@tonbo/cli 0.14.1 → 0.15.0

package/dist/bin/tonbo.js

@@ -574,6 +574,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "leaveYieldOrganization": {
+    "method": "POST",
+    "path": "/yield/leave",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "recordYieldMetric": {
     "method": "POST",
     "path": "/yield/metrics",
@@ -600,6 +607,13 @@ var managementOperations = {
     "query": [],
     "idempotencyKey": false
   },
+  "createYieldPickup": {
+    "method": "POST",
+    "path": "/yield/pickups",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false
+  },
   "listYieldQuestions": {
     "method": "GET",
     "path": "/yield/questions",
@@ -794,6 +808,16 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine sleep"
   },
+  "wakeMachine": {
+    "method": "POST",
+    "path": "/machines/{name}/wake",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wake"
+  },
   "listMachineActivations": {
     "method": "GET",
     "path": "/machines/{name}/activations",
@@ -924,6 +948,101 @@ var managementOperations = {
     "cli": "tonbo machine file list",
     "cell": true
   },
+  "listMachineProcesses": {
+    "method": "GET",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine ps",
+    "cell": true
+  },
+  "startMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{name}/processes",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo machine exec --detach",
+    "cell": true
+  },
+  "getMachineProcess": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine wait",
+    "cell": true
+  },
+  "killMachineProcess": {
+    "method": "DELETE",
+    "path": "/machines/{name}/processes/{process}",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine kill",
+    "cell": true
+  },
+  "readMachineProcessOutput": {
+    "method": "GET",
+    "path": "/machines/{name}/processes/{process}/output",
+    "pathParams": [
+      "name",
+      "process"
+    ],
+    "query": [
+      "offset"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine output",
+    "cell": true
+  },
+  "listMachineHolds": {
+    "method": "GET",
+    "path": "/machines/{name}/holds",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold ls",
+    "cell": true
+  },
+  "setMachineHold": {
+    "method": "PUT",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold set",
+    "cell": true
+  },
+  "releaseMachineHold": {
+    "method": "DELETE",
+    "path": "/machines/{name}/holds/{hold}",
+    "pathParams": [
+      "name",
+      "hold"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine hold rm",
+    "cell": true
+  },
   "issueSshCertificate": {
     "method": "POST",
     "path": "/ssh/certificates",
@@ -1059,6 +1178,182 @@ var managementOperations = {
     "cli": "tonbo stream usage"
   }
 };
+var plannedManagementOperations = {
+  "listBudgets": {
+    "method": "GET",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget list"
+  },
+  "createBudget": {
+    "method": "POST",
+    "path": "/budgets",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo budget add"
+  },
+  "getBudget": {
+    "method": "GET",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget show"
+  },
+  "changeBudget": {
+    "method": "PATCH",
+    "path": "/budgets/{budget_id}",
+    "pathParams": [
+      "budget_id"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo budget set"
+  },
+  "getMachineActivation": {
+    "method": "GET",
+    "path": "/machines/{name}/activations/{activation}",
+    "pathParams": [
+      "name",
+      "activation"
+    ],
+    "query": [
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine activation show"
+  },
+  "getMachineUsage": {
+    "method": "GET",
+    "path": "/machines/{name}/usage",
+    "pathParams": [
+      "name"
+    ],
+    "query": [
+      "from",
+      "to",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine usage"
+  },
+  "setMachineProcessDeadline": {
+    "method": "PUT",
+    "path": "/machines/{machine}/processes/{process}/deadline",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine extend",
+    "cell": true
+  },
+  "signalMachineProcess": {
+    "method": "POST",
+    "path": "/machines/{machine}/processes/{process}/signal",
+    "pathParams": [
+      "machine",
+      "process"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo machine signal",
+    "cell": true
+  },
+  "createMachineDirectory": {
+    "method": "PUT",
+    "path": "/machines/{machine}/files/directory",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "parents",
+      "mode",
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mkdir",
+    "cell": true
+  },
+  "renameMachineFile": {
+    "method": "POST",
+    "path": "/machines/{machine}/files/rename",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "user"
+    ],
+    "idempotencyKey": true,
+    "cli": "tonbo machine file mv",
+    "cell": true
+  },
+  "getMachineFileArchive": {
+    "method": "GET",
+    "path": "/machines/{machine}/files/archive",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "path",
+      "format",
+      "user"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine file archive",
+    "cell": true
+  },
+  "readMachineLogs": {
+    "method": "GET",
+    "path": "/machines/{machine}/logs",
+    "pathParams": [
+      "machine"
+    ],
+    "query": [
+      "activation",
+      "cursor",
+      "since",
+      "limit",
+      "follow"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine logs",
+    "cell": true
+  },
+  "listSshCertificates": {
+    "method": "GET",
+    "path": "/ssh/certificates",
+    "pathParams": [],
+    "query": [
+      "member",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate list",
+    "cell": true
+  },
+  "revokeSshCertificate": {
+    "method": "DELETE",
+    "path": "/ssh/certificates/{certificate}",
+    "pathParams": [
+      "certificate"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo ssh certificate revoke",
+    "cell": true
+  }
+};
 var accountRoles = [
   "owner",
   "admin",
@@ -1673,6 +1968,7 @@ var machinePortAccess = [
 var machineTimings = {
   "pollAfterSeconds": 2,
   "sleepPollAfterSeconds": 5,
+  "wakePollAfterSeconds": 2,
   "wakeHoldSeconds": 25,
   "earlyReclaimSeconds": 120
 };
@@ -1745,6 +2041,9 @@ async function requestJson(fetcher, url, init = {}) {
 
 // ../../packages/tonbo-cli-core/dist/src/api.js
 var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
+function managementOperation(operationId) {
+  return operationId in managementOperations ? managementOperations[operationId] : plannedManagementOperations[operationId];
+}
 var DEFAULT_LOGIN_HINT2 = credentialsContract.reader.login_hint;
 var ExchangeRefusal = class extends HttpError {
 };
@@ -1789,7 +2088,7 @@ var ManagementApi = class {
     }
   }
   async requestWith(operationId, key, { params = {}, query = {}, body, idempotencyKey, ifMatch }, seen) {
-    const operation = managementOperations[operationId];
+    const operation = managementOperation(operationId);
     const path4 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
       if (value === void 0)
@@ -1855,6 +2154,27 @@ var ManagementApi = class {
       idempotencyKey
     }).catch(unconfirmed("Agent creation", idempotencyKey, "the same name, role and region"));
   }
+  /** The account's budgets (planned: 404 until budgets are served). */
+  listBudgets(key) {
+    return this.call("listBudgets", key);
+  }
+  getBudget(key, budgetId) {
+    return this.call("getBudget", key, { params: { budget_id: budgetId } });
+  }
+  /** A replay with the same idempotency key returns the budget the first
+   * request created. */
+  createBudget(key, request, idempotencyKey) {
+    return this.call("createBudget", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Budget creation", idempotencyKey, "the same name, limit and members"));
+  }
+  changeBudget(key, budgetId, change) {
+    return this.call("changeBudget", key, {
+      params: { budget_id: budgetId },
+      body: withoutUndefined(change)
+    });
+  }
   listApiKeys(key, page) {
     return this.page("listApiKeys", key, page);
   }
@@ -2074,6 +2394,18 @@ var ManagementApi = class {
     });
     return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
   }
+  /** With `etag`, only the Machine that ETag names, at that revision, is
+   * woken (machine-v2.json `etag.if_match.wake` is optional). A 202 carries
+   * the `Retry-After` to read the Machine again after (machine-v2.json
+   * `wake.poll_after_seconds`); a 200 (already awake) carries none. A
+   * refused wake throws the API's problem. */
+  async wakeMachine(key, name, etag) {
+    const headers = { retryAfter: null };
+    const answer = await this.request("wakeMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.retryAfter = response.headers.get("retry-after");
+    });
+    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
+  }
   /** The Machine being deleted or the device forgotten, with its kind; the
    * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
    * says whether a name was released (`managed`: its create never reached its
@@ -2144,11 +2476,42 @@ import os4 from "node:os";
 import { promisify as promisify2 } from "node:util";
 
 // ../../packages/tonbo-cli-core/dist/src/callback-page.js
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
+var LOGO_PIXELS = [
+  [0, 5],
+  [5, 0],
+  [5, 5],
+  [5, 10],
+  [5, 15],
+  [10, 5],
+  [10, 15],
+  [21, 10],
+  [21, 15],
+  [26, 5],
+  [26, 15],
+  [31, 5],
+  [31, 10],
+  [42, 5],
+  [42, 10],
+  [42, 15],
+  [47, 5],
+  [52, 10],
+  [52, 15],
+  [63, 0],
+  [63, 5],
+  [63, 10],
+  [63, 15],
+  [68, 5],
+  [68, 15],
+  [73, 5],
+  [73, 10],
+  [84, 5],
+  [84, 10],
+  [89, 5],
+  [89, 15],
+  [94, 10],
+  [94, 15]
+];
+var LOGO = `<svg class="wordmark" aria-hidden="true" viewBox="0 0 99 20" width="99" height="20"><g fill="currentColor" shape-rendering="crispEdges">${LOGO_PIXELS.map(([x, y]) => `<rect x="${x}" y="${y}" width="5" height="5"/>`).join("")}</g></svg>`;
 var OUTCOMES = {
   complete: {
     status: 200,
@@ -2185,7 +2548,7 @@ function renderCallbackPage(outcome) {
     --ink: #1d1b17;
     --rule: #c9c5ba;
     --quiet: #5c564a;
-    --signal: #d64a03;
+    --signal: #e5673e;
   }
   @media (prefers-color-scheme: dark) {
     :root {
@@ -2193,7 +2556,7 @@ function renderCallbackPage(outcome) {
       --ink: #f3f2ee;
       --rule: #3a362e;
       --quiet: #a49e8f;
-      --signal: #f08b4b;
+      --signal: #e5673e;
     }
   }
   * { box-sizing: border-box; }
@@ -2209,21 +2572,9 @@ function renderCallbackPage(outcome) {
     -webkit-font-smoothing: antialiased;
   }
   header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
+  svg.wordmark {
+    display: block;
     color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
   }
   main {
     display: flex;
@@ -2254,7 +2605,7 @@ function renderCallbackPage(outcome) {
 </style>
 </head>
 <body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<header>${LOGO}</header>
 <main>
   <h1>${title}</h1>
   <p>${body}</p>
@@ -2663,6 +3014,14 @@ var SessionClient = class _SessionClient {
     }
     return bearer;
   }
+  /** Drops every token of `accountId` this process keeps, and its bearer. */
+  forget(accountId) {
+    for (const id of [...this.tokens.keys()])
+      if (id.endsWith(` ${accountId}`))
+        this.tokens.delete(id);
+    this.bearers.delete(accountId);
+    this.workspaces.delete(accountId);
+  }
   /** A token of `accountId` for `audience`, kept until a minute before it expires. */
   async token(audience, accountId) {
     const id = `${audience} ${accountId}`;
@@ -2877,6 +3236,29 @@ var LoginStore = class {
     }
     return accounts;
   }
+  /** Forgets an account the person no longer belongs to (they left it, or
+   * were removed): the login's cache of names is read again without it, it
+   * is no longer the default account, and this process's tokens of it are
+   * dropped. The CLI login itself stays: it still reaches every other
+   * account. Without a CLI login there is nothing to forget. */
+  async forgetAccount(accountId) {
+    const client = await this.session().catch(() => null);
+    if (!client)
+      return;
+    await this.refreshAccounts(client).catch(() => void 0);
+    const latest = await this.sessions.load();
+    if (!latest || latest.session.id !== client.stored.session.id)
+      return;
+    const { [accountId]: _forgotten, ...accounts } = latest.accounts ?? {};
+    const saved = {
+      ...latest,
+      accounts,
+      default_account_id: latest.default_account_id === accountId ? null : latest.default_account_id ?? null
+    };
+    await this.sessions.save(saved);
+    client.stored = saved;
+    client.forget(accountId);
+  }
   /** The id of the account `nameOrId` names, looked up again once when the cache misses. */
   async resolve(client, nameOrId) {
     if (UUID2.test(nameOrId))
@@ -3604,7 +3986,7 @@ var TerminalProgress = class {
 };
 
 // src/commands.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID4 } from "node:crypto";
 
 // src/agent-name.ts
 var AGENT_NAME_RULE = agentNameContract.$defs.name;
@@ -3619,6 +4001,209 @@ function validateAgentName(name) {
   }
 }
 
+// src/budget.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+var BUDGETS_NOT_AVAILABLE = "Budgets are not available yet.";
+function parseDollars(value) {
+  const match = /^\$?([0-9]+)(?:\.([0-9]{1,2}))?$/.exec(value.trim());
+  if (!match) throw new Error(`${value} is not an amount in dollars, such as $50 or 12.50.`);
+  return Number(match[1]) * 1e6 + Number((match[2] ?? "").padEnd(2, "0")) * 1e4;
+}
+var isAmount = (value) => /^\$?[0-9]+(?:\.[0-9]{1,2})?$/.test(value.trim());
+function unavailable(error) {
+  if (error instanceof HttpError && error.status === 404 && error.code !== "budget_not_found")
+    return new HttpError(BUDGETS_NOT_AVAILABLE, 404, error.body, error.requestId);
+  return error;
+}
+async function budgets(deps, key) {
+  return deps.api.listBudgets(key).catch((error) => {
+    throw unavailable(error);
+  });
+}
+async function resolveBudget(deps, key, budget) {
+  const all = await budgets(deps, key);
+  const found = all.find((entry) => entry.id === budget || entry.name === budget);
+  if (!found) throw new Error(`No budget of this account is ${budget}. See \`tonbo budget list\`.`);
+  return found;
+}
+function usedText(budget) {
+  if (budget.limit_micros === void 0) return "\u2014";
+  const used = (budget.settled_micros ?? 0) + (budget.committed_micros ?? 0);
+  return `${usd(used)} of ${usd(budget.limit_micros)}`;
+}
+function budgetFields(budget) {
+  const rows = [
+    ["ID", budget.id],
+    ["Name", budget.name ?? "\u2014"],
+    ["Scope", budget.scope],
+    ["Stage", budget.stage]
+  ];
+  if (budget.limit_micros !== void 0) {
+    rows.push(["Limit", usd(budget.limit_micros)]);
+    rows.push(["Charged", usd(budget.settled_micros ?? 0)]);
+    rows.push(["Committed", usd(budget.committed_micros ?? 0)]);
+  }
+  if (budget.principals?.length) rows.push(["Covers", budget.principals.join(", ")]);
+  if (budget.write_pace)
+    rows.push([
+      "Writes paced",
+      `${budget.write_pace.units_per_second}/s (floor ${budget.write_pace.floor_units_per_second}/s)`
+    ]);
+  rows.push(["Resets", budget.resets_at]);
+  rows.push(["Raise at", budget.raise_url]);
+  return fields(rows);
+}
+async function budgetListCommand(deps, options) {
+  const all = await budgets(deps, await deps.auth.apiKey());
+  print(
+    deps,
+    options.json,
+    all,
+    all.length ? table(
+      ["ID", "NAME", "SCOPE", "STAGE", "USED", "RESETS"],
+      all.map((budget) => [
+        budget.id,
+        budget.name ?? "\u2014",
+        budget.scope,
+        budget.stage,
+        usedText(budget),
+        budget.resets_at
+      ])
+    ) : "No budgets. An owner or admin sets the account budget in the console; `tonbo budget add` sets one for you or an Agent you created."
+  );
+}
+async function budgetShowCommand(deps, budget, options) {
+  const found = await resolveBudget(deps, await deps.auth.apiKey(), budget);
+  print(deps, options.json, found, budgetFields(found));
+}
+async function sendToConsole(deps, url, why) {
+  deps.notice(`${why} An owner or admin makes it in the console: ${url}`);
+  if (deps.interactive() && deps.openUrl) await deps.openUrl(url).catch(() => void 0);
+}
+async function consoleOr(deps, error) {
+  if (error instanceof HttpError && error.code === "budget_raise_in_console") {
+    const body = error.body;
+    if (typeof body?.raise_url === "string") {
+      await sendToConsole(deps, body.raise_url, "Only the console makes this change.");
+      throw new HttpError(error.message, error.status, error.body, error.requestId);
+    }
+  }
+  throw unavailable(error);
+}
+async function budgetAddCommand(deps, name, options) {
+  const key = await deps.auth.apiKey();
+  const limit = parseDollars(options.limit);
+  const principals = options.member?.length ? await Promise.all(options.member.map((member) => resolveMemberSubject(deps, key, member))) : [(await deps.api.getAccount(key)).member.subject];
+  const created = await deps.api.createBudget(key, { scope: "principals", name, limit_micros: limit, principals }, randomUUID3()).catch((error) => consoleOr(deps, error));
+  print(
+    deps,
+    options.json,
+    created,
+    `Created budget ${created.name ?? name}: ${usd(limit)} a month, covering ${principals.join(", ")}.`
+  );
+}
+async function budgetSetCommand(deps, budget, options) {
+  if (options.limit === void 0 && !options.add?.length)
+    throw new Error("Nothing to change: pass --limit, --add or both.");
+  const key = await deps.auth.apiKey();
+  const found = await resolveBudget(deps, key, budget);
+  const limit = options.limit === void 0 ? void 0 : parseDollars(options.limit);
+  if (limit !== void 0 && (found.limit_micros === void 0 || limit >= found.limit_micros)) {
+    await sendToConsole(
+      deps,
+      found.raise_url,
+      found.limit_micros === void 0 ? "This budget is not yours to change here." : `${usd(limit)} is not below the budget's ${usd(found.limit_micros)}: the CLI only lowers a budget.`
+    );
+    throw new Error("The budget was not changed.");
+  }
+  const add = options.add?.length ? await Promise.all(options.add.map((member) => resolveMemberSubject(deps, key, member))) : void 0;
+  const changed = await deps.api.changeBudget(key, found.id, { limit_micros: limit, add_principals: add }).catch((error) => consoleOr(deps, error));
+  print(deps, options.json, changed, budgetFields(changed));
+}
+async function attachBudget(deps, key, subject, value, name, created) {
+  try {
+    if (isAmount(value)) {
+      const limit = parseDollars(value);
+      const budget = await deps.api.createBudget(
+        key,
+        { scope: "principals", name, limit_micros: limit, principals: [subject] },
+        randomUUID3()
+      ).catch((error) => consoleOr(deps, error));
+      deps.notice(`Budget ${budget.name ?? name}: ${usd(limit)} a month for ${subject}.`);
+      return;
+    }
+    const found = await resolveBudget(deps, key, value);
+    await deps.api.changeBudget(key, found.id, { add_principals: [subject] }).catch((error) => consoleOr(deps, error));
+    deps.notice(`Budget ${found.name ?? found.id} now covers ${subject}.`);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    throw new Error(`${created} was created, but its budget was not set: ${reason}`);
+  }
+}
+function accountBudgetFields(account) {
+  const budgets2 = account.budgets;
+  if (!budgets2) return [];
+  const line = (budget) => budget ? `${budget.name ?? budget.id} \xB7 ${budget.stage} \xB7 ${usedText(budget)} \xB7 resets ${budget.resets_at}` : "none";
+  const rows = [
+    ["Account budget", line(budgets2.account)],
+    ["Your budget", line(budgets2.caller)]
+  ];
+  const pace = budgets2.account?.write_pace;
+  if (pace)
+    rows.push([
+      "Writes paced",
+      `${pace.units_per_second}/s across regions (floor ${pace.floor_units_per_second}/s)`
+    ]);
+  return rows;
+}
+function refusalBudget(body) {
+  const budget = body?.budget;
+  if (!budget || typeof budget !== "object") return null;
+  const record = budget;
+  return typeof record.id === "string" && typeof record.raise_url === "string" ? record : null;
+}
+function budgetHint(error) {
+  const budget = refusalBudget(error.body);
+  const name = budget ? budget.name ?? budget.id : "a budget";
+  switch (error.code) {
+    case "budget_exhausted":
+      return `The budget ${name} is used up${budget?.retry_at ? ` until ${budget.retry_at}` : ""}: stop, and try again only after then. A person can raise it in the console${budget ? ` at ${budget.raise_url}` : ""}.`;
+    case "budget_slowdown":
+      return `The budget ${name} is close to its limit, so only a few of its Machines may be awake at once: sleep another of its Machines${budget?.largest_shape_that_fits ? `, or set this one's shape to ${budget.largest_shape_that_fits}` : ""}, then wake it again. A person can raise it${budget ? ` at ${budget.raise_url}` : " in the console"}.`;
+    case "budget_scope":
+      return "Your budget confines you to the Machines you created: work on one of those, or ask a person to.";
+    case "budget_raise_in_console": {
+      const url = error.body?.raise_url;
+      return `Only the console makes this change${typeof url === "string" ? `: ${url}` : "."}`;
+    }
+    default:
+      return null;
+  }
+}
+function budgetHeaderLine(header) {
+  const values = /* @__PURE__ */ new Map();
+  for (const member of header.split(",")) {
+    const [name, ...rest] = member.trim().split("=");
+    if (!name) continue;
+    values.set(name.trim(), rest.join("=").trim().replace(/^"|"$/g, ""));
+  }
+  const used = values.get("used");
+  const percent = used === void 0 ? "" : `, ${Math.round(Number(used) * 100)}% used`;
+  return `Budget: ${values.get("scope") === "account" ? "the account budget" : "your budget"} is at ${values.get("stage") ?? "notice"}${percent}; it resets ${values.get("resets") ?? "on the 1st"}.`;
+}
+function noticingBudget(fetcher, notice) {
+  let said = false;
+  return async (input, init) => {
+    const response = await fetcher(input, init);
+    const header = response.headers.get("tonbo-budget");
+    if (header && !said) {
+      said = true;
+      notice(budgetHeaderLine(header));
+    }
+    return response;
+  };
+}
+
 // src/commands.ts
 function print(deps, json, data, human) {
   deps.output(json ? JSON.stringify(data) : human);
@@ -3661,7 +4246,7 @@ async function agentCreateCommand(deps, name, options = {}) {
   const agent = await deps.api.createAgent(
     key,
     { name, region, ...options.role === void 0 ? {} : { role: options.role } },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -3674,6 +4259,15 @@ async function agentCreateCommand(deps, name, options = {}) {
       `Region: ${agent.region}`
     ].join("\n")
   );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      `agent.${agent.id}`,
+      options.budget,
+      agent.name,
+      `The Agent ${agent.name}`
+    );
 }
 async function accountShowCommand(deps, options = {}) {
   const account = await deps.api.getAccount(await deps.auth.apiKey());
@@ -3687,7 +4281,8 @@ async function accountShowCommand(deps, options = {}) {
       ["Kind", account.kind],
       ["Your role", account.member.role],
       ["Your subject", account.member.subject],
-      ["Bucket limit", String(account.limits.buckets)]
+      ["Bucket limit", String(account.limits.buckets)],
+      ...accountBudgetFields(account)
     ])
   );
 }
@@ -3892,6 +4487,15 @@ async function apiKeyCreateCommand(deps, name, options = {}) {
     deps.notice(
       "Do not set TONBO_API_KEY in your own shell: it overrides your `tonbo login`, for this CLI too."
     );
+  if (options.budget !== void 0)
+    await attachBudget(
+      deps,
+      key,
+      created.member,
+      options.budget,
+      created.name,
+      `The API key ${created.name}`
+    );
 }
 async function apiKeyShowCommand(deps, keyId, options = {}) {
   const apiKey = await deps.api.getApiKey(await deps.auth.apiKey(), keyId);
@@ -3950,7 +4554,7 @@ async function bucketCreateCommand(deps, name, options = {}) {
   const bucket = await deps.api.createBucket(
     await deps.auth.apiKey(),
     { name, region: options.region },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4081,7 +4685,7 @@ async function databaseCreateCommand(deps, name, options = {}) {
   const database = await deps.api.createDatabase(
     await deps.auth.apiKey(),
     { name, region: options.region, expires_at: expiresAt },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4269,7 +4873,7 @@ async function streamCreateCommand(deps, name, options = {}) {
       content_type: options.contentType,
       expires_at: expiresAt
     },
-    options.idempotencyKey ?? randomUUID3()
+    options.idempotencyKey ?? randomUUID4()
   );
   print(
     deps,
@@ -4493,11 +5097,11 @@ async function accountUseCommand(deps, account, options = {}) {
 import { Help } from "commander";
 
 // src/machine.ts
-import { randomUUID as randomUUID5 } from "node:crypto";
+import { randomUUID as randomUUID6 } from "node:crypto";
 import { readFileSync } from "node:fs";
 
 // src/volume.ts
-import { randomUUID as randomUUID4 } from "node:crypto";
+import { randomUUID as randomUUID5 } from "node:crypto";
 var VOLUME_DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees/data#volume";
 var VOLUME_ERROR_HINTS = {
   payment_required: "Add credit at <billing>, then create the Volume again.",
@@ -4595,7 +5199,7 @@ async function volumeCreateCommand(deps, name, options = {}) {
     const volume = await deps.api.createVolume(
       key,
       { name, region, size_gib: sizeGib },
-      options.idempotencyKey ?? randomUUID4()
+      options.idempotencyKey ?? randomUUID5()
     );
     print(
       deps,
@@ -4662,7 +5266,8 @@ var MACHINE_ERROR_HINTS = {
   machine_kind_mismatch: "That Machine is one of your computers: `tonbo machine show` and `tonbo machine delete` serve it, and nothing else does.",
   volumes_not_offered: "Volumes are not offered to this account in the Machine's region yet; nothing was created or changed.",
   secret_env_conflict: "Use another secret key or remove the non-secret env variable with that name.",
-  secret_limit: "Reduce the number or byte size of this Machine's secrets."
+  secret_limit: "Reduce the number or byte size of this Machine's secrets.",
+  wake_unavailable: "The wake was refused for now; nothing woke. Wake it again after a while; `tonbo machine show` says why it is blocked."
 };
 var MACHINE_IMAGE_FAILURE_HINTS = {
   image_unavailable: "The registry no longer serves that image publicly, or served other bytes for it: publish it again, or use another image",
@@ -4694,7 +5299,7 @@ function ifMatchHeader(value) {
 }
 function explainMachineError(error) {
   if (!(error instanceof HttpError) || error.code === null) return error;
-  const hint = MACHINE_ERROR_HINTS[error.code];
+  const hint = budgetHint(error) ?? MACHINE_ERROR_HINTS[error.code];
   if (!hint) return error;
   return new HttpError(`${error.message}
 ${hint}`, error.status, error.body, error.requestId);
@@ -4724,7 +5329,13 @@ function portText(port) {
 function machinePortsText(machine) {
   return machine.ports.length ? machine.ports.map(portText).join(", ") : "none";
 }
-var { earlyReclaimSeconds, pollAfterSeconds, sleepPollAfterSeconds, wakeHoldSeconds } = machineTimings;
+var {
+  earlyReclaimSeconds,
+  pollAfterSeconds,
+  sleepPollAfterSeconds,
+  wakePollAfterSeconds,
+  wakeHoldSeconds
+} = machineTimings;
 function machineState(machine) {
   if (machine.failure)
     return `${machine.state}: ${machine.failure.code}: ${machine.failure.message}`;
@@ -5226,7 +5837,7 @@ async function machineCreateCommand(deps, name, command, options = {}) {
           ...database ? { database: database.name } : {},
           ...options.database === false ? { database: null } : {}
         },
-        options.idempotencyKey ?? randomUUID5()
+        options.idempotencyKey ?? randomUUID6()
       );
     } catch (error) {
       if (error instanceof HttpError && error.code === "name_taken")
@@ -5266,11 +5877,16 @@ async function machineShowCommand(deps, name, options = {}) {
     const key = await deps.auth.apiKey();
     const { machine, etag } = await deps.api.getMachineWithEtag(key, name);
     const lastEnd = options.json || machine.kind === "byoc" || machine.state !== "active" ? null : await lastActivationEnd(deps, key, machine.name);
+    const processes = options.json || machine.kind === "byoc" || machine.state !== "active" || !deps.processes ? null : await deps.processes(key, machine.region, machine.name);
+    const processLines = processes ? [
+      ...processes.running.map((line) => `Background process: ${line}`),
+      ...processes.last ? [`Last background process: ${processes.last}`] : []
+    ] : [];
     print(
       deps,
       options.json,
       machine,
-      anyMachineText(machine, await billingUrl(deps), etag, lastEnd)
+      [anyMachineText(machine, await billingUrl(deps), etag, lastEnd), ...processLines].join("\n")
     );
   });
 }
@@ -5318,9 +5934,14 @@ function appliesText(name, change) {
     lines.push(
       change.delete_after_seconds === null ? "The Machine is no longer deleted for being asleep." : "Delete-after applies now; `tonbo machine show` says when."
     );
-  const later = [change.image, change.command, change.shape, change.env, change.volumes].some(
-    (field) => field !== void 0
-  );
+  const later = [
+    change.image,
+    change.command,
+    change.shape,
+    change.env,
+    change.volumes,
+    change.database
+  ].some((field) => field !== void 0);
   if (later) {
     lines.push(
       `The change applies at the next activation. To apply it now, run \`tonbo machine sleep ${name}\`; the next request boots the new spec.`
@@ -5370,6 +5991,8 @@ async function machineUpdateCommand(deps, name, command, options = {}) {
     if (options.volume === false) change.volumes = [];
     else if (typeof options.volume === "string")
       change.volumes = [(await resolveVolumeBinding(deps, key, options.volume)).binding];
+    if (options.database === false) change.database = null;
+    else if (typeof options.database === "string") change.database = options.database;
     if (options.discardSnapshot) change.discard_snapshot = true;
     if (Object.values(change).every((value) => value === void 0))
       throw new Error("Nothing to change: pass at least one option or a command.");
@@ -5431,6 +6054,42 @@ async function machineSleepCommand(deps, name, options = {}) {
     );
   });
 }
+function wokenText(machine, waking) {
+  if (!waking) return `Machine ${machine.name} is awake.`;
+  return `Machine ${machine.name} is waking; \`tonbo machine show ${machine.name}\` says when it is awake.`;
+}
+async function machineWakeCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const timeout = waitTimeout(options);
+    const key = await deps.auth.apiKey();
+    const { machine, retryAfterSeconds: retryAfterSeconds2 } = await deps.api.wakeMachine(
+      key,
+      name,
+      ifMatchHeader(options.ifMatch)
+    );
+    const waking = retryAfterSeconds2 !== null;
+    if (!options.wait || !waking) {
+      print(deps, options.json, machine, wokenText(machine, waking));
+      return;
+    }
+    const { machine: awake, waited } = await waitForMachine(
+      deps,
+      key,
+      name,
+      retryAfterSeconds2 ?? wakePollAfterSeconds,
+      wakePollAfterSeconds,
+      timeout,
+      (read) => read.status.power === "awake" || read.state !== "active"
+    );
+    if (!awake)
+      throw new Error(
+        `Machine ${name} is not awake after ${waited} s; \`tonbo machine show ${name}\` says why.`
+      );
+    if (awake.status.power !== "awake")
+      throw new Error(`Machine ${name} is ${awake.state}; it did not wake.`);
+    print(deps, options.json, awake, `Machine ${awake.name} is awake (after ${waited} s).`);
+  });
+}
 async function machineDeleteCommand(deps, name, options = {}) {
   await machineCommand(async () => {
     const key = await deps.auth.apiKey();
@@ -5676,6 +6335,34 @@ var COMMAND_HELP = {
       "--idempotency-key": "a new UUID"
     }
   },
+  "tonbo budget list": {
+    about: [
+      "Lists the account's monthly spend budgets, the account budget first, with each one's stage and what it has used of its limit this UTC month. You see a budget's figures with `usage.read`, or when it covers you; of any other budget only its stage, reset and console link."
+    ],
+    examples: ["tonbo budget list"]
+  },
+  "tonbo budget show": {
+    about: [
+      "Prints one budget: its limit, what was charged and what is committed this month, whom it covers, its stage, when it resets (00:00 UTC on the 1st) and its page in the console."
+    ],
+    examples: ["tonbo budget show pi-agent"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
+  "tonbo budget add": {
+    about: [
+      "Creates a budget over you, or over Agents you created, which counts the compute and outbound data of the Machines they create. Only the console sets the account budget or covers another member."
+    ],
+    examples: ["tonbo budget add pi-agent --limit 50 --member pi-agent"],
+    arguments: { name: "the budget's name, unique in the account" },
+    defaults: { "--member": "yourself" }
+  },
+  "tonbo budget set": {
+    about: [
+      "Lowers the budget that covers you, or adds Agents you created to it. Raising a limit, renaming, removing and every change to another budget are the console's: the command prints the budget's page and opens it instead."
+    ],
+    examples: ["tonbo budget set pi-agent --limit 25"],
+    arguments: { budget: "the budget's name or id (`bdg_\u2026`)" }
+  },
   "tonbo api-key list": {
     about: [
       "Shows your keys, or every key of the account for an owner or admin, with the last four characters of each secret, whether it is read-only, what it reaches of buckets, databases and streams, and when it expires and was last used."
@@ -5913,7 +6600,7 @@ var COMMAND_HELP = {
   "tonbo machine update": {
     about: [
       "Changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed.",
-      "Ports and `--sleep-after` apply at once. The image, command, shape and env apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again.",
+      "Ports and `--sleep-after` apply at once. The image, command, shape, env, Volume and database apply at the next boot, and the command says how to apply them now: `tonbo machine sleep`, after which the next request boots the new spec. Naming the same tag again resolves its digest again. `--database <name>` binds another database of the account in the Machine's region, which no other Machine binds, and `--no-database` binds none; the database it leaves is kept. A Machine created with its own database keeps it.",
       "`--delete-after` applies at once and keeps the clock, which counts from the end of the Machine's last activation (or its creation), so a lower value can delete a Machine that has already slept that long; `--no-delete-after` turns it off. `tonbo machine show` prints when it will be deleted."
     ],
     examples: ["tonbo machine update web --env MODE=staging --sleep-after 300"],
@@ -5929,11 +6616,13 @@ var COMMAND_HELP = {
   "tonbo machine exec": {
     about: [
       "Runs one command in the Machine's running activation through its region's cell origin, waking the Machine first when it is asleep, and streams its stdout and stderr here as they come; a call that woke the Machine prints its hourly ceiling on stderr. The command runs without a shell, as the image's User, and lives exactly as long as the call: there is no terminal and no streamed stdin, and `--stdin` sends at most 1 MiB read before the call.",
-      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream."
+      "The CLI exits with the command's status: 128 plus the signal's number when a signal ended it, 124 at `--timeout`, 125 when it was refused, killed or passed 64 MiB of output, 126 or 127 when it could not run, and 255 when the connection ended first and the outcome is unknown. `--json` prints the answer's document instead, with the first and last 512 KiB of each stream.",
+      "`--detach` starts the command in the background instead, prints its process id and returns at once: it runs whatever happens to this call, keeps the Machine awake until it ends, and is ended at `--timeout` (default 3600, at most 21600). Read it with `tonbo machine output`, wait for it with `tonbo machine wait`, list them with `tonbo machine ps` and end one with `tonbo machine kill`. A budget or funding stop, or a sleep you ask for, still ends it."
     ],
     examples: [
       "tonbo machine exec web -- ls -la /app",
-      "tonbo machine exec web --timeout 60 -- npm test"
+      "tonbo machine exec web --timeout 60 -- npm test",
+      "tonbo machine exec web --detach -- npm run build"
     ],
     arguments: {
       name: "the Machine's name",
@@ -5941,6 +6630,37 @@ var COMMAND_HELP = {
     },
     defaults: { "--timeout": "600", "--cwd": "the image's WorkingDir" }
   },
+  "tonbo machine ps": {
+    about: [
+      "Lists the Machine's background processes, newest first: those running and those that ended in the last 24 hours, with how each ended. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine ps web"],
+    arguments: { name: "the Machine's name" }
+  },
+  "tonbo machine wait": {
+    about: [
+      "Waits until a background process ends, prints how it ended and exits with its status as `tonbo machine exec` would: its exit code, 128 plus a signal's number, 124 at its timeout, 125 when it was killed and 255 when its outcome is unknown. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine wait web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine output": {
+    about: [
+      "Prints a background process's stdout and stderr together, as it wrote them, from the last 16 MiB the Machine keeps. `--follow` keeps printing until the process ends. The output is gone once the Machine sleeps. It never wakes the Machine."
+    ],
+    examples: [
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f",
+      "tonbo machine output web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f --follow"
+    ],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
+  "tonbo machine kill": {
+    about: [
+      "Ends a background process: SIGTERM to everything it started, then a kill 5 seconds later. It never wakes the Machine."
+    ],
+    examples: ["tonbo machine kill web 019a1f2e5a6b7c8d9e0f1a2b3c4d5e6f"],
+    arguments: { name: "the Machine's name", process: "the process id `exec --detach` printed" }
+  },
   "tonbo machine file read": {
     about: [
       "Prints one regular file of the Machine, waking it when it is asleep. A file is gone when the Machine sleeps, so a read that woke it sees only its image."
@@ -5979,6 +6699,30 @@ var COMMAND_HELP = {
     examples: ["tonbo machine file delete web /app/tmp --recursive"],
     arguments: { name: "the Machine's name", path: "the absolute path in the Machine" }
   },
+  "tonbo machine hold set": {
+    about: [
+      "Keeps the Machine awake until at least now plus `--for` (1 hour by default, at most 1 hour). Running it again only moves the end later, so a script can repeat it while its work runs. It never wakes an asleep Machine, and it ends when the Machine sleeps, stops or runs out of credit or budget. An awake Machine is billed as usual. A program inside the Machine sets its own holds on `/run/tonbo-hold.sock`, with no key."
+    ],
+    examples: ["tonbo machine hold set web build --for 30m"],
+    arguments: {
+      name: "the Machine's name",
+      hold: "a name you choose for the hold, such as build"
+    }
+  },
+  "tonbo machine hold rm": {
+    about: [
+      "Releases one hold set from outside the Machine, whether or not it existed. The Machine sleeps `sleep_after` seconds later unless something else keeps it awake."
+    ],
+    examples: ["tonbo machine hold rm web build"],
+    arguments: { name: "the Machine's name", hold: "the hold's name" }
+  },
+  "tonbo machine hold ls": {
+    about: [
+      "Lists the holds of the Machine's current activation, those set from outside and those a program inside set, with when each lapses. An asleep Machine has none."
+    ],
+    examples: ["tonbo machine hold ls web"],
+    arguments: { name: "the Machine's name" }
+  },
   "tonbo machine sleep": {
     about: [
       "Puts an awake Machine to sleep now, and says so when it is already asleep or still creating; its next request boots it on its latest spec. With `--wait` the CLI reads the Machine until it is asleep or `--timeout` passes."
@@ -5987,6 +6731,14 @@ var COMMAND_HELP = {
     arguments: NAME("Machine"),
     defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
   },
+  "tonbo machine wake": {
+    about: [
+      "Wakes an asleep Machine now, without a request to it, and says so when it is already awake. The wake passes the same checks as any other and is billed the same: it needs credit, room on a host and a budget that allows it, and a refused wake says why. With `--wait` the CLI reads the Machine until it is awake or `--timeout` passes."
+    ],
+    examples: ["tonbo machine wake web --wait"],
+    arguments: NAME("Machine"),
+    defaults: { "--timeout": String(DEFAULT_WAIT_SECONDS) }
+  },
   "tonbo machine delete": {
     about: [
       "Deletes the Machine with its disk and logs; a Volume or database it binds stays. Its name is free for a new Machine at once. At a terminal it asks you to type the Machine's name first, and sends the ETag it read then.",
@@ -6165,7 +6917,7 @@ function applyHelp(program) {
 
 // src/machine-cell.ts
 import { readFile as readFile3, writeFile } from "node:fs/promises";
-import { randomUUID as randomUUID6 } from "node:crypto";
+import { randomUUID as randomUUID7 } from "node:crypto";
 var EXEC_EXIT_CODES = {
   timeout: 124,
   output_limit: 125,
@@ -6318,6 +7070,191 @@ async function machineExecCommand(deps, name, command, options = {}) {
     deps.notice(`The command ended: ${ended.reason}.`);
   exitWith(deps, execExitCode(ended));
 }
+function processEndText(process2) {
+  const end = process2.end;
+  if (!end) return "-";
+  if (end.reason === "exited") return `exited ${end.exit_code ?? 0}`;
+  if (end.reason === "signaled") return `signaled ${end.signal ?? ""}`.trim();
+  return end.reason;
+}
+function processExitCode(process2) {
+  const end = process2.end;
+  if (!end) return 0;
+  if (end.reason === "exited" || end.reason === "signaled" || end.reason === "timeout")
+    return execExitCode({ reason: end.reason, exit_code: end.exit_code, signal: end.signal });
+  return end.reason === "lost" ? EXEC_EXIT_CODES.lost : EXEC_EXIT_CODES.killed;
+}
+async function machineProcessStartCommand(deps, name, command, options = {}) {
+  if (command.length === 0)
+    throw new Error(
+      "Name the command after --, such as `tonbo machine exec web --detach -- npm run build`."
+    );
+  const body = { command };
+  if (options.cwd) body.cwd = options.cwd;
+  if (options.env?.length) body.env = parseEnv2(options.env);
+  if (options.timeout !== void 0) body.timeout_seconds = options.timeout;
+  if (options.expectActivation) body.expect_activation = options.expectActivation;
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    if (options.stdin) body.stdin = Buffer.from(await readAllStdin(deps)).toString("base64");
+    const response = await cellApi(deps).fetch("startMachineProcess", key, region, {
+      params: { name },
+      headers: {
+        "content-type": "application/json",
+        "idempotency-key": options.idempotencyKey ?? randomUUID7()
+      },
+      body: JSON.stringify(body)
+    });
+    const { data } = await response.json();
+    if (response.headers.get("tonbo-woke") === "true") {
+      const ceiling = response.headers.get("tonbo-ceiling-usd-micros-per-hour");
+      noticeWake(
+        deps,
+        {
+          activation: data.activation,
+          woke: true,
+          ceiling_usd_micros_per_hour: ceiling === null ? null : Number(ceiling)
+        },
+        name
+      );
+    }
+    print(
+      deps,
+      options.json,
+      data,
+      response.status === 200 ? `${data.process} (already started under this key, ${data.state})` : data.process
+    );
+    if (!options.json && response.status !== 200)
+      deps.notice(
+        `Started; it keeps ${name} awake until it ends or at ${data.deadline}. Read it with \`tonbo machine output ${name} ${data.process}\`, wait for it with \`tonbo machine wait ${name} ${data.process}\`.`
+      );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function readProcess(deps, key, region, name, id) {
+  return cellApi(deps).json("getMachineProcess", key, region, {
+    params: { name, process: id }
+  });
+}
+function processFields(process2) {
+  return fields([
+    ["process", process2.process],
+    ["state", process2.state],
+    ["command", (process2.argv_preview ?? []).join(" ") || "-"],
+    ["started", process2.started_at],
+    ["deadline", process2.deadline],
+    ["ended", process2.ended_at ?? "-"],
+    ["end", processEndText(process2)],
+    ["activation", process2.activation]
+  ]);
+}
+async function machineProcessListCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const processes = await cellApi(deps).json(
+      "listMachineProcesses",
+      key,
+      region,
+      {
+        params: { name }
+      }
+    );
+    print(
+      deps,
+      options.json,
+      processes,
+      processes.length === 0 ? `${name} has no background processes.` : table(
+        ["PROCESS", "STATE", "STARTED", "END", "COMMAND"],
+        processes.map((process2) => [
+          process2.process,
+          process2.state,
+          process2.started_at,
+          processEndText(process2),
+          (process2.argv_preview ?? []).join(" ")
+        ])
+      )
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessWaitCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let process2 = await readProcess(deps, key, region, name, id);
+    while (process2.state === "running") {
+      await sleep(2e3);
+      process2 = await readProcess(deps, key, region, name, id);
+    }
+    print(deps, options.json, process2, processFields(process2));
+    exitWith(deps, processExitCode(process2));
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessOutputCommand(deps, name, id, options = {}) {
+  const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    let offset = options.offset ?? 0;
+    for (; ; ) {
+      const response = await cellApi(deps).fetch("readMachineProcessOutput", key, region, {
+        params: { name, process: id },
+        query: { offset: String(offset) }
+      });
+      const bytes2 = new Uint8Array(await response.arrayBuffer());
+      const start = Number(response.headers.get("tonbo-output-start") ?? offset);
+      if (start > offset)
+        deps.notice(`(${start - offset} bytes before offset ${start} were dropped from the ring)`);
+      if (bytes2.length) writeBytes(deps, "stdout", bytes2);
+      offset = Number(response.headers.get("tonbo-output-next-offset") ?? start + bytes2.length);
+      const ended = response.headers.get("tonbo-process-state") === "ended";
+      if (start + bytes2.length < offset) continue;
+      if (!options.follow || ended) break;
+      await sleep(1e3);
+    }
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessKillCommand(deps, name, id, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const process2 = await cellApi(deps).json("killMachineProcess", key, region, {
+      params: { name, process: id }
+    });
+    print(
+      deps,
+      options.json,
+      process2,
+      process2.state === "ended" ? `${id} had already ended: ${processEndText(process2)}.` : `Killing ${id}; it ends within a few seconds.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineProcessSummary(cell, key, region, name) {
+  try {
+    const processes = await cell.json("listMachineProcesses", key, region, {
+      params: { name }
+    });
+    const line = (process2) => `${process2.process} ${(process2.argv_preview ?? []).join(" ")} (${process2.state === "running" ? `until ${process2.deadline}` : processEndText(process2)})`;
+    const last = processes.find((process2) => process2.state === "ended");
+    return {
+      running: processes.filter((process2) => process2.state === "running").map(line),
+      last: last ? line(last) : null
+    };
+  } catch {
+    return null;
+  }
+}
 async function machineFileReadCommand(deps, name, path4, options = {}) {
   try {
     const key = await deps.auth.apiKey();
@@ -6348,7 +7285,7 @@ async function machineFileWriteCommand(deps, name, path4, options = {}) {
         "if-none-match": options.create ? "*" : void 0,
         "tonbo-file-mode": options.mode,
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID7()
       },
       body: new Uint8Array(bytes2)
     });
@@ -6431,7 +7368,7 @@ async function machineFileDeleteCommand(deps, name, path4, options = {}) {
       query: { path: path4, recursive: options.recursive ? "true" : void 0 },
       headers: {
         "tonbo-expect-activation": options.expectActivation,
-        "idempotency-key": randomUUID6()
+        "idempotency-key": randomUUID7()
       }
     });
     print(deps, options.json, { path: path4 }, `Deleted ${path4}.`);
@@ -6439,6 +7376,76 @@ async function machineFileDeleteCommand(deps, name, path4, options = {}) {
     throw explainMachineError(error);
   }
 }
+var HOLD_MAX_SECONDS = 3600;
+function parseHoldDuration(value) {
+  const match = /^(\d+)\s*([smh]?)$/.exec(value.trim());
+  const unit = { "": 1, s: 1, m: 60, h: 3600 }[match?.[2] ?? ""] ?? 1;
+  const seconds = match ? Number(match[1]) * unit : Number.NaN;
+  if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > HOLD_MAX_SECONDS)
+    throw new Error(`--for ${value} is not between 1 second and 1 hour, such as 90s, 45m or 1h.`);
+  return seconds;
+}
+async function machineHoldSetCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const placed = await cellApi(deps).json("setMachineHold", key, region, {
+      params: { name, hold },
+      headers: {
+        "content-type": "application/json",
+        "tonbo-expect-activation": options.expectActivation
+      },
+      body: JSON.stringify({ seconds: options.for ?? HOLD_MAX_SECONDS })
+    });
+    print(
+      deps,
+      options.json,
+      placed,
+      `${name} stays awake until ${placed.until} (hold ${placed.hold}). Run this again before then to extend it; \`tonbo machine hold rm ${name} ${placed.hold}\` lets it sleep. An awake Machine is billed as usual.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldRmCommand(deps, name, hold, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    await cellApi(deps).fetch("releaseMachineHold", key, region, { params: { name, hold } });
+    print(
+      deps,
+      options.json,
+      { hold },
+      `Released ${hold}. ${name} sleeps once nothing else keeps it awake.`
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
+async function machineHoldLsCommand(deps, name, options = {}) {
+  try {
+    const key = await deps.auth.apiKey();
+    const region = await regionOf(deps, key, name);
+    const holds = await cellApi(deps).json("listMachineHolds", key, region, {
+      params: { name }
+    });
+    print(
+      deps,
+      options.json,
+      holds,
+      holds.length === 0 ? `${name} has no holds.` : table(
+        ["HOLD", "SET FROM", "UNTIL"],
+        holds.map((entry) => [
+          entry.hold,
+          entry.source === "guest" ? "inside the Machine" : "outside (API or CLI)",
+          entry.until
+        ])
+      )
+    );
+  } catch (error) {
+    throw explainMachineError(error);
+  }
+}
 
 // src/prompt.ts
 import select from "@inquirer/select";
@@ -6709,8 +7716,9 @@ function createDependencies(selection = {}) {
     loginOrigin: loginOrigin(api),
     account
   });
+  const notice = (text) => console.error(text);
   return {
-    api: new ManagementApi(fetch, api),
+    api: new ManagementApi(noticingBudget(fetch, notice), api),
     ask: terminalAsk,
     auth: new AuthClient(
       credentials,
@@ -6726,7 +7734,9 @@ function createDependencies(selection = {}) {
     credentials,
     interactive: () => process.stdin.isTTY === true && process.stderr.isTTY === true,
     output: (text) => console.log(text),
-    notice: (text) => console.error(text),
+    notice,
+    openUrl: openBrowser,
+    processes: (key, region, name) => machineProcessSummary(new CellApi(fetch), key, region, name),
     progress: new TerminalProgress(process.stderr),
     select: terminalSelect
   };
@@ -6740,7 +7750,7 @@ function parseWhole(value) {
   return Number(value);
 }
 function operationOptions(command, operationId) {
-  const query = managementOperations[operationId].query;
+  const query = managementOperation(operationId).query;
   if (query.includes("limit"))
     command.option("--limit <count>", "the most items to return", parseLimit);
   if (query.includes("cursor"))
@@ -6749,6 +7759,10 @@ function operationOptions(command, operationId) {
 }
 var ifMatchHelp = (action) => `${action} only the Machine at the ETag \`tonbo machine show\` printed (with or without its quotes)`;
 var repeated = (value, previous = []) => [...previous, value];
+var budgetOption = (whom) => new Option(
+  "--budget <budget>",
+  `put ${whom} under a monthly budget: an amount in dollars such as 50 creates one, a budget's name adds to it`
+).hideHelp();
 var roleOption = (description) => new Option("--role <role>", description).choices(accountRoles);
 function machineSpecOptions(command, update) {
   const later = update ? "; applies at the next boot" : "";
@@ -6856,7 +7870,7 @@ function createProgram(makeDependencies = createDependencies) {
     ).option(
       "--idempotency-key <key>",
       "reuse the key of an unconfirmed creation to get the Agent it created"
-    ),
+    ).addOption(budgetOption("the Agent")),
     "createAgent"
   ).action(
     async (name, options) => agentCreateCommand(dependencies(), name, options)
@@ -6891,7 +7905,7 @@ function createProgram(makeDependencies = createDependencies) {
       repeated
     ).addOption(
       new Option("--expires-in <period>", "when the key expires").choices(apiKeyExpirations)
-    ),
+    ).addOption(budgetOption("the key's member")),
     "createApiKey"
   ).action(
     async (name, options) => apiKeyCreateCommand(dependencies(), name, options)
@@ -6905,6 +7919,37 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (keyId, options) => apiKeyRevokeCommand(dependencies(), keyId, options)
   );
+  const budget = program.command("budget", { hidden: true }).description("the account's monthly spend budgets");
+  operationOptions(
+    budget.command("list").description("list the budgets, the account budget first"),
+    "listBudgets"
+  ).action(async (options) => budgetListCommand(dependencies(), options));
+  operationOptions(
+    budget.command("show <budget>").description("show one budget, by its name or id"),
+    "getBudget"
+  ).action(
+    async (name, options) => budgetShowCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("add <name>").description("create a budget for you or Agents you created").requiredOption("--limit <dollars>", "the monthly limit in dollars, such as 50").option(
+      "--member <member>",
+      "a member to cover: you, or an Agent you created (subject, id or name); repeat for several",
+      repeated
+    ),
+    "createBudget"
+  ).action(
+    async (name, options) => budgetAddCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    budget.command("set <budget>").description("lower the budget that covers you, or add Agents you created to it").option("--limit <dollars>", "a lower monthly limit; a raise opens the console").option(
+      "--add <member>",
+      "an Agent you created to cover too (subject, id or name); repeat for several",
+      repeated
+    ),
+    "changeBudget"
+  ).action(
+    async (name, options) => budgetSetCommand(dependencies(), name, options)
+  );
   const bucket = program.command("bucket").description("the account's Streams buckets");
   operationOptions(bucket.command("list").description("list the buckets"), "listBuckets").action(
     async (options) => bucketListCommand(dependencies(), options)
@@ -7116,7 +8161,10 @@ function createProgram(makeDependencies = createDependencies) {
     machineSpecOptions(
       machine.command("update <name> [command...]").description(
         "change a Machine; [command...] after -- replaces its command at the next boot"
-      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
+      ).option("--image <reference>", "a new image, named as for create; applies at the next boot").option("--image-command", "run the image's own CMD again at the next boot").option("--unset-env <KEY>", "remove an environment variable; repeat for several", repeated).option("--clear-ports", "remove every port").option("--if-match <etag>", ifMatchHelp("change")).option("--discard-snapshot", "apply a change that discards the Machine's snapshot").option("--no-volume", "remove the Machine's Volume at the next boot; the Volume is kept").option(
+        "--database <name>",
+        "bind the account's database <name> of the Machine's region instead; applies at the next wake"
+      ).option("--no-database", "bind no database from the next wake; the database is kept").option("--no-delete-after", "never delete the Machine for being asleep"),
       true
     ),
     "updateMachine"
@@ -7126,13 +8174,16 @@ function createProgram(makeDependencies = createDependencies) {
   operationOptions(
     machine.command("exec <name> [command...]").description(
       "run a command in a Machine, waking it first, and print its output; exits with its status"
+    ).option(
+      "--detach",
+      "start it in the background and print its id at once; it keeps the Machine awake until it ends or its timeout"
     ).option("--cwd <path>", "the working directory, an absolute path").option(
       "--env <KEY=VALUE>",
       "set an environment variable for the command; repeat for several",
       repeated
     ).option(
       "--timeout <seconds>",
-      "kill the command after this many seconds (default 600, at most 3600)",
+      "kill the command after this many seconds (default 600, at most 3600; with --detach default 3600, at most 21600)",
       parseWhole
     ).option("--stdin", "send this process's stdin to the command (at most 1 MiB)").option(
       "--expect-activation <activation>",
@@ -7143,7 +8194,31 @@ function createProgram(makeDependencies = createDependencies) {
     ),
     "execMachineCommand"
   ).action(
-    async (name, command, options) => machineExecCommand(dependencies(), name, command, options)
+    async (name, command, options) => options.detach ? machineProcessStartCommand(dependencies(), name, command, options) : machineExecCommand(dependencies(), name, command, options)
+  );
+  operationOptions(
+    machine.command("ps <name>").description("list a Machine's background processes, running and recently ended"),
+    "listMachineProcesses"
+  ).action(
+    async (name, options) => machineProcessListCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    machine.command("wait <name> <process>").description("wait for a background process to end; exits with its status"),
+    "getMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessWaitCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("output <name> <process>").description("print a background process's output, stdout and stderr together").option("--offset <bytes>", "start at this byte offset", parseWhole).option("--follow", "keep printing new output until the process ends"),
+    "readMachineProcessOutput"
+  ).action(
+    async (name, id, options) => machineProcessOutputCommand(dependencies(), name, id, options)
+  );
+  operationOptions(
+    machine.command("kill <name> <process>").description("end a background process: SIGTERM, then a kill after 5 seconds"),
+    "killMachineProcess"
+  ).action(
+    async (name, id, options) => machineProcessKillCommand(dependencies(), name, id, options)
   );
   const file = machine.command("file").description("read, write, stat, list and delete a Machine's files");
   operationOptions(
@@ -7176,12 +8251,41 @@ function createProgram(makeDependencies = createDependencies) {
   ).action(
     async (name, path4, options) => machineFileDeleteCommand(dependencies(), name, path4, options)
   );
+  const hold = machine.command("hold").description("keep a Machine awake for work that has no open connection");
+  operationOptions(
+    hold.command("set <name> <hold>").description("keep a Machine awake until a hold lapses; never wakes it").option(
+      "--for <duration>",
+      "how long from now, such as 90s, 45m or 1h (at most 1h)",
+      parseHoldDuration
+    ).option("--expect-activation <activation>", "hold only this activation"),
+    "setMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldSetCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("rm <name> <hold>").description("release a hold set from outside the Machine"),
+    "releaseMachineHold"
+  ).action(
+    async (name, holdName, options) => machineHoldRmCommand(dependencies(), name, holdName, options)
+  );
+  operationOptions(
+    hold.command("ls <name>").description("list what holds a Machine awake"),
+    "listMachineHolds"
+  ).action(
+    async (name, options) => machineHoldLsCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("sleep <name>").description("put a Machine to sleep now; its next request boots it on its latest spec").option("--if-match <etag>", ifMatchHelp("put to sleep")).option("--wait", "wait until the Machine is asleep").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
     "sleepMachine"
   ).action(
     async (name, options) => machineSleepCommand(dependencies(), name, options)
   );
+  operationOptions(
+    machine.command("wake <name>").description("wake an asleep Machine now, without a request to it").option("--if-match <etag>", ifMatchHelp("wake")).option("--wait", "wait until the Machine is awake").option("--timeout <seconds>", "how long --wait waits, in seconds", parseWhole),
+    "wakeMachine"
+  ).action(
+    async (name, options) => machineWakeCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("delete <name>").description("delete a Machine with its disk and logs, or forget one of your computers").option("--yes", "delete without asking; required when stdin is not a terminal").option("--if-match <etag>", ifMatchHelp("delete")),
     "deleteMachine"