@kikimoradev/kcloud 0.16.0 → 0.17.0

package/dist/main.js

@@ -386,6 +386,12 @@ const dispatcherOf = (spec) => {
 		}
 	};
 };
+//#endregion
+//#region ../../packages/cli-kit/src/list.ts
+const listOf = (items) => {
+	const last = items.at(-1);
+	return items.length < 2 || last === void 0 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${last}`;
+};
 const permissionsOutsideOwner = 63;
 const isMissing = (error) => error instanceof Error && error.code === "ENOENT";
 const ensurePrivateDirectory = async (path) => {
@@ -509,243 +515,6 @@ const spec = {
 const defineCommand = commandFactoryOf(spec);
 const defineGroup = (definition) => defineGroup$1(definition);
 const runCli = dispatcherOf(spec);
-const agentEventLevelSchema = z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-const agentRoles = [
-	"monitor",
-	"executor",
-	"summarizer"
-];
-const agentRoleSchema = z.enum(agentRoles);
-const agentLogStreams = ["stdout", "stderr"];
-z.enum(agentLogStreams);
-const platformStream = "platform";
-const agentEventStreams = [...agentLogStreams, platformStream];
-const agentEventStreamSchema = z.enum(agentEventStreams);
-const authKindSchema = z.enum([
-	"apiKey",
-	"oauth",
-	"claude.ai",
-	"unknown"
-]);
-const agentControlStateSchema = z.enum([
-	"running",
-	"pausing",
-	"paused"
-]);
-z.enum([
-	"session",
-	"diagnostic",
-	"task"
-]);
-const maxCostUsd = 1e3;
-const countSchema = z.int().min(0).max(2147483647);
-const costUsdSchema = z.number().min(0).max(maxCostUsd);
-const instantSchema$2 = z.iso.datetime();
-const workerEnvelope = (event) => ({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	event: z.literal(event)
-});
-const roleEnvelope = (event) => ({
-	...workerEnvelope(event),
-	agent: agentRoleSchema.optional()
-});
-const agentEventSchema = z.discriminatedUnion("event", [
-	z.looseObject({
-		...workerEnvelope("worker.started"),
-		version: z.string(),
-		claudeVersion: z.string().optional(),
-		nodeVersion: z.string(),
-		authKind: authKindSchema,
-		pid: countSchema,
-		projectDir: z.string(),
-		paused: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.stopped"),
-		signal: z.string().optional(),
-		drained: z.boolean().optional(),
-		forced: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.draining"),
-		reason: z.string(),
-		timeoutMs: countSchema.optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.available"),
-		from: z.string(),
-		to: z.string(),
-		installError: z.string().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.installed"),
-		from: z.string(),
-		to: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("control.changed"),
-		state: agentControlStateSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.started"),
-		cycle: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.finished"),
-		cycle: countSchema,
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		addedTasks: countSchema,
-		skippedDuplicates: countSchema,
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.offHours"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.sleeping"),
-		nextCycleAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema,
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.granted"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.released"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.cancelled"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("task.started"),
-		taskId: z.string(),
-		title: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.finished"),
-		taskId: z.string(),
-		title: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		numTurns: countSchema.optional(),
-		willRetry: z.boolean().optional(),
-		attempt: countSchema.optional(),
-		maxAttempts: countSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.retryScheduled"),
-		taskId: z.string(),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject(roleEnvelope("executor.waiting")),
-	z.looseObject({
-		...roleEnvelope("executor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.started"),
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.finished"),
-		taskId: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.init"),
-		model: z.string(),
-		sessionId: z.string(),
-		taskId: z.string().optional(),
-		cycle: countSchema.optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.stderr"),
-		line: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.procError"),
-		message: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.killed"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.text"),
-		text: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.tool"),
-		tool: z.string(),
-		detail: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.toolError"),
-		output: z.string()
-	})
-]);
-z.looseObject({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	agent: agentRoleSchema.optional(),
-	event: z.string().min(1).max(64)
-});
-agentEventSchema.options.map((option) => option.shape.event.value);
-({
-	rawLog: "log.raw",
-	rejectedLog: "log.rejected",
-	throttledLog: "log.throttled",
-	stateChanged: "platform.stateChanged",
-	crashLooping: "platform.crashLooping",
-	provisioned: "platform.provisioned",
-	sandboxStarted: "platform.sandboxStarted",
-	sandboxStopped: "platform.sandboxStopped"
-}).rawLog;
 //#endregion
 //#region ../../packages/contracts/src/patterns.ts
 const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
@@ -1021,6 +790,11 @@ const errorCodes = Object.keys({
 	"node.in_use": "conflict",
 	"node.host_unknown": "rule_violation",
 	"node.split_exceeds_host": "rule_violation",
+	"node.package_unavailable": "not_found",
+	"agent.backup_not_found": "not_found",
+	"agent.backup_unavailable": "rule_violation",
+	"agent.backup_without_export": "rule_violation",
+	"agent.backup_in_progress": "conflict",
 	"project.last_admin": "conflict",
 	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
@@ -1043,20 +817,257 @@ const errorCodes = Object.keys({
 	"volume.invalid_size": "rule_violation",
 	"notification.not_found": "not_found"
 });
-const errorCodeSchema = z.enum(errorCodes);
-const errorDetailsSchema = z.record(z.string(), z.union([
-	z.string(),
-	z.number(),
-	z.boolean()
-]));
-const errorBodySchema = z.object({
-	code: errorCodeSchema,
-	details: errorDetailsSchema.optional(),
-	issues: z.array(z.object({
-		path: z.string(),
-		message: z.string()
-	})).optional()
-}).meta({ id: "ErrorBody" });
+const errorCodeSchema = z.enum(errorCodes);
+const errorDetailsSchema = z.record(z.string(), z.union([
+	z.string(),
+	z.number(),
+	z.boolean()
+]));
+const errorBodySchema = z.object({
+	code: errorCodeSchema,
+	details: errorDetailsSchema.optional(),
+	issues: z.array(z.object({
+		path: z.string(),
+		message: z.string()
+	})).optional()
+}).meta({ id: "ErrorBody" });
+const agentEventLevelSchema = z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+const agentRoles = [
+	"monitor",
+	"executor",
+	"summarizer"
+];
+const agentRoleSchema = z.enum(agentRoles);
+const agentLogStreams = ["stdout", "stderr"];
+z.enum(agentLogStreams);
+const platformStream = "platform";
+const agentEventStreams = [...agentLogStreams, platformStream];
+const agentEventStreamSchema = z.enum(agentEventStreams);
+const authKindSchema = z.enum([
+	"apiKey",
+	"oauth",
+	"claude.ai",
+	"unknown"
+]);
+const agentControlStateSchema = z.enum([
+	"running",
+	"pausing",
+	"paused"
+]);
+z.enum([
+	"session",
+	"diagnostic",
+	"task"
+]);
+const maxCostUsd = 1e3;
+const countSchema = z.int().min(0).max(2147483647);
+const costUsdSchema = z.number().min(0).max(maxCostUsd);
+const instantSchema$2 = z.iso.datetime();
+const workerEnvelope = (event) => ({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	event: z.literal(event)
+});
+const roleEnvelope = (event) => ({
+	...workerEnvelope(event),
+	agent: agentRoleSchema.optional()
+});
+const agentEventSchema = z.discriminatedUnion("event", [
+	z.looseObject({
+		...workerEnvelope("worker.started"),
+		version: z.string(),
+		claudeVersion: z.string().optional(),
+		nodeVersion: z.string(),
+		authKind: authKindSchema,
+		pid: countSchema,
+		projectDir: z.string(),
+		paused: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.stopped"),
+		signal: z.string().optional(),
+		drained: z.boolean().optional(),
+		forced: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.draining"),
+		reason: z.string(),
+		timeoutMs: countSchema.optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.available"),
+		from: z.string(),
+		to: z.string(),
+		installError: z.string().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.installed"),
+		from: z.string(),
+		to: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("control.changed"),
+		state: agentControlStateSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.started"),
+		cycle: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.finished"),
+		cycle: countSchema,
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		addedTasks: countSchema,
+		skippedDuplicates: countSchema,
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.offHours"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.sleeping"),
+		nextCycleAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema,
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.granted"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.released"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.cancelled"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("task.started"),
+		taskId: z.string(),
+		title: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.finished"),
+		taskId: z.string(),
+		title: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		numTurns: countSchema.optional(),
+		willRetry: z.boolean().optional(),
+		attempt: countSchema.optional(),
+		maxAttempts: countSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.retryScheduled"),
+		taskId: z.string(),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject(roleEnvelope("executor.waiting")),
+	z.looseObject({
+		...roleEnvelope("executor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.started"),
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.finished"),
+		taskId: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.init"),
+		model: z.string(),
+		sessionId: z.string(),
+		taskId: z.string().optional(),
+		cycle: countSchema.optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.stderr"),
+		line: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.procError"),
+		message: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.killed"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.text"),
+		text: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.tool"),
+		tool: z.string(),
+		detail: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.toolError"),
+		output: z.string()
+	})
+]);
+z.looseObject({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	agent: agentRoleSchema.optional(),
+	event: z.string().min(1).max(64)
+});
+agentEventSchema.options.map((option) => option.shape.event.value);
+({
+	rawLog: "log.raw",
+	rejectedLog: "log.rejected",
+	throttledLog: "log.throttled",
+	stateChanged: "platform.stateChanged",
+	crashLooping: "platform.crashLooping",
+	provisioned: "platform.provisioned",
+	sandboxStarted: "platform.sandboxStarted",
+	sandboxStopped: "platform.sandboxStopped"
+}).rawLog;
 const agentStateSchema = z.enum([
 	"created",
 	"provisioning",
@@ -1561,9 +1572,32 @@ const nodeSchema = z.object({
 	agentCount: z.int().nonnegative(),
 	connectedAt: z.iso.datetime().nullable(),
 	lastSeenAt: z.iso.datetime().nullable(),
+	offlineSince: z.iso.datetime().nullable(),
 	registrationExpiresAt: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Node" });
+const nodeUpdateSchema = z.object({
+	state: z.enum([
+		"current",
+		"waiting",
+		"updating",
+		"failed",
+		"unmanaged"
+	]),
+	target: z.string().nullable(),
+	sessions: z.int().nonnegative(),
+	since: z.iso.datetime().nullable(),
+	last: z.object({
+		outcome: z.enum([
+			"updated",
+			"rolledBack",
+			"failed"
+		]),
+		version: z.string().nullable(),
+		reason: z.string().nullable(),
+		at: z.iso.datetime()
+	}).nullable()
+}).meta({ id: "NodeUpdate" });
 const nodeAgentSchema = z.object({
 	id: idSchema,
 	name: z.string(),
@@ -1609,7 +1643,8 @@ const nodeRuntimeSchema = z.object({
 }).meta({ id: "NodeRuntime" });
 nodeSchema.extend({
 	agents: z.array(nodeAgentSchema),
-	runtime: nodeRuntimeSchema.nullable()
+	runtime: nodeRuntimeSchema.nullable(),
+	update: nodeUpdateSchema.nullable()
 }).meta({ id: "NodeDetail" });
 z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
 z.object({ nodeId: idSchema });
@@ -1825,6 +1860,8 @@ const auditActionSchema = z.enum([
 	"agent.updated",
 	"agent.deleted",
 	"agent.action",
+	"agent.backup_requested",
+	"agent.restored",
 	"platform.settings_updated",
 	"runtime.sessions_updated",
 	"platform.upgrade_requested",
@@ -2464,6 +2501,43 @@ z.object({
 		z.object({ code: errorCodeSchema })
 	])
 }).meta({ id: "AgentEventFrame" });
+//#endregion
+//#region ../../packages/contracts/src/agent-backups.ts
+const agentBackupTriggers = ["nightly", "manual"];
+const agentBackupSchema = z.object({
+	id: idSchema,
+	agentId: idSchema,
+	nodeId: idSchema,
+	nodeName: z.string().nullable(),
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string(),
+	entries: z.int().nonnegative(),
+	sizeBytes: z.int().nonnegative(),
+	createdAt: z.iso.datetime(),
+	expiresAt: z.iso.datetime()
+}).meta({ id: "AgentBackup" });
+z.object({
+	items: z.array(agentBackupSchema),
+	retentionDays: z.int().positive()
+}).meta({ id: "AgentBackupList" });
+z.object({ state: z.literal("requested") }).meta({ id: "AgentBackupRequested" });
+z.object({
+	id: idSchema,
+	backupId: idSchema
+});
+z.object({
+	name: agentNameSchema,
+	slug: slugSchema.optional(),
+	nodeId: idSchema
+}).meta({ id: "RestoreAgentBody" });
+z.object({ agentId: idSchema }).meta({ id: "RestoredAgent" });
+z.object({
+	agentId: idSchema,
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string().min(1).max(64),
+	entries: z.coerce.number().int().nonnegative()
+});
+z.object({ backupId: idSchema });
 [
 	"application/vnd.oci.image.index.v1+json",
 	"application/vnd.oci.image.manifest.v1+json",
@@ -3644,6 +3718,116 @@ const createWhoamiCommand = (adaptersOf) => defineCommand({
 	}
 });
 //#endregion
+//#region src/render/body.ts
+const isTerminal$1 = (stream) => stream.isTTY === true;
+const pipedText$1 = async (stream) => {
+	const chunks = [];
+	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+};
+const fileOptions = { file: { type: "string" } };
+const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
+const documentOf = async (run, file) => {
+	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
+	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
+	}
+};
+const readFileOrRefuse = async (path) => {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		throw new CliError(`${path} could not be read.`);
+	}
+};
+const validated = (schema, document, what) => {
+	const parsed = schema.safeParse(document);
+	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
+};
+//#endregion
+//#region src/commands/nodes/shared.ts
+const nodeHints = {
+	...organizationHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.name_taken": "Another node of the organization has that name.",
+	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
+};
+const splitHints = {
+	...nodeHints,
+	"auth.forbidden": "Splitting a node takes an admin of its organization.",
+	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
+const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
+const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
+const nodeIn = (nodes, reference, organization) => {
+	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
+	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
+	return found;
+};
+const resolveNode = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return {
+		organizationId: organization.id,
+		nodeId: reference
+	};
+	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
+	return {
+		organizationId: organization.id,
+		nodeId: node.id
+	};
+};
+const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const createdNode = async (api, organizationId, name) => {
+	const body = { name };
+	validated(createNodeBodySchema, body, "a node");
+	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+		params: { path: { organizationId } },
+		body
+	}), nodeHints);
+};
+const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const deleteNode = async (api, { organizationId, nodeId }) => {
+	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+		organizationId,
+		nodeId
+	} } }), nodeHints);
+};
+const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: {
+		revision,
+		split
+	}
+}), splitHints);
+const nodeUsage = [["", "a node is named by its name or its id"]];
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+};
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
 //#region src/commands/run.ts
 const runOf = async (adaptersOf, { settings, context }) => {
 	const adapters = adaptersOf(context);
@@ -3682,62 +3866,187 @@ const agentFrom = async (run, reference, project) => {
 	return resolveAgentId(run, reference, project);
 };
 //#endregion
-//#region src/commands/agents/check.ts
-const checkHints = {
+//#region src/commands/agents/backups.ts
+const backupsListHint = "kcloud agents backups list <agent> shows the backups of the agent and their ids.";
+const backupHints = {
 	...agentHints,
-	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs.",
-	"runtime.monitor_paused": "kcloud agents resume <agent> lets the agent work again.",
-	"runtime.monitor_draining": "The agent stops after its current session; start it again to run a cycle.",
-	"runtime.monitor_limited": "The Claude usage limit holds; the monitor runs its next cycle once it resets.",
-	"runtime.monitor_check_unsupported": "Move the agent to Kikimora 0.10.0 or newer with kcloud agents set, then kcloud agents update."
+	"agent.backup_unavailable": "Backups need the Spaces of the platform and a node that can make them. An administrator of the platform configures the Spaces.",
+	"agent.backup_without_export": "The Kikimora release of the agent cannot export its memory. Move it to 0.12.0 or newer with kcloud agents set, then kcloud agents update.",
+	"agent.backup_in_progress": "A backup of the agent is running already. kcloud agents backups list <agent> shows it once the node has sent it.",
+	"node.offline": "The node of the agent is not connected, so it cannot make a backup. kcloud nodes show <node> tells when it was last seen."
 };
-const checkCommand = (adaptersOf) => defineCommand({
-	name: "check",
-	summary: "Run a monitor cycle now instead of waiting for the interval.",
-	usage: "agents check <agent> [--project <name>]",
-	optionsUsage: agentUsage,
-	options: agentOption,
+const restoreHints = {
+	...agentHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.offline": "The node is not connected. kcloud nodes show <node> tells when it was last seen.",
+	"agent.backup_not_found": `The backup does not exist or has expired. ${backupsListHint}`,
+	"agent.slug_taken": "Another agent of the project has that slug. Pass another with --slug.",
+	"agent.invalid_slug": "A slug holds lowercase letters, digits and hyphens."
+};
+const backupsOf = async (api, agentId) => dataOf("list the backups of the agent", await api.GET("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const requestedBackup = async (api, agentId) => dataOf("back the agent up", await api.POST("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const nodeIdFor = async (api, agentId, node) => {
+	if (isId(node)) return node;
+	const agent = dataOf("describe the agent", await api.GET("/agents/{id}", { params: { path: { id: agentId } } }), agentHints);
+	const project = await projectOf(api, agent.projectId);
+	const nodes = await nodesOf(api, project.organizationId);
+	return nodeIn(nodes, node, `the organization of ${project.slug}`).id;
+};
+const restoredAgent = async (api, agentId, { backupId, name, node, slug }) => {
+	const nodeId = await nodeIdFor(api, agentId, node);
+	return dataOf("restore the agent from the backup", await api.POST("/agents/{id}/backups/{backupId}/restore", {
+		params: { path: {
+			id: agentId,
+			backupId
+		} },
+		body: {
+			name,
+			nodeId,
+			...slug === void 0 ? {} : { slug }
+		}
+	}), restoreHints);
+};
+const keptFor = (days) => `A backup is kept for ${String(days)} ${days === 1 ? "day" : "days"}.`;
+const backupsTable = ({ items, retentionDays }) => items.length === 0 ? `The agent has no backup yet. ${keptFor(retentionDays)}` : [renderTable([
+	{ header: "CREATED" },
+	{ header: "TRIGGER" },
+	{ header: "NODE" },
+	{ header: "KIKIMORA" },
+	{
+		header: "ENTRIES",
+		align: "right"
+	},
+	{
+		header: "SIZE",
+		align: "right"
+	},
+	{ header: "EXPIRES" },
+	{ header: "ID" }
+], items.map((backup) => [
+	backup.createdAt,
+	backup.trigger,
+	backup.nodeName ?? backup.nodeId,
+	backup.kikimoraVersion,
+	String(backup.entries),
+	bytesOf(backup.sizeBytes),
+	backup.expiresAt,
+	backup.id
+])), keptFor(retentionDays)].join("\n");
+const restoreRequestOf = ({ backup, name, node, slug }) => {
+	if (backup === void 0 || name === void 0 || node === void 0 || node.trim() === "") {
+		const missing = [
+			...backup === void 0 ? ["--backup <id>"] : [],
+			...name === void 0 ? ["--name <name>"] : [],
+			...node === void 0 || node.trim() === "" ? ["--node <node>"] : []
+		];
+		throw new UsageError(`agents restore needs ${listOf(missing)}.`, backupsListHint);
+	}
+	if (!isId(backup)) throw new UsageError(`--backup ${backup} is not the id of a backup.`, backupsListHint);
+	const named = agentNameSchema.safeParse(name);
+	if (!named.success) throw new UsageError(`--name needs from 1 to ${String(80)} characters.`);
+	if (slug !== void 0 && !slugSchema.safeParse(slug).success) throw new UsageError(`--slug ${slug} is not a slug.`, "A slug holds lowercase letters, digits and hyphens, at most 40 of them.");
+	return {
+		backupId: backup,
+		name: named.data,
+		node: node.trim(),
+		slug
+	};
+};
+const backupsCommand = (adaptersOf) => defineGroup({
+	name: "backups",
+	summary: "The backups of the memory of an agent.",
+	usage: "agents backups <command>",
+	subcommands: [defineCommand({
+		name: "list",
+		summary: "List the backups of an agent, the newest first.",
+		usage: "agents backups list <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+			return printed(run, await backupsOf(run.api, agentId), backupsTable);
+		}
+	}), defineCommand({
+		name: "create",
+		summary: "Ask the node of an agent for a backup now.",
+		usage: "agents backups create <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = invocation.positionals[0] ?? "";
+			const agentId = await agentFrom(run, reference, invocation.values.project);
+			return printed(run, await requestedBackup(run.api, agentId), () => `Backup of ${reference} requested. kcloud agents backups list ${reference} shows it once the node has sent it.`);
+		}
+	})]
+});
+const restoreCommand = (adaptersOf) => defineCommand({
+	name: "restore",
+	summary: "Create a new agent from a backup of an agent.",
+	usage: "agents restore <agent> --backup <id> --name <name> --node <node> [--slug <slug>] [--project <name>]",
+	optionsUsage: [
+		...agentUsage,
+		["--backup <id>", "the backup, by its id from kcloud agents backups list"],
+		["--name <name>", "the name of the new agent"],
+		["--node <node>", "the node the new agent runs on, by name or id"],
+		["--slug <slug>", "the slug of the new agent (default: one made from its name)"],
+		["", "the new agent joins the project of the agent with its configuration and the memory of the backup"]
+	],
+	options: {
+		...agentOption,
+		backup: { type: "string" },
+		name: { type: "string" },
+		node: { type: "string" },
+		slug: { type: "string" }
+	},
 	positionals: {
 		min: 1,
 		max: 1
 	},
 	run: async (invocation) => {
+		const request = restoreRequestOf(invocation.values);
 		const run = await runOf(adaptersOf, invocation);
-		const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-		const check = dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: agentId } } }), checkHints);
-		return printed(run, check, (answer) => answer.state === "running" ? `Monitor cycle ${String(answer.cycle)} is already running.` : "Monitor cycle requested; it starts now, also outside the active hours.");
+		const reference = invocation.positionals[0] ?? "";
+		const agentId = await agentFrom(run, reference, invocation.values.project);
+		return printed(run, await restoredAgent(run.api, agentId, request), (restored) => [`Restored ${request.name} as ${restored.agentId} from backup ${request.backupId} of ${reference}.`, `kcloud agents start ${restored.agentId} starts it once it is provisioned.`].join("\n"));
 	}
 });
 //#endregion
-//#region src/render/body.ts
-const isTerminal$1 = (stream) => stream.isTTY === true;
-const pipedText$1 = async (stream) => {
-	const chunks = [];
-	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
-	return Buffer.concat(chunks).toString("utf8");
-};
-const fileOptions = { file: { type: "string" } };
-const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
-const documentOf = async (run, file) => {
-	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
-	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
-	try {
-		return JSON.parse(text);
-	} catch {
-		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
-	}
-};
-const readFileOrRefuse = async (path) => {
-	try {
-		return await readFile(path, "utf8");
-	} catch {
-		throw new CliError(`${path} could not be read.`);
-	}
-};
-const validated = (schema, document, what) => {
-	const parsed = schema.safeParse(document);
-	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
+//#region src/commands/agents/check.ts
+const checkHints = {
+	...agentHints,
+	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs.",
+	"runtime.monitor_paused": "kcloud agents resume <agent> lets the agent work again.",
+	"runtime.monitor_draining": "The agent stops after its current session; start it again to run a cycle.",
+	"runtime.monitor_limited": "The Claude usage limit holds; the monitor runs its next cycle once it resets.",
+	"runtime.monitor_check_unsupported": "Move the agent to Kikimora 0.10.0 or newer with kcloud agents set, then kcloud agents update."
 };
+const checkCommand = (adaptersOf) => defineCommand({
+	name: "check",
+	summary: "Run a monitor cycle now instead of waiting for the interval.",
+	usage: "agents check <agent> [--project <name>]",
+	optionsUsage: agentUsage,
+	options: agentOption,
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const run = await runOf(adaptersOf, invocation);
+		const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+		const check = dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: agentId } } }), checkHints);
+		return printed(run, check, (answer) => answer.state === "running" ? `Monitor cycle ${String(answer.cycle)} is already running.` : "Monitor cycle requested; it starts now, also outside the active hours.");
+	}
+});
 //#endregion
 //#region src/render/confirm.ts
 const confirmed = async ({ prompt, settings, question }) => {
@@ -4042,86 +4351,6 @@ const detailsOf = (agent) => [
 	]))
 ].join("\n");
 //#endregion
-//#region src/commands/nodes/shared.ts
-const nodeHints = {
-	...organizationHints,
-	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
-	"node.name_taken": "Another node of the organization has that name.",
-	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
-	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
-};
-const splitHints = {
-	...nodeHints,
-	"auth.forbidden": "Splitting a node takes an admin of its organization.",
-	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
-	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
-	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
-};
-const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
-const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
-const nodeIn = (nodes, reference, organization) => {
-	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
-	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
-	return found;
-};
-const resolveNode = async (scope, reference) => {
-	const organization = await scope.organization();
-	if (isId(reference)) return {
-		organizationId: organization.id,
-		nodeId: reference
-	};
-	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
-	return {
-		organizationId: organization.id,
-		nodeId: node.id
-	};
-};
-const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const createdNode = async (api, organizationId, name) => {
-	const body = { name };
-	validated(createNodeBodySchema, body, "a node");
-	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
-		params: { path: { organizationId } },
-		body
-	}), nodeHints);
-};
-const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const deleteNode = async (api, { organizationId, nodeId }) => {
-	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-		organizationId,
-		nodeId
-	} } }), nodeHints);
-};
-const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
-	params: { path: {
-		organizationId,
-		nodeId
-	} },
-	body: {
-		revision,
-		split
-	}
-}), splitHints);
-const nodeUsage = [["", "a node is named by its name or its id"]];
-//#endregion
-//#region src/commands/projects/shared.ts
-const defaultProjectColor = "#7c86ff";
-const projectHint = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"project.slug_taken": "Another project of the organization has that slug.",
-	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
-	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
-	"project.member_not_found": "kcloud projects members list <project> shows them.",
-	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
-};
-const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
-//#endregion
 //#region src/commands/agents/placement.ts
 const placedNodeId = async (run, { projectId, given, ask }) => {
 	const project = await projectOf(run.api, projectId);
@@ -5156,6 +5385,8 @@ const createAgentsCommand = (adaptersOf) => defineGroup({
 		...lifecycleCommands(adaptersOf),
 		checkCommand(adaptersOf),
 		tasksCommand(adaptersOf),
+		backupsCommand(adaptersOf),
+		restoreCommand(adaptersOf),
 		...observabilityCommands(adaptersOf),
 		...streamCommands(adaptersOf)
 	]
@@ -5788,75 +6019,6 @@ const agentTools = [
 	})
 ];
 //#endregion
-//#region src/mcp/tools/credentials.ts
-const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
-const credentialTools = [
-	defineTool({
-		name: "credentials_list",
-		title: "List credentials",
-		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
-		operations: ["listCredentials"],
-		safety: "read",
-		input: z.object({ project: projectField }),
-		run: async ({ project }, run) => credentialsOf(run.api, await projectIdOf(run, project))
-	}),
-	defineTool({
-		name: "credential_update",
-		title: "Rename or verify a credential",
-		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
-		operations: ["renameCredential", "verifyCredential"],
-		safety: "write",
-		input: z.object({
-			project: projectField,
-			credential: credentialField$1,
-			action: z.enum(["rename", "verify"]),
-			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
-		}),
-		run: async ({ project, credential, action, label }, run) => {
-			const projectId = await projectIdOf(run, project);
-			const credentialId = await resolveCredentialId(run.api, projectId, credential);
-			if (action === "verify") {
-				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
-					id: projectId,
-					credentialId
-				} } }), credentialHints);
-				return {
-					id: credentialId,
-					verifying: true
-				};
-			}
-			if (label === void 0) throw new UsageError("rename needs a label.");
-			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
-				params: { path: {
-					id: projectId,
-					credentialId
-				} },
-				body: { label }
-			}), credentialHints);
-		}
-	}),
-	defineTool({
-		name: "credential_delete",
-		title: "Delete a credential",
-		description: "Delete a credential of a project that no agent and no repository uses.",
-		operations: ["deleteCredential"],
-		safety: "destructive",
-		input: z.object({
-			project: projectField,
-			credential: credentialField$1
-		}),
-		run: async ({ project, credential }, run) => {
-			const projectId = await projectIdOf(run, project);
-			const credentialId = await resolveCredentialId(run.api, projectId, credential);
-			doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
-				id: projectId,
-				credentialId
-			} } }), credentialHints);
-			return { deleted: credentialId };
-		}
-	})
-];
-//#endregion
 //#region src/commands/nodes/split.ts
 const splitFields = [
 	"reserve.cpus",
@@ -6242,6 +6404,117 @@ const nodeTools = [
 	})
 ];
 //#endregion
+//#region src/mcp/tools/backups.ts
+const agentBackupTools = [
+	defineTool({
+		name: "agent_backups_list",
+		title: "List the backups of an agent",
+		description: "List the backups of the memory of an agent, the newest first, with their trigger, node, Kikimora release, entries, size and expiry, and the days a backup is kept.",
+		operations: ["listAgentBackups"],
+		safety: "read",
+		input: z.object(agentFields),
+		run: async (reference, run) => backupsOf(run.api, await agentIdOf(run, reference))
+	}),
+	defineTool({
+		name: "agent_backup_request",
+		title: "Back an agent up now",
+		description: "Ask the node of an agent for a backup of its memory now. state requested means the node makes it, and agent_backups_list shows it once the node has sent it.",
+		operations: ["requestAgentBackup"],
+		safety: "write",
+		input: z.object(agentFields),
+		run: async (reference, run) => requestedBackup(run.api, await agentIdOf(run, reference))
+	}),
+	defineTool({
+		name: "agent_restore",
+		title: "Restore an agent from a backup",
+		description: "Create a new agent in the project of an agent, with its configuration and the memory of one of its backups, on the node named. Returns the id of the new agent, which stays stopped until agent_action starts it.",
+		operations: ["restoreAgentFromBackup"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			backup: idSchema.describe("The id of the backup, from agent_backups_list."),
+			name: agentNameSchema.describe("The name of the new agent."),
+			slug: slugSchema.optional().describe("The slug of the new agent, instead of one made from its name."),
+			node: nodeField
+		}),
+		run: async ({ backup, name, slug, node, ...reference }, run) => restoredAgent(run.api, await agentIdOf(run, reference), {
+			backupId: backup,
+			name,
+			node,
+			slug
+		})
+	})
+];
+//#endregion
+//#region src/mcp/tools/credentials.ts
+const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
+const credentialTools = [
+	defineTool({
+		name: "credentials_list",
+		title: "List credentials",
+		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
+		operations: ["listCredentials"],
+		safety: "read",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => credentialsOf(run.api, await projectIdOf(run, project))
+	}),
+	defineTool({
+		name: "credential_update",
+		title: "Rename or verify a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
+		operations: ["renameCredential", "verifyCredential"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1,
+			action: z.enum(["rename", "verify"]),
+			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
+		}),
+		run: async ({ project, credential, action, label }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			if (action === "verify") {
+				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
+					id: projectId,
+					credentialId
+				} } }), credentialHints);
+				return {
+					id: credentialId,
+					verifying: true
+				};
+			}
+			if (label === void 0) throw new UsageError("rename needs a label.");
+			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
+				params: { path: {
+					id: projectId,
+					credentialId
+				} },
+				body: { label }
+			}), credentialHints);
+		}
+	}),
+	defineTool({
+		name: "credential_delete",
+		title: "Delete a credential",
+		description: "Delete a credential of a project that no agent and no repository uses.",
+		operations: ["deleteCredential"],
+		safety: "destructive",
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1
+		}),
+		run: async ({ project, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
+				id: projectId,
+				credentialId
+			} } }), credentialHints);
+			return { deleted: credentialId };
+		}
+	})
+];
+//#endregion
 //#region src/commands/notifications.ts
 const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
 const createNotificationsCommand = (adaptersOf) => defineGroup({
@@ -8263,6 +8536,7 @@ const kcloudTools = [
 	...projectToolTools,
 	...nodeTools,
 	...agentTools,
+	...agentBackupTools,
 	...taskTools,
 	...observabilityTools,
 	...notificationTools,
@@ -8359,6 +8633,22 @@ const runtimeRowsOf = (runtime) => [
 	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
 	["log readers", String(runtime.ingest.readers)]
 ];
+const updateOf = ({ update }) => {
+	if (update === null) return "not reported";
+	switch (update.state) {
+		case "current": return "current";
+		case "waiting": return `waits for ${String(update.sessions)} ${update.sessions === 1 ? "session" : "sessions"} to end before ${update.target ?? "-"}`;
+		case "updating": return `updating to ${update.target ?? "-"}`;
+		case "failed": return `failed to reach ${update.target ?? "-"}, runs its previous version`;
+		case "unmanaged": return "updated with its platform";
+	}
+};
+const lastUpdateOf = ({ update }) => {
+	const last = update?.last ?? null;
+	if (last === null) return null;
+	const outcome = `${last.outcome} ${last.version ?? "-"} at ${last.at}`;
+	return last.reason === null ? outcome : `${outcome}: ${last.reason}`;
+};
 const nodeDetailsText = (node) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", node.name],
@@ -8375,6 +8665,9 @@ const nodeDetailsText = (node) => [
 		["registration", registrationOf(node)],
 		["connected", node.connectedAt ?? "never"],
 		["last seen", node.lastSeenAt ?? "never"],
+		...node.offlineSince === null ? [] : [["offline since", node.offlineSince]],
+		["update", updateOf(node)],
+		...lastUpdateOf(node) === null ? [] : [["last update", lastUpdateOf(node) ?? ""]],
 		["created", node.createdAt],
 		["id", node.id]
 	]),

package/package.json

@@ -15,7 +15,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.16.0",
+  "version": "0.17.0",
   "dependencies": {
     "@clack/prompts": "1.8.1",
     "@modelcontextprotocol/server": "2.1.0",