@kvbox/cli 0.5.12 → 0.5.14

package/dist/kvbox.js

@@ -147,7 +147,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command41 } from "commander";
+import { Command as Command48 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -162,10 +162,10 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.12" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.14" : void 0);
 
 // src/commands/vm/index.ts
-import { Command as Command17 } from "commander";
+import { Command as Command24 } from "commander";
 
 // src/commands/vm/connect.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -384,6 +384,30 @@ function parseMib(text) {
 var SizeSchema = z2.enum(SIZE_NAMES);
 var BOX_SSH_USER = "kvbox";
 var BoxStatusSchema = z2.enum(["running", "standby", "hibernated", "stopped", "unknown"]);
+var PortProtoSchema = z2.enum(["tcp", "udp"]);
+var MAX_BOX_PORTS = 16;
+var PortForwardSchema = z2.object({
+  guestPort: z2.number().int().min(1).max(65535),
+  hostPort: z2.number().int(),
+  proto: PortProtoSchema,
+  /** The host's public address; only the control plane fills it in, as for `ssh`. */
+  address: z2.string().optional()
+});
+var PortsRequest = z2.object({
+  ports: z2.array(z2.object({ guestPort: z2.number().int().min(1).max(65535), proto: PortProtoSchema.optional() })).min(1).max(MAX_BOX_PORTS)
+});
+var BoxPortSchema = z2.number().int().min(1).max(65535);
+var ClaimSubdomainRequest = z2.object({ name: z2.string(), port: BoxPortSchema });
+var SubdomainPortRequest = z2.object({ port: BoxPortSchema });
+var SubdomainRouteRequest = z2.object({ name: z2.string(), port: BoxPortSchema });
+var SubdomainSchema = z2.object({
+  owner: z2.string(),
+  box: z2.string(),
+  subdomain: z2.string(),
+  port: BoxPortSchema,
+  url: z2.string(),
+  routes: z2.array(z2.object({ name: z2.string(), port: BoxPortSchema, url: z2.string() }))
+});
 var MachineSchema = z2.object({
   /** Host-unique short id (the tap is `kv-<id>`). Missing only on a box made before ids that has not restarted since. */
   id: z2.string(),
@@ -416,6 +440,8 @@ var MachineSchema = z2.object({
    * whose host reported no port or did not answer.
    */
   ssh: z2.object({ host: z2.string(), port: z2.number().int(), user: z2.string() }).optional(),
+  /** Box ports published on the host (#30). Absent: none. */
+  ports: z2.array(PortForwardSchema).optional(),
   /** Whether the owner slug is a user or an org. Only the control plane knows; it fills it in on `GET /machines`. */
   ownerKind: z2.enum(["user", "org"]).optional(),
   /** Seconds without network traffic before the host hibernates the box (#47). Absent: never. */
@@ -924,6 +950,35 @@ var ServerClient = class {
   setMachine(name, req) {
     return this.call("POST", `/machines/${encodeURIComponent(name)}/set`, MachineSchema, req);
   }
+  /** Publish box ports on the host (#30); the answer is the box with every port it publishes. */
+  addPorts(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);
+  }
+  /** Stop publishing them (#30). */
+  removePorts(name, req) {
+    return this.call("DELETE", `/machines/${encodeURIComponent(name)}/ports`, MachineSchema, req);
+  }
+  /** HTTPS names (#31), the control plane's only: the box's subdomain, claimed for its default port. */
+  claimSubdomain(name, req) {
+    return this.call("PUT", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema, req);
+  }
+  setSubdomainPort(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/subdomain/port`, SubdomainSchema, req);
+  }
+  releaseSubdomain(name) {
+    return this.call("DELETE", `/machines/${encodeURIComponent(name)}/subdomain`, SubdomainSchema);
+  }
+  /** `<route>.<sub>`: a named port under the box's subdomain. */
+  addSubdomainRoute(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/subdomain/routes`, SubdomainSchema, req);
+  }
+  removeSubdomainRoute(name, route) {
+    return this.call("DELETE", `/machines/${encodeURIComponent(name)}/subdomain/routes/${encodeURIComponent(route)}`, SubdomainSchema);
+  }
+  /** Every readable box's subdomain. */
+  listSubdomains() {
+    return this.call("GET", "/subdomains", z3.array(SubdomainSchema));
+  }
   /** A running box's own load, memory and disk, asked of its guest (#67). */
   machineStats(name) {
     return this.call("GET", `/machines/${encodeURIComponent(name)}/stats`, MachineStatsSchema);
@@ -1398,9 +1453,274 @@ var pauseCommand = new Command6("pause").description("freeze a box in place (mem
   }
 });
 
+// src/commands/vm/proxy/index.ts
+import { Command as Command13 } from "commander";
+
+// src/commands/vm/proxy/add.ts
+import { Command as Command7 } from "commander";
+
+// ../shared/src/names.ts
+import { createHmac } from "crypto";
+var LABEL_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
+  "admin",
+  "api",
+  "app",
+  "assets",
+  "auth",
+  "billing",
+  "blog",
+  "cdn",
+  "dashboard",
+  "dev",
+  "docs",
+  "edge",
+  "help",
+  "install",
+  "kvbox",
+  "login",
+  "mail",
+  "relay",
+  "root",
+  "smtp",
+  "static",
+  "status",
+  "support",
+  "www"
+]);
+function subdomainProblem(text) {
+  if (text.length < 3 || text.length > 63) return `"${text}" must be 3 to 63 characters`;
+  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
+  if (RESERVED_SUBDOMAINS.has(text)) return `"${text}" is reserved; pick another name`;
+  return null;
+}
+function routeNameProblem(text) {
+  if (text.length < 1 || text.length > 63) return `"${text}" must be 1 to 63 characters`;
+  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
+  return null;
+}
+function assertSubdomain(text) {
+  const problem = subdomainProblem(text);
+  if (problem) throw new KvboxError(`subdomain ${problem}`);
+  return text;
+}
+function assertRouteName(text) {
+  const problem = routeNameProblem(text);
+  if (problem) throw new KvboxError(`name ${problem}`);
+  return text;
+}
+
+// src/commands/vm/proxy/shared.ts
+var boxOf = (sub, user) => user !== void 0 && sub.owner !== user ? `${sub.owner}/${sub.box}` : sub.box;
+function subdomainJson(sub, user) {
+  return { box: boxOf(sub, user), subdomain: sub.subdomain, port: sub.port, url: sub.url, routes: sub.routes };
+}
+function httpsRowsOf(sub, user) {
+  const box = boxOf(sub, user);
+  return [{ box, guestPort: sub.port, proto: "https", url: sub.url }, ...sub.routes.map((r) => ({ box, guestPort: r.port, proto: "https", url: r.url, name: r.name }))];
+}
+function requireCloud(client) {
+  if (client.target.kind !== "cloud") throw new KvboxError("HTTPS names need the kvbox cloud: kvbox login (this host's own socket has none)");
+}
+function rowsOf(box, user, only) {
+  return (box.ports ?? []).filter(only ?? (() => true)).map((f) => ({ box: displayName(box, user), ...f }));
+}
+function reaches(row, short = false) {
+  if (row.address !== void 0) return `${row.address}:${row.hostPort}`;
+  return short ? `:${row.hostPort}` : `port ${row.hostPort} of this host's public address`;
+}
+function parsePorts(texts) {
+  return texts.map((t) => {
+    const n = Number(t);
+    if (!/^\d+$/.test(t) || n < 1 || n > 65535) throw new KvboxError(`"${t}" is not a port (1-65535)`);
+    return n;
+  });
+}
+async function findBox(client, text) {
+  const found = pickRef(await boxesFor(client, text), text, me(client));
+  if (!found) throw new KvboxError(`box ${text}: not found (kvbox ls)`);
+  return found;
+}
+
+// src/commands/vm/proxy/add.ts
+var addCommand = new Command7("add").description("publish box ports on the internet; each gets a random public port, or an HTTPS name with --name").argument("<box>", "box name").argument("<port...>", "ports inside the box, e.g. 3000 8080").option("--udp", "UDP instead of TCP").option("--name <name>", "serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)").option("--json", "print the new forwards as JSON").action(async (name, portTexts, opts, cmd) => {
+  const guestPorts = parsePorts(portTexts);
+  if (opts.name !== void 0) {
+    assertRouteName(opts.name);
+    if (guestPorts.length !== 1) throw new KvboxError("--name publishes one port: kvbox vm proxy add <box> <port> --name <name>");
+    if (opts.udp) throw new KvboxError("--name serves HTTPS, which is TCP: drop --udp");
+  }
+  const proto = opts.udp ? "udp" : "tcp";
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const user = me(client);
+    if (opts.name !== void 0) requireCloud(client);
+    const found = await findBox(client, name);
+    const box = displayName(found, user);
+    if (opts.name !== void 0) {
+      const route = opts.name;
+      const sub = await spin(`publishing ${guestPorts[0]} on ${name} as ${route}\u2026`, client.addSubdomainRoute(box, { name: route, port: guestPorts[0] }));
+      const url = sub.routes.find((r) => r.name === route).url;
+      if (opts.json) {
+        json({ box, guestPort: guestPorts[0], proto: "https", url, name: route });
+        return;
+      }
+      info(`${color.green("\u2713")} ${color.bold(url)} \u2192 box ${color.bold(box)} port ${guestPorts[0]}`);
+      info("  the first name under a subdomain waits for its certificate, about a minute");
+      if (found.status !== "running") info(`  box ${box} is ${found.status}: the address answers once it runs`);
+      return;
+    }
+    const updated = await spin(`publishing ${guestPorts.join(", ")} on ${name}\u2026`, client.addPorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));
+    const rows = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));
+    if (opts.json) {
+      json(rows);
+      return;
+    }
+    for (const row of rows) info(`${color.green("\u2713")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);
+    if (updated.status !== "running") info(`  box ${name} is ${updated.status}: the ports open when it runs`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/claim.ts
+import { Command as Command8 } from "commander";
+var claimCommand = new Command8("claim").description("give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports").argument("<box>", "box name").argument("<subdomain>", "3-63 lowercase letters, digits and '-'; must be free").requiredOption("--port <port>", "the box port the address serves").option("--json", "print the subdomain as JSON").action(async (name, subdomain, opts, cmd) => {
+  assertSubdomain(subdomain);
+  const [port] = parsePorts([opts.port]);
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    requireCloud(client);
+    const user = me(client);
+    const found = await findBox(client, name);
+    const box = displayName(found, user);
+    const sub = await spin(`claiming ${subdomain}\u2026`, client.claimSubdomain(box, { name: subdomain, port }));
+    if (opts.json) {
+      json(subdomainJson(sub, me(client)));
+      return;
+    }
+    info(`${color.green("\u2713")} ${color.bold(sub.url)} \u2192 box ${color.bold(box)} port ${sub.port}`);
+    info(`  more ports under it: kvbox vm proxy add ${box} <port> --name <name>  \u2192  https://<name>.${sub.url.replace(/^https:\/\//, "")}`);
+    if (found.status !== "running") info(`  box ${box} is ${found.status}: the address answers once it runs`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/ls.ts
+import { Command as Command9 } from "commander";
+async function subdomainsOf(client) {
+  try {
+    return await client.listSubdomains();
+  } catch (err) {
+    warn(`HTTPS names not listed: ${err.message}`);
+    return [];
+  }
+}
+var lsCommand2 = new Command9("ls").description("list the box ports published on the internet").argument("[box]", "only this box").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const user = me(client);
+    const [boxes, subs] = await Promise.all([
+      name === void 0 ? client.listMachines() : findBox(client, name).then((b) => [b]),
+      client.target.kind === "cloud" ? subdomainsOf(client) : []
+    ]);
+    const shown = new Set(boxes.map((b) => displayName(b, user)));
+    const https = subs.flatMap((s) => httpsRowsOf(s, user)).filter((r) => shown.has(r.box));
+    const rows = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);
+    if (opts.json) {
+      json(rows);
+      return;
+    }
+    if (rows.length === 0) {
+      info(name === void 0 ? "no published ports (kvbox vm proxy add <box> <port>)" : `box ${name} publishes no ports (kvbox vm proxy add ${name} <port>)`);
+      return;
+    }
+    table(rows.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === "https" ? r.url : reaches(r, true), proto: r.proto })));
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/release.ts
+import { Command as Command10 } from "commander";
+var releaseCommand = new Command10("release").description("give up a box's HTTPS address and every name under it").argument("<box>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    requireCloud(client);
+    const box = displayName(await findBox(client, name), me(client));
+    if (!await confirm(`Give up box ${box}'s HTTPS address and every name under it? Anyone may claim it after.`, opts.yes ?? false)) {
+      info("cancelled");
+      process.exitCode = 1;
+      return;
+    }
+    const sub = await spin(`releasing ${name}'s address\u2026`, client.releaseSubdomain(box));
+    const names = sub.routes.length === 0 ? "" : ` and ${sub.routes.length} name${sub.routes.length > 1 ? "s" : ""} under it`;
+    info(`${color.green("\u2713")} ${sub.url.replace(/^https:\/\//, "")}${names} no longer reach box ${color.bold(box)}`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/rm.ts
+import { Command as Command11 } from "commander";
+var rmCommand = new Command11("rm").description("stop publishing box ports, or an HTTPS name with --name").argument("<box>", "box name").argument("[port...]", "ports inside the box, as given to add").option("--udp", "the UDP forwards of those ports").option("--name <name>", "the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)").option("-y, --yes", "do not ask for confirmation").action(async (name, portTexts, opts, cmd) => {
+  if (opts.name !== void 0) {
+    assertRouteName(opts.name);
+    if (portTexts.length > 0) throw new KvboxError("--name frees a name, not ports: kvbox vm proxy rm <box> --name <name>");
+  } else if (portTexts.length === 0) {
+    throw new KvboxError("which ports? kvbox vm proxy rm <box> <port...>, or --name <name> for an HTTPS name");
+  }
+  const guestPorts = parsePorts(portTexts);
+  const proto = opts.udp ? "udp" : "tcp";
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    if (opts.name !== void 0) requireCloud(client);
+    const box = displayName(await findBox(client, name), me(client));
+    const question = opts.name !== void 0 ? `Stop serving ${opts.name} under box ${box}'s subdomain?` : `Stop publishing port${guestPorts.length > 1 ? "s" : ""} ${guestPorts.join(", ")} of box ${box}?`;
+    if (!await confirm(question, opts.yes ?? false)) {
+      info("cancelled");
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.name !== void 0) {
+      const sub = await spin(`freeing ${opts.name} on ${name}\u2026`, client.removeSubdomainRoute(box, opts.name));
+      info(`${color.green("\u2713")} ${opts.name}.${sub.url.replace(/^https:\/\//, "")} no longer reaches box ${color.bold(box)}`);
+      return;
+    }
+    await spin(`closing ${guestPorts.join(", ")} on ${name}\u2026`, client.removePorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));
+    info(`${color.green("\u2713")} box ${color.bold(name)} no longer publishes ${guestPorts.join(", ")} (${proto})`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/set-port.ts
+import { Command as Command12 } from "commander";
+var setPortCommand = new Command12("set-port").description("point a box's HTTPS address at another of its ports").argument("<box>", "box name").argument("<port>", "the box port https://<subdomain>.kvbox.app serves from now on").option("--json", "print the subdomain as JSON").action(async (name, portText, opts, cmd) => {
+  const [port] = parsePorts([portText]);
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    requireCloud(client);
+    const box = displayName(await findBox(client, name), me(client));
+    const sub = await spin(`pointing ${name} at port ${port}\u2026`, client.setSubdomainPort(box, { port }));
+    if (opts.json) {
+      json(subdomainJson(sub, me(client)));
+      return;
+    }
+    info(`${color.green("\u2713")} ${color.bold(sub.url)} \u2192 box ${color.bold(box)} port ${sub.port}`);
+  } finally {
+    await client.close();
+  }
+});
+
+// src/commands/vm/proxy/index.ts
+var proxyCommand = new Command13("proxy").description("publish box ports on the internet").addCommand(addCommand).addCommand(lsCommand2).addCommand(rmCommand).addCommand(claimCommand).addCommand(setPortCommand).addCommand(releaseCommand);
+for (const cmd of proxyCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
+
 // src/commands/vm/rescale.ts
-import { Command as Command7, Option as Option2 } from "commander";
-var rescaleCommand = new Command7("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option2("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command14, Option as Option2 } from "commander";
+var rescaleCommand = new Command14("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option2("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const req = {
     ...opts.size !== void 0 ? { size: opts.size } : {},
     ...opts.vcpu !== void 0 ? { vcpu: parseCount(opts.vcpu) } : {},
@@ -1445,8 +1765,8 @@ function parseGib(flag, text) {
 }
 
 // src/commands/vm/resume.ts
-import { Command as Command8 } from "commander";
-var resumeCommand = new Command8("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command15 } from "commander";
+var resumeCommand = new Command15("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`resuming ${name}\u2026`, client.resumeMachine(name));
@@ -1458,8 +1778,8 @@ var resumeCommand = new Command8("resume").description("continue a box that is i
 });
 
 // src/commands/vm/rm.ts
-import { Command as Command9 } from "commander";
-var rmCommand = new Command9("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command16 } from "commander";
+var rmCommand2 = new Command16("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = pickRef(await boxesFor(client, name), name, me(client));
@@ -1478,8 +1798,8 @@ var rmCommand = new Command9("rm").description("destroy a box (its disk is delet
 });
 
 // src/commands/vm/set.ts
-import { Command as Command10 } from "commander";
-var setCommand = new Command10("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command17 } from "commander";
+var setCommand = new Command17("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   if (opts.autoHibernate === void 0) throw new KvboxError("nothing to change: give --auto-hibernate");
   const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);
   const client = await clientFor(cmd.optsWithGlobals());
@@ -1498,8 +1818,8 @@ var setCommand = new Command10("set").description("change a box's settings, e.g.
 });
 
 // src/commands/vm/start.ts
-import { Command as Command11 } from "commander";
-var startCommand = new Command11("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command18 } from "commander";
+var startCommand = new Command18("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`booting ${name}\u2026`, client.startMachine(name));
@@ -1511,8 +1831,8 @@ var startCommand = new Command11("start").description("boot a stopped box again
 });
 
 // src/commands/vm/stop.ts
-import { Command as Command12 } from "commander";
-var stopCommand = new Command12("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command19 } from "commander";
+var stopCommand = new Command19("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`shutting ${name} down\u2026`, client.stopMachine(name));
@@ -1524,8 +1844,8 @@ var stopCommand = new Command12("stop").description("shut a box down (its disk i
 });
 
 // src/commands/vm/top.ts
-import { Command as Command13 } from "commander";
-var topCommand = new Command13("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command20 } from "commander";
+var topCommand = new Command20("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === "running");
@@ -1585,8 +1905,8 @@ function topRows(entries, cloud) {
 }
 
 // src/commands/vm/update.ts
-import { Command as Command14 } from "commander";
-var updateCommand = new Command14("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command21 } from "commander";
+var updateCommand = new Command21("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const before = pickRef(await boxesFor(client, name), name, me(client));
@@ -1608,8 +1928,8 @@ var updateCommand = new Command14("update").description("move a box onto the cur
 });
 
 // src/commands/vm/usage.ts
-import { Command as Command15 } from "commander";
-var usageCommand = new Command15("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+import { Command as Command22 } from "commander";
+var usageCommand = new Command22("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   let since;
   if (opts.since !== void 0) {
     const t = Date.parse(opts.since);
@@ -1656,8 +1976,8 @@ function block(u) {
 }
 
 // src/commands/vm/wake.ts
-import { Command as Command16 } from "commander";
-var wakeCommand = new Command16("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command23 } from "commander";
+var wakeCommand = new Command23("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`waking ${name} (loading its memory from disk)\u2026`, client.wakeMachine(name));
@@ -1669,15 +1989,15 @@ var wakeCommand = new Command16("wake").description("continue a hibernated box w
 });
 
 // src/commands/vm/index.ts
-var vmCommand = new Command17("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(rmCommand);
-for (const cmd of vmCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
-var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand];
+var vmCommand = new Command24("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(proxyCommand).addCommand(rmCommand2);
+for (const cmd of vmCommand.commands) if (cmd !== proxyCommand) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
+var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand2];
 
 // src/commands/server/index.ts
-import { Command as Command25 } from "commander";
+import { Command as Command32 } from "commander";
 
 // src/commands/server/join.ts
-import { Command as Command18 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/server/daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -1731,7 +2051,7 @@ function runKvboxServer(args) {
 }
 
 // src/commands/server/join.ts
-var joinCommand = new Command18("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
+var joinCommand = new Command25("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
   const args = ["join", url, "--token", opts.token];
   if (opts.advertise !== void 0) args.push("--advertise", opts.advertise);
   if (opts.name !== void 0) args.push("--name", opts.name);
@@ -1741,8 +2061,8 @@ var joinCommand = new Command18("join").description("put this machine behind a c
 });
 
 // src/commands/server/leave.ts
-import { Command as Command19 } from "commander";
-var leaveCommand = new Command19("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
+import { Command as Command26 } from "commander";
+var leaveCommand = new Command26("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
   const p = paths();
   for (const line of (await runKvboxServer(["leave"])).split("\n")) info(line);
   if (await runningPid(p) === null) return;
@@ -1751,14 +2071,14 @@ var leaveCommand = new Command19("leave").description("take this machine out fro
 });
 
 // src/commands/server/relay.ts
-import { Command as Command20 } from "commander";
-var relayCommand = new Command20("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
+import { Command as Command27 } from "commander";
+var relayCommand = new Command27("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
   for (const line of (await runKvboxServer(["relay", joinString])).split("\n")) info(line);
 });
 
 // src/commands/server/start.ts
-import { Command as Command21 } from "commander";
-var startCommand2 = new Command21("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
+import { Command as Command28 } from "commander";
+var startCommand2 = new Command28("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false });
   try {
     const health = await client.health();
@@ -1774,8 +2094,8 @@ var startCommand2 = new Command21("start").description("start the local kvbox-se
 });
 
 // src/commands/server/status.ts
-import { Command as Command22 } from "commander";
-var statusCommand = new Command22("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command29 } from "commander";
+var statusCommand = new Command29("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
   try {
     const health = await client.health();
@@ -1807,8 +2127,8 @@ var statusCommand = new Command22("status").description("show whether this machi
 });
 
 // src/commands/server/stop.ts
-import { Command as Command23 } from "commander";
-var stopCommand2 = new Command23("stop").description("stop the local server (running boxes are not affected)").action(async () => {
+import { Command as Command30 } from "commander";
+var stopCommand2 = new Command30("stop").description("stop the local server (running boxes are not affected)").action(async () => {
   const pid = await runningPid(paths());
   if (pid === null) throw new KvboxError("kvbox-server is not running");
   await stopLocalServer(pid);
@@ -1816,8 +2136,8 @@ var stopCommand2 = new Command23("stop").description("stop the local server (run
 });
 
 // src/commands/server/trust-ca.ts
-import { Command as Command24 } from "commander";
-var trustCaCommand = new Command24("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
+import { Command as Command31 } from "commander";
+var trustCaCommand = new Command31("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
   if (publicKey === void 0 && !opts.fromCloud) throw new KvboxError("give the CA public key, or --from-cloud to fetch it from the control plane this host joined");
   if (publicKey !== void 0 && opts.fromCloud) throw new KvboxError("either a public key or --from-cloud, not both");
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
@@ -1855,7 +2175,7 @@ function describeReport(report) {
 }
 
 // src/commands/server/index.ts
-var serverCommand = new Command25("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
+var serverCommand = new Command32("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
 
 // src/commands/login.ts
 import { spawnSync as spawnSync3 } from "child_process";
@@ -1863,8 +2183,8 @@ import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from
 import { hostname as osHostname } from "os";
 import { createInterface } from "readline/promises";
 import { Writable } from "stream";
-import { Command as Command26 } from "commander";
-var loginCommand = new Command26("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
+import { Command as Command33 } from "commander";
+var loginCommand = new Command33("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
   const session = await runLogin(url, creds, paths());
@@ -1962,8 +2282,8 @@ async function firstLine(stream) {
 }
 
 // src/commands/logout.ts
-import { Command as Command27 } from "commander";
-var logoutCommand = new Command27("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
+import { Command as Command34 } from "commander";
+var logoutCommand = new Command34("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
   const p = paths();
   const session = await readSession(p).catch(() => null);
   switch (await runLogout(p)) {
@@ -2000,8 +2320,8 @@ async function runLogout(p = paths()) {
 }
 
 // src/commands/whoami.ts
-import { Command as Command28 } from "commander";
-var whoamiCommand = new Command28("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
+import { Command as Command35 } from "commander";
+var whoamiCommand = new Command35("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
   const session = await readSession();
   if (opts.json) {
     json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);
@@ -2017,11 +2337,11 @@ function describeSession(session) {
 }
 
 // src/commands/snapshots/index.ts
-import { Command as Command32 } from "commander";
+import { Command as Command39 } from "commander";
 
 // src/commands/snapshots/ls.ts
-import { Command as Command29 } from "commander";
-var lsCommand2 = new Command29("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command36 } from "commander";
+var lsCommand3 = new Command36("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const cloud = client.target.kind === "cloud";
@@ -2052,8 +2372,8 @@ var lsCommand2 = new Command29("ls").description("list snapshots (yours and your
 });
 
 // src/commands/snapshots/new.ts
-import { Command as Command30 } from "commander";
-var newCommand2 = new Command30("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
+import { Command as Command37 } from "commander";
+var newCommand2 = new Command37("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)\u2026`, client.createSnapshot({ box, name }));
@@ -2065,8 +2385,8 @@ var newCommand2 = new Command30("new").description("freeze a running box (memory
 });
 
 // src/commands/snapshots/rm.ts
-import { Command as Command31 } from "commander";
-var rmCommand2 = new Command31("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command38 } from "commander";
+var rmCommand3 = new Command38("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   if (!await confirm(`Delete snapshot ${name}?`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2082,14 +2402,14 @@ var rmCommand2 = new Command31("rm").description("delete a snapshot (boxes made
 });
 
 // src/commands/snapshots/index.ts
-var snapshotsCommand = new Command32("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand2).addCommand(rmCommand2);
+var snapshotsCommand = new Command39("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand3).addCommand(rmCommand3);
 for (const cmd of snapshotsCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/org/index.ts
-import { Command as Command38 } from "commander";
+import { Command as Command45 } from "commander";
 
 // src/commands/org/ls.ts
-import { Command as Command33 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/org/context.ts
 var NOT_LOGGED_IN = "orgs live on the control plane: kvbox login first";
@@ -2109,7 +2429,7 @@ function orgFor(opts, target) {
 }
 
 // src/commands/org/ls.ts
-var lsCommand3 = new Command33("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand4 = new Command40("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const orgs = await client.listOrgs();
@@ -2131,8 +2451,8 @@ function orgRows(orgs) {
 }
 
 // src/commands/org/members.ts
-import { Command as Command34, Option as Option3 } from "commander";
-var lsCommand4 = new Command34("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command41, Option as Option3 } from "commander";
+var lsCommand5 = new Command41("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.getOrg(orgFor(opts, client.target));
@@ -2146,7 +2466,7 @@ var lsCommand4 = new Command34("ls").description("list an org's members and thei
     await client.close();
   }
 });
-var addCommand = new Command34("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option3("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
+var addCommand2 = new Command41("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option3("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2156,7 +2476,7 @@ var addCommand = new Command34("add").description("add a user to an org (admins
     await client.close();
   }
 });
-var rmCommand3 = new Command34("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
+var rmCommand4 = new Command41("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2172,11 +2492,11 @@ var rmCommand3 = new Command34("rm").description("remove a member (or leave: rem
     await client.close();
   }
 });
-var membersCommand = new Command34("members").description("who is in an org and what they may do").addCommand(lsCommand4).addCommand(addCommand).addCommand(rmCommand3);
+var membersCommand = new Command41("members").description("who is in an org and what they may do").addCommand(lsCommand5).addCommand(addCommand2).addCommand(rmCommand4);
 
 // src/commands/org/new.ts
-import { Command as Command35 } from "commander";
-var newCommand3 = new Command35("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
+import { Command as Command42 } from "commander";
+var newCommand3 = new Command42("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.createOrg({ slug, name: opts.name ?? slug });
@@ -2192,8 +2512,8 @@ var newCommand3 = new Command35("new").description("create an org; you become it
 });
 
 // src/commands/org/rm.ts
-import { Command as Command36 } from "commander";
-var rmCommand4 = new Command36("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
+import { Command as Command43 } from "commander";
+var rmCommand5 = new Command43("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
   if (!await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2209,8 +2529,8 @@ var rmCommand4 = new Command36("rm").description("delete an org (owners only; re
 });
 
 // src/commands/org/role.ts
-import { Argument, Command as Command37 } from "commander";
-var roleCommand = new Command37("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
+import { Argument, Command as Command44 } from "commander";
+var roleCommand = new Command44("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2222,11 +2542,11 @@ var roleCommand = new Command37("role").description("change a member's role (own
 });
 
 // src/commands/org/index.ts
-var orgCommand = new Command38("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand3).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand4);
+var orgCommand = new Command45("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand4).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand5);
 
 // src/commands/usage.ts
-import { Command as Command39 } from "commander";
-var usageCommand2 = new Command39("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command46 } from "commander";
+var usageCommand2 = new Command46("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   for (const [name, value] of [
     ["since", opts.since],
     ["until", opts.until]
@@ -2299,8 +2619,8 @@ function usageRows(report, cloud) {
 }
 
 // src/commands/credit.ts
-import { Command as Command40 } from "commander";
-var creditCommand = new Command40("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command47 } from "commander";
+var creditCommand = new Command47("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });
   try {
     if (client.target.kind === "local") throw new KvboxError("credit lives on the control plane: kvbox login first");
@@ -2329,7 +2649,7 @@ function creditRow(b, me2) {
 
 // src/program.ts
 function buildProgram() {
-  const program = new Command41("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command48("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);