@kikimoradev/kcloud 1.1.0 → 1.3.0

package/dist/main.js

@@ -518,7 +518,9 @@ const runCli = dispatcherOf(spec);
 //#endregion
 //#region ../../packages/contracts/src/patterns.ts
 const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
+const uuidShapePattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 const hexColorPattern = /^#[0-9a-f]{6}$/;
+const logoHashPattern = /^[0-9a-f]{64}$/;
 const userCodePattern = /^[23456789BCDFGHJKLMNPQRSTVWXZ]{4}-[23456789BCDFGHJKLMNPQRSTVWXZ]{4}$/;
 const versionTagPattern = /^(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})$/;
 const effortLevelSchema = z.enum([
@@ -661,6 +663,22 @@ const credentialMetadataSchema = z.object({
 	checkedAt: z.iso.datetime().optional(),
 	failureReason: z.string().optional()
 }).meta({ id: "CredentialMetadata" });
+const usageWindowStatusSchema = z.enum([
+	"allowed",
+	"allowed_warning",
+	"rejected"
+]);
+const usageWindowSchema = z.object({
+	utilization: z.number().nonnegative(),
+	resetsAt: z.iso.datetime().nullable(),
+	status: usageWindowStatusSchema.nullable()
+}).meta({ id: "UsageWindow" });
+const subscriptionUsageSchema = z.object({
+	fiveHour: usageWindowSchema.nullable(),
+	sevenDay: usageWindowSchema.nullable(),
+	readAt: z.iso.datetime(),
+	stale: z.boolean()
+}).meta({ id: "SubscriptionUsage" });
 const credentialSchema = z.object({
 	id: idSchema,
 	projectId: idSchema,
@@ -671,6 +689,8 @@ const credentialSchema = z.object({
 	verification: verificationStatusSchema,
 	metadata: credentialMetadataSchema,
 	expiresAt: z.iso.datetime().nullable(),
+	expiresAtComputed: z.boolean(),
+	usage: subscriptionUsageSchema.nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 }).meta({ id: "Credential" });
@@ -739,6 +759,7 @@ const errorCodes = Object.keys({
 	"credential.in_use": "conflict",
 	"credential.kind_mismatch": "rule_violation",
 	"credential.rejected": "rule_violation",
+	"credential.usage_unavailable": "rule_violation",
 	"repository.not_found": "not_found",
 	"repository.already_registered": "conflict",
 	"repository.in_use": "conflict",
@@ -805,7 +826,6 @@ const errorCodes = Object.keys({
 	"node.size_unavailable": "rule_violation",
 	"node.size_not_larger": "rule_violation",
 	"node.region_unavailable": "rule_violation",
-	"node.import_refused": "rule_violation",
 	"provider.not_found": "not_found",
 	"provider.name_taken": "conflict",
 	"provider.in_use": "conflict",
@@ -819,20 +839,17 @@ const errorCodes = Object.keys({
 	"infrastructure.provider_error": "internal",
 	"infrastructure.operation_in_progress": "conflict",
 	"infrastructure.host_ops_disabled": "rule_violation",
-	"infrastructure.backups_unavailable": "rule_violation",
-	"infrastructure.maintenance_in_progress": "conflict",
-	"infrastructure.maintenance_not_in_progress": "conflict",
 	"backup.not_found": "not_found",
 	"backup.in_progress": "conflict",
 	"backup.unavailable": "rule_violation",
 	"backup.corrupt": "rule_violation",
 	"backup.undecryptable": "rule_violation",
-	"platform.version_unknown": "rule_violation",
-	"platform.same_version": "rule_violation",
-	"platform.image_unresolved": "rule_violation",
-	"platform.scripts_outdated": "rule_violation",
-	"volume.invalid_size": "rule_violation",
-	"notification.not_found": "not_found"
+	"notification.not_found": "not_found",
+	"logo.not_found": "not_found",
+	"logo.unreadable": "rule_violation",
+	"logo.too_small": "rule_violation",
+	"logo.too_large": "rule_violation",
+	"logo.type_mismatch": "rule_violation"
 });
 const errorCodeSchema = z.enum(errorCodes);
 const errorDetailsSchema = z.record(z.string(), z.union([
@@ -1083,7 +1100,8 @@ agentEventSchema.options.map((option) => option.shape.event.value);
 	crashLooping: "platform.crashLooping",
 	provisioned: "platform.provisioned",
 	sandboxStarted: "platform.sandboxStarted",
-	sandboxStopped: "platform.sandboxStopped"
+	sandboxStopped: "platform.sandboxStopped",
+	restartedByNode: "platform.restartedByNode"
 }).rawLog;
 const agentStateSchema = z.enum([
 	"created",
@@ -1180,46 +1198,11 @@ const degradedAgentSchema = z.object({
 z.object({
 	status: z.enum(runtimeHealthStates),
 	database: z.object({ ok: z.boolean() }),
-	engine: z.enum(runtimeEngineKinds),
-	docker: z.object({
-		state: z.enum(dockerStates),
-		lastError: z.string().nullable(),
-		checkedAt: z.iso.datetime().nullable()
-	}),
-	storage: z.object({
-		data: storageStateSchema,
-		engine: storageStateSchema
-	}),
 	partitions: z.object({
 		defaultRows: z.int().nonnegative(),
 		ensuredThrough: z.string().nullable(),
 		lastMaintenanceAt: z.iso.datetime().nullable()
 	}),
-	reconcile: z.object({
-		lastTickAt: z.iso.datetime().nullable(),
-		lastTickError: z.string().nullable(),
-		agentsQueued: z.int().nonnegative(),
-		agentsActive: z.int().nonnegative()
-	}),
-	ingest: z.object({
-		readers: z.int().nonnegative(),
-		oldestCursorLagSeconds: z.number().nonnegative().nullable()
-	}),
-	sandbox: z.object({
-		enabled: z.boolean(),
-		image: z.object({
-			tag: z.string(),
-			digest: z.string()
-		}),
-		agentsWithSandbox: z.int().nonnegative(),
-		sidecarsRunning: z.int().nonnegative(),
-		volumeBytes: z.int().nonnegative().nullable()
-	}),
-	sessionLogs: z.object({
-		prunedDirectories: z.int().nonnegative(),
-		lastPrunedAt: z.iso.datetime().nullable(),
-		failures: z.int().nonnegative()
-	}),
 	metrics: runtimeMetricsSchema,
 	deadLetters: z.array(deadLetterQueueSchema),
 	degradedAgents: z.array(degradedAgentSchema)
@@ -1442,17 +1425,21 @@ const memorySummarySchema = z.object({
 	sessionId: z.string().nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "MemorySummary" });
-z.object({
-	items: z.array(memorySummarySchema),
+const memoryOutcomes = ["succeeded", "failed"];
+const memoryOutcomeSchema = z.enum(memoryOutcomes);
+pageSchema(memorySummarySchema).extend({
 	source: z.enum(["worker", "unavailable"]),
 	staleReason: z.enum([
 		"unreachable",
 		"timeout",
 		"stopped"
-	]).nullable()
-}).meta({ id: "AgentMemoryList" });
+	]).nullable(),
+	truncated: z.boolean()
+}).meta({ id: "AgentMemoryPage" });
 z.object({
 	q: z.string().max(200).optional(),
+	outcome: memoryOutcomeSchema.optional(),
+	cursor: cursorSchema.optional(),
 	limit: z.coerce.number().int().min(1).max(100).default(20)
 });
 const costPointSchema = z.object({
@@ -1565,7 +1552,7 @@ z.object({
 	organizationId: idSchema,
 	accountId: idSchema
 });
-z.enum(["monitor", "executor"]);
+const sessionRoleSchema = z.enum(["monitor", "executor"]);
 const sessionSlotCountSchema = z.int().min(1).max(64);
 const sessionQueueEntrySchema = z.object({
 	agentId: idSchema,
@@ -1574,8 +1561,21 @@ const sessionQueueEntrySchema = z.object({
 	projectName: z.string().nullable(),
 	position: z.int().positive(),
 	since: z.iso.datetime(),
-	taskId: z.string().nullable()
+	taskId: z.string().nullable(),
+	taskTitle: z.string().nullable(),
+	readable: z.boolean()
 }).meta({ id: "SessionQueueEntry" });
+const sessionHolderSchema = z.object({
+	agentId: idSchema,
+	agentName: z.string().nullable(),
+	projectId: idSchema.nullable(),
+	projectName: z.string().nullable(),
+	since: z.iso.datetime().nullable(),
+	taskId: z.string().nullable(),
+	taskTitle: z.string().nullable(),
+	readable: z.boolean(),
+	pid: z.int().positive().nullable()
+}).meta({ id: "SessionHolder" });
 const sessionPoolSchema = z.object({
 	slots: sessionSlotCountSchema.nullable(),
 	effective: z.int().nonnegative(),
@@ -1602,6 +1602,12 @@ const agentAdmissionSchema = z.object({
 	monitor: agentAdmissionStateSchema.nullable(),
 	executor: agentAdmissionStateSchema.nullable()
 }).meta({ id: "AgentAdmission" });
+const admissionHoldSchema = z.object({
+	pools: z.array(sessionRoleSchema),
+	sessions: z.int().nonnegative(),
+	target: z.string().nullable(),
+	updating: z.boolean()
+}).meta({ id: "AdmissionHold" });
 const nodeStateSchema = z.enum([
 	"pending",
 	"online",
@@ -1670,16 +1676,36 @@ const poolUsageSchema = z.object({
 	memoryBytes: z.int().nonnegative(),
 	memoryMaxBytes: z.int().nonnegative().nullable(),
 	cpus: z.number().nonnegative().nullable(),
-	memoryKills: z.int().nonnegative()
+	memoryKills: z.int().nonnegative(),
+	processors: z.int().positive().nullable().optional()
 }).meta({ id: "PoolUsage" });
 const nodePoolSchema = z.object({
 	slots: z.int().nonnegative(),
 	inUse: z.int().nonnegative(),
 	waiting: z.array(sessionQueueEntrySchema),
+	holders: z.array(sessionHolderSchema).nullable(),
 	usage: poolUsageSchema.nullable()
 }).meta({ id: "NodePool" });
+const sessionRefusalsSchema = z.object({
+	count: z.int().positive(),
+	lastAt: z.iso.datetime(),
+	pool: sessionRoleSchema,
+	reason: z.string()
+}).meta({ id: "SessionRefusals" });
+const poolLayoutSchema = z.object({
+	cores: z.array(z.int().positive()).min(1),
+	cpus: z.object({
+		monitor: z.number().positive(),
+		executor: z.number().positive()
+	}).nullable(),
+	topologyError: z.string().nullable(),
+	clamped: z.boolean()
+}).meta({ id: "PoolLayout" });
 const nodePoolsSchema = z.object({
 	enforcement: poolEnforcementSchema,
+	agentsSlice: poolEnforcementSchema.nullable(),
+	refused: sessionRefusalsSchema.nullable(),
+	layout: poolLayoutSchema.nullable(),
 	monitor: nodePoolSchema,
 	executor: nodePoolSchema
 }).meta({ id: "NodePools" });
@@ -1761,6 +1787,7 @@ const nodeUpdateSchema = z.object({
 	target: z.string().nullable(),
 	sessions: z.int().nonnegative(),
 	since: z.iso.datetime().nullable(),
+	held: z.array(sessionRoleSchema),
 	last: z.object({
 		outcome: z.enum([
 			"updated",
@@ -1784,12 +1811,7 @@ const nodeAgentSchema = z.object({
 const nodeRuntimeSchema = z.object({
 	reportedAt: z.iso.datetime(),
 	docker: z.object({
-		state: z.enum([
-			"ok",
-			"unavailable",
-			"disabled",
-			"adopting"
-		]),
+		state: z.enum(dockerStates),
 		lastError: z.string().nullable()
 	}),
 	storage: z.object({
@@ -1802,7 +1824,20 @@ const nodeRuntimeSchema = z.object({
 		agentsQueued: z.int().nonnegative(),
 		agentsActive: z.int().nonnegative()
 	}),
-	ingest: z.object({ readers: z.int().nonnegative() }),
+	ingest: z.object({
+		readers: z.int().nonnegative(),
+		oldestCursorLagSeconds: z.number().nonnegative().nullable()
+	}),
+	sandbox: z.object({
+		enabled: z.boolean(),
+		image: z.object({
+			tag: z.string(),
+			digest: z.string()
+		}),
+		agentsWithSandbox: z.int().nonnegative(),
+		sidecarsRunning: z.int().nonnegative(),
+		volumeBytes: z.int().nonnegative().nullable()
+	}),
 	sessions: z.object({
 		monitor: z.object({
 			effective: z.int().nonnegative(),
@@ -1821,6 +1856,28 @@ nodeSchema.extend({
 	update: nodeUpdateSchema.nullable()
 }).meta({ id: "NodeDetail" });
 z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
+const adminNodeSessionsSchema = z.object({
+	effective: z.int().nonnegative(),
+	inUse: z.int().nonnegative()
+});
+const nodeHealthSchema = z.object({
+	docker: z.enum(dockerStates),
+	storage: z.enum(storageStates),
+	reconcileError: z.string().nullable()
+}).meta({ id: "NodeHealth" });
+const adminNodeSchema = nodeSchema.extend({
+	organization: z.object({
+		id: idSchema,
+		name: z.string().nullable()
+	}),
+	update: nodeUpdateSchema.nullable(),
+	sessions: z.object({
+		monitor: adminNodeSessionsSchema,
+		executor: adminNodeSessionsSchema
+	}).nullable(),
+	health: nodeHealthSchema.nullable()
+}).meta({ id: "AdminNode" });
+z.object({ items: z.array(adminNodeSchema) }).meta({ id: "AdminNodeList" });
 z.object({ nodeId: idSchema });
 z.object({
 	organizationId: idSchema,
@@ -1894,17 +1951,51 @@ const splitFits = (split, host) => {
 	const overflow = splitOverflowOf(split, host);
 	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
 };
+const poolProcessorsOf = (cpus, hostCpus) => Math.max(1, Math.min(Math.round(cpus), Math.round(hostCpus)));
+const layoutAppliesSplit = (layout, split) => layout?.cpus != null && split !== null && layout.cpus.monitor === split.monitor.cpus && layout.cpus.executor === split.executor.cpus;
+const splitCoresOf = (split, cores) => {
+	const processors = cores.reduce((total, size) => total + size, 0);
+	const sizeAt = (index) => cores[Math.min(index, cores.length - 1)] ?? 1;
+	const coresFrom = (first, cpus) => {
+		const wanted = poolProcessorsOf(cpus, processors);
+		let taken = sizeAt(first);
+		let count = 1;
+		while (taken + sizeAt(first + count) <= wanted) {
+			taken += sizeAt(first + count);
+			count += 1;
+		}
+		return count;
+	};
+	const executor = coresFrom(0, split.executor.cpus);
+	const monitor = coresFrom(executor, split.monitor.cpus);
+	return {
+		cores: cores.length,
+		monitor,
+		executor,
+		fits: executor + monitor < cores.length
+	};
+};
+//#endregion
+//#region ../../packages/contracts/src/appearance.ts
+const colorSchema = z.string().regex(hexColorPattern);
+const logoMaxBytes = 524288;
+const logoHashSchema = z.string().regex(logoHashPattern);
+z.instanceof(Uint8Array).meta({ description: "The bytes of a PNG, JPEG or WebP image." });
+z.instanceof(Uint8Array).meta({ description: "The bytes of the WebP image." });
+z.object({ v: logoHashSchema.optional() });
 //#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
 const passwordSchema = z.string().min(12).max(128);
 const userStatusSchema = z.enum(["active", "disabled"]);
 const organizationNameSchema = z.string().trim().min(2).max(80);
-const organizationSlugSchema = z.string().regex(slugPattern);
+const organizationSlugSchema = z.string().regex(slugPattern).refine((slug) => !uuidShapePattern.test(slug));
 const organizationSchema = z.object({
 	id: idSchema,
 	name: z.string(),
 	slug: organizationSlugSchema,
+	color: colorSchema,
+	logoHash: logoHashSchema.nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Organization" });
 z.object({ items: z.array(organizationSchema) }).meta({ id: "OrganizationList" });
@@ -1962,6 +2053,11 @@ z.object({
 		initialPassword: passwordSchema.optional()
 	}).optional()
 }).meta({ id: "CreateOrganizationBody" });
+const updateOrganizationBodySchema = z.object({
+	name: organizationNameSchema,
+	slug: organizationSlugSchema,
+	color: colorSchema
+}).meta({ id: "UpdateOrganizationBody" });
 z.object({ temporaryPassword: z.string() }).meta({ id: "TemporaryPassword" });
 z.object({ items: z.array(userSchema) }).meta({ id: "UserList" });
 z.object({ id: idSchema });
@@ -2030,6 +2126,9 @@ const auditActionSchema = z.enum([
 	"platform.bootstrapped",
 	"organization.created",
 	"organization.renamed",
+	"organization.updated",
+	"organization.logo_set",
+	"organization.logo_removed",
 	"user.created",
 	"user.role_changed",
 	"user.disabled",
@@ -2043,6 +2142,8 @@ const auditActionSchema = z.enum([
 	"token.revoked",
 	"project.created",
 	"project.updated",
+	"project.logo_set",
+	"project.logo_removed",
 	"project.member_added",
 	"project.member_role_changed",
 	"project.member_removed",
@@ -2151,7 +2252,6 @@ pageSchema(auditEntrySchema).meta({ id: "AuditPage" });
 //#endregion
 //#region ../../packages/contracts/src/projects.ts
 const slugSchema = z.string().regex(slugPattern);
-const colorSchema = z.string().regex(hexColorPattern);
 const projectSchema = z.object({
 	id: idSchema,
 	organizationId: idSchema,
@@ -2159,6 +2259,7 @@ const projectSchema = z.object({
 	slug: slugSchema,
 	description: z.string(),
 	color: colorSchema,
+	logoHash: logoHashSchema.nullable(),
 	dockerAllowed: z.boolean(),
 	memberCount: z.int().nonnegative(),
 	createdAt: z.iso.datetime(),
@@ -2513,9 +2614,6 @@ const containerHealthSchema = z.enum([
 ]);
 const maxAgentDescriptionLength = 2e3;
 const maxAgentPromptLength = 64e3;
-const minAgentCpus = .25;
-const maxAgentMemoryMb = 16384;
-const defaultAgentMemoryMb = 4096;
 const workspaceDirectorySchema = z.string().regex(/^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/);
 const timeZones = new Set(Intl.supportedValuesOf("timeZone"));
 const timezoneSchema = z.string().trim().refine((value) => timeZones.has(value), { message: "expected an IANA time zone identifier" });
@@ -2526,11 +2624,13 @@ const agentDiskGbSchema = z.int().min(1).max(100);
 const agentMachineSchema = z.object({
 	docker: z.boolean(),
 	browser: z.boolean(),
-	cpus: z.number().min(minAgentCpus).max(8),
-	memoryMb: z.int().min(512).max(maxAgentMemoryMb),
 	diskGb: agentDiskGbSchema
-}).meta({ id: "AgentMachine" });
+});
 const agentMachineInputSchema = agentMachineSchema.extend({ diskGb: agentDiskGbSchema.optional() });
+const agentMachineDtoSchema = agentMachineSchema.extend({
+	cpus: z.number().positive().optional().meta({ deprecated: true }),
+	memoryMb: z.int().positive().optional().meta({ deprecated: true })
+}).meta({ id: "AgentMachine" });
 const agentPromptsSchema = z.object({
 	monitor: agentPromptSchema,
 	executor: agentPromptSchema
@@ -2587,6 +2687,7 @@ const agentRuntimeSchema = z.object({
 	stopMode: agentStopModeSchema.nullable(),
 	stopDeadlineAt: z.iso.datetime().nullable(),
 	admission: agentAdmissionSchema.nullable(),
+	admissionHold: admissionHoldSchema.nullable(),
 	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "AgentRuntime" });
 const agentListItemSchema = z.object({
@@ -2615,7 +2716,7 @@ agentListItemSchema.extend({
 	version: z.int().nonnegative(),
 	description: z.string(),
 	timezone: z.string(),
-	machine: agentMachineSchema,
+	machine: agentMachineDtoSchema,
 	settings: kikimoraSettingsSchema,
 	effectiveSettings: workerSettingsSchema,
 	prompts: agentPromptsSchema,
@@ -2757,13 +2858,20 @@ z.object({
 	nodeId: idSchema
 }).meta({ id: "RestoreAgentBody" });
 z.object({ agentId: idSchema }).meta({ id: "RestoredAgent" });
+const agentBackupContentDigestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
 z.object({
 	agentId: idSchema,
 	trigger: z.enum(agentBackupTriggers),
 	kikimoraVersion: z.string().min(1).max(64),
-	entries: z.coerce.number().int().nonnegative()
+	entries: z.coerce.number().int().nonnegative(),
+	contentDigest: agentBackupContentDigestSchema.optional()
 });
 z.object({ backupId: idSchema });
+z.object({
+	agentId: idSchema,
+	contentDigest: agentBackupContentDigestSchema
+});
+z.object({ backupId: idSchema.nullable() });
 [
 	"application/vnd.oci.image.index.v1+json",
 	"application/vnd.oci.image.manifest.v1+json",
@@ -2771,21 +2879,12 @@ z.object({ backupId: idSchema });
 	"application/vnd.docker.distribution.manifest.v2+json"
 ].join(", ");
 const pinnedPlatformImagePattern = /^[a-z0-9][a-z0-9.-]*(?::[0-9]{1,5})?(?:\/[a-z0-9][a-z0-9._-]*)+@sha256:[0-9a-f]{64}$/;
-//#endregion
-//#region ../../packages/contracts/src/infrastructure.ts
-const volumeRoles = ["data", "agents"];
-const volumeRoleSchema = z.enum(volumeRoles);
+const volumeRoleSchema = z.enum(["data", "agents"]);
 const filesystemNameSchema = z.enum([
 	"root",
 	"data",
 	"agents"
 ]);
-z.enum([
-	"digitalOcean",
-	"spaces",
-	"ghcr",
-	"backup"
-]);
 const backupKindSchema = z.enum(["scheduled", "manual"]);
 const backupStatusSchema = z.enum([
 	"running",
@@ -2829,65 +2928,42 @@ const sha256HexPattern = /^[0-9a-f]{64}$/;
 const platformSecretPattern = /^[\x21-\x7e]+$/;
 const instantSchema$1 = z.iso.datetime();
 const byteCountSchema$1 = z.int().nonnegative();
-const platformSecretSchema = z.string().trim().min(1).max(maxPlatformSecretLength).regex(platformSecretPattern, { message: "expected printable ASCII characters without spaces" });
+z.string().trim().min(1).max(maxPlatformSecretLength).regex(platformSecretPattern, { message: "expected printable ASCII characters without spaces" });
 const secretPresenceSchema = z.object({ present: z.boolean() }).meta({ id: "SecretPresence" });
 const regionSchema = z.string().regex(regionSlugPattern);
+const bucketNameSchema = z.string().regex(bucketNamePattern);
 const platformVolumeSchema = z.object({
 	role: volumeRoleSchema,
 	id: z.guid(),
 	name: z.string().regex(volumeNamePattern)
 }).meta({ id: "PlatformVolume" });
-const oneVolumePerRole = (volumes) => volumes.length === volumeRoles.length && volumeRoles.every((role) => volumes.some((volume) => volume.role === role));
-const platformVolumesSchema = z.array(platformVolumeSchema).refine(oneVolumePerRole, { message: `expected exactly one volume for each role: ${volumeRoles.join(", ")}` });
+const countOfRole = (volumes, role) => volumes.filter((volume) => volume.role === role).length;
+const oneDataVolumeAndAtMostOneAgentsVolume = (volumes) => countOfRole(volumes, "data") === 1 && countOfRole(volumes, "agents") <= 1;
+const platformVolumesSchema = z.array(platformVolumeSchema).refine(oneDataVolumeAndAtMostOneAgentsVolume, { message: "expected one data volume and at most one agents volume" });
 const isOrigin = (value) => {
 	if (!URL.canParse(value)) return false;
 	const url = new URL(value);
 	return url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
 };
 const spacesEndpointSchema = z.url({ protocol: /^https?$/ }).max(2e3).refine(isOrigin, { message: "expected an origin without a path, a query, a fragment or credentials" });
-const digitalOceanShape = {
-	dropletId: z.int().positive(),
-	region: regionSchema,
-	reservedIp: z.ipv4(),
-	volumes: platformVolumesSchema
-};
-const spacesShape = {
-	endpoint: spacesEndpointSchema,
-	region: regionSchema,
-	bucket: z.string().regex(bucketNamePattern)
-};
 const backupSettingsSchema = z.object({ retentionDays: z.int().min(1).max(maxBackupRetentionDays) }).meta({ id: "BackupSettings" });
 z.object({
-	version: z.int().nonnegative(),
 	instance: z.string(),
 	domain: z.string(),
 	digitalOcean: z.object({
-		...digitalOceanShape,
-		token: secretPresenceSchema
+		dropletId: z.int().positive(),
+		region: regionSchema,
+		reservedIp: z.ipv4(),
+		volumes: platformVolumesSchema
 	}).nullable(),
 	spaces: z.object({
-		...spacesShape,
-		accessKey: secretPresenceSchema,
-		secretKey: secretPresenceSchema
+		endpoint: spacesEndpointSchema,
+		region: regionSchema,
+		bucket: bucketNameSchema
 	}).nullable(),
 	ghcrToken: secretPresenceSchema,
-	backup: backupSettingsSchema,
-	updatedAt: instantSchema$1
+	backup: backupSettingsSchema
 }).meta({ id: "PlatformSettings" });
-z.object({
-	version: z.int().nonnegative(),
-	digitalOcean: z.object({
-		...digitalOceanShape,
-		token: platformSecretSchema.nullable()
-	}).nullable(),
-	spaces: z.object({
-		...spacesShape,
-		accessKey: platformSecretSchema.nullable(),
-		secretKey: platformSecretSchema.nullable()
-	}).nullable(),
-	ghcrToken: platformSecretSchema.nullable(),
-	backup: backupSettingsSchema.nullable()
-}).meta({ id: "UpdatePlatformSettingsBody" });
 const storageReadingSchema = z.discriminatedUnion("measured", [z.object({
 	measured: z.literal(true),
 	path: z.string(),
@@ -2935,19 +3011,6 @@ const nodeVolumesSchema = z.discriminatedUnion("source", [z.object({
 	source: z.literal("ok"),
 	items: z.array(nodeVolumeSchema)
 }), unavailableBecause(["not_configured"])]).meta({ id: "NodeVolumes" });
-const dropletSizeSchema = z.object({
-	slug: z.string(),
-	vcpus: z.int().positive(),
-	memoryMb: z.int().positive(),
-	diskGb: z.int().positive(),
-	priceMonthly: z.number().nonnegative(),
-	command: z.string()
-}).meta({ id: "DropletSize" });
-const nodeSizesSchema = z.discriminatedUnion("source", [z.object({
-	source: z.literal("ok"),
-	items: z.array(dropletSizeSchema)
-}), unavailableBecause(providerUnavailableReasons)]).meta({ id: "NodeSizes" });
-const capacityForecastSchema = z.object({ byDisk: z.int().nonnegative().nullable() }).meta({ id: "CapacityForecast" });
 z.object({
 	droplet: nodeDropletSchema,
 	volumes: nodeVolumesSchema,
@@ -2956,23 +3019,14 @@ z.object({
 		data: storageReadingSchema,
 		agents: storageReadingSchema
 	}),
-	sizes: nodeSizesSchema,
 	platform: z.object({
 		version: z.string(),
 		instance: z.string(),
 		scriptsVersion: z.string(),
 		dockerVersion: z.string().nullable(),
 		dockerRootDir: z.string().nullable()
-	}),
-	maintenance: z.object({
-		quiescedAt: instantSchema$1.nullable(),
-		pending: z.array(idSchema)
-	}),
-	capacity: capacityForecastSchema
+	})
 }).meta({ id: "PlatformNode" });
-z.object({ role: volumeRoleSchema });
-z.object({ sizeGb: z.int().positive() }).meta({ id: "ResizeVolumeBody" });
-z.object({ agents: z.int().nonnegative() }).meta({ id: "QuiesceResult" });
 const requesterSchema = z.object({
 	userId: idSchema,
 	label: z.string().nullable()
@@ -3076,22 +3130,17 @@ const registryUnavailableSchema = z.object({
 	detail: z.string().nullable()
 }).meta({ id: "RegistryUnavailable" });
 const hostOperationsAvailabilities = ["enabled", "disabled"];
-const backupsAvailabilities = ["enabled", "unavailable"];
 const installedImageSchema = z.string().regex(pinnedPlatformImagePattern).nullable();
 z.object({
 	version: z.string(),
+	environment: z.string().nullable(),
 	apiImage: installedImageSchema,
 	webImage: installedImageSchema,
 	nodeImage: installedImageSchema,
 	latest: z.string().nullable(),
 	latestError: registryUnavailableSchema.nullable(),
-	versions: z.array(z.string()),
-	upgradeable: z.boolean(),
-	scriptsVersion: z.string(),
-	expectedScriptsVersion: z.string(),
 	imagePrefix: z.string(),
 	hostOperations: z.enum(hostOperationsAvailabilities),
-	backups: z.enum(backupsAvailabilities),
 	operations: z.array(hostOperationSchema)
 }).meta({ id: "Platform" });
 const keyVersionSchema = z.int().positive();
@@ -3114,13 +3163,15 @@ z.object({
 	versions: z.array(masterKeyVersionSchema),
 	rotationPending: z.boolean()
 }).meta({ id: "MasterKey" });
-z.object({ version: z.string().regex(versionTagPattern) }).meta({ id: "UpgradePlatformBody" });
-const metricsRangeSchema = z.enum([
+//#endregion
+//#region ../../packages/contracts/src/metrics.ts
+const metricsRanges = [
 	"1h",
 	"24h",
 	"7d",
 	"90d"
-]);
+];
+const metricsRangeSchema = z.enum(metricsRanges);
 const agentMetricsRanges = [
 	"1h",
 	"24h",
@@ -3174,18 +3225,13 @@ const agentUsageSchema = z.object({
 	blockReadBytes: byteCountSchema,
 	blockWriteBytes: byteCountSchema
 }).meta({ id: "AgentUsage" });
-const nodeHostSeriesSchema = z.object({
-	nodeId: idSchema,
-	nodeName: z.string(),
-	points: z.array(hostPointSchema)
-}).meta({ id: "NodeHostSeries" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
 	to: instantSchema,
-	nodes: z.array(nodeHostSeriesSchema),
+	points: z.array(hostPointSchema),
 	agents: z.array(agentUsageSchema)
-}).meta({ id: "HostMetrics" });
+}).meta({ id: "NodeMetrics" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
@@ -3195,24 +3241,6 @@ z.object({
 }).meta({ id: "AgentMetrics" });
 z.object({ range: metricsRangeSchema });
 z.object({ range: agentMetricsRangeSchema });
-z.object({
-	nodeId: idSchema,
-	agentId: idSchema
-});
-z.object({ agentIds: z.array(idSchema).min(1).max(500) });
-z.object({ occupied: z.array(idSchema) });
-z.object({ offset: z.coerce.number().int().nonnegative() });
-z.object({ bytes: z.int().nonnegative() });
-z.object({
-	bytes: z.int().nonnegative(),
-	sha256: z.string().regex(/^[0-9a-f]{64}$/u)
-});
-z.object({
-	bytes: z.int().nonnegative(),
-	files: z.int().nonnegative(),
-	memoryCheck: z.string()
-});
-z.object({ removed: z.boolean() });
 const notificationKindSchema = z.enum([
 	"credential.verification_failed",
 	"credential.expiring",
@@ -3240,7 +3268,8 @@ const notificationTargetTypeSchema = z.enum([
 	"backup",
 	"queue",
 	"volume",
-	"platform"
+	"platform",
+	"node"
 ]);
 const hostOperationOutcomes = [
 	"succeeded",
@@ -3368,6 +3397,7 @@ const detailsOf$1 = (body) => {
 	const parsed = errorBodySchema.safeParse(body);
 	return parsed.success ? parsed.data.details ?? {} : {};
 };
+const hintText = (hint, details) => typeof hint === "string" ? hint : hint(details);
 //#endregion
 //#region src/client/api.ts
 const defaultTimeoutMs = 3e4;
@@ -3424,7 +3454,7 @@ const createApi = ({ origin, token, fetch = globalThis.fetch, timeoutMs = defaul
 const refused = (action, { error, response }, hints) => {
 	const failure = new ApiError(response.status, codeOf(error), action, detailsOf$1(error));
 	const hint = failure.code === null ? void 0 : hints[failure.code];
-	return hint === void 0 ? failure : new CliError(failure.message, hint, { cause: failure });
+	return hint === void 0 ? failure : new CliError(failure.message, hintText(hint, failure.details), { cause: failure });
 };
 const dataOf = (action, answer, hints = {}) => {
 	if (answer.data === void 0) throw refused(action, answer, hints);
@@ -3796,7 +3826,7 @@ const createLoginCommand = (adaptersOf) => defineCommand({
 	}
 });
 const authorizeInBrowser = async ({ adapters, api, origin, prompt }) => {
-	const started = dataOf("start the sign-in", await api.POST("/auth/cli/authorize", { body: { clientName: adapters.clientName() } }), { "infrastructure.not_configured": `${origin} has no administrator yet; the instance is seeded during kcloud-admin init.` });
+	const started = dataOf("start the sign-in", await api.POST("/auth/cli/authorize", { body: { clientName: adapters.clientName() } }), { "infrastructure.not_configured": `${origin} has no administrator yet; the platform is seeded during pnpm platform bootstrap.` });
 	prompt.note([
 		`Code    ${started.userCode}`,
 		`Address ${started.verificationUri}`,
@@ -4144,6 +4174,13 @@ const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe
 	organizationId,
 	nodeId
 } } }), nodeHints);
+const nodeMetricsOf = async (api, { organizationId, nodeId }, range) => dataOf("show what the node used", await api.GET("/organizations/{organizationId}/nodes/{nodeId}/metrics", { params: {
+	path: {
+		organizationId,
+		nodeId
+	},
+	query: { range }
+} }), nodeHints);
 const createdNode = async (api, organizationId, body) => {
 	validated(createNodeBodySchema, body, "a node");
 	return providerDataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
@@ -4243,10 +4280,15 @@ const runOf = async (adaptersOf, { settings, context }) => {
 //#region src/commands/agents/shared.ts
 const agentOption = { project: { type: "string" } };
 const agentUsage = [["--project <name>", "the project of the agent, when the agent is named alone"]];
+const actionsAfterPause = /* @__PURE__ */ new Set([
+	"update",
+	"restart",
+	"resume"
+]);
 const agentHints = {
 	"agent.not_found": "kcloud agents list --project <name> shows the agents.",
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
+	"agent.invalid_transition": ({ state, action }) => state === "pausing" && actionsAfterPause.has(String(action)) ? "The agent finishes its current session before it pauses; the action goes through once kcloud agents show <agent> says paused." : "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
 	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
@@ -4474,12 +4516,56 @@ const enforcementText = ({ state, reason }) => {
 		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
 	}
 };
-const memoryOf = (pool) => {
+const agentsSliceReasons = {
+	cgroup_driver: "Docker on the host does not use the systemd cgroup driver",
+	cgroup_driver_unread: "the node has not read the cgroup driver of Docker yet",
+	host_unread: "the node has not read its host yet",
+	configure_failed: "systemd did not take the limits",
+	pending: "the node has not applied the limit yet",
+	platform: "the node runs no pool service"
+};
+const agentsSliceText = ({ state, reason }) => {
+	switch (state) {
+		case "enforced": return "The node holds its agents and their sessions together to the host minus its reserve.";
+		case "unsplit": return "The node has no split, so its agents outside their sessions have no limit.";
+		case "unsupported": return `The node holds its agents outside their sessions to no limit: ${reason === null ? "it cannot" : agentsSliceReasons[reason] ?? reason}.`;
+	}
+};
+const refusedText = ({ count, pool, lastAt, reason }) => `The session starter refused ${count === 1 ? "1 session" : `${count} sessions`} of the ${pool} pool in the last hour, the last at ${lastAt}: ${reason}`;
+const layoutTexts = (layout, split) => [...layout.topologyError === null ? [] : [`The node did not read its processor cores, so each logical processor counts as a core and a pool can share a physical core: ${layout.topologyError}`], ...layout.clamped && layoutAppliesSplit(layout, split) ? ["The split does not fit the cores of the node, so its pools run on fewer cores than the split asks for; kcloud nodes split <node> shows the cores each pool takes."] : []];
+const memoryOf$1 = (pool) => {
 	if (pool.usage === null) return "-";
 	const { memoryBytes, memoryMaxBytes } = pool.usage;
 	return memoryMaxBytes === null ? bytesOf(memoryBytes) : `${bytesOf(memoryBytes)} of ${bytesOf(memoryMaxBytes)}`;
 };
 const roles = ["monitor", "executor"];
+const workOf = (role, { taskId, taskTitle, readable }) => {
+	if (readable === false) return "another project";
+	if (taskId === null) return role === "monitor" ? "monitor cycle" : "-";
+	return taskTitle == null ? taskId : `${taskId} ${taskTitle}`;
+};
+const holdersOf = (pools) => {
+	if (roles.every((role) => pools[role].holders == null)) return null;
+	const held = roles.flatMap((role) => (pools[role].holders ?? []).map((holder) => [
+		role,
+		holder.projectName ?? "-",
+		holder.agentName ?? holder.agentId,
+		workOf(role, holder),
+		holder.since ?? "-",
+		holder.pid == null ? "-" : String(holder.pid)
+	]));
+	return held.length === 0 ? "No session holds a slot." : renderTable([
+		{ header: "HOLDS" },
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "WORK" },
+		{ header: "SINCE" },
+		{
+			header: "PID",
+			align: "right"
+		}
+	], held);
+};
 const queueOf = (pools) => {
 	const waiting = roles.flatMap((role) => pools[role].waiting.map((entry) => [
 		role,
@@ -4487,7 +4573,7 @@ const queueOf = (pools) => {
 		entry.projectName ?? "-",
 		entry.agentName ?? entry.agentId,
 		entry.since,
-		entry.taskId ?? "-"
+		workOf(role, entry)
 	]));
 	return waiting.length === 0 ? "No session waits for a slot." : renderTable([
 		{ header: "WAITS FOR" },
@@ -4498,37 +4584,44 @@ const queueOf = (pools) => {
 		{ header: "PROJECT" },
 		{ header: "AGENT" },
 		{ header: "SINCE" },
-		{ header: "TASK" }
+		{ header: "WORK" }
 	], waiting);
 };
-const poolsText = (pools) => [
-	enforcementText(pools.enforcement),
-	renderTable([
-		{ header: "POOL" },
-		{ header: "SLOTS IN USE" },
-		{
-			header: "CPU IN USE",
-			align: "right"
-		},
-		{ header: "MEMORY IN USE" },
-		{
-			header: "MEMORY KILLS",
-			align: "right"
-		}
-	], roles.map((role) => {
-		const pool = pools[role];
-		const cpus = pool.usage?.cpus ?? null;
-		return [
-			role,
-			`${pool.inUse} of ${pool.slots}`,
-			cpus === null ? "-" : cpus.toFixed(2),
-			memoryOf(pool),
-			pool.usage === null ? "-" : String(pool.usage.memoryKills)
-		];
-	})),
-	"",
-	queueOf(pools)
-].join("\n");
+const poolsText = (pools, split) => {
+	const holders = holdersOf(pools);
+	return [
+		enforcementText(pools.enforcement),
+		...pools.agentsSlice == null ? [] : [agentsSliceText(pools.agentsSlice)],
+		...pools.refused == null ? [] : [refusedText(pools.refused)],
+		...pools.layout == null ? [] : layoutTexts(pools.layout, split),
+		renderTable([
+			{ header: "POOL" },
+			{ header: "SLOTS IN USE" },
+			{
+				header: "CPU IN USE",
+				align: "right"
+			},
+			{ header: "MEMORY IN USE" },
+			{
+				header: "MEMORY KILLS",
+				align: "right"
+			}
+		], roles.map((role) => {
+			const pool = pools[role];
+			const cpus = pool.usage?.cpus ?? null;
+			return [
+				role,
+				`${pool.inUse} of ${pool.slots}`,
+				cpus === null ? "-" : cpus.toFixed(2),
+				memoryOf$1(pool),
+				pool.usage === null ? "-" : String(pool.usage.memoryKills)
+			];
+		})),
+		...holders === null ? [] : ["", holders],
+		"",
+		queueOf(pools)
+	].join("\n");
+};
 //#endregion
 //#region src/commands/agents/plan.ts
 const agentPlanOf = (agent) => ({
@@ -4551,8 +4644,36 @@ const agentPlanOf = (agent) => ({
 	prompts: agent.prompts,
 	settings: agent.settings,
 	timezone: agent.timezone,
-	machine: agent.machine
+	machine: {
+		docker: agent.machine.docker,
+		browser: agent.machine.browser,
+		diskGb: agent.machine.diskGb
+	}
 });
+const machineLimitKeys = /* @__PURE__ */ new Set(["cpus", "memoryMb"]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const warnIgnored = ({ context }, keys) => {
+	const named = keys.map((key) => `machine.${key}`).join(" and ");
+	context.terminal.error(context.terminal.errorStyles.warning(`warning ${named} ${keys.length === 1 ? "is" : "are"} ignored: an agent has no limits of its own, and the pools of its node limit its sessions.`));
+};
+const machineWithoutLimits = (run, machine) => {
+	if (!isRecord(machine)) return machine;
+	const ignored = Object.keys(machine).filter((key) => machineLimitKeys.has(key));
+	if (ignored.length === 0) return machine;
+	warnIgnored(run, ignored);
+	return Object.fromEntries(Object.entries(machine).filter(([key]) => !machineLimitKeys.has(key)));
+};
+const agentFileWithoutLimits = (run, document) => isRecord(document) && "machine" in document ? {
+	...document,
+	machine: machineWithoutLimits(run, document.machine)
+} : document;
+const agentChangeWithoutLimits = (run, document) => isRecord(document) && isRecord(document.sections) && "machine" in document.sections ? {
+	...document,
+	sections: {
+		...document.sections,
+		machine: machineWithoutLimits(run, document.sections.machine)
+	}
+} : document;
 //#endregion
 //#region src/commands/agents/config.ts
 const agentsOf = async (scope, project) => {
@@ -4663,7 +4784,7 @@ const configCommands = (adaptersOf) => [
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const file = invocation.values.file;
 			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
-			const agent = await changedAgent(run.api, agentId, await documentOf(run, file));
+			const agent = await changedAgent(run.api, agentId, agentChangeWithoutLimits(run, await documentOf(run, file)));
 			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs kcloud agents update to take the change.` : `Changed ${changed.name}.`);
 		}
 	}),
@@ -4708,6 +4829,15 @@ const admissionRowsOf = (agent) => {
 	const { admission } = agent.runtime;
 	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
 };
+const admissionHoldRowsOf = ({ runtime }) => {
+	const hold = runtime.admissionHold;
+	if (hold == null) return [];
+	if (hold.updating) return [["admissions", `held while the node updates to ${hold.target ?? "-"}`]];
+	const all = hold.pools.includes("monitor");
+	const noun = all ? "session" : "executor session";
+	const waits = `${String(hold.sessions)} ${noun}${hold.sessions === 1 ? "" : "s"}`;
+	return [["admissions", `${all ? "held" : "executor held"} for the node update to ${hold.target ?? "-"}, waiting for ${waits}`]];
+};
 const poolLimitRowsOf = ({ runtime }) => runtime.poolLimit === null ? [] : [["pool limit", poolLimitText(runtime.poolLimit)]];
 const detailsOf = (agent) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
@@ -4720,12 +4850,13 @@ const detailsOf = (agent) => [
 		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
 		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
 		["timezone", agent.timezone],
-		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
+		["disk", `${String(agent.machine.diskGb)} GB`],
 		["docker", agent.machine.docker ? "yes" : "no"],
 		["browser", agent.machine.browser ? "yes" : "no"],
 		["container", agent.runtime.containerId ?? "none"],
 		["health", agent.runtime.health],
 		...admissionRowsOf(agent),
+		...admissionHoldRowsOf(agent),
 		...poolLimitRowsOf(agent),
 		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
 		["actions", agent.availableActions.join(", ")],
@@ -4914,15 +5045,13 @@ const askedPlan = async (run, projectId, values, required) => {
 		timezone: values.timezone ?? localTimezone(),
 		machine: {
 			docker: values.docker,
-			browser: values.browser,
-			cpus: 2,
-			memoryMb: defaultAgentMemoryMb
+			browser: values.browser
 		}
 	};
 };
 const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
 const fileOf = async (run, projectId, { file, node }, required) => {
-	const document = await documentOf(run, file);
+	const document = agentFileWithoutLimits(run, await documentOf(run, file));
 	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
 		...document,
 		nodeId: await placedNodeId(run, {
@@ -5061,30 +5190,29 @@ const lifecycleCommands = (adaptersOf) => agentActions.map((action) => defineCom
 }));
 //#endregion
 //#region src/client/pages.ts
-const windowOf = (limit, all, fallback = 50) => {
+const windowOf = (limit, all, fallback = 50, largest = 200) => {
 	if (limit === void 0) return {
 		limit: fallback,
 		all
 	};
 	const size = Number(limit);
-	if (!/^[0-9]+$/u.test(limit) || size < 1 || size > 200) throw new UsageError(`--limit ${limit} is not a whole number from 1 to 200.`);
+	if (!/^[0-9]+$/u.test(limit) || size < 1 || size > largest) throw new UsageError(`--limit ${limit} is not a whole number from 1 to ${largest}.`);
 	return {
 		limit: size,
 		all
 	};
 };
-const collect = async (page, { limit, all }) => {
-	const first = await page(null, Math.min(limit, 200));
+const collect = async (page, { limit, all }, largest = 200) => {
+	const first = await page(null, Math.min(limit, largest));
 	if (!all) return first;
 	const items = [...first.items];
-	let cursor = first.nextCursor;
-	while (cursor !== null) {
-		const next = await page(cursor, 200);
-		items.push(...next.items);
-		cursor = next.nextCursor;
+	let last = first;
+	while (last.nextCursor !== null) {
+		last = await page(last.nextCursor, largest);
+		items.push(...last.items);
 	}
 	return {
-		...first,
+		...last,
 		items,
 		nextCursor: null
 	};
@@ -5131,6 +5259,43 @@ const transcriptOf = async (api, agentId, sessionId, all) => collect(async (curs
 	limit: 200,
 	all
 });
+const memoryOf = (api, agentId, { query, outcome }, window) => collect(async (cursor, limit) => dataOf("search what the agent remembers", await api.GET("/agents/{id}/memory", { params: {
+	path: { id: agentId },
+	query: {
+		limit,
+		...query === void 0 ? {} : { q: query },
+		...outcome === void 0 ? {} : { outcome },
+		...cursor === null ? {} : { cursor }
+	}
+} }), agentHints), window, 100);
+const memoryReasons = {
+	stopped: "the agent is not running",
+	unreachable: "the agent did not answer on its control socket",
+	timeout: "the agent did not answer in time"
+};
+const unreadReasonOf = (page) => page.staleReason === null ? "the agent did not answer" : memoryReasons[page.staleReason];
+const memoryText = (page) => {
+	const unread = page.source === "unavailable";
+	if (unread && page.items.length === 0) return `The memory cannot be read: ${unreadReasonOf(page)}.`;
+	if (page.items.length === 0) return "The agent remembers nothing that matches.";
+	return [
+		renderTable([
+			{ header: "WHEN" },
+			{ header: "OUTCOME" },
+			{ header: "TASK" },
+			{ header: "TITLE" },
+			{ header: "HEADLINE" }
+		], page.items.map((summary) => [
+			summary.createdAt,
+			summary.ok ? "ok" : "failed",
+			summary.taskId,
+			summary.title,
+			summary.headline
+		])),
+		...unread ? ["", `The rest of the memory cannot be read: ${unreadReasonOf(page)}.`] : [],
+		...page.truncated ? ["", `The agent returns at most 100 summaries, so the list may miss older ones.`] : []
+	].join("\n");
+};
 const observabilityCommands = (adaptersOf) => [
 	defineCommand({
 		name: "sessions",
@@ -5206,7 +5371,9 @@ const observabilityCommands = (adaptersOf) => [
 			const run = await runOf(adaptersOf, invocation);
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const page = await transcriptOf(run.api, agentId, invocation.positionals[1] ?? "", invocation.values.all);
-			return printed(run, page.items, (entries) => entries.length === 0 ? "The session left no transcript." : entries.map((entry) => JSON.stringify(entry)).join("\n"));
+			const code = printed(run, page.items, (entries) => entries.length === 0 ? "The session left no transcript." : entries.map((entry) => JSON.stringify(entry)).join("\n"));
+			if (page.nextCursor !== null && !run.settings.json) run.context.terminal.error("More entries follow; --all prints the whole session.");
+			return code;
 		}
 	}),
 	defineCommand({
@@ -5342,44 +5509,35 @@ const observabilityCommands = (adaptersOf) => [
 	defineCommand({
 		name: "memory",
 		summary: "Search what an agent remembers of its tasks.",
-		usage: "agents memory <agent> [--project <name>] [--query <text>] [--limit <n>]",
+		usage: "agents memory <agent> [--project <name>] [--query <text>] [--outcome <outcome>] [--limit <n>] [--all]",
 		optionsUsage: [
 			...agentUsage,
 			["--query <text>", "only the summaries that match this text"],
-			["--limit <n>", "how many summaries (default: 20)"]
+			["--outcome <outcome>", `only the summaries of one outcome: ${memoryOutcomes.join(", ")}`],
+			["--limit <n>", `how many summaries (default: 20)`],
+			allUsage
 		],
 		options: {
 			...agentOption,
+			...pageOptions,
 			query: { type: "string" },
-			limit: { type: "string" }
+			outcome: { type: "string" }
 		},
 		positionals: {
 			min: 1,
 			max: 1
 		},
 		run: async (invocation) => {
+			const { values } = invocation;
 			const run = await runOf(adaptersOf, invocation);
-			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-			const { limit } = windowOf(invocation.values.limit, false, 20);
-			const search = invocation.values.query;
-			const listed = dataOf("search what the agent remembers", await run.api.GET("/agents/{id}/memory", { params: {
-				path: { id: agentId },
-				query: {
-					limit,
-					...search === void 0 ? {} : { q: search }
-				}
-			} }), agentHints);
-			return printed(run, listed, (shown) => shown.items.length === 0 ? "The agent remembers nothing that matches." : renderTable([
-				{ header: "WHEN" },
-				{ header: "OUTCOME" },
-				{ header: "TITLE" },
-				{ header: "HEADLINE" }
-			], shown.items.map((summary) => [
-				summary.createdAt,
-				summary.ok ? "ok" : "failed",
-				summary.title,
-				summary.headline
-			])));
+			const agentId = await agentFrom(run, invocation.positionals[0], values.project);
+			const outcome = memoryOutcomes.find((candidate) => candidate === values.outcome);
+			if (values.outcome !== void 0 && outcome === void 0) throw new UsageError(`--outcome ${values.outcome} is not an outcome of a summary.`, `The outcomes are ${memoryOutcomes.join(", ")}.`);
+			const page = await memoryOf(run.api, agentId, {
+				query: values.query,
+				outcome
+			}, windowOf(values.limit, values.all, 20, 100));
+			return printed(run, page, memoryText);
 		}
 	})
 ];
@@ -5953,25 +6111,59 @@ const secretUsage = [
 //#region src/commands/credentials.ts
 const projectOption$2 = { project: { type: "string" } };
 const projectUsage$2 = [["--project <name>", "the project the credential belongs to, by slug, name or id"]];
+const usageUnavailable = "Only a Claude Code OAuth token reports the usage of a subscription.";
 const credentialHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"credential.not_found": "kcloud credentials list --project <name> shows them.",
 	"credential.label_taken": "Another credential of the project already has that label.",
-	"credential.in_use": "Point the agents at another credential first."
+	"credential.in_use": "Point the agents at another credential first.",
+	"credential.usage_unavailable": usageUnavailable
+};
+const percent = 100;
+const notApplicable = "-";
+const usedOf = (window) => window === null ? notApplicable : `${String(Math.round(window.utilization * percent))}%`;
+const shareOf = (window) => window?.status === "rejected" ? "limit" : usedOf(window);
+const usageSummaryOf = ({ kind, usage }) => {
+	if (kind !== "claude_oauth_token") return notApplicable;
+	if (usage === null) return "no data";
+	const summary = `5h ${shareOf(usage.fiveHour)} 7d ${shareOf(usage.sevenDay)}`;
+	return usage.stale ? `${summary} (stale)` : summary;
+};
+const usageReportOf = (credential) => {
+	const { usage } = credential;
+	if (usage === null) return `No usage of ${credential.label} was read yet.`;
+	const windows = [["5h", usage.fiveHour], ["7d", usage.sevenDay]];
+	return `${renderTable([
+		{ header: "WINDOW" },
+		{ header: "USED" },
+		{ header: "STATUS" },
+		{ header: "RESETS" }
+	], windows.map(([name, window]) => [
+		name,
+		usedOf(window),
+		window?.status ?? notApplicable,
+		window?.resetsAt ?? notApplicable
+	]))}\n${usage.stale ? `Read at ${usage.readAt}; the latest reading failed.` : `Read at ${usage.readAt}.`}`;
+};
+const isoDateLength = 10;
+const expiryOf = ({ expiresAt, expiresAtComputed }) => {
+	if (expiresAt === null) return "never";
+	return expiresAtComputed ? `about ${expiresAt.slice(0, isoDateLength)}` : expiresAt;
 };
 const projectFrom$2 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
 	return resolveProjectId(run, given);
 };
 const credentialsOf = async (api, projectId) => dataOf("list the credentials of the project", await api.GET("/projects/{id}/credentials", { params: { path: { id: projectId } } }), credentialHints).items;
-const resolveCredentialId = async (api, projectId, reference) => {
+const resolveCredential = async (api, projectId, reference) => {
 	const credentials = await credentialsOf(api, projectId);
 	const found = credentials.filter((credential) => credential.id === reference || credential.label === reference);
 	const [first] = found;
 	if (first === void 0) throw new CliError(`The project has no credential ${reference}.`, credentials.length === 0 ? "kcloud credentials add makes one." : `Its credentials are ${credentials.map(({ label }) => label).join(", ")}.`);
 	if (found.length > 1) throw new CliError(`${reference} names ${found.length} credentials of the project.`, "Name it by its id instead.");
-	return first.id;
+	return first;
 };
+const resolveCredentialId = async (api, projectId, reference) => (await resolveCredential(api, projectId, reference)).id;
 const createCredentialsCommand = (adaptersOf) => defineGroup({
 	name: "credentials",
 	summary: "The Claude and GitHub credentials of a project.",
@@ -5997,13 +6189,15 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 					{ header: "FINGERPRINT" },
 					{ header: "VERIFIED" },
 					{ header: "EXPIRES" },
+					{ header: "USAGE" },
 					{ header: "ID" }
 				], credentials.map((credential) => [
 					credential.label,
 					credential.kind,
 					credential.fingerprint,
 					credential.verification,
-					credential.expiresAt ?? "never",
+					expiryOf(credential),
+					usageSummaryOf(credential),
 					credential.id
 				])));
 			}
@@ -6149,6 +6343,34 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 				return said(run, `The instance is verifying ${credentialId}; kcloud credentials list shows the answer.`);
 			}
 		}),
+		defineCommand({
+			name: "usage",
+			summary: "Show the usage of the Claude subscription behind a Claude Code OAuth token.",
+			usage: "credentials usage <credential> --project <name> [--refresh]",
+			optionsUsage: [...projectUsage$2, ["--refresh", "read it from Anthropic now; within 30 seconds the last reading"]],
+			options: {
+				...projectOption$2,
+				refresh: {
+					type: "boolean",
+					default: false
+				}
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				const stored = await resolveCredential(run.api, projectId, invocation.positionals[0] ?? "");
+				if (stored.kind !== "claude_oauth_token") throw new CliError(`${stored.label} is a ${stored.kind}, which reports no usage.`, usageUnavailable);
+				const credential = invocation.values.refresh ? dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
+					id: projectId,
+					credentialId: stored.id
+				} } }), credentialHints) : stored;
+				return printed(run, credential, usageReportOf);
+			}
+		}),
 		defineCommand({
 			name: "delete",
 			summary: "Delete a credential no agent uses.",
@@ -6534,6 +6756,115 @@ const agentTools = [
 		run: async ({ action, now, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, action === "stop" && now)
 	})
 ];
+const percentOf = (ratio) => ratio === null ? "-" : `${(ratio * 100).toFixed(1)}%`;
+const disksOf = (point) => [
+	point.diskRootUsedRatio,
+	point.diskDataUsedRatio,
+	point.diskAgentsUsedRatio
+].map(percentOf).join(" / ");
+const gpuMemoryOf = ({ gpuMemoryUsedBytesAvg: used, gpuMemoryTotalBytes: total }) => used === null || total === null ? "-" : `${bytesOf(used)} of ${bytesOf(total)}`;
+const gpuOf = (point) => `${percentOf(point.gpuUtilRatioAvg)}, ${gpuMemoryOf(point)}`;
+const readsAGpu = (points) => points.some((point) => point.gpuUtilRatioAvg !== null || point.gpuMemoryTotalBytes !== null);
+const hostText$1 = (points) => {
+	const gpu = readsAGpu(points);
+	return renderTable([
+		{ header: "AT" },
+		{
+			header: "CPU",
+			align: "right"
+		},
+		{
+			header: "MEMORY",
+			align: "right"
+		},
+		{
+			header: "LOAD",
+			align: "right"
+		},
+		{
+			header: "DISKS ROOT / DATA / AGENTS",
+			align: "right"
+		},
+		...gpu ? [{
+			header: "GPU",
+			align: "right"
+		}] : []
+	], points.map((point) => [
+		point.ts,
+		percentOf(point.cpuRatioAvg),
+		`${bytesOf(point.memoryUsedBytesAvg)} of ${bytesOf(point.memoryTotalBytes)}`,
+		point.load1Avg === null ? "-" : point.load1Avg.toFixed(2),
+		disksOf(point),
+		...gpu ? [gpuOf(point)] : []
+	]));
+};
+const byFootprint = (left, right) => right.memoryBytesAvg - left.memoryBytesAvg || left.agentName.localeCompare(right.agentName);
+const agentsText = (agents) => renderTable([
+	{ header: "PROJECT" },
+	{ header: "AGENT" },
+	{
+		header: "CPU (CORES)",
+		align: "right"
+	},
+	{
+		header: "MEMORY AVG",
+		align: "right"
+	},
+	{
+		header: "MEMORY MAX",
+		align: "right"
+	},
+	{
+		header: "NETWORK IN / OUT",
+		align: "right"
+	},
+	{
+		header: "DISK READ / WRITE",
+		align: "right"
+	}
+], agents.toSorted(byFootprint).map((usage) => [
+	usage.projectName,
+	usage.agentName,
+	usage.cpuRatioAvg === null ? "-" : usage.cpuRatioAvg.toFixed(2),
+	bytesOf(usage.memoryBytesAvg),
+	bytesOf(usage.memoryBytesMax),
+	`${bytesOf(usage.networkRxBytes)} / ${bytesOf(usage.networkTxBytes)}`,
+	`${bytesOf(usage.blockReadBytes)} / ${bytesOf(usage.blockWriteBytes)}`
+]));
+const nodeMetricsText = (metrics) => [
+	`${metrics.from} to ${metrics.to}, one point per ${metrics.resolution}.`,
+	"",
+	metrics.points.length === 0 ? "The node sent no sample in that range." : hostText$1(metrics.points),
+	"",
+	metrics.agents.length === 0 ? "No agent you can see ran on the node in that range." : agentsText(metrics.agents)
+].join("\n");
+const rangeOf = (given) => {
+	if (given === void 0) return "1h";
+	const range = metricsRanges.find((candidate) => candidate === given);
+	if (range === void 0) throw new UsageError(`--range ${given} is not a range of metrics.`, `The ranges are ${metricsRanges.join(", ")}.`);
+	return range;
+};
+const createNodeMetricsCommand = (adaptersOf) => defineCommand({
+	name: "metrics",
+	summary: "Show what the host of a node and the agents on it used over a range.",
+	usage: "nodes metrics <node> [--range <range>]",
+	optionsUsage: [
+		...nodeUsage,
+		["--range <range>", `how far back: ${metricsRanges.join(", ")} (default: 1h)`],
+		["", "the agents are those of the projects you belong to, or all for an admin"]
+	],
+	options: { range: { type: "string" } },
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const range = rangeOf(invocation.values.range);
+		const run = await runOf(adaptersOf, invocation);
+		const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+		return printed(run, await nodeMetricsOf(run.api, reference, range), nodeMetricsText);
+	}
+});
 //#endregion
 //#region src/commands/nodes/split.ts
 const splitFields = [
@@ -6589,6 +6920,8 @@ const changeOfParts = ({ reserve, monitor, executor }) => {
 const cpusText = (cpus) => String(Math.round(cpus * 100) / 100);
 const hostText = (host) => `${cpusText(host.cpus)} CPU and ${hostMemoryMbOf(host)} MB`;
 const excessText = ({ cpus, memoryMb }) => [...cpus > 0 ? [`${cpusText(cpus)} CPU`] : [], ...memoryMb > 0 ? [`${memoryMb} MB`] : []].join(" and ");
+const coresText = (count) => count === 1 ? "1 core" : `${String(count)} cores`;
+const coresOfNode = (node) => node.runtime?.pools.layout?.cores ?? null;
 const fittingSplit = (node, change, nameOf) => {
 	const merged = {
 		...node.split === null ? {} : valuesOf(node.split),
@@ -6602,9 +6935,25 @@ const fittingSplit = (node, change, nameOf) => {
 	validated(nodeSplitSchema, split, "a split of a node");
 	if (node.host === null) throw new CliError(`${node.name} has not reported its CPUs and memory yet, so it cannot be split.`, "The node reports them once its service runs; kcloud nodes show <node> shows its state.");
 	if (!splitFits(split, node.host)) throw new CliError(`The split asks for ${excessText(splitOverflowOf(split, node.host))} more than ${node.name} has.`, `${node.name} has ${hostText(node.host)}; shrink a pool or the reserve.`);
+	const cores = coresOfNode(node);
+	const fit = cores === null ? null : splitCoresOf(split, cores);
+	if (fit !== null && !fit.fits) throw new CliError(`The pools take whole cores of ${node.name}: the executor pool would get ${coresText(fit.executor)} and the monitor pool ${coresText(fit.monitor)} of ${String(fit.cores)}, and the reserve keeps at least 1.`, "Shrink a pool, so the reserve keeps the core of processor 0.");
 	return split;
 };
+const processorCountsOf = (node) => {
+	const pools = node.runtime?.pools;
+	if (pools === void 0 || !layoutAppliesSplit(pools.layout, node.split)) return null;
+	const monitor = pools.monitor.usage?.processors ?? null;
+	const executor = pools.executor.usage?.processors ?? null;
+	return monitor === null && executor === null ? null : {
+		monitor,
+		executor
+	};
+};
+const processorsText = (count) => count === 1 ? "1 processor" : `${String(count)} processors`;
+const poolCpusText = (cpus, processors) => processors === null ? cpusText(cpus) : `${cpusText(cpus)} (${processorsText(processors)})`;
 const splitViewOf = (node) => {
+	const cores = coresOfNode(node);
 	const overflow = node.split === null || node.host === null ? null : splitOverflowOf(node.split, node.host);
 	return {
 		id: node.id,
@@ -6615,6 +6964,8 @@ const splitViewOf = (node) => {
 			memoryMb: hostMemoryMbOf(node.host)
 		},
 		split: node.split,
+		processors: processorCountsOf(node),
+		cores: cores === null || node.split === null ? null : splitCoresOf(node.split, cores),
 		free: overflow === null ? null : {
 			cpus: -overflow.cpus,
 			memoryMb: -overflow.memoryMb
@@ -6624,10 +6975,12 @@ const splitViewOf = (node) => {
 const resourceCells = ({ cpus, memoryMb }) => [cpusText(cpus), `${memoryMb} MB`];
 const oneSlotOf = ({ cpus, memoryMb, slots }) => `${cpusText(cpus / slots)} CPU, ${Math.floor(memoryMb / slots)} MB`;
 const hostLineOf = (view) => view.host === null ? `${view.name} has not reported its CPUs and memory yet.` : `The host has ${cpusText(view.host.cpus)} CPU and ${view.host.memoryMb} MB.`;
+const coresLineOf = ({ cores, executor, monitor, fits }) => fits ? `The pools take whole cores: the executor pool ${coresText(executor)} and the monitor pool ${coresText(monitor)}; the reserve keeps ${coresText(cores - executor - monitor)} of ${String(cores)}.` : `The executor pool would take ${coresText(executor)} and the monitor pool ${coresText(monitor)} of ${String(cores)}, so the node runs them on fewer cores and keeps 1 for the reserve.`;
 const splitTableOf = (view, split) => {
 	const poolRow = (role) => [
 		role,
-		...resourceCells(split[role]),
+		poolCpusText(split[role].cpus, view.processors?.[role] ?? null),
+		`${String(split[role].memoryMb)} MB`,
 		String(split[role].slots),
 		oneSlotOf(split[role])
 	];
@@ -6675,7 +7028,8 @@ const splitTableOf = (view, split) => {
 			{ header: "ONE SLOT" }
 		], rows),
 		...view.host === null ? ["", hostLineOf(view)] : [],
-		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`]
+		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`],
+		...view.cores === null ? [] : ["", coresLineOf(view.cores)]
 	].join("\n");
 };
 const splitText = (view) => view.split === null ? [
@@ -6683,10 +7037,14 @@ const splitText = (view) => view.split === null ? [
 	hostLineOf(view),
 	`kcloud nodes split set ${view.name} with every part splits it.`
 ].join("\n") : splitTableOf(view, view.split);
-const splitSummaryOf = (split) => {
+const splitSummaryOf = (split, processors = null) => {
 	if (split === null) return "none, slots counted from the host without hard limits";
 	const { reserve, monitor, executor } = split;
-	const pool = (role, { cpus, memoryMb, slots }) => `${role} ${cpusText(cpus)} CPU, ${memoryMb} MB, ${slots} slots`;
+	const pool = (role, { cpus, memoryMb, slots }) => {
+		const count = processors?.[role] ?? null;
+		const onProcessors = count === null ? "" : ` (${processorsText(count)})`;
+		return `${role} ${cpusText(cpus)} CPU${onProcessors}, ${memoryMb} MB, ${slots} slots`;
+	};
 	return [
 		`reserve ${cpusText(reserve.cpus)} CPU, ${reserve.memoryMb} MB`,
 		pool("monitor", monitor),
@@ -6868,6 +7226,18 @@ const nodeTools = [
 		input: z.object({ node: nodeField }),
 		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
 	}),
+	defineTool({
+		name: "node_metrics",
+		title: "Show what the host of a node and its agents used",
+		description: "Show the CPU, memory, load, disks and GPU of the host of a node over a range, and what each agent on it used over the whole range: the agents of the projects the caller belongs to, or every agent for an admin of the organization.",
+		operations: ["getNodeMetrics"],
+		safety: "read",
+		input: z.object({
+			node: nodeField,
+			range: z.enum(metricsRanges).default("1h")
+		}),
+		run: async ({ node, range }, run) => nodeMetricsOf(run.api, await resolveNode(run, node), range)
+	}),
 	defineTool({
 		name: "node_split_set",
 		title: "Split a node into pools",
@@ -7010,19 +7380,31 @@ const credentialTools = [
 	}),
 	defineTool({
 		name: "credential_update",
-		title: "Rename or verify a credential",
-		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
-		operations: ["renameCredential", "verifyCredential"],
+		title: "Rename, verify or read the usage of a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer; refresh_usage reads the usage of the Claude subscription behind a Claude Code OAuth token now, or answers the last reading within 30 seconds of the previous one.",
+		operations: [
+			"renameCredential",
+			"verifyCredential",
+			"refreshCredentialUsage"
+		],
 		safety: "write",
 		input: z.object({
 			project: projectField,
 			credential: credentialField$1,
-			action: z.enum(["rename", "verify"]),
+			action: z.enum([
+				"rename",
+				"verify",
+				"refresh_usage"
+			]),
 			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
 		}),
 		run: async ({ project, credential, action, label }, run) => {
 			const projectId = await projectIdOf(run, project);
 			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			if (action === "refresh_usage") return dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
+				id: projectId,
+				credentialId
+			} } }), credentialHints);
 			if (action === "verify") {
 				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
 					id: projectId,
@@ -7363,21 +7745,23 @@ const observabilityTools = [
 	defineTool({
 		name: "agent_memory_search",
 		title: "Search the memory of an agent",
-		description: "Search what an agent remembers of the tasks it finished.",
+		description: "Search what an agent remembers of the tasks it finished, newest first, one page or every summary with all.",
 		operations: ["searchAgentMemory"],
 		safety: "read",
 		input: z.object({
 			...agentFields,
 			query: z.string().max(200).optional(),
-			limit: z.int().min(1).max(100).default(20)
+			outcome: memoryOutcomeSchema.optional().describe("Only the summaries of tasks that succeeded or failed."),
+			limit: z.int().min(1).max(100).default(20),
+			all: pageFields.all
 		}),
-		run: async ({ query, limit, ...reference }, run) => dataOf("search what the agent remembers", await run.api.GET("/agents/{id}/memory", { params: {
-			path: { id: await agentIdOf(run, reference) },
-			query: {
-				limit,
-				...query === void 0 ? {} : { q: query }
-			}
-		} }), agentHints)
+		run: async ({ query, outcome, limit, all, ...reference }, run) => memoryOf(run.api, await agentIdOf(run, reference), {
+			query,
+			outcome
+		}, {
+			limit,
+			all
+		})
 	}),
 	defineTool({
 		name: "agent_earlier_output",
@@ -7442,6 +7826,70 @@ const observabilityTools = [
 	})
 ];
 //#endregion
+//#region src/commands/logo.ts
+const logoOptions = {
+	logo: { type: "string" },
+	"no-logo": {
+		type: "boolean",
+		default: false
+	}
+};
+const logoUsage = [["--logo <path>", "show a PNG, JPEG or WebP image instead of the color, at most 512 KB and 2048 px on a side"], ["--no-logo", "remove the logo and show the color again"]];
+const logoHints = {
+	"logo.unreadable": "The file has to be a PNG, JPEG or WebP image.",
+	"logo.too_small": "The image needs at least 64 pixels on each side.",
+	"logo.too_large": "The image may have at most 2048 pixels on a side."
+};
+const startsWith = (bytes, prefix, at = 0) => prefix.every((byte, index) => bytes[at + index] === byte);
+const ascii = (text) => Array.from(text, (letter) => letter.charCodeAt(0));
+const signatures = [
+	{
+		contentType: "image/png",
+		matches: (bytes) => startsWith(bytes, [
+			137,
+			...ascii("PNG\r\n"),
+			26,
+			10
+		])
+	},
+	{
+		contentType: "image/jpeg",
+		matches: (bytes) => startsWith(bytes, [
+			255,
+			216,
+			255
+		])
+	},
+	{
+		contentType: "image/webp",
+		matches: (bytes) => startsWith(bytes, ascii("RIFF")) && startsWith(bytes, ascii("WEBP"), 8)
+	}
+];
+const isLogoChange = (change) => change.logo !== void 0 || change["no-logo"] === true;
+const logoFileOf = async (workingDirectory, file) => {
+	const path = resolve(workingDirectory, file);
+	const bytes = await readFile(path).catch(() => {
+		throw new CliError(`${path} could not be read.`);
+	});
+	if (bytes.byteLength > 524288) throw new UsageError(`${file} holds ${String(Math.ceil(bytes.byteLength / 1024))} KB, and a logo at most ${String(logoMaxBytes / 1024)} KB.`);
+	const contentType = signatures.find(({ matches }) => matches(bytes))?.contentType;
+	if (contentType === void 0) throw new UsageError(`${file} is not a PNG, JPEG or WebP image.`);
+	return {
+		bytes,
+		contentType
+	};
+};
+const logoActionOf = async (workingDirectory, change) => {
+	if (change.logo !== void 0 && change["no-logo"] === true) throw new UsageError("--logo and --no-logo exclude each other.");
+	if (change.logo !== void 0) return logoFileOf(workingDirectory, change.logo);
+	return change["no-logo"] === true ? "remove" : null;
+};
+const logoUpload = ({ bytes, contentType }) => ({
+	body: bytes,
+	bodySerializer: (body) => body,
+	headers: { "content-type": contentType }
+});
+//#endregion
 //#region src/commands/roles.ts
 const roleOption = { role: { type: "string" } };
 const roleUsage = ["--role <role>", "admin or member"];
@@ -7751,6 +8199,48 @@ const costsText = (costs, { from, to }, slugs) => [
 	"",
 	`${costs.totalCostUsd.toFixed(2)} over ${costs.totalRuns} runs and ${costs.sessions} sessions.`
 ].join("\n");
+const organizationChangeHints = {
+	...organizationHints,
+	"organization.slug_taken": "Another organization already uses that slug.",
+	"organization.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"auth.forbidden": "Only an admin of the organization changes it.",
+	...logoHints
+};
+const followSlug = async (homeDirectory, origin, before, after) => {
+	const store = await readInstanceStore(homeDirectory);
+	const stored = store.instances[origin];
+	if (stored?.organization !== before.slug) return;
+	await writeInstanceStore(homeDirectory, withInstance(store, origin, {
+		...stored,
+		organization: after.slug
+	}));
+};
+const updatedOrganization = async (api, current, fields) => {
+	if ([
+		fields.name,
+		fields.slug,
+		fields.color
+	].every((field) => field === void 0)) return current;
+	const body = {
+		name: fields.name ?? current.name,
+		slug: fields.slug ?? current.slug,
+		color: fields.color ?? current.color
+	};
+	validated(updateOrganizationBodySchema, body, "a change to an organization");
+	return dataOf("change the organization", await api.PATCH("/organizations/{organizationId}", {
+		params: { path: { organizationId: current.id } },
+		body
+	}), organizationChangeHints);
+};
+const withLogo = async (api, organization, logo) => {
+	const params = { path: { organizationId: organization.id } };
+	if (logo === null) return organization;
+	if (logo === "remove") return dataOf("remove the logo of the organization", await api.DELETE("/organizations/{organizationId}/logo", { params }), organizationChangeHints);
+	return dataOf("set the logo of the organization", await api.PUT("/organizations/{organizationId}/logo", {
+		params,
+		...logoUpload(logo)
+	}), organizationChangeHints);
+};
 const createOrgsCommand = (adaptersOf) => defineGroup({
 	name: "orgs",
 	summary: "The organizations you can see, and the one kcloud acts in.",
@@ -7835,11 +8325,52 @@ const createOrgsCommand = (adaptersOf) => defineGroup({
 				return printed(run, organization, (shown) => renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 					["name", shown.name],
 					["slug", shown.slug],
+					["color", shown.color],
+					["logo", shown.logoHash ?? "-"],
 					["created", shown.createdAt],
 					["id", shown.id]
 				]));
 			}
 		}),
+		defineCommand({
+			name: "set",
+			summary: "Change the name, slug, color or logo of an organization.",
+			usage: "orgs set [<organization>] [--name <name>] [--slug <slug>] [--color <#rrggbb>] [--logo <path> | --no-logo]",
+			optionsUsage: [
+				["--name <name>", "the new name"],
+				["--slug <slug>", "the new slug; scripts and --org that name the old one stop finding it"],
+				["--color <#rrggbb>", "the color of the organization in the panel"],
+				...logoUsage
+			],
+			options: {
+				name: { type: "string" },
+				slug: { type: "string" },
+				color: { type: "string" },
+				...logoOptions
+			},
+			positionals: {
+				min: 0,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				if ([
+					values.name,
+					values.slug,
+					values.color
+				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("orgs set needs --name, --slug, --color, --logo or --no-logo.");
+				const logo = await logoActionOf(invocation.context.workingDirectory, values);
+				const run = await runOf(adaptersOf, invocation);
+				const current = await organizationOrInUse(run, invocation.positionals[0]);
+				const updated = await updatedOrganization(run.api, current, values);
+				if (updated.slug !== current.slug) {
+					await followSlug(run.context.homeDirectory, run.origin, current, updated);
+					run.context.terminal.error(run.context.terminal.errorStyles.warning(`warning Scripts that pass --org ${current.slug} or set ${organizationVariable}=${current.slug} need ${updated.slug} now.`));
+				}
+				const organization = await withLogo(run.api, updated, logo);
+				return printed(run, organization, (shown) => `Changed ${shown.name} (${shown.slug}).`);
+			}
+		}),
 		defineCommand({
 			name: "costs",
 			summary: "Show what the organization spent, by day and by project.",
@@ -7904,6 +8435,20 @@ const organizationTools = [
 			return dataOf("describe the organization", await run.api.GET("/organizations/{organizationId}", { params: { path: { organizationId: id } } }), organizationHints);
 		}
 	}),
+	defineTool({
+		name: "organization_update",
+		title: "Change an organization",
+		description: "Change the name or color of an organization, by default the one this server acts in. A field left out keeps its value. A new slug is set with kcloud orgs set or in the panel.",
+		operations: ["listOrganizations", "updateOrganization"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			organization: z.string().trim().min(1).optional().describe("The organization, by its slug, its name or its id."),
+			name: organizationNameSchema.optional(),
+			color: colorSchema.optional().describe("The color in the panel, as #rrggbb.")
+		}),
+		run: async ({ organization, ...change }, run) => updatedOrganization(run.api, await organizationOrInUse(run, organization), change)
+	}),
 	defineTool({
 		name: "organization_costs",
 		title: "Show what the organization spent",
@@ -8433,19 +8978,37 @@ const createdProject = async (scope, name, { slug, description, color }) => {
 		organization
 	};
 };
-const changedProject = async (api, id, change) => {
-	const current = await projectOf(api, id);
-	const body = {
-		name: change.name ?? current.name,
-		slug: change.slug ?? current.slug,
-		description: change.description ?? current.description,
-		color: change.color ?? current.color
-	};
-	validated(updateProjectBodySchema, body, "a change to a project");
-	return dataOf("change the project", await api.PATCH("/projects/{id}", {
-		params: { path: { id } },
-		body
-	}), projectHint);
+const logoHint = {
+	...projectHint,
+	...logoHints
+};
+const changedProject = async (api, id, change, logo = null) => {
+	const params = { path: { id } };
+	let project = await projectOf(api, id);
+	if ([
+		change.name,
+		change.slug,
+		change.description,
+		change.color
+	].some((field) => field !== void 0)) {
+		const body = {
+			name: change.name ?? project.name,
+			slug: change.slug ?? project.slug,
+			description: change.description ?? project.description,
+			color: change.color ?? project.color
+		};
+		validated(updateProjectBodySchema, body, "a change to a project");
+		project = dataOf("change the project", await api.PATCH("/projects/{id}", {
+			params,
+			body
+		}), projectHint);
+	}
+	if (logo !== null && logo !== "remove") project = dataOf("set the logo of the project", await api.PUT("/projects/{id}/logo", {
+		params,
+		...logoUpload(logo)
+	}), logoHint);
+	if (logo === "remove") project = dataOf("remove the logo of the project", await api.DELETE("/projects/{id}/logo", { params }), logoHint);
+	return project;
 };
 const deleteProject = async (api, id) => {
 	doneWith("delete the project", await api.DELETE("/projects/{id}", { params: { path: { id } } }), projectHint);
@@ -8504,6 +9067,7 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 					["slug", shown.slug],
 					["description", shown.description === "" ? "-" : shown.description],
 					["color", shown.color],
+					["logo", shown.logoHash ?? "-"],
 					["docker", shown.dockerAllowed ? "allowed" : "not allowed"],
 					["members", String(shown.memberCount)],
 					["created", shown.createdAt],
@@ -8529,12 +9093,17 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "update",
-			summary: "Change the name, slug, description or color of a project.",
-			usage: "projects update <project> [--name <name>] [--slug <slug>] [--description <text>] [--color <#rrggbb>]",
-			optionsUsage: [["--name <name>", "the new name"], ...fieldUsage],
+			summary: "Change the name, slug, description, color or logo of a project.",
+			usage: "projects update <project> [--name <name>] [--slug <slug>] [--description <text>] [--color <#rrggbb>] [--logo <path> | --no-logo]",
+			optionsUsage: [
+				["--name <name>", "the new name"],
+				...fieldUsage,
+				...logoUsage
+			],
 			options: {
 				name: { type: "string" },
-				...fieldOptions
+				...fieldOptions,
+				...logoOptions
 			},
 			positionals: {
 				min: 1,
@@ -8547,10 +9116,11 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 					values.slug,
 					values.description,
 					values.color
-				].every((value) => value === void 0)) throw new UsageError("projects update needs --name, --slug, --description or --color.");
+				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("projects update needs --name, --slug, --description, --color, --logo or --no-logo.");
+				const logo = await logoActionOf(invocation.context.workingDirectory, values);
 				const run = await runOf(adaptersOf, invocation);
 				const id = await resolveProjectId(run, invocation.positionals[0] ?? "");
-				const project = await changedProject(run.api, id, values);
+				const project = await changedProject(run.api, id, values, logo);
 				return printed(run, project, (shown) => `Changed ${shown.name} (${shown.slug}).`);
 			}
 		}),
@@ -9329,20 +9899,31 @@ const operationRowsOf = (operation) => {
 		...error === null ? [] : [["error", error]]
 	];
 };
-const runtimeRowsOf = (runtime) => [
+const lagOf = ({ oldestCursorLagSeconds }) => oldestCursorLagSeconds === null ? "-" : `${oldestCursorLagSeconds} s`;
+const sandboxRowsOf = ({ sandbox }) => sandbox.enabled ? [
+	["sandboxes", `enabled, image ${sandbox.image.tag}`],
+	["agents with docker", String(sandbox.agentsWithSandbox)],
+	["sidecars running", String(sandbox.sidecarsRunning)],
+	["sandbox volumes", sandbox.volumeBytes === null ? "not measured yet" : bytesOf(sandbox.volumeBytes)]
+] : [["sandboxes", "disabled, SANDBOX_ENABLED is off on the node"]];
+const runtimeRowsOf = (runtime, engine) => [
 	["reported", runtime.reportedAt],
 	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
 	["data storage", storageOf(runtime.storage.data)],
 	["engine storage", storageOf(runtime.storage.engine)],
 	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
 	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
-	["log readers", String(runtime.ingest.readers)]
+	["log readers", String(runtime.ingest.readers)],
+	["oldest cursor lag", lagOf(runtime.ingest)],
+	...engine === "native" ? [] : sandboxRowsOf(runtime)
 ];
+const sessionsText = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
+const heldPoolsOf = ({ held = [] }) => held;
 const updateOf = ({ update }) => {
 	if (update === null) return "not reported";
 	switch (update.state) {
 		case "current": return "current";
-		case "waiting": return `waits for ${String(update.sessions)} ${update.sessions === 1 ? "session" : "sessions"} to end before ${update.target ?? "-"}`;
+		case "waiting": return heldPoolsOf(update).includes("monitor") ? `admissions held for ${update.target ?? "-"}, waits for ${sessionsText(update.sessions, "session")}` : `executor admissions held for ${update.target ?? "-"}, waits for ${sessionsText(update.sessions, "executor session")}; monitors go on until the executor pool is empty`;
 		case "updating": return `updating to ${update.target ?? "-"}`;
 		case "failed": return `failed to reach ${update.target ?? "-"}, runs its previous version`;
 		case "unmanaged": return "updated with its platform";
@@ -9368,7 +9949,7 @@ const nodeDetailsText = (node) => [
 		["data root", node.host?.dataRoot ?? "-"],
 		["capabilities", capabilitiesOf(node)],
 		["offers", node.offered.length === 0 ? "-" : node.offered.join(", ")],
-		["split", splitSummaryOf(node.split)],
+		["split", splitSummaryOf(node.split, processorCountsOf(node))],
 		["registration", registrationOf(node)],
 		["connected", node.connectedAt ?? "never"],
 		["last seen", node.lastSeenAt ?? "never"],
@@ -9394,9 +9975,9 @@ const nodeDetailsText = (node) => [
 	])),
 	"",
 	...node.runtime === null ? ["The node has reported no runtime yet."] : [
-		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime)),
+		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime, node.engine)),
 		"",
-		poolsText(node.runtime.pools)
+		poolsText(node.runtime.pools, node.split)
 	]
 ].join("\n");
 const installCommandsOf = (origin) => [
@@ -9523,6 +10104,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
 			}
 		}),
+		createNodeMetricsCommand(adaptersOf),
 		createSplitCommand(adaptersOf),
 		defineCommand({
 			name: "create",