetch(up.putUrl, {",
+        '  method: "PUT",',
+        '  headers: { "Content-Type": "application/gzip", "Content-Length": String(size) },',
+        "  body: createReadStream(TARBALL),",
+        '  duplex: "half",',
+        "});",
+        "if (!put.ok) {",
+        '  console.error("x la subida devolvio " + put.status);',
+        "  process.exit(1);",
+        "}",
+        "",
+        "// prebuilt: la caja no reconstruye nada, solo descomprime y arranca.",
+        'console.log("-> desplegando");',
+        'const out = await api("/machines/launch", {',
+        "  sandboxId: MACHINE,",
+        "  archiveUrl: up.file.url,",
+        "  prebuilt: true,",
+        "  appDir: APP_DIR,",
+        "  port: PORT,",
+        '  message: "deploy " + SHA,',
+        "});",
+        "",
+        "if (out.exitCode !== 0) {",
+        '  console.error("x termino con codigo " + out.exitCode);',
+        '  console.error(out.buildOutput || out.startOutput || "");',
+        "  process.exit(1);",
+        "}",
+        'console.log("OK desplegado - version " + out.version);',
+        'console.log("   " + out.url);',
+        ""
+      ].join("\n");
+      mkdirSync(".github/workflows", { recursive: true });
+      mkdirSync(".github/scripts", { recursive: true });
+      writeFileSync2(".github/workflows/easybits-deploy.yml", workflow);
+      writeFileSync2(".github/scripts/easybits-deploy.mjs", script);
+      const written = [".github/workflows/easybits-deploy.yml", ".github/scripts/easybits-deploy.mjs"];
+      emit(ctx, { written, appDir, port: Number(port) }, () => console.log(`Done. Wrote:
   .github/workflows/easybits-deploy.yml
   .github/scripts/easybits-deploy.mjs
 
-Falta, una sola vez:
+One-time setup left:
 
-1. Crea la m\xE1quina (si a\xFAn no la tienes):
+1. Create the machine (if you don't have one yet):
 
    curl -X POST https://www.easybits.cloud/api/v2/machines/launch \\
      -H "Authorization: Bearer $EASYBITS_API_KEY" \\
      -H "Content-Type: application/json" \\
-     -d '{"repo":"https://github.com/TU/REPO.git","branch":"main",
+     -d '{"repo":"https://github.com/YOU/REPO.git","branch":"main",
           "tier":"micro","template":"node","appDir":"${appDir}","port":${port}}'
 
-   Repo privado: deja el URL limpio y agrega el token aparte,
+   Private repo: keep the URL clean and pass the token separately,
      "repoToken":"github_pat_\u2026"
-   (un token dentro del URL se rechaza).
+   (a token inside the URL is rejected).
 
-   \xBFTu build cabe en la caja? Entonces no necesitas este workflow:
-   POST /machines/SANDBOX_ID/push-deploy te da un webhook de GitHub
-   y cada push despliega solo. Docs: https://www.easybits.cloud/docs
+   Does your build fit in the machine? Then you don't need this workflow:
+   POST /machines/SANDBOX_ID/push-deploy gives you a GitHub webhook
+   and every push deploys by itself. Docs: https://www.easybits.cloud/docs
 
-2. Guarda en el repo (Settings \u2192 Secrets and variables \u2192 Actions):
-     EASYBITS_API_KEY      tu key
-     EASYBITS_SANDBOX_ID   el id que devolvi\xF3 el paso 1
+2. Add these repo secrets (Settings \u2192 Secrets and variables \u2192 Actions):
+     EASYBITS_API_KEY      your key
+     EASYBITS_SANDBOX_ID   the id returned by step 1
 
-3. Si tu app usa variables secretas:
+3. If your app uses secret env vars:
 
-   curl -X PUT https://www.easybits.cloud/api/v2/machines/SANDBOX_ID/secrets \\
-     -H "Authorization: Bearer $EASYBITS_API_KEY" \\
-     -H "Content-Type: application/json" \\
-     -d '{"DATABASE_URL":"..."}'
-
-Desde ah\xED, cada push a main despliega.`);
-}
-async function sshProxy() {
-  const target = process.argv[3];
-  if (!target) {
-    console.error("uso: easybits ssh-proxy <sandboxId|caja.ghosty>");
-    process.exit(2);
-  }
-  let sandboxId = target.split(".")[0];
-  const eb = await createClientFromEnv();
-  if (!sandboxId.startsWith("sb_")) {
-    const hits = (await eb.sandboxes.list()).filter((s) => s.name === sandboxId);
-    if (hits.length === 0) throw new Error(`no hay ninguna caja llamada "${sandboxId}"`);
-    if (hits.length > 1)
-      throw new Error(`"${sandboxId}" es ambiguo: ${hits.length} cajas lo usan; pasa el sandboxId`);
-    sandboxId = hits[0].sandboxId;
-  }
-  const sb = await eb.sandboxes.get(sandboxId);
-  const { url } = await sb.sshTicket();
-  const ws = new WebSocket(url);
-  ws.binaryType = "arraybuffer";
-  ws.onerror = () => {
-    console.error("easybits ssh-proxy: no se pudo abrir el t\xFAnel");
-    process.exit(1);
-  };
-  ws.onclose = () => process.exit(0);
-  ws.onmessage = (ev) => {
-    const data = ev.data;
-    process.stdout.write(
-      typeof data === "string" ? Buffer.from(data) : Buffer.from(data)
-    );
+   easybits machines secrets set SANDBOX_ID DATABASE_URL=...
+
+From then on, every push to main deploys.`));
+    }
+  }
+};
+
+// src/commands/ssh.ts
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, mkdirSync as mkdirSync2 } from "fs";
+import { execFileSync } from "child_process";
+var SSH_CONFIG_SNIPPET = `Host *.ghosty
+    ProxyCommand easybits ssh-proxy %h
+    User root`;
+var sshKey = {
+  name: "ssh-key",
+  group: "SSH",
+  summary: "Print your public key for sandbox SSH (creates it once)",
+  synopsis: "ssh-key",
+  leaf: {
+    summary: "Print your public key for sandbox_ssh_enable (creates ~/.ssh/easybits_ed25519 once)",
+    usage: "easybits ssh-key",
+    examples: ["easybits ssh-key"],
+    async run(ctx) {
+      const dir = join2(homedir2(), ".ssh");
+      const key = join2(dir, "easybits_ed25519");
+      const pub = `${key}.pub`;
+      if (!existsSync3(pub)) {
+        mkdirSync2(dir, { recursive: true, mode: 448 });
+        execFileSync("ssh-keygen", ["-t", "ed25519", "-N", "", "-f", key, "-C", "easybits"], {
+          stdio: ["ignore", "ignore", "inherit"]
+        });
+        console.error(`easybits: key created at ${key}`);
+      }
+      const publicKey = readFileSync3(pub, "utf8").trim();
+      if (ctx.json) process.stdout.write(JSON.stringify({ publicKey, path: pub }, null, 2) + "\n");
+      else process.stdout.write(publicKey + "\n");
+    }
+  }
+};
+var sshProxy = {
+  name: "ssh-proxy",
+  group: "SSH",
+  summary: "SSH tunnel over 443 (use as ssh ProxyCommand)",
+  synopsis: "ssh-proxy <host>",
+  leaf: {
+    summary: "SSH tunnel over 443; meant to be the ProxyCommand in ~/.ssh/config",
+    usage: "easybits ssh-proxy <sandboxId|name.ghosty>",
+    examples: ["ssh mybox.ghosty   # with the ~/.ssh/config snippet from `easybits --help`"],
+    async run(ctx) {
+      const target = need(ctx, 0, "sandboxId|name.ghosty", this.usage);
+      let sandboxId = target.split(".")[0];
+      const eb = await getClient(ctx);
+      if (!sandboxId.startsWith("sb_")) {
+        const hits = (await eb.sandboxes.list()).filter((s) => s.name === sandboxId);
+        if (hits.length === 0) throw usageError(`No sandbox named "${sandboxId}".`, this.usage);
+        if (hits.length > 1)
+          throw usageError(`"${sandboxId}" is ambiguous: ${hits.length} sandboxes use it; pass the sandboxId.`, this.usage);
+        sandboxId = hits[0].sandboxId;
+      }
+      const sb = await eb.sandboxes.get(sandboxId);
+      const { url } = await sb.sshTicket();
+      const ws = new WebSocket(url);
+      ws.binaryType = "arraybuffer";
+      await new Promise((resolve, reject) => {
+        ws.onopen = () => resolve();
+        ws.onerror = () => reject(new CliError("easybits ssh-proxy: could not open the tunnel"));
+      });
+      ws.onerror = () => {
+        console.error("easybits ssh-proxy: tunnel error");
+        process.exit(1);
+      };
+      ws.onclose = () => process.exit(0);
+      ws.onmessage = (ev) => {
+        const data = ev.data;
+        process.stdout.write(typeof data === "string" ? Buffer.from(data) : Buffer.from(data));
+      };
+      process.stdin.on("data", (chunk) => ws.send(chunk));
+      process.stdin.on("end", () => ws.close());
+      await new Promise(() => {
+      });
+    }
+  }
+};
+
+// src/commands/sandboxes.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+function sandboxRecord(s) {
+  return {
+    sandboxId: s.sandboxId,
+    name: s.name,
+    template: s.template,
+    status: s.status,
+    createdAt: s.createdAt,
+    expiresAt: s.expiresAt,
+    persistent: s.persistent,
+    tier: s.tier,
+    cpuMode: s.cpuMode,
+    monthlyMxn: s.monthlyMxn,
+    metadata: s.metadata,
+    activity: s.activity
   };
-  await new Promise((resolve) => ws.onopen = () => resolve());
-  process.stdin.on("data", (chunk) => ws.send(chunk));
-  process.stdin.on("end", () => ws.close());
-}
-async function sshKey() {
-  const { homedir } = await import("os");
-  const { join } = await import("path");
-  const { existsSync: existsSync2, readFileSync: readFileSync2, mkdirSync: mkdirSync2 } = await import("fs");
-  const { execFileSync } = await import("child_process");
-  const dir = join(homedir(), ".ssh");
-  const key = join(dir, "easybits_ed25519");
-  const pub = `${key}.pub`;
-  if (!existsSync2(pub)) {
-    mkdirSync2(dir, { recursive: true, mode: 448 });
-    execFileSync("ssh-keygen", ["-t", "ed25519", "-N", "", "-f", key, "-C", "easybits"], {
-      stdio: ["ignore", "ignore", "inherit"]
+}
+function printSandbox(s) {
+  console.log(`ID:        ${s.sandboxId}`);
+  if (s.name) console.log(`Name:      ${s.name}`);
+  console.log(`Template:  ${s.template}`);
+  console.log(`Status:    ${s.status}`);
+  if (s.activity) console.log(`Activity:  ${s.activity} (busy: exec/suspend/destroy answer 409 SandboxBusy until it ends)`);
+  console.log(`Created:   ${fmtDate(s.createdAt)}`);
+  console.log(`Expires:   ${s.persistent ? "never (permanent)" : fmtDate(s.expiresAt)}`);
+  if (s.tier) console.log(`Tier:      ${s.tier}${s.monthlyMxn != null ? ` ($${s.monthlyMxn} MXN/month)` : ""}`);
+}
+async function sandbox(ctx, usage2) {
+  const id = need(ctx, 0, "sandbox-id", usage2);
+  const eb = await getClient(ctx);
+  return eb.sandboxes.get(id);
+}
+var FILES_USAGE = "easybits sandboxes files <ls|read|write> <sandbox-id> <path> [local-file]";
+var sandboxes = {
+  name: "sandboxes",
+  aliases: ["sandbox", "sb"],
+  group: "Compute",
+  summary: "Firecracker microVMs (alias: sb)",
+  synopsis: "sandboxes",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your sandboxes",
+      usage: "easybits sandboxes ls",
+      examples: ["easybits sandboxes ls", "easybits sb ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const rows = (await eb.sandboxes.list()).map(sandboxRecord);
+        emit(
+          ctx,
+          rows,
+          () => table(
+            rows.map((r) => ({ ...r, expires: r.persistent ? "permanent" : fmtDate(r.expiresAt) })),
+            [["sandboxId", "ID"], ["name", "NAME"], ["template", "TEMPLATE"], ["status", "STATUS"], ["expires", "EXPIRES"]],
+            "No sandboxes. Create one: easybits sandboxes create --template node"
+          )
+        );
+      }
+    },
+    create: {
+      aliases: ["new"],
+      summary: "Create a sandbox and wait until it is running",
+      usage: "easybits sandboxes create [--template ubuntu] [--name <name>] [--timeout <s>] [--size s|m|l|xl] [--env K=V]...",
+      options: {
+        template: { type: "string", value: "name", description: "Base template (default ubuntu): ubuntu, python, node, code-interpreter\u2026" },
+        name: { type: "string", value: "name", description: "Human label (lets you `ssh <name>.ghosty`)" },
+        timeout: { type: "string", value: "seconds", description: "Time to live before auto-destroy" },
+        size: { type: "string", value: "s|m|l|xl", description: "VM size class (gated by plan)" },
+        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable (repeatable)" },
+        "no-wait": { type: "boolean", description: "Return right away instead of waiting for running" }
+      },
+      examples: [
+        "easybits sandboxes create --template node --name scratch",
+        "ID=$(easybits sb create --template python --json | jq -r .sandboxId)"
+      ],
+      async run(ctx) {
+        const size = str(ctx, "size");
+        if (size && !["s", "m", "l", "xl"].includes(size)) throw usageError("--size must be s, m, l or xl.", this.usage);
+        const env = pairs(list(ctx, "env"), this.usage);
+        const eb = await getClient(ctx);
+        const sb = await eb.sandboxes.create({
+          template: str(ctx, "template") ?? "ubuntu",
+          name: str(ctx, "name"),
+          timeoutSeconds: int(ctx, "timeout", this.usage),
+          size,
+          env: Object.keys(env).length ? env : void 0,
+          waitForReady: !bool(ctx, "no-wait")
+        });
+        const rec = sandboxRecord(sb);
+        emit(ctx, rec, () => printSandbox(rec));
+      }
+    },
+    get: {
+      aliases: ["show", "status"],
+      summary: "Show one sandbox",
+      usage: "easybits sandboxes get <sandbox-id>",
+      examples: ["easybits sandboxes get sb_abc123"],
+      async run(ctx) {
+        const rec = sandboxRecord(await sandbox(ctx, this.usage));
+        emit(ctx, rec, () => printSandbox(rec));
+      }
+    },
+    exec: {
+      summary: "Run a shell command inside a sandbox",
+      usage: "easybits sandboxes exec <sandbox-id> [--cwd <dir>] [--timeout <s>] -- <command...>",
+      options: {
+        cwd: { type: "string", value: "dir", description: "Working directory" },
+        timeout: { type: "string", value: "seconds", description: "Kill the command after this long" },
+        env: { type: "string", multiple: true, value: "K=V", description: "Environment variable (repeatable)" }
+      },
+      examples: [
+        "easybits sandboxes exec sb_abc123 -- uname -a",
+        "easybits sb exec sb_abc123 --cwd /data/work -- npm test",
+        "easybits sb exec sb_abc123 --json -- 'ls -la /' | jq .exitCode"
+      ],
+      async run(ctx) {
+        need(ctx, 0, "sandbox-id", this.usage);
+        const command = ctx.args.slice(1).join(" ");
+        if (!command) throw usageError("Missing <command>.", this.usage);
+        const env = pairs(list(ctx, "env"), this.usage);
+        const sb = await sandbox(ctx, this.usage);
+        const r = await sb.exec(command, {
+          cwd: str(ctx, "cwd"),
+          timeoutSeconds: int(ctx, "timeout", this.usage),
+          env: Object.keys(env).length ? env : void 0
+        });
+        if (ctx.json) {
+          emit(ctx, r, () => {
+          });
+          return;
+        }
+        if (r.stdout) process.stdout.write(r.stdout);
+        if (r.stderr) process.stderr.write(r.stderr);
+        if (r.truncated) console.error("easybits: output truncated");
+        process.exitCode = r.exitCode;
+      }
+    },
+    logs: {
+      summary: "Read the sandbox journal (optionally one systemd unit)",
+      usage: "easybits sandboxes logs <sandbox-id> [--unit <unit>] [--lines <n>] [--since <spec>] [--grep <text>]",
+      options: {
+        unit: { type: "string", value: "unit", description: "systemd unit to filter" },
+        lines: { type: "string", value: "n", description: "Last N lines (default 200)" },
+        since: { type: "string", value: "spec", description: 'journalctl time spec, e.g. "10 min ago"' },
+        grep: { type: "string", value: "text", description: "Only lines matching" }
+      },
+      examples: ["easybits sandboxes logs sb_abc123 --lines 50", "easybits sb logs sb_abc123 --unit myapp --since '10 min ago'"],
+      async run(ctx) {
+        const sb = await sandbox(ctx, this.usage);
+        const r = await sb.logs({
+          unit: str(ctx, "unit"),
+          lines: int(ctx, "lines", this.usage),
+          since: str(ctx, "since"),
+          grep: str(ctx, "grep")
+        });
+        emit(ctx, r, () => process.stdout.write(r.output.endsWith("\n") || !r.output ? r.output : r.output + "\n"));
+      }
+    },
+    files: {
+      summary: "List, read or write files inside a sandbox",
+      usage: FILES_USAGE,
+      options: {
+        content: { type: "string", value: "text", description: "write: inline content instead of a local file" },
+        out: { type: "string", value: "file", description: "read: save to a local file (binary-safe)" }
+      },
+      examples: [
+        "easybits sandboxes files ls sb_abc123 /data/work",
+        "easybits sb files read sb_abc123 /etc/os-release",
+        "easybits sb files read sb_abc123 /data/out.png --out out.png",
+        "easybits sb files write sb_abc123 /data/work/app.js ./app.js",
+        "echo hello | easybits sb files write sb_abc123 /tmp/hello.txt"
+      ],
+      async run(ctx) {
+        const action = need(ctx, 0, "ls|read|write", FILES_USAGE);
+        const id = need(ctx, 1, "sandbox-id", FILES_USAGE);
+        const path = need(ctx, 2, "path", FILES_USAGE);
+        const eb = await getClient(ctx);
+        const sb = await eb.sandboxes.get(id);
+        if (action === "ls" || action === "list") {
+          const { entries } = await sb.files.list(path);
+          emit(
+            ctx,
+            entries,
+            () => table(
+              entries.map((e) => ({ ...e, size: e.isDir ? "dir" : fmtBytes(e.size), modifiedAt: fmtDate(e.modifiedAt) })),
+              [["name", "NAME"], ["size", "SIZE"], ["modifiedAt", "MODIFIED"]],
+              "Empty directory."
+            )
+          );
+        } else if (action === "read" || action === "cat") {
+          const out = str(ctx, "out");
+          if (out) {
+            const r = await sb.files.read(path, { encoding: "base64" });
+            writeFileSync3(out, Buffer.from(r.content, "base64"));
+            emit(ctx, { path, out, size: r.size }, () => console.error(`Saved ${fmtBytes(r.size)} to ${out}`));
+          } else {
+            const r = await sb.files.read(path);
+            emit(ctx, r, () => process.stdout.write(r.content));
+          }
+        } else if (action === "write") {
+          const local = ctx.args[3];
+          const inline = str(ctx, "content");
+          let buf;
+          if (inline != null) buf = Buffer.from(inline, "utf8");
+          else if (local) {
+            if (!existsSync4(local)) throw usageError(`File not found: ${local}`, FILES_USAGE);
+            buf = readFileSync4(local);
+          } else if (!process.stdin.isTTY) buf = await readStdin();
+          else throw usageError("Give a local file, --content, or pipe data on stdin.", FILES_USAGE);
+          const r = await sb.files.write(path, buf.toString("base64"), { encoding: "base64" });
+          emit(ctx, { path, ...r }, () => console.log(`Wrote ${fmtBytes(r.bytes)} to ${path}`));
+        } else {
+          throw usageError(`Unknown files action "${action}".`, FILES_USAGE);
+        }
+      }
+    },
+    suspend: {
+      summary: "Suspend to disk (frees CPU; TTL paused)",
+      usage: "easybits sandboxes suspend <sandbox-id>",
+      examples: ["easybits sandboxes suspend sb_abc123"],
+      async run(ctx) {
+        const r = await (await sandbox(ctx, this.usage)).suspend();
+        emit(ctx, r, () => console.log(`Suspended ${r.sandboxId ?? ctx.args[0]} (${r.status ?? "suspended"})`));
+      }
+    },
+    resume: {
+      summary: "Wake a suspended sandbox",
+      usage: "easybits sandboxes resume <sandbox-id> [--env K=V]...",
+      options: { env: { type: "string", multiple: true, value: "K=V", description: "Rewrite env on wake (repeatable)" } },
+      examples: ["easybits sandboxes resume sb_abc123"],
+      async run(ctx) {
+        const env = pairs(list(ctx, "env"), this.usage);
+        const r = await (await sandbox(ctx, this.usage)).resume(Object.keys(env).length ? { env } : {});
+        emit(ctx, r, () => console.log(`Resumed ${r.sandboxId ?? ctx.args[0]} (${r.status ?? "running"})`));
+      }
+    },
+    destroy: {
+      aliases: ["rm", "delete"],
+      summary: "Destroy a sandbox (irreversible)",
+      usage: "easybits sandboxes destroy <sandbox-id>",
+      examples: ["easybits sandboxes destroy sb_abc123"],
+      async run(ctx) {
+        const r = await (await sandbox(ctx, this.usage)).destroy();
+        emit(ctx, { ...r, sandboxId: ctx.args[0] }, () => console.log(`Destroyed ${ctx.args[0]}`));
+      }
+    },
+    snapshot: {
+      summary: "Capture a copy-on-write snapshot without stopping the box",
+      usage: "easybits sandboxes snapshot <sandbox-id> [--name <name>]",
+      options: { name: { type: "string", value: "name", description: "Snapshot label" } },
+      examples: ["easybits sandboxes snapshot sb_abc123 --name before-upgrade"],
+      async run(ctx) {
+        const r = await (await sandbox(ctx, this.usage)).snapshot(str(ctx, "name"));
+        emit(ctx, r, () => console.log(`Snapshot ${r.snapshotId} (${fmtBytes(r.sizeBytes)})`));
+      }
+    }
+  }
+};
+
+// src/commands/machines.ts
+var SECRETS_USAGE = "easybits machines secrets <ls|set|unset> <machine-id> [KEY=VALUE... | NAME]";
+var machines = {
+  name: "machines",
+  aliases: ["deploy", "machine"],
+  group: "Hosting",
+  summary: "Permanent machines and their releases (alias: deploy)",
+  synopsis: "machines",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your permanent machines",
+      usage: "easybits machines ls",
+      examples: ["easybits machines ls", "easybits deploy ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const rows = (await eb.machines.list()).map(sandboxRecord);
+        emit(
+          ctx,
+          rows,
+          () => table(
+            rows,
+            [["sandboxId", "ID"], ["name", "NAME"], ["tier", "TIER"], ["status", "STATUS"], ["monthlyMxn", "MXN/MONTH"]],
+            "No permanent machines. See: easybits docs hosting"
+          )
+        );
+      }
+    },
+    deploy: {
+      aliases: ["release"],
+      summary: "Publish the machine's current app code as a new release",
+      usage: "easybits machines deploy <machine-id> [--message <text>]",
+      options: { message: { type: "string", short: "m", value: "text", description: "Release note" } },
+      examples: ['easybits machines deploy sb_abc123 -m "v1.2: fix checkout"'],
+      async run(ctx) {
+        const id = need(ctx, 0, "machine-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.machines.deploy(id, { message: str(ctx, "message") });
+        emit(ctx, r, () => console.log(`Release v${r.version} ${r.releaseId} (${r.status}, ${fmtBytes(r.sizeBytes)})`));
+      }
+    },
+    releases: {
+      summary: "List releases, newest first",
+      usage: "easybits machines releases <machine-id> [--limit <n>]",
+      options: { limit: { type: "string", value: "n", description: "How many" } },
+      examples: ["easybits machines releases sb_abc123 --limit 5"],
+      async run(ctx) {
+        const id = need(ctx, 0, "machine-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.machines.releases(id, { limit: int(ctx, "limit", this.usage) });
+        emit(
+          ctx,
+          r,
+          () => table(
+            r.items.map((x) => ({ ...x, size: fmtBytes(x.sizeBytes), createdAt: fmtDate(x.createdAt) })),
+            [["version", "VERSION"], ["releaseId", "ID"], ["status", "STATUS"], ["size", "SIZE"], ["createdAt", "CREATED"], ["message", "MESSAGE"]],
+            "No releases yet. Publish one: easybits machines deploy <machine-id>"
+          )
+        );
+      }
+    },
+    logs: {
+      summary: "Tail the app's own log",
+      usage: "easybits machines logs <machine-id> [--lines <n>] [--grep <text>]",
+      options: {
+        lines: { type: "string", value: "n", description: "Last N lines" },
+        grep: { type: "string", value: "text", description: "Only lines matching" }
+      },
+      examples: ["easybits machines logs sb_abc123 --lines 100", "easybits machines logs sb_abc123 --grep ERROR"],
+      async run(ctx) {
+        const id = need(ctx, 0, "machine-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.machines.logs(id, { lines: int(ctx, "lines", this.usage), grep: str(ctx, "grep") });
+        emit(ctx, r, () => process.stdout.write(r.output.endsWith("\n") || !r.output ? r.output : r.output + "\n"));
+      }
+    },
+    rollback: {
+      summary: "Put a previous release back on the same machine (data untouched)",
+      usage: "easybits machines rollback <machine-id> <release-id>",
+      examples: ["easybits machines rollback sb_abc123 rel_789"],
+      async run(ctx) {
+        const id = need(ctx, 0, "machine-id", this.usage);
+        const rel = need(ctx, 1, "release-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.machines.rollback(id, rel);
+        emit(ctx, r, () => console.log(`Rolled back to v${r.version} (exit ${r.exitCode})`));
+        if (r.exitCode !== 0) process.exitCode = 1;
+      }
+    },
+    secrets: {
+      summary: "App env vars stored encrypted in your vault",
+      usage: SECRETS_USAGE,
+      examples: [
+        "easybits machines secrets ls sb_abc123",
+        "easybits machines secrets set sb_abc123 DATABASE_URL=postgres://\u2026 API_KEY=xyz",
+        "easybits machines secrets unset sb_abc123 API_KEY"
+      ],
+      async run(ctx) {
+        const action = need(ctx, 0, "ls|set|unset", SECRETS_USAGE);
+        const id = need(ctx, 1, "machine-id", SECRETS_USAGE);
+        const eb = await getClient(ctx);
+        if (action === "ls" || action === "list") {
+          const r = await eb.machines.secrets(id);
+          emit(ctx, r, () => {
+            console.log(`Injected: ${r.secretNames.length ? r.secretNames.join(", ") : "(none)"}`);
+            console.log(`In vault: ${r.inVault.length ? r.inVault.join(", ") : "(none)"}`);
+          });
+        } else if (action === "set") {
+          const values = pairs(ctx.args.slice(2), SECRETS_USAGE);
+          if (!Object.keys(values).length) throw usageError("Give at least one KEY=VALUE.", SECRETS_USAGE);
+          const r = await eb.machines.setSecrets(id, values);
+          emit(ctx, r, () => console.log(`Set ${Object.keys(values).join(", ")}. Injected now: ${r.secretNames.join(", ")}`));
+        } else if (action === "unset") {
+          const name = need(ctx, 2, "NAME", SECRETS_USAGE);
+          const r = await eb.machines.unsetSecret(id, name);
+          emit(ctx, r, () => console.log(`Unset ${name} (value kept in the vault)`));
+        } else {
+          throw usageError(`Unknown secrets action "${action}".`, SECRETS_USAGE);
+        }
+      }
+    }
+  }
+};
+
+// src/commands/domains.ts
+async function sandbox2(ctx, usage2) {
+  const id = need(ctx, 0, "sandbox-id", usage2);
+  return (await getClient(ctx)).sandboxes.get(id);
+}
+var domains = {
+  name: "domains",
+  aliases: ["domain"],
+  group: "Hosting",
+  summary: "Custom domains with auto TLS on a sandbox or machine",
+  synopsis: "domains",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List domains attached to a sandbox",
+      usage: "easybits domains ls <sandbox-id>",
+      examples: ["easybits domains ls sb_abc123"],
+      async run(ctx) {
+        const items = await (await sandbox2(ctx, this.usage)).listDomains();
+        emit(ctx, items, () => table(items, [["domain", "DOMAIN"], ["port", "PORT"]], "No custom domains."));
+      }
+    },
+    add: {
+      summary: "Attach a domain to a port; prints the DNS record to create",
+      usage: "easybits domains add <sandbox-id> <domain> --port <port>",
+      options: { port: { type: "string", value: "port", description: "Port inside the sandbox (required)" } },
+      examples: ["easybits domains add sb_abc123 shop.example.com --port 3000"],
+      async run(ctx) {
+        const domain = need(ctx, 1, "domain", this.usage);
+        const port = int(ctx, "port", this.usage);
+        if (port == null) throw usageError("Missing --port.", this.usage);
+        const r = await (await sandbox2(ctx, this.usage)).addDomain(domain, port);
+        emit(ctx, r, () => {
+          console.log(`Attached ${r.domain} \u2192 port ${r.port}`);
+          console.log(`Create this DNS record: ${JSON.stringify(r.dns)}`);
+          console.log(`Then run: easybits domains verify ${ctx.args[0]} ${r.domain}`);
+        });
+      }
+    },
+    verify: {
+      summary: "Check DNS + HTTPS for a domain",
+      usage: "easybits domains verify <sandbox-id> <domain>",
+      examples: ["easybits domains verify sb_abc123 shop.example.com"],
+      async run(ctx) {
+        const domain = need(ctx, 1, "domain", this.usage);
+        const r = await (await sandbox2(ctx, this.usage)).verifyDomain(domain);
+        emit(ctx, r, () => {
+          console.log(`${r.domain}: ${r.ready ? "ready" : "not ready yet"}`);
+          console.log(`DNS resolved: ${r.dns.resolved}  HTTPS ok: ${r.https.ok}`);
+          if (r.hint) console.log(r.hint);
+        });
+        if (!r.ready) process.exitCode = 1;
+      }
+    },
+    rm: {
+      aliases: ["remove", "delete"],
+      summary: "Detach a domain",
+      usage: "easybits domains rm <sandbox-id> <domain>",
+      examples: ["easybits domains rm sb_abc123 shop.example.com"],
+      async run(ctx) {
+        const domain = need(ctx, 1, "domain", this.usage);
+        const r = await (await sandbox2(ctx, this.usage)).removeDomain(domain);
+        emit(ctx, r, () => console.log(`Removed ${domain}`));
+      }
+    }
+  }
+};
+
+// src/commands/db.ts
+async function findDb(eb, ref) {
+  const { items } = await eb.listDatabases();
+  const hit = items.find((d) => d.id === ref) ?? items.find((d) => d.name === ref);
+  if (!hit) throw new CliError(`No database "${ref}".`, 1, "List them with: easybits db ls", "not_found", 404);
+  return hit;
+}
+var db = {
+  name: "db",
+  aliases: ["databases"],
+  group: "Data",
+  summary: "SQL databases (libSQL)",
+  synopsis: "db",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your databases",
+      usage: "easybits db ls",
+      examples: ["easybits db ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const { items } = await eb.listDatabases();
+        emit(
+          ctx,
+          items,
+          () => table(
+            items.map((d) => ({ ...d, createdAt: fmtDate(d.createdAt) })),
+            [["id", "ID"], ["name", "NAME"], ["createdAt", "CREATED"], ["description", "DESCRIPTION"]],
+            "No databases. Create one: easybits db create <name>"
+          )
+        );
+      }
+    },
+    create: {
+      summary: "Create a database",
+      usage: "easybits db create <name> [--description <text>]",
+      options: { description: { type: "string", value: "text", description: "What it is for" } },
+      examples: ["easybits db create leads --description 'CRM leads'"],
+      async run(ctx) {
+        const name = need(ctx, 0, "name", this.usage);
+        const eb = await getClient(ctx);
+        const d = await eb.createDatabase({ name, description: str(ctx, "description") });
+        emit(ctx, d, () => console.log(`Created ${d.name} (${d.id})`));
+      }
+    },
+    rm: {
+      aliases: ["delete", "drop"],
+      summary: "Delete a database (irreversible)",
+      usage: "easybits db rm <db-id|name>",
+      examples: ["easybits db rm leads"],
+      async run(ctx) {
+        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const eb = await getClient(ctx);
+        const hit = await findDb(eb, ref);
+        const r = await eb.deleteDatabase(hit.id);
+        emit(ctx, { ...r, id: hit.id, name: hit.name }, () => console.log(`Deleted ${hit.name} (${hit.id})`));
+      }
+    },
+    query: {
+      aliases: ["sql"],
+      summary: "Run one SQL statement (by database id or name)",
+      usage: "easybits db query <db-id|name> <sql> [--arg <value>]...",
+      options: { arg: { type: "string", multiple: true, value: "value", description: "Positional ? parameter (repeatable)" } },
+      examples: [
+        "easybits db query leads 'SELECT * FROM leads LIMIT 10'",
+        "easybits db query leads 'INSERT INTO leads(name) VALUES (?)' --arg Ana",
+        "easybits db query leads 'SELECT count(*) AS n FROM leads' --json"
+      ],
+      async run(ctx) {
+        const ref = need(ctx, 0, "db-id|name", this.usage);
+        const sql = need(ctx, 1, "sql", this.usage);
+        const eb = await getClient(ctx);
+        const hit = await findDb(eb, ref);
+        const args = list(ctx, "arg");
+        const r = await eb.queryDatabase(hit.id, sql, args.length ? args : void 0);
+        emit(ctx, r, () => {
+          if (r.cols.length) {
+            table(
+              r.rows.map((row) => Object.fromEntries(r.cols.map((c, i) => [c, row[i]]))),
+              r.cols.map((c) => [c, c]),
+              "(0 rows)"
+            );
+          } else {
+            console.log(`OK, ${r.affected_row_count} row(s) affected${r.last_insert_rowid ? `, last id ${r.last_insert_rowid}` : ""}`);
+          }
+        });
+      }
+    }
+  }
+};
+
+// src/commands/agents.ts
+var agents = {
+  name: "agents",
+  aliases: ["agent"],
+  group: "Compute",
+  summary: "Agents running in their own sandbox",
+  synopsis: "agents",
+  subs: {
+    ls: {
+      aliases: ["list"],
+      summary: "List your agents",
+      usage: "easybits agents ls",
+      examples: ["easybits agents ls --json"],
+      async run(ctx) {
+        const eb = await getClient(ctx);
+        const items = await eb.listAgents();
+        emit(
+          ctx,
+          items,
+          () => table(
+            items.map((a) => ({ ...a, createdAt: fmtDate(a.createdAt) })),
+            [["agentId", "ID"], ["name", "NAME"], ["template", "TEMPLATE"], ["status", "STATUS"], ["createdAt", "CREATED"]],
+            "No agents. Create one: easybits agents create --template <template>"
+          )
+        );
+      }
+    },
+    create: {
+      summary: "Create an agent from a template",
+      usage: "easybits agents create --template <template> [--name <name>] [--env K=V]... [--timeout <s>]",
+      options: {
+        template: { type: "string", value: "template", description: "Agent template (see: easybits docs agents)" },
+        name: { type: "string", value: "name", description: "Label" },
+        env: { type: "string", multiple: true, value: "K=V", description: "Env for the agent (repeatable)" },
+        timeout: { type: "string", value: "seconds", description: "Lifetime before auto-destroy" }
+      },
+      examples: [
+        "easybits agents create --template goose --name helper",
+        "easybits agents create --template chat-anthropic --env ANTHROPIC_API_KEY=sk-ant-\u2026 --json"
+      ],
+      async run(ctx) {
+        const template = str(ctx, "template");
+        if (!template) throw usageError("Missing --template.", this.usage);
+        const eb = await getClient(ctx);
+        const a = await eb.createAgent({
+          template,
+          name: str(ctx, "name"),
+          env: pairs(list(ctx, "env"), this.usage),
+          timeoutSeconds: int(ctx, "timeout", this.usage)
+        });
+        emit(ctx, a, () => {
+          console.log(`Agent:   ${a.agentId}`);
+          console.log(`Sandbox: ${a.sandboxId}`);
+          console.log(`URL:     ${a.agentUrl}`);
+          console.log(`Talk to it: easybits agents message ${a.agentId} "hello"`);
+        });
+      }
+    },
+    message: {
+      aliases: ["msg", "send"],
+      summary: "Send a message; streams the reply",
+      usage: "easybits agents message <agent-id> <text...> [--session <id>]",
+      options: { session: { type: "string", value: "id", description: "Continue a conversation" } },
+      examples: ['easybits agents message ag_123 "summarize /data/work/README.md"', "easybits agents message ag_123 hi --json"],
+      async run(ctx) {
+        const id = need(ctx, 0, "agent-id", this.usage);
+        const content = ctx.args.slice(1).join(" ");
+        if (!content) throw usageError("Missing <text>.", this.usage);
+        const eb = await getClient(ctx);
+        const params = { content, sessionId: str(ctx, "session") };
+        if (ctx.json) {
+          emit(ctx, await eb.messageAgent(id, params), () => {
+          });
+          return;
+        }
+        for await (const tok of eb.streamAgent(id, params)) process.stdout.write(tok);
+        process.stdout.write("\n");
+      }
+    },
+    destroy: {
+      aliases: ["rm", "delete"],
+      summary: "Destroy an agent and its sandbox",
+      usage: "easybits agents destroy <agent-id>",
+      examples: ["easybits agents destroy ag_123"],
+      async run(ctx) {
+        const id = need(ctx, 0, "agent-id", this.usage);
+        const eb = await getClient(ctx);
+        const r = await eb.destroyAgent(id);
+        emit(ctx, { ...r, agentId: id }, () => console.log(`Destroyed ${id}`));
+      }
+    }
+  }
+};
+
+// src/commands/docs.ts
+import { spawn as spawn2 } from "child_process";
+import { resolveBaseUrl as resolveBaseUrl4 } from "@easybits.cloud/sdk";
+var docs = {
+  name: "docs",
+  group: "Help",
+  summary: "Print the docs URL, or a docs section as markdown",
+  synopsis: "docs [section]",
+  leaf: {
+    summary: "Print the docs URL, or a docs section as markdown",
+    usage: "easybits docs [section] [--en] [--open]",
+    options: {
+      en: { type: "boolean", description: "English docs" },
+      open: { type: "boolean", description: "Open the docs in your browser" }
+    },
+    examples: ["easybits docs", "easybits docs cli --en", "easybits docs hosting", "easybits docs --open"],
+    async run(ctx) {
+      const base = await resolveBaseUrl4();
+      const prefix = bool(ctx, "en") ? "/en/docs" : "/docs";
+      const section = ctx.args[0];
+      if (!section) {
+        const url2 = `${base}${prefix}`;
+        if (bool(ctx, "open")) {
+          const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "explorer" : "xdg-open";
+          spawn2(opener, [url2], { stdio: "ignore", detached: true }).unref();
+        }
+        emit(ctx, { url: url2, markdown: `${url2}.md`, llms: `${base}/llms.txt` }, () => console.log(url2));
+        return;
+      }
+      const url = `${base}${prefix}/${encodeURIComponent(section)}.md`;
+      const res = await fetch(url);
+      if (!res.ok) {
+        throw new CliError(
+          `Docs section "${section}" not found (${res.status}).`,
+          2,
+          `See the section list: ${base}/llms.txt`,
+          "usage",
+          res.status
+        );
+      }
+      const markdown = await res.text();
+      emit(ctx, { section, url, markdown }, () => process.stdout.write(markdown.endsWith("\n") ? markdown : markdown + "\n"));
+    }
+  }
+};
+
+// src/commands/index.ts
+var COMMANDS = [
+  login,
+  logout,
+  usage,
+  sandboxes,
+  agents,
+  machines,
+  domains,
+  init,
+  db,
+  files,
+  websites,
+  providers,
+  config,
+  mcp,
+  sshKey,
+  sshProxy,
+  docs
+];
+function findCommand(name) {
+  return COMMANDS.find((c) => c.name === name || c.aliases?.includes(name));
+}
+
+// src/help.ts
+var GLOBAL_FLAGS = `Global flags:
+  --json           Machine output: JSON on stdout, errors included
+  --token <key>    API key for this call (EASYBITS_API_KEY wins if set)
+  -h, --help       Help (also: easybits <command> --help)
+  -v, --version    Print the CLI version
+
+Exit codes: 0 ok, 1 API error, 2 usage error, 3 not logged in or bad key`;
+var COL = 17;
+function globalHelp(version) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const c of COMMANDS) groups.set(c.group, [...groups.get(c.group) ?? [], c]);
+  const lines = [`easybits ${version} \u2014 the cloud for AI agents, from your terminal`, "", "Usage: easybits <command> [subcommand] [args] [flags]", ""];
+  for (const [group, cmds] of groups) {
+    lines.push(`${group}:`);
+    for (const c of cmds) {
+      lines.push(`  ${c.synopsis.padEnd(COL)}${c.summary}`);
+      if (c.subs) lines.push(`  ${"".padEnd(COL)}${Object.keys(c.subs).join(" ")}`);
+    }
+    lines.push("");
+  }
+  lines.push(GLOBAL_FLAGS, "", "SSH to a sandbox \u2014 add to ~/.ssh/config:", indent(SSH_CONFIG_SNIPPET, 2), "");
+  lines.push("Docs: https://www.easybits.cloud/docs/cli.md  (or: easybits docs cli)");
+  return lines.join("\n");
+}
+function commandHelp(c) {
+  if (c.leaf) return leafHelp(c.leaf);
+  const subs = Object.entries(c.subs ?? {});
+  const width = Math.max(...subs.map(([n]) => n.length)) + 2;
+  const lines = [`easybits ${c.name} \u2014 ${c.summary}`, "", `Usage: easybits ${c.name} <subcommand> [args] [flags]`, ""];
+  if (c.aliases?.length) lines.push(`Aliases: ${c.aliases.join(", ")}`, "");
+  lines.push("Subcommands:");
+  for (const [n, l] of subs) lines.push(`  ${n.padEnd(width)}${l.summary}`);
+  lines.push("", `Run: easybits ${c.name} <subcommand> --help`);
+  return lines.join("\n");
+}
+function leafHelp(l) {
+  const lines = [l.summary, "", `Usage: ${l.usage}`];
+  if (l.aliases?.length) lines.push(`Aliases: ${l.aliases.join(", ")}`);
+  const opts = Object.entries(l.options ?? {});
+  if (opts.length) {
+    const flag = ([n, o]) => `${o.short ? `-${o.short}, ` : ""}--${n}${o.type === "string" ? ` <${o.value ?? "value"}>` : ""}`;
+    const width = Math.max(...opts.map((o) => flag(o).length)) + 2;
+    lines.push("", "Flags:");
+    for (const o of opts) lines.push(`  ${flag(o).padEnd(width)}${o[1].description ?? ""}`);
+  }
+  if (l.examples?.length) {
+    lines.push("", "Examples:");
+    for (const e of l.examples) lines.push(`  ${e}`);
+  }
+  lines.push("", "Add --json for machine output.");
+  return lines.join("\n");
+}
+function indent(s, n) {
+  return s.split("\n").map((l) => " ".repeat(n) + l).join("\n");
+}
+
+// src/banner.ts
+var BANNER = "            \x1B[38;2;244;245;251m\u2860\u2812\u2812\u28E4\x1B[38;2;152;112;237m\u28C0\u28C0\u2840    \x1B[38;2;244;245;251m\u28FF\u28FF\u28FF\u28FF\u28FF\u28FF                       \u28FF\u28FF\u28FF\u28FF\u28FF\u28FF\u28E4 \u28FF\u28FF  \u28E4\u28FF\x1B[0m\n    \x1B[38;2;244;245;251m\u28A0\u2854\u2809\u2809\u2809\u2822\u2840\u285E\x1B[38;2;152;112;237m\u2880\u2874\u288B\u282D\x1B[38;2;244;245;251m\u2809\u28AF\x1B[38;2;152;112;237m\u28FD\u28F7\u2844  \x1B[38;2;244;245;251m\u28FF\u28FF     \u28E4\u28FF\u28FF\u28FF\u28FF\u28FF\u28E4 \u28E4\u28FF\u28FF\u28FF\u28FF\u28E4 \u28FF\u28FF  \u28FF\u28FF \u28FF\u28FF   \u28FF\u28FF \u28E4\u28E4 \u28E4\u28FF\u28FF\u28E4\u28E4 \u28E4\u28FF\u28FF\u28FF\u28FF\u28E4\x1B[0m\n   \x1B[38;2;152;112;237m\u2880\x1B[38;2;244;245;251m\u28FF\x1B[38;2;152;112;237m\u289B\u280D\u2809\u2899\u2873\u28FC\u2857\u28FE\u28B0\x1B[38;2;244;245;251m\u28A1\u28F6\u28E4\u2818\u2846 \x1B[38;2;152;112;237m\u28BB  \x1B[38;2;244;245;251m\u28FF\u28FF\u28FF\u28FF\u28FF   \u28E4\u28E4\u28E4\u28E4\u28FF\u28FF \u28FF\u28FF\u28E4\u28E4\u28E4  \u28FF\u28FF  \u28FF\u28FF \u28FF\u28FF\u28FF\u28FF\u28FF\u28FF\u28E4 \u28FF\u28FF \u281B\u28FF\u28FF\u281B\u281B \u28FF\u28FF\u28E4\u28E4\u28E4\x1B[0m\n\x1B[38;2;152;112;237m\u28E4\u28C4\u28C0\u28FF\x1B[38;2;244;245;251m\u28DF\x1B[38;2;152;112;237m\u2801  \x1B[38;2;244;245;251m\u28FE\u28FF\u280E\x1B[38;2;152;112;237m\u28E7\u28BF\u284C\x1B[38;2;244;245;251m\u2808\u2819\u280B \u2847\x1B[38;2;152;112;237m\u2880\u287E  \x1B[38;2;244;245;251m\u28FF\u28FF     \u28FF\u28FF\u281B\u281B\u281B\u28FF\u28FF  \u281B\u281B\u281B\u28FF\u28FF \u281B\u28FF\u28FF\u28E4\u28FF\u28FF \u28FF\u28FF   \u28FF\u28FF \u28FF\u28FF  \u28FF\u28FF    \u281B\u281B\u281B\u28FF\u28FF\x1B[0m\n\x1B[38;2;152;112;237m\u2801 \u2808\u28E7\x1B[38;2;244;245;251m\u28BF\u28C6   \u2809\x1B[38;2;152;112;237m\u2880\u285F\x1B[38;2;244;245;251m\u28E7\x1B[38;2;152;112;237m\u2859\u2832\u28A4\u28E4\u2874\u2835\u280B   \x1B[38;2;244;245;251m\u28FF\u28FF\u28FF\u28FF\u28FF\u28FF \u281B\u28FF\u28FF\u28FF\u281B\u28FF\u28FF \u281B\u28FF\u28FF\u28FF\u28FF\u281B  \u28E4\u28FF\u28FF\u281B  \u28FF\u28FF\u28FF\u28FF\u28FF\u28FF\u281B \u28FF\u28FF  \u281B\u28FF\u28FF\u28FF \u281B\u28FF\u28FF\u28FF\u28FF\u281B\x1B[0m\n   \x1B[38;2;152;112;237m\u2808\u283B\x1B[38;2;244;245;251m\u28BF\u28E6\x1B[38;2;152;112;237m\u28C0\u28E0\u28F4\u281F\x1B[38;2;244;245;251m\u2801\u2808\u2819\u2833\u2836\u280A                            \u28FF\u28FF\u281B\x1B[0m\n      \x1B[38;2;244;245;251m\u2808\u2809\u2809\u2801\x1B[0m";
+
+// src/index.ts
+import { EasybitsError as EasybitsError2 } from "@easybits.cloud/sdk";
+var VERSION = true ? "0.5.1" : "dev";
+var GLOBAL_OPTIONS = {
+  json: { type: "boolean" },
+  token: { type: "string" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" }
+};
+function wantsJson(argv2) {
+  const end = argv2.indexOf("--");
+  return (end === -1 ? argv2 : argv2.slice(0, end)).includes("--json");
+}
+function showBanner(json) {
+  if (!BANNER || json || !process.stdout.isTTY || process.env.NO_COLOR) return;
+  process.stdout.write((BANNER.endsWith("\n") ? BANNER : BANNER + "\n") + "\n");
+}
+function positionalIndexes(argv2) {
+  const out = [];
+  for (let i = 0; i < argv2.length; i++) {
+    const a = argv2[i];
+    if (a === "--") break;
+    if (a === "--token") {
+      i++;
+      continue;
+    }
+    if (a.startsWith("-") && a !== "-") continue;
+    out.push(i);
+  }
+  return out;
+}
+function parse(argv2, skip, leaf) {
+  const rest = argv2.filter((_, i) => !skip.includes(i));
+  try {
+    const { values, positionals } = parseArgs({
+      args: rest,
+      options: { ...GLOBAL_OPTIONS, ...leaf?.options ?? {} },
+      allowPositionals: true,
+      strict: true
     });
-    console.error(`easybits: llave creada en ${key}`);
-  }
-  process.stdout.write(readFileSync2(pub, "utf8").trim() + "\n");
-}
-var [cmd, sub] = [process.argv[2], process.argv[3]];
-switch (cmd) {
-  case "login":
-    login();
-    break;
-  case "files":
-    if (sub === "list" || !sub) filesList();
-    else if (sub === "upload") filesUpload();
-    else if (sub === "delete") filesDelete();
-    else console.error(`Unknown: files ${sub}`);
-    break;
-  case "providers":
-    providersList();
-    break;
-  case "init":
-    init();
-    break;
-  case "config":
-    printMcpConfig();
-    break;
-  case "mcp":
-    printMcpStdioConfig();
-    break;
-  case "ssh-proxy":
-    sshProxy();
-    break;
-  case "ssh-key":
-    sshKey();
-    break;
-  case "help":
-  case void 0:
-    console.log(`easybits CLI \u2014 @easybits.cloud/cli
-
-Commands:
-  login <key>       Save API key
-  init              Write the GitHub Actions deploy workflow
-                    (--app-dir /srv/app, --port 3000)
-  files list        List your files
-  files upload <f>  Upload a file
-  files delete <id> Delete a file
-  providers list    Show storage providers
-  config            Print MCP config JSON (streamable HTTP)
-  mcp               Print MCP stdio config JSON
-  ssh-key           Print your public key for sandbox_ssh_enable (creates it once)
-  ssh-proxy <id>    SSH tunnel over 443 (use as ssh ProxyCommand)
-
-SSH to a box \u2014 add to ~/.ssh/config:
-  Host *.ghosty
-    ProxyCommand easybits ssh-proxy %h
-    User root`);
-    break;
-  default:
-    console.error(`Unknown command: ${cmd}. Run 'easybits help'`);
+    return { values, positionals };
+  } catch (e) {
+    throw usageError(e.message.split("\n")[0].split(". To specify")[0].replace(/\.?$/, "."), leaf?.usage);
+  }
+}
+async function main(argv2) {
+  const pos = positionalIndexes(argv2);
+  const cmdName = pos.length ? argv2[pos[0]] : void 0;
+  if (!cmdName || cmdName === "help") {
+    const topic = cmdName === "help" && pos[1] != null ? findCommand(argv2[pos[1]]) : void 0;
+    const { values: values2 } = parse(argv2, pos.slice(0, 2), void 0);
+    if (values2.version) {
+      console.log(VERSION);
+      return;
+    }
+    if (topic) {
+      console.log(commandHelp(topic));
+      return;
+    }
+    showBanner(values2.json === true);
+    console.log(globalHelp(VERSION));
+    return;
+  }
+  const cmd = findCommand(cmdName);
+  if (!cmd) throw usageError(`Unknown command "${cmdName}".`);
+  let leaf = cmd.leaf;
+  const skip = [pos[0]];
+  if (cmd.subs) {
+    const subName = pos[1] != null ? argv2[pos[1]] : void 0;
+    const entry = subName ? Object.entries(cmd.subs).find(([n, l]) => n === subName || l.aliases?.includes(subName)) : void 0;
+    if (entry) {
+      leaf = entry[1];
+      skip.push(pos[1]);
+    } else if (subName) {
+      throw usageError(`Unknown subcommand "${cmd.name} ${subName}".`, `easybits ${cmd.name} <${Object.keys(cmd.subs).join("|")}>`);
+    } else if (cmd.defaultSub && !argv2.includes("--help") && !argv2.includes("-h")) {
+      leaf = cmd.subs[cmd.defaultSub];
+    } else if (!argv2.includes("--help") && !argv2.includes("-h")) {
+      throw usageError(`Missing subcommand for "${cmd.name}".`, `easybits ${cmd.name} <${Object.keys(cmd.subs).join("|")}>`);
+    }
+  }
+  const { values, positionals } = parse(argv2, skip, leaf);
+  if (values.version) {
+    console.log(VERSION);
+    return;
+  }
+  if (values.help || !leaf) {
+    console.log(leaf && (leaf !== cmd.subs?.[cmd.defaultSub ?? ""] || skip.length > 1) ? leafHelp(leaf) : commandHelp(cmd));
+    return;
+  }
+  const ctx = {
+    json: values.json === true,
+    token: typeof values.token === "string" ? values.token : void 0,
+    args: positionals,
+    opts: values
+  };
+  try {
+    await leaf.run.call(leaf, ctx);
+  } catch (e) {
+    if (e instanceof EasybitsError2 && e.status === 401 && usedSession() && await forceRefresh()) {
+      await leaf.run.call(leaf, ctx);
+      return;
+    }
+    throw e;
+  }
 }
+var argv = process.argv.slice(2);
+main(argv).catch((err) => {
+  const e = toCliError(err);
+  if (wantsJson(argv)) {
+    process.stdout.write(JSON.stringify({ error: e.message, code: e.exitCode, ...e.hint ? { hint: e.hint } : {} }) + "\n");
+  } else {
+    process.stderr.write(`Error: ${e.message}
+`);
+    if (e.hint) process.stderr.write(`${e.hint}
+`);
+  }
+  process.exitCode = e.exitCode || EXIT.API;
+});