@tonbo/cli 0.14.0 → 0.15.0

package/dist/bin/tonbo.js

@@ -2,7 +2,7 @@
 
 // src/app.ts
 import { Command, InvalidArgumentError, Option } from "commander";
-import { readFileSync } from "node:fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 
 // ../../packages/tonbo-cli-core/dist/src/generated/contracts.js
 var agentNameContract = {
@@ -574,6 +574,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "leaveYieldOrganization": {
+    "method": "POST",
+    "path": "/yield/leave",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "recordYieldMetric": {
     "method": "POST",
     "path": "/yield/metrics",
@@ -600,6 +607,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "createYieldPickup": {
+    "method": "POST",
+    "path": "/yield/pickups",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "listYieldQuestions": {
     "method": "GET",
     "path": "/yield/questions",
@@ -794,6 +808,16 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine sleep"
   },
+  "wakeMachine": {
+    "method": "POST",
+    "path": "/machines/{name}/wake",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wake"
+  },
   "listMachineActivations": {
     "method": "GET",
     "path": "/machines/{name}/activations",
@@ -815,6 +839,38 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine shapes"
   },
+  "listMachineSecrets": {
+    "method": "GET",
+    "path": "/machines/{name}/secrets",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret list"
+  },
+  "setMachineSecret": {
+    "method": "PUT",
+    "path": "/machines/{name}/secrets/{key}",
+    "pathParams": [
+      "name",
+      "key"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret set"
+  },
+  "unsetMachineSecret": {
+    "method": "DELETE",
+    "path": "/machines/{name}/secrets/{key}",
+    "pathParams": [
+      "name",
+      "key"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine secret unset"
+  },
   "execMachineCommand": {
     "method": "POST",
     "path": "/machines/{name}/exec",
@@ -892,6 +948,101 @@ var managementOperations = {
     "cli": "tonbo machine file list",
     "cell": true
   },
+  "listMachineProcesses": {
+    "method": "GET",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine ps",
+    "cell": true
+  },
+  "startMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo machine exec --detach",
+    "cell": true
+  },
+  "getMachineProcess": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wait",
+    "cell": true
+  },
+  "killMachineProcess": {
+    "method": "DELETE",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine kill",
+    "cell": true
+  },
+  "readMachineProcessOutput": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}/output",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [
+      "offset"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine output",
+    "cell": true
+  },
+  "listMachineHolds": {
+    "method": "GET",
+    "path": "/machines/{name}/holds",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold ls",
+    "cell": true
+  },
+  "setMachineHold": {
+    "method": "PUT",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold set",
+    "cell": true
+  },
+  "releaseMachineHold": {
+    "method": "DELETE",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold rm",
+    "cell": true
+  },
   "issueSshCertificate": {
     "method": "POST",
     "path": "/ssh/certificates",
@@ -1027,6 +1178,182 @@ var managementOperations = {
     "cli": "tonbo stream usage"
   }
 };
+var plannedManagementOperations = {
+  "listBudgets": {
+    "method": "GET",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget list"
+  },
+  "createBudget": {
+    "method": "POST",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo budget add"
+  },
+  "getBudget": {
+    "method": "GET",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget show"
+  },
+  "changeBudget": {
+    "method": "PATCH",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget set"
+  },
+  "getMachineActivation": {
+    "method": "GET",
+    "path": "/machines/{name}/activations/{activation}",
+    "pathParams": [
+      "name",
+      "activation"
+    ],
+    "query": [
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine activation show"
+  },
+  "getMachineUsage": {
+    "method": "GET",
+    "path": "/machines/{name}/usage",
+    "pathParams": [
+      "name"
+    ],
+    "query": [
+      "from",
+      "to",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine usage"
+  },
+  "setMachineProcessDeadline": {
+    "method": "PUT",
+    "path": "/machines/{machine}/processes/{process}/deadline",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine extend",
+    "cell": true
+  },
+  "signalMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{machine}/processes/{process}/signal",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine signal",
+    "cell": true
+  },
+  "createMachineDirectory": {
+    "method": "PUT",
+    "path": "/machines/{machine}/files/directory",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "parents",
+      "mode",
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mkdir",
+    "cell": true
+  },
+  "renameMachineFile": {
+    "method": "POST",
+    "path": "/machines/{machine}/files/rename",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mv",
+    "cell": true
+  },
+  "getMachineFileArchive": {
+    "method": "GET",
+    "path": "/machines/{machine}/files/archive",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "format",
+      "user"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine file archive",
+    "cell": true
+  },
+  "readMachineLogs": {
+    "method": "GET",
+    "path": "/machines/{machine}/logs",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "activation",
+      "cursor",
+      "since",
+      "limit",
+      "follow"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine logs",
+    "cell": true
+  },
+  "listSshCertificates": {
+    "method": "GET",
+    "path": "/ssh/certificates",
+    "pathParams": [],
+    "query": [
+      "member",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate list",
+    "cell": true
+  },
+  "revokeSshCertificate": {
+    "method": "DELETE",
+    "path": "/ssh/certificates/{certificate}",
+    "pathParams": [
+      "certificate"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate revoke",
+    "cell": true
+  }
+};
 var accountRoles = [
   "owner",
   "admin",
@@ -1641,9 +1968,15 @@ var machinePortAccess = [
 var machineTimings = {
   "pollAfterSeconds": 2,
   "sleepPollAfterSeconds": 5,
+  "wakePollAfterSeconds": 2,
   "wakeHoldSeconds": 25,
   "earlyReclaimSeconds": 120
 };
+var machineSecretLimits = {
+  "perMachine": 64,
+  "valueMaxBytes": 65536,
+  "totalMaxBytes": 262144
+};
 
 // ../../packages/tonbo-cli-core/dist/src/bearer.js
 var MANAGEMENT_AUDIENCE = cliSessionContract.audiences.management;
@@ -1708,6 +2041,9 @@ async function requestJson(fetcher, url, init = {}) {
 
 // ../../packages/tonbo-cli-core/dist/src/api.js
 var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
+function managementOperation(operationId) {
+  return operationId in managementOperations ? managementOperations[operationId] : plannedManagementOperations[operationId];
+}
 var DEFAULT_LOGIN_HINT2 = credentialsContract.reader.login_hint;
 var ExchangeRefusal = class extends HttpError {
 };
@@ -1752,7 +2088,7 @@ var ManagementApi = class {
     }
   }
   async requestWith(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
-    const operation = managementOperations[operationId];
+    const operation = managementOperation(operationId);
     const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
       if (value === void 0)
@@ -1818,6 +2154,27 @@ var ManagementApi = class {
       idempotencyKey
     }).catch(unconfirmed("Agent creation", idempotencyKey, "the same name, role and region"));
   }
+  /** The account's budgets (planned: 404 until budgets are served). */
+  listBudgets(key) {
+    return this.call("listBudgets", key);
+  }
+  getBudget(key, budgetId) {
+    return this.call("getBudget", key, { params: { budget_id: budgetId } });
+  }
+  /** A replay with the same idempotency key returns the budget the first
+   * request created. */
+  createBudget(key, request, idempotencyKey) {
+    return this.call("createBudget", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Budget creation", idempotencyKey, "the same name, limit and members"));
+  }
+  changeBudget(key, budgetId, change) {
+    return this.call("changeBudget", key, {
+      params: { budget_id: budgetId },
+      body: withoutUndefined(change)
+    });
+  }
   listApiKeys(key, page) {
     return this.page("listApiKeys", key, page);
   }
@@ -1923,6 +2280,21 @@ var ManagementApi = class {
   listMachines(key, page) {
     return this.page("listMachines", key, page);
   }
+  async listMachineSecrets(key, name) {
+    const answer = await this.request("listMachineSecrets", key, {
+      params: { name }
+    });
+    return answer.data;
+  }
+  setMachineSecret(key, name, secretKey, value) {
+    return this.call("setMachineSecret", key, {
+      params: { name, key: secretKey },
+      body: value
+    });
+  }
+  unsetMachineSecret(key, name, secretKey) {
+    return this.request("unsetMachineSecret", key, { params: { name, key: secretKey } });
+  }
   /**
    * A replay with the same idempotency key returns the Machine the first
    * request created, so a transport failure or a 5xx answer is retried here
@@ -2022,6 +2394,18 @@ var ManagementApi = class {
     });
     return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
   }
+  /** With `etag`, only the Machine that ETag names, at that revision, is
+   * woken (machine-v2.json `etag.if_match.wake` is optional). A 202 carries
+   * the `Retry-After` to read the Machine again after (machine-v2.json
+   * `wake.poll_after_seconds`); a 200 (already awake) carries none. A
+   * refused wake throws the API's problem. */
+  async wakeMachine(key, name, etag) {
+    const headers = { retryAfter: null };
+    const answer = await this.request("wakeMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.retryAfter = response.headers.get("retry-after");
+    });
+    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
+  }
   /** The Machine being deleted or the device forgotten, with its kind; the
    * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
    * says whether a name was released (`managed`: its create never reached its
@@ -2092,11 +2476,42 @@ import os4 from "node:os";
 import { promisify as promisify2 } from "node:util";
 
 // ../../packages/tonbo-cli-core/dist/src/callback-page.js
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
+var LOGO_PIXELS = [
+  [0, 5],
+  [5, 0],
+  [5, 5],
+  [5, 10],
+  [5, 15],
+  [10, 5],
+  [10, 15],
+  [21, 10],
+  [21, 15],
+  [26, 5],
+  [26, 15],
+  [31, 5],
+  [31, 10],
+  [42, 5],
+  [42, 10],
+  [42, 15],
+  [47, 5],
+  [52, 10],
+  [52, 15],
+  [63, 0],
+  [63, 5],
+  [63, 10],
+  [63, 15],
+  [68, 5],
+  [68, 15],
+  [73, 5],
+  [73, 10],
+  [84, 5],
+  [84, 10],
+  [89, 5],
+  [89, 15],
+  [94, 10],
+  [94, 15]
+];
+var LOGO = `<svg class="wordmark" aria-hidden="true" viewBox="0 0 99 20" width="99" height="20"><g fill="currentColor" shape-rendering="crispEdges">${LOGO_PIXELS.map(([x, y]) => `<rect x="${x}" y="${y}" width="5" height="5"/>`).join("")}</g></svg>`;
 var OUTCOMES = {
   complete: {
     status: 200,
@@ -2133,7 +2548,7 @@ function renderCallbackPage(outcome) {
     --ink: #1d1b17;
     --rule: #c9c5ba;
     --quiet: #5c564a;
-    --signal: #d64a03;
+    --signal: #e5673e;
   }
   @media (prefers-color-scheme: dark) {
     :root {
@@ -2141,7 +2556,7 @@ function renderCallbackPage(outcome) {
       --ink: #f3f2ee;
       --rule: #3a362e;
       --quiet: #a49e8f;
-      --signal: #f08b4b;
+      --signal: #e5673e;
     }
   }
   * { box-sizing: border-box; }
@@ -2157,21 +2572,9 @@ function renderCallbackPage(outcome) {
     -webkit-font-smoothing: antialiased;
   }
   header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
+  svg.wordmark {
+    display: block;
     color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
   }
   main {
     display: flex;
@@ -2202,7 +2605,7 @@ function renderCallbackPage(outcome) {
 </style>
 </head>
 <body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<header>${LOGO}</header>
 <main>
   <h1>${title}</h1>
   <p>${body}</p>
@@ -2611,6 +3014,14 @@ var SessionClient = class _SessionClient {
     }
     return bearer;
   }
+  /** Drops every token of `accountId` this process keeps, and its bearer. */
+  forget(accountId) {
+    for (const id of [...this.tokens.keys()])
+      if (id.endsWith(` ${accountId}`))
+        this.tokens.delete(id);
+    this.bearers.delete(accountId);
+    this.workspaces.delete(accountId);
+  }
   /** A token of `accountId` for `audience`, kept until a minute before it expires. */
   async token(audience, accountId) {
     const id = `${audience} ${accountId}`;
@@ -2825,6 +3236,29 @@ var LoginStore = class {
     }
     return accounts;
   }
+  /** Forgets an account the person no longer belongs to (they left it, or
+   * were removed): the login's cache of names is read again without it, it
+   * is no longer the default account, and this process's tokens of it are
+   * dropped. The CLI login itself stays: it still reaches every other
+   * account. Without a CLI login there is nothing to forget. */
+  async forgetAccount(accountId) {
+    const client = await this.session().catch(() => null);
+    if (!client)
+      return;
+    await this.refreshAccounts(client).catch(() => void 0);
+    const latest = await this.sessions.load();
+    if (!latest || latest.session.id !== client.stored.session.id)
+      return;
+    const { [accountId]: _forgotten, ...accounts } = latest.accounts ?? {};
+    const saved = {
+      ...latest,
+      accounts,
+      default_account_id: latest.default_account_id === accountId ? null : latest.default_account_id ?? null
+    };
+    await this.sessions.save(saved);
+    client.stored = saved;
+    client.forget(accountId);
+  }
   /** The id of the account `nameOrId` names, looked up again once when the cache misses. */
   async resolve(client, nameOrId) {
     if (UUID2.test(nameOrId))
@@ -3552,7 +3986,7 @@ var TerminalProgress = class {
 };
 
 // src/commands.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/agent-name.ts
 var AGENT_NAME_RULE = agentNameContract.$defs.name;
@@ -3567,22 +4001,225 @@ function validateAgentName(name) {
   }
 }
 
-// src/commands.ts
-function print(deps, json, data, human) {
-  deps.output(json ? JSON.stringify(data) : human);
-}
-function printPage(deps, json, page, human) {
-  print(deps, json, page.data, human(page.data));
-  if (page.next_cursor) deps.notice(`More results: run again with --cursor ${page.next_cursor}`);
+// src/budget.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+var BUDGETS_NOT_AVAILABLE = "Budgets are not available yet.";
+function parseDollars(value) {
+  const match = /^\$?([0-9]+)(?:\.([0-9]{1,2}))?$/.exec(value.trim());
+  if (!match) throw new Error(`${value} is not an amount in dollars, such as $50 or 12.50.`);
+  return Number(match[1]) * 1e6 + Number((match[2] ?? "").padEnd(2, "0")) * 1e4;
+}
+var isAmount = (value) => /^\$?[0-9]+(?:\.[0-9]{1,2})?$/.test(value.trim());
+function unavailable(error) {
+  if (error instanceof HttpError && error.status === 404 && error.code !== "budget_not_found")
+    return new HttpError(BUDGETS_NOT_AVAILABLE, 404, error.body, error.requestId);
+  return error;
+}
+async function budgets(deps, key) {
+  return deps.api.listBudgets(key).catch((error) => {
+    throw unavailable(error);
+  });
 }
-async function confirm(deps, yes, action, question, expected) {
-  if (yes) return;
-  if (!deps.interactive())
-    throw new Error(`Refusing to ${action} without confirmation: pass --yes.`);
-  if (await deps.ask(await question()) !== expected)
-    throw new Error("Cancelled; nothing was changed.");
+async function resolveBudget(deps, key, budget) {
+  const all = await budgets(deps, key);
+  const found = all.find((entry) => entry.id === budget || entry.name === budget);
+  if (!found) throw new Error(`No budget of this account is ${budget}. See \`tonbo budget list\`.`);
+  return found;
+}
+function usedText(budget) {
+  if (budget.limit_micros === void 0) return "\u2014";
+  const used = (budget.settled_micros ?? 0) + (budget.committed_micros ?? 0);
+  return `${usd(used)} of ${usd(budget.limit_micros)}`;
+}
+function budgetFields(budget) {
+  const rows = [
+    ["ID", budget.id],
+    ["Name", budget.name ?? "\u2014"],
+    ["Scope", budget.scope],
+    ["Stage", budget.stage]
+  ];
+  if (budget.limit_micros !== void 0) {
+    rows.push(["Limit", usd(budget.limit_micros)]);
+    rows.push(["Charged", usd(budget.settled_micros ?? 0)]);
+    rows.push(["Committed", usd(budget.committed_micros ?? 0)]);
+  }
+  if (budget.principals?.length) rows.push(["Covers", budget.principals.join(", ")]);
+  if (budget.write_pace)
+    rows.push([
+      "Writes paced",
+      `${budget.write_pace.units_per_second}/s (floor ${budget.write_pace.floor_units_per_second}/s)`
+    ]);
+  rows.push(["Resets", budget.resets_at]);
+  rows.push(["Raise at", budget.raise_url]);
+  return fields(rows);
 }
-async function regionListCommand(deps, options = {}) {
+async function budgetListCommand(deps, options) {
+  const all = await budgets(deps, await deps.auth.apiKey());
+  print(
+    deps,
+    options.json,
+    all,
+    all.length ? table(
+      ["ID", "NAME", "SCOPE", "STAGE", "USED", "RESETS"],
+      all.map((budget) => [
+        budget.id,
+        budget.name ?? "\u2014",
+        budget.scope,
+        budget.stage,
+        usedText(budget),
+        budget.resets_at
+      ])
+    ) : "No budgets. An owner or admin sets the account budget in the console; `tonbo budget add` sets one for you or an Agent you created."
+  );
+}
+async function budgetShowCommand(deps, budget, options) {
+  const found = await resolveBudget(deps, await deps.auth.apiKey(), budget);
+  print(deps, options.json, found, budgetFields(found));
+}
+async function sendToConsole(deps, url, why) {
+  deps.notice(`${why} An owner or admin makes it in the console: ${url}`);
+  if (deps.interactive() && deps.openUrl) await deps.openUrl(url).catch(() => void 0);
+}
+async function consoleOr(deps, error) {
+  if (error instanceof HttpError && error.code === "budget_raise_in_console") {
+    const body = error.body;
+    if (typeof body?.raise_url === "string") {
+      await sendToConsole(deps, body.raise_url, "Only the console makes this change.");
+      throw new HttpError(error.message, error.status, error.body, error.requestId);
+    }
+  }
+  throw unavailable(error);
+}
+async function budgetAddCommand(deps, name, options) {
+  const key = await deps.auth.apiKey();
+  const limit = parseDollars(options.limit);
+  const principals = options.member?.length ? await Promise.all(options.member.map((member) => resolveMemberSubject(deps, key, member))) : [(await deps.api.getAccount(key)).member.subject];
+  const created = await deps.api.createBudget(key, { scope: "principals", name, limit_micros: limit, principals }, randomUUID3()).catch((error) => consoleOr(deps, error));
+  print(
+    deps,
+    options.json,
+    created,
+    `Created budget ${created.name ?? name}: ${usd(limit)} a month, covering ${principals.join(", ")}.`
+  );
+}
+async function budgetSetCommand(deps, budget, options) {
+  if (options.limit === void 0 && !options.add?.length)
+    throw new Error("Nothing to change: pass --limit, --add or both.");
+  const key = await deps.auth.apiKey();
+  const found = await resolveBudget(deps, key, budget);
+  const limit = options.limit === void 0 ? void 0 : parseDollars(options.limit);
+  if (limit !== void 0 && (found.limit_micros === void 0 || limit >= found.limit_micros)) {
+    await sendToConsole(
+      deps,
+      found.raise_url,
+      found.limit_micros === void 0 ? "This budget is not yours to change here." : `${usd(limit)} is not below the budget's ${usd(found.limit_micros)}: the CLI only lowers a budget.`
+    );
+    throw new Error("The budget was not changed.");
+  }
+  const add = options.add?.length ? await Promise.all(options.add.map((member) => resolveMemberSubject(deps, key, member))) : void 0;
+  const changed = await deps.api.changeBudget(key, found.id, { limit_micros: limit, add_principals: add }).catch((error) => consoleOr(deps, error));
+  print(deps, options.json, changed, budgetFields(changed));
+}
+async function attachBudget(deps, key, subject, value, name, created) {
+  try {
+    if (isAmount(value)) {
+      const limit = parseDollars(value);
+      const budget = await deps.api.createBudget(
+        key,
+        { scope: "principals", name, limit_micros: limit, principals: [subject] },
+        randomUUID3()
+      ).catch((error) => consoleOr(deps, error));
+      deps.notice(`Budget ${budget.name ?? name}: ${usd(limit)} a month for ${subject}.`);
+      return;
+    }
+    const found = await resolveBudget(deps, key, value);
+    await deps.api.changeBudget(key, found.id, { add_principals: [subject] }).catch((error) => consoleOr(deps, error));
+    deps.notice(`Budget ${found.name ?? found.id} now covers ${subject}.`);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`${created} was created, but its budget was not set: ${reason}`);
+  }
+}
+function accountBudgetFields(account) {
+  const budgets2 = account.budgets;
+  if (!budgets2) return [];
+  const line = (budget) => budget ? `${budget.name ?? budget.id} \xB7 ${budget.stage} \xB7 ${usedText(budget)} \xB7 resets ${budget.resets_at}` : "none";
+  const rows = [
+    ["Account budget", line(budgets2.account)],
+    ["Your budget", line(budgets2.caller)]
+  ];
+  const pace = budgets2.account?.write_pace;
+  if (pace)
+    rows.push([
+      "Writes paced",
+      `${pace.units_per_second}/s across regions (floor ${pace.floor_units_per_second}/s)`
+    ]);
+  return rows;
+}
+function refusalBudget(body) {
+  const budget = body?.budget;
+  if (!budget || typeof budget !== "object") return null;
+  const record = budget;
+  return typeof record.id === "string" && typeof record.raise_url === "string" ? record : null;
+}
+function budgetHint(error) {
+  const budget = refusalBudget(error.body);
+  const name = budget ? budget.name ?? budget.id : "a budget";
+  switch (error.code) {
+    case "budget_exhausted":
+      return `The budget ${name} is used up${budget?.retry_at ? ` until ${budget.retry_at}` : ""}: stop, and try again only after then. A person can raise it in the console${budget ? ` at ${budget.raise_url}` : ""}.`;
+    case "budget_slowdown":
+      return `The budget ${name} is close to its limit, so only a few of its Machines may be awake at once: sleep another of its Machines${budget?.largest_shape_that_fits ? `, or set this one's shape to ${budget.largest_shape_that_fits}` : ""}, then wake it again. A person can raise it${budget ? ` at ${budget.raise_url}` : " in the console"}.`;
+    case "budget_scope":
+      return "Your budget confines you to the Machines you created: work on one of those, or ask a person to.";
+    case "budget_raise_in_console": {
+      const url = error.body?.raise_url;
+      return `Only the console makes this change${typeof url === "string" ? `: ${url}` : "."}`;
+    }
+    default:
+      return null;
+  }
+}
+function budgetHeaderLine(header) {
+  const values = /* @__PURE__ */ new Map();
+  for (const member of header.split(",")) {
+    const [name, ...rest] = member.trim().split("=");
+    if (!name) continue;
+    values.set(name.trim(), rest.join("=").trim().replace(/^"|"$/g, ""));
+  }
+  const used = values.get("used");
+  const percent = used === void 0 ? "" : `, ${Math.round(Number(used) * 100)}% used`;
+  return `Budget: ${values.get("scope") === "account" ? "the account budget" : "your budget"} is at ${values.get("stage") ?? "notice"}${percent}; it resets ${values.get("resets") ?? "on the 1st"}.`;
+}
+function noticingBudget(fetcher, notice) {
+  let said = false;
+  return async (input, init) => {
+    const response = await fetcher(input, init);
+    const header = response.headers.get("tonbo-budget");
+    if (header && !said) {
+      said = true;
+      notice(budgetHeaderLine(header));
+    }
+    return response;
+  };
+}
+
+// src/commands.ts
+function print(deps, json, data, human) {
+  deps.output(json ? JSON.stringify(data) : human);
+}
+function printPage(deps, json, page, human) {
+  print(deps, json, page.data, human(page.data));
+  if (page.next_cursor) deps.notice(`More results: run again with --cursor ${page.next_cursor}`);
+}
+async function confirm(deps, yes, action, question, expected) {
+  if (yes) return;
+  if (!deps.interactive())
+    throw new Error(`Refusing to ${action} without confirmation: pass --yes.`);
+  if (await deps.ask(await question()) !== expected)
+    throw new Error("Cancelled; nothing was changed.");
+}
+async function regionListCommand(deps, options = {}) {
   const regions = await deps.api.listRegions(await deps.auth.apiKey());
   print(
     deps,
@@ -3609,7 +4246,7 @@ async function agentCreateCommand(deps, name, options = {}) {
   const agent = await deps.api.createAgent(
     key,
     { name, region, ...options.role === void 0 ? {} : { role: options.role } },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -3622,6 +4259,15 @@ async function agentCreateCommand(deps, name, options = {}) {
       `Region: ${agent.region}`
     ].join("\n")
   );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      `agent.${agent.id}`,
+      options.budget,
+      agent.name,
+      `The Agent ${agent.name}`
+    );
 }
 async function accountShowCommand(deps, options = {}) {
   const account = await deps.api.getAccount(await deps.auth.apiKey());
@@ -3635,7 +4281,8 @@ async function accountShowCommand(deps, options = {}) {
       ["Kind", account.kind],
       ["Your role", account.member.role],
       ["Your subject", account.member.subject],
-      ["Bucket limit", String(account.limits.buckets)]
+      ["Bucket limit", String(account.limits.buckets)],
+      ...accountBudgetFields(account)
     ])
   );
 }
@@ -3840,6 +4487,15 @@ async function apiKeyCreateCommand(deps, name, options = {}) {
     deps.notice(
       "Do not set TONBO_API_KEY in your own shell: it overrides your `tonbo login`, for this CLI too."
     );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      created.member,
+      options.budget,
+      created.name,
+      `The API key ${created.name}`
+    );
 }
 async function apiKeyShowCommand(deps, keyId, options = {}) {
   const apiKey = await deps.api.getApiKey(await deps.auth.apiKey(), keyId);
@@ -3898,7 +4554,7 @@ async function bucketCreateCommand(deps, name, options = {}) {
   const bucket = await deps.api.createBucket(
     await deps.auth.apiKey(),
     { name, region: options.region },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4029,7 +4685,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
   const database = await deps.api.createDatabase(
     await deps.auth.apiKey(),
     { name, region: options.region, expires_at: expiresAt },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4217,7 +4873,7 @@ async function streamCreateCommand(deps, name, options = {}) {
       content_type: options.contentType,
       expires_at: expiresAt
     },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4441,10 +5097,11 @@ async function accountUseCommand(deps, account, options = {}) {
 import { Help } from "commander";
 
 // src/machine.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { readFileSync } from "node:fs";
 
 // src/volume.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
@@ -4479,7 +5136,19 @@ function volumeFields(volume) {
     ["Machine", boundText(volume)],
     ["Size", `${volume.size_gib} GiB`],
     ["Live bytes", `${bytes(volume.live_bytes)} (billed)`],
-    ["Last commit", volume.last_commit_at ?? "none yet"],
+    ["Last meter report", volume.last_commit_at ?? "none yet"],
+    [
+      "Restored to",
+      volume.restored_to ? `${volume.restored_to.committed_at} (generation ${volume.restored_to.data_generation})` : "none"
+    ],
+    [
+      "Backed up to",
+      volume.backed_up_to ? volume.backed_up_to.committed_at ? `${volume.backed_up_to.committed_at} (generation ${volume.backed_up_to.data_generation}; ${volume.backed_up_to.dirty_bytes} bytes pending copy)` : `empty snapshot (generation ${volume.backed_up_to.data_generation}; ${volume.backed_up_to.dirty_bytes} bytes pending copy)` : "unknown"
+    ],
+    [
+      "Cold GETs",
+      volume.cold ? `${volume.cold.demand_gets} demand, ${volume.cold.hydrate_gets} hydration` : "none"
+    ],
     ["Durability", VOLUME_DURABILITY_LINK],
     ["Created", volume.created_at]
   ]);
@@ -4530,7 +5199,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
     const volume = await deps.api.createVolume(
       key,
       { name, region, size_gib: sizeGib },
-      options.idempotencyKey ?? randomUUID4()
+      options.idempotencyKey ?? randomUUID5()
     );
     print(
       deps,
@@ -4595,7 +5264,10 @@ var MACHINE_ERROR_HINTS = {
   image_pulling: "The Machine's image is still being pulled; the request was not run. Try again shortly; `tonbo machine show` reports the image's state.",
   image_failed: "The Machine's image could not be pulled; `tonbo machine show` says why. Fix the image, then name it again with `tonbo machine update --image`.",
   machine_kind_mismatch: "That Machine is one of your computers: `tonbo machine show` and `tonbo machine delete` serve it, and nothing else does.",
-  volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed."
+  volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed.",
+  secret_env_conflict: "Use another secret key or remove the non-secret env variable with that name.",
+  secret_limit: "Reduce the number or byte size of this Machine's secrets.",
+  wake_unavailable: "The wake was refused for now; nothing woke. Wake it again after a while; `tonbo machine show` says why it is blocked."
 };
 var MACHINE_IMAGE_FAILURE_HINTS = {
   image_unavailable: "The registry no longer serves that image publicly, or served other bytes for it: publish it again, or use another image",
@@ -4627,7 +5299,7 @@ function ifMatchHeader(value) {
 }
 function explainMachineError(error) {
   if (!(error instanceof HttpError) || error.code === null) return error;
-  const hint = MACHINE_ERROR_HINTS[error.code];
+  const hint = budgetHint(error) ?? MACHINE_ERROR_HINTS[error.code];
   if (!hint) return error;
   return new HttpError(`${error.message}
 ${hint}`, error.status, error.body, error.requestId);
@@ -4657,7 +5329,13 @@ function portText(port) {
 function machinePortsText(machine) {
   return machine.ports.length ? machine.ports.map(portText).join(", ") : "none";
 }
-var { earlyReclaimSeconds, pollAfterSeconds, sleepPollAfterSeconds, wakeHoldSeconds } = machineTimings;
+var {
+  earlyReclaimSeconds,
+  pollAfterSeconds,
+  sleepPollAfterSeconds,
+  wakePollAfterSeconds,
+  wakeHoldSeconds
+} = machineTimings;
 function machineState(machine) {
   if (machine.failure)
     return `${machine.state}: ${machine.failure.code}: ${machine.failure.message}`;
@@ -4704,7 +5382,9 @@ var MACHINE_WAKE_BLOCKED_HINTS = {
   meter_lag: "Tonbo could not confirm the account's usage in time; the next request tries again.",
   crash_backoff: "Its recent wakes failed; see `tonbo machine activations <name>`.",
   capacity: "No host had room for its shape; the next request tries again.",
-  region_closed: "Machines are closed in its region for now; the next request after they reopen wakes it."
+  region_closed: "Machines are closed in its region for now; the next request after they reopen wakes it.",
+  budget_slowdown: "Its budget is close to running out, and this wake would pass the budget's slow-down rate: sleep another Machine of the budget, or lower this one's shape, then wake it again. Machines already awake keep running.",
+  budget_exhausted: "Its budget is used up for the month: it wakes after the budget resets, or once a person raises it in the console."
 };
 var MACHINE_ACCOUNT_EGRESS_BLOCKED_HINT = "If this is the free egress cap: 10 GiB a month without purchased credit; buy credit at <billing> to lift it.";
 function conditionText(name, condition, billing) {
@@ -4885,7 +5565,7 @@ function specWarnings(deps, _ports, envKeys) {
   const secret = envKeys.filter((key) => SECRET_LOOKING.test(key)).sort();
   if (secret.length)
     deps.notice(
-      `${secret.join(", ")} ${secret.length === 1 ? "looks" : "look"} secret: env values are readable by every member through the API; Machine secrets come later.`
+      `${secret.join(", ")} ${secret.length === 1 ? "looks" : "look"} secret: env values are readable by every member through the API; use Machine secrets for private values.`
     );
 }
 function waitTimeout(options) {
@@ -4912,6 +5592,41 @@ async function waitForMachine(deps, key, name, firstWait, every, timeout, settle
     wait = every;
   }
 }
+function secretFromFile(key, file, delivery) {
+  if (!key || !file) throw new Error("Pass a secret as KEY=FILE.");
+  const bytes2 = readFileSync(file === "-" ? 0 : file);
+  if (bytes2.byteLength > machineSecretLimits.valueMaxBytes)
+    throw new Error(`Secret ${key} exceeds the ${machineSecretLimits.valueMaxBytes}-byte limit.`);
+  if (delivery === "file") return { delivery, value_base64: bytes2.toString("base64") };
+  let value;
+  try {
+    value = new TextDecoder("utf-8", { fatal: true }).decode(bytes2);
+  } catch {
+    throw new Error(`Secret ${key} is not UTF-8; use --secret-file for binary bytes.`);
+  }
+  return { delivery, value };
+}
+function createSecrets(options) {
+  const values = {};
+  let total = 0;
+  for (const [delivery, entries] of [
+    ["env", options.secretEnv],
+    ["file", options.secretFile]
+  ]) {
+    for (const entry of entries ?? []) {
+      const separator = entry.indexOf("=");
+      if (separator < 1) throw new Error("Pass a secret as KEY=FILE.");
+      const key = entry.slice(0, separator);
+      if (Object.hasOwn(values, key)) throw new Error(`Secret ${key} was named twice.`);
+      const secret = secretFromFile(key, entry.slice(separator + 1), delivery);
+      total += "value" in secret ? Buffer.byteLength(secret.value, "utf8") : Buffer.from(secret.value_base64, "base64").byteLength;
+      if (Object.keys(values).length >= machineSecretLimits.perMachine || total > machineSecretLimits.totalMaxBytes)
+        throw new Error("Machine secrets exceed their count or total byte limit.");
+      values[key] = secret;
+    }
+  }
+  return values;
+}
 function deleteAfterSeconds(option) {
   if (typeof option === "number") return option;
   return option === false ? null : void 0;
@@ -4964,6 +5679,50 @@ async function machineListCommand(deps, options = {}) {
       );
   });
 }
+async function machineSecretListCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const secrets = await deps.api.listMachineSecrets(await deps.auth.apiKey(), name);
+    print(
+      deps,
+      options.json,
+      secrets,
+      secrets.length ? table(
+        ["KEY", "DELIVERY", "VERSION", "UPDATED", "BY"],
+        secrets.map((secret) => [
+          secret.key,
+          secret.delivery,
+          String(secret.version),
+          secret.updated_at,
+          secret.updated_by.sub
+        ])
+      ) : `Machine ${name} has no secrets.`
+    );
+  });
+}
+async function machineSecretSetCommand(deps, name, secretKey, options) {
+  await machineCommand(async () => {
+    const entry = await deps.api.setMachineSecret(
+      await deps.auth.apiKey(),
+      name,
+      secretKey,
+      secretFromFile(secretKey, options.from, options.delivery ?? "env")
+    );
+    print(
+      deps,
+      options.json,
+      entry,
+      `Set ${entry.key} on Machine ${name} (version ${entry.version}; applies at the next activation).`
+    );
+  });
+}
+async function machineSecretUnsetCommand(deps, name, secretKey) {
+  await machineCommand(async () => {
+    await deps.api.unsetMachineSecret(await deps.auth.apiKey(), name, secretKey);
+    deps.output(
+      `Removed ${secretKey} from Machine ${name}; the next activation will not receive it.`
+    );
+  });
+}
 function conditionsCell(machine) {
   const conditions = machine.status.conditions ?? [];
   if (!conditions.length) return "-";
@@ -5046,6 +5805,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
     if (!options.image) throw new Error("Pass --image <reference>.");
     const timeout = waitTimeout(options);
     const env = parseEnv(options.env ?? []);
+    const secrets = createSecrets(options);
     const ports = withDefault(parsePorts(options.port ?? []), options.defaultPort);
     const key = await deps.auth.apiKey();
     const bound = typeof options.volume === "string" ? await resolveVolumeBinding(deps, key, options.volume) : null;
@@ -5068,6 +5828,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           command: command.length ? command : void 0,
           ports: ports.length ? ports : void 0,
           env: Object.keys(env).length ? env : void 0,
+          ...Object.keys(secrets).length ? { secrets } : {},
           sleep_after_seconds: options.sleepAfter,
           idle_action: options.idleAction,
           stop_grace_seconds: options.stopGrace,
@@ -5076,7 +5837,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           ...database ? { database: database.name } : {},
           ...options.database === false ? { database: null } : {}
         },
-        options.idempotencyKey ?? randomUUID5()
+        options.idempotencyKey ?? randomUUID6()
       );
     } catch (error) {
       if (error instanceof HttpError && error.code === "name_taken")
@@ -5116,11 +5877,16 @@ async function machineShowCommand(deps, name, options = {}) {
     const key = await deps.auth.apiKey();
     const { machine, etag } = await deps.api.getMachineWithEtag(key, name);
     const lastEnd = options.json || machine.kind === "byoc" || machine.state !== "active" ? null : await lastActivationEnd(deps, key, machine.name);
+    const processes = options.json || machine.kind === "byoc" || machine.state !== "active" || !deps.processes ? null : await deps.processes(key, machine.region, machine.name);
+    const processLines = processes ? [
+      ...processes.running.map((line) => `Background process: ${line}`),
+      ...processes.last ? [`Last background process: ${processes.last}`] : []
+    ] : [];
     print(
       deps,
       options.json,
       machine,
-      anyMachineText(machine, await billingUrl(deps), etag, lastEnd)
+      [anyMachineText(machine, await billingUrl(deps), etag, lastEnd), ...processLines].join("\n")
     );
   });
 }
@@ -5168,9 +5934,14 @@ function appliesText(name, change) {
     lines.push(
       change.delete_after_seconds === null ? "The Machine is no longer deleted for being asleep." : "Delete-after applies now; `tonbo machine show` says when."
     );
-  const later = [change.image, change.command, change.shape, change.env, change.volumes].some(
-    (field) => field !== void 0
-  );
+  const later = [
+    change.image,
+    change.command,
+    change.shape,
+    change.env,
+    change.volumes,
+    change.database
+  ].some((field) => field !== void 0);
   if (later) {
     lines.push(
       `The change applies at the next activation. To apply it now, run \`tonbo machine sleep ${name}\`; the next request boots the new spec.`
@@ -5220,6 +5991,8 @@ async function machineUpdateCommand(deps, name, command, options = {}) {
     if (options.volume === false) change.volumes = [];
     else if (typeof options.volume === "string")
       change.volumes = [(await resolveVolumeBinding(deps, key, options.volume)).binding];
+    if (options.database === false) change.database = null;
+    else if (typeof options.database === "string") change.database = options.database;
     if (options.discardSnapshot) change.discard_snapshot = true;
     if (Object.values(change).every((value) => value === void 0))
       throw new Error("Nothing to change: pass at least one option or a command.");
@@ -5281,6 +6054,42 @@ async function machineSleepCommand(deps, name, options = {}) {
     );
   });
 }
+function wokenText(machine, waking) {
+  if (!waking) return `Machine ${machine.name} is awake.`;
+  return `Machine ${machine.name} is waking; \`tonbo machine show ${machine.name}\` says when it is awake.`;
+}
+async function machineWakeCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const timeout = waitTimeout(options);
+    const key = await deps.auth.apiKey();
+    const { machine, retryAfterSeconds: retryAfterSeconds2 } = await deps.api.wakeMachine(
+      key,
+      name,
+      ifMatchHeader(options.ifMatch)
+    );
+    const waking = retryAfterSeconds2 !== null;
+    if (!options.wait || !waking) {
+      print(deps, options.json, machine, wokenText(machine, waking));
+      return;
+    }
+    const { machine: awake, waited } = await waitForMachine(
+      deps,
+      key,
+      name,
+      retryAfterSeconds2 ?? wakePollAfterSeconds,
+      wakePollAfterSeconds,
+      timeout,
+      (read) => read.status.power === "awake" || read.state !== "active"
+    );
+    if (!awake)
+      throw new Error(
+        `Machine ${name} is not awake after ${waited} s; \`tonbo machine show ${name}\` says why.`
+      );
+    if (awake.status.power !== "awake")
+      throw new Error(`Machine ${name} is ${awake.state}; it did not wake.`);
+    print(deps, options.json, awake, `Machine ${awake.name} is awake (after ${waited} s).`);
+  });
+}
 async function machineDeleteCommand(deps, name, options = {}) {
   await machineCommand(async () => {
     const key = await deps.auth.apiKey();
@@ -5526,6 +6335,34 @@ var COMMAND_HELP = {
       "--idempotency-key": "a new UUID"
     }
   },
+  "tonbo budget list": {
+    about: [
+      "Lists the account's monthly spend budgets, the account budget first, with each one's stage and what it has used of its limit this UTC month. You see a budget's figures with `usage.read`, or when it covers you; of any other budget only its stage, reset and console link."
+    ],
+    examples: ["tonbo budget list"]
+  },
+  "tonbo budget show": {
+    about: [
+      "Prints one budget: its limit, what was charged and what is committed this month, whom it covers, its stage, when it resets (00:00 UTC on the 1st) and its page in the console."
+    ],
+    examples: ["tonbo budget show pi-agent"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
+  "tonbo budget add": {
+    about: [
+      "Creates a budget over you, or over Agents you created, which counts the compute and outbound data of the Machines they create. Only the console sets the account budget or covers another member."
+    ],
+    examples: ["tonbo budget add pi-agent --limit 50 --member pi-agent"],
+    arguments: { name: "the budget's name, unique in the account" },
+    defaults: { "--member": "yourself" }
+  },
+  "tonbo budget set": {
+    about: [
+      "Lowers the budget that covers you, or adds Agents you created to it. Raising a limit, renaming, removing and every change to another budget are the console's: the command prints the budget's page and opens it instead."
+    ],
+    examples: ["tonbo budget set pi-agent --limit 25"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
   "tonbo api-key list": {
     about: [
       "Shows your keys, or every key of the account for an owner or admin, with the last four characters of each secret, whether it is read-only, what it reaches of buckets, databases and streams, and when it expires and was last used."
@@ -5713,7 +6550,7 @@ var COMMAND_HELP = {
   "tonbo machine create": {
     about: [
       "Creates a Machine, a VM booted from an image in one region. It has no database of its own: `--database <name>` binds one of the account's databases of its region, which it then reaches at `TONBO_DATABASE_URL`, and a database binds one Machine at a time; its files can last on a Volume (`--volume`), and its program can open any other database by URL with a key. The image is a public OCI image with a linux/arm64 variant, from Docker Hub or another public registry (`nginx:1.27`, `ghcr.io/org/app:v1`, or one pinned by digest), or `tonbo.dev/platform`, the platform image. A registry reachable only over IPv6, one named by an IP address, and one that redirects its manifests are refused. The CLI resolves a registry image to its linux/arm64 digest, and the image is pulled before the Machine leaves `creating`.",
-      "The Machine is served at `https://<name>-<account>.tonbo.sh` on its default port. `--port <port>` serves a private port, which takes a member's token, and `--port <port>:public` an open one, which needs the `machines.public` capability. A command after `--` replaces the image's CMD. The CLI warns on stderr when the Machine has no port, since nothing can wake it then, and when an `--env` key looks secret: env values are readable by every member through the API.",
+      "The Machine is served at `https://<name>-<account>.tonbo.sh` on its default port. `--port <port>` serves a private port, which takes a member's token, and `--port <port>:public` an open one, which needs the `machines.public` capability. A command after `--` replaces the image's CMD. `--secret-env KEY=FILE` and `--secret-file KEY=FILE` read initial secrets from local files and store them with the Machine before its first boot; their values are never returned. The CLI warns on stderr when the Machine has no port, since nothing can wake it then, and when an `--env` key looks secret: env values are readable by every member through the API.",
       "The answer is the Machine while it is `creating`. With `--wait` the CLI reads it until it is `active` or `failed`, or `--timeout` passes: a failure prints what to do and exits 1, and a timeout says it is still creating and undoes nothing. A creation the network or a 5xx answer did not confirm is sent at most three times with the same idempotency key, each retry after its `Retry-After` (at most 30 s) or a short backoff; a `name_taken` refusal says which Machine holds the name and how old it is, in case it is yours from a lost reply. In a region not open for Machines the creation is refused with `region_not_offered`, and nothing is created."
     ],
     examples: ["tonbo machine create web --image nginx:1.27 --port 80:public --wait"],
@@ -5738,10 +6575,32 @@ var COMMAND_HELP = {
     examples: ["tonbo machine show web"],
     arguments: NAME("Machine")
   },
+  "tonbo machine secret list": {
+    about: [
+      "Lists a Machine's secret keys, delivery, version and last writer. The values are never returned."
+    ],
+    examples: ["tonbo machine secret list web"],
+    arguments: { name: "the Machine whose secrets to list" }
+  },
+  "tonbo machine secret set": {
+    about: [
+      "Reads the secret from a local file, or standard input with `--from -`, without putting its value in shell history. `env` delivers UTF-8 text as an environment variable; `file` delivers arbitrary bytes under `$TONBO_SECRETS_DIR`. The new value applies at the next activation."
+    ],
+    examples: ["tonbo machine secret set web API_KEY --from ./api-key.txt"],
+    arguments: { name: "the Machine to change", key: "the secret's environment or file name" },
+    defaults: { "--delivery": "env" }
+  },
+  "tonbo machine secret unset": {
+    about: [
+      "Removes a Machine secret whether or not it exists. A running activation keeps its existing value until the next activation."
+    ],
+    examples: ["tonbo machine secret unset web API_KEY"],
+    arguments: { name: "the Machine to change", key: "the secret to remove" }
+  },
   "tonbo machine update": {
     about: [
       "Changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed.",
-      "Ports and `--sleep-after` apply at once. The image, command, shape and env apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again.",
+      "Ports and `--sleep-after` apply at once. The image, command, shape, env, Volume and database apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again. `--database <name>` binds another database of the account in the Machine's region, which no other Machine binds, and `--no-database` binds none; the database it leaves is kept. A Machine created with its own database keeps it.",
       "`--delete-after` applies at once and keeps the clock, which counts from the end of the Machine's last activation (or its creation), so a lower value can delete a Machine that has already slept that long; `--no-delete-after` turns it off. `tonbo machine show` prints when it will be deleted."
     ],
     examples: ["tonbo machine update web --env MODE=staging --sleep-after 300"],
@@ -5757,11 +6616,13 @@ var COMMAND_HELP = {
   "tonbo machine exec": {
     about: [
       "Runs one command in the Machine's running activation through its region's cell origin, waking the Machine first when it is asleep, and streams its stdout and stderr here as they come; a call that woke the Machine prints its hourly ceiling on stderr. The command runs without a shell, as the image's User, and lives exactly as long as the call: there is no terminal and no streamed stdin, and `--stdin` sends at most 1 MiB read before the call.",
-      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream."
+      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream.",
+      "`--detach` starts the command in the background instead, prints its process id and returns at once: it runs whatever happens to this call, keeps the Machine awake until it ends, and is ended at `--timeout` (default 3600, at most 21600). Read it with `tonbo machine output`, wait for it with `tonbo machine wait`, list them with `tonbo machine ps` and end one with `tonbo machine kill`. A budget or funding stop, or a sleep you ask for, still ends it."
     ],
     examples: [
       "tonbo machine exec web -- ls -la /app",
-      "tonbo machine exec web --timeout 60 -- npm test"
+      "tonbo machine exec web --timeout 60 -- npm test",
+      "tonbo machine exec web --detach -- npm run build"
     ],
     arguments: {
       name: "the Machine's name",
@@ -5769,6 +6630,37 @@ var COMMAND_HELP = {
     },
     defaults: { "--timeout": "600", "--cwd": "the image's WorkingDir" }
   },
+  "tonbo machine ps": {
+    about: [
+      "Lists the Machine's background processes, newest first: those running and those that ended in the last 24 hours, with how each ended. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine ps web"],
+    arguments: { name: "the Machine's name" }
+  },
+  "tonbo machine wait": {
+    about: [
+      "Waits until a background process ends, prints how it ended and exits with its status as `tonbo machine exec` would: its exit code, 128 plus a signal's number, 124 at its timeout, 125 when it was killed and 255 when its outcome is unknown. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine wait web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine output": {
+    about: [
+      "Prints a background process's stdout and stderr together, as it wrote them, from the last 16 MiB the Machine keeps. `--follow` keeps printing until the process ends. The output is gone once the Machine sleeps. It never wakes the Machine."
+    ],
+    examples: [
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f",
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f --follow"
+    ],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine kill": {
+    about: [
+      "Ends a background process: SIGTERM to everything it started, then a kill 5 seconds later. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine kill web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
   "tonbo machine file read": {
     about: [
       "Prints one regular file of the Machine, waking it when it is asleep. A file is gone when the Machine sleeps, so a read that woke it sees only its image."
@@ -5807,6 +6699,30 @@ var COMMAND_HELP = {
     examples: ["tonbo machine file delete web /app/tmp --recursive"],
     arguments: { name: "the Machine's name", path: "the absolute path in the Machine" }
   },
+  "tonbo machine hold set": {
+    about: [
+      "Keeps the Machine awake until at least now plus `--for` (1 hour by default, at most 1 hour). Running it again only moves the end later, so a script can repeat it while its work runs. It never wakes an asleep Machine, and it ends when the Machine sleeps, stops or runs out of credit or budget. An awake Machine is billed as usual. A program inside the Machine sets its own holds on `/run/tonbo-hold.sock`, with no key."
+    ],
+    examples: ["tonbo machine hold set web build --for 30m"],
+    arguments: {
+      name: "the Machine's name",
+      hold: "a name you choose for the hold, such as build"
+    }
+  },
+  "tonbo machine hold rm": {
+    about: [
+      "Releases one hold set from outside the Machine, whether or not it existed. The Machine sleeps `sleep_after` seconds later unless something else keeps it awake."
+    ],
+    examples: ["tonbo machine hold rm web build"],
+    arguments: { name: "the Machine's name", hold: "the hold's name" }
+  },
+  "tonbo machine hold ls": {
+    about: [
+      "Lists the holds of the Machine's current activation, those set from outside and those a program inside set, with when each lapses. An asleep Machine has none."
+    ],
+    examples: ["tonbo machine hold ls web"],
+    arguments: { name: "the Machine's name" }
+  },
   "tonbo machine sleep": {
     about: [
       "Puts an awake Machine to sleep now, and says so when it is already asleep or still creating; its next request boots it on its latest spec. With `--wait` the CLI reads the Machine until it is asleep or `--timeout` passes."
@@ -5815,6 +6731,14 @@ var COMMAND_HELP = {
     arguments: NAME("Machine"),
     defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
   },
+  "tonbo machine wake": {
+    about: [
+      "Wakes an asleep Machine now, without a request to it, and says so when it is already awake. The wake passes the same checks as any other and is billed the same: it needs credit, room on a host and a budget that allows it, and a refused wake says why. With `--wait` the CLI reads the Machine until it is awake or `--timeout` passes."
+    ],
+    examples: ["tonbo machine wake web --wait"],
+    arguments: NAME("Machine"),
+    defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
+  },
   "tonbo machine delete": {
     about: [
       "Deletes the Machine with its disk and logs; a Volume or database it binds stays. Its name is free for a new Machine at once. At a terminal it asks you to type the Machine's name first, and sends the ETag it read then.",
@@ -5993,7 +6917,7 @@ function applyHelp(program) {
 
 // src/machine-cell.ts
 import { readFile as readFile3, writeFile } from "node:fs/promises";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var EXEC_EXIT_CODES = {
   timeout: 124,
   output_limit: 125,
@@ -6146,6 +7070,191 @@ async function machineExecCommand(deps, name, command, options = {}) {
     deps.notice(`The command ended: ${ended.reason}.`);
   exitWith(deps, execExitCode(ended));
 }
+function processEndText(process2) {
+  const end = process2.end;
+  if (!end) return "-";
+  if (end.reason === "exited") return `exited ${end.exit_code ?? 0}`;
+  if (end.reason === "signaled") return `signaled ${end.signal ?? ""}`.trim();
+  return end.reason;
+}
+function processExitCode(process2) {
+  const end = process2.end;
+  if (!end) return 0;
+  if (end.reason === "exited" || end.reason === "signaled" || end.reason === "timeout")
+    return execExitCode({ reason: end.reason, exit_code: end.exit_code, signal: end.signal });
+  return end.reason === "lost" ? EXEC_EXIT_CODES.lost : EXEC_EXIT_CODES.killed;
+}
+async function machineProcessStartCommand(deps, name, command, options = {}) {
+  if (command.length === 0)
+    throw new Error(
+      "Name the command after --, such as `tonbo machine exec web --detach -- npm run build`."
+    );
+  const body = { command };
+  if (options.cwd) body.cwd = options.cwd;
+  if (options.env?.length) body.env = parseEnv2(options.env);
+  if (options.timeout !== void 0) body.timeout_seconds = options.timeout;
+  if (options.expectActivation) body.expect_activation = options.expectActivation;
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    if (options.stdin) body.stdin = Buffer.from(await readAllStdin(deps)).toString("base64");
+    const response = await cellApi(deps).fetch("startMachineProcess", key, region, {
+      params: { name },
+      headers: {
+        "content-type": "application/json",
+        "idempotency-key": options.idempotencyKey ?? randomUUID7()
+      },
+      body: JSON.stringify(body)
+    });
+    const { data } = await response.json();
+    if (response.headers.get("tonbo-woke") === "true") {
+      const ceiling = response.headers.get("tonbo-ceiling-usd-micros-per-hour");
+      noticeWake(
+        deps,
+        {
+          activation: data.activation,
+          woke: true,
+          ceiling_usd_micros_per_hour: ceiling === null ? null : Number(ceiling)
+        },
+        name
+      );
+    }
+    print(
+      deps,
+      options.json,
+      data,
+      response.status === 200 ? `${data.process} (already started under this key, ${data.state})` : data.process
+    );
+    if (!options.json && response.status !== 200)
+      deps.notice(
+        `Started; it keeps ${name} awake until it ends or at ${data.deadline}. Read it with \`tonbo machine output ${name} ${data.process}\`, wait for it with \`tonbo machine wait ${name} ${data.process}\`.`
+      );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function readProcess(deps, key, region, name, id) {
+  return cellApi(deps).json("getMachineProcess", key, region, {
+    params: { name, process: id }
+  });
+}
+function processFields(process2) {
+  return fields([
+    ["process", process2.process],
+    ["state", process2.state],
+    ["command", (process2.argv_preview ?? []).join(" ") || "-"],
+    ["started", process2.started_at],
+    ["deadline", process2.deadline],
+    ["ended", process2.ended_at ?? "-"],
+    ["end", processEndText(process2)],
+    ["activation", process2.activation]
+  ]);
+}
+async function machineProcessListCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const processes = await cellApi(deps).json(
+      "listMachineProcesses",
+      key,
+      region,
+      {
+        params: { name }
+      }
+    );
+    print(
+      deps,
+      options.json,
+      processes,
+      processes.length === 0 ? `${name} has no background processes.` : table(
+        ["PROCESS", "STATE", "STARTED", "END", "COMMAND"],
+        processes.map((process2) => [
+          process2.process,
+          process2.state,
+          process2.started_at,
+          processEndText(process2),
+          (process2.argv_preview ?? []).join(" ")
+        ])
+      )
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessWaitCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let process2 = await readProcess(deps, key, region, name, id);
+    while (process2.state === "running") {
+      await sleep(2e3);
+      process2 = await readProcess(deps, key, region, name, id);
+    }
+    print(deps, options.json, process2, processFields(process2));
+    exitWith(deps, processExitCode(process2));
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessOutputCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let offset = options.offset ?? 0;
+    for (; ; ) {
+      const response = await cellApi(deps).fetch("readMachineProcessOutput", key, region, {
+        params: { name, process: id },
+        query: { offset: String(offset) }
+      });
+      const bytes2 = new Uint8Array(await response.arrayBuffer());
+      const start = Number(response.headers.get("tonbo-output-start") ?? offset);
+      if (start > offset)
+        deps.notice(`(${start - offset} bytes before offset ${start} were dropped from the ring)`);
+      if (bytes2.length) writeBytes(deps, "stdout", bytes2);
+      offset = Number(response.headers.get("tonbo-output-next-offset") ?? start + bytes2.length);
+      const ended = response.headers.get("tonbo-process-state") === "ended";
+      if (start + bytes2.length < offset) continue;
+      if (!options.follow || ended) break;
+      await sleep(1e3);
+    }
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessKillCommand(deps, name, id, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const process2 = await cellApi(deps).json("killMachineProcess", key, region, {
+      params: { name, process: id }
+    });
+    print(
+      deps,
+      options.json,
+      process2,
+      process2.state === "ended" ? `${id} had already ended: ${processEndText(process2)}.` : `Killing ${id}; it ends within a few seconds.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessSummary(cell, key, region, name) {
+  try {
+    const processes = await cell.json("listMachineProcesses", key, region, {
+      params: { name }
+    });
+    const line = (process2) => `${process2.process} ${(process2.argv_preview ?? []).join(" ")} (${process2.state === "running" ? `until ${process2.deadline}` : processEndText(process2)})`;
+    const last = processes.find((process2) => process2.state === "ended");
+    return {
+      running: processes.filter((process2) => process2.state === "running").map(line),
+      last: last ? line(last) : null
+    };
+  } catch {
+    return null;
+  }
+}
 async function machineFileReadCommand(deps, name, path4, options = {}) {
   try {
     const key = await deps.auth.apiKey();
@@ -6176,7 +7285,7 @@ async function machineFileWriteCommand(deps, name, path4, options = {}) {
         "if-none-match": options.create ? "*" : void 0,
         "tonbo-file-mode": options.mode,
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID7()
       },
       body: new Uint8Array(bytes2)
     });
@@ -6259,7 +7368,7 @@ async function machineFileDeleteCommand(deps, name, path4, options = {}) {
       query: { path: path4, recursive: options.recursive ? "true" : void 0 },
       headers: {
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID7()
       }
     });
     print(deps, options.json, { path: path4 }, `Deleted ${path4}.`);
@@ -6267,6 +7376,76 @@ async function machineFileDeleteCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
+var HOLD_MAX_SECONDS = 3600;
+function parseHoldDuration(value) {
+  const match = /^(\d+)\s*([smh]?)$/.exec(value.trim());
+  const unit = { "": 1, s: 1, m: 60, h: 3600 }[match?.[2] ?? ""] ?? 1;
+  const seconds = match ? Number(match[1]) * unit : Number.NaN;
+  if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > HOLD_MAX_SECONDS)
+    throw new Error(`--for ${value} is not between 1 second and 1 hour, such as 90s, 45m or 1h.`);
+  return seconds;
+}
+async function machineHoldSetCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const placed = await cellApi(deps).json("setMachineHold", key, region, {
+      params: { name, hold },
+      headers: {
+        "content-type": "application/json",
+        "tonbo-expect-activation": options.expectActivation
+      },
+      body: JSON.stringify({ seconds: options.for ?? HOLD_MAX_SECONDS })
+    });
+    print(
+      deps,
+      options.json,
+      placed,
+      `${name} stays awake until ${placed.until} (hold ${placed.hold}). Run this again before then to extend it; \`tonbo machine hold rm ${name} ${placed.hold}\` lets it sleep. An awake Machine is billed as usual.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldRmCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    await cellApi(deps).fetch("releaseMachineHold", key, region, { params: { name, hold } });
+    print(
+      deps,
+      options.json,
+      { hold },
+      `Released ${hold}. ${name} sleeps once nothing else keeps it awake.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldLsCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const holds = await cellApi(deps).json("listMachineHolds", key, region, {
+      params: { name }
+    });
+    print(
+      deps,
+      options.json,
+      holds,
+      holds.length === 0 ? `${name} has no holds.` : table(
+        ["HOLD", "SET FROM", "UNTIL"],
+        holds.map((entry) => [
+          entry.hold,
+          entry.source === "guest" ? "inside the Machine" : "outside (API or CLI)",
+          entry.until
+        ])
+      )
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
 
 // src/prompt.ts
 import select from "@inquirer/select";
@@ -6526,7 +7705,7 @@ async function sshCertificateIssueCommand(deps, options) {
 
 // src/app.ts
 var packageVersion = JSON.parse(
-  readFileSync(new URL("../../package.json", import.meta.url), "utf8")
+  readFileSync2(new URL("../../package.json", import.meta.url), "utf8")
 );
 function createDependencies(selection = {}) {
   const api = apiOrigin();
@@ -6537,8 +7716,9 @@ function createDependencies(selection = {}) {
     loginOrigin: loginOrigin(api),
     account
   });
+  const notice = (text) => console.error(text);
   return {
-    api: new ManagementApi(fetch, api),
+    api: new ManagementApi(noticingBudget(fetch, notice), api),
     ask: terminalAsk,
     auth: new AuthClient(
       credentials,
@@ -6554,7 +7734,9 @@ function createDependencies(selection = {}) {
     credentials,
     interactive: () => process.stdin.isTTY === true && process.stderr.isTTY === true,
     output: (text) => console.log(text),
-    notice: (text) => console.error(text),
+    notice,
+    openUrl: openBrowser,
+    processes: (key, region, name) => machineProcessSummary(new CellApi(fetch), key, region, name),
     progress: new TerminalProgress(process.stderr),
     select: terminalSelect
   };
@@ -6568,7 +7750,7 @@ function parseWhole(value) {
   return Number(value);
 }
 function operationOptions(command, operationId) {
-  const query = managementOperations[operationId].query;
+  const query = managementOperation(operationId).query;
   if (query.includes("limit"))
     command.option("--limit <count>", "the most items to return", parseLimit);
   if (query.includes("cursor"))
@@ -6577,6 +7759,10 @@ function operationOptions(command, operationId) {
 }
 var ifMatchHelp = (action) => `${action} only the Machine at the ETag \`tonbo machine show\` printed (with or without its quotes)`;
 var repeated = (value, previous = []) => [...previous, value];
+var budgetOption = (whom) => new Option(
+  "--budget <budget>",
+  `put ${whom} under a monthly budget: an amount in dollars such as 50 creates one, a budget's name adds to it`
+).hideHelp();
 var roleOption = (description) => new Option("--role <role>", description).choices(accountRoles);
 function machineSpecOptions(command, update) {
   const later = update ? "; applies at the next boot" : "";
@@ -6684,7 +7870,7 @@ function createProgram(makeDependencies = createDependencies) {
     ).option(
       "--idempotency-key <key>",
       "reuse the key of an unconfirmed creation to get the Agent it created"
-    ),
+    ).addOption(budgetOption("the Agent")),
     "createAgent"
   ).action(
     async (name, options) => agentCreateCommand(dependencies(), name, options)
@@ -6719,7 +7905,7 @@ function createProgram(makeDependencies = createDependencies) {
       repeated
     ).addOption(
       new Option("--expires-in <period>", "when the key expires").choices(apiKeyExpirations)
-    ),
+    ).addOption(budgetOption("the key's member")),
     "createApiKey"
   ).action(
     async (name, options) => apiKeyCreateCommand(dependencies(), name, options)
@@ -6733,6 +7919,37 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (keyId, options) => apiKeyRevokeCommand(dependencies(), keyId, options)
   );
+  const budget = program.command("budget", { hidden: true }).description("the account's monthly spend budgets");
+  operationOptions(
+    budget.command("list").description("list the budgets, the account budget first"),
+    "listBudgets"
+  ).action(async (options) => budgetListCommand(dependencies(), options));
+  operationOptions(
+    budget.command("show <budget>").description("show one budget, by its name or id"),
+    "getBudget"
+  ).action(
+    async (name, options) => budgetShowCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("add <name>").description("create a budget for you or Agents you created").requiredOption("--limit <dollars>", "the monthly limit in dollars, such as 50").option(
+      "--member <member>",
+      "a member to cover: you, or an Agent you created (subject, id or name); repeat for several",
+      repeated
+    ),
+    "createBudget"
+  ).action(
+    async (name, options) => budgetAddCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("set <budget>").description("lower the budget that covers you, or add Agents you created to it").option("--limit <dollars>", "a lower monthly limit; a raise opens the console").option(
+      "--add <member>",
+      "an Agent you created to cover too (subject, id or name); repeat for several",
+      repeated
+    ),
+    "changeBudget"
+  ).action(
+    async (name, options) => budgetSetCommand(dependencies(), name, options)
+  );
   const bucket = program.command("bucket").description("the account's Streams buckets");
   operationOptions(bucket.command("list").description("list the buckets"), "listBuckets").action(
     async (options) => bucketListCommand(dependencies(), options)
@@ -6900,6 +8117,10 @@ function createProgram(makeDependencies = createDependencies) {
       ).option("--no-database", "bind no database (the default)"),
       false
     ).option(
+      "--secret-env <KEY=FILE>",
+      "read a UTF-8 environment secret from FILE; repeat",
+      repeated
+    ).option("--secret-file <KEY=FILE>", "read binary file secret from FILE; repeat", repeated).option(
       "--idempotency-key <key>",
       "reuse the key of an unconfirmed creation to get the Machine it created"
     ).option("--wait", "wait until the Machine is active, or say why it failed").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
@@ -6913,11 +8134,37 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (name, options) => machineShowCommand(dependencies(), name, options)
   );
+  const machineSecret = machine.command("secret").description("manage a Machine's write-only secrets");
+  operationOptions(
+    machineSecret.command("list <name>").description("list secret keys and delivery, never values"),
+    "listMachineSecrets"
+  ).action(
+    async (name, options) => machineSecretListCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    machineSecret.command("set <name> <key>").description(
+      "set a secret from a local file or standard input; applies at the next activation"
+    ).requiredOption("--from <file>", "read the value from FILE, or - for standard input").addOption(
+      new Option("--delivery <mode>", "env or file (binary)").choices(["env", "file"]).default("env")
+    ),
+    "setMachineSecret"
+  ).action(
+    async (name, key, options) => machineSecretSetCommand(dependencies(), name, key, options)
+  );
+  operationOptions(
+    machineSecret.command("unset <name> <key>").description("remove a secret at the next activation"),
+    "unsetMachineSecret"
+  ).action(
+    async (name, key) => machineSecretUnsetCommand(dependencies(), name, key)
+  );
   operationOptions(
     machineSpecOptions(
       machine.command("update <name> [command...]").description(
         "change a Machine; [command...] after -- replaces its command at the next boot"
-      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
+      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option(
+        "--database <name>",
+        "bind the account's database <name> of the Machine's region instead; applies at the next wake"
+      ).option("--no-database", "bind no database from the next wake; the database is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
       true
     ),
     "updateMachine"
@@ -6927,13 +8174,16 @@ function createProgram(makeDependencies = createDependencies) {
   operationOptions(
     machine.command("exec <name> [command...]").description(
       "run a command in a Machine, waking it first, and print its output; exits with its status"
+    ).option(
+      "--detach",
+      "start it in the background and print its id at once; it keeps the Machine awake until it ends or its timeout"
     ).option("--cwd <path>", "the working directory, an absolute path").option(
       "--env <KEY=VALUE>",
       "set an environment variable for the command; repeat for several",
       repeated
     ).option(
       "--timeout <seconds>",
-      "kill the command after this many seconds (default 600, at most 3600)",
+      "kill the command after this many seconds (default 600, at most 3600; with --detach default 3600, at most 21600)",
       parseWhole
     ).option("--stdin", "send this process's stdin to the command (at most 1 MiB)").option(
       "--expect-activation <activation>",
@@ -6944,7 +8194,31 @@ function createProgram(makeDependencies = createDependencies) {
     ),
     "execMachineCommand"
   ).action(
-    async (name, command, options) => machineExecCommand(dependencies(), name, command, options)
+    async (name, command, options) => options.detach ? machineProcessStartCommand(dependencies(), name, command, options) : machineExecCommand(dependencies(), name, command, options)
+  );
+  operationOptions(
+    machine.command("ps <name>").description("list a Machine's background processes, running and recently ended"),
+    "listMachineProcesses"
+  ).action(
+    async (name, options) => machineProcessListCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    machine.command("wait <name> <process>").description("wait for a background process to end; exits with its status"),
+    "getMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessWaitCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("output <name> <process>").description("print a background process's output, stdout and stderr together").option("--offset <bytes>", "start at this byte offset", parseWhole).option("--follow", "keep printing new output until the process ends"),
+    "readMachineProcessOutput"
+  ).action(
+    async (name, id, options) => machineProcessOutputCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("kill <name> <process>").description("end a background process: SIGTERM, then a kill after 5 seconds"),
+    "killMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessKillCommand(dependencies(), name, id, options)
   );
   const file = machine.command("file").description("read, write, stat, list and delete a Machine's files");
   operationOptions(
@@ -6977,12 +8251,41 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (name, path4, options) => machineFileDeleteCommand(dependencies(), name, path4, options)
   );
+  const hold = machine.command("hold").description("keep a Machine awake for work that has no open connection");
+  operationOptions(
+    hold.command("set <name> <hold>").description("keep a Machine awake until a hold lapses; never wakes it").option(
+      "--for <duration>",
+      "how long from now, such as 90s, 45m or 1h (at most 1h)",
+      parseHoldDuration
+    ).option("--expect-activation <activation>", "hold only this activation"),
+    "setMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldSetCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("rm <name> <hold>").description("release a hold set from outside the Machine"),
+    "releaseMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldRmCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("ls <name>").description("list what holds a Machine awake"),
+    "listMachineHolds"
+  ).action(
+    async (name, options) => machineHoldLsCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("sleep <name>").description("put a Machine to sleep now; its next request boots it on its latest spec").option("--if-match <etag>", ifMatchHelp("put to sleep")).option("--wait", "wait until the Machine is asleep").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
     "sleepMachine"
   ).action(
     async (name, options) => machineSleepCommand(dependencies(), name, options)
   );
+  operationOptions(
+    machine.command("wake <name>").description("wake an asleep Machine now, without a request to it").option("--if-match <etag>", ifMatchHelp("wake")).option("--wait", "wait until the Machine is awake").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
+    "wakeMachine"
+  ).action(
+    async (name, options) => machineWakeCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("delete <name>").description("delete a Machine with its disk and logs, or forget one of your computers").option("--yes", "delete without asking; required when stdin is not a terminal").option("--if-match <etag>", ifMatchHelp("delete")),
     "deleteMachine"