@kvbox/cli 0.5.17 → 0.5.19

package/dist/kvbox.js

@@ -10,8 +10,10 @@ var KvboxError = class extends Error {
   exitCode;
 };
 var AmbiguousRefError = class extends KvboxError {
-  constructor(kind, name, slugs) {
-    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(", ")} and ${slugs.at(-1)}; say which with --org ${slugs[0]} or ${slugs[0]}/${name}`, 1);
+  /** `orgFlag` false: `--org` names something else on this command (a fork's target), so only `slug/name` is offered. */
+  constructor(kind, name, slugs, orgFlag = true) {
+    const way = orgFlag ? `--org ${slugs[0]} or ${slugs[0]}/${name}` : `${slugs[0]}/${name}`;
+    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(", ")} and ${slugs.at(-1)}; say which with ${way}`, 1);
     this.name = "AmbiguousRefError";
   }
 };
@@ -147,7 +149,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command48 } from "commander";
+import { Command as Command49 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -162,10 +164,10 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.17" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.19" : void 0);
 
 // src/commands/vm/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/vm/connect.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -230,6 +232,8 @@ function paths(home = kvboxHome()) {
          * The next snapshot is a diff of the pages dirtied since, merged onto this. Absent after a boot.
          */
         memBase: join(dir, "mem.base"),
+        /** `kvbox vm fork` (#79): the source's VM state, captured here and gone once the box runs. Its memory is `memBase`. */
+        forkVmstate: join(dir, "fork.vmstate"),
         /** `kvbox hibernate`: the box's memory image and VM state while it is hibernated; gone again after `wake` or `stop`. */
         hibernateDir: join(dir, "hibernate"),
         hibernateVmstate: join(dir, "hibernate", "vmstate"),
@@ -427,7 +431,7 @@ var MachineSchema = z2.object({
   // base image version the box's overlay stacks on
   createdAt: z2.string(),
   source: z2.string(),
-  // "base" or "snapshot:<name>"
+  // "base", "snapshot:<owner/name>" or "fork:<owner/name>" (#79)
   status: BoxStatusSchema,
   /**
    * Public TCP port on the host that reaches the box's SSH while it runs (#49). Only boxes made
@@ -463,6 +467,20 @@ var CreateMachineRequest = z2.object({
   /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */
   autoHibernateSec: z2.number().int().min(0).optional()
 });
+var ForkMachineRequest = z2.object({
+  name: z2.string().optional(),
+  /**
+   * The new box's slug, bare (`acme`): the control plane sends the target of `--org` here; the host
+   * qualifies it with the caller's realm. Absent: the source's owner. A CLI leaves it out.
+   */
+  owner: z2.string().optional(),
+  /** A cold fork only: a warm one keeps the source's vCPU and memory. */
+  size: SizeSchema.optional(),
+  force: z2.boolean().optional(),
+  /** As in CreateMachineRequest: the control plane's CA line for the new box's owner. */
+  sshKeys: z2.array(z2.string()).optional(),
+  autoHibernateSec: z2.number().int().min(0).optional()
+});
 var SetSshKeysRequest = z2.object({
   sshKeys: z2.array(z2.string())
 });
@@ -578,7 +596,12 @@ var BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).ext
   id: z2.string(),
   status: UsageStatusSchema,
   /** Through a control plane: whether the owner slug is a user's or an org's (what `kvbox ls` shows). */
-  ownerKind: z2.enum(["user", "org"]).optional()
+  ownerKind: z2.enum(["user", "org"]).optional(),
+  /**
+   * Through a control plane: the username that made the box (#60), absent when the box is gone from
+   * the index (removed), was found by reconcile, or its maker was deleted. The ledger does not record it.
+   */
+  createdBy: z2.string().optional()
 });
 var UsageReportSchema = z2.object({
   window: z2.object({ from: z2.string(), to: z2.string() }),
@@ -923,6 +946,10 @@ var ServerClient = class {
   createMachine(req) {
     return this.call("POST", "/machines", MachineSchema, req);
   }
+  /** `kvbox vm fork` (#79): `name` is the source; the copy goes to the `--org` slug, else the caller's own. */
+  forkMachine(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/fork`, MachineSchema, req);
+  }
   stopMachine(name) {
     return this.call("POST", `/machines/${encodeURIComponent(name)}/stop`, MachineSchema);
   }
@@ -1242,7 +1269,7 @@ function displayName(box, user) {
   return user !== void 0 && slugOf(box.owner) !== user ? `${slugOf(box.owner)}/${box.name}` : box.name;
 }
 function describe(box, user) {
-  const from = box.source.startsWith("snapshot:") ? ` from snapshot ${shortRef(box.source.slice("snapshot:".length), box.owner)}` : "";
+  const from = box.source.startsWith("snapshot:") ? ` from snapshot ${shortRef(box.source.slice("snapshot:".length), box.owner)}` : box.source.startsWith("fork:") ? `, a fork of ${shortRef(box.source.slice("fork:".length), box.owner)}` : "";
   return `box ${color.bold(displayName(box, user))} is ${box.status} at ${box.ip}${from}: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`;
 }
 function autoHibernateText(sec) {
@@ -1386,9 +1413,36 @@ var execCommand = new Command3("exec").description("run a command in a box and e
   process.exit(status2);
 });
 
+// src/commands/vm/fork.ts
+import { Command as Command4, Option as Option2 } from "commander";
+var forkCommand = new Command4("fork").description("copy a box, running or stopped, into a new one on the same host (--org: into an org)").argument("<box>", "the box to copy").argument("[name]", "the copy's name (box1, box2, \u2026 when omitted)").addOption(new Option2("-s, --size <size>", "the copy's size, for a stopped box only (default: the box's)").choices(SIZE_NAMES)).option("--auto-hibernate <duration>", "hibernate the copy after this long without network traffic (30m, 4h, 1d; off: never; default: the box's)").option("--force", "skip the capacity guard").option("--json", "print the new box as JSON").action(async (source, name, opts, cmd) => {
+  const autoHibernateSec = opts.autoHibernate === void 0 ? void 0 : parseIdleTimeout(opts.autoHibernate);
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const box = await spin(`forking ${source}\u2026`, client.forkMachine(source, {
+      ...name !== void 0 ? { name } : {},
+      ...opts.size !== void 0 ? { size: opts.size } : {},
+      ...autoHibernateSec !== void 0 ? { autoHibernateSec } : {},
+      ...opts.force ? { force: true } : {}
+    }));
+    if (opts.json) {
+      json(box);
+      return;
+    }
+    const user = me(client);
+    process.stdout.write(`${box.name}
+`);
+    info(`${color.green("\u2713")} ${describe(box, user)}`);
+    info(`  connect with: kvbox connect ${displayName(box, user)}`);
+    info(`  it ${autoHibernateText(box.autoHibernateSec)}; published ports and HTTPS names stay with ${source}`);
+  } finally {
+    await client.close();
+  }
+});
+
 // src/commands/vm/hibernate.ts
-import { Command as Command4 } from "commander";
-var hibernateCommand = new Command4("hibernate").description("save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command5 } from "commander";
+var hibernateCommand = new Command5("hibernate").description("save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`hibernating ${name} (saving its memory to disk)\u2026`, client.hibernateMachine(name));
@@ -1400,7 +1454,7 @@ var hibernateCommand = new Command4("hibernate").description("save a box's memor
 });
 
 // src/commands/vm/ls.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 function ownerCell(b, me2) {
   const slug = slugOf(b.owner);
   if (slug === me2) return "private";
@@ -1410,7 +1464,7 @@ function addressOf(b) {
   if (b.ssh !== void 0) return b.ssh.host;
   return b.ip === "" ? "-" : b.ip;
 }
-var lsCommand = new Command5("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand = new Command6("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const boxes = await spin("listing boxes\u2026", client.listMachines({ all: opts.all }));
@@ -1441,8 +1495,8 @@ function lsRows(boxes, cloud) {
 }
 
 // src/commands/vm/pause.ts
-import { Command as Command6 } from "commander";
-var pauseCommand = new Command6("pause").description("freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command7 } from "commander";
+var pauseCommand = new Command7("pause").description("freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`pausing ${name}\u2026`, client.pauseMachine(name));
@@ -1454,7 +1508,7 @@ var pauseCommand = new Command6("pause").description("freeze a box in place (mem
 });
 
 // src/commands/vm/proxy/claim.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 
 // ../shared/src/names.ts
 import { createHmac } from "crypto";
@@ -1540,7 +1594,7 @@ async function findBox(client, text) {
 }
 
 // src/commands/vm/proxy/claim.ts
-var claimCommand = new Command7("claim").description("give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports").argument("<box>", "box name").argument("<subdomain>", "3-63 lowercase letters, digits and '-'; must be free").requiredOption("--port <port>", "the box port the address serves").option("--json", "print the subdomain as JSON").action(async (name, subdomain, opts, cmd) => {
+var claimCommand = new Command8("claim").description("give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports").argument("<box>", "box name").argument("<subdomain>", "3-63 lowercase letters, digits and '-'; must be free").requiredOption("--port <port>", "the box port the address serves").option("--json", "print the subdomain as JSON").action(async (name, subdomain, opts, cmd) => {
   assertSubdomain(subdomain);
   const [port] = parsePorts([opts.port]);
   const client = await clientFor(cmd.optsWithGlobals());
@@ -1563,11 +1617,11 @@ var claimCommand = new Command7("claim").description("give a box its HTTPS addre
 });
 
 // src/commands/vm/proxy/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/vm/proxy/add.ts
-import { Command as Command8 } from "commander";
-var addCommand = new Command8("add").description("publish box ports on the internet; each gets a random public port, or an HTTPS name with --name").argument("<box>", "box name").argument("<port...>", "ports inside the box, e.g. 3000 8080").option("--udp", "UDP instead of TCP").option("--name <name>", "serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)").option("--json", "print the new forwards as JSON").action(async (name, portTexts, opts, cmd) => {
+import { Command as Command9 } from "commander";
+var addCommand = new Command9("add").description("publish box ports on the internet; each gets a random public port, or an HTTPS name with --name").argument("<box>", "box name").argument("<port...>", "ports inside the box, e.g. 3000 8080").option("--udp", "UDP instead of TCP").option("--name <name>", "serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)").option("--json", "print the new forwards as JSON").action(async (name, portTexts, opts, cmd) => {
   const guestPorts = parsePorts(portTexts);
   if (opts.name !== void 0) {
     assertRouteName(opts.name);
@@ -1608,7 +1662,7 @@ var addCommand = new Command8("add").description("publish box ports on the inter
 });
 
 // src/commands/vm/proxy/ls.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 async function subdomainsOf(client) {
   try {
     return await client.listSubdomains();
@@ -1617,7 +1671,7 @@ async function subdomainsOf(client) {
     return [];
   }
 }
-var lsCommand2 = new Command9("ls").description("list the box ports published on the internet").argument("[box]", "only this box").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+var lsCommand2 = new Command10("ls").description("list the box ports published on the internet").argument("[box]", "only this box").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const user = me(client);
@@ -1643,8 +1697,8 @@ var lsCommand2 = new Command9("ls").description("list the box ports published on
 });
 
 // src/commands/vm/proxy/release.ts
-import { Command as Command10 } from "commander";
-var releaseCommand = new Command10("release").description("give up a box's HTTPS address and every name under it").argument("<box>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command11 } from "commander";
+var releaseCommand = new Command11("release").description("give up a box's HTTPS address and every name under it").argument("<box>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     requireCloud(client);
@@ -1663,8 +1717,8 @@ var releaseCommand = new Command10("release").description("give up a box's HTTPS
 });
 
 // src/commands/vm/proxy/rm.ts
-import { Command as Command11 } from "commander";
-var rmCommand = new Command11("rm").description("stop publishing box ports, or an HTTPS name with --name").argument("<box>", "box name").argument("[port...]", "ports inside the box, as given to add").option("--udp", "the UDP forwards of those ports").option("--name <name>", "the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)").option("-y, --yes", "do not ask for confirmation").action(async (name, portTexts, opts, cmd) => {
+import { Command as Command12 } from "commander";
+var rmCommand = new Command12("rm").description("stop publishing box ports, or an HTTPS name with --name").argument("<box>", "box name").argument("[port...]", "ports inside the box, as given to add").option("--udp", "the UDP forwards of those ports").option("--name <name>", "the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)").option("-y, --yes", "do not ask for confirmation").action(async (name, portTexts, opts, cmd) => {
   if (opts.name !== void 0) {
     assertRouteName(opts.name);
     if (portTexts.length > 0) throw new KvboxError("--name frees a name, not ports: kvbox vm proxy rm <box> --name <name>");
@@ -1696,8 +1750,8 @@ var rmCommand = new Command11("rm").description("stop publishing box ports, or a
 });
 
 // src/commands/vm/proxy/set-port.ts
-import { Command as Command12 } from "commander";
-var setPortCommand = new Command12("set-port").description("point a box's HTTPS address at another of its ports").argument("<box>", "box name").argument("<port>", "the box port https://<subdomain>.kvbox.app serves from now on").option("--json", "print the subdomain as JSON").action(async (name, portText, opts, cmd) => {
+import { Command as Command13 } from "commander";
+var setPortCommand = new Command13("set-port").description("point a box's HTTPS address at another of its ports").argument("<box>", "box name").argument("<port>", "the box port https://<subdomain>.kvbox.app serves from now on").option("--json", "print the subdomain as JSON").action(async (name, portText, opts, cmd) => {
   const [port] = parsePorts([portText]);
   const client = await clientFor(cmd.optsWithGlobals());
   try {
@@ -1715,12 +1769,12 @@ var setPortCommand = new Command12("set-port").description("point a box's HTTPS
 });
 
 // src/commands/vm/proxy/index.ts
-var proxyCommand = new Command13("proxy").description("publish box ports on the internet").addCommand(addCommand).addCommand(lsCommand2).addCommand(rmCommand).addCommand(claimCommand).addCommand(setPortCommand).addCommand(releaseCommand);
+var proxyCommand = new Command14("proxy").description("publish box ports on the internet").addCommand(addCommand).addCommand(lsCommand2).addCommand(rmCommand).addCommand(claimCommand).addCommand(setPortCommand).addCommand(releaseCommand);
 for (const cmd of proxyCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/vm/rescale.ts
-import { Command as Command14, Option as Option2 } from "commander";
-var rescaleCommand = new Command14("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option2("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command15, Option as Option3 } from "commander";
+var rescaleCommand = new Command15("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option3("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const req = {
     ...opts.size !== void 0 ? { size: opts.size } : {},
     ...opts.vcpu !== void 0 ? { vcpu: parseCount(opts.vcpu) } : {},
@@ -1765,8 +1819,8 @@ function parseGib(flag, text) {
 }
 
 // src/commands/vm/resume.ts
-import { Command as Command15 } from "commander";
-var resumeCommand = new Command15("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command16 } from "commander";
+var resumeCommand = new Command16("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`resuming ${name}\u2026`, client.resumeMachine(name));
@@ -1778,8 +1832,8 @@ var resumeCommand = new Command15("resume").description("continue a box that is
 });
 
 // src/commands/vm/rm.ts
-import { Command as Command16 } from "commander";
-var rmCommand2 = new Command16("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command17 } from "commander";
+var rmCommand2 = new Command17("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = pickRef(await boxesFor(client, name), name, me(client));
@@ -1798,8 +1852,8 @@ var rmCommand2 = new Command16("rm").description("destroy a box (its disk is del
 });
 
 // src/commands/vm/set.ts
-import { Command as Command17 } from "commander";
-var setCommand = new Command17("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command18 } from "commander";
+var setCommand = new Command18("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   if (opts.autoHibernate === void 0) throw new KvboxError("nothing to change: give --auto-hibernate");
   const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);
   const client = await clientFor(cmd.optsWithGlobals());
@@ -1818,8 +1872,8 @@ var setCommand = new Command17("set").description("change a box's settings, e.g.
 });
 
 // src/commands/vm/start.ts
-import { Command as Command18 } from "commander";
-var startCommand = new Command18("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command19 } from "commander";
+var startCommand = new Command19("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`booting ${name}\u2026`, client.startMachine(name));
@@ -1831,8 +1885,8 @@ var startCommand = new Command18("start").description("boot a stopped box again
 });
 
 // src/commands/vm/stop.ts
-import { Command as Command19 } from "commander";
-var stopCommand = new Command19("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command20 } from "commander";
+var stopCommand = new Command20("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`shutting ${name} down\u2026`, client.stopMachine(name));
@@ -1844,8 +1898,8 @@ var stopCommand = new Command19("stop").description("shut a box down (its disk i
 });
 
 // src/commands/vm/top.ts
-import { Command as Command20 } from "commander";
-var topCommand = new Command20("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command21 } from "commander";
+var topCommand = new Command21("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === "running");
@@ -1905,8 +1959,8 @@ function topRows(entries, cloud) {
 }
 
 // src/commands/vm/update.ts
-import { Command as Command21 } from "commander";
-var updateCommand = new Command21("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command22 } from "commander";
+var updateCommand = new Command22("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const before = pickRef(await boxesFor(client, name), name, me(client));
@@ -1928,8 +1982,8 @@ var updateCommand = new Command21("update").description("move a box onto the cur
 });
 
 // src/commands/vm/usage.ts
-import { Command as Command22 } from "commander";
-var usageCommand = new Command22("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+import { Command as Command23 } from "commander";
+var usageCommand = new Command23("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   let since;
   if (opts.since !== void 0) {
     const t = Date.parse(opts.since);
@@ -1976,8 +2030,8 @@ function block(u) {
 }
 
 // src/commands/vm/wake.ts
-import { Command as Command23 } from "commander";
-var wakeCommand = new Command23("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command24 } from "commander";
+var wakeCommand = new Command24("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`waking ${name} (loading its memory from disk)\u2026`, client.wakeMachine(name));
@@ -1989,15 +2043,15 @@ var wakeCommand = new Command23("wake").description("continue a hibernated box w
 });
 
 // src/commands/vm/index.ts
-var vmCommand = new Command24("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(proxyCommand).addCommand(rmCommand2);
+var vmCommand = new Command25("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(forkCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(proxyCommand).addCommand(rmCommand2);
 for (const cmd of vmCommand.commands) if (cmd !== proxyCommand) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand2, claimCommand];
 
 // src/commands/server/index.ts
-import { Command as Command32 } from "commander";
+import { Command as Command33 } from "commander";
 
 // src/commands/server/join.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/commands/server/daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -2051,7 +2105,7 @@ function runKvboxServer(args) {
 }
 
 // src/commands/server/join.ts
-var joinCommand = new Command25("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
+var joinCommand = new Command26("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
   const args = ["join", url, "--token", opts.token];
   if (opts.advertise !== void 0) args.push("--advertise", opts.advertise);
   if (opts.name !== void 0) args.push("--name", opts.name);
@@ -2061,8 +2115,8 @@ var joinCommand = new Command25("join").description("put this machine behind a c
 });
 
 // src/commands/server/leave.ts
-import { Command as Command26 } from "commander";
-var leaveCommand = new Command26("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
+import { Command as Command27 } from "commander";
+var leaveCommand = new Command27("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
   const p = paths();
   for (const line of (await runKvboxServer(["leave"])).split("\n")) info(line);
   if (await runningPid(p) === null) return;
@@ -2071,14 +2125,14 @@ var leaveCommand = new Command26("leave").description("take this machine out fro
 });
 
 // src/commands/server/relay.ts
-import { Command as Command27 } from "commander";
-var relayCommand = new Command27("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
+import { Command as Command28 } from "commander";
+var relayCommand = new Command28("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
   for (const line of (await runKvboxServer(["relay", joinString])).split("\n")) info(line);
 });
 
 // src/commands/server/start.ts
-import { Command as Command28 } from "commander";
-var startCommand2 = new Command28("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
+import { Command as Command29 } from "commander";
+var startCommand2 = new Command29("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false });
   try {
     const health = await client.health();
@@ -2094,8 +2148,8 @@ var startCommand2 = new Command28("start").description("start the local kvbox-se
 });
 
 // src/commands/server/status.ts
-import { Command as Command29 } from "commander";
-var statusCommand = new Command29("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command30 } from "commander";
+var statusCommand = new Command30("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
   try {
     const health = await client.health();
@@ -2127,8 +2181,8 @@ var statusCommand = new Command29("status").description("show whether this machi
 });
 
 // src/commands/server/stop.ts
-import { Command as Command30 } from "commander";
-var stopCommand2 = new Command30("stop").description("stop the local server (running boxes are not affected)").action(async () => {
+import { Command as Command31 } from "commander";
+var stopCommand2 = new Command31("stop").description("stop the local server (running boxes are not affected)").action(async () => {
   const pid = await runningPid(paths());
   if (pid === null) throw new KvboxError("kvbox-server is not running");
   await stopLocalServer(pid);
@@ -2136,8 +2190,8 @@ var stopCommand2 = new Command30("stop").description("stop the local server (run
 });
 
 // src/commands/server/trust-ca.ts
-import { Command as Command31 } from "commander";
-var trustCaCommand = new Command31("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
+import { Command as Command32 } from "commander";
+var trustCaCommand = new Command32("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
   if (publicKey === void 0 && !opts.fromCloud) throw new KvboxError("give the CA public key, or --from-cloud to fetch it from the control plane this host joined");
   if (publicKey !== void 0 && opts.fromCloud) throw new KvboxError("either a public key or --from-cloud, not both");
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
@@ -2175,7 +2229,7 @@ function describeReport(report) {
 }
 
 // src/commands/server/index.ts
-var serverCommand = new Command32("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
+var serverCommand = new Command33("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
 
 // src/commands/login.ts
 import { spawnSync as spawnSync3 } from "child_process";
@@ -2183,8 +2237,8 @@ import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from
 import { hostname as osHostname } from "os";
 import { createInterface } from "readline/promises";
 import { Writable } from "stream";
-import { Command as Command33 } from "commander";
-var loginCommand = new Command33("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
+import { Command as Command34 } from "commander";
+var loginCommand = new Command34("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
   const session = await runLogin(url, creds, paths());
@@ -2282,8 +2336,8 @@ async function firstLine(stream) {
 }
 
 // src/commands/logout.ts
-import { Command as Command34 } from "commander";
-var logoutCommand = new Command34("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
+import { Command as Command35 } from "commander";
+var logoutCommand = new Command35("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
   const p = paths();
   const session = await readSession(p).catch(() => null);
   switch (await runLogout(p)) {
@@ -2320,8 +2374,8 @@ async function runLogout(p = paths()) {
 }
 
 // src/commands/whoami.ts
-import { Command as Command35 } from "commander";
-var whoamiCommand = new Command35("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
+import { Command as Command36 } from "commander";
+var whoamiCommand = new Command36("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
   const session = await readSession();
   if (opts.json) {
     json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);
@@ -2337,11 +2391,11 @@ function describeSession(session) {
 }
 
 // src/commands/snapshots/index.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/snapshots/ls.ts
-import { Command as Command36 } from "commander";
-var lsCommand3 = new Command36("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command37 } from "commander";
+var lsCommand3 = new Command37("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const cloud = client.target.kind === "cloud";
@@ -2372,8 +2426,8 @@ var lsCommand3 = new Command36("ls").description("list snapshots (yours and your
 });
 
 // src/commands/snapshots/new.ts
-import { Command as Command37 } from "commander";
-var newCommand2 = new Command37("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
+import { Command as Command38 } from "commander";
+var newCommand2 = new Command38("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)\u2026`, client.createSnapshot({ box, name }));
@@ -2385,8 +2439,8 @@ var newCommand2 = new Command37("new").description("freeze a running box (memory
 });
 
 // src/commands/snapshots/rm.ts
-import { Command as Command38 } from "commander";
-var rmCommand3 = new Command38("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command39 } from "commander";
+var rmCommand3 = new Command39("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   if (!await confirm(`Delete snapshot ${name}?`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2402,14 +2456,14 @@ var rmCommand3 = new Command38("rm").description("delete a snapshot (boxes made
 });
 
 // src/commands/snapshots/index.ts
-var snapshotsCommand = new Command39("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand3).addCommand(rmCommand3);
+var snapshotsCommand = new Command40("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand3).addCommand(rmCommand3);
 for (const cmd of snapshotsCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/org/index.ts
-import { Command as Command45 } from "commander";
+import { Command as Command46 } from "commander";
 
 // src/commands/org/ls.ts
-import { Command as Command40 } from "commander";
+import { Command as Command41 } from "commander";
 
 // src/commands/org/context.ts
 var NOT_LOGGED_IN = "orgs live on the control plane: kvbox login first";
@@ -2429,7 +2483,7 @@ function orgFor(opts, target) {
 }
 
 // src/commands/org/ls.ts
-var lsCommand4 = new Command40("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand4 = new Command41("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const orgs = await client.listOrgs();
@@ -2451,8 +2505,8 @@ function orgRows(orgs) {
 }
 
 // src/commands/org/members.ts
-import { Command as Command41, Option as Option3 } from "commander";
-var lsCommand5 = new Command41("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command42, Option as Option4 } from "commander";
+var lsCommand5 = new Command42("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.getOrg(orgFor(opts, client.target));
@@ -2466,7 +2520,7 @@ var lsCommand5 = new Command41("ls").description("list an org's members and thei
     await client.close();
   }
 });
-var addCommand2 = new Command41("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option3("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
+var addCommand2 = new Command42("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option4("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2476,7 +2530,7 @@ var addCommand2 = new Command41("add").description("add a user to an org (admins
     await client.close();
   }
 });
-var rmCommand4 = new Command41("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
+var rmCommand4 = new Command42("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2492,11 +2546,11 @@ var rmCommand4 = new Command41("rm").description("remove a member (or leave: rem
     await client.close();
   }
 });
-var membersCommand = new Command41("members").description("who is in an org and what they may do").addCommand(lsCommand5).addCommand(addCommand2).addCommand(rmCommand4);
+var membersCommand = new Command42("members").description("who is in an org and what they may do").addCommand(lsCommand5).addCommand(addCommand2).addCommand(rmCommand4);
 
 // src/commands/org/new.ts
-import { Command as Command42 } from "commander";
-var newCommand3 = new Command42("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
+import { Command as Command43 } from "commander";
+var newCommand3 = new Command43("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.createOrg({ slug, name: opts.name ?? slug });
@@ -2512,8 +2566,8 @@ var newCommand3 = new Command42("new").description("create an org; you become it
 });
 
 // src/commands/org/rm.ts
-import { Command as Command43 } from "commander";
-var rmCommand5 = new Command43("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
+import { Command as Command44 } from "commander";
+var rmCommand5 = new Command44("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
   if (!await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2529,8 +2583,8 @@ var rmCommand5 = new Command43("rm").description("delete an org (owners only; re
 });
 
 // src/commands/org/role.ts
-import { Argument, Command as Command44 } from "commander";
-var roleCommand = new Command44("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
+import { Argument, Command as Command45 } from "commander";
+var roleCommand = new Command45("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2542,11 +2596,45 @@ var roleCommand = new Command44("role").description("change a member's role (own
 });
 
 // src/commands/org/index.ts
-var orgCommand = new Command45("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand4).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand5);
+var orgCommand = new Command46("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand4).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand5);
 
 // src/commands/usage.ts
-import { Command as Command46 } from "commander";
-var usageCommand2 = new Command46("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command47 } from "commander";
+
+// ../shared/src/usage.ts
+import { z as z4 } from "zod";
+var PricingSchema = z4.object({
+  currency: z4.string().min(1),
+  vcpuHour: z4.number().nonnegative(),
+  ramGibHour: z4.number().nonnegative(),
+  diskGibHour: z4.number().nonnegative()
+});
+var round = (n, places) => Math.round(n * 10 ** places) / 10 ** places;
+function costOf(t, pricing) {
+  return t.vcpuHours * pricing.vcpuHour + t.ramGibHours * pricing.ramGibHour + t.diskGibHours * pricing.diskGibHour;
+}
+function sumUsage(items, pricing) {
+  const sum = {
+    seconds: { running: 0, standby: 0, hibernated: 0, stopped: 0 },
+    vcpuHours: 0,
+    ramGibHours: 0,
+    diskGibHours: 0
+  };
+  for (const t of items) {
+    for (const s of Object.keys(sum.seconds)) sum.seconds[s] += t.seconds[s];
+    sum.vcpuHours += t.vcpuHours;
+    sum.ramGibHours += t.ramGibHours;
+    sum.diskGibHours += t.diskGibHours;
+  }
+  sum.vcpuHours = round(sum.vcpuHours, 3);
+  sum.ramGibHours = round(sum.ramGibHours, 3);
+  sum.diskGibHours = round(sum.diskGibHours, 3);
+  if (pricing !== void 0) sum.cost = { amount: round(costOf(sum, pricing), 4), currency: pricing.currency };
+  return sum;
+}
+
+// src/commands/usage.ts
+var usageCommand2 = new Command47("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--by-user", "one line per user who made the boxes (e.g. who spent what in --org)").option("--json", "print as JSON").action(async (opts, cmd) => {
   for (const [name, value] of [
     ["since", opts.since],
     ["until", opts.until]
@@ -2556,15 +2644,17 @@ var usageCommand2 = new Command46("usage").description("what your boxes used thi
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     if (client.target.kind === "local" && cmd.optsWithGlobals().org) throw new KvboxError("--org needs a control plane: kvbox login, or drop --org");
+    if (client.target.kind === "local" && opts.byUser) throw new KvboxError("--by-user needs a control plane: kvbox login, or drop --by-user");
     const report = await client.usageReport(opts.since, opts.until, opts.all);
+    const perUser = opts.byUser ? byUser(report) : void 0;
     if (opts.json) {
-      json(report);
+      json(perUser ?? report);
       return;
     }
     const cloud = client.target.kind === "cloud" ? { me: client.target.user } : void 0;
     info(`${day2(report.window.from)} to ${day2(report.window.to)}`);
     if (report.boxes.length === 0) info("no usage in this window");
-    else table(usageRows(report, cloud));
+    else table(perUser ? userRows(perUser) : usageRows(report, cloud));
     if (cloud) {
       const line = await creditLine(client, cloud.me);
       if (line !== void 0) info(line);
@@ -2617,10 +2707,50 @@ function usageRows(report, cloud) {
   });
   return rows;
 }
+function byUser(report) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const b of report.boxes) {
+    const user = b.createdBy ?? null;
+    const list = groups.get(user);
+    if (list === void 0) groups.set(user, [b]);
+    else list.push(b);
+  }
+  const currency = report.totals.cost?.currency;
+  const users = [...groups].map(([user, boxes]) => {
+    const { cost: _none, ...sum } = sumUsage(boxes);
+    const u = { user, boxes: boxes.length, ...sum };
+    if (currency !== void 0) u.cost = { amount: round(boxes.reduce((n, b) => n + (b.cost?.amount ?? 0), 0), 4), currency };
+    return u;
+  });
+  users.sort((a, b) => a.user === null ? 1 : b.user === null ? -1 : a.user.localeCompare(b.user));
+  return { window: report.window, users, totals: report.totals };
+}
+function userRows(r) {
+  const priced = r.totals.cost !== void 0;
+  const cells = (t) => ({
+    running: duration(t.seconds.running),
+    "vcpu-h": hours(t.vcpuHours),
+    "ram GiB-h": hours(t.ramGibHours),
+    "disk GiB-h": hours(t.diskGibHours)
+  });
+  const rows = r.users.map((u) => ({
+    user: u.user ?? color.dim("unknown"),
+    boxes: String(u.boxes),
+    ...cells(u),
+    ...priced ? { cost: money(u.cost?.amount ?? 0, r.totals.cost.currency) } : {}
+  }));
+  rows.push({
+    user: color.bold("total"),
+    boxes: String(r.users.reduce((n, u) => n + u.boxes, 0)),
+    ...cells(r.totals),
+    ...priced ? { cost: `${money(r.totals.cost.amount, r.totals.cost.currency)} ${color.dim("(estimated)")}` } : {}
+  });
+  return rows;
+}
 
 // src/commands/credit.ts
-import { Command as Command47 } from "commander";
-var creditCommand = new Command47("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command48 } from "commander";
+var creditCommand = new Command48("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });
   try {
     if (client.target.kind === "local") throw new KvboxError("credit lives on the control plane: kvbox login first");
@@ -2649,7 +2779,7 @@ function creditRow(b, me2) {
 
 // src/program.ts
 function buildProgram() {
-  const program = new Command48("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command49("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);