@kvbox/cli 0.5.10 → 0.5.12

package/dist/kvbox.js

@@ -147,7 +147,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command40 } from "commander";
+import { Command as Command41 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -162,10 +162,10 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.10" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.12" : void 0);
 
 // src/commands/vm/index.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 
 // src/commands/vm/connect.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -529,6 +529,23 @@ var MachineUsageSchema = z2.object({
   estimatedStops: z2.number().int(),
   historyFrom: z2.string().nullable()
 });
+var GuestStatsSchema = z2.object({
+  /** Load average over 1, 5 and 15 minutes. */
+  load: z2.tuple([z2.number(), z2.number(), z2.number()]),
+  cpus: z2.number().int(),
+  memTotalMib: z2.number().int(),
+  /** Total minus available: page cache counts as free. */
+  memUsedMib: z2.number().int(),
+  /** The box's root, which is its overlay disk: the box's own writes, not the shared base. */
+  diskTotalBytes: z2.number().int(),
+  diskUsedBytes: z2.number().int(),
+  uptimeSec: z2.number().int()
+});
+var MachineStatsSchema = z2.object({
+  name: z2.string(),
+  owner: z2.string(),
+  stats: GuestStatsSchema.nullable()
+});
 var UsageStatusSchema = z2.enum([...BoxStatusSchema.options, "removed"]);
 var BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).extend({
   /** The host's box id; a name removed and recreated appears twice, with two ids. */
@@ -803,6 +820,7 @@ async function resolveTarget(opts, p = paths()) {
   }
   return { kind: "local", socketPath: p.serverSock };
 }
+var allQuery = (opts) => opts.all ? "?all=1" : "";
 var ServerClient = class {
   constructor(target, opts = {}) {
     this.target = target;
@@ -869,9 +887,12 @@ var ServerClient = class {
   capacity() {
     return this.call("GET", "/capacity", CapacitySchema);
   }
-  /** Through a control plane: every box the user can see, or the `--org` org's. */
-  listMachines() {
-    return this.call("GET", "/machines", z3.array(MachineSchema));
+  /**
+   * Through a control plane: the user's boxes and their orgs', the `--org` org's, or `org`'s;
+   * `all`: every box on the platform (platform admins only, #78).
+   */
+  listMachines(opts = {}) {
+    return this.call("GET", `/machines${allQuery(opts)}`, z3.array(MachineSchema), void 0, opts.org);
   }
   createMachine(req) {
     return this.call("POST", "/machines", MachineSchema, req);
@@ -903,14 +924,19 @@ var ServerClient = class {
   setMachine(name, req) {
     return this.call("POST", `/machines/${encodeURIComponent(name)}/set`, MachineSchema, req);
   }
+  /** A running box's own load, memory and disk, asked of its guest (#67). */
+  machineStats(name) {
+    return this.call("GET", `/machines/${encodeURIComponent(name)}/stats`, MachineStatsSchema);
+  }
   /** `since`: an ISO date, already validated; the server counts from the box's creation without it. */
   machineUsage(name, since) {
     const query = since === void 0 ? "" : `?since=${encodeURIComponent(since)}`;
     return this.call("GET", `/machines/${encodeURIComponent(name)}/usage${query}`, MachineUsageSchema);
   }
   /** Every box of the caller over the window (#41 on a host, #42 through a control plane); dates as the user wrote them. */
-  usageReport(since, until) {
+  usageReport(since, until, all = false) {
     const q = new URLSearchParams();
+    if (all) q.set("all", "1");
     if (since !== void 0) q.set("since", since);
     if (until !== void 0) q.set("until", until);
     const query = q.size === 0 ? "" : `?${q.toString()}`;
@@ -923,8 +949,9 @@ var ServerClient = class {
   deleteMachine(name) {
     return this.call("DELETE", `/machines/${encodeURIComponent(name)}`, z3.undefined());
   }
-  listSnapshots() {
-    return this.call("GET", "/snapshots", z3.array(SnapshotSchema));
+  /** Like `listMachines`, for snapshots. */
+  listSnapshots(opts = {}) {
+    return this.call("GET", `/snapshots${allQuery(opts)}`, z3.array(SnapshotSchema), void 0, opts.org);
   }
   createSnapshot(req) {
     return this.call("POST", "/snapshots", SnapshotSchema, req);
@@ -1010,6 +1037,11 @@ async function wakeUp(client, box, name) {
       return box;
   }
 }
+function boxesFor(client, text) {
+  const slash = text.indexOf("/");
+  if (slash === -1 || client.target.kind !== "cloud") return client.listMachines();
+  return client.listMachines({ org: text.slice(0, slash).split("@")[0] });
+}
 var me = (client) => client.target.kind === "cloud" ? client.target.user : void 0;
 async function clientFor(opts, client = {}) {
   return new ServerClient(await resolveTarget(opts), client);
@@ -1179,7 +1211,7 @@ var connectCommand = new Command2("connect").alias("cn").description("open a she
   let cert;
   let owner;
   try {
-    let box = pickRef(await client.listMachines(), name, me(client));
+    let box = pickRef(await boxesFor(client, name), name, me(client));
     if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     cert = await ensureCert(client, void 0, void 0, { owner: box.owner });
     owner = box.owner;
@@ -1257,7 +1289,7 @@ var execCommand = new Command3("exec").description("run a command in a box and e
   let cert;
   let owner;
   try {
-    let box = pickRef(await client.listMachines(), name, me(client));
+    let box = pickRef(await boxesFor(client, name), name, me(client));
     if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     if (box.status === "stopped") throw new KvboxError(`box ${name} is stopped (kvbox start ${name})`);
     cert = await ensureCert(client, void 0, void 0, { owner: box.owner });
@@ -1313,7 +1345,7 @@ var hibernateCommand = new Command4("hibernate").description("save a box's memor
 });
 
 // src/commands/vm/ls.ts
-import { Command as Command5, Option as Option2 } from "commander";
+import { Command as Command5 } from "commander";
 function ownerCell(b, me2) {
   const slug = slugOf(b.owner);
   if (slug === me2) return "private";
@@ -1323,10 +1355,10 @@ function addressOf(b) {
   if (b.ssh !== void 0) return `${b.ssh.host}:${b.ssh.port}`;
   return b.ip === "" ? "-" : b.ip;
 }
-var lsCommand = new Command5("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").addOption(new Option2("-a, --all", "kept for older scripts: the listing covers everything you can see anyway").hideHelp()).option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand = new Command5("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
-    const boxes = await client.listMachines();
+    const boxes = await client.listMachines({ all: opts.all });
     if (opts.json) {
       json(boxes);
       return;
@@ -1367,8 +1399,8 @@ var pauseCommand = new Command6("pause").description("freeze a box in place (mem
 });
 
 // src/commands/vm/rescale.ts
-import { Command as Command7, Option as Option3 } from "commander";
-var rescaleCommand = new Command7("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option3("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command7, Option as Option2 } from "commander";
+var rescaleCommand = new Command7("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option2("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const req = {
     ...opts.size !== void 0 ? { size: opts.size } : {},
     ...opts.vcpu !== void 0 ? { vcpu: parseCount(opts.vcpu) } : {},
@@ -1378,7 +1410,7 @@ var rescaleCommand = new Command7("rescale").description("change a box's vCPUs,
   if (Object.keys(req).length === 0) throw new KvboxError("nothing to change: give --size, --vcpu, --mem or --disk");
   const client = await clientFor(cmd.optsWithGlobals());
   try {
-    const before = pickRef(await client.listMachines(), name, me(client));
+    const before = pickRef(await boxesFor(client, name), name, me(client));
     if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     const box = await spin(`rescaling ${name}\u2026`, client.rescaleMachine(displayName(before, me(client)), req));
     if (opts.json) {
@@ -1430,7 +1462,7 @@ import { Command as Command9 } from "commander";
 var rmCommand = new Command9("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
-    const box = pickRef(await client.listMachines(), name, me(client));
+    const box = pickRef(await boxesFor(client, name), name, me(client));
     if (!box) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     const ref = displayName(box, me(client));
     if (!await confirm(`Destroy box ${ref} and its disk?`, opts.yes ?? false)) {
@@ -1452,7 +1484,7 @@ var setCommand = new Command10("set").description("change a box's settings, e.g.
   const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);
   const client = await clientFor(cmd.optsWithGlobals());
   try {
-    const found = pickRef(await client.listMachines(), name, me(client));
+    const found = pickRef(await boxesFor(client, name), name, me(client));
     if (!found) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     const box = await spin(`updating ${name}\u2026`, client.setMachine(displayName(found, me(client)), { autoHibernateSec }));
     if (opts.json) {
@@ -1491,12 +1523,73 @@ var stopCommand = new Command12("stop").description("shut a box down (its disk i
   }
 });
 
-// src/commands/vm/update.ts
+// src/commands/vm/top.ts
 import { Command as Command13 } from "commander";
-var updateCommand = new Command13("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+var topCommand = new Command13("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === "running");
+    const entries = await mapLimit(running, ASK_AT_ONCE, async (b) => {
+      const who = { name: b.name, owner: b.owner, ...b.ownerKind === void 0 ? {} : { ownerKind: b.ownerKind } };
+      try {
+        return { ...who, stats: (await client.machineStats(`${slugOf(b.owner)}/${b.name}`)).stats };
+      } catch (err) {
+        return { ...who, stats: null, error: err.message };
+      }
+    });
+    if (entries.length > 0 && entries.every((e) => e.error !== void 0)) process.exitCode = 1;
+    if (opts.json) {
+      json(entries);
+      return;
+    }
+    if (entries.length === 0) {
+      info("no running boxes");
+      return;
+    }
+    table(topRows(entries, client.target.kind === "cloud" ? { me: client.target.user } : void 0));
+    for (const e of entries) if (e.error !== void 0) info(color.dim(`${e.name}: ${e.error}`));
+    if (entries.some((e) => e.stats === null && e.error === void 0)) {
+      info(color.dim("-: the box's image is older than base v0.7.0; kvbox vm update <box> moves it onto the current one"));
+    }
+  } finally {
+    await client.close();
+  }
+});
+var ASK_AT_ONCE = 8;
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+  return out;
+}
+var pct = (used, total) => total > 0 ? color.dim(` ${Math.round(used / total * 100)}%`) : "";
+function topRows(entries, cloud) {
+  return entries.map((e) => {
+    const s = e.stats;
+    return {
+      ...cloud ? { owner: ownerCell(e, cloud.me) } : {},
+      name: boxName(e.name),
+      load: s ? `${s.load[0].toFixed(2)} ${s.load[1].toFixed(2)} ${color.dim(`/${s.cpus}`)}` : "-",
+      mem: s ? `${gbShort(s.memUsedMib * 1024 ** 2)}/${gbShort(s.memTotalMib * 1024 ** 2)}${pct(s.memUsedMib, s.memTotalMib)}` : "-",
+      disk: s ? `${gbShort(s.diskUsedBytes)}/${gbShort(s.diskTotalBytes)}${pct(s.diskUsedBytes, s.diskTotalBytes)}` : "-",
+      // duration() writes "-" for 0, which here would read as "no numbers".
+      uptime: s ? s.uptimeSec >= 1 ? duration(s.uptimeSec) : "0s" : "-"
+    };
+  });
+}
+
+// src/commands/vm/update.ts
+import { Command as Command14 } from "commander";
+var updateCommand = new Command14("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
-    const before = pickRef(await client.listMachines(), name, me(client));
+    const before = pickRef(await boxesFor(client, name), name, me(client));
     if (!before) throw new KvboxError(`box ${name}: not found (kvbox ls)`);
     const box = await spin(`updating ${name}\u2026`, client.updateMachine(displayName(before, me(client))));
     if (opts.json) {
@@ -1515,8 +1608,8 @@ var updateCommand = new Command13("update").description("move a box onto the cur
 });
 
 // src/commands/vm/usage.ts
-import { Command as Command14 } from "commander";
-var usageCommand = new Command14("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+import { Command as Command15 } from "commander";
+var usageCommand = new Command15("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   let since;
   if (opts.since !== void 0) {
     const t = Date.parse(opts.since);
@@ -1563,8 +1656,8 @@ function block(u) {
 }
 
 // src/commands/vm/wake.ts
-import { Command as Command15 } from "commander";
-var wakeCommand = new Command15("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command16 } from "commander";
+var wakeCommand = new Command16("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`waking ${name} (loading its memory from disk)\u2026`, client.wakeMachine(name));
@@ -1576,15 +1669,15 @@ var wakeCommand = new Command15("wake").description("continue a hibernated box w
 });
 
 // src/commands/vm/index.ts
-var vmCommand = new Command16("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(rmCommand);
+var vmCommand = new Command17("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(rmCommand);
 for (const cmd of vmCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand];
 
 // src/commands/server/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/server/join.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 
 // src/commands/server/daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -1638,7 +1731,7 @@ function runKvboxServer(args) {
 }
 
 // src/commands/server/join.ts
-var joinCommand = new Command17("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
+var joinCommand = new Command18("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
   const args = ["join", url, "--token", opts.token];
   if (opts.advertise !== void 0) args.push("--advertise", opts.advertise);
   if (opts.name !== void 0) args.push("--name", opts.name);
@@ -1648,8 +1741,8 @@ var joinCommand = new Command17("join").description("put this machine behind a c
 });
 
 // src/commands/server/leave.ts
-import { Command as Command18 } from "commander";
-var leaveCommand = new Command18("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
+import { Command as Command19 } from "commander";
+var leaveCommand = new Command19("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
   const p = paths();
   for (const line of (await runKvboxServer(["leave"])).split("\n")) info(line);
   if (await runningPid(p) === null) return;
@@ -1658,14 +1751,14 @@ var leaveCommand = new Command18("leave").description("take this machine out fro
 });
 
 // src/commands/server/relay.ts
-import { Command as Command19 } from "commander";
-var relayCommand = new Command19("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
+import { Command as Command20 } from "commander";
+var relayCommand = new Command20("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
   for (const line of (await runKvboxServer(["relay", joinString])).split("\n")) info(line);
 });
 
 // src/commands/server/start.ts
-import { Command as Command20 } from "commander";
-var startCommand2 = new Command20("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
+import { Command as Command21 } from "commander";
+var startCommand2 = new Command21("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false });
   try {
     const health = await client.health();
@@ -1681,8 +1774,8 @@ var startCommand2 = new Command20("start").description("start the local kvbox-se
 });
 
 // src/commands/server/status.ts
-import { Command as Command21 } from "commander";
-var statusCommand = new Command21("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command22 } from "commander";
+var statusCommand = new Command22("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
   try {
     const health = await client.health();
@@ -1714,8 +1807,8 @@ var statusCommand = new Command21("status").description("show whether this machi
 });
 
 // src/commands/server/stop.ts
-import { Command as Command22 } from "commander";
-var stopCommand2 = new Command22("stop").description("stop the local server (running boxes are not affected)").action(async () => {
+import { Command as Command23 } from "commander";
+var stopCommand2 = new Command23("stop").description("stop the local server (running boxes are not affected)").action(async () => {
   const pid = await runningPid(paths());
   if (pid === null) throw new KvboxError("kvbox-server is not running");
   await stopLocalServer(pid);
@@ -1723,8 +1816,8 @@ var stopCommand2 = new Command22("stop").description("stop the local server (run
 });
 
 // src/commands/server/trust-ca.ts
-import { Command as Command23 } from "commander";
-var trustCaCommand = new Command23("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
+import { Command as Command24 } from "commander";
+var trustCaCommand = new Command24("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
   if (publicKey === void 0 && !opts.fromCloud) throw new KvboxError("give the CA public key, or --from-cloud to fetch it from the control plane this host joined");
   if (publicKey !== void 0 && opts.fromCloud) throw new KvboxError("either a public key or --from-cloud, not both");
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
@@ -1762,7 +1855,7 @@ function describeReport(report) {
 }
 
 // src/commands/server/index.ts
-var serverCommand = new Command24("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
+var serverCommand = new Command25("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
 
 // src/commands/login.ts
 import { spawnSync as spawnSync3 } from "child_process";
@@ -1770,8 +1863,8 @@ import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from
 import { hostname as osHostname } from "os";
 import { createInterface } from "readline/promises";
 import { Writable } from "stream";
-import { Command as Command25 } from "commander";
-var loginCommand = new Command25("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
+import { Command as Command26 } from "commander";
+var loginCommand = new Command26("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
   const session = await runLogin(url, creds, paths());
@@ -1869,8 +1962,8 @@ async function firstLine(stream) {
 }
 
 // src/commands/logout.ts
-import { Command as Command26 } from "commander";
-var logoutCommand = new Command26("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
+import { Command as Command27 } from "commander";
+var logoutCommand = new Command27("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
   const p = paths();
   const session = await readSession(p).catch(() => null);
   switch (await runLogout(p)) {
@@ -1907,8 +2000,8 @@ async function runLogout(p = paths()) {
 }
 
 // src/commands/whoami.ts
-import { Command as Command27 } from "commander";
-var whoamiCommand = new Command27("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
+import { Command as Command28 } from "commander";
+var whoamiCommand = new Command28("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
   const session = await readSession();
   if (opts.json) {
     json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);
@@ -1924,15 +2017,15 @@ function describeSession(session) {
 }
 
 // src/commands/snapshots/index.ts
-import { Command as Command31 } from "commander";
+import { Command as Command32 } from "commander";
 
 // src/commands/snapshots/ls.ts
-import { Command as Command28, Option as Option4 } from "commander";
-var lsCommand2 = new Command28("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").addOption(new Option4("-a, --all", "kept for older scripts: the listing covers everything you can see anyway").hideHelp()).option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command29 } from "commander";
+var lsCommand2 = new Command29("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const cloud = client.target.kind === "cloud";
-    const snaps = await client.listSnapshots();
+    const snaps = await client.listSnapshots({ all: opts.all });
     if (opts.json) {
       json(snaps);
       return;
@@ -1959,8 +2052,8 @@ var lsCommand2 = new Command28("ls").description("list snapshots (yours and your
 });
 
 // src/commands/snapshots/new.ts
-import { Command as Command29 } from "commander";
-var newCommand2 = new Command29("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
+import { Command as Command30 } from "commander";
+var newCommand2 = new Command30("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)\u2026`, client.createSnapshot({ box, name }));
@@ -1972,8 +2065,8 @@ var newCommand2 = new Command29("new").description("freeze a running box (memory
 });
 
 // src/commands/snapshots/rm.ts
-import { Command as Command30 } from "commander";
-var rmCommand2 = new Command30("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command31 } from "commander";
+var rmCommand2 = new Command31("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   if (!await confirm(`Delete snapshot ${name}?`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -1989,14 +2082,14 @@ var rmCommand2 = new Command30("rm").description("delete a snapshot (boxes made
 });
 
 // src/commands/snapshots/index.ts
-var snapshotsCommand = new Command31("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand2).addCommand(rmCommand2);
+var snapshotsCommand = new Command32("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand2).addCommand(rmCommand2);
 for (const cmd of snapshotsCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/org/index.ts
-import { Command as Command37 } from "commander";
+import { Command as Command38 } from "commander";
 
 // src/commands/org/ls.ts
-import { Command as Command32 } from "commander";
+import { Command as Command33 } from "commander";
 
 // src/commands/org/context.ts
 var NOT_LOGGED_IN = "orgs live on the control plane: kvbox login first";
@@ -2016,7 +2109,7 @@ function orgFor(opts, target) {
 }
 
 // src/commands/org/ls.ts
-var lsCommand3 = new Command32("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand3 = new Command33("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const orgs = await client.listOrgs();
@@ -2038,8 +2131,8 @@ function orgRows(orgs) {
 }
 
 // src/commands/org/members.ts
-import { Command as Command33, Option as Option5 } from "commander";
-var lsCommand4 = new Command33("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command34, Option as Option3 } from "commander";
+var lsCommand4 = new Command34("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.getOrg(orgFor(opts, client.target));
@@ -2053,7 +2146,7 @@ var lsCommand4 = new Command33("ls").description("list an org's members and thei
     await client.close();
   }
 });
-var addCommand = new Command33("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option5("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
+var addCommand = new Command34("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option3("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2063,7 +2156,7 @@ var addCommand = new Command33("add").description("add a user to an org (admins
     await client.close();
   }
 });
-var rmCommand3 = new Command33("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
+var rmCommand3 = new Command34("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2079,11 +2172,11 @@ var rmCommand3 = new Command33("rm").description("remove a member (or leave: rem
     await client.close();
   }
 });
-var membersCommand = new Command33("members").description("who is in an org and what they may do").addCommand(lsCommand4).addCommand(addCommand).addCommand(rmCommand3);
+var membersCommand = new Command34("members").description("who is in an org and what they may do").addCommand(lsCommand4).addCommand(addCommand).addCommand(rmCommand3);
 
 // src/commands/org/new.ts
-import { Command as Command34 } from "commander";
-var newCommand3 = new Command34("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
+import { Command as Command35 } from "commander";
+var newCommand3 = new Command35("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.createOrg({ slug, name: opts.name ?? slug });
@@ -2099,8 +2192,8 @@ var newCommand3 = new Command34("new").description("create an org; you become it
 });
 
 // src/commands/org/rm.ts
-import { Command as Command35 } from "commander";
-var rmCommand4 = new Command35("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
+import { Command as Command36 } from "commander";
+var rmCommand4 = new Command36("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
   if (!await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2116,8 +2209,8 @@ var rmCommand4 = new Command35("rm").description("delete an org (owners only; re
 });
 
 // src/commands/org/role.ts
-import { Argument, Command as Command36 } from "commander";
-var roleCommand = new Command36("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
+import { Argument, Command as Command37 } from "commander";
+var roleCommand = new Command37("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2129,11 +2222,11 @@ var roleCommand = new Command36("role").description("change a member's role (own
 });
 
 // src/commands/org/index.ts
-var orgCommand = new Command37("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand3).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand4);
+var orgCommand = new Command38("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand3).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand4);
 
 // src/commands/usage.ts
-import { Command as Command38 } from "commander";
-var usageCommand2 = new Command38("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command39 } from "commander";
+var usageCommand2 = new Command39("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   for (const [name, value] of [
     ["since", opts.since],
     ["until", opts.until]
@@ -2143,7 +2236,7 @@ var usageCommand2 = new Command38("usage").description("what your boxes used thi
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     if (client.target.kind === "local" && cmd.optsWithGlobals().org) throw new KvboxError("--org needs a control plane: kvbox login, or drop --org");
-    const report = await client.usageReport(opts.since, opts.until);
+    const report = await client.usageReport(opts.since, opts.until, opts.all);
     if (opts.json) {
       json(report);
       return;
@@ -2206,8 +2299,8 @@ function usageRows(report, cloud) {
 }
 
 // src/commands/credit.ts
-import { Command as Command39 } from "commander";
-var creditCommand = new Command39("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command40 } from "commander";
+var creditCommand = new Command40("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });
   try {
     if (client.target.kind === "local") throw new KvboxError("credit lives on the control plane: kvbox login first");
@@ -2236,7 +2329,7 @@ function creditRow(b, me2) {
 
 // src/program.ts
 function buildProgram() {
-  const program = new Command40("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command41("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);