@kikimoradev/kcloud 0.13.0 → 0.15.0

package/dist/main.js

@@ -431,9 +431,10 @@ const createTerminal = ({ stdout, stderr }) => ({
 //#region src/cli/cli.ts
 const program = "kcloud";
 const debugVariable = "KCLOUD_DEBUG";
+const defaultOrigin = "https://cloud.kikimora.dev";
 const globalOptions = {
-	profile: { type: "string" },
 	url: { type: "string" },
+	org: { type: "string" },
 	json: {
 		type: "boolean",
 		default: false
@@ -449,23 +450,28 @@ const globalOptions = {
 	}
 };
 const globalOptionsUsage = [
-	["--profile <name>", "the saved instance to act on (default: the current one)"],
-	["--url <origin>", "the instance to act on, instead of the origin of the profile"],
+	["--url <origin>", `the instance to act on (default: ${defaultOrigin})`],
+	["--org <organization>", "the organization to act in, by slug, name or id"],
 	["--json", "print machine-readable output"],
 	["--yes", "ask nothing; every input comes from a flag, a file or stdin"],
 	["-h, --help", "show help"]
 ];
 const globalValuesSchema = z.looseObject({
-	profile: z.string().optional(),
 	url: z.string().optional(),
+	org: z.string().optional(),
 	json: z.boolean(),
 	yes: z.boolean()
 });
+const organizationOf = (given) => {
+	if (given === void 0) return null;
+	if (given.trim() === "") throw new UsageError("--org needs an organization.", "Name it by its slug, name or id.");
+	return given.trim();
+};
 const settingsOf = (values) => {
 	const global = globalValuesSchema.parse(values);
 	return {
-		profile: global.profile ?? null,
 		origin: global.url ?? null,
+		organization: organizationOf(global.org),
 		json: global.json,
 		yes: global.yes
 	};
@@ -819,7 +825,8 @@ const workerSettingsSchema = z.strictObject({
 //#region ../../packages/contracts/src/common.ts
 const idSchema = z.uuid().toLowerCase();
 const localeSchema = z.enum(["en", "pl"]);
-const roleSchema = z.enum(["admin", "user"]);
+const organizationRoleSchema = z.enum(["admin", "member"]);
+const projectRoleSchema = z.enum(["admin", "member"]);
 const cursorSchema = z.string().max(512);
 const cursorQuerySchema = z.object({
 	cursor: cursorSchema.optional(),
@@ -925,13 +932,16 @@ const errorCodes = Object.keys({
 	"user.disabled": "forbidden",
 	"user.cannot_modify_self": "rule_violation",
 	"user.last_admin": "rule_violation",
+	"organization.not_found": "not_found",
+	"organization.invalid_slug": "rule_violation",
+	"organization.slug_taken": "conflict",
 	"project.not_found": "not_found",
 	"project.invalid_slug": "rule_violation",
 	"project.slug_taken": "conflict",
-	"project.member_exists": "conflict",
 	"project.docker_not_allowed": "rule_violation",
 	"project.member_not_found": "not_found",
 	"project.member_must_be_active": "rule_violation",
+	"project.not_empty": "rule_violation",
 	"credential.not_found": "not_found",
 	"credential.label_taken": "conflict",
 	"credential.in_use": "conflict",
@@ -978,6 +988,15 @@ const errorCodes = Object.keys({
 	"runtime.monitor_draining": "conflict",
 	"runtime.monitor_limited": "conflict",
 	"runtime.monitor_check_unsupported": "rule_violation",
+	"node.not_found": "not_found",
+	"node.name_taken": "conflict",
+	"node.offline": "rule_violation",
+	"node.not_registered": "rule_violation",
+	"node.registration_invalid": "unauthenticated",
+	"node.registration_used": "conflict",
+	"node.in_use": "conflict",
+	"project.last_admin": "conflict",
+	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
 	"infrastructure.not_configured": "rule_violation",
 	"infrastructure.provider_error": "internal",
@@ -1319,7 +1338,8 @@ z.object({
 	unavailableReason: z.enum([
 		"not_found",
 		"tampered",
-		"too_large"
+		"too_large",
+		"node_offline"
 	]).nullable(),
 	truncated: z.boolean()
 }).meta({ id: "TranscriptPage" });
@@ -1354,7 +1374,7 @@ const costPointSchema = z.object({
 	costUsd: z.number().min(0),
 	runs: z.int().nonnegative()
 }).meta({ id: "CostPoint" });
-z.object({
+const costSeriesSchema = z.object({
 	items: z.array(costPointSchema),
 	totalCostUsd: z.number().nonnegative(),
 	totalRuns: z.int().nonnegative(),
@@ -1364,6 +1384,12 @@ const costQuerySchema = z.object({
 	from: z.iso.date(),
 	to: z.iso.date()
 });
+const projectCostSchema = z.object({
+	projectId: idSchema,
+	costUsd: z.number().min(0),
+	runs: z.int().nonnegative()
+}).meta({ id: "ProjectCost" });
+costSeriesSchema.extend({ projects: z.array(projectCostSchema) }).meta({ id: "OrganizationCosts" });
 pageSchema(z.object({
 	taskId: z.string(),
 	title: z.string(),
@@ -1376,23 +1402,142 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
+const nodeStateSchema = z.enum([
+	"pending",
+	"online",
+	"offline"
+]);
+const nodeProviderSchema = z.enum(["self_hosted"]);
+const nodeNameSchema = z.string().trim().regex(slugPattern);
+const nodeHostSchema = z.object({
+	cpus: z.number().nonnegative(),
+	memoryBytes: z.number().nonnegative(),
+	dataRoot: z.string(),
+	serverVersion: z.string()
+}).meta({ id: "NodeHost" });
+const nodeCapabilitiesSchema = z.object({
+	sandbox: z.boolean(),
+	uidIsolation: z.boolean()
+}).meta({ id: "NodeCapabilities" });
+const nodeSchema = z.object({
+	id: idSchema,
+	name: nodeNameSchema,
+	provider: nodeProviderSchema,
+	state: nodeStateSchema,
+	engine: z.enum(runtimeEngineKinds).nullable(),
+	version: z.string().nullable(),
+	host: nodeHostSchema.nullable(),
+	capabilities: nodeCapabilitiesSchema.nullable(),
+	agentCount: z.int().nonnegative(),
+	connectedAt: z.iso.datetime().nullable(),
+	lastSeenAt: z.iso.datetime().nullable(),
+	registrationExpiresAt: z.iso.datetime().nullable(),
+	createdAt: z.iso.datetime()
+}).meta({ id: "Node" });
+const nodeAgentSchema = z.object({
+	id: idSchema,
+	name: z.string(),
+	slug: z.string(),
+	projectId: idSchema,
+	projectName: z.string(),
+	state: agentStateSchema
+}).meta({ id: "NodeAgent" });
+const nodeRuntimeSchema = z.object({
+	reportedAt: z.iso.datetime(),
+	docker: z.object({
+		state: z.enum([
+			"ok",
+			"unavailable",
+			"disabled",
+			"adopting"
+		]),
+		lastError: z.string().nullable()
+	}),
+	storage: z.object({
+		data: storageStateSchema,
+		engine: storageStateSchema
+	}),
+	reconcile: z.object({
+		lastTickAt: z.iso.datetime().nullable(),
+		lastTickError: z.string().nullable(),
+		agentsQueued: z.int().nonnegative(),
+		agentsActive: z.int().nonnegative()
+	}),
+	ingest: z.object({ readers: z.int().nonnegative() }),
+	sessions: z.object({
+		monitor: z.object({
+			effective: z.int().nonnegative(),
+			inUse: z.int().nonnegative()
+		}),
+		executor: z.object({
+			effective: z.int().nonnegative(),
+			inUse: z.int().nonnegative()
+		})
+	})
+}).meta({ id: "NodeRuntime" });
+nodeSchema.extend({
+	agents: z.array(nodeAgentSchema),
+	runtime: nodeRuntimeSchema.nullable()
+}).meta({ id: "NodeDetail" });
+z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
+z.object({ nodeId: idSchema });
+z.object({
+	organizationId: idSchema,
+	nodeId: idSchema
+});
+const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
+const nodeRegistrationSchema = z.object({
+	token: z.string(),
+	expiresAt: z.iso.datetime()
+}).meta({ id: "NodeRegistration" });
+z.object({
+	node: nodeSchema,
+	registration: nodeRegistrationSchema
+}).meta({ id: "CreatedNode" }).meta({ id: "RenewedNodeRegistration" });
+z.object({
+	token: z.string().min(1).max(256),
+	version: z.string().min(1).max(128),
+	engine: z.enum(runtimeEngineKinds),
+	host: nodeHostSchema.nullable(),
+	capabilities: nodeCapabilitiesSchema
+}).meta({ id: "RegisterNodeBody" });
+z.object({
+	nodeId: idSchema,
+	credential: z.string()
+}).meta({ id: "RegisteredNode" });
 //#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
 const passwordSchema = z.string().min(12).max(128);
 const userStatusSchema = z.enum(["active", "disabled"]);
-const meSchema = z.object({
+const organizationNameSchema = z.string().trim().min(2).max(80);
+const organizationSlugSchema = z.string().regex(slugPattern);
+const organizationSchema = z.object({
 	id: idSchema,
+	name: z.string(),
+	slug: organizationSlugSchema,
+	createdAt: z.iso.datetime()
+}).meta({ id: "Organization" });
+z.object({ items: z.array(organizationSchema) }).meta({ id: "OrganizationList" });
+z.object({ organizationId: idSchema });
+z.object({
 	organizationId: idSchema,
+	userId: idSchema
+});
+const meSchema = z.object({
+	id: idSchema,
 	email: emailSchema,
-	role: roleSchema,
+	organization: organizationSchema,
+	organizationRole: organizationRoleSchema,
+	platformAdmin: z.boolean(),
 	locale: localeSchema,
 	mustChangePassword: z.boolean()
 }).meta({ id: "Me" });
 const userSchema = z.object({
 	id: idSchema,
 	email: emailSchema,
-	role: roleSchema,
+	organizationRole: organizationRoleSchema,
+	platformAdmin: z.boolean(),
 	status: userStatusSchema,
 	locale: localeSchema,
 	mustChangePassword: z.boolean(),
@@ -1408,20 +1553,33 @@ z.object({
 	newPassword: passwordSchema
 }).meta({ id: "ChangePasswordBody" });
 z.object({ locale: localeSchema }).meta({ id: "ChangeLocaleBody" });
-z.object({
+const createUserBodySchema = z.object({
 	email: emailSchema,
-	role: roleSchema,
+	organizationRole: organizationRoleSchema,
 	locale: localeSchema,
 	initialPassword: passwordSchema.optional()
 }).meta({ id: "CreateUserBody" });
-z.object({
+const createdUserSchema = z.object({
 	user: userSchema,
 	temporaryPassword: z.string().nullable()
 }).meta({ id: "CreatedUser" });
-z.object({ role: roleSchema }).meta({ id: "UpdateUserBody" });
+z.object({ organizationRole: organizationRoleSchema }).meta({ id: "UpdateUserBody" });
+z.object({
+	name: organizationNameSchema,
+	slug: organizationSlugSchema.optional(),
+	admin: z.object({
+		email: emailSchema,
+		locale: localeSchema,
+		initialPassword: passwordSchema.optional()
+	})
+}).meta({ id: "CreateOrganizationBody" });
 z.object({ temporaryPassword: z.string() }).meta({ id: "TemporaryPassword" });
 z.object({ items: z.array(userSchema) }).meta({ id: "UserList" });
 z.object({ id: idSchema });
+z.object({
+	organization: organizationSchema,
+	admin: createdUserSchema
+}).meta({ id: "CreatedOrganization" });
 const accessTokenNameSchema = z.string().trim().min(1).max(80);
 const accessTokenSchema = z.object({
 	id: idSchema,
@@ -1481,6 +1639,8 @@ z.discriminatedUnion("status", [cliTokenWaitingSchema, cliTokenReadySchema]).met
 z.object({ version: z.string() }).meta({ id: "PlatformVersion" });
 const auditActionSchema = z.enum([
 	"platform.bootstrapped",
+	"organization.created",
+	"organization.renamed",
 	"user.created",
 	"user.role_changed",
 	"user.disabled",
@@ -1495,7 +1655,9 @@ const auditActionSchema = z.enum([
 	"project.created",
 	"project.updated",
 	"project.member_added",
+	"project.member_role_changed",
 	"project.member_removed",
+	"project.deleted",
 	"project.docker_changed",
 	"credential.created",
 	"credential.rotated",
@@ -1526,6 +1688,10 @@ const auditActionSchema = z.enum([
 	"node.volume_resized",
 	"node.quiesced",
 	"node.resumed",
+	"node.created",
+	"node.registered",
+	"node.registration_renewed",
+	"node.deleted",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1545,10 +1711,12 @@ const auditTargetTypeSchema = z.enum([
 	"backup",
 	"host_operation",
 	"volume",
-	"queue"
+	"queue",
+	"node"
 ]);
 const auditEntrySchema = z.object({
 	id: idSchema,
+	organizationId: idSchema.nullable(),
 	occurredAt: z.iso.datetime(),
 	actor: z.object({
 		kind: z.enum(["user", "system"]),
@@ -1565,6 +1733,7 @@ const auditEntrySchema = z.object({
 	ip: z.string().nullable()
 }).meta({ id: "AuditEntry" });
 cursorQuerySchema.extend({
+	organizationId: idSchema.optional(),
 	action: auditActionSchema.optional(),
 	actorUserId: idSchema.optional(),
 	from: z.iso.datetime().optional(),
@@ -1577,6 +1746,7 @@ const slugSchema = z.string().regex(slugPattern);
 const colorSchema = z.string().regex(hexColorPattern);
 const projectSchema = z.object({
 	id: idSchema,
+	organizationId: idSchema,
 	name: z.string(),
 	slug: slugSchema,
 	description: z.string(),
@@ -1589,26 +1759,27 @@ const projectSchema = z.object({
 const memberSchema = z.object({
 	userId: idSchema,
 	email: z.email(),
-	role: roleSchema,
+	role: projectRoleSchema,
 	status: userStatusSchema,
 	addedAt: z.iso.datetime()
 }).meta({ id: "Member" });
 projectSchema.extend({ members: z.array(memberSchema) }).meta({ id: "ProjectDetail" });
 z.object({ items: z.array(projectSchema) }).meta({ id: "ProjectList" });
 z.object({ items: z.array(memberSchema) }).meta({ id: "MemberList" });
-z.object({
+const createProjectBodySchema = z.object({
 	name: z.string().trim().min(2).max(80),
 	slug: slugSchema.optional(),
 	description: z.string().max(500),
 	color: colorSchema
 }).meta({ id: "CreateProjectBody" });
-z.object({
+const updateProjectBodySchema = z.object({
 	name: z.string().trim().min(2).max(80),
 	slug: slugSchema,
 	description: z.string().max(500),
 	color: colorSchema
 }).meta({ id: "UpdateProjectBody" });
 z.object({ allowed: z.boolean() }).meta({ id: "SetProjectDockerBody" });
+z.object({ role: projectRoleSchema }).meta({ id: "SetProjectMemberBody" });
 z.object({ id: idSchema });
 z.object({
 	id: idSchema,
@@ -2063,6 +2234,11 @@ const agentListItemSchema = z.object({
 	availableActions: z.array(agentActionSchema),
 	updatedAt: z.iso.datetime()
 }).meta({ id: "AgentListItem" });
+const agentNodeSchema = z.object({
+	id: idSchema,
+	name: nodeNameSchema,
+	state: nodeStateSchema
+}).meta({ id: "AgentNode" });
 agentListItemSchema.extend({
 	version: z.int().nonnegative(),
 	description: z.string(),
@@ -2077,6 +2253,7 @@ agentListItemSchema.extend({
 	toolAssignments: z.array(agentToolSchema),
 	release: releaseSummarySchema.nullable(),
 	runtime: agentRuntimeSchema,
+	node: agentNodeSchema.nullable(),
 	runtimeUid: z.int().positive().nullable(),
 	sandbox: agentSandboxSchema.nullable(),
 	createdAt: z.iso.datetime()
@@ -2099,6 +2276,7 @@ const createAgentBodySchema = z.object({
 	slug: slugSchema.optional(),
 	description: agentDescriptionSchema,
 	kikimoraVersion: kikimoraVersionSchema,
+	nodeId: idSchema,
 	claudeCredentialId: idSchema,
 	githubCredentialId: idSchema,
 	repositories: agentRepositoryLinksSchema,
@@ -2370,7 +2548,7 @@ z.object({
 		pending: z.array(idSchema)
 	}),
 	capacity: capacityForecastSchema
-}).meta({ id: "Node" });
+}).meta({ id: "PlatformNode" });
 z.object({ role: volumeRoleSchema });
 z.object({ sizeGb: z.int().positive() }).meta({ id: "ResizeVolumeBody" });
 z.object({ agents: z.int().nonnegative() }).meta({ id: "QuiesceResult" });
@@ -2476,6 +2654,7 @@ z.object({
 	version: z.string(),
 	apiImage: installedImageSchema,
 	webImage: installedImageSchema,
+	nodeImage: installedImageSchema,
 	latest: z.string().nullable(),
 	latestError: registryUnavailableSchema.nullable(),
 	versions: z.array(z.string()),
@@ -2566,11 +2745,16 @@ const agentUsageSchema = z.object({
 	blockReadBytes: byteCountSchema,
 	blockWriteBytes: byteCountSchema
 }).meta({ id: "AgentUsage" });
+const nodeHostSeriesSchema = z.object({
+	nodeId: idSchema,
+	nodeName: z.string(),
+	points: z.array(hostPointSchema)
+}).meta({ id: "NodeHostSeries" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
 	to: instantSchema,
-	host: z.array(hostPointSchema),
+	nodes: z.array(nodeHostSeriesSchema),
 	agents: z.array(agentUsageSchema)
 }).meta({ id: "HostMetrics" });
 z.object({
@@ -2659,7 +2843,11 @@ z.strictObject({ label: textParam }), z.strictObject({
 }), z.strictObject({
 	agentName: textParam,
 	failureCount: countParam
-}), z.strictObject({ agentName: textParam }), z.strictObject({ ratio: ratioParam }), z.strictObject({
+}), z.strictObject({ agentName: textParam }), z.strictObject({
+	node: textParam,
+	ratio: ratioParam
+}), z.strictObject({
+	node: textParam,
 	filesystem: filesystemNameSchema,
 	ratio: ratioParam
 }), z.strictObject({ backupKind: backupKindSchema }), z.strictObject({ hours: z.int().positive() }), z.strictObject({
@@ -2842,10 +3030,90 @@ const createAdapters = (context) => ({
 	clientName: () => `kcloud on ${hostname()}`
 });
 //#endregion
-//#region src/profile/config.ts
+//#region src/resolve.ts
+const organizationHints = { "organization.not_found": "kcloud orgs list shows the organizations you can see." };
+const isId = (reference) => idSchema.safeParse(reference).success;
+const once = (load) => {
+	let loaded = null;
+	return () => loaded ??= load();
+};
+const slugsOf = (items) => items.map(({ slug }) => slug).join(", ");
+const organizationIn = (organizations, reference) => {
+	const found = organizations.filter((organization) => organization.id === reference.toLowerCase() || organization.slug === reference || organization.name === reference);
+	const [first] = found;
+	if (first === void 0) throw new CliError(`There is no organization ${reference} you can see.`, organizations.length === 0 ? "kcloud orgs list shows the organizations you can see." : `kcloud orgs list shows ${slugsOf(organizations)}.`);
+	if (found.length > 1) throw new CliError(`${reference} names ${found.length} organizations.`, "Name it by its slug or by its id instead.");
+	return first;
+};
+const scopeOf = (api, reference) => {
+	const me = once(async () => dataOf("say who the token belongs to", await api.GET("/auth/me")));
+	const organizations = once(async () => dataOf("list the organizations", await api.GET("/organizations")).items);
+	return {
+		api,
+		me,
+		organizations,
+		organization: once(async () => reference === null ? (await me()).organization : organizationIn(await organizations(), reference))
+	};
+};
+const projectsOf = async (scope) => {
+	const { id } = await scope.organization();
+	return dataOf("list the projects", await scope.api.GET("/organizations/{organizationId}/projects", { params: { path: { organizationId: id } } }), organizationHints).items;
+};
+const matches = (reference, project) => project.slug === reference || project.name === reference;
+const resolveProjectId = async (scope, reference) => {
+	if (isId(reference)) return reference;
+	const projects = await projectsOf(scope);
+	const found = projects.filter((project) => matches(reference, project));
+	const [first] = found;
+	if (first === void 0) {
+		const { slug } = await scope.organization();
+		throw new CliError(`There is no project ${reference} you can see in ${slug}.`, projects.length === 0 ? "kcloud projects list shows the projects you are a member of." : `kcloud projects list shows ${slugsOf(projects)}.`);
+	}
+	if (found.length > 1) throw new CliError(`${reference} names ${found.length} projects.`, "Name it by its slug or by its id instead.");
+	return first.id;
+};
+const agentsOfProject = async (api, projectId) => dataOf("list the agents of the project", await api.GET("/projects/{id}/agents", { params: { path: { id: projectId } } })).items;
+const resolveAgentId = async (scope, reference, project) => {
+	if (isId(reference)) return reference;
+	const [left, right] = reference.split("/");
+	const projectReference = right === void 0 ? project : left;
+	const agentReference = right ?? left ?? "";
+	const searched = projectReference === void 0 ? await projectsOf(scope) : [{
+		id: await resolveProjectId(scope, projectReference),
+		slug: projectReference
+	}];
+	const found = [];
+	for (const candidate of searched) for (const agent of await agentsOfProject(scope.api, candidate.id)) if (agent.slug === agentReference || agent.name === agentReference) found.push({
+		agent,
+		project: candidate
+	});
+	const [first] = found;
+	if (first === void 0) throw new CliError(`There is no agent ${reference} you can see.`, "Name it as <project>/<agent>, or pass --project; kcloud agents list shows them.");
+	if (found.length > 1) throw new CliError(`${reference} names an agent in ${found.map(({ project }) => project.slug).join(", ")}.`, "Name it as <project>/<agent> instead.");
+	return first.agent.id;
+};
+const sameEmail = (left, right) => left.toLowerCase() === right.toLowerCase();
+const organizationMembersOf = async (api, organizationId) => dataOf("list the members of the organization", await api.GET("/organizations/{organizationId}/members", { params: { path: { organizationId } } }), organizationHints).items;
+const resolveOrganizationMember = async (api, organizationId, reference) => {
+	const found = (await organizationMembersOf(api, organizationId)).find((member) => member.id === reference.toLowerCase() || sameEmail(member.email, reference));
+	if (found === void 0) throw new CliError(`The organization has no member ${reference}.`, "kcloud orgs members list shows them.");
+	return found;
+};
+//#endregion
+//#region src/instance/config.ts
 const configFileName = "cli.json";
 const stateDirectoryName = ".kikimora-cloud";
-const profileFileOf = (homeDirectory) => join(homeDirectory, stateDirectoryName, configFileName);
+const configFileOf = (homeDirectory) => join(homeDirectory, stateDirectoryName, configFileName);
+const instanceSchema = z.strictObject({
+	token: z.string().min(1),
+	tokenId: z.string().min(1).nullable(),
+	email: z.string().min(1).nullable(),
+	organization: z.string().min(1).nullable()
+});
+const instanceStoreSchema = z.strictObject({
+	version: z.literal(2),
+	instances: z.record(z.url(), instanceSchema)
+});
 const profileSchema = z.strictObject({
 	origin: z.url(),
 	token: z.string().min(1),
@@ -2857,97 +3125,88 @@ const profileStoreSchema = z.strictObject({
 	current: z.string().min(1).nullable(),
 	profiles: z.record(z.string().min(1), profileSchema)
 });
-const emptyProfileStore = {
-	version: 1,
-	current: null,
-	profiles: {}
+const storedSchema = z.discriminatedUnion("version", [instanceStoreSchema, profileStoreSchema]);
+const emptyInstanceStore = {
+	version: 2,
+	instances: {}
 };
-const readProfileStore = async (homeDirectory) => {
-	const path = profileFileOf(homeDirectory);
+const instancesOfProfiles = ({ current, profiles }) => {
+	const currentLast = Object.entries(profiles).toSorted(([left], [right]) => Number(left === current) - Number(right === current));
+	return {
+		version: 2,
+		instances: Object.fromEntries(currentLast.map(([, { origin, token, tokenId, email }]) => [new URL(origin).origin, {
+			token,
+			tokenId,
+			email,
+			organization: null
+		}]))
+	};
+};
+const readInstanceStore = async (homeDirectory) => {
+	const path = configFileOf(homeDirectory);
 	const content = await readPrivateFile(path);
-	if (content === null) return emptyProfileStore;
+	if (content === null) return emptyInstanceStore;
 	let document;
 	try {
 		document = JSON.parse(content);
 	} catch {
 		throw new CliError(`${path} is not JSON.`, `Fix it or delete it, then log in again.`);
 	}
-	const parsed = profileStoreSchema.safeParse(document);
+	const parsed = storedSchema.safeParse(document);
 	if (!parsed.success) throw new CliError(`${path} is not what ${configFileName} should hold.`, z.prettifyError(parsed.error));
-	return parsed.data;
+	return parsed.data.version === 2 ? parsed.data : instancesOfProfiles(parsed.data);
 };
-const writeProfileStore = async (homeDirectory, store) => {
-	await writePrivateFile(profileFileOf(homeDirectory), `${JSON.stringify(store, null, 2)}\n`);
+const writeInstanceStore = async (homeDirectory, store) => {
+	await writePrivateFile(configFileOf(homeDirectory), `${JSON.stringify(store, null, 2)}\n`);
 };
-const withProfile = (store, name, profile) => ({
-	version: 1,
-	current: name,
-	profiles: {
-		...store.profiles,
-		[name]: profile
+const withInstance = (store, origin, instance) => ({
+	version: 2,
+	instances: {
+		...store.instances,
+		[origin]: instance
 	}
 });
-const withoutProfile = (store, name) => {
-	const profiles = Object.fromEntries(Object.entries(store.profiles).filter(([candidate]) => candidate !== name));
-	const remaining = Object.keys(profiles);
-	return {
-		version: 1,
-		current: store.current === name ? remaining[0] ?? null : store.current,
-		profiles
-	};
-};
-const profileNameOf = (origin) => {
-	const { hostname } = new URL(origin);
-	return hostname;
-};
+const withoutInstance = (store, origin) => ({
+	version: 2,
+	instances: Object.fromEntries(Object.entries(store.instances).filter(([candidate]) => candidate !== origin))
+});
 //#endregion
-//#region src/profile/session.ts
+//#region src/instance/session.ts
 const urlVariable = "KIKIMORA_CLOUD_URL";
 const tokenVariable = "KIKIMORA_CLOUD_TOKEN";
-const notSignedIn = () => new CliError("No instance is signed in here.", `Run kcloud login --url <origin>, or set ${urlVariable} and ${tokenVariable}.`);
-const namedProfileOf = (store, name) => {
-	const profile = store.profiles[name];
-	if (profile === void 0) {
-		const known = Object.keys(store.profiles);
-		throw new CliError(`There is no profile ${name} here.`, known.length === 0 ? "Run kcloud login --url <origin> to make one." : `kcloud profiles list shows ${known.join(", ")}.`);
-	}
-	return [name, profile];
+const organizationVariable = "KIKIMORA_CLOUD_ORG";
+const givenIn = (environment, name) => {
+	const value = environment[name]?.trim();
+	return value === void 0 || value === "" ? null : value;
 };
-const currentProfileOf = (store) => {
-	if (store.current === null) throw notSignedIn();
-	return namedProfileOf(store, store.current);
+const originFor = (settings, context) => originOf(settings.origin ?? givenIn(context.environment, "KIKIMORA_CLOUD_URL") ?? "https://cloud.kikimora.dev");
+const notSignedIn = (origin, store) => {
+	const known = Object.keys(store.instances);
+	return new CliError(`Not signed in to ${origin}.`, known.length === 0 ? "Run kcloud login (add --url for another instance)." : `Run kcloud login, or add --url for ${known.join(" or ")}.`);
 };
 const openSession = async ({ settings, context, api = createApi }) => {
-	const store = await readProfileStore(context.homeDirectory);
-	const fromEnvironment = context.environment[tokenVariable];
-	if (fromEnvironment !== void 0 && fromEnvironment !== "") {
-		const origin = settings.origin ?? context.environment["KIKIMORA_CLOUD_URL"] ?? (settings.profile === null ? store.current === null ? null : currentProfileOf(store)[1].origin : namedProfileOf(store, settings.profile)[1].origin);
-		if (origin === null || origin === "") throw new CliError(`${tokenVariable} is set without an instance to use it on.`, `Pass --url <origin> or set ${urlVariable}.`);
-		return {
-			api: api({
-				origin: originOf(origin),
-				token: fromEnvironment
-			}),
-			origin: originOf(origin),
-			profileName: null,
-			store
-		};
-	}
-	const [name, profile] = settings.profile === null ? currentProfileOf(store) : namedProfileOf(store, settings.profile);
-	const origin = originOf(settings.origin ?? profile.origin);
+	const origin = originFor(settings, context);
+	const store = await readInstanceStore(context.homeDirectory);
+	const stored = store.instances[origin] ?? null;
+	const fromEnvironment = givenIn(context.environment, tokenVariable);
+	const token = fromEnvironment ?? stored?.token ?? null;
+	if (token === null) throw notSignedIn(origin, store);
+	const organization = settings.organization ?? givenIn(context.environment, "KIKIMORA_CLOUD_ORG") ?? stored?.organization ?? null;
 	return {
-		api: api({
+		...scopeOf(api({
 			origin,
-			token: profile.token
-		}),
+			token
+		}), organization),
 		origin,
-		profileName: name,
-		store
+		token,
+		tokenFromEnvironment: fromEnvironment !== null,
+		store,
+		stored
 	};
 };
 //#endregion
 //#region src/commands/auth/account.ts
-const passwordLength = `between ${passwordSchema.minLength ?? 0} and ${passwordSchema.maxLength ?? 0} characters`;
+const passwordLength$1 = `between ${passwordSchema.minLength ?? 0} and ${passwordSchema.maxLength ?? 0} characters`;
 const createAuthCommand = (adaptersOf) => defineGroup({
 	name: "auth",
 	summary: "Your own account on this instance.",
@@ -2975,8 +3234,8 @@ const createAuthCommand = (adaptersOf) => defineGroup({
 				validate: (value) => value === "" ? "cannot be empty" : void 0
 			});
 			const newPassword = await prompt.password({
-				message: `Your new password, ${passwordLength}`,
-				validate: (value) => passwordSchema.safeParse(value).success ? void 0 : passwordLength
+				message: `Your new password, ${passwordLength$1}`,
+				validate: (value) => passwordSchema.safeParse(value).success ? void 0 : passwordLength$1
 			});
 			doneWith("change the password", await session.api.PATCH("/auth/me/password", { body: {
 				currentPassword,
@@ -3019,16 +3278,7 @@ const createAuthCommand = (adaptersOf) => defineGroup({
 });
 //#endregion
 //#region src/commands/auth/login.ts
-const usage = "login [--url <origin>] [--with-token] [--profile <name>]";
-const originFor = async (settings, context) => {
-	const given = settings.origin ?? context.environment["KIKIMORA_CLOUD_URL"];
-	if (given !== void 0 && given !== "") return originOf(given);
-	const store = await readProfileStore(context.homeDirectory);
-	const named = settings.profile ?? store.current;
-	const known = named === null ? void 0 : store.profiles[named];
-	if (known !== void 0) return originOf(known.origin);
-	throw new UsageError("login needs the address of an instance.", `Pass --url <origin> or set ${urlVariable}.`);
-};
+const usage = "login [--url <origin>] [--with-token]";
 const isTerminal$2 = (stream) => stream.isTTY === true;
 const pipedText$2 = async (context) => {
 	if (isTerminal$2(context.io.stdin)) return "";
@@ -3037,8 +3287,8 @@ const pipedText$2 = async (context) => {
 	return Buffer.concat(chunks).toString("utf8").trim();
 };
 const readToken = async (context, settings) => {
-	const fromEnvironment = context.environment[tokenVariable];
-	if (fromEnvironment !== void 0 && fromEnvironment !== "") return fromEnvironment;
+	const fromEnvironment = givenIn(context.environment, tokenVariable);
+	if (fromEnvironment !== null) return fromEnvironment;
 	const piped = await pipedText$2(context);
 	if (piped !== "") return piped;
 	if (settings.yes) throw new UsageError("login --with-token found no token to use.", `Pipe it on stdin or set ${tokenVariable}.`);
@@ -3046,9 +3296,13 @@ const readToken = async (context, settings) => {
 };
 const createLoginCommand = (adaptersOf) => defineCommand({
 	name: "login",
-	summary: "Sign in to an instance and save its token in a profile.",
+	summary: "Sign in to an instance and save its token for its address.",
 	usage,
-	optionsUsage: [["--with-token", "take a token from stdin or the environment instead of a browser"], ["", `the address comes from --url or ${urlVariable}, the token of --with-token from stdin or ${tokenVariable}`]],
+	optionsUsage: [
+		["--with-token", "take a token from stdin or the environment instead of a browser"],
+		["", `the address comes from --url or ${urlVariable}, or is ${defaultOrigin}`],
+		["", `the token of --with-token comes from stdin or ${tokenVariable}`]
+	],
 	options: { "with-token": {
 		type: "boolean",
 		default: false
@@ -3059,7 +3313,7 @@ const createLoginCommand = (adaptersOf) => defineCommand({
 	},
 	run: async ({ values, settings, context }) => {
 		const adapters = adaptersOf(context);
-		const origin = await originFor(settings, context);
+		const origin = originFor(settings, context);
 		const prompt = adapters.prompter(settings);
 		const anonymous = adapters.api({
 			origin,
@@ -3079,16 +3333,16 @@ const createLoginCommand = (adaptersOf) => defineCommand({
 		const me = dataOf("say who the token belongs to", await identified.GET("/auth/me"));
 		await save({
 			context,
-			settings,
 			origin,
 			secret,
 			me
 		});
 		const version = await instanceVersion(identified);
-		prompt.outro(`Signed in to ${origin} as ${me.email}${version === null ? "" : ` on ${version}`}.`);
+		prompt.outro(`Signed in to ${origin} as ${me.email} of ${me.organization.name}${version === null ? "" : ` on ${version}`}.`);
 		if (settings.json) context.terminal.json({
 			origin,
 			email: me.email,
+			organization: me.organization.slug,
 			version
 		});
 		return exitCodes.ok;
@@ -3124,14 +3378,14 @@ const authorizeInBrowser = async ({ adapters, api, origin, prompt }) => {
 		}
 	}
 };
-const save = async ({ context, settings, origin, secret, me }) => {
-	const store = await readProfileStore(context.homeDirectory);
-	const name = settings.profile ?? profileNameOf(origin);
-	await writeProfileStore(context.homeDirectory, withProfile(store, name, {
-		origin,
+const save = async ({ context, origin, secret, me }) => {
+	const store = await readInstanceStore(context.homeDirectory);
+	const previous = store.instances[origin];
+	await writeInstanceStore(context.homeDirectory, withInstance(store, origin, {
 		token: secret,
 		tokenId: null,
-		email: me.email
+		email: me.email,
+		organization: previous?.email === me.email ? previous.organization : null
 	}));
 };
 const instanceVersion = async (api) => {
@@ -3140,11 +3394,15 @@ const instanceVersion = async (api) => {
 };
 //#endregion
 //#region src/commands/auth/logout.ts
+const outcomeOf = (session, kept) => {
+	if (session.tokenFromEnvironment) return kept ? `${tokenVariable} signs in to ${session.origin}, so nothing is stored here to forget.` : `Revoked the token of ${tokenVariable} on ${session.origin}.`;
+	return kept ? `Forgot ${session.origin} here. Its token is still usable.` : `Revoked the token of ${session.origin} and forgot it here.`;
+};
 const createLogoutCommand = (adaptersOf) => defineCommand({
 	name: "logout",
-	summary: "Revoke the token of a profile and forget it.",
-	usage: "logout [--keep-token]",
-	optionsUsage: [["--keep-token", "forget the profile here and leave its token usable elsewhere"]],
+	summary: "Revoke the token of an instance and forget it here.",
+	usage: "logout [--url <origin>] [--keep-token]",
+	optionsUsage: [["--keep-token", "forget the instance here and leave its token usable elsewhere"]],
 	options: { "keep-token": {
 		type: "boolean",
 		default: false
@@ -3160,12 +3418,10 @@ const createLogoutCommand = (adaptersOf) => defineCommand({
 			context,
 			api: adapters.api
 		});
-		if (!values["keep-token"]) doneWith("revoke the token", await session.api.POST("/auth/logout"));
-		if (session.profileName !== null) {
-			const store = await readProfileStore(context.homeDirectory);
-			await writeProfileStore(context.homeDirectory, withoutProfile(store, session.profileName));
-		}
-		context.terminal.line(values["keep-token"] ? `Forgot ${session.origin} here; its token is still usable.` : `Revoked the token of ${session.origin} and forgot it here.`);
+		const kept = values["keep-token"];
+		if (!kept) doneWith("revoke the token", await session.api.POST("/auth/logout"));
+		if (!session.tokenFromEnvironment) await writeInstanceStore(context.homeDirectory, withoutInstance(session.store, session.origin));
+		context.terminal.line(outcomeOf(session, kept));
 		return exitCodes.ok;
 	}
 });
@@ -3228,9 +3484,10 @@ const createVersionCommand = (adaptersOf, cliVersion) => defineCommand({
 });
 //#endregion
 //#region src/commands/auth/whoami.ts
+const organizationNameOf = ({ name, slug }) => `${name} (${slug})`;
 const createWhoamiCommand = (adaptersOf) => defineCommand({
 	name: "whoami",
-	summary: "Say which instance and which account the token belongs to.",
+	summary: "Say which instance, account and organization kcloud acts with.",
 	usage: "whoami",
 	options: {},
 	positionals: {
@@ -3244,20 +3501,23 @@ const createWhoamiCommand = (adaptersOf) => defineCommand({
 			context,
 			api: adapters.api
 		});
-		const me = dataOf("say who the token belongs to", await session.api.GET("/auth/me"));
+		const me = await session.me();
+		const actsIn = await session.organization();
 		if (settings.json) {
 			context.terminal.json({
 				origin: session.origin,
-				profile: session.profileName,
-				...me
+				...me,
+				actsIn
 			});
 			return exitCodes.ok;
 		}
 		context.terminal.line(renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 			["instance", session.origin],
-			["profile", session.profileName ?? "the environment"],
 			["email", me.email],
-			["role", me.role],
+			["organization", organizationNameOf(me.organization)],
+			["role", me.organizationRole],
+			["platform admin", me.platformAdmin ? "yes" : "no"],
+			["acts in", organizationNameOf(actsIn)],
 			["locale", me.locale]
 		]));
 		return exitCodes.ok;
@@ -3274,6 +3534,9 @@ const runOf = async (adaptersOf, { settings, context }) => {
 	});
 	return {
 		api: session.api,
+		me: session.me,
+		organizations: session.organizations,
+		organization: session.organization,
 		origin: session.origin,
 		adapters,
 		prompt: adapters.prompter(settings),
@@ -3282,40 +3545,6 @@ const runOf = async (adaptersOf, { settings, context }) => {
 	};
 };
 //#endregion
-//#region src/resolve.ts
-const isId = (reference) => idSchema.safeParse(reference).success;
-const matches = (reference, project) => project.slug === reference || project.name === reference;
-const projectsOf = async (api) => dataOf("list the projects", await api.GET("/projects")).items;
-const resolveProjectId = async (api, reference) => {
-	if (isId(reference)) return reference;
-	const projects = await projectsOf(api);
-	const found = projects.filter((project) => matches(reference, project));
-	const [first] = found;
-	if (first === void 0) throw new CliError(`There is no project ${reference} you can see.`, projects.length === 0 ? "kcloud projects list shows the projects you are a member of." : `kcloud projects list shows ${projects.map(({ slug }) => slug).join(", ")}.`);
-	if (found.length > 1) throw new CliError(`${reference} names ${found.length} projects.`, "Name it by its slug or by its id instead.");
-	return first.id;
-};
-const agentsOfProject = async (api, projectId) => dataOf("list the agents of the project", await api.GET("/projects/{id}/agents", { params: { path: { id: projectId } } })).items;
-const resolveAgentId = async (api, reference, project) => {
-	if (isId(reference)) return reference;
-	const [left, right] = reference.split("/");
-	const projectReference = right === void 0 ? project : left;
-	const agentReference = right ?? left ?? "";
-	const searched = projectReference === void 0 ? await projectsOf(api) : [{
-		id: await resolveProjectId(api, projectReference),
-		slug: projectReference
-	}];
-	const found = [];
-	for (const candidate of searched) for (const agent of await agentsOfProject(api, candidate.id)) if (agent.slug === agentReference || agent.name === agentReference) found.push({
-		agent,
-		project: candidate
-	});
-	const [first] = found;
-	if (first === void 0) throw new CliError(`There is no agent ${reference} you can see.`, "Name it as <project>/<agent>, or pass --project; kcloud agents list shows them.");
-	if (found.length > 1) throw new CliError(`${reference} names an agent in ${found.map(({ project }) => project.slug).join(", ")}.`, "Name it as <project>/<agent> instead.");
-	return first.agent.id;
-};
-//#endregion
 //#region src/commands/agents/shared.ts
 const agentOption = { project: { type: "string" } };
 const agentUsage = [["--project <name>", "the project of the agent, when the agent is named alone"]];
@@ -3324,11 +3553,12 @@ const agentHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
-	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry."
+	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
+	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen."
 };
 const agentFrom = async (run, reference, project) => {
 	if (reference === void 0 || reference === "") throw new UsageError("This command needs an agent.", "Name it as <project>/<agent>, or pass --project.");
-	return resolveAgentId(run.api, reference, project);
+	return resolveAgentId(run, reference, project);
 };
 //#endregion
 //#region src/commands/agents/check.ts
@@ -3403,6 +3633,7 @@ const agentPlanOf = (agent) => ({
 	slug: agent.slug,
 	description: agent.description,
 	kikimoraVersion: agent.kikimoraVersion,
+	...agent.node === null ? {} : { nodeId: agent.node.id },
 	claudeCredentialId: agent.claudeCredential.id,
 	githubCredentialId: agent.githubCredential.id,
 	repositories: agent.repositories.map(({ repositoryId, directory }) => ({
@@ -3420,17 +3651,17 @@ const agentPlanOf = (agent) => ({
 });
 //#endregion
 //#region src/commands/agents/config.ts
-const agentsOf = async (api, project) => {
-	const projects = project === void 0 ? (await projectsOf(api)).map(({ id, slug }) => ({
+const agentsOf = async (scope, project) => {
+	const projects = project === void 0 ? (await projectsOf(scope)).map(({ id, slug }) => ({
 		id,
 		slug
 	})) : [{
-		id: await resolveProjectId(api, project),
+		id: await resolveProjectId(scope, project),
 		slug: project
 	}];
 	const listed = [];
 	for (const { id, slug } of projects) {
-		const { items } = dataOf("list the agents of the project", await api.GET("/projects/{id}/agents", { params: { path: { id } } }), agentHints);
+		const { items } = dataOf("list the agents of the project", await scope.api.GET("/projects/{id}/agents", { params: { path: { id } } }), agentHints);
 		for (const agent of items) listed.push({
 			project: slug,
 			...agent
@@ -3463,7 +3694,7 @@ const configCommands = (adaptersOf) => [
 		},
 		run: async (invocation) => {
 			const run = await runOf(adaptersOf, invocation);
-			const listed = await agentsOf(run.api, invocation.values.project);
+			const listed = await agentsOf(run, invocation.values.project);
 			return printed(run, listed, (items) => items.length === 0 ? "There is no agent here yet; kcloud agents create makes one." : renderTable([
 				{ header: "PROJECT" },
 				{ header: "AGENT" },
@@ -3581,6 +3812,7 @@ const detailsOf = (agent) => [
 		["wanted", agent.desiredState],
 		["observed", agent.observedState],
 		["release", agent.kikimoraVersion],
+		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
 		["timezone", agent.timezone],
 		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
 		["docker", agent.machine.docker ? "yes" : "no"],
@@ -3605,6 +3837,272 @@ const detailsOf = (agent) => [
 	]))
 ].join("\n");
 //#endregion
+//#region src/commands/nodes.ts
+const nodeHints = {
+	...organizationHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.name_taken": "Another node of the organization has that name.",
+	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
+};
+const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
+const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
+const nodeIn = (nodes, reference, organization) => {
+	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
+	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
+	return found;
+};
+const resolveNode = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return {
+		organizationId: organization.id,
+		nodeId: reference
+	};
+	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
+	return {
+		organizationId: organization.id,
+		nodeId: node.id
+	};
+};
+const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const createdNode = async (api, organizationId, name) => {
+	const body = { name };
+	validated(createNodeBodySchema, body, "a node");
+	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+		params: { path: { organizationId } },
+		body
+	}), nodeHints);
+};
+const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const deleteNode = async (api, { organizationId, nodeId }) => {
+	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+		organizationId,
+		nodeId
+	} } }), nodeHints);
+};
+const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
+const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
+const capabilitiesOf = (node) => {
+	if (node.capabilities === null) return "-";
+	const { sandbox, uidIsolation } = node.capabilities;
+	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
+};
+const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
+const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const runtimeRowsOf = (runtime) => [
+	["reported", runtime.reportedAt],
+	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
+	["data storage", storageOf(runtime.storage.data)],
+	["engine storage", storageOf(runtime.storage.engine)],
+	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
+	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
+	["monitor slots", `${runtime.sessions.monitor.inUse} of ${runtime.sessions.monitor.effective} in use`],
+	["executor slots", `${runtime.sessions.executor.inUse} of ${runtime.sessions.executor.effective} in use`],
+	["log readers", String(runtime.ingest.readers)]
+];
+const nodeDetailsText = (node) => [
+	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+		["name", node.name],
+		["state", node.state],
+		["provider", node.provider],
+		["engine", node.engine ?? "-"],
+		["version", node.version ?? "-"],
+		["host", hostOf(node)],
+		["server", node.host?.serverVersion ?? "-"],
+		["data root", node.host?.dataRoot ?? "-"],
+		["capabilities", capabilitiesOf(node)],
+		["registration", registrationOf(node)],
+		["connected", node.connectedAt ?? "never"],
+		["last seen", node.lastSeenAt ?? "never"],
+		["created", node.createdAt],
+		["id", node.id]
+	]),
+	"",
+	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "STATE" },
+		{ header: "ID" }
+	], node.agents.map((agent) => [
+		agent.projectName,
+		agent.slug,
+		agent.state,
+		agent.id
+	])),
+	"",
+	node.runtime === null ? "The node has reported no runtime yet." : renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime))
+].join("\n");
+const startHintOf = (origin) => [
+	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
+	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
+	"On a Windows PC:",
+	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+].join("\n");
+const printedRegistration = (run, created) => {
+	if (run.settings.json) {
+		run.context.terminal.json(created);
+		return exitCodes.ok;
+	}
+	run.context.terminal.line(created.registration.token);
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	return exitCodes.ok;
+};
+const nodeUsage = [["", "a node is named by its name or its id"]];
+const createNodesCommand = (adaptersOf) => defineGroup({
+	name: "nodes",
+	summary: "The nodes of the organization, the hosts its agents run on.",
+	usage: "nodes <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the nodes of the organization.",
+			usage: "nodes list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await nodesOf(run.api, organization.id);
+				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "STATE" },
+					{ header: "ENGINE" },
+					{ header: "VERSION" },
+					{
+						header: "AGENTS",
+						align: "right"
+					},
+					{ header: "LAST SEEN" },
+					{ header: "ID" }
+				], nodes.map((node) => [
+					node.name,
+					node.state,
+					node.engine ?? "-",
+					node.version ?? "-",
+					String(node.agentCount),
+					node.lastSeenAt ?? "never",
+					node.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a node with its host, the agents placed on it and its runtime.",
+			usage: "nodes show <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
+			}
+		}),
+		defineCommand({
+			name: "create",
+			summary: "Create a node and print its one-time registration token.",
+			usage: "nodes create <name>",
+			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "token",
+			summary: "Issue a new registration token for a node that has not joined yet.",
+			usage: "nodes token <node>",
+			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printedRegistration(run, await renewedRegistration(run.api, reference));
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a node that runs no agent.",
+			usage: "nodes delete <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+				});
+				await deleteNode(run.api, reference);
+				return said(run, `Deleted the node ${given}.`);
+			}
+		})
+	]
+});
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+};
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
+//#region src/commands/agents/placement.ts
+const placedNodeId = async (run, { projectId, given, ask }) => {
+	const project = await projectOf(run.api, projectId);
+	const organization = `the organization of ${project.slug}`;
+	const nodes = await nodesOf(run.api, project.organizationId);
+	if (given !== void 0) return nodeIn(nodes, given, organization).id;
+	const [only, ...others] = nodes;
+	if (only === void 0) throw new CliError(`The organization of ${project.slug} has no node to run the agent on.`, "kcloud nodes create <name> creates one, and its host joins with the token it prints.");
+	if (others.length === 0) {
+		run.context.terminal.error(`The agent runs on ${only.name}, the only node of ${organization}.`);
+		return only.id;
+	}
+	if (ask) return run.prompt.select({
+		message: "The node it runs on",
+		choices: nodes.map((node) => ({
+			value: node.id,
+			label: node.name,
+			hint: node.state
+		}))
+	});
+	throw new UsageError(`agents create needs --node <name>, because ${organization} has ${nodes.length} nodes.`, `The nodes are ${nodes.map(({ name }) => name).join(", ")}.`);
+};
+//#endregion
 //#region src/commands/agents/create.ts
 const claudeKinds = /* @__PURE__ */ new Set(["anthropic_api_key", "claude_oauth_token"]);
 const catalogueOf = async (api, projectId) => {
@@ -3708,6 +4206,11 @@ const promptText = async (run, file, question) => {
 };
 const localTimezone = () => Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
 const askedPlan = async (run, projectId, values) => {
+	const nodeId = await placedNodeId(run, {
+		projectId,
+		given: values.node,
+		ask: !run.settings.yes
+	});
 	const catalogue = await catalogueOf(run.api, projectId);
 	const name = values.name ?? await run.prompt.text({
 		message: "The name of the agent",
@@ -3725,6 +4228,7 @@ const askedPlan = async (run, projectId, values) => {
 		name,
 		description: "",
 		kikimoraVersion: release,
+		nodeId,
 		claudeCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => claudeKinds.has(kind), "The Claude credential it works with"),
 		githubCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => kind === "github_pat", "The GitHub credential it clones with"),
 		repositories: [...await chosenRepositories(run.prompt, catalogue)],
@@ -3743,17 +4247,27 @@ const askedPlan = async (run, projectId, values) => {
 		}
 	};
 };
-const fileOf = async (run, file) => {
+const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
+const fileOf = async (run, projectId, { file, node }) => {
 	const document = await documentOf(run, file);
-	validated(createAgentBodySchema, document, "an agent");
-	return document;
+	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
+		...document,
+		nodeId: await placedNodeId(run, {
+			projectId,
+			given: node,
+			ask: false
+		})
+	};
+	validated(createAgentBodySchema, placed, "an agent");
+	return placed;
 };
 const createCommand = (adaptersOf) => defineCommand({
 	name: "create",
 	summary: "Create an agent from a file, from flags, or by asking step by step.",
-	usage: "agents create --project <name> [--file <path>] [--name <name>]",
+	usage: "agents create --project <name> [--node <node>] [--file <path>] [--name <name>]",
 	optionsUsage: [
 		["--project <name>", "the project that owns the agent"],
+		["--node <node>", "the node it runs on, by name or id; needed when the organization has several"],
 		["--file <path>", "the whole agent as JSON, or - to read stdin"],
 		["--name <name>", "the name of the agent, instead of asking"],
 		["--release <x.y.z>", "the Kikimora release it runs, instead of asking"],
@@ -3762,11 +4276,13 @@ const createCommand = (adaptersOf) => defineCommand({
 		["--timezone <zone>", "the timezone of the agent (default: this machine's)"],
 		["--docker", "give the agent a Docker sidecar, when the project allows it"],
 		["--browser", "give the agent a browser"],
-		["", "kcloud agents show <agent> --as-file prints what --file takes"]
+		["", "kcloud agents show <agent> --as-file prints what --file takes"],
+		["", "--node replaces the nodeId of the file"]
 	],
 	options: {
 		...fileOptions,
 		project: { type: "string" },
+		node: { type: "string" },
 		name: { type: "string" },
 		release: { type: "string" },
 		"monitor-prompt-file": { type: "string" },
@@ -3789,8 +4305,11 @@ const createCommand = (adaptersOf) => defineCommand({
 		const { values } = invocation;
 		const run = await runOf(adaptersOf, invocation);
 		if (values.project === void 0) throw new UsageError("agents create needs --project <name>.", "kcloud projects list shows the projects you are a member of.");
-		const projectId = await resolveProjectId(run.api, values.project);
-		const body = values.file === void 0 ? await askedPlan(run, projectId, values) : await fileOf(run, values.file);
+		const projectId = await resolveProjectId(run, values.project);
+		const body = values.file === void 0 ? await askedPlan(run, projectId, values) : await fileOf(run, projectId, {
+			file: values.file,
+			node: values.node
+		});
 		const agent = dataOf("create the agent", await run.api.POST("/projects/{id}/agents", {
 			params: { path: { id: projectId } },
 			body
@@ -3897,10 +4416,10 @@ const pageOptions = {
 };
 const allUsage = ["--all", "follow the cursor to the end instead of one page"];
 const pageUsage = [["--limit <n>", `how many rows (default: 50)`], allUsage];
-const dayOf = (date) => date.toISOString().slice(0, 10);
+const dayOf$1 = (date) => date.toISOString().slice(0, 10);
 const costWindowOf = (days, now) => ({
-	from: dayOf(/* @__PURE__ */ new Date(now.getTime() - (days - 1) * 24 * 60 * 6e4)),
-	to: dayOf(now)
+	from: dayOf$1(/* @__PURE__ */ new Date(now.getTime() - (days - 1) * 24 * 60 * 6e4)),
+	to: dayOf$1(now)
 });
 const windowFrom = (days, now) => {
 	const span = days === void 0 ? 7 : Number(days);
@@ -4334,17 +4853,6 @@ const streamFrames = async (request) => {
 	}
 };
 //#endregion
-//#region src/profile/token.ts
-const tokenOf = async ({ settings, context }) => {
-	const fromEnvironment = context.environment[tokenVariable];
-	if (fromEnvironment !== void 0 && fromEnvironment !== "") return fromEnvironment;
-	const store = await readProfileStore(context.homeDirectory);
-	const name = settings.profile ?? store.current;
-	const profile = name === null ? void 0 : store.profiles[name];
-	if (profile === void 0) throw new CliError("No instance is signed in here.", "Run kcloud login --url <origin> first.");
-	return profile.token;
-};
-//#endregion
 //#region src/commands/agents/streams.ts
 const streamOptions = {
 	...agentOption,
@@ -4397,15 +4905,12 @@ const streamCommands = (adaptersOf) => [{
 			api: adapters.api
 		});
 		const reference = positionals[0] ?? "";
-		const agentId = await resolveAgentId(session.api, reference, values.project);
+		const agentId = await resolveAgentId(session, reference, values.project);
 		const limit = values.limit;
 		if (limit !== void 0 && !/^[0-9]+$/u.test(limit)) throw new UsageError(`--limit ${limit} is not a whole number.`);
 		await streamFrames({
 			origin: session.origin,
-			token: await tokenOf({
-				settings,
-				context
-			}),
+			token: session.token,
 			path: path.replace("{id}", encodeURIComponent(agentId)),
 			query: {
 				...values.since === void 0 ? {} : { since: values.since },
@@ -4601,7 +5106,7 @@ const pipedText = async (stream) => {
 	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
 	return Buffer.concat(chunks).toString("utf8");
 };
-const secretOf = async ({ run, file, fromStdin = false, question, variable = secretVariable }) => {
+const secretOf = async ({ run, file, fromStdin = false, question, variable = secretVariable, stdinHint = "Pipe the secret in, or drop --secret-stdin to be asked for it." }) => {
 	if (file !== void 0) {
 		const path = resolve(run.context.workingDirectory, file);
 		try {
@@ -4611,7 +5116,7 @@ const secretOf = async ({ run, file, fromStdin = false, question, variable = sec
 		}
 	}
 	if (fromStdin) {
-		if (isTerminal(run.context.io.stdin)) throw new UsageError("Nothing is piped on stdin.", "Pipe the secret in, or drop --secret-stdin to be asked for it.");
+		if (isTerminal(run.context.io.stdin)) throw new UsageError("Nothing is piped on stdin.", stdinHint);
 		return (await pipedText(run.context.io.stdin)).trim();
 	}
 	const fromEnvironment = run.context.environment[variable];
@@ -4646,7 +5151,7 @@ const credentialHints = {
 };
 const projectFrom$2 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
-	return resolveProjectId(run.api, given);
+	return resolveProjectId(run, given);
 };
 const credentialsOf = async (api, projectId) => dataOf("list the credentials of the project", await api.GET("/projects/{id}/credentials", { params: { path: { id: projectId } } }), credentialHints).items;
 const resolveCredentialId = async (api, projectId, reference) => {
@@ -5020,17 +5525,18 @@ const accountTools = [
 	defineTool({
 		name: "whoami",
 		title: "Who am I",
-		description: "Say which instance and which account this server acts as, and whether the version of kcloud matches the version of the instance.",
+		description: "Say which instance, account and organization this server acts with, and whether the version of kcloud matches the version of the instance.",
 		operations: ["getMe", "getPlatformVersion"],
 		safety: "read",
 		input: z.object({}),
 		run: async (_, run) => {
-			const me = dataOf("say who the token belongs to", await run.api.GET("/auth/me"));
+			const user = await run.me();
+			const actsIn = await run.organization();
 			const platform = dataOf("say which version it runs", await run.api.GET("/version"));
 			return {
 				origin: run.origin,
-				profile: run.profileName,
-				user: me,
+				user,
+				actsIn,
 				kcloud: run.kcloudVersion,
 				instance: platform.version,
 				matched: platform.version === run.kcloudVersion
@@ -5084,8 +5590,8 @@ const windowOfPage = ({ limit, all }, fallback = 50) => ({
 	limit: limit ?? fallback,
 	all
 });
-const projectIdOf = (run, project) => resolveProjectId(run.api, project);
-const agentIdOf = (run, { agent, project }) => resolveAgentId(run.api, agent, project);
+const projectIdOf = (run, project) => resolveProjectId(run, project);
+const agentIdOf = (run, { agent, project }) => resolveAgentId(run, agent, project);
 //#endregion
 //#region src/mcp/tools/agents.ts
 const actionOn = async (run, agentId, action, force) => dataOf(`${action} the agent`, await run.api.POST("/agents/{id}/actions/{action}", {
@@ -5103,7 +5609,7 @@ const agentTools = [
 		operations: ["listAgents"],
 		safety: "read",
 		input: z.object({ project: projectField.optional().describe("One project instead of all of them.") }),
-		run: async ({ project }, run) => agentsOf(run.api, project)
+		run: async ({ project }, run) => agentsOf(run, project)
 	}),
 	defineTool({
 		name: "agent_show",
@@ -5123,7 +5629,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_create",
 		title: "Create an agent",
-		description: "Create an agent in a project. The credentials, repositories and tools are named by the ids that credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
+		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
 		operations: ["createAgent"],
 		safety: "write",
 		input: z.object({
@@ -5288,11 +5794,47 @@ const credentialTools = [
 	})
 ];
 //#endregion
-//#region src/commands/notifications.ts
-const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
-const createNotificationsCommand = (adaptersOf) => defineGroup({
-	name: "notifications",
-	summary: "What the instance wants you to look at.",
+//#region src/mcp/tools/nodes.ts
+const nodeField = z.string().trim().min(1).describe("The node, by its name or its id, from nodes_list.");
+const nodeTools = [
+	defineTool({
+		name: "nodes_list",
+		title: "List nodes",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version and agent count.",
+		operations: ["listNodes"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => nodesOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "node_show",
+		title: "Show a node",
+		description: "Show one node with its host, its capabilities, the agents placed on it and the runtime it reported last.",
+		operations: ["getNode"],
+		safety: "read",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
+	}),
+	defineTool({
+		name: "node_delete",
+		title: "Delete a node",
+		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
+		operations: ["deleteNode"],
+		safety: "destructive",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			await deleteNode(run.api, reference);
+			return { deleted: reference.nodeId };
+		}
+	})
+];
+//#endregion
+//#region src/commands/notifications.ts
+const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
+const createNotificationsCommand = (adaptersOf) => defineGroup({
+	name: "notifications",
+	summary: "What the instance wants you to look at.",
 	usage: "notifications <command>",
 	subcommands: [
 		defineCommand({
@@ -5391,10 +5933,7 @@ const createNotificationsCommand = (adaptersOf) => defineGroup({
 				});
 				await streamFrames({
 					origin: session.origin,
-					token: await tokenOf({
-						settings,
-						context
-					}),
+					token: session.token,
 					path: "/notifications/stream",
 					follow: true,
 					action: "follow the notifications",
@@ -5649,6 +6188,534 @@ const observabilityTools = [
 	})
 ];
 //#endregion
+//#region src/commands/roles.ts
+const roleOption = { role: { type: "string" } };
+const roleUsage = ["--role <role>", "admin or member"];
+const roleFrom = (given, command) => {
+	if (given === void 0) throw new UsageError(`${command} needs --role admin or --role member.`);
+	const parsed = organizationRoleSchema.safeParse(given);
+	if (!parsed.success) throw new UsageError(`--role ${given} is not a role.`, "The roles are admin and member.");
+	return parsed.data;
+};
+const asRole = (role) => role === "admin" ? "an admin" : "a member";
+//#endregion
+//#region src/commands/orgs/members.ts
+const memberHints = {
+	...organizationHints,
+	"user.not_found": "kcloud orgs members list shows them.",
+	"user.email_taken": "An account with that e-mail exists already.",
+	"user.cannot_modify_self": "Another admin of the organization has to make that change.",
+	"user.last_admin": "Make another member an admin first.",
+	"auth.forbidden": "Changing the members of an organization takes an admin of it."
+};
+const passwordLength = `between ${passwordSchema.minLength ?? 0} and ${passwordSchema.maxLength ?? 0} characters`;
+const memberPath = (organizationId, userId) => ({ params: { path: {
+	organizationId,
+	userId
+} } });
+const memberRoleChanged = async (api, organizationId, userId, role) => dataOf("change the role of the member", await api.PATCH("/organizations/{organizationId}/members/{userId}", {
+	...memberPath(organizationId, userId),
+	body: { organizationRole: role }
+}), memberHints);
+const memberDisabled = async (api, organizationId, userId) => dataOf("disable the member", await api.POST("/organizations/{organizationId}/members/{userId}/disable", memberPath(organizationId, userId)), memberHints);
+const memberEnabled = async (api, organizationId, userId) => dataOf("enable the member", await api.POST("/organizations/{organizationId}/members/{userId}/enable", memberPath(organizationId, userId)), memberHints);
+const passwordReset = async (api, organizationId, userId) => dataOf("reset the password of the member", await api.POST("/organizations/{organizationId}/members/{userId}/reset-password", memberPath(organizationId, userId)), memberHints);
+const chosenMember$1 = async (run, reference) => {
+	const organization = await run.organization();
+	return {
+		organization,
+		member: await resolveOrganizationMember(run.api, organization.id, reference)
+	};
+};
+const localeFrom = (given) => {
+	if (given === void 0) return "en";
+	const parsed = localeSchema.safeParse(given);
+	if (!parsed.success) throw new UsageError(`--locale ${given} is not a language of the panel.`, "The languages are en and pl.");
+	return parsed.data;
+};
+const initialPasswordOf = async (run, source) => {
+	const file = source["initial-password-file"];
+	const fromStdin = source["initial-password-stdin"];
+	if (file === void 0 && !fromStdin) return null;
+	const password = await secretOf({
+		run,
+		file,
+		fromStdin,
+		question: "The initial password",
+		stdinHint: "Pipe the password in, or drop --initial-password-stdin."
+	});
+	if (!passwordSchema.safeParse(password).success) throw new UsageError(`The initial password is not ${passwordLength}.`);
+	return password;
+};
+const printedPassword = (run, password, note) => {
+	run.context.terminal.line(password);
+	run.context.terminal.error(note);
+	return exitCodes.ok;
+};
+const memberUsage = [["", "the member is named by e-mail or id"]];
+const organizationMembersCommand = (adaptersOf) => defineGroup({
+	name: "members",
+	summary: "The people of the organization kcloud acts in.",
+	usage: "orgs members <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the members of the organization.",
+			usage: "orgs members list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { id } = await run.organization();
+				const items = await organizationMembersOf(run.api, id);
+				return printed(run, items, (members) => renderTable([
+					{ header: "EMAIL" },
+					{ header: "ROLE" },
+					{ header: "STATUS" },
+					{ header: "LAST SIGN-IN" },
+					{ header: "ID" }
+				], members.map((member) => [
+					member.email,
+					member.platformAdmin ? `${member.organizationRole}, platform admin` : member.organizationRole,
+					member.status,
+					member.lastLoginAt ?? "never",
+					member.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "add",
+			summary: "Add a person to the organization, printing a temporary password once.",
+			usage: "orgs members add --email <email> --role <role> [--locale <locale>] [--initial-password-file <path> | --initial-password-stdin]",
+			optionsUsage: [
+				["--email <email>", "the e-mail the person signs in with"],
+				roleUsage,
+				["--locale <locale>", "the language of the panel for them, en or pl (default: en)"],
+				["--initial-password-file <path>", "read the first password from a file"],
+				["--initial-password-stdin", "read the first password from stdin"],
+				["", "a password is never taken from a flag"],
+				["", "without one the instance makes a temporary password and kcloud prints it"]
+			],
+			options: {
+				email: { type: "string" },
+				...roleOption,
+				locale: { type: "string" },
+				"initial-password-file": { type: "string" },
+				"initial-password-stdin": {
+					type: "boolean",
+					default: false
+				}
+			},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const email = values.email;
+				if (email === void 0) throw new UsageError("orgs members add needs --email <email>.");
+				const role = roleFrom(values.role, "orgs members add");
+				const locale = localeFrom(values.locale);
+				if (values["initial-password-file"] !== void 0 && values["initial-password-stdin"]) throw new UsageError("Pass --initial-password-file or --initial-password-stdin, not both.");
+				const run = await runOf(adaptersOf, invocation);
+				const initialPassword = await initialPasswordOf(run, values);
+				const body = {
+					email,
+					organizationRole: role,
+					locale,
+					...initialPassword === null ? {} : { initialPassword }
+				};
+				validated(createUserBodySchema, body, "a new member");
+				const organization = await run.organization();
+				const created = dataOf("add the member", await run.api.POST("/organizations/{organizationId}/members", {
+					params: { path: { organizationId: organization.id } },
+					body
+				}), memberHints);
+				if (run.settings.json) {
+					run.context.terminal.json(created);
+					return exitCodes.ok;
+				}
+				const added = `Added ${created.user.email} to ${organization.slug} as ${asRole(role)}.`;
+				return created.temporaryPassword === null ? said(run, added) : printedPassword(run, created.temporaryPassword, `${added} The temporary password is shown only here.`);
+			}
+		}),
+		defineCommand({
+			name: "set-role",
+			summary: "Make a member an admin of the organization, or a member again.",
+			usage: "orgs members set-role <member> --role <role>",
+			optionsUsage: [roleUsage, ...memberUsage],
+			options: roleOption,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const role = roleFrom(invocation.values.role, "orgs members set-role");
+				const run = await runOf(adaptersOf, invocation);
+				const { organization, member } = await chosenMember$1(run, invocation.positionals[0] ?? "");
+				const user = await memberRoleChanged(run.api, organization.id, member.id, role);
+				return printed(run, user, (shown) => `${shown.email} is ${asRole(shown.organizationRole)} of ${organization.slug} now.`);
+			}
+		}),
+		defineCommand({
+			name: "disable",
+			summary: "Stop a member from signing in, keeping the account.",
+			usage: "orgs members disable <member>",
+			optionsUsage: memberUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { organization, member } = await chosenMember$1(run, invocation.positionals[0] ?? "");
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Disable ${member.email}? The account cannot sign in until it is enabled again.`
+				});
+				const user = await memberDisabled(run.api, organization.id, member.id);
+				return printed(run, user, (shown) => `Disabled ${shown.email}.`);
+			}
+		}),
+		defineCommand({
+			name: "enable",
+			summary: "Let a disabled member sign in again.",
+			usage: "orgs members enable <member>",
+			optionsUsage: memberUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { organization, member } = await chosenMember$1(run, invocation.positionals[0] ?? "");
+				const user = await memberEnabled(run.api, organization.id, member.id);
+				return printed(run, user, (shown) => `Enabled ${shown.email}.`);
+			}
+		}),
+		defineCommand({
+			name: "reset-password",
+			summary: "Give a member a new temporary password and print it once.",
+			usage: "orgs members reset-password <member>",
+			optionsUsage: memberUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { organization, member } = await chosenMember$1(run, invocation.positionals[0] ?? "");
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Reset the password of ${member.email}? The current one stops working.`
+				});
+				const reset = await passwordReset(run.api, organization.id, member.id);
+				if (run.settings.json) {
+					run.context.terminal.json(reset);
+					return exitCodes.ok;
+				}
+				return printedPassword(run, reset.temporaryPassword, `The temporary password of ${member.email} is shown only here.`);
+			}
+		})
+	]
+});
+//#endregion
+//#region src/commands/orgs/index.ts
+const organizationOrInUse = async (scope, reference) => reference === void 0 ? scope.organization() : organizationIn(await scope.organizations(), reference);
+const organizationsMarked = async (scope, warn) => {
+	const organizations = await scope.organizations();
+	const inUse = await scope.organization().then(({ id }) => id, (error) => {
+		if (!(error instanceof CliError)) throw error;
+		warn(error);
+		return null;
+	});
+	return organizations.map((organization) => ({
+		...organization,
+		inUse: organization.id === inUse
+	}));
+};
+const organizationCostsOf = async (api, organizationId, { from, to }) => dataOf("show what the organization spent", await api.GET("/organizations/{organizationId}/costs", { params: {
+	path: { organizationId },
+	query: {
+		from,
+		to
+	}
+} }), organizationHints);
+const dayOf = (flag, given) => {
+	if (!z.iso.date().safeParse(given).success) throw new UsageError(`--${flag} ${given} is not a day written as YYYY-MM-DD.`);
+	return given;
+};
+const shiftedDay = (day, days) => new Date(Date.parse(`${day}T00:00:00.000Z`) + days * 24 * 60 * 6e4).toISOString().slice(0, 10);
+const costWindowFrom = (from, to, now) => {
+	const last = to === void 0 ? now.toISOString().slice(0, 10) : dayOf("to", to);
+	const first = from === void 0 ? shiftedDay(last, -6) : dayOf("from", from);
+	if (first > last) throw new UsageError(`--from ${first} comes after --to ${last}.`);
+	return {
+		from: first,
+		to: last
+	};
+};
+const costsText = (costs, { from, to }, slugs) => [
+	costs.items.length === 0 ? `The organization spent nothing between ${from} and ${to}.` : renderTable([
+		{ header: "DAY" },
+		{
+			header: "COST",
+			align: "right"
+		},
+		{
+			header: "RUNS",
+			align: "right"
+		}
+	], costs.items.map((point) => [
+		point.day,
+		point.costUsd.toFixed(2),
+		String(point.runs)
+	])),
+	...costs.projects.length === 0 ? [] : ["", renderTable([
+		{ header: "PROJECT" },
+		{
+			header: "COST",
+			align: "right"
+		},
+		{
+			header: "RUNS",
+			align: "right"
+		}
+	], costs.projects.map((project) => [
+		slugs.get(project.projectId) ?? project.projectId,
+		project.costUsd.toFixed(2),
+		String(project.runs)
+	]))],
+	"",
+	`${costs.totalCostUsd.toFixed(2)} over ${costs.totalRuns} runs and ${costs.sessions} sessions.`
+].join("\n");
+const createOrgsCommand = (adaptersOf) => defineGroup({
+	name: "orgs",
+	summary: "The organizations you can see, and the one kcloud acts in.",
+	usage: "orgs <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the organizations you can see, marking the one kcloud acts in.",
+			usage: "orgs list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const items = await organizationsMarked(run, (problem) => {
+					run.context.terminal.error(run.context.terminal.errorStyles.warning(`warning ${problem.message}`));
+				});
+				return printed(run, items, (listed) => listed.length === 0 ? "You can see no organization." : renderTable([
+					{ header: "SLUG" },
+					{ header: "NAME" },
+					{ header: "ID" }
+				], listed.map((organization) => [
+					organization.inUse ? `${organization.slug} *` : organization.slug,
+					organization.name,
+					organization.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "use",
+			summary: "Act in an organization on this instance from now on.",
+			usage: "orgs use <organization> | orgs use --clear",
+			optionsUsage: [["--clear", "act in your own organization again"], ["", `--org and ${organizationVariable} still win over the one stored here`]],
+			options: { clear: {
+				type: "boolean",
+				default: false
+			} },
+			positionals: {
+				min: 0,
+				max: 1
+			},
+			run: async ({ values, positionals, settings, context }) => {
+				const [reference] = positionals;
+				if (values.clear === (reference !== void 0)) throw new UsageError("orgs use needs an organization or --clear, and not both.", "kcloud orgs list shows the organizations you can see.");
+				const adapters = adaptersOf(context);
+				const session = await openSession({
+					settings,
+					context,
+					api: adapters.api
+				});
+				if (session.stored === null) throw new CliError(`${tokenVariable} signs in to ${session.origin}, so nothing is stored here to keep the organization with.`, `Pass --org or set ${organizationVariable} instead.`);
+				const organization = reference === void 0 ? null : organizationIn(await session.organizations(), reference);
+				await writeInstanceStore(context.homeDirectory, withInstance(session.store, session.origin, {
+					...session.stored,
+					organization: organization?.slug ?? null
+				}));
+				if (givenIn(context.environment, "KIKIMORA_CLOUD_ORG") !== null) context.terminal.error(context.terminal.errorStyles.warning(`warning ${organizationVariable} still wins over it in this environment.`));
+				return printed({
+					settings,
+					context
+				}, {
+					origin: session.origin,
+					organization
+				}, ({ origin }) => organization === null ? `kcloud acts in your own organization on ${origin} again.` : `kcloud acts in ${organizationNameOf(organization)} on ${origin} from now on.`);
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show an organization, by default the one kcloud acts in.",
+			usage: "orgs show [<organization>]",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { id } = await organizationOrInUse(run, invocation.positionals[0]);
+				const organization = dataOf("describe the organization", await run.api.GET("/organizations/{organizationId}", { params: { path: { organizationId: id } } }), organizationHints);
+				return printed(run, organization, (shown) => renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+					["name", shown.name],
+					["slug", shown.slug],
+					["created", shown.createdAt],
+					["id", shown.id]
+				]));
+			}
+		}),
+		defineCommand({
+			name: "costs",
+			summary: "Show what the organization spent, by day and by project.",
+			usage: "orgs costs [--from <day>] [--to <day>]",
+			optionsUsage: [["--from <day>", `the first day, as YYYY-MM-DD (default: 7 days up to --to)`], ["--to <day>", "the last day, as YYYY-MM-DD (default: today)"]],
+			options: {
+				from: { type: "string" },
+				to: { type: "string" }
+			},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const run = await runOf(adaptersOf, invocation);
+				const window = costWindowFrom(values.from, values.to, run.adapters.now());
+				const organization = await run.organization();
+				const costs = await organizationCostsOf(run.api, organization.id, window);
+				if (run.settings.json) {
+					run.context.terminal.json(costs);
+					return exitCodes.ok;
+				}
+				const slugs = new Map(costs.projects.length === 0 ? [] : (await projectsOf(run)).map(({ id, slug }) => [id, slug]));
+				run.context.terminal.line(costsText(costs, window, slugs));
+				return exitCodes.ok;
+			}
+		}),
+		organizationMembersCommand(adaptersOf)
+	]
+});
+//#endregion
+//#region src/mcp/tools/organizations.ts
+const memberField = z.string().trim().min(1).describe("The member, by e-mail or id, from organization_members_list.");
+const dayField = z.iso.date();
+const chosenMember = async (run, member) => {
+	const { id } = await run.organization();
+	return {
+		organizationId: id,
+		userId: (await resolveOrganizationMember(run.api, id, member)).id
+	};
+};
+const organizationTools = [
+	defineTool({
+		name: "organizations_list",
+		title: "List organizations",
+		description: "List the organizations you can see, marking the one this server acts in. A member sees one, a platform admin sees all.",
+		operations: ["listOrganizations"],
+		safety: "read",
+		input: z.object({}),
+		run: (_, run) => organizationsMarked(run, () => void 0)
+	}),
+	defineTool({
+		name: "organization_show",
+		title: "Show an organization",
+		description: "Show an organization, by default the one this server acts in.",
+		operations: ["getOrganization"],
+		safety: "read",
+		input: z.object({ organization: z.string().trim().min(1).optional().describe("The organization, by its slug, its name or its id.") }),
+		run: async ({ organization }, run) => {
+			const { id } = await organizationOrInUse(run, organization);
+			return dataOf("describe the organization", await run.api.GET("/organizations/{organizationId}", { params: { path: { organizationId: id } } }), organizationHints);
+		}
+	}),
+	defineTool({
+		name: "organization_costs",
+		title: "Show what the organization spent",
+		description: "Show what the organization this server acts in spent, by day and by project, over the last seven days unless from and to say otherwise.",
+		operations: ["getOrganizationCosts"],
+		safety: "read",
+		input: z.object({
+			from: dayField.optional().describe("The first day, as YYYY-MM-DD."),
+			to: dayField.optional().describe("The last day, as YYYY-MM-DD, today by default.")
+		}),
+		run: async ({ from, to }, run) => {
+			const { id } = await run.organization();
+			return organizationCostsOf(run.api, id, costWindowFrom(from, to, run.now()));
+		}
+	}),
+	defineTool({
+		name: "organization_members_list",
+		title: "List the members of the organization",
+		description: "List the people of the organization this server acts in, with their role and status.",
+		operations: ["listOrganizationMembers"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => organizationMembersOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "organization_member_set_role",
+		title: "Set the role of a member",
+		description: "Make a member an admin of the organization, or a member again. It takes an admin of the organization.",
+		operations: ["updateOrganizationMember"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			member: memberField,
+			role: organizationRoleSchema
+		}),
+		run: async ({ member, role }, run) => {
+			const { organizationId, userId } = await chosenMember(run, member);
+			return memberRoleChanged(run.api, organizationId, userId, role);
+		}
+	}),
+	defineTool({
+		name: "organization_member_disable",
+		title: "Disable a member",
+		description: "Stop a member from signing in, keeping the account. It takes an admin of the organization.",
+		operations: ["disableOrganizationMember"],
+		safety: "destructive",
+		input: z.object({ member: memberField }),
+		run: async ({ member }, run) => {
+			const { organizationId, userId } = await chosenMember(run, member);
+			return memberDisabled(run.api, organizationId, userId);
+		}
+	}),
+	defineTool({
+		name: "organization_member_enable",
+		title: "Enable a member",
+		description: "Let a disabled member sign in again. It takes an admin of the organization.",
+		operations: ["enableOrganizationMember"],
+		safety: "write",
+		input: z.object({ member: memberField }),
+		run: async ({ member }, run) => {
+			const { organizationId, userId } = await chosenMember(run, member);
+			return memberEnabled(run.api, organizationId, userId);
+		}
+	})
+];
+//#endregion
 //#region src/commands/tools.ts
 const projectOption$1 = { project: { type: "string" } };
 const projectUsage$1 = [["--project <name>", "the project the tool belongs to, by slug, name or id"]];
@@ -5663,7 +6730,7 @@ const toolHints = {
 };
 const projectFrom$1 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
-	return resolveProjectId(run.api, given);
+	return resolveProjectId(run, given);
 };
 const toolsOf = async (api, projectId) => dataOf("list the tools of the project", await api.GET("/projects/{id}/tools", { params: { path: { id: projectId } } }), toolHints).items;
 const resolveTool = async (api, projectId, reference) => {
@@ -5688,6 +6755,13 @@ const changedTool = async (api, projectId, tool, document) => {
 		body: change
 	}), toolHints);
 };
+const copiedTool = async (api, projectId, toolId, targetProjectId) => dataOf("copy the tool", await api.POST("/projects/{id}/tools/{toolId}/copy", {
+	params: { path: {
+		id: projectId,
+		toolId
+	} },
+	body: { targetProjectId }
+}), toolHints);
 const createToolsCommand = (adaptersOf) => defineGroup({
 	name: "tools",
 	summary: "The HTTP APIs and MCP servers a project offers its agents.",
@@ -5833,6 +6907,31 @@ const createToolsCommand = (adaptersOf) => defineGroup({
 				} } }), toolHints);
 				return said(run, `Deleted the tool ${tool.name}.`);
 			}
+		}),
+		defineCommand({
+			name: "copy",
+			summary: "Copy a tool to another project, without its secrets.",
+			usage: "tools copy <tool> --project <name> --to <project>",
+			optionsUsage: [...projectUsage$1, ["--to <project>", "the project that receives the copy, by slug, name or id"]],
+			options: {
+				...projectOption$1,
+				to: { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const target = values.to;
+				if (target === void 0) throw new UsageError("tools copy needs --to <project>.", "kcloud projects list shows the projects.");
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, values.project);
+				const tool = await resolveTool(run.api, projectId, invocation.positionals[0] ?? "");
+				const targetProjectId = await resolveProjectId(run, target);
+				const copied = await copiedTool(run.api, projectId, tool.id, targetProjectId);
+				return printed(run, copied, (shown) => [`Copied ${tool.name} to ${target} as ${shown.id}.`, ...shown.complete ? [] : ["Its secrets stay behind. kcloud tools update --file sets them."]].join(" "));
+			}
 		})
 	]
 });
@@ -5906,6 +7005,23 @@ const projectToolTools = [
 			});
 		}
 	}),
+	defineTool({
+		name: "tool_copy",
+		title: "Copy a tool",
+		description: "Copy a tool to another project of the organization. Its secrets stay behind, so a copy that needs them is incomplete until someone sets them.",
+		operations: ["copyTool"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			tool: toolField,
+			to: projectField.describe("The project that receives the copy, by slug, name or id.")
+		}),
+		run: async ({ project, tool, to }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const found = await resolveTool(run.api, projectId, tool);
+			return copiedTool(run.api, projectId, found.id, await projectIdOf(run, to));
+		}
+	}),
 	defineTool({
 		name: "tool_delete",
 		title: "Delete a tool",
@@ -5928,16 +7044,166 @@ const projectToolTools = [
 	})
 ];
 //#endregion
-//#region src/commands/projects.ts
-const projectHint = { "project.not_found": "kcloud projects list shows the projects you are a member of." };
+//#region src/commands/projects/members.ts
+const projectMembersOf = async (api, projectId) => dataOf("list the members of the project", await api.GET("/projects/{id}/members", { params: { path: { id: projectId } } }), projectHint).items;
+const resolveProjectMember = async (api, projectId, reference) => {
+	const found = (await projectMembersOf(api, projectId)).find((member) => member.userId === reference.toLowerCase() || sameEmail(member.email, reference));
+	if (found === void 0) throw new CliError(`The project has no member ${reference}.`, "kcloud projects members list <project> shows them.");
+	return found;
+};
+const projectUserIdOf = async (api, projectId, reference) => {
+	if (isId(reference)) return reference.toLowerCase();
+	const { organizationId } = await projectOf(api, projectId);
+	return (await resolveOrganizationMember(api, organizationId, reference)).id;
+};
+const setProjectMember = async (api, projectId, userId, role) => {
+	doneWith("set the member of the project", await api.PUT("/projects/{id}/members/{userId}", {
+		params: { path: {
+			id: projectId,
+			userId
+		} },
+		body: { role }
+	}), projectHint);
+};
+const removeProjectMember = async (api, projectId, userId) => {
+	doneWith("remove the member of the project", await api.DELETE("/projects/{id}/members/{userId}", { params: { path: {
+		id: projectId,
+		userId
+	} } }), projectHint);
+};
+const projectMembersCommand = (adaptersOf) => defineGroup({
+	name: "members",
+	summary: "The members of a project and their project role.",
+	usage: "projects members <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the members of one project.",
+			usage: "projects members list <project>",
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
+				const items = await projectMembersOf(run.api, id);
+				return printed(run, items, (members) => members.length === 0 ? "The project has no member." : renderTable([
+					{ header: "EMAIL" },
+					{ header: "ROLE" },
+					{ header: "STATUS" },
+					{ header: "ADDED" },
+					{ header: "ID" }
+				], members.map((member) => [
+					member.email,
+					member.role,
+					member.status,
+					member.addedAt,
+					member.userId
+				])));
+			}
+		}),
+		defineCommand({
+			name: "set",
+			summary: "Add a member of the organization to a project, or change their role.",
+			usage: "projects members set <project> <user> --role <role>",
+			optionsUsage: [roleUsage, ["", "the user is named by e-mail or id, and belongs to the organization"]],
+			options: roleOption,
+			positionals: {
+				min: 2,
+				max: 2
+			},
+			run: async (invocation) => {
+				const [project = "", user = ""] = invocation.positionals;
+				const role = roleFrom(invocation.values.role, "projects members set");
+				const run = await runOf(adaptersOf, invocation);
+				const id = await resolveProjectId(run, project);
+				const userId = await projectUserIdOf(run.api, id, user);
+				await setProjectMember(run.api, id, userId, role);
+				return said(run, `${user} is ${asRole(role)} of the project ${project} now.`);
+			}
+		}),
+		defineCommand({
+			name: "remove",
+			summary: "Take a member off a project.",
+			usage: "projects members remove <project> <user>",
+			optionsUsage: [["", "the user is named by e-mail or id"]],
+			options: {},
+			positionals: {
+				min: 2,
+				max: 2
+			},
+			run: async (invocation) => {
+				const [project = "", user = ""] = invocation.positionals;
+				const run = await runOf(adaptersOf, invocation);
+				const id = await resolveProjectId(run, project);
+				const member = await resolveProjectMember(run.api, id, user);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Remove ${member.email} from the project ${project}?`
+				});
+				await removeProjectMember(run.api, id, member.userId);
+				return said(run, `Removed ${member.email} from the project ${project}.`);
+			}
+		})
+	]
+});
+//#endregion
+//#region src/commands/projects/index.ts
+const fieldOptions = {
+	slug: { type: "string" },
+	description: { type: "string" },
+	color: { type: "string" }
+};
+const fieldUsage = [
+	["--slug <slug>", "lowercase letters, digits and hyphens (default: made from the name)"],
+	["--description <text>", "what the project is for"],
+	["--color <#rrggbb>", `the color of the project in the panel (default: ${defaultProjectColor})`]
+];
+const createdProject = async (scope, name, { slug, description, color }) => {
+	const body = {
+		name,
+		...slug === void 0 ? {} : { slug },
+		description: description ?? "",
+		color: color ?? "#7c86ff"
+	};
+	validated(createProjectBodySchema, body, "a project");
+	const organization = await scope.organization();
+	return {
+		project: dataOf("create the project", await scope.api.POST("/organizations/{organizationId}/projects", {
+			params: { path: { organizationId: organization.id } },
+			body
+		}), projectHint),
+		organization
+	};
+};
+const changedProject = async (api, id, change) => {
+	const current = await projectOf(api, id);
+	const body = {
+		name: change.name ?? current.name,
+		slug: change.slug ?? current.slug,
+		description: change.description ?? current.description,
+		color: change.color ?? current.color
+	};
+	validated(updateProjectBodySchema, body, "a change to a project");
+	return dataOf("change the project", await api.PATCH("/projects/{id}", {
+		params: { path: { id } },
+		body
+	}), projectHint);
+};
+const deleteProject = async (api, id) => {
+	doneWith("delete the project", await api.DELETE("/projects/{id}", { params: { path: { id } } }), projectHint);
+};
 const createProjectsCommand = (adaptersOf) => defineGroup({
 	name: "projects",
-	summary: "The projects you are a member of.",
+	summary: "The projects of the organization you can see.",
 	usage: "projects <command>",
 	subcommands: [
 		defineCommand({
 			name: "list",
-			summary: "List the projects you can see.",
+			summary: "List the projects of the organization you can see.",
 			usage: "projects list",
 			options: {},
 			positionals: {
@@ -5946,8 +7212,9 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const { items } = dataOf("list the projects", await run.api.GET("/projects"));
-				return printed(run, items, (projects) => projects.length === 0 ? "You are a member of no project yet." : renderTable([
+				const items = await projectsOf(run);
+				const { slug } = await run.organization();
+				return printed(run, items, (projects) => projects.length === 0 ? `You see no project in ${slug} yet.` : renderTable([
 					{ header: "SLUG" },
 					{ header: "NAME" },
 					{
@@ -5976,12 +7243,13 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const id = await resolveProjectId(run.api, invocation.positionals[0] ?? "");
+				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
 				const project = dataOf("describe the project", await run.api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
 				return printed(run, project, (shown) => renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 					["name", shown.name],
 					["slug", shown.slug],
 					["description", shown.description === "" ? "-" : shown.description],
+					["color", shown.color],
 					["docker", shown.dockerAllowed ? "allowed" : "not allowed"],
 					["members", String(shown.memberCount)],
 					["created", shown.createdAt],
@@ -5990,9 +7258,52 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 			}
 		}),
 		defineCommand({
-			name: "members",
-			summary: "List the members of one project.",
-			usage: "projects members <project>",
+			name: "create",
+			summary: "Create a project in the organization.",
+			usage: "projects create <name> [--slug <slug>] [--description <text>] [--color <#rrggbb>]",
+			optionsUsage: fieldUsage,
+			options: fieldOptions,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { project, organization } = await createdProject(run, invocation.positionals[0] ?? "", invocation.values);
+				return printed(run, project, (created) => `Created ${created.name} (${created.slug}) in ${organization.slug} as ${created.id}.`);
+			}
+		}),
+		defineCommand({
+			name: "update",
+			summary: "Change the name, slug, description or color of a project.",
+			usage: "projects update <project> [--name <name>] [--slug <slug>] [--description <text>] [--color <#rrggbb>]",
+			optionsUsage: [["--name <name>", "the new name"], ...fieldUsage],
+			options: {
+				name: { type: "string" },
+				...fieldOptions
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				if ([
+					values.name,
+					values.slug,
+					values.description,
+					values.color
+				].every((value) => value === void 0)) throw new UsageError("projects update needs --name, --slug, --description or --color.");
+				const run = await runOf(adaptersOf, invocation);
+				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
+				const project = await changedProject(run.api, id, values);
+				return printed(run, project, (shown) => `Changed ${shown.name} (${shown.slug}).`);
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a project that holds no agent, credential, repository or tool.",
+			usage: "projects delete <project>",
 			options: {},
 			positionals: {
 				min: 1,
@@ -6000,50 +7311,136 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const id = await resolveProjectId(run.api, invocation.positionals[0] ?? "");
-				const { items } = dataOf("list the members of the project", await run.api.GET("/projects/{id}/members", { params: { path: { id } } }), projectHint);
-				return printed(run, items, (members) => members.length === 0 ? "The project has no member." : renderTable([
-					{ header: "EMAIL" },
-					{ header: "ROLE" },
-					{ header: "STATUS" },
-					{ header: "ADDED" }
-				], members.map((member) => [
-					member.email,
-					member.role,
-					member.status,
-					member.addedAt
-				])));
+				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
+				const project = await projectOf(run.api, id);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the project ${project.name} (${project.slug})?`
+				});
+				await deleteProject(run.api, id);
+				return said(run, `Deleted the project ${project.name}.`);
 			}
-		})
+		}),
+		projectMembersCommand(adaptersOf)
 	]
 });
 //#endregion
 //#region src/mcp/tools/projects.ts
-const projectTools = [defineTool({
-	name: "projects_list",
-	title: "List projects",
-	description: "List the projects you are a member of.",
-	operations: ["listProjects"],
-	safety: "read",
-	input: z.object({}),
-	run: async (_, run) => dataOf("list the projects", await run.api.GET("/projects")).items
-}), defineTool({
-	name: "project_show",
-	title: "Show a project",
-	description: "Show one project together with its members.",
-	operations: ["getProject", "listProjectMembers"],
-	safety: "read",
-	input: z.object({ project: projectField }),
-	run: async ({ project }, run) => {
-		const id = await projectIdOf(run, project);
-		const shown = dataOf("describe the project", await run.api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
-		const { items } = dataOf("list the members of the project", await run.api.GET("/projects/{id}/members", { params: { path: { id } } }), projectHint);
-		return {
-			...shown,
-			members: items
-		};
-	}
-})];
+const userField = z.string().trim().min(1).describe("The user, by e-mail or id, a member of the organization of the project.");
+const fields = {
+	slug: slugSchema.optional().describe("Lowercase letters, digits and hyphens."),
+	description: z.string().max(500).optional(),
+	color: colorSchema.optional().describe("The color in the panel, as #rrggbb.")
+};
+const projectTools = [
+	defineTool({
+		name: "projects_list",
+		title: "List projects",
+		description: "List the projects you can see in the organization this server acts in.",
+		operations: ["listProjects"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => projectsOf(run)
+	}),
+	defineTool({
+		name: "project_show",
+		title: "Show a project",
+		description: "Show one project together with its members.",
+		operations: ["getProject", "listProjectMembers"],
+		safety: "read",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => {
+			const id = await projectIdOf(run, project);
+			return {
+				...dataOf("describe the project", await run.api.GET("/projects/{id}", { params: { path: { id } } }), projectHint),
+				members: await projectMembersOf(run.api, id)
+			};
+		}
+	}),
+	defineTool({
+		name: "project_create",
+		title: "Create a project",
+		description: "Create a project in the organization this server acts in.",
+		operations: ["createProject"],
+		safety: "write",
+		input: z.object({
+			name: z.string().trim().min(2).max(80),
+			...fields
+		}),
+		run: async ({ name, ...rest }, run) => (await createdProject(run, name, rest)).project
+	}),
+	defineTool({
+		name: "project_update",
+		title: "Change a project",
+		description: "Change the name, slug, description or color of a project. A field left out keeps its value.",
+		operations: ["updateProject"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			project: projectField,
+			name: z.string().trim().min(2).max(80).optional(),
+			...fields
+		}),
+		run: async ({ project, ...change }, run) => changedProject(run.api, await projectIdOf(run, project), change)
+	}),
+	defineTool({
+		name: "project_delete",
+		title: "Delete a project",
+		description: "Delete a project. The instance refuses while it holds agents, credentials, repositories or tools.",
+		operations: ["deleteProject"],
+		safety: "destructive",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => {
+			const id = await projectIdOf(run, project);
+			await deleteProject(run.api, id);
+			return { deleted: id };
+		}
+	}),
+	defineTool({
+		name: "project_member_set",
+		title: "Set a member of a project",
+		description: "Add a member of the organization to a project with a project role, or change the role of a member.",
+		operations: ["setProjectMember"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			project: projectField,
+			user: userField,
+			role: projectRoleSchema
+		}),
+		run: async ({ project, user, role }, run) => {
+			const id = await projectIdOf(run, project);
+			const userId = await projectUserIdOf(run.api, id, user);
+			await setProjectMember(run.api, id, userId, role);
+			return {
+				projectId: id,
+				userId,
+				role
+			};
+		}
+	}),
+	defineTool({
+		name: "project_member_remove",
+		title: "Remove a member of a project",
+		description: "Take a member off a project. The account stays in the organization.",
+		operations: ["removeProjectMember"],
+		safety: "destructive",
+		input: z.object({
+			project: projectField,
+			user: userField
+		}),
+		run: async ({ project, user }, run) => {
+			const id = await projectIdOf(run, project);
+			const member = await resolveProjectMember(run.api, id, user);
+			await removeProjectMember(run.api, id, member.userId);
+			return {
+				projectId: id,
+				removed: member.userId
+			};
+		}
+	})
+];
 //#endregion
 //#region src/mcp/tools/releases.ts
 const releaseTools = [defineTool({
@@ -6071,7 +7468,7 @@ const repositoryHints = {
 };
 const projectFrom = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
-	return resolveProjectId(run.api, given);
+	return resolveProjectId(run, given);
 };
 const repositoriesOf = async (api, projectId) => dataOf("list the repositories of the project", await api.GET("/projects/{id}/repositories", { params: { path: { id: projectId } } }), repositoryHints).items;
 const resolveRepositoryId = async (api, projectId, reference) => {
@@ -6447,23 +7844,28 @@ const taskTools = [
 //#region src/mcp/tools/index.ts
 const kcloudTools = [
 	...accountTools,
+	...organizationTools,
 	...projectTools,
 	...credentialTools,
 	...repositoryTools,
 	...projectToolTools,
+	...nodeTools,
 	...agentTools,
 	...taskTools,
 	...observabilityTools,
 	...notificationTools,
 	...releaseTools
 ];
+const passwordPrinted = (what) => `a secret never passes through the context of a model, and kcloud prints ${what}`;
+passwordPrinted("the one-time registration token of the node");
+passwordPrinted("the temporary password of the new member"), passwordPrinted("the new temporary password");
 //#endregion
 //#region src/mcp/server.ts
 const instructions = [
-	"These tools act on one Kikimora Cloud instance as the account kcloud is signed in with; whoami names both.",
+	"These tools act on one Kikimora Cloud instance, as the account kcloud is signed in with, in one organization of it. whoami names all three.",
 	"Name a project by its slug, its name or its id. Name an agent as <project>/<agent>, as its slug or name together with project, or by its id.",
 	"A refusal quotes the error code of the instance. Its hint may name a kcloud command, such as kcloud agents list; the tool for the same resource and verb, agents_list, does that work here.",
-	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud tokens create, kcloud auth password, or sets the secrets of a tool in the panel."
+	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud tokens create, kcloud auth password, kcloud orgs members add, kcloud orgs members reset-password, or sets the secrets of a tool in the panel."
 ].join("\n");
 const createKcloudServer = ({ version, open }) => {
 	const server = new McpServer({
@@ -6484,8 +7886,8 @@ const createKcloudServer = ({ version, open }) => {
 const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 	name: "mcp",
 	summary: "Serve the work of kcloud to an MCP client over stdio.",
-	usage: "mcp [--profile <name>] [--url <origin>]",
-	optionsUsage: [["", "an MCP client starts it, as in: claude mcp add kcloud -- kcloud mcp"], ["", "each tool call uses the profile or KIKIMORA_CLOUD_TOKEN of that moment"]],
+	usage: "mcp [--url <origin>] [--org <organization>]",
+	optionsUsage: [["", "an MCP client starts it, as in: claude mcp add kcloud -- kcloud mcp"], ["", "each tool call reads the token and the organization of that moment"]],
 	options: {},
 	positionals: {
 		min: 0,
@@ -6504,13 +7906,12 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 				});
 				return {
 					api: session.api,
+					me: session.me,
+					organizations: session.organizations,
+					organization: session.organization,
 					origin: session.origin,
-					profileName: session.profileName,
 					kcloudVersion: cliVersion,
-					token: () => tokenOf({
-						settings,
-						context
-					}),
+					token: () => Promise.resolve(session.token),
 					wait: adapters.wait,
 					now: adapters.now
 				};
@@ -6527,96 +7928,6 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 	}
 });
 //#endregion
-//#region src/commands/profiles.ts
-const rowsOf = (store) => Object.entries(store.profiles).map(([name, profile]) => [
-	name === store.current ? `${name} *` : name,
-	profile.origin,
-	profile.email ?? "unknown"
-]);
-const namedProfile = (store, name) => {
-	if (store.profiles[name] === void 0) {
-		const known = Object.keys(store.profiles);
-		throw new CliError(`There is no profile ${name} here.`, known.length === 0 ? "Run kcloud login --url <origin> to make one." : `kcloud profiles list shows ${known.join(", ")}.`);
-	}
-};
-const createProfilesCommand = () => defineGroup({
-	name: "profiles",
-	summary: "The instances this machine is signed in to.",
-	usage: "profiles <command>",
-	subcommands: [
-		defineCommand({
-			name: "list",
-			summary: "List the saved profiles, marking the current one.",
-			usage: "profiles list",
-			options: {},
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async ({ settings, context }) => {
-				const store = await readProfileStore(context.homeDirectory);
-				if (settings.json) {
-					context.terminal.json({
-						current: store.current,
-						profiles: Object.entries(store.profiles).map(([name, profile]) => ({
-							name,
-							origin: profile.origin,
-							email: profile.email
-						}))
-					});
-					return exitCodes.ok;
-				}
-				const rows = rowsOf(store);
-				context.terminal.line(rows.length === 0 ? "No instance is signed in here; kcloud login --url <origin> signs in." : renderTable([
-					{ header: "PROFILE" },
-					{ header: "INSTANCE" },
-					{ header: "ACCOUNT" }
-				], rows));
-				return exitCodes.ok;
-			}
-		}),
-		defineCommand({
-			name: "use",
-			summary: "Make one of the saved profiles the current one.",
-			usage: "profiles use <name>",
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async ({ positionals, context }) => {
-				const [name = ""] = positionals;
-				const store = await readProfileStore(context.homeDirectory);
-				namedProfile(store, name);
-				await writeProfileStore(context.homeDirectory, {
-					...store,
-					current: name
-				});
-				context.terminal.line(`${name} is the current profile.`);
-				return exitCodes.ok;
-			}
-		}),
-		defineCommand({
-			name: "remove",
-			summary: "Forget a saved profile without revoking its token.",
-			usage: "profiles remove <name>",
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async ({ positionals, context }) => {
-				const [name = ""] = positionals;
-				const store = await readProfileStore(context.homeDirectory);
-				namedProfile(store, name);
-				await writeProfileStore(context.homeDirectory, withoutProfile(store, name));
-				context.terminal.line(`Forgot ${name}; its token stays usable until it is revoked.`);
-				return exitCodes.ok;
-			}
-		})
-	]
-});
-//#endregion
 //#region src/commands/releases.ts
 const createReleasesCommand = (adaptersOf) => defineGroup({
 	name: "releases",
@@ -6656,13 +7967,14 @@ const kcloudCommands = () => [
 	createLogoutCommand(createAdapters),
 	createWhoamiCommand(createAdapters),
 	createVersionCommand(createAdapters, cliVersion),
-	createProfilesCommand(),
+	createOrgsCommand(createAdapters),
 	createTokensCommand(createAdapters),
 	createAuthCommand(createAdapters),
 	createProjectsCommand(createAdapters),
 	createCredentialsCommand(createAdapters),
 	createRepositoriesCommand(createAdapters),
 	createToolsCommand(createAdapters),
+	createNodesCommand(createAdapters),
 	createAgentsCommand(createAdapters),
 	createNotificationsCommand(createAdapters),
 	createReleasesCommand(createAdapters),