@kikimoradev/kcloud 0.17.0 → 0.18.0

package/dist/main.js

@@ -795,6 +795,18 @@ const errorCodes = Object.keys({
 	"agent.backup_unavailable": "rule_violation",
 	"agent.backup_without_export": "rule_violation",
 	"agent.backup_in_progress": "conflict",
+	"node.machine_missing": "rule_violation",
+	"node.operation_running": "conflict",
+	"node.operation_not_failed": "conflict",
+	"node.size_unavailable": "rule_violation",
+	"node.size_not_larger": "rule_violation",
+	"node.region_unavailable": "rule_violation",
+	"provider.not_found": "not_found",
+	"provider.name_taken": "conflict",
+	"provider.in_use": "conflict",
+	"provider.token_unauthorized": "rule_violation",
+	"provider.token_scopes_missing": "rule_violation",
+	"provider.unavailable": "rule_violation",
 	"project.last_admin": "conflict",
 	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
@@ -1440,6 +1452,83 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
+const providerKindSchema = z.enum(["digitalocean"]);
+const providerAccountNameSchema = z.string().trim().min(1).max(64);
+const providerTokenSchema = z.string().trim().min(16).max(512).regex(/^[\x21-\x7e]+$/u);
+const providerRegionSlugSchema = z.string().trim().regex(/^[a-z]{3}[0-9]$/u);
+const providerSizeSlugSchema = z.string().trim().regex(/^[a-z0-9][a-z0-9-]{0,63}$/u);
+const providerTokenScopes = [
+	"regions:read",
+	"sizes:read",
+	"image:read",
+	"vpc:read",
+	"actions:read",
+	"droplet:create",
+	"droplet:read",
+	"droplet:update",
+	"droplet:delete",
+	"block_storage:create",
+	"block_storage:read",
+	"block_storage:delete",
+	"block_storage_action:create",
+	"firewall:create",
+	"firewall:read",
+	"firewall:delete",
+	"tag:create",
+	"tag:read",
+	"tag:delete"
+];
+const providerTokenScopeSchema = z.enum(providerTokenScopes).meta({ id: "ProviderTokenScope" });
+const providerVerificationSchema = z.object({
+	checkedAt: z.iso.datetime(),
+	missingScopes: z.array(providerTokenScopeSchema),
+	failure: z.string().nullable()
+}).meta({ id: "ProviderVerification" });
+const providerAccountSchema = z.object({
+	id: idSchema,
+	kind: providerKindSchema,
+	name: z.string(),
+	defaultRegion: z.string(),
+	revision: z.int().nonnegative(),
+	verification: providerVerificationSchema,
+	nodeCount: z.int().nonnegative(),
+	createdAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+}).meta({ id: "ProviderAccount" });
+z.object({ items: z.array(providerAccountSchema) }).meta({ id: "ProviderAccountList" });
+const createProviderAccountBodySchema = z.object({
+	kind: providerKindSchema,
+	name: providerAccountNameSchema,
+	token: providerTokenSchema,
+	defaultRegion: providerRegionSlugSchema
+}).meta({ id: "CreateProviderAccountBody" });
+z.object({
+	revision: z.int().nonnegative(),
+	name: providerAccountNameSchema.optional(),
+	token: providerTokenSchema.optional(),
+	defaultRegion: providerRegionSlugSchema.optional()
+}).meta({ id: "UpdateProviderAccountBody" });
+const providerRegionSchema = z.object({
+	slug: z.string(),
+	name: z.string(),
+	available: z.boolean()
+}).meta({ id: "ProviderRegion" });
+const providerSizeSchema = z.object({
+	slug: z.string(),
+	vcpus: z.int().positive(),
+	memoryMb: z.int().positive(),
+	diskGb: z.int().positive(),
+	priceMonthly: z.number().nonnegative(),
+	regions: z.array(z.string())
+}).meta({ id: "ProviderSize" });
+z.object({
+	regions: z.array(providerRegionSchema),
+	sizes: z.array(providerSizeSchema)
+}).meta({ id: "ProviderCatalog" });
+z.object({
+	organizationId: idSchema,
+	accountId: idSchema
+});
 z.enum(["monitor", "executor"]);
 const sessionSlotCountSchema = z.int().min(1).max(64);
 const sessionQueueEntrySchema = z.object({
@@ -1482,7 +1571,8 @@ const nodeStateSchema = z.enum([
 	"online",
 	"offline"
 ]);
-const nodeProviderSchema = z.enum(["self_hosted"]);
+const nodeProviders = ["self_hosted", "digitalocean"];
+const nodeProviderSchema = z.enum(nodeProviders);
 const nodeNameSchema = z.string().trim().regex(slugPattern);
 const nodeHostSchema = z.object({
 	cpus: z.number().nonnegative(),
@@ -1557,6 +1647,52 @@ const nodePoolsSchema = z.object({
 	monitor: nodePoolSchema,
 	executor: nodePoolSchema
 }).meta({ id: "NodePools" });
+const nodeVolumeGbSchema = z.int().min(10).max(4096);
+const nodeMachineSchema = z.object({
+	account: z.object({
+		id: idSchema,
+		name: z.string().nullable()
+	}),
+	region: z.string(),
+	size: z.string(),
+	volumeGb: z.int().positive(),
+	dropletId: z.int().positive().nullable(),
+	publicIpv4: z.string().nullable()
+}).meta({ id: "NodeMachine" });
+const nodeOperationKindSchema = z.enum([
+	"create",
+	"resize",
+	"delete"
+]);
+const nodeOperationStateSchema = z.enum(["running", "failed"]);
+const nodeOperationStepSchema = z.enum([
+	"tag",
+	"firewall",
+	"volume",
+	"droplet",
+	"boot",
+	"installing",
+	"power_off",
+	"resize_droplet",
+	"resize_volume",
+	"power_on",
+	"delete_droplet",
+	"delete_volume",
+	"delete_firewall",
+	"delete_tag"
+]);
+const nodeOperationSchema = z.object({
+	kind: nodeOperationKindSchema,
+	state: nodeOperationStateSchema,
+	step: nodeOperationStepSchema.nullable(),
+	error: z.string().nullable(),
+	target: z.object({
+		size: z.string(),
+		volumeGb: z.int().positive()
+	}).nullable(),
+	startedAt: z.iso.datetime(),
+	updatedAt: z.iso.datetime()
+}).meta({ id: "NodeOperation" });
 const nodeSchema = z.object({
 	id: idSchema,
 	name: nodeNameSchema,
@@ -1574,6 +1710,8 @@ const nodeSchema = z.object({
 	lastSeenAt: z.iso.datetime().nullable(),
 	offlineSince: z.iso.datetime().nullable(),
 	registrationExpiresAt: z.iso.datetime().nullable(),
+	machine: nodeMachineSchema.nullable(),
+	operation: nodeOperationSchema.nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Node" });
 const nodeUpdateSchema = z.object({
@@ -1656,15 +1794,34 @@ z.object({
 	revision: z.int().nonnegative(),
 	split: nodeSplitSchema.nullable()
 }).meta({ id: "UpdateNodeSplitBody" });
-const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
+const nodeMachineRequestSchema = z.object({
+	accountId: idSchema,
+	region: providerRegionSlugSchema,
+	size: providerSizeSlugSchema,
+	volumeGb: nodeVolumeGbSchema
+}).meta({ id: "NodeMachineRequest" });
+const createNodeBodySchema = z.object({
+	name: nodeNameSchema,
+	machine: nodeMachineRequestSchema.optional()
+}).meta({ id: "CreateNodeBody" });
+const resizeNodeBodySchema = z.object({
+	revision: z.int().nonnegative(),
+	size: providerSizeSlugSchema,
+	volumeGb: nodeVolumeGbSchema
+}).meta({ id: "ResizeNodeBody" });
+z.object({ revision: z.int().nonnegative() }).meta({ id: "RetryNodeOperationBody" });
 const nodeRegistrationSchema = z.object({
 	token: z.string(),
 	expiresAt: z.iso.datetime()
 }).meta({ id: "NodeRegistration" });
+z.object({
+	node: nodeSchema,
+	registration: nodeRegistrationSchema.nullable()
+}).meta({ id: "CreatedNode" });
 z.object({
 	node: nodeSchema,
 	registration: nodeRegistrationSchema
-}).meta({ id: "CreatedNode" }).meta({ id: "RenewedNodeRegistration" });
+}).meta({ id: "RenewedNodeRegistration" });
 z.object({
 	token: z.string().min(1).max(256),
 	version: z.string().min(1).max(128),
@@ -1672,6 +1829,16 @@ z.object({
 	host: nodeHostSchema.nullable(),
 	capabilities: nodeCapabilitiesSchema
 }).meta({ id: "RegisterNodeBody" });
+z.object({ token: z.string().min(1).max(256) }).meta({ id: "NodeInstallationBody" });
+z.object({
+	platformVersion: z.string(),
+	image: z.string().nullable(),
+	registry: z.object({
+		server: z.string(),
+		username: z.string(),
+		password: z.string()
+	}).nullable()
+}).meta({ id: "NodeInstallation" });
 z.object({
 	nodeId: idSchema,
 	credential: z.string()
@@ -1881,6 +2048,18 @@ const auditActionSchema = z.enum([
 	"node.registration_renewed",
 	"node.deleted",
 	"node.split_changed",
+	"node.resize_requested",
+	"node.removal_requested",
+	"node.operation_retried",
+	"node.operation_failed",
+	"node.machine_created",
+	"node.machine_resized",
+	"node.machine_removed",
+	"provider_account.created",
+	"provider_account.updated",
+	"provider_account.token_replaced",
+	"provider_account.verified",
+	"provider_account.deleted",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1901,7 +2080,8 @@ const auditTargetTypeSchema = z.enum([
 	"host_operation",
 	"volume",
 	"queue",
-	"node"
+	"node",
+	"provider_account"
 ]);
 const auditEntrySchema = z.object({
 	id: idSchema,
@@ -2869,7 +3049,8 @@ const masterKeyVersionSchema = z.object({
 	secrets: z.object({
 		credentials: secretCountSchema,
 		toolSecrets: secretCountSchema,
-		platformSecrets: secretCountSchema
+		platformSecrets: secretCountSchema,
+		providerAccounts: secretCountSchema.default(0)
 	}),
 	backups: secretCountSchema,
 	newestBackupExpiresAt: instantSchema$1.nullable()
@@ -3748,20 +3929,125 @@ const validated = (schema, document, what) => {
 	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
 };
 //#endregion
+//#region src/commands/providers/shared.ts
+const providerHints = {
+	...organizationHints,
+	"auth.forbidden": "Changing a provider account takes an admin of the organization.",
+	"provider.not_found": "kcloud providers list shows the provider accounts.",
+	"provider.name_taken": "Another provider account of the organization has that name.",
+	"provider.in_use": "Delete the nodes created with it first; kcloud nodes list shows the provider of each node.",
+	"provider.token_unauthorized": "DigitalOcean refused the token. Create a new one under API, Tokens in its control panel.",
+	"concurrency.conflict": "Someone changed the account meanwhile; run the command again."
+};
+const reasonOf$1 = (error) => {
+	const reason = error.details.reason;
+	return typeof reason === "string" && reason !== "" ? `: ${reason}` : "";
+};
+const missingScopesOf = (error) => {
+	const scopes = error.details.missingScopes;
+	return typeof scopes === "string" && scopes !== "" ? scopes : "some scopes";
+};
+const apiErrorOf$1 = (error) => {
+	if (error instanceof ApiError) return error;
+	return error instanceof Error ? apiErrorOf$1(error.cause) : null;
+};
+const explained = (error) => {
+	const failure = apiErrorOf$1(error);
+	switch (failure?.code) {
+		case "provider.token_scopes_missing": return new CliError(failure.message, `The token lacks ${missingScopesOf(failure)}. kcloud providers add --help lists every scope it needs.`, { cause: failure });
+		case "provider.unavailable": return new CliError(failure.message, `DigitalOcean did not answer as expected${reasonOf$1(failure)}. Try again in a moment.`, { cause: failure });
+		default: return error;
+	}
+};
+const providerDataOf = (action, answer, hints = providerHints) => {
+	try {
+		return dataOf(action, answer, hints);
+	} catch (error) {
+		throw explained(error);
+	}
+};
+const providerDoneWith = (action, answer, hints = providerHints) => {
+	try {
+		doneWith(action, answer, hints);
+	} catch (error) {
+		throw explained(error);
+	}
+};
+const providerAccountsOf = async (api, organizationId) => providerDataOf("list the provider accounts", await api.GET("/organizations/{organizationId}/provider-accounts", { params: { path: { organizationId } } })).items;
+const providerAccountOf = async (api, organizationId, accountId) => providerDataOf("describe the provider account", await api.GET("/organizations/{organizationId}/provider-accounts/{accountId}", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const resolveProviderAccount = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return providerAccountOf(scope.api, organization.id, reference);
+	const accounts = await providerAccountsOf(scope.api, organization.id);
+	const found = accounts.find((account) => account.name === reference);
+	if (found === void 0) throw new CliError(`There is no provider account ${reference} in ${organization.slug}.`, accounts.length === 0 ? "kcloud providers add <name> --region <slug> adds one." : `kcloud providers list shows ${accounts.map(({ name }) => name).join(", ")}.`);
+	return found;
+};
+const verifiedAccount = async (api, organizationId, accountId) => providerDataOf("verify the provider account", await api.POST("/organizations/{organizationId}/provider-accounts/{accountId}/verification", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const providerCatalogOf = async (api, organizationId, accountId) => providerDataOf("read the regions and sizes of the provider", await api.GET("/organizations/{organizationId}/provider-accounts/{accountId}/catalog", { params: { path: {
+	organizationId,
+	accountId
+} } }));
+const catalogInRegion = (catalog, region) => {
+	if (!catalog.regions.some(({ slug }) => slug === region)) throw new CliError(`The account offers no region ${region} for a node.`, `Its regions are ${catalog.regions.map(({ slug }) => slug).join(", ")}.`);
+	return {
+		region,
+		regions: catalog.regions,
+		sizes: catalog.sizes.filter(({ regions }) => regions.includes(region))
+	};
+};
+const deleteProviderAccount = async (api, organizationId, accountId) => {
+	providerDoneWith("delete the provider account", await api.DELETE("/organizations/{organizationId}/provider-accounts/{accountId}", { params: { path: {
+		organizationId,
+		accountId
+	} } }));
+};
+const verificationText = ({ failure, missingScopes }) => {
+	if (failure === "unauthorized") return "token refused";
+	if (failure !== null) return `not checked: ${failure}`;
+	return missingScopes.length === 0 ? "ok" : `missing ${missingScopes.length} of ${providerTokenScopes.length} scopes`;
+};
+const scopeLineWidth = 64;
+const scopeLines = () => providerTokenScopes.reduce((lines, scope) => {
+	const last = lines.at(-1);
+	if (last !== void 0 && last.length + scope.length + 2 <= scopeLineWidth) {
+		lines[lines.length - 1] = `${last}, ${scope}`;
+		return lines;
+	}
+	return [...lines, scope];
+}, []);
+//#endregion
 //#region src/commands/nodes/shared.ts
 const nodeHints = {
 	...organizationHints,
 	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
 	"node.name_taken": "Another node of the organization has that name.",
 	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
-	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token.",
+	"node.machine_missing": "The node runs on a host of its own, which the platform does not resize.",
+	"node.operation_running": "The platform is still working on the node; kcloud nodes show <node> shows the step.",
+	"node.operation_not_failed": "Only a failed operation can be retried; kcloud nodes show <node> shows the operation.",
+	"node.region_unavailable": "kcloud providers catalog <account> lists the regions a node can go to.",
+	"node.size_unavailable": "kcloud providers catalog <account> --region <slug> lists the sizes of a region.",
+	"node.size_not_larger": "A node only grows: name a size with more CPUs or memory, or a larger volume.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
+const machineHints = {
+	...providerHints,
+	...nodeHints,
+	"auth.forbidden": "Creating, resizing and deleting nodes take an admin of the organization."
 };
 const splitHints = {
 	...nodeHints,
 	"auth.forbidden": "Splitting a node takes an admin of its organization.",
 	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
-	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
-	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host."
 };
 const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
 const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
@@ -3786,24 +4072,57 @@ const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe
 	organizationId,
 	nodeId
 } } }), nodeHints);
-const createdNode = async (api, organizationId, name) => {
-	const body = { name };
+const createdNode = async (api, organizationId, body) => {
 	validated(createNodeBodySchema, body, "a node");
-	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+	return providerDataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
 		params: { path: { organizationId } },
 		body
-	}), nodeHints);
+	}), machineHints);
 };
 const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
 	organizationId,
 	nodeId
 } } }), nodeHints);
 const deleteNode = async (api, { organizationId, nodeId }) => {
-	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	const answer = await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
 		organizationId,
 		nodeId
-	} } }), nodeHints);
+	} } });
+	providerDoneWith("delete the node", answer, machineHints);
+	return answer.response.status === 202 ? answer.data ?? null : null;
+};
+const resizeTargetOf = (node, { size, volumeGb }) => {
+	const { machine } = node;
+	if (machine === null) throw new CliError(`${node.name} runs on a host of its own, so the platform cannot resize it.`, "Only a node created with --provider digitalocean can be resized.");
+	const target = {
+		size: size ?? machine.size,
+		volumeGb: volumeGb ?? machine.volumeGb
+	};
+	if (target.volumeGb < machine.volumeGb) throw new CliError(`The volume of ${node.name} holds ${machine.volumeGb} GB, and a volume cannot shrink.`);
+	if (target.size === machine.size && target.volumeGb === machine.volumeGb) throw new CliError(`${node.name} is ${machine.size} with a volume of ${machine.volumeGb} GB already.`, "Name a larger size, a larger volume or both.");
+	return target;
 };
+const resizedNode = async (api, { organizationId, nodeId }, node, change) => {
+	const body = {
+		revision: node.revision,
+		...resizeTargetOf(node, change)
+	};
+	validated(resizeNodeBodySchema, body, "a size of a node");
+	return providerDataOf("resize the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/resize", {
+		params: { path: {
+			organizationId,
+			nodeId
+		} },
+		body
+	}), machineHints);
+};
+const retriedOperation = async (api, { organizationId, nodeId }, revision) => providerDataOf("retry the operation of the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/operation/retry", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: { revision }
+}), machineHints);
 const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
 	params: { path: {
 		organizationId,
@@ -6337,7 +6656,7 @@ const nodeTools = [
 	defineTool({
 		name: "nodes_list",
 		title: "List nodes",
-		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version, capabilities, split and agent count.",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their provider, state, engine, version, capabilities, split, agent count, the DigitalOcean machine of a node created there, and the operation the platform runs on it.",
 		operations: ["listNodes"],
 		safety: "read",
 		input: z.object({}),
@@ -6346,7 +6665,7 @@ const nodeTools = [
 	defineTool({
 		name: "node_show",
 		title: "Show a node",
-		description: "Show one node with its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
+		description: "Show one node with its provider, its DigitalOcean machine and the step and error of its operation, its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
 		operations: ["getNode"],
 		safety: "read",
 		input: z.object({ node: nodeField }),
@@ -6389,17 +6708,51 @@ const nodeTools = [
 			return splitViewOf(await splitNode(run.api, reference, detail.revision, null));
 		}
 	}),
+	defineTool({
+		name: "node_resize",
+		title: "Resize a node on DigitalOcean",
+		description: "Give a node created on DigitalOcean a larger droplet size, a larger volume for its agents, or both; a field left out keeps its value, and a node never shrinks. A new size powers the droplet off, so its agents stop until it runs again. Returns the node with the operation that started; node_show follows its steps. Takes an admin of the organization.",
+		operations: ["getNode", "resizeNode"],
+		safety: "destructive",
+		input: z.object({
+			node: nodeField,
+			size: providerSizeSlugSchema.optional().describe("The new droplet size, from provider_catalog."),
+			volumeGb: nodeVolumeGbSchema.optional().describe("The new size of the volume in GB.")
+		}),
+		run: async ({ node, size, volumeGb }, run) => {
+			if (size === void 0 && volumeGb === void 0) throw new CliError("Name a size, a volume or both.");
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			return resizedNode(run.api, reference, detail, {
+				size,
+				volumeGb
+			});
+		}
+	}),
+	defineTool({
+		name: "node_retry",
+		title: "Retry the operation of a node",
+		description: "Run the failed create, resize or delete operation of a node on DigitalOcean again from the step that failed. Returns the node; node_show follows its steps. Takes an admin of the organization.",
+		operations: ["getNode", "retryNodeOperation"],
+		safety: "write",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			return retriedOperation(run.api, reference, detail.revision);
+		}
+	}),
 	defineTool({
 		name: "node_delete",
 		title: "Delete a node",
-		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
+		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it. A self-hosted node is deleted at once and returns deleted; for a node on DigitalOcean the platform destroys its droplet and its volume first and returns the node as removing.",
 		operations: ["deleteNode"],
 		safety: "destructive",
 		input: z.object({ node: nodeField }),
 		run: async ({ node }, run) => {
 			const reference = await resolveNode(run, node);
-			await deleteNode(run.api, reference);
-			return { deleted: reference.nodeId };
+			const removing = await deleteNode(run.api, reference);
+			return removing === null ? { deleted: reference.nodeId } : { removing };
 		}
 	})
 ];
@@ -8127,6 +8480,71 @@ const projectTools = [
 	})
 ];
 //#endregion
+//#region src/mcp/tools/providers.ts
+const accountField = z.string().trim().min(1).describe("The provider account, by its name or its id, from providers_list.");
+const providerTools = [
+	defineTool({
+		name: "providers_list",
+		title: "List provider accounts",
+		description: "List the DigitalOcean accounts of the organization this server acts in, with their default region, the number of nodes created with each, and the last check of their token, never the token itself.",
+		operations: ["listProviderAccounts"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => providerAccountsOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "provider_show",
+		title: "Show a provider account",
+		description: "Show one provider account with its default region, its node count and the last check of its token: when it ran, the scopes it lacked and why it failed.",
+		operations: ["getProviderAccount"],
+		safety: "read",
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => resolveProviderAccount(run, account)
+	}),
+	defineTool({
+		name: "provider_catalog",
+		title: "List regions and sizes",
+		description: "List the regions of a provider account that offer volumes, and the sizes with at least 2 GB of memory a node can have in one region, with CPUs, memory in MB, disk in GB and the monthly price in USD. The region defaults to the default region of the account.",
+		operations: ["getProviderCatalog"],
+		safety: "read",
+		input: z.object({
+			account: accountField,
+			region: providerRegionSlugSchema.optional().describe("The region whose sizes to list, as in fra1.")
+		}),
+		run: async ({ account, region }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			const catalog = await providerCatalogOf(run.api, (await run.organization()).id, found.id);
+			return catalogInRegion(catalog, region ?? found.defaultRegion);
+		}
+	}),
+	defineTool({
+		name: "provider_verify",
+		title: "Check the token of a provider account",
+		description: "Check the token of a provider account against DigitalOcean again and return the account with the result: missingScopes lists the scopes it lacks, and failure is unauthorized when DigitalOcean refused it. Takes an admin of the organization.",
+		operations: ["verifyProviderAccount"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			return verifiedAccount(run.api, (await run.organization()).id, found.id);
+		}
+	}),
+	defineTool({
+		name: "provider_delete",
+		title: "Delete a provider account",
+		description: "Delete a provider account and erase its token. The instance refuses while nodes created with it exist. Takes an admin of the organization.",
+		operations: ["deleteProviderAccount"],
+		safety: "destructive",
+		input: z.object({ account: accountField }),
+		run: async ({ account }, run) => {
+			const found = await resolveProviderAccount(run, account);
+			await deleteProviderAccount(run.api, (await run.organization()).id, found.id);
+			return { deleted: found.id };
+		}
+	})
+];
+//#endregion
 //#region src/mcp/tools/releases.ts
 const releaseTools = [defineTool({
 	name: "releases_list",
@@ -8534,6 +8952,7 @@ const kcloudTools = [
 	...credentialTools,
 	...repositoryTools,
 	...projectToolTools,
+	...providerTools,
 	...nodeTools,
 	...agentTools,
 	...agentBackupTools,
@@ -8551,7 +8970,7 @@ const instructions = [
 	"These tools act on one Kikimora Cloud instance, as the account kcloud is signed in with, in one organization of it. whoami names all three.",
 	"Name a project by its slug, its name or its id. Name an agent as <project>/<agent>, as its slug or name together with project, or by its id.",
 	"A refusal quotes the error code of the instance. Its hint may name a kcloud command, such as kcloud agents list; the tool for the same resource and verb, agents_list, does that work here.",
-	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud tokens create, kcloud auth password, kcloud orgs members add, kcloud orgs members reset-password, or sets the secrets of a tool in the panel."
+	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud providers add, kcloud providers update, kcloud tokens create, kcloud auth password, kcloud orgs members add, kcloud orgs members reset-password, or sets the secrets of a tool in the panel."
 ].join("\n");
 const createKcloudServer = ({ version, open }) => {
 	const server = new McpServer({
@@ -8615,6 +9034,7 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 });
 //#endregion
 //#region src/commands/nodes/index.ts
+const defaultVolumeGb = 40;
 const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
 const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
 const capabilitiesOf = (node) => {
@@ -8624,6 +9044,25 @@ const capabilitiesOf = (node) => {
 };
 const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
 const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const shapeText = ({ size, volumeGb }) => `${size} with a volume of ${volumeGb} GB`;
+const machineText = (machine) => `${machine.size} in ${machine.region} with a volume of ${machine.volumeGb} GB`;
+const dropletText = ({ dropletId, publicIpv4 }) => dropletId === null ? "not created yet" : `${dropletId} at ${publicIpv4 ?? "no address yet"}`;
+const operationText = ({ kind, state, step }) => `${kind} ${state}${step === null ? "" : ` at ${step}`}`;
+const machineRowsOf = (machine) => machine === null ? [] : [
+	["machine", machineText(machine)],
+	["account", machine.account.name ?? machine.account.id],
+	["droplet", dropletText(machine)]
+];
+const operationRowsOf = (operation) => {
+	if (operation === null) return [];
+	const { target, error } = operation;
+	return [
+		["operation", operationText(operation)],
+		...target === null ? [] : [["target", shapeText(target)]],
+		["started", operation.startedAt],
+		...error === null ? [] : [["error", error]]
+	];
+};
 const runtimeRowsOf = (runtime) => [
 	["reported", runtime.reportedAt],
 	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
@@ -8654,6 +9093,8 @@ const nodeDetailsText = (node) => [
 		["name", node.name],
 		["state", node.state],
 		["provider", node.provider],
+		...machineRowsOf(node.machine),
+		...operationRowsOf(node.operation),
 		["engine", node.engine ?? "-"],
 		["version", node.version ?? "-"],
 		["host", hostOf(node)],
@@ -8692,11 +9133,13 @@ const nodeDetailsText = (node) => [
 		poolsText(node.runtime.pools)
 	]
 ].join("\n");
-const startHintOf = (origin) => [
-	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
-	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
-	"On a Windows PC:",
-	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+const installCommandsOf = (origin) => [
+	"Install the node with it, putting the token in place of <token>. On a Linux host:",
+	`  curl -fsSLo install-node.sh ${origin}/install-node.sh`,
+	`  printf '%s\\n' '<token>' | sudo sh install-node.sh --platform-url ${origin} --registration-token -`,
+	"On Windows, in PowerShell as administrator:",
+	`  Invoke-WebRequest -UseBasicParsing -OutFile install-node.ps1 ${origin}/install-node.ps1`,
+	`  powershell -NoProfile -ExecutionPolicy Bypass -File .\\install-node.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
 ].join("\n");
 const printedRegistration = (run, created) => {
 	if (run.settings.json) {
@@ -8704,9 +9147,56 @@ const printedRegistration = (run, created) => {
 		return exitCodes.ok;
 	}
 	run.context.terminal.line(created.registration.token);
-	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, installCommandsOf(run.origin)].join("\n"));
 	return exitCodes.ok;
 };
+const printedCreation = (run, created) => {
+	const { node, registration } = created;
+	if (registration !== null) return printedRegistration(run, {
+		node,
+		registration
+	});
+	return printed(run, created, () => [`Creating ${node.name} on DigitalOcean${node.machine === null ? "" : `, ${machineText(node.machine)}`}.`, `It joins the platform on its own; kcloud nodes show ${node.name} follows the steps.`].join("\n"));
+};
+const createOptions = {
+	provider: { type: "string" },
+	account: { type: "string" },
+	region: { type: "string" },
+	size: { type: "string" },
+	"volume-gb": { type: "string" }
+};
+const volumeGbOf = (given) => {
+	if (given === void 0) return void 0;
+	if (!/^[0-9]+$/u.test(given)) throw new UsageError(`--volume-gb ${given} is not a whole number of gigabytes.`);
+	return Number(given);
+};
+const machineFlags = [
+	"account",
+	"region",
+	"size",
+	"volume-gb"
+];
+const nodeBodyOf = async (run, name, values) => {
+	const provider = nodeProviders.find((candidate) => candidate === (values.provider ?? "self_hosted"));
+	if (provider === void 0) throw new UsageError(`--provider ${values.provider ?? ""} is not a provider of a node.`, `The providers are ${nodeProviders.join(", ")}.`);
+	if (provider === "self_hosted") {
+		const given = machineFlags.filter((flag) => values[flag] !== void 0);
+		if (given.length > 0) throw new UsageError(`${given.map((flag) => `--${flag}`).join(", ")} need --provider digitalocean.`);
+		return { name };
+	}
+	if (values.account === void 0 || values.size === void 0) throw new UsageError("A node on DigitalOcean needs --account <account> and --size <slug>.", "kcloud providers catalog <account> lists the sizes.");
+	const volumeGb = volumeGbOf(values["volume-gb"]) ?? defaultVolumeGb;
+	const account = await resolveProviderAccount(run, values.account);
+	return {
+		name,
+		machine: {
+			accountId: account.id,
+			region: values.region ?? account.defaultRegion,
+			size: values.size,
+			volumeGb
+		}
+	};
+};
 const createNodesCommand = (adaptersOf) => defineGroup({
 	name: "nodes",
 	summary: "The nodes of the organization, the hosts its agents run on.",
@@ -8727,7 +9217,9 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				const items = await nodesOf(run.api, organization.id);
 				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
 					{ header: "NAME" },
+					{ header: "PROVIDER" },
 					{ header: "STATE" },
+					{ header: "OPERATION" },
 					{ header: "ENGINE" },
 					{ header: "VERSION" },
 					{
@@ -8738,7 +9230,9 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 					{ header: "ID" }
 				], nodes.map((node) => [
 					node.name,
+					node.provider,
 					node.state,
+					node.operation === null ? "-" : operationText(node.operation),
 					node.engine ?? "-",
 					node.version ?? "-",
 					String(node.agentCount),
@@ -8749,7 +9243,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "show",
-			summary: "Show a node with its host, its split, the agents placed on it, its runtime and its pools.",
+			summary: "Show a node with its machine, its host, its split, its agents, its runtime and its pools.",
 			usage: "nodes show <node>",
 			optionsUsage: nodeUsage,
 			options: {},
@@ -8766,10 +9260,18 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		createSplitCommand(adaptersOf),
 		defineCommand({
 			name: "create",
-			summary: "Create a node and print its one-time registration token.",
-			usage: "nodes create <name>",
-			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
-			options: {},
+			summary: "Create a node on a host of your own, printing its one-time registration token, or on DigitalOcean.",
+			usage: "nodes create <name> [--provider digitalocean --account <account> --size <slug>]",
+			optionsUsage: [
+				["", "the name holds lowercase letters, digits and hyphens"],
+				["--provider <provider>", `one of ${nodeProviders.join(", ")} (default: self_hosted)`],
+				["", "self_hosted: the token goes to stdout alone, how to install to stderr"],
+				["--account <account>", "the DigitalOcean account, by name or id"],
+				["--size <slug>", "the droplet size, as kcloud providers catalog lists them"],
+				["--region <slug>", "the region (default: the region of the account)"],
+				["--volume-gb <n>", `the volume for the agents (default: ${defaultVolumeGb})`]
+			],
+			options: createOptions,
 			positionals: {
 				min: 1,
 				max: 1
@@ -8777,7 +9279,65 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
 				const organization = await run.organization();
-				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+				const body = await nodeBodyOf(run, invocation.positionals[0] ?? "", invocation.values);
+				return printedCreation(run, await createdNode(run.api, organization.id, body));
+			}
+		}),
+		defineCommand({
+			name: "resize",
+			summary: "Give a node on DigitalOcean a larger size, a larger volume or both.",
+			usage: "nodes resize <node> [--size <slug>] [--volume-gb <n>]",
+			optionsUsage: [
+				...nodeUsage,
+				["--size <slug>", "the new droplet size, with more CPUs or memory"],
+				["--volume-gb <n>", "the new size of the volume for the agents"],
+				["", "an option left out keeps its value; a node never shrinks"]
+			],
+			options: {
+				size: { type: "string" },
+				"volume-gb": { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const change = {
+					size: values.size,
+					volumeGb: volumeGbOf(values["volume-gb"])
+				};
+				if (change.size === void 0 && change.volumeGb === void 0) throw new UsageError("nodes resize needs --size <slug>, --volume-gb <n> or both.");
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				const node = await nodeDetailOf(run.api, reference);
+				const target = resizeTargetOf(node, change);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Resize ${given} to ${shapeText(target)}? ${target.size === node.machine?.size ? "The volume cannot shrink afterwards." : "The droplet is off during the resize, so its agents stop until it runs again, and it cannot shrink afterwards."}`
+				});
+				const resized = await resizedNode(run.api, reference, node, change);
+				return printed(run, resized, (detail) => `Resizing ${detail.name} to ${shapeText(target)}; kcloud nodes show ${detail.name} follows the steps.`);
+			}
+		}),
+		defineCommand({
+			name: "retry",
+			summary: "Retry the failed operation of a node on DigitalOcean from the step that failed.",
+			usage: "nodes retry <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				const node = await nodeDetailOf(run.api, reference);
+				const retried = await retriedOperation(run.api, reference, node.revision);
+				return printed(run, retried, (detail) => detail.operation === null ? `${detail.name} has no operation left to run.` : `Retrying ${operationText(detail.operation)} of ${detail.name}; kcloud nodes show ${detail.name} follows the steps.`);
 			}
 		}),
 		defineCommand({
@@ -8798,7 +9358,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "delete",
-			summary: "Delete a node that runs no agent.",
+			summary: "Delete a node that runs no agent, with its droplet on DigitalOcean.",
 			usage: "nodes delete <node>",
 			optionsUsage: nodeUsage,
 			options: {},
@@ -8810,13 +9370,300 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				const run = await runOf(adaptersOf, invocation);
 				const given = invocation.positionals[0] ?? "";
 				const reference = await resolveNode(run, given);
+				const node = await nodeDetailOf(run.api, reference);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: node.machine === null ? `Delete the node ${given}? Its host can no longer reach the platform.` : `Delete the node ${given}? The platform destroys its droplet and its volume with the data of its agents.`
+				});
+				const removing = await deleteNode(run.api, reference);
+				if (removing === null) return said(run, `Deleted the node ${given}.`);
+				return printed(run, removing, (removed) => `The removal of ${removed.name} started: the platform destroys its droplet, its volume and its firewall, then forgets the node. kcloud nodes list shows it until then.`);
+			}
+		})
+	]
+});
+//#endregion
+//#region src/commands/providers/index.ts
+const accountUsage = [["", "an account is named by its name or its id"]];
+const regionOption = { region: { type: "string" } };
+const tokenOf = async (run, name, values) => {
+	const token = await secretOf({
+		run,
+		file: values["secret-file"],
+		fromStdin: values["secret-stdin"],
+		question: `The DigitalOcean token of ${name}`,
+		stdinHint: "Pipe the token in, or drop --secret-stdin to be asked for it."
+	});
+	validated(providerTokenSchema, token, "a DigitalOcean token");
+	return token;
+};
+const gigabytes = (megabytes) => `${megabytes / 1024} GB`;
+const accountDetailsText = (account) => [renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+	["name", account.name],
+	["kind", account.kind],
+	["default region", account.defaultRegion],
+	["nodes", String(account.nodeCount)],
+	["token", verificationText(account.verification)],
+	["checked", account.verification.checkedAt],
+	["created", account.createdAt],
+	["updated", account.updatedAt],
+	["id", account.id]
+]), ...account.verification.missingScopes.length === 0 ? [] : ["", `The token lacks ${account.verification.missingScopes.join(", ")}.`]].join("\n");
+const verificationSentence = (account) => {
+	const { failure, missingScopes } = account.verification;
+	if (failure === "unauthorized") return `DigitalOcean refused the token of ${account.name}; kcloud providers update ${account.name} --token replaces it.`;
+	if (failure !== null) return `The token of ${account.name} could not be checked: ${failure}.`;
+	return missingScopes.length === 0 ? `The token of ${account.name} has every scope a node needs.` : `The token of ${account.name} lacks ${missingScopes.join(", ")}.`;
+};
+const catalogText = (catalog) => [
+	renderTable([
+		{ header: "REGION" },
+		{ header: "NAME" },
+		{ header: "AVAILABLE" }
+	], catalog.regions.map((region) => [
+		region.slug === catalog.region ? `${region.slug} *` : region.slug,
+		region.name,
+		region.available ? "yes" : "no"
+	])),
+	"",
+	catalog.sizes.length === 0 ? `No size for a node is offered in ${catalog.region}.` : renderTable([
+		{ header: `SIZE IN ${catalog.region.toUpperCase()}` },
+		{
+			header: "CPU",
+			align: "right"
+		},
+		{
+			header: "MEMORY",
+			align: "right"
+		},
+		{
+			header: "DISK",
+			align: "right"
+		},
+		{
+			header: "USD A MONTH",
+			align: "right"
+		}
+	], catalog.sizes.map((size) => [
+		size.slug,
+		String(size.vcpus),
+		gigabytes(size.memoryMb),
+		`${size.diskGb} GB`,
+		size.priceMonthly.toFixed(2)
+	]))
+].join("\n");
+const createProvidersCommand = (adaptersOf) => defineGroup({
+	name: "providers",
+	summary: "The cloud accounts the platform creates the nodes of the organization in.",
+	usage: "providers <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the provider accounts of the organization.",
+			usage: "providers list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await providerAccountsOf(run.api, organization.id);
+				return printed(run, items, (accounts) => accounts.length === 0 ? `${organization.slug} has no provider account yet; kcloud providers add <name> --region <slug> adds one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "KIND" },
+					{ header: "REGION" },
+					{
+						header: "NODES",
+						align: "right"
+					},
+					{ header: "TOKEN" },
+					{ header: "ID" }
+				], accounts.map((account) => [
+					account.name,
+					account.kind,
+					account.defaultRegion,
+					String(account.nodeCount),
+					verificationText(account.verification),
+					account.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a provider account with the state of its token.",
+			usage: "providers show <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				return printed(run, account, accountDetailsText);
+			}
+		}),
+		defineCommand({
+			name: "add",
+			summary: "Add a DigitalOcean account, asking for its token.",
+			usage: "providers add <name> --region <slug> [--secret-file <path>]",
+			optionsUsage: [
+				["--region <slug>", "the region a new node goes to by default, as in fra1"],
+				...secretUsage,
+				["", "the instance checks the token before it stores it; the token needs"],
+				...scopeLines().map((line) => ["", `  ${line}`])
+			],
+			options: {
+				...regionOption,
+				...secretOptions
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const name = invocation.positionals[0] ?? "";
+				if (values.region === void 0) throw new UsageError("providers add needs --region <slug>.", "Name the region a new node goes to by default, as in fra1.");
+				const draft = {
+					kind: "digitalocean",
+					name,
+					defaultRegion: values.region
+				};
+				validated(createProviderAccountBodySchema.omit({ token: true }), draft, "a provider account");
+				const token = await tokenOf(run, name, values);
+				const account = providerDataOf("add the provider account", await run.api.POST("/organizations/{organizationId}/provider-accounts", {
+					params: { path: { organizationId: organization.id } },
+					body: {
+						...draft,
+						token
+					}
+				}));
+				return printed(run, account, (added) => `Added ${added.name} as ${added.id}; its token has every scope a node needs.`);
+			}
+		}),
+		defineCommand({
+			name: "update",
+			summary: "Rename a provider account, change its default region or replace its token.",
+			usage: "providers update <account> [--name <name>] [--region <slug>] [--token]",
+			optionsUsage: [
+				...accountUsage,
+				["--name <name>", "the new name"],
+				["--region <slug>", "the new default region of new nodes"],
+				["--token", "replace the token, asking for the new one"],
+				...secretUsage,
+				["", `the new token needs the ${providerTokenScopes.length} scopes add lists`]
+			],
+			options: {
+				name: { type: "string" },
+				...regionOption,
+				token: {
+					type: "boolean",
+					default: false
+				},
+				...secretOptions
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const replacesToken = values.token || values["secret-stdin"] || values["secret-file"] !== void 0;
+				if (values.name === void 0 && values.region === void 0 && !replacesToken) throw new UsageError("providers update needs --name, --region or --token.");
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				const change = {
+					revision: account.revision,
+					...values.name === void 0 ? {} : { name: values.name },
+					...values.region === void 0 ? {} : { defaultRegion: values.region }
+				};
+				validated(createProviderAccountBodySchema.pick({
+					name: true,
+					defaultRegion: true
+				}).partial(), change, "a change of a provider account");
+				const body = replacesToken ? {
+					...change,
+					token: await tokenOf(run, account.name, values)
+				} : change;
+				const updated = providerDataOf("update the provider account", await run.api.PATCH("/organizations/{organizationId}/provider-accounts/{accountId}", {
+					params: { path: {
+						organizationId: organization.id,
+						accountId: account.id
+					} },
+					body
+				}));
+				return printed(run, updated, (changed) => `Updated ${changed.name}${replacesToken ? "; its new token has every scope a node needs" : ""}.`);
+			}
+		}),
+		defineCommand({
+			name: "verify",
+			summary: "Check the token of a provider account against DigitalOcean again.",
+			usage: "providers verify <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				return printed(run, await verifiedAccount(run.api, organization.id, account.id), verificationSentence);
+			}
+		}),
+		defineCommand({
+			name: "catalog",
+			summary: "List the regions of a provider account and the sizes a node can have in one.",
+			usage: "providers catalog <account> [--region <slug>]",
+			optionsUsage: [
+				...accountUsage,
+				["--region <slug>", "the region whose sizes to list (default: the account's)"],
+				["", "only regions with volumes and sizes with at least 2 GB of memory"]
+			],
+			options: regionOption,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const account = await resolveProviderAccount(run, invocation.positionals[0] ?? "");
+				const catalog = await providerCatalogOf(run.api, organization.id, account.id);
+				return printed(run, catalogInRegion(catalog, invocation.values.region ?? account.defaultRegion), catalogText);
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a provider account no node was created with.",
+			usage: "providers delete <account>",
+			optionsUsage: accountUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const given = invocation.positionals[0] ?? "";
+				const account = await resolveProviderAccount(run, given);
 				await confirmed({
 					prompt: run.prompt,
 					settings: run.settings,
-					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+					question: `Delete the provider account ${given}? The platform erases its token.`
 				});
-				await deleteNode(run.api, reference);
-				return said(run, `Deleted the node ${given}.`);
+				await deleteProviderAccount(run.api, organization.id, account.id);
+				return said(run, `Deleted the provider account ${given}.`);
 			}
 		})
 	]
@@ -8868,6 +9715,7 @@ const kcloudCommands = () => [
 	createCredentialsCommand(createAdapters),
 	createRepositoriesCommand(createAdapters),
 	createToolsCommand(createAdapters),
+	createProvidersCommand(createAdapters),
 	createNodesCommand(createAdapters),
 	createAgentsCommand(createAdapters),
 	createNotificationsCommand(createAdapters),

package/package.json

@@ -15,7 +15,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.17.0",
+  "version": "0.18.0",
   "dependencies": {
     "@clack/prompts": "1.8.1",
     "@modelcontextprotocol/server": "2.1.0",