@kikimoradev/kcloud 0.16.0 → 0.18.0

package/dist/main.js

@@ -386,6 +386,12 @@ const dispatcherOf = (spec) => {
 		}
 	};
 };
+//#endregion
+//#region ../../packages/cli-kit/src/list.ts
+const listOf = (items) => {
+	const last = items.at(-1);
+	return items.length < 2 || last === void 0 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${last}`;
+};
 const permissionsOutsideOwner = 63;
 const isMissing = (error) => error instanceof Error && error.code === "ENOENT";
 const ensurePrivateDirectory = async (path) => {
@@ -509,243 +515,6 @@ const spec = {
 const defineCommand = commandFactoryOf(spec);
 const defineGroup = (definition) => defineGroup$1(definition);
 const runCli = dispatcherOf(spec);
-const agentEventLevelSchema = z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-const agentRoles = [
-	"monitor",
-	"executor",
-	"summarizer"
-];
-const agentRoleSchema = z.enum(agentRoles);
-const agentLogStreams = ["stdout", "stderr"];
-z.enum(agentLogStreams);
-const platformStream = "platform";
-const agentEventStreams = [...agentLogStreams, platformStream];
-const agentEventStreamSchema = z.enum(agentEventStreams);
-const authKindSchema = z.enum([
-	"apiKey",
-	"oauth",
-	"claude.ai",
-	"unknown"
-]);
-const agentControlStateSchema = z.enum([
-	"running",
-	"pausing",
-	"paused"
-]);
-z.enum([
-	"session",
-	"diagnostic",
-	"task"
-]);
-const maxCostUsd = 1e3;
-const countSchema = z.int().min(0).max(2147483647);
-const costUsdSchema = z.number().min(0).max(maxCostUsd);
-const instantSchema$2 = z.iso.datetime();
-const workerEnvelope = (event) => ({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	event: z.literal(event)
-});
-const roleEnvelope = (event) => ({
-	...workerEnvelope(event),
-	agent: agentRoleSchema.optional()
-});
-const agentEventSchema = z.discriminatedUnion("event", [
-	z.looseObject({
-		...workerEnvelope("worker.started"),
-		version: z.string(),
-		claudeVersion: z.string().optional(),
-		nodeVersion: z.string(),
-		authKind: authKindSchema,
-		pid: countSchema,
-		projectDir: z.string(),
-		paused: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.stopped"),
-		signal: z.string().optional(),
-		drained: z.boolean().optional(),
-		forced: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.draining"),
-		reason: z.string(),
-		timeoutMs: countSchema.optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.available"),
-		from: z.string(),
-		to: z.string(),
-		installError: z.string().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.installed"),
-		from: z.string(),
-		to: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("control.changed"),
-		state: agentControlStateSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.started"),
-		cycle: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.finished"),
-		cycle: countSchema,
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		addedTasks: countSchema,
-		skippedDuplicates: countSchema,
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.offHours"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.sleeping"),
-		nextCycleAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema,
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.granted"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.released"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.cancelled"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("task.started"),
-		taskId: z.string(),
-		title: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.finished"),
-		taskId: z.string(),
-		title: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		numTurns: countSchema.optional(),
-		willRetry: z.boolean().optional(),
-		attempt: countSchema.optional(),
-		maxAttempts: countSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.retryScheduled"),
-		taskId: z.string(),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject(roleEnvelope("executor.waiting")),
-	z.looseObject({
-		...roleEnvelope("executor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.started"),
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.finished"),
-		taskId: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.init"),
-		model: z.string(),
-		sessionId: z.string(),
-		taskId: z.string().optional(),
-		cycle: countSchema.optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.stderr"),
-		line: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.procError"),
-		message: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.killed"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.text"),
-		text: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.tool"),
-		tool: z.string(),
-		detail: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.toolError"),
-		output: z.string()
-	})
-]);
-z.looseObject({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	agent: agentRoleSchema.optional(),
-	event: z.string().min(1).max(64)
-});
-agentEventSchema.options.map((option) => option.shape.event.value);
-({
-	rawLog: "log.raw",
-	rejectedLog: "log.rejected",
-	throttledLog: "log.throttled",
-	stateChanged: "platform.stateChanged",
-	crashLooping: "platform.crashLooping",
-	provisioned: "platform.provisioned",
-	sandboxStarted: "platform.sandboxStarted",
-	sandboxStopped: "platform.sandboxStopped"
-}).rawLog;
 //#endregion
 //#region ../../packages/contracts/src/patterns.ts
 const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
@@ -1021,6 +790,23 @@ const errorCodes = Object.keys({
 	"node.in_use": "conflict",
 	"node.host_unknown": "rule_violation",
 	"node.split_exceeds_host": "rule_violation",
+	"node.package_unavailable": "not_found",
+	"agent.backup_not_found": "not_found",
+	"agent.backup_unavailable": "rule_violation",
+	"agent.backup_without_export": "rule_violation",
+	"agent.backup_in_progress": "conflict",
+	"node.machine_missing": "rule_violation",
+	"node.operation_running": "conflict",
+	"node.operation_not_failed": "conflict",
+	"node.size_unavailable": "rule_violation",
+	"node.size_not_larger": "rule_violation",
+	"node.region_unavailable": "rule_violation",
+	"provider.not_found": "not_found",
+	"provider.name_taken": "conflict",
+	"provider.in_use": "conflict",
+	"provider.token_unauthorized": "rule_violation",
+	"provider.token_scopes_missing": "rule_violation",
+	"provider.unavailable": "rule_violation",
 	"project.last_admin": "conflict",
 	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
@@ -1057,6 +843,243 @@ const errorBodySchema = z.object({
 		message: z.string()
 	})).optional()
 }).meta({ id: "ErrorBody" });
+const agentEventLevelSchema = z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+const agentRoles = [
+	"monitor",
+	"executor",
+	"summarizer"
+];
+const agentRoleSchema = z.enum(agentRoles);
+const agentLogStreams = ["stdout", "stderr"];
+z.enum(agentLogStreams);
+const platformStream = "platform";
+const agentEventStreams = [...agentLogStreams, platformStream];
+const agentEventStreamSchema = z.enum(agentEventStreams);
+const authKindSchema = z.enum([
+	"apiKey",
+	"oauth",
+	"claude.ai",
+	"unknown"
+]);
+const agentControlStateSchema = z.enum([
+	"running",
+	"pausing",
+	"paused"
+]);
+z.enum([
+	"session",
+	"diagnostic",
+	"task"
+]);
+const maxCostUsd = 1e3;
+const countSchema = z.int().min(0).max(2147483647);
+const costUsdSchema = z.number().min(0).max(maxCostUsd);
+const instantSchema$2 = z.iso.datetime();
+const workerEnvelope = (event) => ({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	event: z.literal(event)
+});
+const roleEnvelope = (event) => ({
+	...workerEnvelope(event),
+	agent: agentRoleSchema.optional()
+});
+const agentEventSchema = z.discriminatedUnion("event", [
+	z.looseObject({
+		...workerEnvelope("worker.started"),
+		version: z.string(),
+		claudeVersion: z.string().optional(),
+		nodeVersion: z.string(),
+		authKind: authKindSchema,
+		pid: countSchema,
+		projectDir: z.string(),
+		paused: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.stopped"),
+		signal: z.string().optional(),
+		drained: z.boolean().optional(),
+		forced: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.draining"),
+		reason: z.string(),
+		timeoutMs: countSchema.optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.available"),
+		from: z.string(),
+		to: z.string(),
+		installError: z.string().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.installed"),
+		from: z.string(),
+		to: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("control.changed"),
+		state: agentControlStateSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.started"),
+		cycle: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.finished"),
+		cycle: countSchema,
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		addedTasks: countSchema,
+		skippedDuplicates: countSchema,
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.offHours"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.sleeping"),
+		nextCycleAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema,
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.granted"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.released"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.cancelled"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("task.started"),
+		taskId: z.string(),
+		title: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.finished"),
+		taskId: z.string(),
+		title: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		numTurns: countSchema.optional(),
+		willRetry: z.boolean().optional(),
+		attempt: countSchema.optional(),
+		maxAttempts: countSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.retryScheduled"),
+		taskId: z.string(),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject(roleEnvelope("executor.waiting")),
+	z.looseObject({
+		...roleEnvelope("executor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.started"),
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.finished"),
+		taskId: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.init"),
+		model: z.string(),
+		sessionId: z.string(),
+		taskId: z.string().optional(),
+		cycle: countSchema.optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.stderr"),
+		line: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.procError"),
+		message: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.killed"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.text"),
+		text: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.tool"),
+		tool: z.string(),
+		detail: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.toolError"),
+		output: z.string()
+	})
+]);
+z.looseObject({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	agent: agentRoleSchema.optional(),
+	event: z.string().min(1).max(64)
+});
+agentEventSchema.options.map((option) => option.shape.event.value);
+({
+	rawLog: "log.raw",
+	rejectedLog: "log.rejected",
+	throttledLog: "log.throttled",
+	stateChanged: "platform.stateChanged",
+	crashLooping: "platform.crashLooping",
+	provisioned: "platform.provisioned",
+	sandboxStarted: "platform.sandboxStarted",
+	sandboxStopped: "platform.sandboxStopped"
+}).rawLog;
 const agentStateSchema = z.enum([
 	"created",
 	"provisioning",
@@ -1429,6 +1452,83 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
+const providerKindSchema = z.enum(["digitalocean"]);
+const providerAccountNameSchema = z.string().trim().min(1).max(64);
+const providerTokenSchema = z.string().trim().min(16).max(512).regex(/^[\x21-\x7e]+$/u);
+const providerRegionSlugSchema = z.string().trim().regex(/^[a-z]{3}[0-9]$/u);
+const providerSizeSlugSchema = z.string().trim().regex(/^[a-z0-9][a-z0-9-]{0,63}$/u);
+const providerTokenScopes = [
+	"regions:read",
+	"sizes:read",
+	"image:read",
+	"vpc:read",
+	"actions:read",
+	"droplet:create",
+	"droplet:read",
+	"droplet:update",
+	"droplet:delete",
+	"block_storage:create",
+	"block_storage:read",
+	"block_storage:delete",
+	"block_storage_action:create",
+	"firewall:create",
+	"firewall:read",
+	"firewall:delete",
+	"tag:create",
+	"tag:read",
+	"tag:delete"
+];
+const providerTokenScopeSchema = z.enum(providerTokenScopes).meta({ id: "ProviderTokenScope" });
+const providerVerificationSchema = z.object({
+	checkedAt: z.iso.datetime(),
+	missingScopes: z.array(providerTokenScopeSchema),
+	failure: z.string().nullable()
+}).meta({ id: "ProviderVerification" });
+const providerAccountSchema = z.object({
+	id: idSchema,
+	kind: providerKindSchema,
+	name: z.string(),
+	defaultRegion: z.string(),
+	revision: z.int().nonnegative(),
+	verification: providerVerificationSchema,
+	nodeCount: z.int().nonnegative(),
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+}).meta({ id: "ProviderAccount" });
+z.object({ items: z.array(providerAccountSchema) }).meta({ id: "ProviderAccountList" });
+const createProviderAccountBodySchema = z.object({
+	kind: providerKindSchema,
+	name: providerAccountNameSchema,
+	token: providerTokenSchema,
+	defaultRegion: providerRegionSlugSchema
+}).meta({ id: "CreateProviderAccountBody" });
+z.object({
+	revision: z.int().nonnegative(),
+	name: providerAccountNameSchema.optional(),
+	token: providerTokenSchema.optional(),
+	defaultRegion: providerRegionSlugSchema.optional()
+}).meta({ id: "UpdateProviderAccountBody" });
+const providerRegionSchema = z.object({
+	slug: z.string(),
+	name: z.string(),
+	available: z.boolean()
+}).meta({ id: "ProviderRegion" });
+const providerSizeSchema = z.object({
+	slug: z.string(),
+	vcpus: z.int().positive(),
+	memoryMb: z.int().positive(),
+	diskGb: z.int().positive(),
+	priceMonthly: z.number().nonnegative(),
+	regions: z.array(z.string())
+}).meta({ id: "ProviderSize" });
+z.object({
+	regions: z.array(providerRegionSchema),
+	sizes: z.array(providerSizeSchema)
+}).meta({ id: "ProviderCatalog" });
+z.object({
+	organizationId: idSchema,
+	accountId: idSchema
+});
 z.enum(["monitor", "executor"]);
 const sessionSlotCountSchema = z.int().min(1).max(64);
 const sessionQueueEntrySchema = z.object({
@@ -1471,7 +1571,8 @@ const nodeStateSchema = z.enum([
 	"online",
 	"offline"
 ]);
-const nodeProviderSchema = z.enum(["self_hosted"]);
+const nodeProviders = ["self_hosted", "digitalocean"];
+const nodeProviderSchema = z.enum(nodeProviders);
 const nodeNameSchema = z.string().trim().regex(slugPattern);
 const nodeHostSchema = z.object({
 	cpus: z.number().nonnegative(),
@@ -1546,6 +1647,52 @@ const nodePoolsSchema = z.object({
 	monitor: nodePoolSchema,
 	executor: nodePoolSchema
 }).meta({ id: "NodePools" });
+const nodeVolumeGbSchema = z.int().min(10).max(4096);
+const nodeMachineSchema = z.object({
+	account: z.object({
+		id: idSchema,
+		name: z.string().nullable()
+	}),
+	region: z.string(),
+	size: z.string(),
+	volumeGb: z.int().positive(),
+	dropletId: z.int().positive().nullable(),
+	publicIpv4: z.string().nullable()
+}).meta({ id: "NodeMachine" });
+const nodeOperationKindSchema = z.enum([
+	"create",
+	"resize",
+	"delete"
+]);
+const nodeOperationStateSchema = z.enum(["running", "failed"]);
+const nodeOperationStepSchema = z.enum([
+	"tag",
+	"firewall",
+	"volume",
+	"droplet",
+	"boot",
+	"installing",
+	"power_off",
+	"resize_droplet",
+	"resize_volume",
+	"power_on",
+	"delete_droplet",
+	"delete_volume",
+	"delete_firewall",
+	"delete_tag"
+]);
+const nodeOperationSchema = z.object({
+	kind: nodeOperationKindSchema,
+	state: nodeOperationStateSchema,
+	step: nodeOperationStepSchema.nullable(),
+	error: z.string().nullable(),
+	target: z.object({
+		size: z.string(),
+		volumeGb: z.int().positive()
+	}).nullable(),
+	startedAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+}).meta({ id: "NodeOperation" });
 const nodeSchema = z.object({
 	id: idSchema,
 	name: nodeNameSchema,
@@ -1561,9 +1708,34 @@ const nodeSchema = z.object({
 	agentCount: z.int().nonnegative(),
 	connectedAt: z.iso.datetime().nullable(),
 	lastSeenAt: z.iso.datetime().nullable(),
+	offlineSince: z.iso.datetime().nullable(),
 	registrationExpiresAt: z.iso.datetime().nullable(),
+	machine: nodeMachineSchema.nullable(),
+	operation: nodeOperationSchema.nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Node" });
+const nodeUpdateSchema = z.object({
+	state: z.enum([
+		"current",
+		"waiting",
+		"updating",
+		"failed",
+		"unmanaged"
+	]),
+	target: z.string().nullable(),
+	sessions: z.int().nonnegative(),
+	since: z.iso.datetime().nullable(),
+	last: z.object({
+		outcome: z.enum([
+			"updated",
+			"rolledBack",
+			"failed"
+		]),
+		version: z.string().nullable(),
+		reason: z.string().nullable(),
+		at: z.iso.datetime()
+	}).nullable()
+}).meta({ id: "NodeUpdate" });
 const nodeAgentSchema = z.object({
 	id: idSchema,
 	name: z.string(),
@@ -1609,7 +1781,8 @@ const nodeRuntimeSchema = z.object({
 }).meta({ id: "NodeRuntime" });
 nodeSchema.extend({
 	agents: z.array(nodeAgentSchema),
-	runtime: nodeRuntimeSchema.nullable()
+	runtime: nodeRuntimeSchema.nullable(),
+	update: nodeUpdateSchema.nullable()
 }).meta({ id: "NodeDetail" });
 z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
 z.object({ nodeId: idSchema });
@@ -1621,15 +1794,34 @@ z.object({
 	revision: z.int().nonnegative(),
 	split: nodeSplitSchema.nullable()
 }).meta({ id: "UpdateNodeSplitBody" });
-const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
+const nodeMachineRequestSchema = z.object({
+	accountId: idSchema,
+	region: providerRegionSlugSchema,
+	size: providerSizeSlugSchema,
+	volumeGb: nodeVolumeGbSchema
+}).meta({ id: "NodeMachineRequest" });
+const createNodeBodySchema = z.object({
+	name: nodeNameSchema,
+	machine: nodeMachineRequestSchema.optional()
+}).meta({ id: "CreateNodeBody" });
+const resizeNodeBodySchema = z.object({
+	revision: z.int().nonnegative(),
+	size: providerSizeSlugSchema,
+	volumeGb: nodeVolumeGbSchema
+}).meta({ id: "ResizeNodeBody" });
+z.object({ revision: z.int().nonnegative() }).meta({ id: "RetryNodeOperationBody" });
 const nodeRegistrationSchema = z.object({
 	token: z.string(),
 	expiresAt: z.iso.datetime()
 }).meta({ id: "NodeRegistration" });
+z.object({
+	node: nodeSchema,
+	registration: nodeRegistrationSchema.nullable()
+}).meta({ id: "CreatedNode" });
 z.object({
 	node: nodeSchema,
 	registration: nodeRegistrationSchema
-}).meta({ id: "CreatedNode" }).meta({ id: "RenewedNodeRegistration" });
+}).meta({ id: "RenewedNodeRegistration" });
 z.object({
 	token: z.string().min(1).max(256),
 	version: z.string().min(1).max(128),
@@ -1637,6 +1829,16 @@ z.object({
 	host: nodeHostSchema.nullable(),
 	capabilities: nodeCapabilitiesSchema
 }).meta({ id: "RegisterNodeBody" });
+z.object({ token: z.string().min(1).max(256) }).meta({ id: "NodeInstallationBody" });
+z.object({
+	platformVersion: z.string(),
+	image: z.string().nullable(),
+	registry: z.object({
+		server: z.string(),
+		username: z.string(),
+		password: z.string()
+	}).nullable()
+}).meta({ id: "NodeInstallation" });
 z.object({
 	nodeId: idSchema,
 	credential: z.string()
@@ -1825,6 +2027,8 @@ const auditActionSchema = z.enum([
 	"agent.updated",
 	"agent.deleted",
 	"agent.action",
+	"agent.backup_requested",
+	"agent.restored",
 	"platform.settings_updated",
 	"runtime.sessions_updated",
 	"platform.upgrade_requested",
@@ -1844,6 +2048,18 @@ const auditActionSchema = z.enum([
 	"node.registration_renewed",
 	"node.deleted",
 	"node.split_changed",
+	"node.resize_requested",
+	"node.removal_requested",
+	"node.operation_retried",
+	"node.operation_failed",
+	"node.machine_created",
+	"node.machine_resized",
+	"node.machine_removed",
+	"provider_account.created",
+	"provider_account.updated",
+	"provider_account.token_replaced",
+	"provider_account.verified",
+	"provider_account.deleted",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1864,7 +2080,8 @@ const auditTargetTypeSchema = z.enum([
 	"host_operation",
 	"volume",
 	"queue",
-	"node"
+	"node",
+	"provider_account"
 ]);
 const auditEntrySchema = z.object({
 	id: idSchema,
@@ -2464,6 +2681,43 @@ z.object({
 		z.object({ code: errorCodeSchema })
 	])
 }).meta({ id: "AgentEventFrame" });
+//#endregion
+//#region ../../packages/contracts/src/agent-backups.ts
+const agentBackupTriggers = ["nightly", "manual"];
+const agentBackupSchema = z.object({
+	id: idSchema,
+	agentId: idSchema,
+	nodeId: idSchema,
+	nodeName: z.string().nullable(),
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string(),
+	entries: z.int().nonnegative(),
+	sizeBytes: z.int().nonnegative(),
+	createdAt: z.iso.datetime(),
+	expiresAt: z.iso.datetime()
+}).meta({ id: "AgentBackup" });
+z.object({
+	items: z.array(agentBackupSchema),
+	retentionDays: z.int().positive()
+}).meta({ id: "AgentBackupList" });
+z.object({ state: z.literal("requested") }).meta({ id: "AgentBackupRequested" });
+z.object({
+	id: idSchema,
+	backupId: idSchema
+});
+z.object({
+	name: agentNameSchema,
+	slug: slugSchema.optional(),
+	nodeId: idSchema
+}).meta({ id: "RestoreAgentBody" });
+z.object({ agentId: idSchema }).meta({ id: "RestoredAgent" });
+z.object({
+	agentId: idSchema,
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string().min(1).max(64),
+	entries: z.coerce.number().int().nonnegative()
+});
+z.object({ backupId: idSchema });
 [
 	"application/vnd.oci.image.index.v1+json",
 	"application/vnd.oci.image.manifest.v1+json",
@@ -2795,7 +3049,8 @@ const masterKeyVersionSchema = z.object({
 	secrets: z.object({
 		credentials: secretCountSchema,
 		toolSecrets: secretCountSchema,
-		platformSecrets: secretCountSchema
+		platformSecrets: secretCountSchema,
+		providerAccounts: secretCountSchema.default(0)
 	}),
 	backups: secretCountSchema,
 	newestBackupExpiresAt: instantSchema$1.nullable()
@@ -3644,6 +3899,254 @@ const createWhoamiCommand = (adaptersOf) => defineCommand({
 	}
 });
 //#endregion
+//#region src/render/body.ts
+const isTerminal$1 = (stream) => stream.isTTY === true;
+const pipedText$1 = async (stream) => {
+	const chunks = [];
+	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+};
+const fileOptions = { file: { type: "string" } };
+const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
+const documentOf = async (run, file) => {
+	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
+	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
+	}
+};
+const readFileOrRefuse = async (path) => {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		throw new CliError(`${path} could not be read.`);
+	}
+};
+const validated = (schema, document, what) => {
+	const parsed = schema.safeParse(document);
+	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
+};
+//#endregion
+//#region src/commands/providers/shared.ts
+const providerHints = {
+	...organizationHints,
+	"auth.forbidden": "Changing a provider account takes an admin of the organization.",
+	"provider.not_found": "kcloud providers list shows the provider accounts.",
+	"provider.name_taken": "Another provider account of the organization has that name.",
+	"provider.in_use": "Delete the nodes created with it first; kcloud nodes list shows the provider of each node.",
+	"provider.token_unauthorized": "DigitalOcean refused the token. Create a new one under API, Tokens in its control panel.",
+	"concurrency.conflict": "Someone changed the account meanwhile; run the command again."
+};
+const reasonOf$1 = (error) => {
+	const reason = error.details.reason;
+	return typeof reason === "string" && reason !== "" ? `: ${reason}` : "";
+};
+const missingScopesOf = (error) => {
+	const scopes = error.details.missingScopes;
+	return typeof scopes === "string" && scopes !== "" ? scopes : "some scopes";
+};
+const apiErrorOf$1 = (error) => {
+	if (error instanceof ApiError) return error;
+	return error instanceof Error ? apiErrorOf$1(error.cause) : null;
+};
+const explained = (error) => {
+	const failure = apiErrorOf$1(error);
+	switch (failure?.code) {
+		case "provider.token_scopes_missing": return new CliError(failure.message, `The token lacks ${missingScopesOf(failure)}. kcloud providers add --help lists every scope it needs.`, { cause: failure });
+		case "provider.unavailable": return new CliError(failure.message, `DigitalOcean did not answer as expected${reasonOf$1(failure)}. Try again in a moment.`, { cause: failure });
+		default: return error;
+	}
+};
+const providerDataOf = (action, answer, hints = providerHints) => {
+	try {
+		return dataOf(action, answer, hints);
+	} catch (error) {
+		throw explained(error);
+	}
+};
+const providerDoneWith = (action, answer, hints = providerHints) => {
+	try {
+		doneWith(action, answer, hints);
+	} catch (error) {
+		throw explained(error);
+	}
+};
+const providerAccountsOf = async (api, organizationId) => providerDataOf("list the provider accounts", await api.GET("/organizations/{organizationId}/provider-accounts", { params: { path: { organizationId } } })).items;
+const providerAccountOf = async (api, organizationId, accountId) => providerDataOf("describe the provider account", await api.GET("/organizations/{organizationId}/provider-accounts/{accountId}", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const resolveProviderAccount = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return providerAccountOf(scope.api, organization.id, reference);
+	const accounts = await providerAccountsOf(scope.api, organization.id);
+	const found = accounts.find((account) => account.name === reference);
+	if (found === void 0) throw new CliError(`There is no provider account ${reference} in ${organization.slug}.`, accounts.length === 0 ? "kcloud providers add <name> --region <slug> adds one." : `kcloud providers list shows ${accounts.map(({ name }) => name).join(", ")}.`);
+	return found;
+};
+const verifiedAccount = async (api, organizationId, accountId) => providerDataOf("verify the provider account", await api.POST("/organizations/{organizationId}/provider-accounts/{accountId}/verification", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const providerCatalogOf = async (api, organizationId, accountId) => providerDataOf("read the regions and sizes of the provider", await api.GET("/organizations/{organizationId}/provider-accounts/{accountId}/catalog", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const catalogInRegion = (catalog, region) => {
+	if (!catalog.regions.some(({ slug }) => slug === region)) throw new CliError(`The account offers no region ${region} for a node.`, `Its regions are ${catalog.regions.map(({ slug }) => slug).join(", ")}.`);
+	return {
+		region,
+		regions: catalog.regions,
+		sizes: catalog.sizes.filter(({ regions }) => regions.includes(region))
+	};
+};
+const deleteProviderAccount = async (api, organizationId, accountId) => {
+	providerDoneWith("delete the provider account", await api.DELETE("/organizations/{organizationId}/provider-accounts/{accountId}", { params: { path: {
+		organizationId,
+		accountId
+	} } }));
+};
+const verificationText = ({ failure, missingScopes }) => {
+	if (failure === "unauthorized") return "token refused";
+	if (failure !== null) return `not checked: ${failure}`;
+	return missingScopes.length === 0 ? "ok" : `missing ${missingScopes.length} of ${providerTokenScopes.length} scopes`;
+};
+const scopeLineWidth = 64;
+const scopeLines = () => providerTokenScopes.reduce((lines, scope) => {
+	const last = lines.at(-1);
+	if (last !== void 0 && last.length + scope.length + 2 <= scopeLineWidth) {
+		lines[lines.length - 1] = `${last}, ${scope}`;
+		return lines;
+	}
+	return [...lines, scope];
+}, []);
+//#endregion
+//#region src/commands/nodes/shared.ts
+const nodeHints = {
+	...organizationHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.name_taken": "Another node of the organization has that name.",
+	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token.",
+	"node.machine_missing": "The node runs on a host of its own, which the platform does not resize.",
+	"node.operation_running": "The platform is still working on the node; kcloud nodes show <node> shows the step.",
+	"node.operation_not_failed": "Only a failed operation can be retried; kcloud nodes show <node> shows the operation.",
+	"node.region_unavailable": "kcloud providers catalog <account> lists the regions a node can go to.",
+	"node.size_unavailable": "kcloud providers catalog <account> --region <slug> lists the sizes of a region.",
+	"node.size_not_larger": "A node only grows: name a size with more CPUs or memory, or a larger volume.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
+const machineHints = {
+	...providerHints,
+	...nodeHints,
+	"auth.forbidden": "Creating, resizing and deleting nodes take an admin of the organization."
+};
+const splitHints = {
+	...nodeHints,
+	"auth.forbidden": "Splitting a node takes an admin of its organization.",
+	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host."
+};
+const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
+const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
+const nodeIn = (nodes, reference, organization) => {
+	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
+	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
+	return found;
+};
+const resolveNode = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return {
+		organizationId: organization.id,
+		nodeId: reference
+	};
+	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
+	return {
+		organizationId: organization.id,
+		nodeId: node.id
+	};
+};
+const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const createdNode = async (api, organizationId, body) => {
+	validated(createNodeBodySchema, body, "a node");
+	return providerDataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+		params: { path: { organizationId } },
+		body
+	}), machineHints);
+};
+const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const deleteNode = async (api, { organizationId, nodeId }) => {
+	const answer = await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+		organizationId,
+		nodeId
+	} } });
+	providerDoneWith("delete the node", answer, machineHints);
+	return answer.response.status === 202 ? answer.data ?? null : null;
+};
+const resizeTargetOf = (node, { size, volumeGb }) => {
+	const { machine } = node;
+	if (machine === null) throw new CliError(`${node.name} runs on a host of its own, so the platform cannot resize it.`, "Only a node created with --provider digitalocean can be resized.");
+	const target = {
+		size: size ?? machine.size,
+		volumeGb: volumeGb ?? machine.volumeGb
+	};
+	if (target.volumeGb < machine.volumeGb) throw new CliError(`The volume of ${node.name} holds ${machine.volumeGb} GB, and a volume cannot shrink.`);
+	if (target.size === machine.size && target.volumeGb === machine.volumeGb) throw new CliError(`${node.name} is ${machine.size} with a volume of ${machine.volumeGb} GB already.`, "Name a larger size, a larger volume or both.");
+	return target;
+};
+const resizedNode = async (api, { organizationId, nodeId }, node, change) => {
+	const body = {
+		revision: node.revision,
+		...resizeTargetOf(node, change)
+	};
+	validated(resizeNodeBodySchema, body, "a size of a node");
+	return providerDataOf("resize the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/resize", {
+		params: { path: {
+			organizationId,
+			nodeId
+		} },
+		body
+	}), machineHints);
+};
+const retriedOperation = async (api, { organizationId, nodeId }, revision) => providerDataOf("retry the operation of the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/operation/retry", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: { revision }
+}), machineHints);
+const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: {
+		revision,
+		split
+	}
+}), splitHints);
+const nodeUsage = [["", "a node is named by its name or its id"]];
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+};
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
 //#region src/commands/run.ts
 const runOf = async (adaptersOf, { settings, context }) => {
 	const adapters = adaptersOf(context);
@@ -3682,6 +4185,161 @@ const agentFrom = async (run, reference, project) => {
 	return resolveAgentId(run, reference, project);
 };
 //#endregion
+//#region src/commands/agents/backups.ts
+const backupsListHint = "kcloud agents backups list <agent> shows the backups of the agent and their ids.";
+const backupHints = {
+	...agentHints,
+	"agent.backup_unavailable": "Backups need the Spaces of the platform and a node that can make them. An administrator of the platform configures the Spaces.",
+	"agent.backup_without_export": "The Kikimora release of the agent cannot export its memory. Move it to 0.12.0 or newer with kcloud agents set, then kcloud agents update.",
+	"agent.backup_in_progress": "A backup of the agent is running already. kcloud agents backups list <agent> shows it once the node has sent it.",
+	"node.offline": "The node of the agent is not connected, so it cannot make a backup. kcloud nodes show <node> tells when it was last seen."
+};
+const restoreHints = {
+	...agentHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.offline": "The node is not connected. kcloud nodes show <node> tells when it was last seen.",
+	"agent.backup_not_found": `The backup does not exist or has expired. ${backupsListHint}`,
+	"agent.slug_taken": "Another agent of the project has that slug. Pass another with --slug.",
+	"agent.invalid_slug": "A slug holds lowercase letters, digits and hyphens."
+};
+const backupsOf = async (api, agentId) => dataOf("list the backups of the agent", await api.GET("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const requestedBackup = async (api, agentId) => dataOf("back the agent up", await api.POST("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const nodeIdFor = async (api, agentId, node) => {
+	if (isId(node)) return node;
+	const agent = dataOf("describe the agent", await api.GET("/agents/{id}", { params: { path: { id: agentId } } }), agentHints);
+	const project = await projectOf(api, agent.projectId);
+	const nodes = await nodesOf(api, project.organizationId);
+	return nodeIn(nodes, node, `the organization of ${project.slug}`).id;
+};
+const restoredAgent = async (api, agentId, { backupId, name, node, slug }) => {
+	const nodeId = await nodeIdFor(api, agentId, node);
+	return dataOf("restore the agent from the backup", await api.POST("/agents/{id}/backups/{backupId}/restore", {
+		params: { path: {
+			id: agentId,
+			backupId
+		} },
+		body: {
+			name,
+			nodeId,
+			...slug === void 0 ? {} : { slug }
+		}
+	}), restoreHints);
+};
+const keptFor = (days) => `A backup is kept for ${String(days)} ${days === 1 ? "day" : "days"}.`;
+const backupsTable = ({ items, retentionDays }) => items.length === 0 ? `The agent has no backup yet. ${keptFor(retentionDays)}` : [renderTable([
+	{ header: "CREATED" },
+	{ header: "TRIGGER" },
+	{ header: "NODE" },
+	{ header: "KIKIMORA" },
+	{
+		header: "ENTRIES",
+		align: "right"
+	},
+	{
+		header: "SIZE",
+		align: "right"
+	},
+	{ header: "EXPIRES" },
+	{ header: "ID" }
+], items.map((backup) => [
+	backup.createdAt,
+	backup.trigger,
+	backup.nodeName ?? backup.nodeId,
+	backup.kikimoraVersion,
+	String(backup.entries),
+	bytesOf(backup.sizeBytes),
+	backup.expiresAt,
+	backup.id
+])), keptFor(retentionDays)].join("\n");
+const restoreRequestOf = ({ backup, name, node, slug }) => {
+	if (backup === void 0 || name === void 0 || node === void 0 || node.trim() === "") {
+		const missing = [
+			...backup === void 0 ? ["--backup <id>"] : [],
+			...name === void 0 ? ["--name <name>"] : [],
+			...node === void 0 || node.trim() === "" ? ["--node <node>"] : []
+		];
+		throw new UsageError(`agents restore needs ${listOf(missing)}.`, backupsListHint);
+	}
+	if (!isId(backup)) throw new UsageError(`--backup ${backup} is not the id of a backup.`, backupsListHint);
+	const named = agentNameSchema.safeParse(name);
+	if (!named.success) throw new UsageError(`--name needs from 1 to ${String(80)} characters.`);
+	if (slug !== void 0 && !slugSchema.safeParse(slug).success) throw new UsageError(`--slug ${slug} is not a slug.`, "A slug holds lowercase letters, digits and hyphens, at most 40 of them.");
+	return {
+		backupId: backup,
+		name: named.data,
+		node: node.trim(),
+		slug
+	};
+};
+const backupsCommand = (adaptersOf) => defineGroup({
+	name: "backups",
+	summary: "The backups of the memory of an agent.",
+	usage: "agents backups <command>",
+	subcommands: [defineCommand({
+		name: "list",
+		summary: "List the backups of an agent, the newest first.",
+		usage: "agents backups list <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+			return printed(run, await backupsOf(run.api, agentId), backupsTable);
+		}
+	}), defineCommand({
+		name: "create",
+		summary: "Ask the node of an agent for a backup now.",
+		usage: "agents backups create <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = invocation.positionals[0] ?? "";
+			const agentId = await agentFrom(run, reference, invocation.values.project);
+			return printed(run, await requestedBackup(run.api, agentId), () => `Backup of ${reference} requested. kcloud agents backups list ${reference} shows it once the node has sent it.`);
+		}
+	})]
+});
+const restoreCommand = (adaptersOf) => defineCommand({
+	name: "restore",
+	summary: "Create a new agent from a backup of an agent.",
+	usage: "agents restore <agent> --backup <id> --name <name> --node <node> [--slug <slug>] [--project <name>]",
+	optionsUsage: [
+		...agentUsage,
+		["--backup <id>", "the backup, by its id from kcloud agents backups list"],
+		["--name <name>", "the name of the new agent"],
+		["--node <node>", "the node the new agent runs on, by name or id"],
+		["--slug <slug>", "the slug of the new agent (default: one made from its name)"],
+		["", "the new agent joins the project of the agent with its configuration and the memory of the backup"]
+	],
+	options: {
+		...agentOption,
+		backup: { type: "string" },
+		name: { type: "string" },
+		node: { type: "string" },
+		slug: { type: "string" }
+	},
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const request = restoreRequestOf(invocation.values);
+		const run = await runOf(adaptersOf, invocation);
+		const reference = invocation.positionals[0] ?? "";
+		const agentId = await agentFrom(run, reference, invocation.values.project);
+		return printed(run, await restoredAgent(run.api, agentId, request), (restored) => [`Restored ${request.name} as ${restored.agentId} from backup ${request.backupId} of ${reference}.`, `kcloud agents start ${restored.agentId} starts it once it is provisioned.`].join("\n"));
+	}
+});
+//#endregion
 //#region src/commands/agents/check.ts
 const checkHints = {
 	...agentHints,
@@ -3709,36 +4367,6 @@ const checkCommand = (adaptersOf) => defineCommand({
 	}
 });
 //#endregion
-//#region src/render/body.ts
-const isTerminal$1 = (stream) => stream.isTTY === true;
-const pipedText$1 = async (stream) => {
-	const chunks = [];
-	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
-	return Buffer.concat(chunks).toString("utf8");
-};
-const fileOptions = { file: { type: "string" } };
-const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
-const documentOf = async (run, file) => {
-	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
-	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
-	try {
-		return JSON.parse(text);
-	} catch {
-		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
-	}
-};
-const readFileOrRefuse = async (path) => {
-	try {
-		return await readFile(path, "utf8");
-	} catch {
-		throw new CliError(`${path} could not be read.`);
-	}
-};
-const validated = (schema, document, what) => {
-	const parsed = schema.safeParse(document);
-	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
-};
-//#endregion
 //#region src/render/confirm.ts
 const confirmed = async ({ prompt, settings, question }) => {
 	if (settings.yes) return;
@@ -4042,86 +4670,6 @@ const detailsOf = (agent) => [
 	]))
 ].join("\n");
 //#endregion
-//#region src/commands/nodes/shared.ts
-const nodeHints = {
-	...organizationHints,
-	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
-	"node.name_taken": "Another node of the organization has that name.",
-	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
-	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
-};
-const splitHints = {
-	...nodeHints,
-	"auth.forbidden": "Splitting a node takes an admin of its organization.",
-	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
-	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
-	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
-};
-const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
-const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
-const nodeIn = (nodes, reference, organization) => {
-	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
-	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
-	return found;
-};
-const resolveNode = async (scope, reference) => {
-	const organization = await scope.organization();
-	if (isId(reference)) return {
-		organizationId: organization.id,
-		nodeId: reference
-	};
-	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
-	return {
-		organizationId: organization.id,
-		nodeId: node.id
-	};
-};
-const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const createdNode = async (api, organizationId, name) => {
-	const body = { name };
-	validated(createNodeBodySchema, body, "a node");
-	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
-		params: { path: { organizationId } },
-		body
-	}), nodeHints);
-};
-const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const deleteNode = async (api, { organizationId, nodeId }) => {
-	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-		organizationId,
-		nodeId
-	} } }), nodeHints);
-};
-const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
-	params: { path: {
-		organizationId,
-		nodeId
-	} },
-	body: {
-		revision,
-		split
-	}
-}), splitHints);
-const nodeUsage = [["", "a node is named by its name or its id"]];
-//#endregion
-//#region src/commands/projects/shared.ts
-const defaultProjectColor = "#7c86ff";
-const projectHint = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"project.slug_taken": "Another project of the organization has that slug.",
-	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
-	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
-	"project.member_not_found": "kcloud projects members list <project> shows them.",
-	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
-};
-const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
-//#endregion
 //#region src/commands/agents/placement.ts
 const placedNodeId = async (run, { projectId, given, ask }) => {
 	const project = await projectOf(run.api, projectId);
@@ -5156,6 +5704,8 @@ const createAgentsCommand = (adaptersOf) => defineGroup({
 		...lifecycleCommands(adaptersOf),
 		checkCommand(adaptersOf),
 		tasksCommand(adaptersOf),
+		backupsCommand(adaptersOf),
+		restoreCommand(adaptersOf),
 		...observabilityCommands(adaptersOf),
 		...streamCommands(adaptersOf)
 	]
@@ -5788,75 +6338,6 @@ const agentTools = [
 	})
 ];
 //#endregion
-//#region src/mcp/tools/credentials.ts
-const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
-const credentialTools = [
-	defineTool({
-		name: "credentials_list",
-		title: "List credentials",
-		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
-		operations: ["listCredentials"],
-		safety: "read",
-		input: z.object({ project: projectField }),
-		run: async ({ project }, run) => credentialsOf(run.api, await projectIdOf(run, project))
-	}),
-	defineTool({
-		name: "credential_update",
-		title: "Rename or verify a credential",
-		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
-		operations: ["renameCredential", "verifyCredential"],
-		safety: "write",
-		input: z.object({
-			project: projectField,
-			credential: credentialField$1,
-			action: z.enum(["rename", "verify"]),
-			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
-		}),
-		run: async ({ project, credential, action, label }, run) => {
-			const projectId = await projectIdOf(run, project);
-			const credentialId = await resolveCredentialId(run.api, projectId, credential);
-			if (action === "verify") {
-				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
-					id: projectId,
-					credentialId
-				} } }), credentialHints);
-				return {
-					id: credentialId,
-					verifying: true
-				};
-			}
-			if (label === void 0) throw new UsageError("rename needs a label.");
-			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
-				params: { path: {
-					id: projectId,
-					credentialId
-				} },
-				body: { label }
-			}), credentialHints);
-		}
-	}),
-	defineTool({
-		name: "credential_delete",
-		title: "Delete a credential",
-		description: "Delete a credential of a project that no agent and no repository uses.",
-		operations: ["deleteCredential"],
-		safety: "destructive",
-		input: z.object({
-			project: projectField,
-			credential: credentialField$1
-		}),
-		run: async ({ project, credential }, run) => {
-			const projectId = await projectIdOf(run, project);
-			const credentialId = await resolveCredentialId(run.api, projectId, credential);
-			doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
-				id: projectId,
-				credentialId
-			} } }), credentialHints);
-			return { deleted: credentialId };
-		}
-	})
-];
-//#endregion
 //#region src/commands/nodes/split.ts
 const splitFields = [
 	"reserve.cpus",
@@ -6175,7 +6656,7 @@ const nodeTools = [
 	defineTool({
 		name: "nodes_list",
 		title: "List nodes",
-		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version, capabilities, split and agent count.",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their provider, state, engine, version, capabilities, split, agent count, the DigitalOcean machine of a node created there, and the operation the platform runs on it.",
 		operations: ["listNodes"],
 		safety: "read",
 		input: z.object({}),
@@ -6184,7 +6665,7 @@ const nodeTools = [
 	defineTool({
 		name: "node_show",
 		title: "Show a node",
-		description: "Show one node with its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
+		description: "Show one node with its provider, its DigitalOcean machine and the step and error of its operation, its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
 		operations: ["getNode"],
 		safety: "read",
 		input: z.object({ node: nodeField }),
@@ -6228,16 +6709,161 @@ const nodeTools = [
 		}
 	}),
 	defineTool({
-		name: "node_delete",
-		title: "Delete a node",
-		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
-		operations: ["deleteNode"],
+		name: "node_resize",
+		title: "Resize a node on DigitalOcean",
+		description: "Give a node created on DigitalOcean a larger droplet size, a larger volume for its agents, or both; a field left out keeps its value, and a node never shrinks. A new size powers the droplet off, so its agents stop until it runs again. Returns the node with the operation that started; node_show follows its steps. Takes an admin of the organization.",
+		operations: ["getNode", "resizeNode"],
+		safety: "destructive",
+		input: z.object({
+			node: nodeField,
+			size: providerSizeSlugSchema.optional().describe("The new droplet size, from provider_catalog."),
+			volumeGb: nodeVolumeGbSchema.optional().describe("The new size of the volume in GB.")
+		}),
+		run: async ({ node, size, volumeGb }, run) => {
+			if (size === void 0 && volumeGb === void 0) throw new CliError("Name a size, a volume or both.");
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			return resizedNode(run.api, reference, detail, {
+				size,
+				volumeGb
+			});
+		}
+	}),
+	defineTool({
+		name: "node_retry",
+		title: "Retry the operation of a node",
+		description: "Run the failed create, resize or delete operation of a node on DigitalOcean again from the step that failed. Returns the node; node_show follows its steps. Takes an admin of the organization.",
+		operations: ["getNode", "retryNodeOperation"],
+		safety: "write",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			return retriedOperation(run.api, reference, detail.revision);
+		}
+	}),
+	defineTool({
+		name: "node_delete",
+		title: "Delete a node",
+		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it. A self-hosted node is deleted at once and returns deleted; for a node on DigitalOcean the platform destroys its droplet and its volume first and returns the node as removing.",
+		operations: ["deleteNode"],
+		safety: "destructive",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const removing = await deleteNode(run.api, reference);
+			return removing === null ? { deleted: reference.nodeId } : { removing };
+		}
+	})
+];
+//#endregion
+//#region src/mcp/tools/backups.ts
+const agentBackupTools = [
+	defineTool({
+		name: "agent_backups_list",
+		title: "List the backups of an agent",
+		description: "List the backups of the memory of an agent, the newest first, with their trigger, node, Kikimora release, entries, size and expiry, and the days a backup is kept.",
+		operations: ["listAgentBackups"],
+		safety: "read",
+		input: z.object(agentFields),
+		run: async (reference, run) => backupsOf(run.api, await agentIdOf(run, reference))
+	}),
+	defineTool({
+		name: "agent_backup_request",
+		title: "Back an agent up now",
+		description: "Ask the node of an agent for a backup of its memory now. state requested means the node makes it, and agent_backups_list shows it once the node has sent it.",
+		operations: ["requestAgentBackup"],
+		safety: "write",
+		input: z.object(agentFields),
+		run: async (reference, run) => requestedBackup(run.api, await agentIdOf(run, reference))
+	}),
+	defineTool({
+		name: "agent_restore",
+		title: "Restore an agent from a backup",
+		description: "Create a new agent in the project of an agent, with its configuration and the memory of one of its backups, on the node named. Returns the id of the new agent, which stays stopped until agent_action starts it.",
+		operations: ["restoreAgentFromBackup"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			backup: idSchema.describe("The id of the backup, from agent_backups_list."),
+			name: agentNameSchema.describe("The name of the new agent."),
+			slug: slugSchema.optional().describe("The slug of the new agent, instead of one made from its name."),
+			node: nodeField
+		}),
+		run: async ({ backup, name, slug, node, ...reference }, run) => restoredAgent(run.api, await agentIdOf(run, reference), {
+			backupId: backup,
+			name,
+			node,
+			slug
+		})
+	})
+];
+//#endregion
+//#region src/mcp/tools/credentials.ts
+const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
+const credentialTools = [
+	defineTool({
+		name: "credentials_list",
+		title: "List credentials",
+		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
+		operations: ["listCredentials"],
+		safety: "read",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => credentialsOf(run.api, await projectIdOf(run, project))
+	}),
+	defineTool({
+		name: "credential_update",
+		title: "Rename or verify a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
+		operations: ["renameCredential", "verifyCredential"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1,
+			action: z.enum(["rename", "verify"]),
+			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
+		}),
+		run: async ({ project, credential, action, label }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			if (action === "verify") {
+				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
+					id: projectId,
+					credentialId
+				} } }), credentialHints);
+				return {
+					id: credentialId,
+					verifying: true
+				};
+			}
+			if (label === void 0) throw new UsageError("rename needs a label.");
+			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
+				params: { path: {
+					id: projectId,
+					credentialId
+				} },
+				body: { label }
+			}), credentialHints);
+		}
+	}),
+	defineTool({
+		name: "credential_delete",
+		title: "Delete a credential",
+		description: "Delete a credential of a project that no agent and no repository uses.",
+		operations: ["deleteCredential"],
 		safety: "destructive",
-		input: z.object({ node: nodeField }),
-		run: async ({ node }, run) => {
-			const reference = await resolveNode(run, node);
-			await deleteNode(run.api, reference);
-			return { deleted: reference.nodeId };
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1
+		}),
+		run: async ({ project, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
+				id: projectId,
+				credentialId
+			} } }), credentialHints);
+			return { deleted: credentialId };
 		}
 	})
 ];
@@ -7854,6 +8480,71 @@ const projectTools = [
 	})
 ];
 //#endregion
+//#region src/mcp/tools/providers.ts
+const accountField = z.string().trim().min(1).describe("The provider account, by its name or its id, from providers_list.");
+const providerTools = [
+	defineTool({
+		name: "providers_list",
+		title: "List provider accounts",
+		description: "List the DigitalOcean accounts of the organization this server acts in, with their default region, the number of nodes created with each, and the last check of their token, never the token itself.",
+		operations: ["listProviderAccounts"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => providerAccountsOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "provider_show",
+		title: "Show a provider account",
+		description: "Show one provider account with its default region, its node count and the last check of its token: when it ran, the scopes it lacked and why it failed.",
+		operations: ["getProviderAccount"],
+		safety: "read",
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => resolveProviderAccount(run, account)
+	}),
+	defineTool({
+		name: "provider_catalog",
+		title: "List regions and sizes",
+		description: "List the regions of a provider account that offer volumes, and the sizes with at least 2 GB of memory a node can have in one region, with CPUs, memory in MB, disk in GB and the monthly price in USD. The region defaults to the default region of the account.",
+		operations: ["getProviderCatalog"],
+		safety: "read",
+		input: z.object({
+			account: accountField,
+			region: providerRegionSlugSchema.optional().describe("The region whose sizes to list, as in fra1.")
+		}),
+		run: async ({ account, region }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			const catalog = await providerCatalogOf(run.api, (await run.organization()).id, found.id);
+			return catalogInRegion(catalog, region ?? found.defaultRegion);
+		}
+	}),
+	defineTool({
+		name: "provider_verify",
+		title: "Check the token of a provider account",
+		description: "Check the token of a provider account against DigitalOcean again and return the account with the result: missingScopes lists the scopes it lacks, and failure is unauthorized when DigitalOcean refused it. Takes an admin of the organization.",
+		operations: ["verifyProviderAccount"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			return verifiedAccount(run.api, (await run.organization()).id, found.id);
+		}
+	}),
+	defineTool({
+		name: "provider_delete",
+		title: "Delete a provider account",
+		description: "Delete a provider account and erase its token. The instance refuses while nodes created with it exist. Takes an admin of the organization.",
+		operations: ["deleteProviderAccount"],
+		safety: "destructive",
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			await deleteProviderAccount(run.api, (await run.organization()).id, found.id);
+			return { deleted: found.id };
+		}
+	})
+];
+//#endregion
 //#region src/mcp/tools/releases.ts
 const releaseTools = [defineTool({
 	name: "releases_list",
@@ -8261,8 +8952,10 @@ const kcloudTools = [
 	...credentialTools,
 	...repositoryTools,
 	...projectToolTools,
+	...providerTools,
 	...nodeTools,
 	...agentTools,
+	...agentBackupTools,
 	...taskTools,
 	...observabilityTools,
 	...notificationTools,
@@ -8277,7 +8970,7 @@ const instructions = [
 	"These tools act on one Kikimora Cloud instance, as the account kcloud is signed in with, in one organization of it. whoami names all three.",
 	"Name a project by its slug, its name or its id. Name an agent as <project>/<agent>, as its slug or name together with project, or by its id.",
 	"A refusal quotes the error code of the instance. Its hint may name a kcloud command, such as kcloud agents list; the tool for the same resource and verb, agents_list, does that work here.",
-	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud tokens create, kcloud auth password, kcloud orgs members add, kcloud orgs members reset-password, or sets the secrets of a tool in the panel."
+	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud providers add, kcloud providers update, kcloud tokens create, kcloud auth password, kcloud orgs members add, kcloud orgs members reset-password, or sets the secrets of a tool in the panel."
 ].join("\n");
 const createKcloudServer = ({ version, open }) => {
 	const server = new McpServer({
@@ -8341,6 +9034,7 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 });
 //#endregion
 //#region src/commands/nodes/index.ts
+const defaultVolumeGb = 40;
 const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
 const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
 const capabilitiesOf = (node) => {
@@ -8350,6 +9044,25 @@ const capabilitiesOf = (node) => {
 };
 const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
 const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const shapeText = ({ size, volumeGb }) => `${size} with a volume of ${volumeGb} GB`;
+const machineText = (machine) => `${machine.size} in ${machine.region} with a volume of ${machine.volumeGb} GB`;
+const dropletText = ({ dropletId, publicIpv4 }) => dropletId === null ? "not created yet" : `${dropletId} at ${publicIpv4 ?? "no address yet"}`;
+const operationText = ({ kind, state, step }) => `${kind} ${state}${step === null ? "" : ` at ${step}`}`;
+const machineRowsOf = (machine) => machine === null ? [] : [
+	["machine", machineText(machine)],
+	["account", machine.account.name ?? machine.account.id],
+	["droplet", dropletText(machine)]
+];
+const operationRowsOf = (operation) => {
+	if (operation === null) return [];
+	const { target, error } = operation;
+	return [
+		["operation", operationText(operation)],
+		...target === null ? [] : [["target", shapeText(target)]],
+		["started", operation.startedAt],
+		...error === null ? [] : [["error", error]]
+	];
+};
 const runtimeRowsOf = (runtime) => [
 	["reported", runtime.reportedAt],
 	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
@@ -8359,11 +9072,29 @@ const runtimeRowsOf = (runtime) => [
 	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
 	["log readers", String(runtime.ingest.readers)]
 ];
+const updateOf = ({ update }) => {
+	if (update === null) return "not reported";
+	switch (update.state) {
+		case "current": return "current";
+		case "waiting": return `waits for ${String(update.sessions)} ${update.sessions === 1 ? "session" : "sessions"} to end before ${update.target ?? "-"}`;
+		case "updating": return `updating to ${update.target ?? "-"}`;
+		case "failed": return `failed to reach ${update.target ?? "-"}, runs its previous version`;
+		case "unmanaged": return "updated with its platform";
+	}
+};
+const lastUpdateOf = ({ update }) => {
+	const last = update?.last ?? null;
+	if (last === null) return null;
+	const outcome = `${last.outcome} ${last.version ?? "-"} at ${last.at}`;
+	return last.reason === null ? outcome : `${outcome}: ${last.reason}`;
+};
 const nodeDetailsText = (node) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", node.name],
 		["state", node.state],
 		["provider", node.provider],
+		...machineRowsOf(node.machine),
+		...operationRowsOf(node.operation),
 		["engine", node.engine ?? "-"],
 		["version", node.version ?? "-"],
 		["host", hostOf(node)],
@@ -8375,6 +9106,9 @@ const nodeDetailsText = (node) => [
 		["registration", registrationOf(node)],
 		["connected", node.connectedAt ?? "never"],
 		["last seen", node.lastSeenAt ?? "never"],
+		...node.offlineSince === null ? [] : [["offline since", node.offlineSince]],
+		["update", updateOf(node)],
+		...lastUpdateOf(node) === null ? [] : [["last update", lastUpdateOf(node) ?? ""]],
 		["created", node.createdAt],
 		["id", node.id]
 	]),
@@ -8399,11 +9133,13 @@ const nodeDetailsText = (node) => [
 		poolsText(node.runtime.pools)
 	]
 ].join("\n");
-const startHintOf = (origin) => [
-	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
-	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
-	"On a Windows PC:",
-	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+const installCommandsOf = (origin) => [
+	"Install the node with it, putting the token in place of <token>. On a Linux host:",
+	`  curl -fsSLo install-node.sh ${origin}/install-node.sh`,
+	`  printf '%s\\n' '<token>' | sudo sh install-node.sh --platform-url ${origin} --registration-token -`,
+	"On Windows, in PowerShell as administrator:",
+	`  Invoke-WebRequest -UseBasicParsing -OutFile install-node.ps1 ${origin}/install-node.ps1`,
+	`  powershell -NoProfile -ExecutionPolicy Bypass -File .\\install-node.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
 ].join("\n");
 const printedRegistration = (run, created) => {
 	if (run.settings.json) {
@@ -8411,9 +9147,56 @@ const printedRegistration = (run, created) => {
 		return exitCodes.ok;
 	}
 	run.context.terminal.line(created.registration.token);
-	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, installCommandsOf(run.origin)].join("\n"));
 	return exitCodes.ok;
 };
+const printedCreation = (run, created) => {
+	const { node, registration } = created;
+	if (registration !== null) return printedRegistration(run, {
+		node,
+		registration
+	});
+	return printed(run, created, () => [`Creating ${node.name} on DigitalOcean${node.machine === null ? "" : `, ${machineText(node.machine)}`}.`, `It joins the platform on its own; kcloud nodes show ${node.name} follows the steps.`].join("\n"));
+};
+const createOptions = {
+	provider: { type: "string" },
+	account: { type: "string" },
+	region: { type: "string" },
+	size: { type: "string" },
+	"volume-gb": { type: "string" }
+};
+const volumeGbOf = (given) => {
+	if (given === void 0) return void 0;
+	if (!/^[0-9]+$/u.test(given)) throw new UsageError(`--volume-gb ${given} is not a whole number of gigabytes.`);
+	return Number(given);
+};
+const machineFlags = [
+	"account",
+	"region",
+	"size",
+	"volume-gb"
+];
+const nodeBodyOf = async (run, name, values) => {
+	const provider = nodeProviders.find((candidate) => candidate === (values.provider ?? "self_hosted"));
+	if (provider === void 0) throw new UsageError(`--provider ${values.provider ?? ""} is not a provider of a node.`, `The providers are ${nodeProviders.join(", ")}.`);
+	if (provider === "self_hosted") {
+		const given = machineFlags.filter((flag) => values[flag] !== void 0);
+		if (given.length > 0) throw new UsageError(`${given.map((flag) => `--${flag}`).join(", ")} need --provider digitalocean.`);
+		return { name };
+	}
+	if (values.account === void 0 || values.size === void 0) throw new UsageError("A node on DigitalOcean needs --account <account> and --size <slug>.", "kcloud providers catalog <account> lists the sizes.");
+	const volumeGb = volumeGbOf(values["volume-gb"]) ?? defaultVolumeGb;
+	const account = await resolveProviderAccount(run, values.account);
+	return {
+		name,
+		machine: {
+			accountId: account.id,
+			region: values.region ?? account.defaultRegion,
+			size: values.size,
+			volumeGb
+		}
+	};
+};
 const createNodesCommand = (adaptersOf) => defineGroup({
 	name: "nodes",
 	summary: "The nodes of the organization, the hosts its agents run on.",
@@ -8434,7 +9217,9 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				const items = await nodesOf(run.api, organization.id);
 				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
 					{ header: "NAME" },
+					{ header: "PROVIDER" },
 					{ header: "STATE" },
+					{ header: "OPERATION" },
 					{ header: "ENGINE" },
 					{ header: "VERSION" },
 					{
@@ -8445,7 +9230,9 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 					{ header: "ID" }
 				], nodes.map((node) => [
 					node.name,
+					node.provider,
 					node.state,
+					node.operation === null ? "-" : operationText(node.operation),
 					node.engine ?? "-",
 					node.version ?? "-",
 					String(node.agentCount),
@@ -8456,7 +9243,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "show",
-			summary: "Show a node with its host, its split, the agents placed on it, its runtime and its pools.",
+			summary: "Show a node with its machine, its host, its split, its agents, its runtime and its pools.",
 			usage: "nodes show <node>",
 			optionsUsage: nodeUsage,
 			options: {},
@@ -8473,10 +9260,18 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		createSplitCommand(adaptersOf),
 		defineCommand({
 			name: "create",
-			summary: "Create a node and print its one-time registration token.",
-			usage: "nodes create <name>",
-			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
-			options: {},
+			summary: "Create a node on a host of your own, printing its one-time registration token, or on DigitalOcean.",
+			usage: "nodes create <name> [--provider digitalocean --account <account> --size <slug>]",
+			optionsUsage: [
+				["", "the name holds lowercase letters, digits and hyphens"],
+				["--provider <provider>", `one of ${nodeProviders.join(", ")} (default: self_hosted)`],
+				["", "self_hosted: the token goes to stdout alone, how to install to stderr"],
+				["--account <account>", "the DigitalOcean account, by name or id"],
+				["--size <slug>", "the droplet size, as kcloud providers catalog lists them"],
+				["--region <slug>", "the region (default: the region of the account)"],
+				["--volume-gb <n>", `the volume for the agents (default: ${defaultVolumeGb})`]
+			],
+			options: createOptions,
 			positionals: {
 				min: 1,
 				max: 1
@@ -8484,7 +9279,65 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
 				const organization = await run.organization();
-				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+				const body = await nodeBodyOf(run, invocation.positionals[0] ?? "", invocation.values);
+				return printedCreation(run, await createdNode(run.api, organization.id, body));
+			}
+		}),
+		defineCommand({
+			name: "resize",
+			summary: "Give a node on DigitalOcean a larger size, a larger volume or both.",
+			usage: "nodes resize <node> [--size <slug>] [--volume-gb <n>]",
+			optionsUsage: [
+				...nodeUsage,
+				["--size <slug>", "the new droplet size, with more CPUs or memory"],
+				["--volume-gb <n>", "the new size of the volume for the agents"],
+				["", "an option left out keeps its value; a node never shrinks"]
+			],
+			options: {
+				size: { type: "string" },
+				"volume-gb": { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const change = {
+					size: values.size,
+					volumeGb: volumeGbOf(values["volume-gb"])
+				};
+				if (change.size === void 0 && change.volumeGb === void 0) throw new UsageError("nodes resize needs --size <slug>, --volume-gb <n> or both.");
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				const node = await nodeDetailOf(run.api, reference);
+				const target = resizeTargetOf(node, change);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Resize ${given} to ${shapeText(target)}? ${target.size === node.machine?.size ? "The volume cannot shrink afterwards." : "The droplet is off during the resize, so its agents stop until it runs again, and it cannot shrink afterwards."}`
+				});
+				const resized = await resizedNode(run.api, reference, node, change);
+				return printed(run, resized, (detail) => `Resizing ${detail.name} to ${shapeText(target)}; kcloud nodes show ${detail.name} follows the steps.`);
+			}
+		}),
+		defineCommand({
+			name: "retry",
+			summary: "Retry the failed operation of a node on DigitalOcean from the step that failed.",
+			usage: "nodes retry <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				const node = await nodeDetailOf(run.api, reference);
+				const retried = await retriedOperation(run.api, reference, node.revision);
+				return printed(run, retried, (detail) => detail.operation === null ? `${detail.name} has no operation left to run.` : `Retrying ${operationText(detail.operation)} of ${detail.name}; kcloud nodes show ${detail.name} follows the steps.`);
 			}
 		}),
 		defineCommand({
@@ -8505,7 +9358,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "delete",
-			summary: "Delete a node that runs no agent.",
+			summary: "Delete a node that runs no agent, with its droplet on DigitalOcean.",
 			usage: "nodes delete <node>",
 			optionsUsage: nodeUsage,
 			options: {},
@@ -8517,13 +9370,300 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				const run = await runOf(adaptersOf, invocation);
 				const given = invocation.positionals[0] ?? "";
 				const reference = await resolveNode(run, given);
+				const node = await nodeDetailOf(run.api, reference);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: node.machine === null ? `Delete the node ${given}? Its host can no longer reach the platform.` : `Delete the node ${given}? The platform destroys its droplet and its volume with the data of its agents.`
+				});
+				const removing = await deleteNode(run.api, reference);
+				if (removing === null) return said(run, `Deleted the node ${given}.`);
+				return printed(run, removing, (removed) => `The removal of ${removed.name} started: the platform destroys its droplet, its volume and its firewall, then forgets the node. kcloud nodes list shows it until then.`);
+			}
+		})
+	]
+});
+//#endregion
+//#region src/commands/providers/index.ts
+const accountUsage = [["", "an account is named by its name or its id"]];
+const regionOption = { region: { type: "string" } };
+const tokenOf = async (run, name, values) => {
+	const token = await secretOf({
+		run,
+		file: values["secret-file"],
+		fromStdin: values["secret-stdin"],
+		question: `The DigitalOcean token of ${name}`,
+		stdinHint: "Pipe the token in, or drop --secret-stdin to be asked for it."
+	});
+	validated(providerTokenSchema, token, "a DigitalOcean token");
+	return token;
+};
+const gigabytes = (megabytes) => `${megabytes / 1024} GB`;
+const accountDetailsText = (account) => [renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+	["name", account.name],
+	["kind", account.kind],
+	["default region", account.defaultRegion],
+	["nodes", String(account.nodeCount)],
+	["token", verificationText(account.verification)],
+	["checked", account.verification.checkedAt],
+	["created", account.createdAt],
+	["updated", account.updatedAt],
+	["id", account.id]
+]), ...account.verification.missingScopes.length === 0 ? [] : ["", `The token lacks ${account.verification.missingScopes.join(", ")}.`]].join("\n");
+const verificationSentence = (account) => {
+	const { failure, missingScopes } = account.verification;
+	if (failure === "unauthorized") return `DigitalOcean refused the token of ${account.name}; kcloud providers update ${account.name} --token replaces it.`;
+	if (failure !== null) return `The token of ${account.name} could not be checked: ${failure}.`;
+	return missingScopes.length === 0 ? `The token of ${account.name} has every scope a node needs.` : `The token of ${account.name} lacks ${missingScopes.join(", ")}.`;
+};
+const catalogText = (catalog) => [
+	renderTable([
+		{ header: "REGION" },
+		{ header: "NAME" },
+		{ header: "AVAILABLE" }
+	], catalog.regions.map((region) => [
+		region.slug === catalog.region ? `${region.slug} *` : region.slug,
+		region.name,
+		region.available ? "yes" : "no"
+	])),
+	"",
+	catalog.sizes.length === 0 ? `No size for a node is offered in ${catalog.region}.` : renderTable([
+		{ header: `SIZE IN ${catalog.region.toUpperCase()}` },
+		{
+			header: "CPU",
+			align: "right"
+		},
+		{
+			header: "MEMORY",
+			align: "right"
+		},
+		{
+			header: "DISK",
+			align: "right"
+		},
+		{
+			header: "USD A MONTH",
+			align: "right"
+		}
+	], catalog.sizes.map((size) => [
+		size.slug,
+		String(size.vcpus),
+		gigabytes(size.memoryMb),
+		`${size.diskGb} GB`,
+		size.priceMonthly.toFixed(2)
+	]))
+].join("\n");
+const createProvidersCommand = (adaptersOf) => defineGroup({
+	name: "providers",
+	summary: "The cloud accounts the platform creates the nodes of the organization in.",
+	usage: "providers <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the provider accounts of the organization.",
+			usage: "providers list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await providerAccountsOf(run.api, organization.id);
+				return printed(run, items, (accounts) => accounts.length === 0 ? `${organization.slug} has no provider account yet; kcloud providers add <name> --region <slug> adds one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "KIND" },
+					{ header: "REGION" },
+					{
+						header: "NODES",
+						align: "right"
+					},
+					{ header: "TOKEN" },
+					{ header: "ID" }
+				], accounts.map((account) => [
+					account.name,
+					account.kind,
+					account.defaultRegion,
+					String(account.nodeCount),
+					verificationText(account.verification),
+					account.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a provider account with the state of its token.",
+			usage: "providers show <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				return printed(run, account, accountDetailsText);
+			}
+		}),
+		defineCommand({
+			name: "add",
+			summary: "Add a DigitalOcean account, asking for its token.",
+			usage: "providers add <name> --region <slug> [--secret-file <path>]",
+			optionsUsage: [
+				["--region <slug>", "the region a new node goes to by default, as in fra1"],
+				...secretUsage,
+				["", "the instance checks the token before it stores it; the token needs"],
+				...scopeLines().map((line) => ["", `  ${line}`])
+			],
+			options: {
+				...regionOption,
+				...secretOptions
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const name = invocation.positionals[0] ?? "";
+				if (values.region === void 0) throw new UsageError("providers add needs --region <slug>.", "Name the region a new node goes to by default, as in fra1.");
+				const draft = {
+					kind: "digitalocean",
+					name,
+					defaultRegion: values.region
+				};
+				validated(createProviderAccountBodySchema.omit({ token: true }), draft, "a provider account");
+				const token = await tokenOf(run, name, values);
+				const account = providerDataOf("add the provider account", await run.api.POST("/organizations/{organizationId}/provider-accounts", {
+					params: { path: { organizationId: organization.id } },
+					body: {
+						...draft,
+						token
+					}
+				}));
+				return printed(run, account, (added) => `Added ${added.name} as ${added.id}; its token has every scope a node needs.`);
+			}
+		}),
+		defineCommand({
+			name: "update",
+			summary: "Rename a provider account, change its default region or replace its token.",
+			usage: "providers update <account> [--name <name>] [--region <slug>] [--token]",
+			optionsUsage: [
+				...accountUsage,
+				["--name <name>", "the new name"],
+				["--region <slug>", "the new default region of new nodes"],
+				["--token", "replace the token, asking for the new one"],
+				...secretUsage,
+				["", `the new token needs the ${providerTokenScopes.length} scopes add lists`]
+			],
+			options: {
+				name: { type: "string" },
+				...regionOption,
+				token: {
+					type: "boolean",
+					default: false
+				},
+				...secretOptions
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const replacesToken = values.token || values["secret-stdin"] || values["secret-file"] !== void 0;
+				if (values.name === void 0 && values.region === void 0 && !replacesToken) throw new UsageError("providers update needs --name, --region or --token.");
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				const change = {
+					revision: account.revision,
+					...values.name === void 0 ? {} : { name: values.name },
+					...values.region === void 0 ? {} : { defaultRegion: values.region }
+				};
+				validated(createProviderAccountBodySchema.pick({
+					name: true,
+					defaultRegion: true
+				}).partial(), change, "a change of a provider account");
+				const body = replacesToken ? {
+					...change,
+					token: await tokenOf(run, account.name, values)
+				} : change;
+				const updated = providerDataOf("update the provider account", await run.api.PATCH("/organizations/{organizationId}/provider-accounts/{accountId}", {
+					params: { path: {
+						organizationId: organization.id,
+						accountId: account.id
+					} },
+					body
+				}));
+				return printed(run, updated, (changed) => `Updated ${changed.name}${replacesToken ? "; its new token has every scope a node needs" : ""}.`);
+			}
+		}),
+		defineCommand({
+			name: "verify",
+			summary: "Check the token of a provider account against DigitalOcean again.",
+			usage: "providers verify <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				return printed(run, await verifiedAccount(run.api, organization.id, account.id), verificationSentence);
+			}
+		}),
+		defineCommand({
+			name: "catalog",
+			summary: "List the regions of a provider account and the sizes a node can have in one.",
+			usage: "providers catalog <account> [--region <slug>]",
+			optionsUsage: [
+				...accountUsage,
+				["--region <slug>", "the region whose sizes to list (default: the account's)"],
+				["", "only regions with volumes and sizes with at least 2 GB of memory"]
+			],
+			options: regionOption,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				const catalog = await providerCatalogOf(run.api, organization.id, account.id);
+				return printed(run, catalogInRegion(catalog, invocation.values.region ?? account.defaultRegion), catalogText);
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a provider account no node was created with.",
+			usage: "providers delete <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const given = invocation.positionals[0] ?? "";
+				const account = await resolveProviderAccount(run, given);
 				await confirmed({
 					prompt: run.prompt,
 					settings: run.settings,
-					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+					question: `Delete the provider account ${given}? The platform erases its token.`
 				});
-				await deleteNode(run.api, reference);
-				return said(run, `Deleted the node ${given}.`);
+				await deleteProviderAccount(run.api, organization.id, account.id);
+				return said(run, `Deleted the provider account ${given}.`);
 			}
 		})
 	]
@@ -8575,6 +9715,7 @@ const kcloudCommands = () => [
 	createCredentialsCommand(createAdapters),
 	createRepositoriesCommand(createAdapters),
 	createToolsCommand(createAdapters),
+	createProvidersCommand(createAdapters),
 	createNodesCommand(createAdapters),
 	createAgentsCommand(createAdapters),
 	createNotificationsCommand(createAdapters),