@kvbox/cli 0.5.18 → 0.5.20

package/dist/kvbox.js

@@ -10,8 +10,10 @@ var KvboxError = class extends Error {
   exitCode;
 };
 var AmbiguousRefError = class extends KvboxError {
-  constructor(kind, name, slugs) {
-    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(", ")} and ${slugs.at(-1)}; say which with --org ${slugs[0]} or ${slugs[0]}/${name}`, 1);
+  /** `orgFlag` false: `--org` names something else on this command (a fork's target), so only `slug/name` is offered. */
+  constructor(kind, name, slugs, orgFlag = true) {
+    const way = orgFlag ? `--org ${slugs[0]} or ${slugs[0]}/${name}` : `${slugs[0]}/${name}`;
+    super(`${kind} ${name} exists in ${slugs.slice(0, -1).join(", ")} and ${slugs.at(-1)}; say which with ${way}`, 1);
     this.name = "AmbiguousRefError";
   }
 };
@@ -24,10 +26,10 @@ function json(value) {
 }
 var ANSI = /\x1b\[[0-9;]*m/g;
 var width = (s) => s.replace(ANSI, "").length;
-function table(rows, columns) {
-  if (rows.length === 0) return;
-  const cols = columns ?? Object.keys(rows[0]);
-  const cells = rows.map((r) => cols.map((c) => String(r[c] ?? "")));
+function table(rows2, columns) {
+  if (rows2.length === 0) return;
+  const cols = columns ?? Object.keys(rows2[0]);
+  const cells = rows2.map((r) => cols.map((c) => String(r[c] ?? "")));
   const widths = cols.map((c, i) => Math.max(c.length, ...cells.map((r) => width(r[i]))));
   const line = (parts) => parts.map((p, i) => p + " ".repeat(Math.max(0, widths[i] - width(p)))).join("  ").trimEnd();
   process.stdout.write(color.dim(line(cols.map((c) => c.toUpperCase()))) + "\n");
@@ -45,8 +47,8 @@ async function confirm(question, yes) {
     warn("refusing without -y when stdin is not a terminal");
     return false;
   }
-  const { createInterface: createInterface2 } = await import("readline/promises");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const { createInterface: createInterface3 } = await import("readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
     return answer === "y" || answer === "yes";
@@ -106,14 +108,14 @@ function slugOf(owner) {
   const at = owner.indexOf("@");
   return at === -1 ? owner : owner.slice(0, at);
 }
-function pickRef(items, text, me2, kind = "box") {
-  if (text.includes("/")) return items.find((i) => text === `${slugOf(i.owner)}/${i.name}` || text === `${i.owner}/${i.name}`);
-  const named = items.filter((i) => i.name === text);
+function pickRef(items, text2, me2, kind = "box") {
+  if (text2.includes("/")) return items.find((i) => text2 === `${slugOf(i.owner)}/${i.name}` || text2 === `${i.owner}/${i.name}`);
+  const named = items.filter((i) => i.name === text2);
   const own = named.find((i) => slugOf(i.owner) === me2);
   if (own) return own;
   const orgs = me2 === void 0 ? named : named.filter((i) => i.ownerKind !== "user");
   if (orgs.length <= 1) return orgs[0];
-  throw new AmbiguousRefError(kind, text, orgs.map((i) => slugOf(i.owner)));
+  throw new AmbiguousRefError(kind, text2, orgs.map((i) => slugOf(i.owner)));
 }
 function shortRef(ref, owner) {
   return ref.startsWith(`${owner}/`) ? ref.slice(owner.length + 1) : ref;
@@ -147,7 +149,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command48 } from "commander";
+import { Command as Command50 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -162,10 +164,10 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.18" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.20" : void 0);
 
 // src/commands/vm/index.ts
-import { Command as Command24 } from "commander";
+import { Command as Command25 } from "commander";
 
 // src/commands/vm/connect.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -230,6 +232,8 @@ function paths(home = kvboxHome()) {
          * The next snapshot is a diff of the pages dirtied since, merged onto this. Absent after a boot.
          */
         memBase: join(dir, "mem.base"),
+        /** `kvbox vm fork` (#79): the source's VM state, captured here and gone once the box runs. Its memory is `memBase`. */
+        forkVmstate: join(dir, "fork.vmstate"),
         /** `kvbox hibernate`: the box's memory image and VM state while it is hibernated; gone again after `wake` or `stop`. */
         hibernateDir: join(dir, "hibernate"),
         hibernateVmstate: join(dir, "hibernate", "vmstate"),
@@ -267,15 +271,15 @@ var SessionSchema = z.object({
   sshCertPrincipals: z.array(z.string()).optional()
 });
 async function readSession(p = paths()) {
-  let text;
+  let text2;
   try {
-    text = await readFile(p.cli, "utf8");
+    text2 = await readFile(p.cli, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
   try {
-    return SessionSchema.parse(JSON.parse(text));
+    return SessionSchema.parse(JSON.parse(text2));
   } catch {
     throw new KvboxError(`${p.cli} is unreadable; run: kvbox logout (then log in again)`);
   }
@@ -371,8 +375,9 @@ var SIZES = {
   l: { vcpu: 8, memMib: 16384, diskGib: 32 }
 };
 var SIZE_NAMES = Object.keys(SIZES);
-function parseMib(text) {
-  const m = /^\s*(\d+(?:\.\d+)?)\s*([gm]i?b?)?\s*$/i.exec(text);
+var DEFAULT_SIZE = "s";
+function parseMib(text2) {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*([gm]i?b?)?\s*$/i.exec(text2);
   if (!m) return void 0;
   const n = Number(m[1]);
   const unit = (m[2] ?? "g").toLowerCase();
@@ -427,7 +432,7 @@ var MachineSchema = z2.object({
   // base image version the box's overlay stacks on
   createdAt: z2.string(),
   source: z2.string(),
-  // "base" or "snapshot:<name>"
+  // "base", "snapshot:<owner/name>" or "fork:<owner/name>" (#79)
   status: BoxStatusSchema,
   /**
    * Public TCP port on the host that reaches the box's SSH while it runs (#49). Only boxes made
@@ -463,6 +468,20 @@ var CreateMachineRequest = z2.object({
   /** Seconds without network traffic before the box is hibernated (#47); 0: never. Absent: the host's default. */
   autoHibernateSec: z2.number().int().min(0).optional()
 });
+var ForkMachineRequest = z2.object({
+  name: z2.string().optional(),
+  /**
+   * The new box's slug, bare (`acme`): the control plane sends the target of `--org` here; the host
+   * qualifies it with the caller's realm. Absent: the source's owner. A CLI leaves it out.
+   */
+  owner: z2.string().optional(),
+  /** A cold fork only: a warm one keeps the source's vCPU and memory. */
+  size: SizeSchema.optional(),
+  force: z2.boolean().optional(),
+  /** As in CreateMachineRequest: the control plane's CA line for the new box's owner. */
+  sshKeys: z2.array(z2.string()).optional(),
+  autoHibernateSec: z2.number().int().min(0).optional()
+});
 var SetSshKeysRequest = z2.object({
   sshKeys: z2.array(z2.string())
 });
@@ -578,7 +597,12 @@ var BoxUsageSchema = MachineUsageSchema.omit({ window: true, status: true }).ext
   id: z2.string(),
   status: UsageStatusSchema,
   /** Through a control plane: whether the owner slug is a user's or an org's (what `kvbox ls` shows). */
-  ownerKind: z2.enum(["user", "org"]).optional()
+  ownerKind: z2.enum(["user", "org"]).optional(),
+  /**
+   * Through a control plane: the username that made the box (#60), absent when the box is gone from
+   * the index (removed), was found by reconcile, or its maker was deleted. The ledger does not record it.
+   */
+  createdBy: z2.string().optional()
 });
 var UsageReportSchema = z2.object({
   window: z2.object({ from: z2.string(), to: z2.string() }),
@@ -787,13 +811,13 @@ function serverLauncher(opts = {}) {
   return { cmd: "sg", args: [group, "-c", "kvbox-server start"], viaGroup: group };
 }
 function groupWithMember(gid, user, groupFile) {
-  let text;
+  let text2;
   try {
-    text = readFileSync(groupFile, "utf8");
+    text2 = readFileSync(groupFile, "utf8");
   } catch {
     return void 0;
   }
-  for (const line of text.split("\n")) {
+  for (const line of text2.split("\n")) {
     const [name, , id, members = ""] = line.split(":");
     if (name === void 0 || id === void 0 || Number.parseInt(id, 10) !== gid) continue;
     return members.split(",").includes(user) ? name : void 0;
@@ -808,13 +832,13 @@ import { resolve } from "path";
 var UNIT = "kvbox-server";
 var UNIT_FILE = `/etc/systemd/system/${UNIT}.service`;
 function hasUnitFor(p, file = UNIT_FILE) {
-  let text;
+  let text2;
   try {
-    text = readFileSync2(file, "utf8");
+    text2 = readFileSync2(file, "utf8");
   } catch {
     return false;
   }
-  const home = /^Environment="?KVBOX_HOME=([^"\n]+)"?$/m.exec(text)?.[1];
+  const home = /^Environment="?KVBOX_HOME=([^"\n]+)"?$/m.exec(text2)?.[1];
   return home !== void 0 && resolve(home) === resolve(p.home);
 }
 function startUnitProcess() {
@@ -889,10 +913,10 @@ var ServerClient = class {
       }
       throw new KvboxError(cloudDown(this.target.url, String(code)));
     }
-    const text = await res.body.text();
+    const text2 = await res.body.text();
     const where = this.target.kind === "cloud" ? hostOf(this.target.url) : "kvbox-server";
     if (res.statusCode >= 300) {
-      const parsed = ApiErrorSchema.safeParse(safeJson(text) ?? {});
+      const parsed = ApiErrorSchema.safeParse(safeJson(text2) ?? {});
       if (!parsed.success) throw new KvboxError(`${where} answered ${res.statusCode}`);
       if (this.target.kind === "cloud" && this.target.token !== "") {
         if (res.statusCode === 401) throw new KvboxError("session expired: kvbox login");
@@ -902,8 +926,8 @@ var ServerClient = class {
       }
       throw new KvboxError(parsed.data.error, res.statusCode === 501 ? 2 : 1);
     }
-    if (text === "") return schema.parse(void 0);
-    const json2 = safeJson(text);
+    if (text2 === "") return schema.parse(void 0);
+    const json2 = safeJson(text2);
     if (json2 === void 0) throw new KvboxError(`${where} answered ${res.statusCode} with something that is not JSON`);
     return schema.parse(json2);
   }
@@ -923,6 +947,10 @@ var ServerClient = class {
   createMachine(req) {
     return this.call("POST", "/machines", MachineSchema, req);
   }
+  /** `kvbox vm fork` (#79): `name` is the source; the copy goes to the `--org` slug, else the caller's own. */
+  forkMachine(name, req) {
+    return this.call("POST", `/machines/${encodeURIComponent(name)}/fork`, MachineSchema, req);
+  }
   stopMachine(name) {
     return this.call("POST", `/machines/${encodeURIComponent(name)}/stop`, MachineSchema);
   }
@@ -1070,9 +1098,9 @@ function cloudDown(url, code) {
   const hint = host.endsWith("kvbox.sh") ? "check status.kvbox.sh" : "use --local for this machine, or kvbox logout";
   return `${host} is not available or is down (${code}). You are logged in there, so kvbox talks to it instead of this machine; ${hint}`;
 }
-function safeJson(text) {
+function safeJson(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
     return void 0;
   }
@@ -1092,10 +1120,10 @@ async function wakeUp(client, box, name) {
       return box;
   }
 }
-function boxesFor(client, text) {
-  const slash = text.indexOf("/");
+function boxesFor(client, text2) {
+  const slash = text2.indexOf("/");
   if (slash === -1 || client.target.kind !== "cloud") return client.listMachines();
-  return client.listMachines({ org: text.slice(0, slash).split("@")[0] });
+  return client.listMachines({ org: text2.slice(0, slash).split("@")[0] });
 }
 var me = (client) => client.target.kind === "cloud" ? client.target.user : void 0;
 async function clientFor(opts, client = {}) {
@@ -1127,17 +1155,17 @@ function sshArgs(ep, p = paths()) {
 async function waitForSsh(ep, timeoutMs = 3e4) {
   const { connect } = await import("net");
   const deadline = Date.now() + timeoutMs;
-  const attempt = () => new Promise((resolve2) => {
+  const attempt = () => new Promise((resolve3) => {
     const sock = connect({ host: ep.host, port: ep.port, timeout: 1e3 });
     sock.once("connect", () => {
       sock.destroy();
-      resolve2(true);
+      resolve3(true);
     });
     sock.once("timeout", () => {
       sock.destroy();
-      resolve2(false);
+      resolve3(false);
     });
-    sock.once("error", () => resolve2(false));
+    sock.once("error", () => resolve3(false));
   });
   while (Date.now() < deadline) {
     if (await attempt()) return;
@@ -1147,9 +1175,9 @@ async function waitForSsh(ep, timeoutMs = 3e4) {
 }
 var NOT_A_HOST_HINT = "kvbox-server is not installed, so this machine is not a kvbox host. Set it up with install-server.sh, or log in to the cloud with: kvbox login";
 async function lastErrorLine(logPath, from = 0) {
-  const { readFile: readFile6 } = await import("fs/promises");
-  const text = (await readFile6(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString("utf8");
-  const lines = text.trimEnd().split("\n").slice(-20).reverse();
+  const { readFile: readFile8 } = await import("fs/promises");
+  const text2 = (await readFile8(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString("utf8");
+  const lines = text2.trimEnd().split("\n").slice(-20).reverse();
   return lines.find((l) => l.startsWith("error: "))?.slice("error: ".length);
 }
 async function startLocalServer(p = paths(), timeoutMs = 5e3) {
@@ -1242,17 +1270,17 @@ function displayName(box, user) {
   return user !== void 0 && slugOf(box.owner) !== user ? `${slugOf(box.owner)}/${box.name}` : box.name;
 }
 function describe(box, user) {
-  const from = box.source.startsWith("snapshot:") ? ` from snapshot ${shortRef(box.source.slice("snapshot:".length), box.owner)}` : "";
+  const from = box.source.startsWith("snapshot:") ? ` from snapshot ${shortRef(box.source.slice("snapshot:".length), box.owner)}` : box.source.startsWith("fork:") ? `, a fork of ${shortRef(box.source.slice("fork:".length), box.owner)}` : "";
   return `box ${color.bold(displayName(box, user))} is ${box.status} at ${box.ip}${from}: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`;
 }
 function autoHibernateText(sec) {
   return sec ? `hibernates after ${duration(sec)} without network traffic (kvbox connect wakes it)` : "never hibernates on its own";
 }
 var UNIT_SEC = { m: 60, h: 3600, d: 86400 };
-function parseIdleTimeout(text) {
-  const t = text.trim().toLowerCase();
+function parseIdleTimeout(text2) {
+  const t = text2.trim().toLowerCase();
   if (t === "off" || t === "never" || t === "0") return 0;
-  if (!/^(\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text}: give a duration like 30m, 4h or 1d, or off`);
+  if (!/^(\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text2}: give a duration like 30m, 4h or 1d, or off`);
   let sec = 0;
   for (const [, n, unit] of t.matchAll(/(\d+)([mhd])/g)) sec += Number(n) * UNIT_SEC[unit];
   return sec;
@@ -1328,12 +1356,12 @@ async function runSsh(ssh, opts) {
     timedOut = true;
     child.kill("SIGTERM");
   }, opts.timeout * 1e3);
-  const status2 = await new Promise((resolve2, reject) => {
+  const status2 = await new Promise((resolve3, reject) => {
     child.once("error", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));
     child.once("close", (code, signal) => {
-      if (timedOut) resolve2(TIMEOUT_EXIT);
-      else if (code !== null) resolve2(code);
-      else resolve2(signal === "SIGINT" ? 130 : 1);
+      if (timedOut) resolve3(TIMEOUT_EXIT);
+      else if (code !== null) resolve3(code);
+      else resolve3(signal === "SIGINT" ? 130 : 1);
     });
   }).finally(() => clearTimeout(timer));
   return { status: status2, chunks, timedOut };
@@ -1386,9 +1414,36 @@ var execCommand = new Command3("exec").description("run a command in a box and e
   process.exit(status2);
 });
 
+// src/commands/vm/fork.ts
+import { Command as Command4, Option as Option2 } from "commander";
+var forkCommand = new Command4("fork").description("copy a box, running or stopped, into a new one on the same host (--org: into an org)").argument("<box>", "the box to copy").argument("[name]", "the copy's name (box1, box2, \u2026 when omitted)").addOption(new Option2("-s, --size <size>", "the copy's size, for a stopped box only (default: the box's)").choices(SIZE_NAMES)).option("--auto-hibernate <duration>", "hibernate the copy after this long without network traffic (30m, 4h, 1d; off: never; default: the box's)").option("--force", "skip the capacity guard").option("--json", "print the new box as JSON").action(async (source, name, opts, cmd) => {
+  const autoHibernateSec = opts.autoHibernate === void 0 ? void 0 : parseIdleTimeout(opts.autoHibernate);
+  const client = await clientFor(cmd.optsWithGlobals());
+  try {
+    const box = await spin(`forking ${source}\u2026`, client.forkMachine(source, {
+      ...name !== void 0 ? { name } : {},
+      ...opts.size !== void 0 ? { size: opts.size } : {},
+      ...autoHibernateSec !== void 0 ? { autoHibernateSec } : {},
+      ...opts.force ? { force: true } : {}
+    }));
+    if (opts.json) {
+      json(box);
+      return;
+    }
+    const user = me(client);
+    process.stdout.write(`${box.name}
+`);
+    info(`${color.green("\u2713")} ${describe(box, user)}`);
+    info(`  connect with: kvbox connect ${displayName(box, user)}`);
+    info(`  it ${autoHibernateText(box.autoHibernateSec)}; published ports and HTTPS names stay with ${source}`);
+  } finally {
+    await client.close();
+  }
+});
+
 // src/commands/vm/hibernate.ts
-import { Command as Command4 } from "commander";
-var hibernateCommand = new Command4("hibernate").description("save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command5 } from "commander";
+var hibernateCommand = new Command5("hibernate").description("save a box's memory to disk and free its RAM (kvbox wake continues it where it left off)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`hibernating ${name} (saving its memory to disk)\u2026`, client.hibernateMachine(name));
@@ -1400,7 +1455,7 @@ var hibernateCommand = new Command4("hibernate").description("save a box's memor
 });
 
 // src/commands/vm/ls.ts
-import { Command as Command5 } from "commander";
+import { Command as Command6 } from "commander";
 function ownerCell(b, me2) {
   const slug = slugOf(b.owner);
   if (slug === me2) return "private";
@@ -1410,7 +1465,7 @@ function addressOf(b) {
   if (b.ssh !== void 0) return b.ssh.host;
   return b.ip === "" ? "-" : b.ip;
 }
-var lsCommand = new Command5("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand = new Command6("ls").description("list boxes with status and address (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const boxes = await spin("listing boxes\u2026", client.listMachines({ all: opts.all }));
@@ -1441,8 +1496,8 @@ function lsRows(boxes, cloud) {
 }
 
 // src/commands/vm/pause.ts
-import { Command as Command6 } from "commander";
-var pauseCommand = new Command6("pause").description("freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command7 } from "commander";
+var pauseCommand = new Command7("pause").description("freeze a box in place (memory and processes kept, no CPU used; kvbox resume continues it instantly)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`pausing ${name}\u2026`, client.pauseMachine(name));
@@ -1454,7 +1509,7 @@ var pauseCommand = new Command6("pause").description("freeze a box in place (mem
 });
 
 // src/commands/vm/proxy/claim.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 
 // ../shared/src/names.ts
 import { createHmac } from "crypto";
@@ -1485,26 +1540,26 @@ var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
   "support",
   "www"
 ]);
-function subdomainProblem(text) {
-  if (text.length < 3 || text.length > 63) return `"${text}" must be 3 to 63 characters`;
-  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
-  if (RESERVED_SUBDOMAINS.has(text)) return `"${text}" is reserved; pick another name`;
+function subdomainProblem(text2) {
+  if (text2.length < 3 || text2.length > 63) return `"${text2}" must be 3 to 63 characters`;
+  if (!LABEL_RE.test(text2)) return `"${text2}" may hold only lowercase letters, digits and '-', not at either end`;
+  if (RESERVED_SUBDOMAINS.has(text2)) return `"${text2}" is reserved; pick another name`;
   return null;
 }
-function routeNameProblem(text) {
-  if (text.length < 1 || text.length > 63) return `"${text}" must be 1 to 63 characters`;
-  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
+function routeNameProblem(text2) {
+  if (text2.length < 1 || text2.length > 63) return `"${text2}" must be 1 to 63 characters`;
+  if (!LABEL_RE.test(text2)) return `"${text2}" may hold only lowercase letters, digits and '-', not at either end`;
   return null;
 }
-function assertSubdomain(text) {
-  const problem = subdomainProblem(text);
+function assertSubdomain(text2) {
+  const problem = subdomainProblem(text2);
   if (problem) throw new KvboxError(`subdomain ${problem}`);
-  return text;
+  return text2;
 }
-function assertRouteName(text) {
-  const problem = routeNameProblem(text);
+function assertRouteName(text2) {
+  const problem = routeNameProblem(text2);
   if (problem) throw new KvboxError(`name ${problem}`);
-  return text;
+  return text2;
 }
 
 // src/commands/vm/proxy/shared.ts
@@ -1533,14 +1588,14 @@ function parsePorts(texts) {
     return n;
   });
 }
-async function findBox(client, text) {
-  const found = pickRef(await boxesFor(client, text), text, me(client));
-  if (!found) throw new KvboxError(`box ${text}: not found (kvbox ls)`);
+async function findBox(client, text2) {
+  const found = pickRef(await boxesFor(client, text2), text2, me(client));
+  if (!found) throw new KvboxError(`box ${text2}: not found (kvbox ls)`);
   return found;
 }
 
 // src/commands/vm/proxy/claim.ts
-var claimCommand = new Command7("claim").description("give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports").argument("<box>", "box name").argument("<subdomain>", "3-63 lowercase letters, digits and '-'; must be free").requiredOption("--port <port>", "the box port the address serves").option("--json", "print the subdomain as JSON").action(async (name, subdomain, opts, cmd) => {
+var claimCommand = new Command8("claim").description("give a box its HTTPS address, https://<subdomain>.kvbox.app, serving one of its ports").argument("<box>", "box name").argument("<subdomain>", "3-63 lowercase letters, digits and '-'; must be free").requiredOption("--port <port>", "the box port the address serves").option("--json", "print the subdomain as JSON").action(async (name, subdomain, opts, cmd) => {
   assertSubdomain(subdomain);
   const [port] = parsePorts([opts.port]);
   const client = await clientFor(cmd.optsWithGlobals());
@@ -1563,11 +1618,11 @@ var claimCommand = new Command7("claim").description("give a box its HTTPS addre
 });
 
 // src/commands/vm/proxy/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/vm/proxy/add.ts
-import { Command as Command8 } from "commander";
-var addCommand = new Command8("add").description("publish box ports on the internet; each gets a random public port, or an HTTPS name with --name").argument("<box>", "box name").argument("<port...>", "ports inside the box, e.g. 3000 8080").option("--udp", "UDP instead of TCP").option("--name <name>", "serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)").option("--json", "print the new forwards as JSON").action(async (name, portTexts, opts, cmd) => {
+import { Command as Command9 } from "commander";
+var addCommand = new Command9("add").description("publish box ports on the internet; each gets a random public port, or an HTTPS name with --name").argument("<box>", "box name").argument("<port...>", "ports inside the box, e.g. 3000 8080").option("--udp", "UDP instead of TCP").option("--name <name>", "serve the port at https://<name>.<subdomain>.kvbox.app (one port; needs kvbox vm proxy claim first)").option("--json", "print the new forwards as JSON").action(async (name, portTexts, opts, cmd) => {
   const guestPorts = parsePorts(portTexts);
   if (opts.name !== void 0) {
     assertRouteName(opts.name);
@@ -1595,12 +1650,12 @@ var addCommand = new Command8("add").description("publish box ports on the inter
       return;
     }
     const updated = await spin(`publishing ${guestPorts.join(", ")} on ${name}\u2026`, client.addPorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));
-    const rows = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));
+    const rows2 = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));
     if (opts.json) {
-      json(rows);
+      json(rows2);
       return;
     }
-    for (const row of rows) info(`${color.green("\u2713")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);
+    for (const row of rows2) info(`${color.green("\u2713")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);
     if (updated.status !== "running") info(`  box ${name} is ${updated.status}: the ports open when it runs`);
   } finally {
     await client.close();
@@ -1608,7 +1663,7 @@ var addCommand = new Command8("add").description("publish box ports on the inter
 });
 
 // src/commands/vm/proxy/ls.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 async function subdomainsOf(client) {
   try {
     return await client.listSubdomains();
@@ -1617,7 +1672,7 @@ async function subdomainsOf(client) {
     return [];
   }
 }
-var lsCommand2 = new Command9("ls").description("list the box ports published on the internet").argument("[box]", "only this box").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+var lsCommand2 = new Command10("ls").description("list the box ports published on the internet").argument("[box]", "only this box").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const user = me(client);
@@ -1627,24 +1682,24 @@ var lsCommand2 = new Command9("ls").description("list the box ports published on
     ]);
     const shown = new Set(boxes.map((b) => displayName(b, user)));
     const https = subs.flatMap((s) => httpsRowsOf(s, user)).filter((r) => shown.has(r.box));
-    const rows = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);
+    const rows2 = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);
     if (opts.json) {
-      json(rows);
+      json(rows2);
       return;
     }
-    if (rows.length === 0) {
+    if (rows2.length === 0) {
       info(name === void 0 ? "no published ports (kvbox vm proxy add <box> <port>)" : `box ${name} publishes no ports (kvbox vm proxy add ${name} <port>)`);
       return;
     }
-    table(rows.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === "https" ? r.url : reaches(r, true), proto: r.proto })));
+    table(rows2.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === "https" ? r.url : reaches(r, true), proto: r.proto })));
   } finally {
     await client.close();
   }
 });
 
 // src/commands/vm/proxy/release.ts
-import { Command as Command10 } from "commander";
-var releaseCommand = new Command10("release").description("give up a box's HTTPS address and every name under it").argument("<box>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command11 } from "commander";
+var releaseCommand = new Command11("release").description("give up a box's HTTPS address and every name under it").argument("<box>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     requireCloud(client);
@@ -1663,8 +1718,8 @@ var releaseCommand = new Command10("release").description("give up a box's HTTPS
 });
 
 // src/commands/vm/proxy/rm.ts
-import { Command as Command11 } from "commander";
-var rmCommand = new Command11("rm").description("stop publishing box ports, or an HTTPS name with --name").argument("<box>", "box name").argument("[port...]", "ports inside the box, as given to add").option("--udp", "the UDP forwards of those ports").option("--name <name>", "the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)").option("-y, --yes", "do not ask for confirmation").action(async (name, portTexts, opts, cmd) => {
+import { Command as Command12 } from "commander";
+var rmCommand = new Command12("rm").description("stop publishing box ports, or an HTTPS name with --name").argument("<box>", "box name").argument("[port...]", "ports inside the box, as given to add").option("--udp", "the UDP forwards of those ports").option("--name <name>", "the HTTPS name to free (kvbox vm proxy release frees the whole subdomain)").option("-y, --yes", "do not ask for confirmation").action(async (name, portTexts, opts, cmd) => {
   if (opts.name !== void 0) {
     assertRouteName(opts.name);
     if (portTexts.length > 0) throw new KvboxError("--name frees a name, not ports: kvbox vm proxy rm <box> --name <name>");
@@ -1696,8 +1751,8 @@ var rmCommand = new Command11("rm").description("stop publishing box ports, or a
 });
 
 // src/commands/vm/proxy/set-port.ts
-import { Command as Command12 } from "commander";
-var setPortCommand = new Command12("set-port").description("point a box's HTTPS address at another of its ports").argument("<box>", "box name").argument("<port>", "the box port https://<subdomain>.kvbox.app serves from now on").option("--json", "print the subdomain as JSON").action(async (name, portText, opts, cmd) => {
+import { Command as Command13 } from "commander";
+var setPortCommand = new Command13("set-port").description("point a box's HTTPS address at another of its ports").argument("<box>", "box name").argument("<port>", "the box port https://<subdomain>.kvbox.app serves from now on").option("--json", "print the subdomain as JSON").action(async (name, portText, opts, cmd) => {
   const [port] = parsePorts([portText]);
   const client = await clientFor(cmd.optsWithGlobals());
   try {
@@ -1715,12 +1770,12 @@ var setPortCommand = new Command12("set-port").description("point a box's HTTPS
 });
 
 // src/commands/vm/proxy/index.ts
-var proxyCommand = new Command13("proxy").description("publish box ports on the internet").addCommand(addCommand).addCommand(lsCommand2).addCommand(rmCommand).addCommand(claimCommand).addCommand(setPortCommand).addCommand(releaseCommand);
+var proxyCommand = new Command14("proxy").description("publish box ports on the internet").addCommand(addCommand).addCommand(lsCommand2).addCommand(rmCommand).addCommand(claimCommand).addCommand(setPortCommand).addCommand(releaseCommand);
 for (const cmd of proxyCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/vm/rescale.ts
-import { Command as Command14, Option as Option2 } from "commander";
-var rescaleCommand = new Command14("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option2("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command15, Option as Option3 } from "commander";
+var rescaleCommand = new Command15("rescale").description("change a box's vCPUs, memory or disk (e.g. --vcpu 4 --mem 16GB); a running box restarts").argument("<name>", "box name").addOption(new Option3("-s, --size <size>", "a preset to start from").choices(SIZE_NAMES)).option("--vcpu <n>", "number of vCPUs").option("--mem <size>", "memory, e.g. 16GB or 4096MB").option("--disk <size>", "disk size, e.g. 32GB (grow only)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const req = {
     ...opts.size !== void 0 ? { size: opts.size } : {},
     ...opts.vcpu !== void 0 ? { vcpu: parseCount(opts.vcpu) } : {},
@@ -1748,25 +1803,25 @@ var rescaleCommand = new Command14("rescale").description("change a box's vCPUs,
     await client.close();
   }
 });
-function parseCount(text) {
-  const n = Number(text);
-  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text}: give a whole number of vCPUs`);
+function parseCount(text2) {
+  const n = Number(text2);
+  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text2}: give a whole number of vCPUs`);
   return n;
 }
-function parseSize(flag, text) {
-  const mib = parseMib(text);
-  if (mib === void 0) throw new KvboxError(`${flag} ${text}: give a size like 16GB or 4096MB`);
+function parseSize(flag, text2) {
+  const mib = parseMib(text2);
+  if (mib === void 0) throw new KvboxError(`${flag} ${text2}: give a size like 16GB or 4096MB`);
   return mib;
 }
-function parseGib(flag, text) {
-  const mib = parseSize(flag, text);
-  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text}: disk sizes are whole GB`);
+function parseGib(flag, text2) {
+  const mib = parseSize(flag, text2);
+  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text2}: disk sizes are whole GB`);
   return mib / 1024;
 }
 
 // src/commands/vm/resume.ts
-import { Command as Command15 } from "commander";
-var resumeCommand = new Command15("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command16 } from "commander";
+var resumeCommand = new Command16("resume").description("continue a box that is in standby (kvbox pause)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`resuming ${name}\u2026`, client.resumeMachine(name));
@@ -1778,8 +1833,8 @@ var resumeCommand = new Command15("resume").description("continue a box that is
 });
 
 // src/commands/vm/rm.ts
-import { Command as Command16 } from "commander";
-var rmCommand2 = new Command16("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command17 } from "commander";
+var rmCommand2 = new Command17("rm").description("destroy a box (its disk is deleted; snapshots are kept)").argument("<name>", "box name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = pickRef(await boxesFor(client, name), name, me(client));
@@ -1798,8 +1853,8 @@ var rmCommand2 = new Command16("rm").description("destroy a box (its disk is del
 });
 
 // src/commands/vm/set.ts
-import { Command as Command17 } from "commander";
-var setCommand = new Command17("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command18 } from "commander";
+var setCommand = new Command18("set").description("change a box's settings, e.g. --auto-hibernate 30m (off: never)").argument("<name>", "box name").option("--auto-hibernate <duration>", "hibernate the box after this long without network traffic (30m, 4h, 1d; off: never)").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   if (opts.autoHibernate === void 0) throw new KvboxError("nothing to change: give --auto-hibernate");
   const autoHibernateSec = parseIdleTimeout(opts.autoHibernate);
   const client = await clientFor(cmd.optsWithGlobals());
@@ -1818,8 +1873,8 @@ var setCommand = new Command17("set").description("change a box's settings, e.g.
 });
 
 // src/commands/vm/start.ts
-import { Command as Command18 } from "commander";
-var startCommand = new Command18("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command19 } from "commander";
+var startCommand = new Command19("start").description("boot a stopped box again (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`booting ${name}\u2026`, client.startMachine(name));
@@ -1831,8 +1886,8 @@ var startCommand = new Command18("start").description("boot a stopped box again
 });
 
 // src/commands/vm/stop.ts
-import { Command as Command19 } from "commander";
-var stopCommand = new Command19("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command20 } from "commander";
+var stopCommand = new Command20("stop").description("shut a box down (its disk is kept; start it again with kvbox start)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`shutting ${name} down\u2026`, client.stopMachine(name));
@@ -1844,8 +1899,8 @@ var stopCommand = new Command19("stop").description("shut a box down (its disk i
 });
 
 // src/commands/vm/top.ts
-import { Command as Command20 } from "commander";
-var topCommand = new Command20("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command21 } from "commander";
+var topCommand = new Command21("top").description("load, memory and disk of each running box, as the box itself sees them").option("-a, --all", "every running box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const running = (await client.listMachines({ all: opts.all })).filter((b) => b.status === "running");
@@ -1905,8 +1960,8 @@ function topRows(entries, cloud) {
 }
 
 // src/commands/vm/update.ts
-import { Command as Command21 } from "commander";
-var updateCommand = new Command21("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command22 } from "commander";
+var updateCommand = new Command22("update").description("move a box onto the current base image (its files stay; a running box restarts)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const before = pickRef(await boxesFor(client, name), name, me(client));
@@ -1928,8 +1983,8 @@ var updateCommand = new Command21("update").description("move a box onto the cur
 });
 
 // src/commands/vm/usage.ts
-import { Command as Command22 } from "commander";
-var usageCommand = new Command22("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
+import { Command as Command23 } from "commander";
+var usageCommand = new Command23("usage").description("how long a box ran, slept and sat stopped, as vCPU-hours, RAM and disk GiB-hours (and cost, when the host prices them)").argument("<name>", "box name").option("--since <date>", "count from this date instead of the box's creation, e.g. 2026-10-01").option("--json", "print as JSON").action(async (name, opts, cmd) => {
   let since;
   if (opts.since !== void 0) {
     const t = Date.parse(opts.since);
@@ -1955,7 +2010,7 @@ function money(amount, currency) {
 }
 function block(u) {
   const estimated = u.estimatedStops === 0 ? "" : color.dim(` (${u.estimatedStops} stop time${u.estimatedStops === 1 ? "" : "s"} estimated)`);
-  const rows = [
+  const rows2 = [
     ["name", boxName(u.name)],
     ["status", status(u.status)],
     ["window", `${day(u.window.from)} to ${day(u.window.to)}`],
@@ -1967,17 +2022,17 @@ function block(u) {
     ["ram GiB-h", hours(u.ramGibHours)],
     ["disk GiB-h", hours(u.diskGibHours)]
   ];
-  if (u.cost !== void 0) rows.push(["cost", `${money(u.cost.amount, u.cost.currency)} ${color.dim("(estimated)")}`]);
+  if (u.cost !== void 0) rows2.push(["cost", `${money(u.cost.amount, u.cost.currency)} ${color.dim("(estimated)")}`]);
   if (u.historyFrom !== null && u.historyFrom > u.window.from) {
-    rows.push(["history", color.dim(`from ${u.historyFrom.slice(0, 16).replace("T", " ")} UTC; the box is older, but its time before that was not recorded`)]);
+    rows2.push(["history", color.dim(`from ${u.historyFrom.slice(0, 16).replace("T", " ")} UTC; the box is older, but its time before that was not recorded`)]);
   }
-  const w = Math.max(...rows.map(([k]) => k.length));
-  return rows.map(([k, v]) => `${" ".repeat(w - k.length)}${k}: ${v}`).join("\n") + "\n";
+  const w = Math.max(...rows2.map(([k]) => k.length));
+  return rows2.map(([k, v]) => `${" ".repeat(w - k.length)}${k}: ${v}`).join("\n") + "\n";
 }
 
 // src/commands/vm/wake.ts
-import { Command as Command23 } from "commander";
-var wakeCommand = new Command23("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
+import { Command as Command24 } from "commander";
+var wakeCommand = new Command24("wake").description("continue a hibernated box where it left off (same name, IP and disk)").argument("<name>", "box name").option("--json", "print the box as JSON").action(async (name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const box = await spin(`waking ${name} (loading its memory from disk)\u2026`, client.wakeMachine(name));
@@ -1989,15 +2044,15 @@ var wakeCommand = new Command23("wake").description("continue a hibernated box w
 });
 
 // src/commands/vm/index.ts
-var vmCommand = new Command24("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(proxyCommand).addCommand(rmCommand2);
+var vmCommand = new Command25("vm").enablePositionalOptions().description("manage boxes (each one is a Firecracker microVM)").addCommand(newCommand).addCommand(forkCommand).addCommand(lsCommand).addCommand(connectCommand).addCommand(execCommand).addCommand(stopCommand).addCommand(startCommand).addCommand(pauseCommand).addCommand(resumeCommand).addCommand(hibernateCommand).addCommand(wakeCommand).addCommand(updateCommand).addCommand(rescaleCommand).addCommand(setCommand).addCommand(usageCommand).addCommand(topCommand).addCommand(proxyCommand).addCommand(rmCommand2);
 for (const cmd of vmCommand.commands) if (cmd !== proxyCommand) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 var vmAliases = [newCommand, lsCommand, connectCommand, execCommand, stopCommand, startCommand, pauseCommand, resumeCommand, hibernateCommand, wakeCommand, rmCommand2, claimCommand];
 
 // src/commands/server/index.ts
-import { Command as Command32 } from "commander";
+import { Command as Command33 } from "commander";
 
 // src/commands/server/join.ts
-import { Command as Command25 } from "commander";
+import { Command as Command26 } from "commander";
 
 // src/commands/server/daemon.ts
 import { spawn as spawn3 } from "child_process";
@@ -2034,7 +2089,7 @@ async function restartLocalServer(p = paths()) {
   return (await startLocalServer(p)).pid;
 }
 function runKvboxServer(args) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn3("kvbox-server", args, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let err = "";
@@ -2044,14 +2099,14 @@ function runKvboxServer(args) {
       reject(new KvboxError(e.code === "ENOENT" ? NOT_A_HOST_HINT : `could not run kvbox-server: ${e.message}`));
     });
     child.once("close", (code) => {
-      if (code === 0) resolve2(out.trimEnd());
+      if (code === 0) resolve3(out.trimEnd());
       else reject(new KvboxError(err.trim().replace(/^error: /, "") || `kvbox-server ${args[0] ?? ""} exited with code ${String(code)}`, code === 2 ? 2 : 1));
     });
   });
 }
 
 // src/commands/server/join.ts
-var joinCommand = new Command25("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
+var joinCommand = new Command26("join").description("put this machine behind a control plane (needs a one-time token minted there) and restart its server").argument("<control-plane-url>", "the control plane, e.g. https://api.kvbox.sh").requiredOption("--token <token>", "one-time join token from the control plane").option("--advertise <host-or-ip>", "address the control plane reaches this machine at (default: its default-route address)").option("--name <name>", "how the control plane lists this machine (default: hostname)").action(async (url, opts) => {
   const args = ["join", url, "--token", opts.token];
   if (opts.advertise !== void 0) args.push("--advertise", opts.advertise);
   if (opts.name !== void 0) args.push("--name", opts.name);
@@ -2061,8 +2116,8 @@ var joinCommand = new Command25("join").description("put this machine behind a c
 });
 
 // src/commands/server/leave.ts
-import { Command as Command26 } from "commander";
-var leaveCommand = new Command26("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
+import { Command as Command27 } from "commander";
+var leaveCommand = new Command27("leave").description("take this machine out from behind its control plane and restart its server").action(async () => {
   const p = paths();
   for (const line of (await runKvboxServer(["leave"])).split("\n")) info(line);
   if (await runningPid(p) === null) return;
@@ -2071,14 +2126,14 @@ var leaveCommand = new Command26("leave").description("take this machine out fro
 });
 
 // src/commands/server/relay.ts
-import { Command as Command27 } from "commander";
-var relayCommand = new Command27("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
+import { Command as Command28 } from "commander";
+var relayCommand = new Command28("relay").description("reach the internet through a relay (paste what `kvbox-relay add` printed on the relay VM); `off` takes the tunnel down").argument("<join-string>", "the line `kvbox-relay add` printed, or `off`").action(async (joinString) => {
   for (const line of (await runKvboxServer(["relay", joinString])).split("\n")) info(line);
 });
 
 // src/commands/server/start.ts
-import { Command as Command28 } from "commander";
-var startCommand2 = new Command28("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
+import { Command as Command29 } from "commander";
+var startCommand2 = new Command29("start").description("start the local kvbox-server in the background").action(async (_opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true }, { autoStart: false });
   try {
     const health = await client.health();
@@ -2094,8 +2149,8 @@ var startCommand2 = new Command28("start").description("start the local kvbox-se
 });
 
 // src/commands/server/status.ts
-import { Command as Command29 } from "commander";
-var statusCommand = new Command29("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command30 } from "commander";
+var statusCommand = new Command30("status").description("show whether this machine's server is running, its control plane and which base image new boxes get").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
   try {
     const health = await client.health();
@@ -2127,8 +2182,8 @@ var statusCommand = new Command29("status").description("show whether this machi
 });
 
 // src/commands/server/stop.ts
-import { Command as Command30 } from "commander";
-var stopCommand2 = new Command30("stop").description("stop the local server (running boxes are not affected)").action(async () => {
+import { Command as Command31 } from "commander";
+var stopCommand2 = new Command31("stop").description("stop the local server (running boxes are not affected)").action(async () => {
   const pid = await runningPid(paths());
   if (pid === null) throw new KvboxError("kvbox-server is not running");
   await stopLocalServer(pid);
@@ -2136,8 +2191,8 @@ var stopCommand2 = new Command30("stop").description("stop the local server (run
 });
 
 // src/commands/server/trust-ca.ts
-import { Command as Command31 } from "commander";
-var trustCaCommand = new Command31("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
+import { Command as Command32 } from "commander";
+var trustCaCommand = new Command32("trust-ca").description("make every cloud box on this machine trust a new SSH CA (after `ca rotate` on the control plane)").argument("[public-key]", "the CA public key (or its cert-authority line); or --from-cloud").option("--from-cloud", "ask the control plane this host joined for its current CA, show the fingerprint, then ask").option("-y, --yes", "do not ask for confirmation").option("--json", "print the report as JSON").action(async (publicKey, opts, cmd) => {
   if (publicKey === void 0 && !opts.fromCloud) throw new KvboxError("give the CA public key, or --from-cloud to fetch it from the control plane this host joined");
   if (publicKey !== void 0 && opts.fromCloud) throw new KvboxError("either a public key or --from-cloud, not both");
   const client = await clientFor({ ...cmd.optsWithGlobals(), local: true });
@@ -2175,16 +2230,140 @@ function describeReport(report) {
 }
 
 // src/commands/server/index.ts
-var serverCommand = new Command32("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
+var serverCommand = new Command33("server").description("run or manage the kvbox server").addCommand(startCommand2).addCommand(statusCommand).addCommand(stopCommand2).addCommand(joinCommand).addCommand(leaveCommand).addCommand(relayCommand).addCommand(trustCaCommand);
 
 // src/commands/login.ts
 import { spawnSync as spawnSync3 } from "child_process";
 import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
 import { hostname as osHostname } from "os";
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 import { Writable } from "stream";
-import { Command as Command33 } from "commander";
-var loginCommand = new Command33("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
+import { Command as Command34 } from "commander";
+
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+function interactive() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+var ESC = "\x1B";
+var ENTER = "\r";
+var CTRL_C = "";
+var CTRL_D = "";
+var cancelled = () => new KvboxError("cancelled", 130);
+function keysIn(chunk) {
+  const keys = [];
+  for (let i = 0; i < chunk.length; ) {
+    if (chunk[i] === ESC && (chunk[i + 1] === "[" || chunk[i + 1] === "O") && i + 2 < chunk.length) {
+      keys.push(chunk.slice(i, i + 3));
+      i += 3;
+    } else {
+      keys.push(chunk[i]);
+      i += 1;
+    }
+  }
+  return keys;
+}
+var isUp = (k) => k === `${ESC}[A` || k === `${ESC}OA` || k === "k";
+var isDown = (k) => k === `${ESC}[B` || k === `${ESC}OB` || k === "j";
+var ANSI2 = /\x1b\[[0-9;]*[A-Za-z]/g;
+function rows(line, columns = process.stderr.columns ?? 80) {
+  const width2 = line.replace(ANSI2, "").length;
+  return Math.max(1, Math.ceil(width2 / Math.max(1, columns)));
+}
+function settled(message, answer) {
+  return `${color.green("\u2713")} ${color.bold(message)}  ${color.cyan(answer)}`;
+}
+async function select(message, choices, initial = 0) {
+  const out = process.stderr;
+  const inp = process.stdin;
+  let index = Math.min(Math.max(initial, 0), choices.length - 1);
+  let drawn = 0;
+  const render = () => {
+    if (drawn > 0) out.write(`${ESC}[${drawn}A`);
+    const lines = [
+      `${color.green("?")} ${color.bold(message)} ${color.dim("\u2191\u2193 to move, enter to pick")}`,
+      ...choices.map((c, i) => {
+        const hint = c.hint ? color.dim(`  ${c.hint}`) : "";
+        return i === index ? `${color.cyan(`\u276F ${c.label}`)}${hint}` : `  ${c.label}${hint}`;
+      })
+    ];
+    out.write(`\r${ESC}[J${lines.join("\n")}
+`);
+    drawn = lines.reduce((n, l) => n + rows(l), 0);
+  };
+  inp.setRawMode(true);
+  inp.resume();
+  inp.setEncoding("utf8");
+  render();
+  let done = false;
+  try {
+    return await new Promise((resolve3, reject) => {
+      const onData = (chunk) => {
+        for (const key of keysIn(chunk)) {
+          if (isUp(key)) index = (index - 1 + choices.length) % choices.length;
+          else if (isDown(key)) index = (index + 1) % choices.length;
+          else if (key === ENTER || key === "\n") {
+            inp.off("data", onData);
+            done = true;
+            resolve3(choices[index].value);
+            return;
+          } else if (key === CTRL_C || key === CTRL_D) {
+            inp.off("data", onData);
+            reject(cancelled());
+            return;
+          } else continue;
+          render();
+        }
+      };
+      inp.on("data", onData);
+    });
+  } finally {
+    inp.setRawMode(false);
+    inp.pause();
+    out.write(`${ESC}[${drawn}A\r${ESC}[J${done ? `${settled(message, choices[index].label)}
+` : ""}`);
+  }
+}
+async function text(message, opts = {}) {
+  const out = process.stderr;
+  for (; ; ) {
+    const hint = opts.default !== void 0 ? ` ${color.dim(`(${opts.default})`)}` : "";
+    const question = `${color.green("?")} ${color.bold(message)}${hint} ${color.dim("\u203A")} `;
+    const rl = createInterface({ input: process.stdin, output: out });
+    const raw = (await askLine(rl, question)).trim();
+    const answer = raw === "" && opts.default !== void 0 ? opts.default : raw;
+    const problem = opts.validate?.(answer);
+    out.write(`${ESC}[${rows(question + raw)}A\r${ESC}[J`);
+    if (problem === void 0) {
+      out.write(`${settled(message, answer)}
+`);
+      return answer;
+    }
+    out.write(`${color.yellow("!")} ${problem}
+`);
+  }
+}
+async function askLine(rl, question) {
+  let onClose = () => {
+  };
+  const closed = new Promise((_, reject) => {
+    onClose = () => reject(cancelled());
+    rl.once("close", onClose);
+  });
+  try {
+    return await Promise.race([rl.question(question).catch(abortIsCancel), closed]);
+  } finally {
+    rl.off("close", onClose);
+    rl.close();
+  }
+}
+function abortIsCancel(err) {
+  if (err.code === "ABORT_ERR") throw cancelled();
+  throw err;
+}
+
+// src/commands/login.ts
+var loginCommand = new Command34("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
   const session = await runLogin(url, creds, paths());
@@ -2240,39 +2419,21 @@ async function ensureSshKey(p = paths(), hostname = osHostname()) {
   return (await readFile5(pubPath, "utf8")).trim();
 }
 async function prompt(question, io) {
-  const rl = createInterface({ input: io.input, output: io.output });
-  return (await ask(rl, question)).trim();
+  const rl = createInterface2({ input: io.input, output: io.output });
+  return (await askLine(rl, question)).trim();
 }
 async function promptSecret(question, io) {
   const sink = new Writable({ write: (_chunk, _enc, cb) => cb() });
-  const rl = createInterface({ input: io.input, output: sink, terminal: true });
+  const rl = createInterface2({ input: io.input, output: sink, terminal: true });
   io.output.write(question);
   try {
-    return await ask(rl, question);
+    return await askLine(rl, question);
   } finally {
     io.output.write("\n");
   }
 }
-async function ask(rl, question) {
-  let onClose = () => {
-  };
-  const closed = new Promise((_, reject) => {
-    onClose = () => reject(new KvboxError("cancelled", 130));
-    rl.once("close", onClose);
-  });
-  try {
-    return await Promise.race([rl.question(question).catch(cancelled), closed]);
-  } finally {
-    rl.off("close", onClose);
-    rl.close();
-  }
-}
-function cancelled(err) {
-  if (err.code === "ABORT_ERR") throw new KvboxError("cancelled", 130);
-  throw err;
-}
 async function firstLine(stream) {
-  const rl = createInterface({ input: stream });
+  const rl = createInterface2({ input: stream });
   try {
     for await (const line of rl) return line.trim();
     return "";
@@ -2282,8 +2443,8 @@ async function firstLine(stream) {
 }
 
 // src/commands/logout.ts
-import { Command as Command34 } from "commander";
-var logoutCommand = new Command34("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
+import { Command as Command35 } from "commander";
+var logoutCommand = new Command35("logout").description("log out of the control plane; commands target this machine's kvbox-server again").action(async () => {
   const p = paths();
   const session = await readSession(p).catch(() => null);
   switch (await runLogout(p)) {
@@ -2320,8 +2481,8 @@ async function runLogout(p = paths()) {
 }
 
 // src/commands/whoami.ts
-import { Command as Command35 } from "commander";
-var whoamiCommand = new Command35("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
+import { Command as Command36 } from "commander";
+var whoamiCommand = new Command36("whoami").description("show which account and control plane commands target (or local mode)").option("--json", "print as JSON").action(async (opts) => {
   const session = await readSession();
   if (opts.json) {
     json(session ? { user: session.user, url: session.url, sshCertExpires: session.sshCertExpires ?? null } : null);
@@ -2337,11 +2498,11 @@ function describeSession(session) {
 }
 
 // src/commands/snapshots/index.ts
-import { Command as Command39 } from "commander";
+import { Command as Command40 } from "commander";
 
 // src/commands/snapshots/ls.ts
-import { Command as Command36 } from "commander";
-var lsCommand3 = new Command36("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command37 } from "commander";
+var lsCommand3 = new Command37("ls").description("list snapshots (yours and your orgs'; --org <slug> for one org)").option("-a, --all", "every snapshot on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const cloud = client.target.kind === "cloud";
@@ -2372,8 +2533,8 @@ var lsCommand3 = new Command36("ls").description("list snapshots (yours and your
 });
 
 // src/commands/snapshots/new.ts
-import { Command as Command37 } from "commander";
-var newCommand2 = new Command37("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
+import { Command as Command38 } from "commander";
+var newCommand2 = new Command38("new").description("freeze a running box (memory + disk) into a snapshot; the box keeps running").argument("<box>", "box name").argument("<name>", "snapshot name").option("--json", "print the snapshot as JSON").action(async (box, name, opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     const snap = await spin(`saving snapshot ${name} from box ${box} (memory + disk)\u2026`, client.createSnapshot({ box, name }));
@@ -2385,8 +2546,8 @@ var newCommand2 = new Command37("new").description("freeze a running box (memory
 });
 
 // src/commands/snapshots/rm.ts
-import { Command as Command38 } from "commander";
-var rmCommand3 = new Command38("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
+import { Command as Command39 } from "commander";
+var rmCommand3 = new Command39("rm").description("delete a snapshot (boxes made from it are not affected)").argument("<name>", "snapshot name").option("-y, --yes", "do not ask for confirmation").action(async (name, opts, cmd) => {
   if (!await confirm(`Delete snapshot ${name}?`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2402,14 +2563,14 @@ var rmCommand3 = new Command38("rm").description("delete a snapshot (boxes made
 });
 
 // src/commands/snapshots/index.ts
-var snapshotsCommand = new Command39("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand3).addCommand(rmCommand3);
+var snapshotsCommand = new Command40("snapshots").aliases(["snapshot", "snap"]).description("freeze running boxes into snapshots and manage them").addCommand(newCommand2).addCommand(lsCommand3).addCommand(rmCommand3);
 for (const cmd of snapshotsCommand.commands) cmd.option("--org <slug>", "act in this org (- for your personal boxes)");
 
 // src/commands/org/index.ts
-import { Command as Command45 } from "commander";
+import { Command as Command46 } from "commander";
 
 // src/commands/org/ls.ts
-import { Command as Command40 } from "commander";
+import { Command as Command41 } from "commander";
 
 // src/commands/org/context.ts
 var NOT_LOGGED_IN = "orgs live on the control plane: kvbox login first";
@@ -2429,7 +2590,7 @@ function orgFor(opts, target) {
 }
 
 // src/commands/org/ls.ts
-var lsCommand4 = new Command40("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
+var lsCommand4 = new Command41("ls").description("list the orgs you belong to and your role in each").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const orgs = await client.listOrgs();
@@ -2451,8 +2612,8 @@ function orgRows(orgs) {
 }
 
 // src/commands/org/members.ts
-import { Command as Command41, Option as Option3 } from "commander";
-var lsCommand5 = new Command41("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command42, Option as Option4 } from "commander";
+var lsCommand5 = new Command42("ls").description("list an org's members and their roles").option("-o, --org <slug>", "the org (or --org before the command)").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.getOrg(orgFor(opts, client.target));
@@ -2466,7 +2627,7 @@ var lsCommand5 = new Command41("ls").description("list an org's members and thei
     await client.close();
   }
 });
-var addCommand2 = new Command41("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option3("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
+var addCommand2 = new Command42("add").description("add a user to an org (admins and owners; only an owner can add an owner)").argument("<user>", "their username").addOption(new Option4("-r, --role <role>", "their role").choices(ORG_ROLES).default("member")).option("-o, --org <slug>", "the org (or --org before the command)").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2476,7 +2637,7 @@ var addCommand2 = new Command41("add").description("add a user to an org (admins
     await client.close();
   }
 });
-var rmCommand4 = new Command41("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
+var rmCommand4 = new Command42("rm").description("remove a member (or leave: remove yourself)").argument("<user>", "their username").option("-o, --org <slug>", "the org (or --org before the command)").option("-y, --yes", "do not ask for confirmation").action(async (user, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2492,11 +2653,11 @@ var rmCommand4 = new Command41("rm").description("remove a member (or leave: rem
     await client.close();
   }
 });
-var membersCommand = new Command41("members").description("who is in an org and what they may do").addCommand(lsCommand5).addCommand(addCommand2).addCommand(rmCommand4);
+var membersCommand = new Command42("members").description("who is in an org and what they may do").addCommand(lsCommand5).addCommand(addCommand2).addCommand(rmCommand4);
 
 // src/commands/org/new.ts
-import { Command as Command42 } from "commander";
-var newCommand3 = new Command42("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
+import { Command as Command43 } from "commander";
+var newCommand3 = new Command43("new").description("create an org; you become its owner (the slug is permanent, the name is not)").argument("<slug>", "the org's slug: lowercase, like a username (acme)").option("-n, --name <name>", "display name (default: the slug)").option("--json", "print the org as JSON").action(async (slug, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const org = await client.createOrg({ slug, name: opts.name ?? slug });
@@ -2512,8 +2673,8 @@ var newCommand3 = new Command42("new").description("create an org; you become it
 });
 
 // src/commands/org/rm.ts
-import { Command as Command43 } from "commander";
-var rmCommand5 = new Command43("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
+import { Command as Command44 } from "commander";
+var rmCommand5 = new Command44("rm").description("delete an org (owners only; remove its boxes and snapshots first)").argument("<slug>", "the org").option("-y, --yes", "do not ask for confirmation").action(async (slug, opts, cmd) => {
   if (!await confirm(`Delete org ${slug}? Its members lose access; its slug stays taken.`, opts.yes ?? false)) {
     info("cancelled");
     process.exitCode = 1;
@@ -2529,8 +2690,8 @@ var rmCommand5 = new Command43("rm").description("delete an org (owners only; re
 });
 
 // src/commands/org/role.ts
-import { Argument, Command as Command44 } from "commander";
-var roleCommand = new Command44("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
+import { Argument, Command as Command45 } from "commander";
+var roleCommand = new Command45("role").description("change a member's role (owners only)").argument("<user>", "their username").addArgument(new Argument("<role>", "owner, admin or member").choices(ORG_ROLES)).option("-o, --org <slug>", "the org (default: the current context)").action(async (user, role, opts, cmd) => {
   const client = await cloudClientFor(cmd.optsWithGlobals());
   try {
     const slug = orgFor(opts, client.target);
@@ -2542,11 +2703,45 @@ var roleCommand = new Command44("role").description("change a member's role (own
 });
 
 // src/commands/org/index.ts
-var orgCommand = new Command45("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand4).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand5);
+var orgCommand = new Command46("org").description("orgs: shared slugs that own boxes, with owners, admins and members").addCommand(lsCommand4).addCommand(newCommand3).addCommand(membersCommand).addCommand(roleCommand).addCommand(rmCommand5);
 
 // src/commands/usage.ts
-import { Command as Command46 } from "commander";
-var usageCommand2 = new Command46("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command47 } from "commander";
+
+// ../shared/src/usage.ts
+import { z as z4 } from "zod";
+var PricingSchema = z4.object({
+  currency: z4.string().min(1),
+  vcpuHour: z4.number().nonnegative(),
+  ramGibHour: z4.number().nonnegative(),
+  diskGibHour: z4.number().nonnegative()
+});
+var round = (n, places) => Math.round(n * 10 ** places) / 10 ** places;
+function costOf(t, pricing) {
+  return t.vcpuHours * pricing.vcpuHour + t.ramGibHours * pricing.ramGibHour + t.diskGibHours * pricing.diskGibHour;
+}
+function sumUsage(items, pricing) {
+  const sum = {
+    seconds: { running: 0, standby: 0, hibernated: 0, stopped: 0 },
+    vcpuHours: 0,
+    ramGibHours: 0,
+    diskGibHours: 0
+  };
+  for (const t of items) {
+    for (const s of Object.keys(sum.seconds)) sum.seconds[s] += t.seconds[s];
+    sum.vcpuHours += t.vcpuHours;
+    sum.ramGibHours += t.ramGibHours;
+    sum.diskGibHours += t.diskGibHours;
+  }
+  sum.vcpuHours = round(sum.vcpuHours, 3);
+  sum.ramGibHours = round(sum.ramGibHours, 3);
+  sum.diskGibHours = round(sum.diskGibHours, 3);
+  if (pricing !== void 0) sum.cost = { amount: round(costOf(sum, pricing), 4), currency: pricing.currency };
+  return sum;
+}
+
+// src/commands/usage.ts
+var usageCommand2 = new Command47("usage").description("what your boxes used this month (or --since/--until): running time, vCPU-h, RAM and disk GiB-h, cost").option("--since <date>", "count from this date, e.g. 2026-10-01 (default: the 1st of this month)").option("--until <date>", "count up to this date (default: now)").option("--org <slug>", "one org's boxes only").option("-a, --all", "every box on the platform (platform admins only)").option("--by-user", "one line per user who made the boxes (e.g. who spent what in --org)").option("--json", "print as JSON").action(async (opts, cmd) => {
   for (const [name, value] of [
     ["since", opts.since],
     ["until", opts.until]
@@ -2556,15 +2751,17 @@ var usageCommand2 = new Command46("usage").description("what your boxes used thi
   const client = await clientFor(cmd.optsWithGlobals());
   try {
     if (client.target.kind === "local" && cmd.optsWithGlobals().org) throw new KvboxError("--org needs a control plane: kvbox login, or drop --org");
+    if (client.target.kind === "local" && opts.byUser) throw new KvboxError("--by-user needs a control plane: kvbox login, or drop --by-user");
     const report = await client.usageReport(opts.since, opts.until, opts.all);
+    const perUser = opts.byUser ? byUser(report) : void 0;
     if (opts.json) {
-      json(report);
+      json(perUser ?? report);
       return;
     }
     const cloud = client.target.kind === "cloud" ? { me: client.target.user } : void 0;
     info(`${day2(report.window.from)} to ${day2(report.window.to)}`);
     if (report.boxes.length === 0) info("no usage in this window");
-    else table(usageRows(report, cloud));
+    else table(perUser ? userRows(perUser) : usageRows(report, cloud));
     if (cloud) {
       const line = await creditLine(client, cloud.me);
       if (line !== void 0) info(line);
@@ -2594,7 +2791,7 @@ function ownerCell2(b, me2) {
 }
 function usageRows(report, cloud) {
   const priced = report.totals.cost !== void 0;
-  const rows = report.boxes.map((b) => ({
+  const rows2 = report.boxes.map((b) => ({
     ...cloud ? { owner: ownerCell2(b, cloud.me) } : {},
     name: boxName(b.name),
     status: b.status === "removed" ? color.dim("removed") : status(b.status),
@@ -2605,7 +2802,7 @@ function usageRows(report, cloud) {
     ...priced ? { cost: money(b.cost?.amount ?? 0, report.totals.cost.currency) } : {}
   }));
   const t = report.totals;
-  rows.push({
+  rows2.push({
     ...cloud ? { owner: "" } : {},
     name: color.bold("total"),
     status: "",
@@ -2615,12 +2812,52 @@ function usageRows(report, cloud) {
     "disk GiB-h": hours(t.diskGibHours),
     ...priced ? { cost: `${money(t.cost.amount, t.cost.currency)} ${color.dim("(estimated)")}` } : {}
   });
-  return rows;
+  return rows2;
+}
+function byUser(report) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const b of report.boxes) {
+    const user = b.createdBy ?? null;
+    const list = groups.get(user);
+    if (list === void 0) groups.set(user, [b]);
+    else list.push(b);
+  }
+  const currency = report.totals.cost?.currency;
+  const users = [...groups].map(([user, boxes]) => {
+    const { cost: _none, ...sum } = sumUsage(boxes);
+    const u = { user, boxes: boxes.length, ...sum };
+    if (currency !== void 0) u.cost = { amount: round(boxes.reduce((n, b) => n + (b.cost?.amount ?? 0), 0), 4), currency };
+    return u;
+  });
+  users.sort((a, b) => a.user === null ? 1 : b.user === null ? -1 : a.user.localeCompare(b.user));
+  return { window: report.window, users, totals: report.totals };
+}
+function userRows(r) {
+  const priced = r.totals.cost !== void 0;
+  const cells = (t) => ({
+    running: duration(t.seconds.running),
+    "vcpu-h": hours(t.vcpuHours),
+    "ram GiB-h": hours(t.ramGibHours),
+    "disk GiB-h": hours(t.diskGibHours)
+  });
+  const rows2 = r.users.map((u) => ({
+    user: u.user ?? color.dim("unknown"),
+    boxes: String(u.boxes),
+    ...cells(u),
+    ...priced ? { cost: money(u.cost?.amount ?? 0, r.totals.cost.currency) } : {}
+  }));
+  rows2.push({
+    user: color.bold("total"),
+    boxes: String(r.users.reduce((n, u) => n + u.boxes, 0)),
+    ...cells(r.totals),
+    ...priced ? { cost: `${money(r.totals.cost.amount, r.totals.cost.currency)} ${color.dim("(estimated)")}` } : {}
+  });
+  return rows2;
 }
 
 // src/commands/credit.ts
-import { Command as Command47 } from "commander";
-var creditCommand = new Command47("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
+import { Command as Command48 } from "commander";
+var creditCommand = new Command48("credit").description("the prepaid credit left on your account and on each of your orgs").option("--org <slug>", "one org only").option("--json", "print as JSON").action(async (opts, cmd) => {
   const client = await clientFor(cmd.optsWithGlobals(), { autoStart: false });
   try {
     if (client.target.kind === "local") throw new KvboxError("credit lives on the control plane: kvbox login first");
@@ -2647,9 +2884,375 @@ function creditRow(b, me2) {
   };
 }
 
+// src/commands/deploy/index.ts
+import { readFile as readFile7 } from "fs/promises";
+import { basename, resolve as resolve2 } from "path";
+import { Command as Command49, Option as Option5 } from "commander";
+
+// src/commands/deploy/config.ts
+import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { join as join3 } from "path";
+import { z as z5 } from "zod";
+
+// src/commands/deploy/templates/react.ts
+import { spawn as spawn4 } from "child_process";
+import { access } from "fs/promises";
+import { join as join2 } from "path";
+var OUT_DIRS = ["dist", "build"];
+async function packageManager(dir) {
+  const has = (f) => access(join2(dir, f)).then(() => true, () => false);
+  if (await has("pnpm-lock.yaml")) return "pnpm";
+  if (await has("yarn.lock")) return "yarn";
+  if (await has("bun.lockb") || await has("bun.lock")) return "bun";
+  return "npm";
+}
+async function runBuild(dir, pm) {
+  const args = pm === "yarn" ? ["build"] : ["run", "build"];
+  info(`${color.dim("$")} ${pm} ${args.join(" ")}`);
+  const status2 = await new Promise((resolve3, reject) => {
+    const child = spawn4(pm, args, { cwd: dir, stdio: ["ignore", process.stderr, process.stderr], shell: process.platform === "win32" });
+    child.once("error", (err) => reject(new KvboxError(`could not run ${pm}: ${err.message}`)));
+    child.once("close", (code) => resolve3(code ?? 1));
+  });
+  if (status2 !== 0) throw new KvboxError(`the build failed (${pm} exited ${status2}); nothing was deployed`);
+}
+var reactTemplate = {
+  id: "react",
+  label: "React",
+  hint: "static site: built here, served by nginx in the box",
+  port: 80,
+  /** A Vite or Create React App project. A framework with its own server (Next.js, Remix, Expo) is not a static site. */
+  detect(pkg) {
+    if (!pkg) return false;
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (!("react" in deps) || "next" in deps || "@remix-run/react" in deps || "expo" in deps) return false;
+    return "vite" in deps || "react-scripts" in deps;
+  },
+  async build(ctx) {
+    if (typeof ctx.pkg?.scripts?.["build"] !== "string") throw new KvboxError(`${ctx.dir}: package.json has no "build" script`);
+    await runBuild(ctx.dir, await packageManager(ctx.dir));
+    const candidates = ctx.dist !== void 0 ? [ctx.dist] : OUT_DIRS;
+    for (const dist of candidates) {
+      const outDir = join2(ctx.dir, dist);
+      if (await access(join2(outDir, "index.html")).then(() => true, () => false)) return { outDir, dist };
+    }
+    throw new KvboxError(
+      `the build left no ${candidates.join(" or ")}/index.html. The React template ships a directory of static files; set "dist" in kvbox.json to the build output directory, or pick the right template with --template`
+    );
+  },
+  /**
+   * The archive lands in a staging directory, which then becomes /srv/app/dist in one move; the
+   * old site is kept beside it until the new one is in place, so a failed step never leaves nginx
+   * without a root and a visitor never sees a half-copied site. Files get read permission for
+   * nginx's user, whatever umask the build ran under. /srv/app is the kvbox user's (image v0.8.0+);
+   * the missing site file means an older image.
+   */
+  remote() {
+    return [
+      "set -e",
+      "test -e /etc/nginx/sites-enabled/kvbox-app || exit 3",
+      "rm -rf /srv/app/.incoming /srv/app/.old",
+      "mkdir -p /srv/app/.incoming",
+      "tar -xf - -C /srv/app/.incoming",
+      "chmod -R a+rX /srv/app/.incoming",
+      "if [ -e /srv/app/dist ]; then mv /srv/app/dist /srv/app/.old; fi",
+      "mv /srv/app/.incoming /srv/app/dist",
+      "rm -rf /srv/app/.old",
+      "sudo -n systemctl enable --now --quiet nginx",
+      "sudo -n systemctl reload nginx"
+    ].join("\n");
+  }
+};
+
+// src/commands/deploy/templates/index.ts
+var TEMPLATES = [reactTemplate];
+var TEMPLATE_IDS = TEMPLATES.map((t) => t.id);
+function templateById(id) {
+  const t = TEMPLATES.find((x) => x.id === id);
+  if (!t) throw new Error(`no template ${id}`);
+  return t;
+}
+function detectTemplate(pkg) {
+  return TEMPLATES.find((t) => t.detect(pkg));
+}
+
+// src/commands/deploy/config.ts
+var CONFIG_FILE = "kvbox.json";
+var BOX_NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;
+var DeployConfigSchema = z5.object({
+  template: z5.enum(TEMPLATE_IDS),
+  name: z5.string().regex(BOX_NAME_RE, "1-12 chars, lowercase letters, digits and '-', starting with a letter or digit"),
+  /** The org whose box it is; absent for the user's own. */
+  org: z5.string().regex(ORG_SLUG_RE, "not an org slug").optional(),
+  /** The HTTPS name (`<subdomain>.kvbox.app`); absent when deploying to this machine's own host. */
+  subdomain: z5.string().check((ctx) => {
+    const problem = subdomainProblem(ctx.value);
+    if (problem) ctx.issues.push({ code: "custom", message: problem, input: ctx.value });
+  }).optional(),
+  size: z5.enum(SIZE_NAMES).optional(),
+  /** The build output directory, relative to the app; the template's default when absent. */
+  dist: z5.string().optional()
+});
+async function readConfig(dir) {
+  const path = join3(dir, CONFIG_FILE);
+  let raw;
+  try {
+    raw = await readFile6(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new KvboxError(`${path}: not valid JSON`);
+  }
+  const parsed = DeployConfigSchema.safeParse(json2);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new KvboxError(`${path}: ${issue.path.join(".") || "file"}: ${issue.message}`);
+  }
+  return parsed.data;
+}
+async function writeConfig(dir, config) {
+  await writeFile4(join3(dir, CONFIG_FILE), JSON.stringify(config, null, 2) + "\n");
+}
+function nameFromDir(dirName) {
+  const slug = dirName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 12).replace(/-+$/, "");
+  return slug === "" ? "app" : slug;
+}
+function subdomainFor(name) {
+  return subdomainProblem(name) === null ? name : `${name}-site`;
+}
+
+// src/commands/deploy/ship.ts
+import { spawn as spawn5 } from "child_process";
+import { readdir, stat as stat2 } from "fs/promises";
+import { join as join4 } from "path";
+var IMAGE_TOO_OLD = 3;
+var SSH_FAILED3 = 255;
+async function measure(dir) {
+  let files = 0;
+  let bytes = 0;
+  for (const entry of await readdir(dir, { recursive: true, withFileTypes: true })) {
+    if (!entry.isFile()) continue;
+    files += 1;
+    bytes += (await stat2(join4(entry.parentPath, entry.name))).size;
+  }
+  return { files, bytes };
+}
+async function ship(ep, dir, remote) {
+  const tar = spawn5("tar", ["-cf", "-", "-C", dir, "."], { stdio: ["ignore", "pipe", "pipe"] });
+  const ssh = spawn5("ssh", [...sshArgs(ep), remote], { stdio: ["pipe", "pipe", "pipe"] });
+  tar.stdout.pipe(ssh.stdin);
+  const chunks = [];
+  ssh.stdout.on("data", (c) => chunks.push(c));
+  ssh.stderr.on("data", (c) => chunks.push(c));
+  tar.stderr.on("data", (c) => chunks.push(c));
+  ssh.stdin.on("error", () => {
+  });
+  tar.stdout.on("error", () => {
+  });
+  tar.once("error", () => ssh.stdin.end());
+  tar.once("close", (code) => {
+    if (code !== 0) ssh.stdin.end();
+  });
+  const tarDone = new Promise((resolve3) => tar.once("close", () => resolve3()));
+  const status2 = await new Promise((resolve3, reject) => {
+    ssh.once("error", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));
+    ssh.once("close", (code, signal) => {
+      tar.stdout.unpipe(ssh.stdin);
+      tar.stdout.resume();
+      tar.kill();
+      resolve3(code ?? (signal === "SIGINT" ? 130 : 1));
+    });
+  });
+  await tarDone;
+  return { status: status2, output: Buffer.concat(chunks).toString("utf8") };
+}
+var shipping = { ship, measure, waitForSsh };
+
+// src/commands/deploy/index.ts
+var deployCommand = new Command49("deploy").description("put the app in this directory on a box with its own HTTPS address (React for now); redeploy by running it again").argument("[dir]", "the app's directory (default: the current one)").addOption(new Option5("-t, --template <template>", "what kind of app it is (detected from package.json when not given)").choices(TEMPLATE_IDS)).option("-n, --name <name>", "the box's name (default: the directory's name)").option("--sub <subdomain>", "its HTTPS name, https://<subdomain>.kvbox.app (default: the box's name)").addOption(new Option5("-s, --size <size>", "size of the box when it has to be made").choices(SIZE_NAMES)).option("-y, --yes", "ask nothing: take the defaults for whatever the flags and kvbox.json leave open").option("--json", "print the result as JSON").option("--org <slug>", "deploy into this org's boxes (saved to kvbox.json)").action(async (dirArg, opts, cmd) => {
+  const dir = resolve2(dirArg ?? ".");
+  const pkg = await readPackageJson(dir);
+  const saved = await readConfig(dir);
+  const globals = cmd.optsWithGlobals();
+  const orgFlag = orgOption(globals);
+  const org = orgFlag ?? saved?.org;
+  const client = await clientFor({ ...globals.local ? { local: true } : {}, ...org !== void 0 ? { org } : {} });
+  try {
+    const cloud = client.target.kind === "cloud";
+    if (!cloud && org !== void 0) throw new KvboxError("--org needs a control plane: kvbox login, or drop --org");
+    const { config, template, fresh } = await settle(dir, pkg, saved, opts, orgFlag, cloud);
+    if (cloud && config.subdomain !== void 0) await refuseOtherAddress(client, config);
+    await writeConfig(dir, config);
+    if (fresh) info(`  ${color.dim(`saved to ${CONFIG_FILE}; next time kvbox deploy asks nothing`)}
+`);
+    info(`${color.bold("Building")} ${color.cyan(config.name)} ${color.dim(`(${template.label})`)}`);
+    const built = await template.build({ dir, pkg, dist: config.dist });
+    if (built.dist !== config.dist) await writeConfig(dir, { ...config, dist: built.dist });
+    const size = await shipping.measure(built.outDir);
+    info("");
+    const { box: found, ref, created } = await findOrCreate(client, config);
+    const cert = await ensureCert(client, void 0, void 0, { owner: found.owner });
+    const wasRunning = !created && found.status === "running";
+    const box = created || wasRunning ? found : await wakeUp(client, found, ref);
+    const ep = sshEndpoint(box, client.target);
+    if (!wasRunning) await spin(`waiting for ${ref} to accept SSH\u2026`, shipping.waitForSsh(ep));
+    const shipIt = () => shipping.ship(ep, built.outDir, template.remote());
+    let result = await spin(`shipping ${built.dist}/ (${size.files} files, ${gb(size.bytes)}) to ${ref}\u2026`, shipIt);
+    if (result.status === SSH_FAILED3 && await renewAfterRefusal(client, cert, box.owner)) {
+      info("renewed your SSH certificate, trying again\u2026");
+      result = await spin(`shipping ${built.dist}/ to ${ref}\u2026`, shipIt);
+    }
+    if (result.status === SSH_FAILED3) throw new KvboxError(`box ${ref}: could not reach it over SSH (still booting?)${result.output ? `
+${result.output.trim()}` : ""}`, SSH_FAILED3);
+    if (result.status === IMAGE_TOO_OLD) {
+      throw new KvboxError(
+        `box ${ref} runs an image without nginx; ${template.label} needs base v0.8.0 or newer. Update the box (kvbox vm update ${ref}) once its host has the new image, or deploy under another name (--name) to get a fresh box`
+      );
+    }
+    if (result.status !== 0) throw new KvboxError(`deploying to ${ref} failed (exit ${result.status}):
+${result.output.trim()}`);
+    let url = `http://${box.ip}`;
+    if (cloud) {
+      const got = await address(client, box, ref, config, template);
+      url = got.url;
+      if (got.subdomain !== config.subdomain) await writeConfig(dir, { ...config, subdomain: got.subdomain, ...built.dist !== config.dist ? { dist: built.dist } : {} });
+    }
+    if (opts.json) {
+      json({ box: ref, created, template: template.id, url, dist: built.dist, files: size.files, bytes: size.bytes });
+      return;
+    }
+    process.stdout.write(`${url}
+`);
+    info(`${color.green("\u2713")} ${color.bold(config.name)} is live at ${color.bold(url)}`);
+    info(`  box ${ref}${created ? " (new)" : ""} \xB7 ${template.label} \xB7 ${size.files} files, ${gb(size.bytes)}`);
+    info(`  redeploy: kvbox deploy${dirArg !== void 0 ? ` ${dirArg}` : ""}`);
+  } finally {
+    await client.close();
+  }
+});
+async function readPackageJson(dir) {
+  try {
+    return JSON.parse(await readFile7(resolve2(dir, "package.json"), "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new KvboxError(`${resolve2(dir, "package.json")}: ${err.message}`);
+  }
+}
+async function settle(dir, pkg, saved, opts, orgFlag, cloud) {
+  const detected = detectTemplate(pkg);
+  if (opts.name !== void 0 && !BOX_NAME_RE.test(opts.name)) throw new KvboxError(`--name ${opts.name}: ${NAME_RULE}`);
+  if (opts.sub !== void 0) assertSubdomain(opts.sub);
+  const renamed = saved !== void 0 && (opts.name !== void 0 && opts.name !== saved.name || orgFlag !== void 0 && orgFlag !== saved.org);
+  const savedSub = renamed ? void 0 : saved?.subdomain;
+  const defaults = {
+    template: opts.template ?? saved?.template ?? detected?.id,
+    name: opts.name ?? saved?.name ?? nameFromDir(basename(dir)),
+    subdomain: opts.sub ?? savedSub,
+    size: opts.size ?? saved?.size ?? DEFAULT_SIZE
+  };
+  const open = {
+    template: opts.template === void 0 && saved?.template === void 0,
+    name: opts.name === void 0 && saved?.name === void 0,
+    subdomain: cloud && opts.sub === void 0 && savedSub === void 0,
+    size: opts.size === void 0 && saved === void 0
+  };
+  const anyOpen = open.template || open.name || open.subdomain || open.size;
+  const fresh = saved === void 0;
+  if (anyOpen && !opts.yes && !interactive()) {
+    const sub = defaults.subdomain ?? subdomainFor(defaults.name);
+    throw new KvboxError(
+      `kvbox deploy asks a few questions the first time, and this is not a terminal. Pass -y to take the defaults (${defaults.template ?? "template?"}, box ${defaults.name}${cloud ? `, https://${sub}.kvbox.app` : ""}, size ${defaults.size}), or answer with --template, --name${cloud ? ", --sub" : ""} and --size`
+    );
+  }
+  const ask = anyOpen && !opts.yes;
+  if (ask && fresh) info(`${color.bold("kvbox deploy")} ${color.dim(dir)}
+`);
+  let templateId = defaults.template;
+  if (open.template && ask) {
+    const initial = detected ? TEMPLATES.indexOf(detected) : 0;
+    templateId = await select("Template", TEMPLATES.map((t) => ({ value: t.id, label: t.label, hint: t === detected ? `${t.hint} \xB7 detected` : t.hint })), initial);
+  }
+  if (templateId === void 0) throw new KvboxError(`could not tell what kind of app ${dir} is (no package.json of a Vite or Create React App project): say it with --template ${TEMPLATE_IDS.join("|")}`);
+  const template = templateById(templateId);
+  let name = defaults.name;
+  if (open.name && ask) name = await text("Box name", { default: defaults.name, validate: (a) => BOX_NAME_RE.test(a) ? void 0 : NAME_RULE });
+  let subdomain = defaults.subdomain ?? (cloud ? subdomainFor(name) : void 0);
+  if (open.subdomain && ask) {
+    subdomain = await text("Address", {
+      default: subdomainFor(name),
+      validate: (a) => {
+        const problem = subdomainProblem(a);
+        return problem ? `that name ${problem}` : void 0;
+      }
+    });
+    info(`  ${color.dim(`https://${subdomain}.kvbox.app`)}`);
+  }
+  let size = defaults.size;
+  if (open.size && ask) {
+    size = await select("Box size", SIZE_NAMES.map((s) => ({ value: s, label: s, hint: `${SIZES[s].vcpu} vCPU, ${SIZES[s].memMib / 1024} GB RAM, ${SIZES[s].diskGib} GB disk` })), SIZE_NAMES.indexOf(DEFAULT_SIZE));
+  }
+  const org = orgFlag ?? saved?.org;
+  const config = {
+    template: template.id,
+    name,
+    ...org !== void 0 ? { org } : {},
+    ...subdomain !== void 0 ? { subdomain } : {},
+    size,
+    ...saved?.dist !== void 0 ? { dist: saved.dist } : {}
+  };
+  return { config, template, fresh };
+}
+var NAME_RULE = "1-12 chars, lowercase letters, digits and '-', starting with a letter or digit";
+async function findOrCreate(client, config) {
+  const user = me(client);
+  const slug = config.org ?? user;
+  const named = (await client.listMachines()).filter((b) => b.name === config.name);
+  let box = slug === void 0 ? named[0] : named.find((b) => slugOf(b.owner) === slug);
+  let created = false;
+  if (!box) {
+    box = await spin(`booting a new box ${config.name}\u2026`, client.createMachine({ name: config.name, ...config.size !== void 0 ? { size: config.size } : {} }));
+    created = true;
+    info(`${color.green("\u2713")} box ${color.bold(config.name)} is up: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`);
+  }
+  return { box, ref: displayName(box, user), created };
+}
+async function existingAddress(client, config) {
+  const slug = config.org ?? me(client);
+  return (await client.listSubdomains()).find((s) => s.box === config.name && s.owner === slug);
+}
+async function refuseOtherAddress(client, config) {
+  const have = await existingAddress(client, config);
+  if (!have || have.subdomain === config.subdomain) return;
+  const ref = config.org !== void 0 ? `${config.org}/${config.name}` : config.name;
+  throw new KvboxError(
+    `box ${ref} already answers at ${have.url}, not ${config.subdomain}. To keep the address: kvbox deploy --sub ${have.subdomain}. To move it: kvbox vm proxy release ${ref}, then deploy again`
+  );
+}
+async function address(client, box, ref, config, template) {
+  const have = (await client.listSubdomains()).find((s) => s.box === box.name && s.owner === slugOf(box.owner));
+  if (have) {
+    if (have.port !== template.port) await client.setSubdomainPort(ref, { port: template.port });
+    return { url: have.url, subdomain: have.subdomain };
+  }
+  const wanted = config.subdomain ?? subdomainFor(config.name);
+  try {
+    const sub = await spin(`claiming https://${wanted}.kvbox.app\u2026`, client.claimSubdomain(ref, { name: wanted, port: template.port }));
+    return { url: sub.url, subdomain: sub.subdomain };
+  } catch (err) {
+    if (!(err instanceof KvboxError)) throw err;
+    throw new KvboxError(`${err.message}
+the app is on box ${ref} but has no address yet: pick another with kvbox deploy --sub <name> (saved to ${CONFIG_FILE})`);
+  }
+}
+
 // src/program.ts
 function buildProgram() {
-  const program = new Command48("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command50("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);
@@ -2659,6 +3262,7 @@ function buildProgram() {
   program.addCommand(orgCommand);
   program.addCommand(usageCommand2);
   program.addCommand(creditCommand);
+  program.addCommand(deployCommand);
   for (const cmd of vmAliases) program.addCommand(cmd);
   return program;
 }