@tonbo/cli 0.5.0 → 0.6.0

package/dist/bin/tonbo.js

@@ -4,8 +4,150 @@
 import { Command, InvalidArgumentError, Option } from "commander";
 import { readFileSync } from "node:fs";
 
-// src/http.ts
+// ../../packages/tonbo-cli-core/dist/src/auth.js
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { execFile } from "node:child_process";
+import os from "node:os";
+import { promisify } from "node:util";
+
+// ../../packages/tonbo-cli-core/dist/src/callback-page.js
+var WORDMARK = [
+  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
+  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
+  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
+].join("\n");
+var OUTCOMES = {
+  complete: {
+    status: 200,
+    title: "You are signed in.",
+    body: "Return to your terminal. This tab can be closed."
+  },
+  denied: {
+    status: 400,
+    title: "Login was not completed.",
+    body: "Nothing was authorized. Return to your terminal to try again."
+  },
+  invalid: {
+    // The state did not match, the code was missing, or the path was wrong.
+    // Say that it could not be verified rather than which check failed: the
+    // person who can read this page is not necessarily the one who started
+    // the login.
+    status: 400,
+    title: "This callback could not be verified.",
+    body: "Return to your terminal and start the login again."
+  }
+};
+function renderCallbackPage(outcome) {
+  const { title, body } = OUTCOMES[outcome];
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>Tonbo CLI</title>
+<style>
+  :root {
+    --paper: #f3f2ee;
+    --ink: #1d1b17;
+    --rule: #c9c5ba;
+    --quiet: #5c564a;
+    --signal: #d64a03;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --paper: #1d1b17;
+      --ink: #f3f2ee;
+      --rule: #3a362e;
+      --quiet: #a49e8f;
+      --signal: #f08b4b;
+    }
+  }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0;
+    min-height: 100vh;
+    display: grid;
+    grid-template-rows: auto 1fr;
+    padding: 0 clamp(20px, 5vw, 72px);
+    background: var(--paper);
+    color: var(--ink);
+    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
+    -webkit-font-smoothing: antialiased;
+  }
+  header { padding: 28px 0; }
+  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
+     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
+     what makes the rows meet without seams. Iosevka is not available here,
+     so it falls back to the platform monospace. */
+  pre.wordmark {
+    margin: 0;
+    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
+    font-size: 8px;
+    font-weight: 400;
+    line-height: 10px;
+    letter-spacing: 0;
+    white-space: pre;
+    color: var(--signal);
+    transform: scaleY(0.8);
+    transform-origin: left top;
+  }
+  main {
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    max-width: 46ch;
+    padding-bottom: 12vh;
+  }
+  h1 {
+    margin: 0;
+    font-size: 26px;
+    font-weight: 300;
+    line-height: 1.16;
+    letter-spacing: -0.018em;
+  }
+  p {
+    margin: 14px 0 0;
+    font-size: 16px;
+    line-height: 1.55;
+    color: var(--quiet);
+  }
+  hr {
+    width: 40px;
+    margin: 28px 0 0;
+    border: 0;
+    border-top: 1px solid var(--rule);
+  }
+</style>
+</head>
+<body>
+<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
+<main>
+  <h1>${title}</h1>
+  <p>${body}</p>
+  <hr>
+</main>
+</body>
+</html>
+`;
+}
+function callbackResponse(outcome) {
+  return {
+    status: OUTCOMES[outcome].status,
+    headers: {
+      "content-type": "text/html; charset=utf-8",
+      "cache-control": "no-store"
+    },
+    body: renderCallbackPage(outcome)
+  };
+}
+
+// ../../packages/tonbo-cli-core/dist/src/http.js
 var HttpError = class extends Error {
+  status;
+  body;
+  requestId;
   constructor(message, status, body, requestId) {
     super(message);
     this.status = status;
@@ -22,26 +164,193 @@ var HttpError = class extends Error {
 async function requestJson(fetcher, url, init = {}) {
   const response = await fetcher(url, init);
   const body = await response.json().catch(() => null);
-  if (response.ok) return body;
+  if (response.ok)
+    return body;
   const record = body && typeof body === "object" ? body : {};
-  const reason = [record.detail, record.title, record.error].find(
-    (value) => typeof value === "string" && value.length > 0
-  );
+  const reason = [record.detail, record.title, record.error].find((value) => typeof value === "string" && value.length > 0);
   const requestId = response.headers.get("x-request-id") ?? (typeof record.request_id === "string" ? record.request_id : null);
   const issues = Array.isArray(record.errors) ? record.errors.filter((issue) => typeof issue?.field === "string" && typeof issue.code === "string").map((issue) => `${issue.field}: ${issue.code}`) : [];
   const message = [
     reason ?? `Request failed with HTTP ${response.status}.`,
     ...issues.length ? [`(${issues.join(", ")})`] : []
   ].join(" ");
-  throw new HttpError(
-    requestId ? `${message} (request ${requestId})` : message,
-    response.status,
-    body,
-    requestId
-  );
+  throw new HttpError(requestId ? `${message} (request ${requestId})` : message, response.status, body, requestId);
+}
+
+// ../../packages/tonbo-cli-core/dist/src/auth.js
+var exec = promisify(execFile);
+var DEFAULT_LOGIN_HINT = "tonbo login";
+var LOOPBACK_HOST = "127.0.0.1";
+function loginHostname(hostname = os.hostname()) {
+  const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
+  return cleaned || "computer";
+}
+var AuthClient = class {
+  credentials;
+  fetcher;
+  loginOrigin;
+  browserOpener;
+  hostname;
+  loginHint;
+  constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname(), loginHint = DEFAULT_LOGIN_HINT) {
+    this.credentials = credentials;
+    this.fetcher = fetcher;
+    this.loginOrigin = loginOrigin2;
+    this.browserOpener = browserOpener;
+    this.hostname = hostname;
+    this.loginHint = loginHint;
+  }
+  /** The personal key requests are made with: TONBO_API_KEY, or the saved
+   * login while it has not expired. */
+  async apiKey() {
+    const injected = process.env.TONBO_API_KEY?.trim();
+    if (injected)
+      return injected;
+    const login = await this.credentials.load();
+    if (!login)
+      throw new Error(`Not logged in. Run \`${this.loginHint}\`.`);
+    if (login.expires_at && Date.parse(login.expires_at) <= Date.now())
+      throw new Error(`Your Tonbo login has expired. Run \`${this.loginHint}\`.`);
+    return login.key;
+  }
+  /**
+   * The browser handoff of /cli/login: PKCE S256 with a loopback redirect on
+   * a free port, then the one-time code is redeemed for a personal key named
+   * "CLI on <hostname>", which replaces that host's earlier login key.
+   */
+  async login(progress = () => {
+  }, account) {
+    const verifier = randomBytes(48).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    const state = randomBytes(24).toString("base64url");
+    const code = await this.listenForCode(state, (redirectUri) => {
+      const authorization = new URL("/cli/login", this.loginOrigin);
+      authorization.search = new URLSearchParams({
+        code_challenge: challenge,
+        code_challenge_method: "S256",
+        redirect_uri: redirectUri,
+        state,
+        hostname: this.hostname,
+        ...account ? { account } : {}
+      }).toString();
+      return this.browserOpener(authorization.toString());
+    }, progress);
+    progress({ status: "started", step: "key-redemption" });
+    const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ code, code_verifier: verifier })
+    });
+    progress({ status: "completed", step: "key-redemption" });
+    const login = {
+      version: 1,
+      account_id: redeemed.account_id,
+      key_id: redeemed.api_key.id,
+      key: redeemed.key,
+      expires_at: redeemed.api_key.expires_at
+    };
+    progress({ status: "started", step: "credential-store" });
+    await this.credentials.save(login);
+    progress({ status: "completed", step: "credential-store" });
+    return login;
+  }
+  listenForCode(expectedState, ready, progress) {
+    return new Promise((resolve, reject) => {
+      let settled = false;
+      const sockets = /* @__PURE__ */ new Set();
+      let authorizationStarted = false;
+      const startAuthorization = () => {
+        if (authorizationStarted)
+          return;
+        authorizationStarted = true;
+        progress({ status: "completed", step: "browser" });
+        progress({ status: "started", step: "browser-authorization" });
+      };
+      const finish = (result, completedResponseSocket) => {
+        if (settled)
+          return;
+        settled = true;
+        clearTimeout(timeout);
+        const complete = (closeError) => {
+          if (closeError)
+            reject(closeError);
+          else if ("code" in result) {
+            progress({ status: "completed", step: "callback-close" });
+            resolve(result.code);
+          } else
+            reject(result.error);
+        };
+        if ("code" in result)
+          progress({ status: "started", step: "callback-close" });
+        if (!server.listening) {
+          complete();
+          return;
+        }
+        server.close(complete);
+        for (const socket of sockets) {
+          if (socket !== completedResponseSocket)
+            socket.destroy();
+        }
+        server.closeIdleConnections();
+      };
+      const timeout = setTimeout(() => {
+        finish({ error: new Error("Timed out waiting for browser login.") });
+      }, 5 * 60 * 1e3);
+      const server = createServer((request, response) => {
+        const url = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
+        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState) {
+          respond(response, "invalid");
+          return;
+        }
+        const denied = url.searchParams.get("error");
+        if (denied) {
+          const responseSocket2 = response.socket;
+          respond(response, "denied", () => finish({ error: new Error(`The login was not approved (${denied}).`) }, responseSocket2));
+          return;
+        }
+        const code = url.searchParams.get("code");
+        if (!code) {
+          respond(response, "invalid");
+          return;
+        }
+        startAuthorization();
+        progress({ status: "completed", step: "browser-authorization" });
+        const responseSocket = response.socket;
+        respond(response, "complete", () => finish({ code }, responseSocket));
+      });
+      server.on("connection", (socket) => {
+        sockets.add(socket);
+        socket.once("close", () => sockets.delete(socket));
+      });
+      server.once("error", (error) => finish({ error }));
+      progress({ status: "started", step: "callback-server" });
+      server.listen(0, LOOPBACK_HOST, () => {
+        const { port } = server.address();
+        progress({ status: "completed", step: "callback-server" });
+        progress({ status: "started", step: "browser" });
+        void ready(`http://${LOOPBACK_HOST}:${port}/callback`).then(startAuthorization).catch((error) => finish({
+          error: error instanceof Error ? error : new Error("Could not open the login browser.")
+        }));
+      });
+    });
+  }
+};
+function respond(response, outcome, finished) {
+  const page = callbackResponse(outcome);
+  if (finished)
+    response.once("finish", finished);
+  response.writeHead(page.status, { ...page.headers, connection: "close" });
+  response.end(page.body);
+}
+async function openBrowser(url) {
+  if (process.platform === "darwin")
+    return void await exec("open", [url]);
+  if (process.platform === "win32")
+    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
+  return void await exec("xdg-open", [url]);
 }
 
-// src/generated/contracts.ts
+// ../../packages/tonbo-cli-core/dist/src/generated/contracts.js
 var agentNameContract = {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://contracts.tonbo.dev/agents/agent-name-v1.json",
@@ -343,6 +652,70 @@ var managementOperations = {
     ],
     "idempotencyKey": false,
     "cli": "tonbo usage show"
+  },
+  "listDatabases": {
+    "method": "GET",
+    "path": "/databases",
+    "pathParams": [],
+    "query": [
+      "prefix",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo database list"
+  },
+  "createDatabase": {
+    "method": "POST",
+    "path": "/databases",
+    "pathParams": [],
+    "query": [],
+    "idempotencyKey": true,
+    "cli": "tonbo database create"
+  },
+  "getDatabase": {
+    "method": "GET",
+    "path": "/databases/{name}",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo database show"
+  },
+  "updateDatabase": {
+    "method": "PATCH",
+    "path": "/databases/{name}",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo database update"
+  },
+  "deleteDatabase": {
+    "method": "DELETE",
+    "path": "/databases/{name}",
+    "pathParams": [
+      "name"
+    ],
+    "query": [],
+    "idempotencyKey": false,
+    "cli": "tonbo database delete"
+  },
+  "listDatabaseUsage": {
+    "method": "GET",
+    "path": "/usage/databases",
+    "pathParams": [],
+    "query": [
+      "period",
+      "sort",
+      "prefix",
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo database usage"
   }
 };
 var accountRoles = [
@@ -358,31 +731,38 @@ var apiKeyExpirations = [
   "never"
 ];
 
-// src/api.ts
+// ../../packages/tonbo-cli-core/dist/src/api.js
 var DEFAULT_API_ORIGIN = "https://api.tonbo.dev";
 var ManagementApi = class {
-  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN) {
+  fetcher;
+  apiOrigin;
+  loginHint;
+  constructor(fetcher, apiOrigin2 = DEFAULT_API_ORIGIN, loginHint = DEFAULT_LOGIN_HINT) {
     this.fetcher = fetcher;
     this.apiOrigin = apiOrigin2;
+    this.loginHint = loginHint;
   }
   /** The answer's `data`. A refusal throws an HttpError naming the request id. */
   async call(operationId, key, request = {}) {
     return (await this.request(operationId, key, request)).data;
   }
-  /** One page of a list operation: its `data` and `next_cursor`. */
-  page(operationId, key, { limit, cursor } = {}) {
-    return this.request(operationId, key, { query: { limit, cursor } });
+  /** One page of a list operation: its `data` and `next_cursor`, with the
+   * operation's other query parameters, if any. */
+  page(operationId, key, { limit, cursor } = {}, query = {}) {
+    return this.request(operationId, key, { query: { ...query, limit, cursor } });
   }
   async request(operationId, key, { params = {}, query = {}, body, idempotencyKey }) {
     const operation = managementOperations[operationId];
     const path2 = operation.path.replace(/\{([^}]+)\}/g, (_, name) => {
       const value = params[name];
-      if (value === void 0) throw new Error(`${operationId} needs the path parameter ${name}.`);
+      if (value === void 0)
+        throw new Error(`${operationId} needs the path parameter ${name}.`);
       return encodeURIComponent(value);
     });
     const search = new URLSearchParams();
     for (const [name, value] of Object.entries(query)) {
-      if (value === void 0) continue;
+      if (value === void 0)
+        continue;
       if (!operation.query.includes(name))
         throw new Error(`${operationId} takes no query parameter ${name}.`);
       search.set(name, String(value));
@@ -390,8 +770,10 @@ var ManagementApi = class {
     if (operation.idempotencyKey && !idempotencyKey)
       throw new Error(`${operationId} needs an Idempotency-Key.`);
     const headers = { authorization: `Bearer ${key}` };
-    if (body !== void 0) headers["content-type"] = "application/json";
-    if (idempotencyKey) headers["idempotency-key"] = idempotencyKey;
+    if (body !== void 0)
+      headers["content-type"] = "application/json";
+    if (idempotencyKey)
+      headers["idempotency-key"] = idempotencyKey;
     const queryString = search.toString();
     const url = `${this.apiOrigin}${managementApiBasePath}${path2}${queryString ? `?${queryString}` : ""}`;
     try {
@@ -402,12 +784,7 @@ var ManagementApi = class {
       });
     } catch (error) {
       if (error instanceof HttpError && error.status === 401)
-        throw new HttpError(
-          `${error.message} Run \`tonbo login\`.`,
-          error.status,
-          error.body,
-          error.requestId
-        );
+        throw new HttpError(`${error.message} Run \`${this.loginHint}\`.`, error.status, error.body, error.requestId);
       throw error;
     }
   }
@@ -450,357 +827,63 @@ var ManagementApi = class {
   listBuckets(key, page) {
     return this.page("listBuckets", key, page);
   }
-  /** A replay with the same idempotency key returns the bucket the first
-   * request created. */
-  createBucket(key, request, idempotencyKey) {
-    return this.call("createBucket", key, {
-      body: withoutUndefined(request),
-      idempotencyKey
-    }).catch(unconfirmed("Bucket creation", idempotencyKey, "the same name and region"));
-  }
-  getBucket(key, name) {
-    return this.call("getBucket", key, { params: { name } });
-  }
-  updateBucket(key, name, change) {
-    return this.call("updateBucket", key, { params: { name }, body: change });
-  }
-  deleteBucket(key, name) {
-    return this.call("deleteBucket", key, { params: { name } });
-  }
-  getUsage(key, period) {
-    return this.call("getUsage", key, { query: { period } });
-  }
-};
-function withoutUndefined(value) {
-  return Object.fromEntries(
-    Object.entries(value).filter(([, field]) => field !== void 0)
-  );
-}
-function unconfirmed(what, idempotencyKey, same) {
-  return (cause) => {
-    if (cause instanceof HttpError && cause.status < 500) throw cause;
-    throw new Error(
-      `${what} was not confirmed: ${cause instanceof Error ? cause.message : String(cause)} Retry with --idempotency-key ${idempotencyKey} and ${same}.`,
-      { cause }
-    );
-  };
-}
-
-// src/auth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { execFile } from "node:child_process";
-import os from "node:os";
-import { promisify } from "node:util";
-
-// src/callback-page.ts
-var WORDMARK = [
-  "\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2580\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588",
-  "\u2588\u2588\u2584 \u2584\u2588\u2588\u2580\u2584 \u2588\u2588 \u2584\u2580\u2588\u2588 \u2584 \u2588\u2588 \u2584\u2580\u2588",
-  "\u2588\u2588\u2588\u2584\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2584\u2588\u2584\u2588\u2588\u2584\u2584\u2588\u2588\u2588\u2588\u2584\u2584\u2588"
-].join("\n");
-var OUTCOMES = {
-  complete: {
-    status: 200,
-    title: "You are signed in.",
-    body: "Return to your terminal. This tab can be closed."
-  },
-  denied: {
-    status: 400,
-    title: "Login was not completed.",
-    body: "Nothing was authorized. Return to your terminal to try again."
-  },
-  invalid: {
-    // The state did not match, the code was missing, or the path was wrong.
-    // Say that it could not be verified rather than which check failed: the
-    // person who can read this page is not necessarily the one who started
-    // the login.
-    status: 400,
-    title: "This callback could not be verified.",
-    body: "Return to your terminal and start the login again."
-  }
-};
-function renderCallbackPage(outcome) {
-  const { title, body } = OUTCOMES[outcome];
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex">
-<title>Tonbo CLI</title>
-<style>
-  :root {
-    --paper: #f3f2ee;
-    --ink: #1d1b17;
-    --rule: #c9c5ba;
-    --quiet: #5c564a;
-    --signal: #d64a03;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root {
-      --paper: #1d1b17;
-      --ink: #f3f2ee;
-      --rule: #3a362e;
-      --quiet: #a49e8f;
-      --signal: #f08b4b;
-    }
+  /** A replay with the same idempotency key returns the bucket the first
+   * request created. */
+  createBucket(key, request, idempotencyKey) {
+    return this.call("createBucket", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Bucket creation", idempotencyKey, "the same name and region"));
   }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0;
-    min-height: 100vh;
-    display: grid;
-    grid-template-rows: auto 1fr;
-    padding: 0 clamp(20px, 5vw, 72px);
-    background: var(--paper);
-    color: var(--ink);
-    font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif;
-    -webkit-font-smoothing: antialiased;
+  getBucket(key, name) {
+    return this.call("getBucket", key, { params: { name } });
   }
-  header { padding: 28px 0; }
-  /* Same metrics as .auth-wordmark in the app: the glyphs are the ground
-     and the letters are the gaps, so the 8px/10px/scaleY(0.8) combination is
-     what makes the rows meet without seams. Iosevka is not available here,
-     so it falls back to the platform monospace. */
-  pre.wordmark {
-    margin: 0;
-    font-family: 'Iosevka', ui-monospace, 'SFMono-Regular', Menlo, Consolas, monospace;
-    font-size: 8px;
-    font-weight: 400;
-    line-height: 10px;
-    letter-spacing: 0;
-    white-space: pre;
-    color: var(--signal);
-    transform: scaleY(0.8);
-    transform-origin: left top;
+  updateBucket(key, name, change) {
+    return this.call("updateBucket", key, { params: { name }, body: change });
   }
-  main {
-    display: flex;
-    flex-direction: column;
-    justify-content: center;
-    max-width: 46ch;
-    padding-bottom: 12vh;
+  deleteBucket(key, name) {
+    return this.call("deleteBucket", key, { params: { name } });
   }
-  h1 {
-    margin: 0;
-    font-size: 26px;
-    font-weight: 300;
-    line-height: 1.16;
-    letter-spacing: -0.018em;
+  listDatabases(key, page, prefix) {
+    return this.page("listDatabases", key, page, { prefix });
   }
-  p {
-    margin: 14px 0 0;
-    font-size: 16px;
-    line-height: 1.55;
-    color: var(--quiet);
+  /** A replay with the same idempotency key returns the database the first
+   * request created. */
+  createDatabase(key, request, idempotencyKey) {
+    return this.call("createDatabase", key, {
+      body: withoutUndefined(request),
+      idempotencyKey
+    }).catch(unconfirmed("Database creation", idempotencyKey, "the same name and region"));
   }
-  hr {
-    width: 40px;
-    margin: 28px 0 0;
-    border: 0;
-    border-top: 1px solid var(--rule);
+  getDatabase(key, name) {
+    return this.call("getDatabase", key, { params: { name } });
   }
-</style>
-</head>
-<body>
-<header><pre class="wordmark" aria-hidden="true">${WORDMARK}</pre></header>
-<main>
-  <h1>${title}</h1>
-  <p>${body}</p>
-  <hr>
-</main>
-</body>
-</html>
-`;
-}
-function callbackResponse(outcome) {
-  return {
-    status: OUTCOMES[outcome].status,
-    headers: {
-      "content-type": "text/html; charset=utf-8",
-      "cache-control": "no-store"
-    },
-    body: renderCallbackPage(outcome)
-  };
-}
-
-// src/auth.ts
-var exec = promisify(execFile);
-var LOOPBACK_HOST = "127.0.0.1";
-function loginHostname(hostname = os.hostname()) {
-  const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
-  return cleaned || "computer";
-}
-var AuthClient = class {
-  constructor(credentials, fetcher, loginOrigin2 = "https://tonbo.dev", browserOpener = openBrowser, hostname = loginHostname()) {
-    this.credentials = credentials;
-    this.fetcher = fetcher;
-    this.loginOrigin = loginOrigin2;
-    this.browserOpener = browserOpener;
-    this.hostname = hostname;
+  updateDatabase(key, name, change) {
+    return this.call("updateDatabase", key, { params: { name }, body: change });
   }
-  /** The personal key requests are made with: TONBO_API_KEY, or the saved
-   * login while it has not expired. */
-  async apiKey() {
-    const injected = process.env.TONBO_API_KEY?.trim();
-    if (injected) return injected;
-    const login = await this.credentials.load();
-    if (!login) throw new Error("Not logged in. Run `tonbo login`.");
-    if (login.expires_at && Date.parse(login.expires_at) <= Date.now())
-      throw new Error("Your Tonbo login has expired. Run `tonbo login`.");
-    return login.key;
+  deleteDatabase(key, name) {
+    return this.call("deleteDatabase", key, { params: { name } });
   }
-  /**
-   * The browser handoff of /cli/login: PKCE S256 with a loopback redirect on
-   * a free port, then the one-time code is redeemed for a personal key named
-   * "CLI on <hostname>", which replaces that host's earlier login key.
-   */
-  async login(progress = () => {
-  }, account) {
-    const verifier = randomBytes(48).toString("base64url");
-    const challenge = createHash("sha256").update(verifier).digest("base64url");
-    const state = randomBytes(24).toString("base64url");
-    const code = await this.listenForCode(
-      state,
-      (redirectUri) => {
-        const authorization = new URL("/cli/login", this.loginOrigin);
-        authorization.search = new URLSearchParams({
-          code_challenge: challenge,
-          code_challenge_method: "S256",
-          redirect_uri: redirectUri,
-          state,
-          hostname: this.hostname,
-          ...account ? { account } : {}
-        }).toString();
-        return this.browserOpener(authorization.toString());
-      },
-      progress
-    );
-    progress({ status: "started", step: "key-redemption" });
-    const redeemed = await requestJson(
-      this.fetcher,
-      new URL("/api/cli/login/token", this.loginOrigin).toString(),
-      {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ code, code_verifier: verifier })
-      }
-    );
-    progress({ status: "completed", step: "key-redemption" });
-    const login = {
-      version: 1,
-      account_id: redeemed.account_id,
-      key_id: redeemed.api_key.id,
-      key: redeemed.key,
-      expires_at: redeemed.api_key.expires_at
-    };
-    progress({ status: "started", step: "credential-store" });
-    await this.credentials.save(login);
-    progress({ status: "completed", step: "credential-store" });
-    return login;
+  /** The whole usage page: its rows, `other`, prices and checkpoint. */
+  listDatabaseUsage(key, page, query = {}) {
+    return this.page("listDatabaseUsage", key, page, query);
   }
-  listenForCode(expectedState, ready, progress) {
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      const sockets = /* @__PURE__ */ new Set();
-      let authorizationStarted = false;
-      const startAuthorization = () => {
-        if (authorizationStarted) return;
-        authorizationStarted = true;
-        progress({ status: "completed", step: "browser" });
-        progress({ status: "started", step: "browser-authorization" });
-      };
-      const finish = (result, completedResponseSocket) => {
-        if (settled) return;
-        settled = true;
-        clearTimeout(timeout);
-        const complete = (closeError) => {
-          if (closeError) reject(closeError);
-          else if ("code" in result) {
-            progress({ status: "completed", step: "callback-close" });
-            resolve(result.code);
-          } else reject(result.error);
-        };
-        if ("code" in result) progress({ status: "started", step: "callback-close" });
-        if (!server.listening) {
-          complete();
-          return;
-        }
-        server.close(complete);
-        for (const socket of sockets) {
-          if (socket !== completedResponseSocket) socket.destroy();
-        }
-        server.closeIdleConnections();
-      };
-      const timeout = setTimeout(
-        () => {
-          finish({ error: new Error("Timed out waiting for browser login.") });
-        },
-        5 * 60 * 1e3
-      );
-      const server = createServer((request, response) => {
-        const url = new URL(request.url ?? "/", `http://${LOOPBACK_HOST}`);
-        if (url.pathname !== "/callback" || url.searchParams.get("state") !== expectedState) {
-          respond(response, "invalid");
-          return;
-        }
-        const denied = url.searchParams.get("error");
-        if (denied) {
-          const responseSocket2 = response.socket;
-          respond(
-            response,
-            "denied",
-            () => finish({ error: new Error(`The login was not approved (${denied}).`) }, responseSocket2)
-          );
-          return;
-        }
-        const code = url.searchParams.get("code");
-        if (!code) {
-          respond(response, "invalid");
-          return;
-        }
-        startAuthorization();
-        progress({ status: "completed", step: "browser-authorization" });
-        const responseSocket = response.socket;
-        respond(response, "complete", () => finish({ code }, responseSocket));
-      });
-      server.on("connection", (socket) => {
-        sockets.add(socket);
-        socket.once("close", () => sockets.delete(socket));
-      });
-      server.once("error", (error) => finish({ error }));
-      progress({ status: "started", step: "callback-server" });
-      server.listen(0, LOOPBACK_HOST, () => {
-        const { port } = server.address();
-        progress({ status: "completed", step: "callback-server" });
-        progress({ status: "started", step: "browser" });
-        void ready(`http://${LOOPBACK_HOST}:${port}/callback`).then(startAuthorization).catch(
-          (error) => finish({
-            error: error instanceof Error ? error : new Error("Could not open the login browser.")
-          })
-        );
-      });
-    });
+  getUsage(key, period) {
+    return this.call("getUsage", key, { query: { period } });
   }
 };
-function respond(response, outcome, finished) {
-  const page = callbackResponse(outcome);
-  if (finished) response.once("finish", finished);
-  response.writeHead(page.status, { ...page.headers, connection: "close" });
-  response.end(page.body);
+function withoutUndefined(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, field]) => field !== void 0));
 }
-async function openBrowser(url) {
-  if (process.platform === "darwin") return void await exec("open", [url]);
-  if (process.platform === "win32")
-    return void await exec("rundll32", ["url.dll,FileProtocolHandler", url]);
-  return void await exec("xdg-open", [url]);
+function unconfirmed(what, idempotencyKey, same) {
+  return (cause) => {
+    if (cause instanceof HttpError && cause.status < 500)
+      throw cause;
+    throw new Error(`${what} was not confirmed: ${cause instanceof Error ? cause.message : String(cause)} Retry with --idempotency-key ${idempotencyKey} and ${same}.`, { cause });
+  };
 }
 
-// src/commands.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-
-// src/credentials.ts
+// ../../packages/tonbo-cli-core/dist/src/credentials.js
 import { randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, rm } from "node:fs/promises";
 import os2 from "node:os";
@@ -812,8 +895,11 @@ function defaultConfigDirectory() {
 var UnusableLoginError = class extends Error {
 };
 var FileCredentialStore = class {
-  constructor(filename = path.join(defaultConfigDirectory(), "credentials.json")) {
+  filename;
+  loginHint;
+  constructor(filename = path.join(defaultConfigDirectory(), "credentials.json"), loginHint = DEFAULT_LOGIN_HINT) {
     this.filename = filename;
+    this.loginHint = loginHint;
   }
   async load() {
     let parsed;
@@ -821,25 +907,22 @@ var FileCredentialStore = class {
       await assertPrivateRegularFile(this.filename);
       parsed = JSON.parse(await readFile(this.filename, "utf8"));
     } catch (error) {
-      if (error.code === "ENOENT") return null;
+      if (error.code === "ENOENT")
+        return null;
       throw new Error(`Could not read Tonbo credentials at ${this.filename}.`, { cause: error });
     }
     if (!isStoredLogin(parsed))
-      throw new UnusableLoginError(
-        `The saved login at ${this.filename} is not usable by this CLI. Run \`tonbo login\`.`
-      );
+      throw new UnusableLoginError(`The saved login at ${this.filename} is not usable by this CLI. Run \`${this.loginHint}\`.`);
     return parsed;
   }
   async save(login) {
-    if (!isStoredLogin(login)) throw new Error("Refusing to store a malformed Tonbo login.");
+    if (!isStoredLogin(login))
+      throw new Error("Refusing to store a malformed Tonbo login.");
     const directory = path.dirname(this.filename);
     await mkdir(directory, { mode: 448, recursive: true });
     await preparePrivateDirectory(directory);
     await assertExistingDestinationIsSafe(this.filename);
-    const temporary = path.join(
-      directory,
-      `.${path.basename(this.filename)}.${process.pid}.${randomUUID()}.tmp`
-    );
+    const temporary = path.join(directory, `.${path.basename(this.filename)}.${process.pid}.${randomUUID()}.tmp`);
     let handle = null;
     try {
       handle = await open(temporary, "wx", 384);
@@ -848,7 +931,8 @@ var FileCredentialStore = class {
       await handle.sync();
       await handle.close();
       handle = null;
-      if (process.platform !== "win32") await chmod(temporary, 384);
+      if (process.platform !== "win32")
+        await chmod(temporary, 384);
       await rename(temporary, this.filename);
     } catch (error) {
       await handle?.close().catch(() => void 0);
@@ -862,7 +946,8 @@ var FileCredentialStore = class {
   }
 };
 function isStoredLogin(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return false;
   const login = value;
   return login.version === 1 && typeof login.account_id === "string" && login.account_id.length > 0 && typeof login.key_id === "string" && login.key_id.length > 0 && typeof login.key === "string" && login.key.startsWith("tbo_") && (login.expires_at === null || typeof login.expires_at === "string" && !Number.isNaN(Date.parse(login.expires_at)));
 }
@@ -870,7 +955,8 @@ async function preparePrivateDirectory(directory) {
   const stat = await lstat(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory())
     throw new Error("Tonbo config directory must be a real directory.");
-  if (process.platform !== "win32") await chmod(directory, 448);
+  if (process.platform !== "win32")
+    await chmod(directory, 448);
 }
 async function assertExistingDestinationIsSafe(filename) {
   try {
@@ -878,7 +964,8 @@ async function assertExistingDestinationIsSafe(filename) {
     if (stat.isSymbolicLink() || !stat.isFile())
       throw new Error("Tonbo credential path must be a regular file.");
   } catch (error) {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT")
+      throw error;
   }
 }
 async function assertPrivateRegularFile(filename) {
@@ -889,27 +976,10 @@ async function assertPrivateRegularFile(filename) {
     throw new Error("Tonbo credential file must have mode 0600.");
 }
 
-// src/agent-name.ts
-var AGENT_NAME_RULE = agentNameContract.$defs.name;
-var AGENT_NAME_PATTERN = new RegExp(AGENT_NAME_RULE.pattern);
-var RESERVED_AGENT_NAMES = new Set(AGENT_NAME_RULE.not.enum);
-function validateAgentName(name) {
-  const valid = name.length >= AGENT_NAME_RULE.minLength && name.length <= AGENT_NAME_RULE.maxLength && AGENT_NAME_PATTERN.test(name) && !RESERVED_AGENT_NAMES.has(name);
-  if (!valid) {
-    throw new Error(
-      `Agent name must be ${AGENT_NAME_RULE.minLength}-${AGENT_NAME_RULE.maxLength} lowercase letters, digits, or single hyphens, start with a letter, and not be reserved.`
-    );
-  }
-}
-
-// src/format.ts
+// ../../packages/tonbo-cli-core/dist/src/format.js
 function table(headings, rows) {
-  const widths = headings.map(
-    (heading, column) => Math.max(heading.length, ...rows.map((row) => (row[column] ?? "").length))
-  );
-  return [headings, ...rows].map(
-    (row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("  ").trimEnd()
-  ).join("\n");
+  const widths = headings.map((heading, column) => Math.max(heading.length, ...rows.map((row) => (row[column] ?? "").length)));
+  return [headings, ...rows].map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("  ").trimEnd()).join("\n");
 }
 function fields(pairs) {
   const width = Math.max(...pairs.map(([label]) => label.length + 1));
@@ -921,37 +991,34 @@ var USD = new Intl.NumberFormat("en-US", {
   minimumFractionDigits: 2,
   maximumFractionDigits: 6
 });
-function usd(micros) {
-  return USD.format(micros / 1e6);
-}
-function when(timestamp, absent = "never") {
-  return timestamp ?? absent;
-}
-
-// src/commands.ts
-function print(deps, json, data, human) {
-  deps.output(json ? JSON.stringify(data) : human);
-}
-function printPage(deps, json, page, human) {
-  print(deps, json, page.data, human(page.data));
-  if (page.next_cursor) deps.notice(`More results: run again with --cursor ${page.next_cursor}`);
-}
-async function confirm(deps, yes, action, question, expected) {
-  if (yes) return;
-  if (!deps.interactive())
-    throw new Error(`Refusing to ${action} without confirmation: pass --yes.`);
-  if (await deps.ask(await question()) !== expected)
-    throw new Error("Cancelled; nothing was changed.");
+function usd(micros) {
+  return USD.format(micros / 1e6);
+}
+var BYTE_UNITS = ["KiB", "MiB", "GiB", "TiB"];
+function bytes(count, absent = "unknown") {
+  if (count === null)
+    return absent;
+  if (count < 1024)
+    return `${count} B`;
+  let value = count;
+  let unit = "B";
+  for (const next of BYTE_UNITS) {
+    if (value < 1024)
+      break;
+    value /= 1024;
+    unit = next;
+  }
+  return `${value.toLocaleString("en-US", { maximumFractionDigits: 1 })} ${unit}`;
 }
+function when(timestamp, absent = "never") {
+  return timestamp ?? absent;
+}
+
+// ../../packages/tonbo-cli-core/dist/src/login.js
 async function loginCommand(deps, options = {}) {
   try {
-    const login = await deps.auth.login(
-      (event) => reportLoginProgress(deps.progress, event),
-      options.account
-    );
-    deps.output(
-      `Logged in to account ${login.account_id}.${login.expires_at ? ` The login expires ${login.expires_at}.` : ""}`
-    );
+    const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account);
+    deps.output(`Logged in to account ${login.account_id}.${login.expires_at ? ` The login expires ${login.expires_at}.` : ""}`);
   } catch (error) {
     deps.progress.fail();
     throw error;
@@ -985,15 +1052,18 @@ var LOGIN_PROGRESS_MESSAGES = {
 };
 function reportLoginProgress(progress, event) {
   const messages = LOGIN_PROGRESS_MESSAGES[event.step];
-  if (event.status === "started") progress.start(messages.started);
-  else progress.succeed(messages.completed);
+  if (event.status === "started")
+    progress.start(messages.started);
+  else
+    progress.succeed(messages.completed);
 }
 async function logoutCommand(deps) {
   let login;
   try {
     login = await deps.credentials.load();
   } catch (error) {
-    if (!(error instanceof UnusableLoginError)) throw error;
+    if (!(error instanceof UnusableLoginError))
+      throw error;
     await deps.credentials.remove();
     deps.output("Removed a saved login this CLI cannot use; it had no key to revoke.");
     return;
@@ -1011,11 +1081,114 @@ async function logoutCommand(deps) {
   }
   await deps.credentials.remove();
   if (failure)
+    throw new Error(`Removed the saved login, but could not revoke its key ${login.key_id}: ${failure.message} Revoke it under API keys in the Tonbo console.`, { cause: failure });
+  deps.output("Logged out. The CLI key is revoked.");
+}
+
+// ../../packages/tonbo-cli-core/dist/src/origin.js
+function apiOrigin(configured = process.env.TONBO_API_ORIGIN) {
+  const url = new URL(configured?.trim() || DEFAULT_API_ORIGIN);
+  const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
+    throw new Error("TONBO_API_ORIGIN must be an https origin.");
+  return url.origin;
+}
+function loginOrigin(api) {
+  const url = new URL(api);
+  if (url.hostname.startsWith("api."))
+    url.hostname = url.hostname.slice("api.".length);
+  return url.origin;
+}
+
+// ../../packages/tonbo-cli-core/dist/src/progress.js
+var FRAMES = ["|", "/", "-", "\\"];
+var TerminalProgress = class {
+  stream;
+  intervalMs;
+  activeMessage;
+  frame = 0;
+  lastWidth = 0;
+  timer;
+  constructor(stream, intervalMs = 80) {
+    this.stream = stream;
+    this.intervalMs = intervalMs;
+  }
+  start(message) {
+    if (this.activeMessage)
+      this.succeed();
+    this.activeMessage = message;
+    this.frame = 0;
+    if (!this.stream.isTTY) {
+      this.stream.write(`[..] ${message}
+`);
+      return;
+    }
+    this.render(`[${FRAMES[this.frame]}] ${message}`);
+    this.timer = setInterval(() => {
+      this.frame = (this.frame + 1) % FRAMES.length;
+      this.render(`[${FRAMES[this.frame]}] ${this.activeMessage}`);
+    }, this.intervalMs);
+    this.timer.unref();
+  }
+  succeed(message = this.activeMessage) {
+    this.finish("ok", message);
+  }
+  fail(message = this.activeMessage) {
+    this.finish("!!", message);
+  }
+  finish(marker, message) {
+    if (this.timer)
+      clearInterval(this.timer);
+    this.timer = void 0;
+    this.activeMessage = void 0;
+    if (!message)
+      return;
+    const line = `[${marker}] ${message}`;
+    if (this.stream.isTTY) {
+      this.render(line);
+      this.stream.write("\n");
+      this.lastWidth = 0;
+      return;
+    }
+    this.stream.write(`${line}
+`);
+  }
+  render(value) {
+    this.stream.write(`\r${value.padEnd(this.lastWidth)}`);
+    this.lastWidth = value.length;
+  }
+};
+
+// src/commands.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/agent-name.ts
+var AGENT_NAME_RULE = agentNameContract.$defs.name;
+var AGENT_NAME_PATTERN = new RegExp(AGENT_NAME_RULE.pattern);
+var RESERVED_AGENT_NAMES = new Set(AGENT_NAME_RULE.not.enum);
+function validateAgentName(name) {
+  const valid = name.length >= AGENT_NAME_RULE.minLength && name.length <= AGENT_NAME_RULE.maxLength && AGENT_NAME_PATTERN.test(name) && !RESERVED_AGENT_NAMES.has(name);
+  if (!valid) {
     throw new Error(
-      `Removed the saved login, but could not revoke its key ${login.key_id}: ${failure.message} Revoke it under API keys in the Tonbo console.`,
-      { cause: failure }
+      `Agent name must be ${AGENT_NAME_RULE.minLength}-${AGENT_NAME_RULE.maxLength} lowercase letters, digits, or single hyphens, start with a letter, and not be reserved.`
     );
-  deps.output("Logged out. The CLI key is revoked.");
+  }
+}
+
+// src/commands.ts
+function print(deps, json, data, human) {
+  deps.output(json ? JSON.stringify(data) : human);
+}
+function printPage(deps, json, page, human) {
+  print(deps, json, page.data, human(page.data));
+  if (page.next_cursor) deps.notice(`More results: run again with --cursor ${page.next_cursor}`);
+}
+async function confirm(deps, yes, action, question, expected) {
+  if (yes) return;
+  if (!deps.interactive())
+    throw new Error(`Refusing to ${action} without confirmation: pass --yes.`);
+  if (await deps.ask(await question()) !== expected)
+    throw new Error("Cancelled; nothing was changed.");
 }
 async function regionListCommand(deps, options = {}) {
   const regions = await deps.api.listRegions(await deps.auth.apiKey());
@@ -1024,8 +1197,8 @@ async function regionListCommand(deps, options = {}) {
     options.json,
     regions,
     regions.length ? table(
-      ["REGION", "URL"],
-      regions.map((region) => [region.id, region.url])
+      ["REGION", "URL", "DATABASE DEFAULT"],
+      regions.map((region) => [region.id, region.url, region.default ? "yes" : ""])
     ) : "No region accepts new resources."
   );
 }
@@ -1145,8 +1318,19 @@ async function memberUpdateCommand(deps, member, options = {}) {
 function keyAccess(apiKey) {
   return apiKey.read_only ? "read-only" : "read-write";
 }
+function narrowedByDatabase(apiKey) {
+  return apiKey.databases.length + apiKey.database_prefixes.length > 0;
+}
 function keyBuckets(apiKey) {
-  return apiKey.buckets.length ? apiKey.buckets.join(", ") : "all";
+  if (apiKey.buckets.length) return apiKey.buckets.join(", ");
+  return narrowedByDatabase(apiKey) ? "none" : "all";
+}
+function keyDatabases(apiKey) {
+  if (narrowedByDatabase(apiKey))
+    return [...apiKey.databases, ...apiKey.database_prefixes.map((prefix) => `${prefix}*`)].join(
+      ", "
+    );
+  return apiKey.buckets.length ? "none" : "all";
 }
 function apiKeyFields(apiKey) {
   return fields([
@@ -1156,6 +1340,7 @@ function apiKeyFields(apiKey) {
     ["Ends in", apiKey.last4],
     ["Access", keyAccess(apiKey)],
     ["Buckets", keyBuckets(apiKey)],
+    ["Databases", keyDatabases(apiKey)],
     ["Expires", when(apiKey.expires_at)],
     ["Last used", when(apiKey.last_used_at)],
     ["Created", apiKey.created_at]
@@ -1171,7 +1356,17 @@ async function apiKeyListCommand(deps, options = {}) {
     options.json,
     page,
     (keys) => keys.length ? table(
-      ["ID", "NAME", "MEMBER", "ENDS IN", "ACCESS", "BUCKETS", "EXPIRES", "LAST USED"],
+      [
+        "ID",
+        "NAME",
+        "MEMBER",
+        "ENDS IN",
+        "ACCESS",
+        "BUCKETS",
+        "DATABASES",
+        "EXPIRES",
+        "LAST USED"
+      ],
       keys.map((apiKey) => [
         apiKey.id,
         apiKey.name,
@@ -1179,6 +1374,7 @@ async function apiKeyListCommand(deps, options = {}) {
         apiKey.last4,
         keyAccess(apiKey),
         keyBuckets(apiKey),
+        keyDatabases(apiKey),
         when(apiKey.expires_at),
         when(apiKey.last_used_at)
       ])
@@ -1193,6 +1389,8 @@ async function apiKeyCreateCommand(deps, name, options = {}) {
     member,
     read_only: options.readOnly,
     buckets: options.bucket,
+    databases: options.database,
+    database_prefixes: options.databasePrefix,
     expires_in: options.expiresIn
   });
   print(
@@ -1312,6 +1510,157 @@ async function bucketDeleteCommand(deps, name, options = {}) {
     `Bucket ${bucket.name} is ${bucket.state}; its streams are being purged.`
   );
 }
+function databaseAccess(database) {
+  return database.public_read ? "public" : "private";
+}
+function databaseSize(database) {
+  const { log, snapshot } = database.stored_bytes;
+  if (log === null && snapshot === null) return "unknown";
+  return `${bytes(log)} log, ${bytes(snapshot, "no")} snapshot`;
+}
+function databaseOwner(database) {
+  return database.owner_id ? `${database.kind} ${database.owner_id}` : database.kind;
+}
+function databaseFields(database) {
+  return fields([
+    ["Name", database.name],
+    ["Kind", databaseOwner(database)],
+    ["Region", database.region],
+    ["State", database.state],
+    ["Read access", databaseAccess(database)],
+    ["URL", database.url],
+    ["Incarnation", database.incarnation ?? "none yet"],
+    ["Last write", when(database.last_write_at)],
+    ["Stored", databaseSize(database)],
+    ["Created", `${database.created_at} by ${database.created_by}`]
+  ]);
+}
+function noticeUnavailable(deps, regions, what) {
+  if (regions.length)
+    deps.notice(
+      `Could not read ${what} in ${regions.join(", ")}; they show as unknown or are missing.`
+    );
+}
+async function databaseListCommand(deps, options = {}) {
+  const page = await deps.api.listDatabases(
+    await deps.auth.apiKey(),
+    { limit: options.limit, cursor: options.cursor },
+    options.prefix
+  );
+  printPage(
+    deps,
+    options.json,
+    page,
+    (databases) => databases.length ? table(
+      ["NAME", "KIND", "REGION", "STATE", "READ ACCESS", "LAST WRITE", "STORED", "URL"],
+      databases.map((database) => [
+        database.name,
+        databaseOwner(database),
+        database.region,
+        database.state,
+        databaseAccess(database),
+        when(database.last_write_at),
+        databaseSize(database),
+        database.url
+      ])
+    ) : "No databases."
+  );
+  noticeUnavailable(deps, page.unavailable_regions, "sizes");
+}
+async function databaseCreateCommand(deps, name, options = {}) {
+  const database = await deps.api.createDatabase(
+    await deps.auth.apiKey(),
+    { name, region: options.region },
+    options.idempotencyKey ?? randomUUID2()
+  );
+  print(
+    deps,
+    options.json,
+    database,
+    [
+      database.state === "active" ? `Created database ${database.name}.` : `Database ${database.name} is being created; \`tonbo database show ${database.name}\` reports it active when it is ready.`,
+      databaseFields(database)
+    ].join("\n")
+  );
+}
+async function databaseShowCommand(deps, name, options = {}) {
+  const database = await deps.api.getDatabase(await deps.auth.apiKey(), name);
+  print(deps, options.json, database, databaseFields(database));
+}
+async function databaseUpdateCommand(deps, name, options = {}) {
+  if (options.public === options.private)
+    throw new Error("Pass exactly one of --public and --private.");
+  const database = await deps.api.updateDatabase(await deps.auth.apiKey(), name, {
+    public_read: options.public === true
+  });
+  print(
+    deps,
+    options.json,
+    database,
+    database.public_read ? `Database ${database.name} is public: anyone can read it at ${database.url}.` : `Database ${database.name} is private: only the account's keys can read it.`
+  );
+}
+async function databaseDeleteCommand(deps, name, options = {}) {
+  await confirm(
+    deps,
+    options.yes,
+    `delete database ${name}`,
+    () => Promise.resolve(
+      `Delete database ${name} and everything in it? This cannot be undone. Type the database's name to confirm:`
+    ),
+    name
+  );
+  const database = await deps.api.deleteDatabase(await deps.auth.apiKey(), name);
+  print(
+    deps,
+    options.json,
+    database,
+    database.state === "deleted" ? `Deleted database ${database.name}; its name is free again.` : `Database ${database.name} is ${database.state}; its name is free again once it is deleted.`
+  );
+}
+function databaseUsageSort(value) {
+  if (value === "-list_value" || value === "list_value") return "-list_value";
+  if (value === "name") return "name";
+  throw new Error("--sort is list_value or name.");
+}
+async function databaseUsageCommand(deps, options = {}) {
+  const usage = await deps.api.listDatabaseUsage(
+    await deps.auth.apiKey(),
+    { limit: options.limit, cursor: options.cursor },
+    { period: options.period, sort: options.sort, prefix: options.prefix }
+  );
+  if (options.json) deps.output(JSON.stringify(usage));
+  else
+    deps.output(
+      [
+        `Database usage in ${usage.period} at list price, before the monthly allowance and credit (${usage.currency.toUpperCase()}; metered up to ${when(usage.as_of, "not yet metered")})`,
+        usage.data.length ? table(
+          [
+            "NAME",
+            "REGION",
+            "STATE",
+            "WRITE UNITS",
+            "LOG GIB-MONTHS",
+            "SNAPSHOT GIB-MONTHS",
+            "LIST VALUE"
+          ],
+          usage.data.map((row) => [
+            row.name,
+            row.region,
+            row.state,
+            row.write_units,
+            row.retention_gib_months,
+            row.snapshot_gib_months ?? "",
+            usd(row.list_value_micros)
+          ])
+        ) : "No database usage.",
+        `Other metered usage: ${usd(usage.other.list_value_micros)}`,
+        "Charges, after the allowance and credit, are in `tonbo usage show`."
+      ].join("\n")
+    );
+  if (usage.next_cursor) deps.notice(`More results: run again with --cursor ${usage.next_cursor}`);
+  noticeUnavailable(deps, usage.unavailable_regions, "usage");
+}
 async function usageShowCommand(deps, options = {}) {
   const usage = await deps.api.getUsage(await deps.auth.apiKey(), options.period);
   print(
@@ -1336,60 +1685,6 @@ async function usageShowCommand(deps, options = {}) {
   );
 }
 
-// src/progress.ts
-var FRAMES = ["|", "/", "-", "\\"];
-var TerminalProgress = class {
-  constructor(stream, intervalMs = 80) {
-    this.stream = stream;
-    this.intervalMs = intervalMs;
-  }
-  activeMessage;
-  frame = 0;
-  lastWidth = 0;
-  timer;
-  start(message) {
-    if (this.activeMessage) this.succeed();
-    this.activeMessage = message;
-    this.frame = 0;
-    if (!this.stream.isTTY) {
-      this.stream.write(`[..] ${message}
-`);
-      return;
-    }
-    this.render(`[${FRAMES[this.frame]}] ${message}`);
-    this.timer = setInterval(() => {
-      this.frame = (this.frame + 1) % FRAMES.length;
-      this.render(`[${FRAMES[this.frame]}] ${this.activeMessage}`);
-    }, this.intervalMs);
-    this.timer.unref();
-  }
-  succeed(message = this.activeMessage) {
-    this.finish("ok", message);
-  }
-  fail(message = this.activeMessage) {
-    this.finish("!!", message);
-  }
-  finish(marker, message) {
-    if (this.timer) clearInterval(this.timer);
-    this.timer = void 0;
-    this.activeMessage = void 0;
-    if (!message) return;
-    const line = `[${marker}] ${message}`;
-    if (this.stream.isTTY) {
-      this.render(line);
-      this.stream.write("\n");
-      this.lastWidth = 0;
-      return;
-    }
-    this.stream.write(`${line}
-`);
-  }
-  render(value) {
-    this.stream.write(`\r${value.padEnd(this.lastWidth)}`);
-    this.lastWidth = value.length;
-  }
-};
-
 // src/prompt.ts
 import select from "@inquirer/select";
 import { createInterface } from "node:readline/promises";
@@ -1419,18 +1714,6 @@ async function terminalAsk(question) {
 var packageVersion = JSON.parse(
   readFileSync(new URL("../../package.json", import.meta.url), "utf8")
 );
-function apiOrigin(configured = process.env.TONBO_API_ORIGIN) {
-  const url = new URL(configured?.trim() || DEFAULT_API_ORIGIN);
-  const loopback = ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
-  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback))
-    throw new Error("TONBO_API_ORIGIN must be an https origin.");
-  return url.origin;
-}
-function loginOrigin(api) {
-  const url = new URL(api);
-  if (url.hostname.startsWith("api.")) url.hostname = url.hostname.slice("api.".length);
-  return url.origin;
-}
 function createDependencies() {
   const api = apiOrigin();
   const credentials = new FileCredentialStore();
@@ -1458,6 +1741,7 @@ function operationOptions(command, operationId) {
     command.option("--cursor <cursor>", "continue from the cursor a previous page printed");
   return command.option("--json", "print the API data as JSON");
 }
+var repeated = (value, previous = []) => [...previous, value];
 var roleOption = (description) => new Option("--role <role>", description).choices(accountRoles);
 function createProgram(dependencies = createDependencies) {
   const program = new Command().name("tonbo").description("Sign in to Tonbo and manage account resources.").version(packageVersion.version);
@@ -1513,7 +1797,15 @@ function createProgram(dependencies = createDependencies) {
     ).option("--read-only", "narrow the key to read-only actions, for its whole life").option(
       "--bucket <name>",
       "narrow the key to this bucket, for its whole life; repeat for several",
-      (value, previous = []) => [...previous, value]
+      repeated
+    ).option(
+      "--database <name>",
+      "narrow the key to this database, for its whole life; repeat for several; never with --bucket",
+      repeated
+    ).option(
+      "--database-prefix <prefix>",
+      "narrow the key to the databases whose name starts with this, for its whole life; repeat for several; never with --bucket",
+      repeated
     ).addOption(
       new Option("--expires-in <period>", "when the key expires; never by default").choices(
         apiKeyExpirations
@@ -1563,6 +1855,62 @@ function createProgram(dependencies = createDependencies) {
   ).action(
     async (name, options) => bucketDeleteCommand(dependencies(), name, options)
   );
+  const database = program.command("database").description("the account's databases");
+  operationOptions(
+    database.command("list").description("list the databases in every region").option("--prefix <prefix>", "only databases whose name starts with this"),
+    "listDatabases"
+  ).action(
+    async (options) => databaseListCommand(dependencies(), options)
+  );
+  operationOptions(
+    database.command("create <name>").description("create a database; its region is fixed for its life").option(
+      "--region <region>",
+      "the database's region (see tonbo region list); the database default region by default"
+    ).option(
+      "--idempotency-key <key>",
+      "reuse the key of an unconfirmed creation to get the database it created"
+    ),
+    "createDatabase"
+  ).action(
+    async (name, options) => databaseCreateCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    database.command("show <name>").description("show a database, its URL and size"),
+    "getDatabase"
+  ).action(
+    async (name, options) => databaseShowCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    database.command("update <name>").description("publish a database for anonymous reads, or take it private (owners and admins)").addOption(new Option("--public", "serve anonymous reads").conflicts("private")).addOption(new Option("--private", "serve only the account's keys").conflicts("public")),
+    "updateDatabase"
+  ).action(
+    async (name, options) => databaseUpdateCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    database.command("delete <name>").description("delete a database and everything in it").option("--yes", "delete without asking; required when stdin is not a terminal"),
+    "deleteDatabase"
+  ).action(
+    async (name, options) => databaseDeleteCommand(dependencies(), name, options)
+  );
+  operationOptions(
+    database.command("usage").description("each database's usage of one month at list price, before allowance and credit").option(
+      "--period <month>",
+      "the calendar month in UTC, as YYYY-MM; the current one by default"
+    ).option(
+      "--sort <order>",
+      "list_value (highest first, the default) or name",
+      (value) => {
+        try {
+          return databaseUsageSort(value);
+        } catch (error) {
+          throw new InvalidArgumentError(error.message);
+        }
+      }
+    ).option("--prefix <prefix>", "only databases whose name starts with this"),
+    "listDatabaseUsage"
+  ).action(
+    async (options) => databaseUsageCommand(dependencies(), options)
+  );
   operationOptions(
     program.command("usage").description("the account's rated usage").command("show").description("show one month's rated usage").option(
       "--period <month>",