@kvbox/cli 0.5.19 → 0.5.21

package/dist/kvbox.js

@@ -26,10 +26,10 @@ function json(value) {
 }
 var ANSI = /\x1b\[[0-9;]*m/g;
 var width = (s) => s.replace(ANSI, "").length;
-function table(rows, columns) {
-  if (rows.length === 0) return;
-  const cols = columns ?? Object.keys(rows[0]);
-  const cells = rows.map((r) => cols.map((c) => String(r[c] ?? "")));
+function table(rows2, columns) {
+  if (rows2.length === 0) return;
+  const cols = columns ?? Object.keys(rows2[0]);
+  const cells = rows2.map((r) => cols.map((c) => String(r[c] ?? "")));
   const widths = cols.map((c, i) => Math.max(c.length, ...cells.map((r) => width(r[i]))));
   const line = (parts) => parts.map((p, i) => p + " ".repeat(Math.max(0, widths[i] - width(p)))).join("  ").trimEnd();
   process.stdout.write(color.dim(line(cols.map((c) => c.toUpperCase()))) + "\n");
@@ -47,8 +47,8 @@ async function confirm(question, yes) {
     warn("refusing without -y when stdin is not a terminal");
     return false;
   }
-  const { createInterface: createInterface2 } = await import("readline/promises");
-  const rl = createInterface2({ input: process.stdin, output: process.stderr });
+  const { createInterface: createInterface3 } = await import("readline/promises");
+  const rl = createInterface3({ input: process.stdin, output: process.stderr });
   try {
     const answer = (await rl.question(`${question} [y/N] `)).trim().toLowerCase();
     return answer === "y" || answer === "yes";
@@ -108,14 +108,14 @@ function slugOf(owner) {
   const at = owner.indexOf("@");
   return at === -1 ? owner : owner.slice(0, at);
 }
-function pickRef(items, text, me2, kind = "box") {
-  if (text.includes("/")) return items.find((i) => text === `${slugOf(i.owner)}/${i.name}` || text === `${i.owner}/${i.name}`);
-  const named = items.filter((i) => i.name === text);
+function pickRef(items, text2, me2, kind = "box") {
+  if (text2.includes("/")) return items.find((i) => text2 === `${slugOf(i.owner)}/${i.name}` || text2 === `${i.owner}/${i.name}`);
+  const named = items.filter((i) => i.name === text2);
   const own = named.find((i) => slugOf(i.owner) === me2);
   if (own) return own;
   const orgs = me2 === void 0 ? named : named.filter((i) => i.ownerKind !== "user");
   if (orgs.length <= 1) return orgs[0];
-  throw new AmbiguousRefError(kind, text, orgs.map((i) => slugOf(i.owner)));
+  throw new AmbiguousRefError(kind, text2, orgs.map((i) => slugOf(i.owner)));
 }
 function shortRef(ref, owner) {
   return ref.startsWith(`${owner}/`) ? ref.slice(owner.length + 1) : ref;
@@ -149,7 +149,7 @@ async function spin(message, work, opts = {}) {
 }
 
 // src/program.ts
-import { Command as Command49 } from "commander";
+import { Command as Command50 } from "commander";
 
 // ../shared/src/version.ts
 import { createRequire } from "module";
@@ -164,7 +164,7 @@ function versionOf(srcFileUrl, injected) {
 }
 
 // src/version.ts
-var VERSION = versionOf(import.meta.url, true ? "0.5.19" : void 0);
+var VERSION = versionOf(import.meta.url, true ? "0.5.21" : void 0);
 
 // src/commands/vm/index.ts
 import { Command as Command25 } from "commander";
@@ -271,15 +271,15 @@ var SessionSchema = z.object({
   sshCertPrincipals: z.array(z.string()).optional()
 });
 async function readSession(p = paths()) {
-  let text;
+  let text2;
   try {
-    text = await readFile(p.cli, "utf8");
+    text2 = await readFile(p.cli, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
   try {
-    return SessionSchema.parse(JSON.parse(text));
+    return SessionSchema.parse(JSON.parse(text2));
   } catch {
     throw new KvboxError(`${p.cli} is unreadable; run: kvbox logout (then log in again)`);
   }
@@ -370,13 +370,14 @@ import { z as z2 } from "zod";
 
 // ../shared/src/sizes.ts
 var SIZES = {
+  xs: { vcpu: 1, memMib: 2048, diskGib: 8 },
   s: { vcpu: 2, memMib: 4096, diskGib: 8 },
   m: { vcpu: 4, memMib: 8192, diskGib: 16 },
   l: { vcpu: 8, memMib: 16384, diskGib: 32 }
 };
 var SIZE_NAMES = Object.keys(SIZES);
-function parseMib(text) {
-  const m = /^\s*(\d+(?:\.\d+)?)\s*([gm]i?b?)?\s*$/i.exec(text);
+function parseMib(text2) {
+  const m = /^\s*(\d+(?:\.\d+)?)\s*([gm]i?b?)?\s*$/i.exec(text2);
   if (!m) return void 0;
   const n = Number(m[1]);
   const unit = (m[2] ?? "g").toLowerCase();
@@ -810,13 +811,13 @@ function serverLauncher(opts = {}) {
   return { cmd: "sg", args: [group, "-c", "kvbox-server start"], viaGroup: group };
 }
 function groupWithMember(gid, user, groupFile) {
-  let text;
+  let text2;
   try {
-    text = readFileSync(groupFile, "utf8");
+    text2 = readFileSync(groupFile, "utf8");
   } catch {
     return void 0;
   }
-  for (const line of text.split("\n")) {
+  for (const line of text2.split("\n")) {
     const [name, , id, members = ""] = line.split(":");
     if (name === void 0 || id === void 0 || Number.parseInt(id, 10) !== gid) continue;
     return members.split(",").includes(user) ? name : void 0;
@@ -831,13 +832,13 @@ import { resolve } from "path";
 var UNIT = "kvbox-server";
 var UNIT_FILE = `/etc/systemd/system/${UNIT}.service`;
 function hasUnitFor(p, file = UNIT_FILE) {
-  let text;
+  let text2;
   try {
-    text = readFileSync2(file, "utf8");
+    text2 = readFileSync2(file, "utf8");
   } catch {
     return false;
   }
-  const home = /^Environment="?KVBOX_HOME=([^"\n]+)"?$/m.exec(text)?.[1];
+  const home = /^Environment="?KVBOX_HOME=([^"\n]+)"?$/m.exec(text2)?.[1];
   return home !== void 0 && resolve(home) === resolve(p.home);
 }
 function startUnitProcess() {
@@ -912,10 +913,10 @@ var ServerClient = class {
       }
       throw new KvboxError(cloudDown(this.target.url, String(code)));
     }
-    const text = await res.body.text();
+    const text2 = await res.body.text();
     const where = this.target.kind === "cloud" ? hostOf(this.target.url) : "kvbox-server";
     if (res.statusCode >= 300) {
-      const parsed = ApiErrorSchema.safeParse(safeJson(text) ?? {});
+      const parsed = ApiErrorSchema.safeParse(safeJson(text2) ?? {});
       if (!parsed.success) throw new KvboxError(`${where} answered ${res.statusCode}`);
       if (this.target.kind === "cloud" && this.target.token !== "") {
         if (res.statusCode === 401) throw new KvboxError("session expired: kvbox login");
@@ -925,8 +926,8 @@ var ServerClient = class {
       }
       throw new KvboxError(parsed.data.error, res.statusCode === 501 ? 2 : 1);
     }
-    if (text === "") return schema.parse(void 0);
-    const json2 = safeJson(text);
+    if (text2 === "") return schema.parse(void 0);
+    const json2 = safeJson(text2);
     if (json2 === void 0) throw new KvboxError(`${where} answered ${res.statusCode} with something that is not JSON`);
     return schema.parse(json2);
   }
@@ -1097,9 +1098,9 @@ function cloudDown(url, code) {
   const hint = host.endsWith("kvbox.sh") ? "check status.kvbox.sh" : "use --local for this machine, or kvbox logout";
   return `${host} is not available or is down (${code}). You are logged in there, so kvbox talks to it instead of this machine; ${hint}`;
 }
-function safeJson(text) {
+function safeJson(text2) {
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
     return void 0;
   }
@@ -1119,10 +1120,10 @@ async function wakeUp(client, box, name) {
       return box;
   }
 }
-function boxesFor(client, text) {
-  const slash = text.indexOf("/");
+function boxesFor(client, text2) {
+  const slash = text2.indexOf("/");
   if (slash === -1 || client.target.kind !== "cloud") return client.listMachines();
-  return client.listMachines({ org: text.slice(0, slash).split("@")[0] });
+  return client.listMachines({ org: text2.slice(0, slash).split("@")[0] });
 }
 var me = (client) => client.target.kind === "cloud" ? client.target.user : void 0;
 async function clientFor(opts, client = {}) {
@@ -1154,17 +1155,17 @@ function sshArgs(ep, p = paths()) {
 async function waitForSsh(ep, timeoutMs = 3e4) {
   const { connect } = await import("net");
   const deadline = Date.now() + timeoutMs;
-  const attempt = () => new Promise((resolve2) => {
+  const attempt = () => new Promise((resolve3) => {
     const sock = connect({ host: ep.host, port: ep.port, timeout: 1e3 });
     sock.once("connect", () => {
       sock.destroy();
-      resolve2(true);
+      resolve3(true);
     });
     sock.once("timeout", () => {
       sock.destroy();
-      resolve2(false);
+      resolve3(false);
     });
-    sock.once("error", () => resolve2(false));
+    sock.once("error", () => resolve3(false));
   });
   while (Date.now() < deadline) {
     if (await attempt()) return;
@@ -1174,9 +1175,9 @@ async function waitForSsh(ep, timeoutMs = 3e4) {
 }
 var NOT_A_HOST_HINT = "kvbox-server is not installed, so this machine is not a kvbox host. Set it up with install-server.sh, or log in to the cloud with: kvbox login";
 async function lastErrorLine(logPath, from = 0) {
-  const { readFile: readFile6 } = await import("fs/promises");
-  const text = (await readFile6(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString("utf8");
-  const lines = text.trimEnd().split("\n").slice(-20).reverse();
+  const { readFile: readFile8 } = await import("fs/promises");
+  const text2 = (await readFile8(logPath).catch(() => Buffer.alloc(0))).subarray(from).toString("utf8");
+  const lines = text2.trimEnd().split("\n").slice(-20).reverse();
   return lines.find((l) => l.startsWith("error: "))?.slice("error: ".length);
 }
 async function startLocalServer(p = paths(), timeoutMs = 5e3) {
@@ -1276,10 +1277,10 @@ function autoHibernateText(sec) {
   return sec ? `hibernates after ${duration(sec)} without network traffic (kvbox connect wakes it)` : "never hibernates on its own";
 }
 var UNIT_SEC = { m: 60, h: 3600, d: 86400 };
-function parseIdleTimeout(text) {
-  const t = text.trim().toLowerCase();
+function parseIdleTimeout(text2) {
+  const t = text2.trim().toLowerCase();
   if (t === "off" || t === "never" || t === "0") return 0;
-  if (!/^(\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text}: give a duration like 30m, 4h or 1d, or off`);
+  if (!/^(\d+[mhd])+$/.test(t)) throw new KvboxError(`--auto-hibernate ${text2}: give a duration like 30m, 4h or 1d, or off`);
   let sec = 0;
   for (const [, n, unit] of t.matchAll(/(\d+)([mhd])/g)) sec += Number(n) * UNIT_SEC[unit];
   return sec;
@@ -1355,12 +1356,12 @@ async function runSsh(ssh, opts) {
     timedOut = true;
     child.kill("SIGTERM");
   }, opts.timeout * 1e3);
-  const status2 = await new Promise((resolve2, reject) => {
+  const status2 = await new Promise((resolve3, reject) => {
     child.once("error", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));
     child.once("close", (code, signal) => {
-      if (timedOut) resolve2(TIMEOUT_EXIT);
-      else if (code !== null) resolve2(code);
-      else resolve2(signal === "SIGINT" ? 130 : 1);
+      if (timedOut) resolve3(TIMEOUT_EXIT);
+      else if (code !== null) resolve3(code);
+      else resolve3(signal === "SIGINT" ? 130 : 1);
     });
   }).finally(() => clearTimeout(timer));
   return { status: status2, chunks, timedOut };
@@ -1539,26 +1540,26 @@ var RESERVED_SUBDOMAINS = /* @__PURE__ */ new Set([
   "support",
   "www"
 ]);
-function subdomainProblem(text) {
-  if (text.length < 3 || text.length > 63) return `"${text}" must be 3 to 63 characters`;
-  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
-  if (RESERVED_SUBDOMAINS.has(text)) return `"${text}" is reserved; pick another name`;
+function subdomainProblem(text2) {
+  if (text2.length < 3 || text2.length > 63) return `"${text2}" must be 3 to 63 characters`;
+  if (!LABEL_RE.test(text2)) return `"${text2}" may hold only lowercase letters, digits and '-', not at either end`;
+  if (RESERVED_SUBDOMAINS.has(text2)) return `"${text2}" is reserved; pick another name`;
   return null;
 }
-function routeNameProblem(text) {
-  if (text.length < 1 || text.length > 63) return `"${text}" must be 1 to 63 characters`;
-  if (!LABEL_RE.test(text)) return `"${text}" may hold only lowercase letters, digits and '-', not at either end`;
+function routeNameProblem(text2) {
+  if (text2.length < 1 || text2.length > 63) return `"${text2}" must be 1 to 63 characters`;
+  if (!LABEL_RE.test(text2)) return `"${text2}" may hold only lowercase letters, digits and '-', not at either end`;
   return null;
 }
-function assertSubdomain(text) {
-  const problem = subdomainProblem(text);
+function assertSubdomain(text2) {
+  const problem = subdomainProblem(text2);
   if (problem) throw new KvboxError(`subdomain ${problem}`);
-  return text;
+  return text2;
 }
-function assertRouteName(text) {
-  const problem = routeNameProblem(text);
+function assertRouteName(text2) {
+  const problem = routeNameProblem(text2);
   if (problem) throw new KvboxError(`name ${problem}`);
-  return text;
+  return text2;
 }
 
 // src/commands/vm/proxy/shared.ts
@@ -1587,9 +1588,9 @@ function parsePorts(texts) {
     return n;
   });
 }
-async function findBox(client, text) {
-  const found = pickRef(await boxesFor(client, text), text, me(client));
-  if (!found) throw new KvboxError(`box ${text}: not found (kvbox ls)`);
+async function findBox(client, text2) {
+  const found = pickRef(await boxesFor(client, text2), text2, me(client));
+  if (!found) throw new KvboxError(`box ${text2}: not found (kvbox ls)`);
   return found;
 }
 
@@ -1649,12 +1650,12 @@ var addCommand = new Command9("add").description("publish box ports on the inter
       return;
     }
     const updated = await spin(`publishing ${guestPorts.join(", ")} on ${name}\u2026`, client.addPorts(box, { ports: guestPorts.map((guestPort) => ({ guestPort, proto })) }));
-    const rows = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));
+    const rows2 = rowsOf(updated, user, (f) => f.proto === proto && guestPorts.includes(f.guestPort));
     if (opts.json) {
-      json(rows);
+      json(rows2);
       return;
     }
-    for (const row of rows) info(`${color.green("\u2713")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);
+    for (const row of rows2) info(`${color.green("\u2713")} box ${color.bold(row.box)} port ${row.guestPort} is reachable at ${reaches(row)} (${row.proto})`);
     if (updated.status !== "running") info(`  box ${name} is ${updated.status}: the ports open when it runs`);
   } finally {
     await client.close();
@@ -1681,16 +1682,16 @@ var lsCommand2 = new Command10("ls").description("list the box ports published o
     ]);
     const shown = new Set(boxes.map((b) => displayName(b, user)));
     const https = subs.flatMap((s) => httpsRowsOf(s, user)).filter((r) => shown.has(r.box));
-    const rows = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);
+    const rows2 = [...boxes.flatMap((b) => rowsOf(b, user)), ...https].sort((a, b) => a.box.localeCompare(b.box) || a.guestPort - b.guestPort);
     if (opts.json) {
-      json(rows);
+      json(rows2);
       return;
     }
-    if (rows.length === 0) {
+    if (rows2.length === 0) {
       info(name === void 0 ? "no published ports (kvbox vm proxy add <box> <port>)" : `box ${name} publishes no ports (kvbox vm proxy add ${name} <port>)`);
       return;
     }
-    table(rows.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === "https" ? r.url : reaches(r, true), proto: r.proto })));
+    table(rows2.map((r) => ({ box: r.box, port: r.guestPort, reaches: r.proto === "https" ? r.url : reaches(r, true), proto: r.proto })));
   } finally {
     await client.close();
   }
@@ -1802,19 +1803,19 @@ var rescaleCommand = new Command15("rescale").description("change a box's vCPUs,
     await client.close();
   }
 });
-function parseCount(text) {
-  const n = Number(text);
-  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text}: give a whole number of vCPUs`);
+function parseCount(text2) {
+  const n = Number(text2);
+  if (!Number.isInteger(n) || n < 1) throw new KvboxError(`--vcpu ${text2}: give a whole number of vCPUs`);
   return n;
 }
-function parseSize(flag, text) {
-  const mib = parseMib(text);
-  if (mib === void 0) throw new KvboxError(`${flag} ${text}: give a size like 16GB or 4096MB`);
+function parseSize(flag, text2) {
+  const mib = parseMib(text2);
+  if (mib === void 0) throw new KvboxError(`${flag} ${text2}: give a size like 16GB or 4096MB`);
   return mib;
 }
-function parseGib(flag, text) {
-  const mib = parseSize(flag, text);
-  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text}: disk sizes are whole GB`);
+function parseGib(flag, text2) {
+  const mib = parseSize(flag, text2);
+  if (mib % 1024 !== 0) throw new KvboxError(`${flag} ${text2}: disk sizes are whole GB`);
   return mib / 1024;
 }
 
@@ -2009,7 +2010,7 @@ function money(amount, currency) {
 }
 function block(u) {
   const estimated = u.estimatedStops === 0 ? "" : color.dim(` (${u.estimatedStops} stop time${u.estimatedStops === 1 ? "" : "s"} estimated)`);
-  const rows = [
+  const rows2 = [
     ["name", boxName(u.name)],
     ["status", status(u.status)],
     ["window", `${day(u.window.from)} to ${day(u.window.to)}`],
@@ -2021,12 +2022,12 @@ function block(u) {
     ["ram GiB-h", hours(u.ramGibHours)],
     ["disk GiB-h", hours(u.diskGibHours)]
   ];
-  if (u.cost !== void 0) rows.push(["cost", `${money(u.cost.amount, u.cost.currency)} ${color.dim("(estimated)")}`]);
+  if (u.cost !== void 0) rows2.push(["cost", `${money(u.cost.amount, u.cost.currency)} ${color.dim("(estimated)")}`]);
   if (u.historyFrom !== null && u.historyFrom > u.window.from) {
-    rows.push(["history", color.dim(`from ${u.historyFrom.slice(0, 16).replace("T", " ")} UTC; the box is older, but its time before that was not recorded`)]);
+    rows2.push(["history", color.dim(`from ${u.historyFrom.slice(0, 16).replace("T", " ")} UTC; the box is older, but its time before that was not recorded`)]);
   }
-  const w = Math.max(...rows.map(([k]) => k.length));
-  return rows.map(([k, v]) => `${" ".repeat(w - k.length)}${k}: ${v}`).join("\n") + "\n";
+  const w = Math.max(...rows2.map(([k]) => k.length));
+  return rows2.map(([k, v]) => `${" ".repeat(w - k.length)}${k}: ${v}`).join("\n") + "\n";
 }
 
 // src/commands/vm/wake.ts
@@ -2088,7 +2089,7 @@ async function restartLocalServer(p = paths()) {
   return (await startLocalServer(p)).pid;
 }
 function runKvboxServer(args) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     const child = spawn3("kvbox-server", args, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let err = "";
@@ -2098,7 +2099,7 @@ function runKvboxServer(args) {
       reject(new KvboxError(e.code === "ENOENT" ? NOT_A_HOST_HINT : `could not run kvbox-server: ${e.message}`));
     });
     child.once("close", (code) => {
-      if (code === 0) resolve2(out.trimEnd());
+      if (code === 0) resolve3(out.trimEnd());
       else reject(new KvboxError(err.trim().replace(/^error: /, "") || `kvbox-server ${args[0] ?? ""} exited with code ${String(code)}`, code === 2 ? 2 : 1));
     });
   });
@@ -2235,9 +2236,133 @@ var serverCommand = new Command33("server").description("run or manage the kvbox
 import { spawnSync as spawnSync3 } from "child_process";
 import { mkdir as mkdir3, readFile as readFile5, writeFile as writeFile3 } from "fs/promises";
 import { hostname as osHostname } from "os";
-import { createInterface } from "readline/promises";
+import { createInterface as createInterface2 } from "readline/promises";
 import { Writable } from "stream";
 import { Command as Command34 } from "commander";
+
+// src/prompt.ts
+import { createInterface } from "readline/promises";
+function interactive() {
+  return process.stdin.isTTY === true && process.stderr.isTTY === true;
+}
+var ESC = "\x1B";
+var ENTER = "\r";
+var CTRL_C = "";
+var CTRL_D = "";
+var cancelled = () => new KvboxError("cancelled", 130);
+function keysIn(chunk) {
+  const keys = [];
+  for (let i = 0; i < chunk.length; ) {
+    if (chunk[i] === ESC && (chunk[i + 1] === "[" || chunk[i + 1] === "O") && i + 2 < chunk.length) {
+      keys.push(chunk.slice(i, i + 3));
+      i += 3;
+    } else {
+      keys.push(chunk[i]);
+      i += 1;
+    }
+  }
+  return keys;
+}
+var isUp = (k) => k === `${ESC}[A` || k === `${ESC}OA` || k === "k";
+var isDown = (k) => k === `${ESC}[B` || k === `${ESC}OB` || k === "j";
+var ANSI2 = /\x1b\[[0-9;]*[A-Za-z]/g;
+function rows(line, columns = process.stderr.columns ?? 80) {
+  const width2 = line.replace(ANSI2, "").length;
+  return Math.max(1, Math.ceil(width2 / Math.max(1, columns)));
+}
+function settled(message, answer) {
+  return `${color.green("\u2713")} ${color.bold(message)}  ${color.cyan(answer)}`;
+}
+async function select(message, choices, initial = 0) {
+  const out = process.stderr;
+  const inp = process.stdin;
+  let index = Math.min(Math.max(initial, 0), choices.length - 1);
+  let drawn = 0;
+  const render = () => {
+    if (drawn > 0) out.write(`${ESC}[${drawn}A`);
+    const lines = [
+      `${color.green("?")} ${color.bold(message)} ${color.dim("\u2191\u2193 to move, enter to pick")}`,
+      ...choices.map((c, i) => {
+        const hint = c.hint ? color.dim(`  ${c.hint}`) : "";
+        return i === index ? `${color.cyan(`\u276F ${c.label}`)}${hint}` : `  ${c.label}${hint}`;
+      })
+    ];
+    out.write(`\r${ESC}[J${lines.join("\n")}
+`);
+    drawn = lines.reduce((n, l) => n + rows(l), 0);
+  };
+  inp.setRawMode(true);
+  inp.resume();
+  inp.setEncoding("utf8");
+  render();
+  let done = false;
+  try {
+    return await new Promise((resolve3, reject) => {
+      const onData = (chunk) => {
+        for (const key of keysIn(chunk)) {
+          if (isUp(key)) index = (index - 1 + choices.length) % choices.length;
+          else if (isDown(key)) index = (index + 1) % choices.length;
+          else if (key === ENTER || key === "\n") {
+            inp.off("data", onData);
+            done = true;
+            resolve3(choices[index].value);
+            return;
+          } else if (key === CTRL_C || key === CTRL_D) {
+            inp.off("data", onData);
+            reject(cancelled());
+            return;
+          } else continue;
+          render();
+        }
+      };
+      inp.on("data", onData);
+    });
+  } finally {
+    inp.setRawMode(false);
+    inp.pause();
+    out.write(`${ESC}[${drawn}A\r${ESC}[J${done ? `${settled(message, choices[index].label)}
+` : ""}`);
+  }
+}
+async function text(message, opts = {}) {
+  const out = process.stderr;
+  for (; ; ) {
+    const hint = opts.default !== void 0 ? ` ${color.dim(`(${opts.default})`)}` : "";
+    const question = `${color.green("?")} ${color.bold(message)}${hint} ${color.dim("\u203A")} `;
+    const rl = createInterface({ input: process.stdin, output: out });
+    const raw = (await askLine(rl, question)).trim();
+    const answer = raw === "" && opts.default !== void 0 ? opts.default : raw;
+    const problem = opts.validate?.(answer);
+    out.write(`${ESC}[${rows(question + raw)}A\r${ESC}[J`);
+    if (problem === void 0) {
+      out.write(`${settled(message, answer)}
+`);
+      return answer;
+    }
+    out.write(`${color.yellow("!")} ${problem}
+`);
+  }
+}
+async function askLine(rl, question) {
+  let onClose = () => {
+  };
+  const closed = new Promise((_, reject) => {
+    onClose = () => reject(cancelled());
+    rl.once("close", onClose);
+  });
+  try {
+    return await Promise.race([rl.question(question).catch(abortIsCancel), closed]);
+  } finally {
+    rl.off("close", onClose);
+    rl.close();
+  }
+}
+function abortIsCancel(err) {
+  if (err.code === "ABORT_ERR") throw cancelled();
+  throw err;
+}
+
+// src/commands/login.ts
 var loginCommand = new Command34("login").description("log in to the kvbox cloud (or your own control plane) and target it from now on").argument("[url]", `control plane URL (default: ${DEFAULT_CLOUD_URL})`).option("-e, --email <email>", "account email (prompted otherwise)").option("--password-stdin", "read the password from the first line of stdin (for scripts)").action(async (urlArg, opts) => {
   const url = normalizeUrl(urlArg ?? DEFAULT_CLOUD_URL);
   const creds = await readCredentials(opts);
@@ -2294,39 +2419,21 @@ async function ensureSshKey(p = paths(), hostname = osHostname()) {
   return (await readFile5(pubPath, "utf8")).trim();
 }
 async function prompt(question, io) {
-  const rl = createInterface({ input: io.input, output: io.output });
-  return (await ask(rl, question)).trim();
+  const rl = createInterface2({ input: io.input, output: io.output });
+  return (await askLine(rl, question)).trim();
 }
 async function promptSecret(question, io) {
   const sink = new Writable({ write: (_chunk, _enc, cb) => cb() });
-  const rl = createInterface({ input: io.input, output: sink, terminal: true });
+  const rl = createInterface2({ input: io.input, output: sink, terminal: true });
   io.output.write(question);
   try {
-    return await ask(rl, question);
+    return await askLine(rl, question);
   } finally {
     io.output.write("\n");
   }
 }
-async function ask(rl, question) {
-  let onClose = () => {
-  };
-  const closed = new Promise((_, reject) => {
-    onClose = () => reject(new KvboxError("cancelled", 130));
-    rl.once("close", onClose);
-  });
-  try {
-    return await Promise.race([rl.question(question).catch(cancelled), closed]);
-  } finally {
-    rl.off("close", onClose);
-    rl.close();
-  }
-}
-function cancelled(err) {
-  if (err.code === "ABORT_ERR") throw new KvboxError("cancelled", 130);
-  throw err;
-}
 async function firstLine(stream) {
-  const rl = createInterface({ input: stream });
+  const rl = createInterface2({ input: stream });
   try {
     for await (const line of rl) return line.trim();
     return "";
@@ -2684,7 +2791,7 @@ function ownerCell2(b, me2) {
 }
 function usageRows(report, cloud) {
   const priced = report.totals.cost !== void 0;
-  const rows = report.boxes.map((b) => ({
+  const rows2 = report.boxes.map((b) => ({
     ...cloud ? { owner: ownerCell2(b, cloud.me) } : {},
     name: boxName(b.name),
     status: b.status === "removed" ? color.dim("removed") : status(b.status),
@@ -2695,7 +2802,7 @@ function usageRows(report, cloud) {
     ...priced ? { cost: money(b.cost?.amount ?? 0, report.totals.cost.currency) } : {}
   }));
   const t = report.totals;
-  rows.push({
+  rows2.push({
     ...cloud ? { owner: "" } : {},
     name: color.bold("total"),
     status: "",
@@ -2705,7 +2812,7 @@ function usageRows(report, cloud) {
     "disk GiB-h": hours(t.diskGibHours),
     ...priced ? { cost: `${money(t.cost.amount, t.cost.currency)} ${color.dim("(estimated)")}` } : {}
   });
-  return rows;
+  return rows2;
 }
 function byUser(report) {
   const groups = /* @__PURE__ */ new Map();
@@ -2733,19 +2840,19 @@ function userRows(r) {
     "ram GiB-h": hours(t.ramGibHours),
     "disk GiB-h": hours(t.diskGibHours)
   });
-  const rows = r.users.map((u) => ({
+  const rows2 = r.users.map((u) => ({
     user: u.user ?? color.dim("unknown"),
     boxes: String(u.boxes),
     ...cells(u),
     ...priced ? { cost: money(u.cost?.amount ?? 0, r.totals.cost.currency) } : {}
   }));
-  rows.push({
+  rows2.push({
     user: color.bold("total"),
     boxes: String(r.users.reduce((n, u) => n + u.boxes, 0)),
     ...cells(r.totals),
     ...priced ? { cost: `${money(r.totals.cost.amount, r.totals.cost.currency)} ${color.dim("(estimated)")}` } : {}
   });
-  return rows;
+  return rows2;
 }
 
 // src/commands/credit.ts
@@ -2777,9 +2884,476 @@ function creditRow(b, me2) {
   };
 }
 
+// src/commands/deploy/index.ts
+import { readFile as readFile7 } from "fs/promises";
+import { basename, resolve as resolve2 } from "path";
+import { Command as Command49, Option as Option5 } from "commander";
+
+// src/commands/deploy/config.ts
+import { readFile as readFile6, writeFile as writeFile4 } from "fs/promises";
+import { join as join4 } from "path";
+import { z as z5 } from "zod";
+
+// src/commands/deploy/templates/pm.ts
+import { access } from "fs/promises";
+import { join as join2 } from "path";
+async function packageManager(dir) {
+  const has = (f) => access(join2(dir, f)).then(() => true, () => false);
+  if (await has("pnpm-lock.yaml")) return "pnpm";
+  if (await has("yarn.lock")) return "yarn";
+  if (await has("bun.lockb") || await has("bun.lock")) return "bun";
+  return "npm";
+}
+function runScript(pm, script) {
+  return pm === "yarn" ? [script] : ["run", script];
+}
+
+// src/commands/deploy/templates/nextjs.ts
+var APP_DIR = "/srv/app/current";
+var SERVICE = "kvbox-app";
+var PORT = 3e3;
+function commands(pm) {
+  switch (pm) {
+    case "pnpm":
+      return { setup: ["sudo -n corepack enable pnpm"], install: "pnpm install --frozen-lockfile", build: "pnpm run build", start: "pnpm run start" };
+    case "yarn":
+      return { setup: ["sudo -n corepack enable yarn"], install: "yarn install --frozen-lockfile", build: "yarn build", start: "yarn start" };
+    case "bun":
+      return { setup: [], install: "npm install", build: "npm run build", start: "npm run start" };
+    case "npm":
+      return { setup: [], install: "if [ -f package-lock.json ]; then npm ci; else npm install; fi", build: "npm run build", start: "npm run start" };
+  }
+}
+var nextjsTemplate = {
+  id: "nextjs",
+  label: "Next.js",
+  hint: "source shipped; installed, built and run in the box on port 3000",
+  size: "s",
+  port: PORT,
+  detect(pkg) {
+    if (!pkg) return false;
+    return "next" in { ...pkg.dependencies, ...pkg.devDependencies };
+  },
+  /** No local build: the box does it. Only the scripts it will need are checked here. */
+  async build(ctx) {
+    for (const script of ["build", "start"]) {
+      if (typeof ctx.pkg?.scripts?.[script] !== "string") throw new KvboxError(`${ctx.dir}: package.json has no "${script}" script; Next.js needs "build": "next build" and "start": "next start"`);
+    }
+    const pm = await packageManager(ctx.dir);
+    return { outDir: ctx.dir, exclude: ["node_modules", ".next", ".git"], pm, what: "the source" };
+  },
+  /**
+   * The source lands in a staging directory and is installed and built there while the old app
+   * keeps serving; only then is it swapped into place and the service restarted, so a failed
+   * install or build leaves the running app alone. The unit is rewritten every time, so a changed
+   * package manager or start script takes effect. /srv/app is the kvbox user's (image v0.8.0+).
+   */
+  remote(built) {
+    const c = commands(built.pm);
+    const unit = [
+      "[Unit]",
+      "Description=kvbox deploy: the app in " + APP_DIR,
+      "After=network.target",
+      "",
+      "[Service]",
+      "User=kvbox",
+      `WorkingDirectory=${APP_DIR}`,
+      `ExecStart=/usr/bin/env ${c.start}`,
+      `Environment=NODE_ENV=production PORT=${PORT}`,
+      "Restart=always",
+      "RestartSec=2",
+      "",
+      "[Install]",
+      "WantedBy=multi-user.target"
+    ];
+    return [
+      "set -e",
+      "test -d /srv/app -a -w /srv/app || exit 3",
+      "rm -rf /srv/app/.incoming /srv/app/.old",
+      "mkdir -p /srv/app/.incoming",
+      "tar -xf - -C /srv/app/.incoming",
+      "cd /srv/app/.incoming",
+      "export CI=1 NEXT_TELEMETRY_DISABLED=1 NODE_ENV=production",
+      ...c.setup,
+      c.install,
+      c.build,
+      "cd /",
+      `sudo -n tee /etc/systemd/system/${SERVICE}.service >/dev/null <<'UNIT'`,
+      ...unit,
+      "UNIT",
+      `if [ -e ${APP_DIR} ]; then mv ${APP_DIR} /srv/app/.old; fi`,
+      `mv /srv/app/.incoming ${APP_DIR}`,
+      "sudo -n systemctl daemon-reload",
+      `sudo -n systemctl enable --quiet ${SERVICE}`,
+      `sudo -n systemctl restart ${SERVICE}`,
+      "rm -rf /srv/app/.old"
+    ].join("\n");
+  }
+};
+
+// src/commands/deploy/templates/react.ts
+import { spawn as spawn4 } from "child_process";
+import { access as access2 } from "fs/promises";
+import { join as join3 } from "path";
+var OUT_DIRS = ["dist", "build"];
+async function runBuild(dir, pm) {
+  const args = runScript(pm, "build");
+  info(`${color.dim("$")} ${pm} ${args.join(" ")}`);
+  const status2 = await new Promise((resolve3, reject) => {
+    const child = spawn4(pm, args, { cwd: dir, stdio: ["ignore", process.stderr, process.stderr], shell: process.platform === "win32" });
+    child.once("error", (err) => reject(new KvboxError(`could not run ${pm}: ${err.message}`)));
+    child.once("close", (code) => resolve3(code ?? 1));
+  });
+  if (status2 !== 0) throw new KvboxError(`the build failed (${pm} exited ${status2}); nothing was deployed`);
+}
+var reactTemplate = {
+  id: "react",
+  label: "React",
+  hint: "static site: built here, served by nginx in the box",
+  size: "xs",
+  port: 80,
+  /** A Vite or Create React App project. A framework with its own server (Next.js, Remix, Expo) is not a static site. */
+  detect(pkg) {
+    if (!pkg) return false;
+    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+    if (!("react" in deps) || "next" in deps || "@remix-run/react" in deps || "expo" in deps) return false;
+    return "vite" in deps || "react-scripts" in deps;
+  },
+  async build(ctx) {
+    if (typeof ctx.pkg?.scripts?.["build"] !== "string") throw new KvboxError(`${ctx.dir}: package.json has no "build" script`);
+    const pm = await packageManager(ctx.dir);
+    await runBuild(ctx.dir, pm);
+    const candidates = ctx.dist !== void 0 ? [ctx.dist] : OUT_DIRS;
+    for (const dist of candidates) {
+      const outDir = join3(ctx.dir, dist);
+      if (await access2(join3(outDir, "index.html")).then(() => true, () => false)) return { outDir, dist, exclude: [], pm, what: `${dist}/` };
+    }
+    throw new KvboxError(
+      `the build left no ${candidates.join(" or ")}/index.html. The React template ships a directory of static files; set "dist" in kvbox.json to the build output directory, or pick the right template with --template`
+    );
+  },
+  /**
+   * The archive lands in a staging directory, which then becomes /srv/app/dist in one move; the
+   * old site is kept beside it until the new one is in place, so a failed step never leaves nginx
+   * without a root and a visitor never sees a half-copied site. Files get read permission for
+   * nginx's user, whatever umask the build ran under. /srv/app is the kvbox user's (image v0.8.0+);
+   * the missing site file means an older image.
+   */
+  remote() {
+    return [
+      "set -e",
+      "test -e /etc/nginx/sites-enabled/kvbox-app || exit 3",
+      "rm -rf /srv/app/.incoming /srv/app/.old",
+      "mkdir -p /srv/app/.incoming",
+      "tar -xf - -C /srv/app/.incoming",
+      "chmod -R a+rX /srv/app/.incoming",
+      "if [ -e /srv/app/dist ]; then mv /srv/app/dist /srv/app/.old; fi",
+      "mv /srv/app/.incoming /srv/app/dist",
+      "rm -rf /srv/app/.old",
+      "sudo -n systemctl enable --now --quiet nginx",
+      "sudo -n systemctl reload nginx"
+    ].join("\n");
+  }
+};
+
+// src/commands/deploy/templates/index.ts
+var TEMPLATES = [reactTemplate, nextjsTemplate];
+var TEMPLATE_IDS = TEMPLATES.map((t) => t.id);
+function templateById(id) {
+  const t = TEMPLATES.find((x) => x.id === id);
+  if (!t) throw new Error(`no template ${id}`);
+  return t;
+}
+function detectTemplate(pkg) {
+  return TEMPLATES.find((t) => t.detect(pkg));
+}
+
+// src/commands/deploy/config.ts
+var DEPLOY_AUTO_HIBERNATE_SEC = 3600;
+var CONFIG_FILE = "kvbox.json";
+var BOX_NAME_RE = /^[a-z0-9][a-z0-9-]{0,11}$/;
+var DeployConfigSchema = z5.object({
+  template: z5.enum(TEMPLATE_IDS),
+  name: z5.string().regex(BOX_NAME_RE, "1-12 chars, lowercase letters, digits and '-', starting with a letter or digit"),
+  /** The org whose box it is; absent for the user's own. */
+  org: z5.string().regex(ORG_SLUG_RE, "not an org slug").optional(),
+  /** The HTTPS name (`<subdomain>.kvbox.app`); absent when deploying to this machine's own host. */
+  subdomain: z5.string().check((ctx) => {
+    const problem = subdomainProblem(ctx.value);
+    if (problem) ctx.issues.push({ code: "custom", message: problem, input: ctx.value });
+  }).optional(),
+  size: z5.enum(SIZE_NAMES).optional(),
+  /** The build output directory, relative to the app; the template's default when absent. */
+  dist: z5.string().optional()
+});
+async function readConfig(dir) {
+  const path = join4(dir, CONFIG_FILE);
+  let raw;
+  try {
+    raw = await readFile6(path, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw err;
+  }
+  let json2;
+  try {
+    json2 = JSON.parse(raw);
+  } catch {
+    throw new KvboxError(`${path}: not valid JSON`);
+  }
+  const parsed = DeployConfigSchema.safeParse(json2);
+  if (!parsed.success) {
+    const issue = parsed.error.issues[0];
+    throw new KvboxError(`${path}: ${issue.path.join(".") || "file"}: ${issue.message}`);
+  }
+  return parsed.data;
+}
+async function writeConfig(dir, config) {
+  await writeFile4(join4(dir, CONFIG_FILE), JSON.stringify(config, null, 2) + "\n");
+}
+function nameFromDir(dirName) {
+  const slug = dirName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 12).replace(/-+$/, "");
+  return slug === "" ? "app" : slug;
+}
+function subdomainFor(name) {
+  return subdomainProblem(name) === null ? name : `${name}-site`;
+}
+
+// src/commands/deploy/ship.ts
+import { spawn as spawn5 } from "child_process";
+import { readdir, stat as stat2 } from "fs/promises";
+import { join as join5 } from "path";
+var IMAGE_TOO_OLD = 3;
+var SSH_FAILED3 = 255;
+async function measure(dir, exclude = []) {
+  const total = { files: 0, bytes: 0 };
+  const walk = async (d) => {
+    for (const entry of await readdir(d, { withFileTypes: true })) {
+      if (exclude.includes(entry.name)) continue;
+      const path = join5(d, entry.name);
+      if (entry.isDirectory()) await walk(path);
+      else if (entry.isFile()) {
+        total.files += 1;
+        total.bytes += (await stat2(path)).size;
+      }
+    }
+  };
+  await walk(dir);
+  return total;
+}
+async function ship(ep, dir, remote, exclude = []) {
+  const tar = spawn5("tar", ["-cf", "-", ...exclude.map((e) => `--exclude=${e}`), "-C", dir, "."], { stdio: ["ignore", "pipe", "pipe"] });
+  const ssh = spawn5("ssh", [...sshArgs(ep), remote], { stdio: ["pipe", "pipe", "pipe"] });
+  tar.stdout.pipe(ssh.stdin);
+  const chunks = [];
+  ssh.stdout.on("data", (c) => chunks.push(c));
+  ssh.stderr.on("data", (c) => chunks.push(c));
+  tar.stderr.on("data", (c) => chunks.push(c));
+  ssh.stdin.on("error", () => {
+  });
+  tar.stdout.on("error", () => {
+  });
+  tar.once("error", () => ssh.stdin.end());
+  tar.once("close", (code) => {
+    if (code !== 0) ssh.stdin.end();
+  });
+  const tarDone = new Promise((resolve3) => tar.once("close", () => resolve3()));
+  const status2 = await new Promise((resolve3, reject) => {
+    ssh.once("error", (err) => reject(new KvboxError(`could not run ssh: ${err.message}`)));
+    ssh.once("close", (code, signal) => {
+      tar.stdout.unpipe(ssh.stdin);
+      tar.stdout.resume();
+      tar.kill();
+      resolve3(code ?? (signal === "SIGINT" ? 130 : 1));
+    });
+  });
+  await tarDone;
+  return { status: status2, output: Buffer.concat(chunks).toString("utf8") };
+}
+var shipping = { ship, measure, waitForSsh };
+
+// src/commands/deploy/index.ts
+var deployCommand = new Command49("deploy").description("put the app in this directory (React or Next.js) on a box with its own HTTPS address; redeploy by running it again").argument("[dir]", "the app's directory (default: the current one)").addOption(new Option5("-t, --template <template>", "what kind of app it is (detected from package.json when not given)").choices(TEMPLATE_IDS)).option("-n, --name <name>", "the box's name (default: the directory's name)").option("--sub <subdomain>", "its HTTPS name, https://<subdomain>.kvbox.app (default: the box's name)").addOption(new Option5("-s, --size <size>", "size of the box when it has to be made").choices(SIZE_NAMES)).option("-y, --yes", "ask nothing: take the defaults for whatever the flags and kvbox.json leave open").option("--json", "print the result as JSON").option("--org <slug>", "deploy into this org's boxes (saved to kvbox.json)").action(async (dirArg, opts, cmd) => {
+  const dir = resolve2(dirArg ?? ".");
+  const pkg = await readPackageJson(dir);
+  const saved = await readConfig(dir);
+  const globals = cmd.optsWithGlobals();
+  const orgFlag = orgOption(globals);
+  const org = orgFlag ?? saved?.org;
+  const client = await clientFor({ ...globals.local ? { local: true } : {}, ...org !== void 0 ? { org } : {} });
+  try {
+    const cloud = client.target.kind === "cloud";
+    if (!cloud && org !== void 0) throw new KvboxError("--org needs a control plane: kvbox login, or drop --org");
+    const { config, template, fresh } = await settle(dir, pkg, saved, opts, orgFlag, cloud);
+    if (cloud && config.subdomain !== void 0) await refuseOtherAddress(client, config);
+    await writeConfig(dir, config);
+    if (fresh) info(`  ${color.dim(`saved to ${CONFIG_FILE}; next time kvbox deploy asks nothing`)}
+`);
+    info(`${color.bold("Building")} ${color.cyan(config.name)} ${color.dim(`(${template.label})`)}`);
+    const built = await template.build({ dir, pkg, dist: config.dist });
+    if (built.dist !== void 0 && built.dist !== config.dist) await writeConfig(dir, { ...config, dist: built.dist });
+    const size = await shipping.measure(built.outDir, built.exclude);
+    info("");
+    const { box: found, ref, created } = await findOrCreate(client, config);
+    const cert = await ensureCert(client, void 0, void 0, { owner: found.owner });
+    const wasRunning = !created && found.status === "running";
+    const box = created || wasRunning ? found : await wakeUp(client, found, ref);
+    const ep = sshEndpoint(box, client.target);
+    if (!wasRunning) await spin(`waiting for ${ref} to accept SSH\u2026`, shipping.waitForSsh(ep));
+    const shipIt = () => shipping.ship(ep, built.outDir, template.remote(built), built.exclude);
+    const doing = built.dist === void 0 ? `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref} and building there, a minute or two\u2026` : `shipping ${built.what} (${size.files} files, ${gb(size.bytes)}) to ${ref}\u2026`;
+    let result = await spin(doing, shipIt);
+    if (result.status === SSH_FAILED3 && await renewAfterRefusal(client, cert, box.owner)) {
+      info("renewed your SSH certificate, trying again\u2026");
+      result = await spin(doing, shipIt);
+    }
+    if (result.status === SSH_FAILED3) throw new KvboxError(`box ${ref}: could not reach it over SSH (still booting?)${result.output ? `
+${result.output.trim()}` : ""}`, SSH_FAILED3);
+    if (result.status === IMAGE_TOO_OLD) {
+      throw new KvboxError(
+        `box ${ref} runs an image too old for the ${template.label} template (base v0.8.0 or newer). Update the box (kvbox vm update ${ref}) once its host has the new image, or deploy under another name (--name) to get a fresh box`
+      );
+    }
+    if (result.status !== 0) throw new KvboxError(`deploying to ${ref} failed (exit ${result.status}):
+${result.output.trim()}`);
+    let url = `http://${box.ip}`;
+    if (cloud) {
+      const got = await address(client, box, ref, config, template);
+      url = got.url;
+      if (got.subdomain !== config.subdomain) await writeConfig(dir, { ...config, subdomain: got.subdomain, ...built.dist !== void 0 && built.dist !== config.dist ? { dist: built.dist } : {} });
+    }
+    if (opts.json) {
+      json({ box: ref, created, template: template.id, url, ...built.dist !== void 0 ? { dist: built.dist } : {}, files: size.files, bytes: size.bytes });
+      return;
+    }
+    process.stdout.write(`${url}
+`);
+    info(`${color.green("\u2713")} ${color.bold(config.name)} is live at ${color.bold(url)}`);
+    info(`  box ${ref}${created ? " (new)" : ""} \xB7 ${template.label} \xB7 ${size.files} files, ${gb(size.bytes)}`);
+    info(`  redeploy: kvbox deploy${dirArg !== void 0 ? ` ${dirArg}` : ""}`);
+  } finally {
+    await client.close();
+  }
+});
+async function readPackageJson(dir) {
+  try {
+    return JSON.parse(await readFile7(resolve2(dir, "package.json"), "utf8"));
+  } catch (err) {
+    if (err.code === "ENOENT") return void 0;
+    throw new KvboxError(`${resolve2(dir, "package.json")}: ${err.message}`);
+  }
+}
+async function settle(dir, pkg, saved, opts, orgFlag, cloud) {
+  const detected = detectTemplate(pkg);
+  if (opts.name !== void 0 && !BOX_NAME_RE.test(opts.name)) throw new KvboxError(`--name ${opts.name}: ${NAME_RULE}`);
+  if (opts.sub !== void 0) assertSubdomain(opts.sub);
+  const renamed = saved !== void 0 && (opts.name !== void 0 && opts.name !== saved.name || orgFlag !== void 0 && orgFlag !== saved.org);
+  const savedSub = renamed ? void 0 : saved?.subdomain;
+  const defaults = {
+    template: opts.template ?? saved?.template ?? detected?.id,
+    name: opts.name ?? saved?.name ?? nameFromDir(basename(dir)),
+    subdomain: opts.sub ?? savedSub,
+    size: opts.size ?? saved?.size
+  };
+  const sizeFor = (t) => defaults.size ?? t?.size ?? "xs";
+  const open = {
+    template: opts.template === void 0 && saved?.template === void 0,
+    name: opts.name === void 0 && saved?.name === void 0,
+    subdomain: cloud && opts.sub === void 0 && savedSub === void 0,
+    size: opts.size === void 0 && saved === void 0
+  };
+  const anyOpen = open.template || open.name || open.subdomain || open.size;
+  const fresh = saved === void 0;
+  if (anyOpen && !opts.yes && !interactive()) {
+    const sub = defaults.subdomain ?? subdomainFor(defaults.name);
+    throw new KvboxError(
+      `kvbox deploy asks a few questions the first time, and this is not a terminal. Pass -y to take the defaults (${defaults.template ?? "template?"}, box ${defaults.name}${cloud ? `, https://${sub}.kvbox.app` : ""}, size ${sizeFor(defaults.template !== void 0 ? templateById(defaults.template) : void 0)}), or answer with --template, --name${cloud ? ", --sub" : ""} and --size`
+    );
+  }
+  const ask = anyOpen && !opts.yes;
+  if (ask && fresh) info(`${color.bold("kvbox deploy")} ${color.dim(dir)}
+`);
+  let templateId = defaults.template;
+  if (open.template && ask) {
+    const initial = detected ? TEMPLATES.indexOf(detected) : 0;
+    templateId = await select("Template", TEMPLATES.map((t) => ({ value: t.id, label: t.label, hint: t === detected ? `${t.hint} \xB7 detected` : t.hint })), initial);
+  }
+  if (templateId === void 0) throw new KvboxError(`could not tell what kind of app ${dir} is (no package.json of a Vite, Create React App or Next.js project): say it with --template ${TEMPLATE_IDS.join("|")}`);
+  const template = templateById(templateId);
+  let name = defaults.name;
+  if (open.name && ask) name = await text("Box name", { default: defaults.name, validate: (a) => BOX_NAME_RE.test(a) ? void 0 : NAME_RULE });
+  let subdomain = defaults.subdomain ?? (cloud ? subdomainFor(name) : void 0);
+  if (open.subdomain && ask) {
+    subdomain = await text("Address", {
+      default: subdomainFor(name),
+      validate: (a) => {
+        const problem = subdomainProblem(a);
+        return problem ? `that name ${problem}` : void 0;
+      }
+    });
+    info(`  ${color.dim(`https://${subdomain}.kvbox.app`)}`);
+  }
+  let size = sizeFor(template);
+  if (open.size && ask) {
+    size = await select("Box size", SIZE_NAMES.map((s) => ({ value: s, label: s, hint: `${SIZES[s].vcpu} vCPU, ${SIZES[s].memMib / 1024} GB RAM, ${SIZES[s].diskGib} GB disk` })), SIZE_NAMES.indexOf(template.size));
+  }
+  const org = orgFlag ?? saved?.org;
+  const config = {
+    template: template.id,
+    name,
+    ...org !== void 0 ? { org } : {},
+    ...subdomain !== void 0 ? { subdomain } : {},
+    size,
+    ...saved?.dist !== void 0 ? { dist: saved.dist } : {}
+  };
+  return { config, template, fresh };
+}
+var NAME_RULE = "1-12 chars, lowercase letters, digits and '-', starting with a letter or digit";
+async function findOrCreate(client, config) {
+  const user = me(client);
+  const slug = config.org ?? user;
+  const named = (await client.listMachines()).filter((b) => b.name === config.name);
+  let box = slug === void 0 ? named[0] : named.find((b) => slugOf(b.owner) === slug);
+  let created = false;
+  if (!box) {
+    box = await spin(`booting a new box ${config.name}\u2026`, client.createMachine({ name: config.name, ...config.size !== void 0 ? { size: config.size } : {}, autoHibernateSec: DEPLOY_AUTO_HIBERNATE_SEC }));
+    created = true;
+    info(`${color.green("\u2713")} box ${color.bold(config.name)} is up: ${box.vcpu} vCPU, ${gb(box.memMib * 1024 ** 2)} RAM, ${gb(box.diskBytes)} disk`);
+  }
+  return { box, ref: displayName(box, user), created };
+}
+async function existingAddress(client, config) {
+  const slug = config.org ?? me(client);
+  return (await client.listSubdomains()).find((s) => s.box === config.name && s.owner === slug);
+}
+async function refuseOtherAddress(client, config) {
+  const have = await existingAddress(client, config);
+  if (!have || have.subdomain === config.subdomain) return;
+  const ref = config.org !== void 0 ? `${config.org}/${config.name}` : config.name;
+  throw new KvboxError(
+    `box ${ref} already answers at ${have.url}, not ${config.subdomain}. To keep the address: kvbox deploy --sub ${have.subdomain}. To move it: kvbox vm proxy release ${ref}, then deploy again`
+  );
+}
+async function address(client, box, ref, config, template) {
+  const have = (await client.listSubdomains()).find((s) => s.box === box.name && s.owner === slugOf(box.owner));
+  if (have) {
+    if (have.port !== template.port) await client.setSubdomainPort(ref, { port: template.port });
+    return { url: have.url, subdomain: have.subdomain };
+  }
+  const wanted = config.subdomain ?? subdomainFor(config.name);
+  try {
+    const sub = await spin(`claiming https://${wanted}.kvbox.app\u2026`, client.claimSubdomain(ref, { name: wanted, port: template.port }));
+    return { url: sub.url, subdomain: sub.subdomain };
+  } catch (err) {
+    if (!(err instanceof KvboxError)) throw err;
+    throw new KvboxError(`${err.message}
+the app is on box ${ref} but has no address yet: pick another with kvbox deploy --sub <name> (saved to ${CONFIG_FILE})`);
+  }
+}
+
 // src/program.ts
 function buildProgram() {
-  const program = new Command49("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
+  const program = new Command50("kvbox").description("self-hosted Firecracker microVMs with Docker-like ergonomics").version(VERSION, "-v, --version").option("--local", "use this machine's kvbox-server over its socket, ignoring kvbox login").option("--org <slug>", "the org: where kvbox new creates, and which box a name means when it is not one of yours; before the command here, or after it").showHelpAfterError().enablePositionalOptions();
   program.addCommand(vmCommand);
   program.addCommand(snapshotsCommand);
   program.addCommand(serverCommand);
@@ -2789,6 +3363,7 @@ function buildProgram() {
   program.addCommand(orgCommand);
   program.addCommand(usageCommand2);
   program.addCommand(creditCommand);
+  program.addCommand(deployCommand);
   for (const cmd of vmAliases) program.addCommand(cmd);
   return program;
 }