@tonbo/cli 0.9.0 → 0.10.0

package/README.md

@@ -14,9 +14,9 @@ tonbo login [--account <name>]
 tonbo logout
 ```
 
-`login` prints the login URL and opens the browser at `https://tonbo.dev/cli/login`, where you pick the account (your personal account unless `--account` names another) and approve a personal API key named `CLI on <hostname>`. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the key. The key acts as you with your role in that account, expires after six months and replaces the key an earlier login on the same host created; there is no refresh, so an expired or revoked key asks you to run `tonbo login` again. One login holds one account: log in again to switch accounts. When no browser can be opened (an SSH session, a server without a desktop), the CLI keeps waiting: open the printed URL in a browser that can reach the callback's `127.0.0.1:<port>` on that machine, through `ssh -L <port>:127.0.0.1:<port>` or the VM's port forwarding.
+`login` prints the login URL and opens the browser at `https://tonbo.dev/cli/login`, where you pick the account (your personal account unless `--account` names another) and approve a personal API key named `CLI on <hostname>`. The browser returns a one-time code to a local callback on `127.0.0.1`, and the CLI redeems it with its PKCE verifier for the key. The key acts as you with your role in that account, expires after six months and replaces the key an earlier login on the same host created; there is no refresh, so an expired or revoked key asks you to run `tonbo login` again. `tonbo` acts in the account of the last login: log in again to switch accounts. The file keeps one login key per account of the computer beside it, for `yield` ([`credentials-v1.json`](../../contracts/cli/credentials-v1.json) `accounts`); a key in a non-personal account is named `Yield CLI · <8 hex>` instead of after the host. When no browser can be opened (an SSH session, a server without a desktop), the CLI keeps waiting: open the printed URL in a browser that can reach the callback's `127.0.0.1:<port>` on that machine, through `ssh -L <port>:127.0.0.1:<port>` or the VM's port forwarding.
 
-The login and the credentials file are shared with [`yield`](../yield) through `@tonbo/cli-core`: either CLI's `login` signs both in, and either `logout` signs both out. The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/credentials.json` as `{version, account_id, key_id, key, expires_at}`. The CLI atomically replaces that file with owner-only permissions and refuses a symlink or a file other users can read. A file written by an earlier CLI release is not migrated; run `tonbo login`.
+The login and the credentials file are shared with [`yield`](../yield) through `@tonbo/cli-core`: either CLI's `login` signs both in, and either `logout` signs both out, revoking every account's key of the file. The login is saved at `${XDG_CONFIG_HOME:-$HOME/.config}/tonbo/credentials.json` as `{version, account_id, key_id, key, expires_at}`, with `accounts` and `login_secret` beside them. The CLI atomically replaces that file with owner-only permissions and refuses a symlink or a file other users can read. A file written by an earlier CLI release is not migrated; run `tonbo login`.
 
 `logout` revokes the saved key through the Management API and removes the file. If the revocation fails, the file is still removed and the CLI reports the key id, so you can revoke it under API keys in the console.
 
@@ -27,7 +27,7 @@ The login and the credentials file are shared with [`yield`](../yield) through `
 
 ## Commands and the Management API
 
-Every command other than `login` and `logout` is named by one operation of the [Management API](../../contracts/management/openapi-v1.yaml) through its `x-tonbo-cli` and calls that operation, plus reads of the same resource (a `--wait`, or the Machine a `name_taken` refusal names); `tonbo machine logs`, once it ships, is the named Streams exception, reading the stream at the Machine's `logs.url`. The command set and the operations tagged with a command are the same set, which `test/commands.test.ts` checks in both directions. The CLI resolves each request from the operation table of the internal package [`@tonbo/cli-core`](../../packages/tonbo-cli-core) (`src/generated/contracts.ts`, which `pnpm --filter @tonbo/cli-core generate:contracts` derives from the contract). `login` and `logout` are the named exception: they obtain and discard the key the other commands present as their Bearer credential. What a command may do is what your role in the logged-in account allows; the CLI never decides it.
+Every command other than `login` and `logout` is named by one operation of the [Management API](../../contracts/management/openapi-v1.yaml) through its `x-tonbo-cli` and calls that operation, plus reads of the same resource (a `--wait`, the Machine a `name_taken` refusal names, or the activations `machine show` reads for the last end); `tonbo machine logs`, once it ships, is the named Streams exception, reading the stream at the Machine's `logs.url`. The command set and the operations tagged with a command are the same set, which `test/commands.test.ts` checks in both directions. The CLI resolves each request from the operation table of the internal package [`@tonbo/cli-core`](../../packages/tonbo-cli-core) (`src/generated/contracts.ts`, which `pnpm --filter @tonbo/cli-core generate:contracts` derives from the contract). `login` and `logout` are the named exception: they obtain and discard the key the other commands present as their Bearer credential. What a command may do is what your role in the logged-in account allows; the CLI never decides it.
 
 | Command | Operation | Request |
 | --- | --- | --- |
@@ -65,6 +65,7 @@ Every command other than `login` and `logout` is named by one operation of the [
 | `tonbo machine update <name> [--image <reference>] [--image-command] [--shape <shape>] [--port <port[:access]>]… [--clear-ports] [--default-port <port>] [--env <KEY=VALUE>]… [--unset-env <KEY>]… [--sleep-after <seconds>] [--idle-action <action>] [--stop-grace <seconds>] [--discard-snapshot] [--if-match <etag>] [-- <command>…]` | `updateMachine` | `PATCH /v1/machines/{name}` |
 | `tonbo machine sleep <name> [--if-match <etag>] [--wait [--timeout <seconds>]]` | `sleepMachine` | `POST /v1/machines/{name}/sleep` |
 | `tonbo machine delete <name> [--yes] [--if-match <etag>]` | `deleteMachine` | `DELETE /v1/machines/{name}` |
+| `tonbo machine activations <name> [--limit <n>] [--cursor <c>]` | `listMachineActivations` | `GET /v1/machines/{name}/activations` |
 | `tonbo machine shapes` | `listMachineShapes` | `GET /v1/machine-shapes` |
 
 ### Output and errors
@@ -166,10 +167,11 @@ tonbo machine create web --image tonbo.dev/platform --port 8080:public --env MOD
 tonbo machine create worker --image tonbo.dev/platform -- sh -c 'while true; do date; sleep 60; done'
 tonbo machine update web --env MODE=staging --sleep-after 300
 tonbo machine sleep web
+tonbo machine activations web
 tonbo machine delete web
 ```
 
-A Machine is a VM booted from an image, in one region, with its own database (`contracts/machines/machine-v2.json`). Machines open by invitation: until a region is open for them, `machine create`, `update`, `sleep` and `delete` are refused with `region_not_offered`, and the CLI says that nothing was created or changed; `machine list`, `show` and `shapes` still answer. A region that cannot be reached is refused with `region_unavailable`, which a retry may clear.
+A Machine is a VM booted from an image, in one region, with its own database (`contracts/machines/machine-v2.json`). Machines open by invitation: until a region is open for them, `machine create`, `update`, `sleep` and `delete` are refused with `region_not_offered`, and the CLI says that nothing was created or changed; `machine list`, `show` and `shapes` still answer. A region that cannot be reached is refused with `region_unavailable`, whose `Retry-After` says when a retry may clear it.
 
 The image is `tonbo.dev/platform`, the platform image each node release ships, or, once registry images are offered, a public OCI image with a linux/arm64 variant. Until then any other reference is refused with `image_not_offered`, before anything is created or changed; `machine show` prints the platform image as `tonbo.dev/platform (platform image)`.
 
@@ -177,9 +179,11 @@ The image is `tonbo.dev/platform`, the platform image each node release ships, o
 
 `machine create` and `machine update` warn on stderr when the Machine ends up with no port (nothing can wake it until exec and SSH arrive) and when an `--env` key looks secret (`*_KEY`, `*_TOKEN`, `*SECRET*`, `*PASSWORD*`): env values are readable by every member through the API, and Machine secrets come later. When the default port is private, `machine create` and `machine show` print the `curl` call that reaches it with a personal key, and say that on a private port Tonbo authenticates the caller, so the app sees neither `Authorization` nor who called; an app with its own users serves a public port and does its own auth.
 
-`machine show` prints the state and what it means (an `active` Machine that is asleep boots on its first request, which the edge holds while it boots), the live activation and conditions when there are any, when the Machine sleeps and that its disk resets at every sleep until suspend ships, the database and logs URLs, a link to the durability text (the CLI prints the link only, never the text or a paraphrase of it), and the ETag. `machine show` prints image states as the API answers them: `pulling`, `ready`, `failed` or `not_pulled`.
+`machine show` prints the state and what it means (an `active` Machine that is asleep boots on its first request, which the edge holds while it boots), the live activation and conditions when there are any, when the Machine sleeps and that its disk resets at every sleep until suspend ships, the database and logs URLs, a link to the durability text (the CLI prints the link only, never the text or a paraphrase of it), the ETag and who created the Machine. Each condition comes with what to do: a refused wake (`wake_blocked`) names its reason, when it was first refused and, for a crash backoff, when a retry may pass; `creation_delayed` says the creation is taking longer than usual and goes on. For an `active` Machine, `machine show` also reads its newest activations and prints how the last one ended (`Last end`), and when the live activation was admitted at an older revision than the Machine's it prints `Spec N, admitted at M` and says that ports and sleep-after already apply and that a changed image, command, shape or env applies after `tonbo machine sleep <name>`, since every spec change advances the revision. `machine show` prints image states as the API answers them: `pulling`, `ready`, `failed` or `not_pulled`. `machine list` prints each Machine's conditions in its last column.
 
-`machine update` changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between, or another Machine that took the name, is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed unless `--default-port` names another. Ports and `--sleep-after` apply at once; image, command, shape and env apply at the next activation, and the command says how to apply them now: `machine sleep`, after which the next request boots the new spec; naming the same tag again re-resolves its digest. `machine sleep` puts an awake Machine to sleep now, and says so when it is already asleep or still creating; with `--wait` it reads the Machine until it is asleep. `machine delete` sends the ETag it read when it asked for confirmation, and `machine sleep` and `machine delete` send `--if-match`'s when given. `--if-match` takes the ETag `machine show` prints, with or without its double quotes: a value with neither a leading `"` nor `W/"` is quoted again, since a shell drops the quotes of a pasted tag. `machine shapes` prints each shape's list price for an hour at full use. `machine delete` deletes the Machine with its disk, database and logs, and its name is free for a new Machine at once.
+`machine activations` lists a Machine's activations, newest first: the wake, what woke it, the spec revision and shape it ran, when it started and how it ended (its state, the reason such as `idle_early`, `workload_exited` with the exit code, or a refusal such as `payment_required`), or `live`.
+
+`machine update` changes only what its options name. It reads the Machine and sends the ETag it read, or `--if-match`'s, so a change someone made in between, or another Machine that took the name, is refused with `precondition_failed` rather than overwritten; a Machine whose creation failed is refused with `machine_failed`. `--env` and `--unset-env` change single variables; `--port` replaces every port, and the current default port stays the default while it is still listed unless `--default-port` names another. Ports and `--sleep-after` apply at once; image, command, shape and env apply at the next activation, and the command says how to apply them now: `machine sleep`, after which the next request boots the new spec; naming the same tag again re-resolves its digest. `machine sleep` puts an awake Machine to sleep now, and says so when it is already asleep or still creating; with `--wait` it reads the Machine after the answer's `Retry-After`, and again every `sleep.poll_after_seconds`, until it is asleep or `--timeout` (300 s by default) passes. `machine delete` sends the ETag it read when it asked for confirmation, and `machine sleep` and `machine delete` send `--if-match`'s when given. `--if-match` takes the ETag `machine show` prints, with or without its double quotes: a value with neither a leading `"` nor `W/"` is quoted again, since a shell drops the quotes of a pasted tag. `machine shapes` prints each shape's list price for an hour at full use. `machine delete` deletes the Machine with its disk, database and logs, and its name is free for a new Machine at once.
 
 In a personal account, `machine list`, `machine show` and `machine delete` also cover your own computers, which `yield login` registers (Machines of kind `byoc`, which run nothing Tonbo operates). They are served even while Machines are not open in any region. `machine list` prints them in a second table with their system, agent harnesses, when they last reported and the state of their login key; `machine show` adds the hostname and device id, which only you see. `machine delete` forgets a computer: it disappears from the list at once and its name is free once the forget completes. Forgetting does not revoke the computer's key, so a computer whose key is still active registers again at its next start; the command says so and suggests `yield logout` on it or `tonbo api-key revoke` first. An organization lists managed Machines only.
 

package/dist/bin/tonbo.js

@@ -202,6 +202,7 @@ var agentNameContract = {
           "artifacts",
           "auth",
           "inference",
+          "lb-check",
           "network-health",
           "sandbox-control",
           "status",
@@ -221,6 +222,7 @@ var agentNameContract = {
           "artifacts.tonbo.sh",
           "auth.tonbo.sh",
           "inference.tonbo.sh",
+          "lb-check.tonbo.sh",
           "network-health.tonbo.sh",
           "sandbox-control.tonbo.sh",
           "status.tonbo.sh",
@@ -621,6 +623,19 @@ var managementOperations = {
     "idempotencyKey": false,
     "cli": "tonbo machine sleep"
   },
+  "listMachineActivations": {
+    "method": "GET",
+    "path": "/machines/{name}/activations",
+    "pathParams": [
+      "name"
+    ],
+    "query": [
+      "cursor",
+      "limit"
+    ],
+    "idempotencyKey": false,
+    "cli": "tonbo machine activations"
+  },
   "listMachineShapes": {
     "method": "GET",
     "path": "/machine-shapes",
@@ -709,7 +724,7 @@ var apiKeyExpirations = [
 ];
 var credentialsContract = {
   "version": 1,
-  "description": "The login `tonbo login` (and `yield login`) saves: a personal key of one account. @tonbo/cli-core writes and reads it; other readers, such as @tonbo/sqlite-ursula/tonbo, follow `reader`.",
+  "description": "The login `tonbo login` (and `yield login`) saves: a personal key of one account at the top level, the login made last, and, beside it, every account's login of this device in `accounts` with the device's `login_secret` (ADR-0016, \"Credentials\", PR 4b-ii). @tonbo/cli-core writes and reads it; the Tonbo SDK (@tonbo/sdk and tonbo-sdk, contracts/sdk/v1.json) reads it as its last key source, and every other reader follows `reader` and reads the top level alone.",
   "path": {
     "description": "`${XDG_CONFIG_HOME}/tonbo/credentials.json` when XDG_CONFIG_HOME is set and not empty, else `${HOME}/.config/tonbo/credentials.json`.",
     "base_env": "XDG_CONFIG_HOME",
@@ -747,6 +762,13 @@ var credentialsContract = {
     "expired": "A login whose `expires_at` is at or before now is expired: ask the person to run `tonbo login`. `expires_at: null` never expires.",
     "login_hint": "tonbo login"
   },
+  "accounts": {
+    "description": "One CLI login key per account (ADR-0016 R7 (a)): a daemon that publishes into an organization holds that organization's key beside the personal account's, since a key reaches only its own account. The fields are additive and optional, so a version 1 reader that knows only the top level keeps working, and the format stays version 1.",
+    "top_level": "The login made last, by `tonbo login` or `yield login`: the account `tonbo` acts in. A login made only to publish into an organization (`yield connect --account`) is added to `accounts` and leaves the top level alone.",
+    "entries": "`accounts` maps an account id to that account's login on this device, the top level's account included. `kind` and `name` are the redemption's answer; a file written before them, or by a server that does not answer them, has the top level alone, whose kind a client asks the API for.",
+    "personal": "The entry whose kind is `user` is the person's personal account's login: it alone captures raw sessions and registers the device (ADR-0016 W-10, W-14).",
+    "login_secret": "One random per-device secret, 32 bytes base64url, made at the first login and kept: it is sent only in the redeem POST, beside the PKCE verifier, never in the /cli/login URL, and User Center keeps only the suffix it derives from it, in an organization key's name `Yield CLI \xB7 <8 hex>`. `tonbo` and `yield` share it through this file, and so share one key per account. A lost file sends a new secret and gets a new suffix; the old key stays until it is revoked or idles out."
+  },
   "current_version": 1,
   "schema": {
     "$schema": "https://json-schema.org/draft/2020-12/schema",
@@ -787,6 +809,59 @@ var credentialsContract = {
         ],
         "format": "date-time",
         "description": "When the key expires, ISO 8601; null for a key that never expires."
+      },
+      "login_secret": {
+        "type": "string",
+        "pattern": "^[A-Za-z0-9_-]{43}$",
+        "description": "This device's login secret (`accounts.login_secret`)."
+      },
+      "accounts": {
+        "type": "object",
+        "description": "Every account's login of this device, keyed by the account id (`accounts.entries`).",
+        "additionalProperties": {
+          "type": "object",
+          "required": [
+            "key_id",
+            "key",
+            "expires_at"
+          ],
+          "properties": {
+            "key_id": {
+              "type": "string",
+              "minLength": 1,
+              "description": "The key's id."
+            },
+            "key": {
+              "type": "string",
+              "pattern": "^tbo_",
+              "description": "The personal key's secret."
+            },
+            "expires_at": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "format": "date-time",
+              "description": "When the key expires; null for never."
+            },
+            "kind": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "pattern": "^(user|organization)$",
+              "description": "The account's kind, `user` for the personal account; null when unknown."
+            },
+            "name": {
+              "type": [
+                "string",
+                "null"
+              ],
+              "minLength": 1,
+              "description": "The account's name, which `--account` takes; null when unknown."
+            }
+          }
+        }
       }
     }
   },
@@ -805,6 +880,30 @@ var credentialsContract = {
         "key_id": "20000000-0000-4000-8000-000000000002",
         "key": "tbo_secret",
         "expires_at": null
+      },
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null,
+        "login_secret": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+        "accounts": {
+          "10000000-0000-4000-8000-000000000001": {
+            "key_id": "20000000-0000-4000-8000-000000000002",
+            "key": "tbo_secret",
+            "expires_at": null,
+            "kind": "user",
+            "name": "sam"
+          },
+          "10000000-0000-4000-8000-0000000000a1": {
+            "key_id": "20000000-0000-4000-8000-0000000000a2",
+            "key": "tbo_org",
+            "expires_at": "2027-04-24T00:00:00.000Z",
+            "kind": "organization",
+            "name": "acme"
+          }
+        }
       }
     ],
     "unusable": [
@@ -846,6 +945,51 @@ var credentialsContract = {
         "account_id": "10000000-0000-4000-8000-000000000001",
         "key_id": "20000000-0000-4000-8000-000000000002",
         "key": "tbo_secret"
+      },
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null,
+        "accounts": {
+          "10000000-0000-4000-8000-0000000000a1": {
+            "key_id": "k",
+            "key": "not-a-personal-key",
+            "expires_at": null
+          }
+        }
+      },
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null,
+        "accounts": {
+          "10000000-0000-4000-8000-0000000000a1": {
+            "key_id": "k",
+            "key": "tbo_org",
+            "expires_at": null,
+            "kind": "team"
+          }
+        }
+      },
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null,
+        "accounts": []
+      },
+      {
+        "version": 1,
+        "account_id": "10000000-0000-4000-8000-000000000001",
+        "key_id": "20000000-0000-4000-8000-000000000002",
+        "key": "tbo_secret",
+        "expires_at": null,
+        "login_secret": "in-a-url"
       }
     ]
   }
@@ -860,6 +1004,7 @@ var machinePortAccess = [
 ];
 var machineTimings = {
   "pollAfterSeconds": 2,
+  "sleepPollAfterSeconds": 5,
   "wakeHoldSeconds": 25,
   "earlyReclaimSeconds": 120
 };
@@ -929,13 +1074,37 @@ var FileCredentialStore = class {
     await rm(this.filename, { force: true });
   }
 };
-var RULE_KEYWORDS = /* @__PURE__ */ new Set(["const", "type", "minLength", "pattern", "format", "description"]);
+var RULE_KEYWORDS = /* @__PURE__ */ new Set([
+  "const",
+  "type",
+  "minLength",
+  "pattern",
+  "format",
+  "description",
+  "additionalProperties"
+]);
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function matchesObject(value, rule) {
+  if (rule.type !== "object" || !isPlainObject(value))
+    return false;
+  if (!rule.required.every((name) => Object.hasOwn(value, name)))
+    return false;
+  return Object.entries(rule.properties).every(([name, inner]) => !Object.hasOwn(value, name) || matchesRule(value[name], inner));
+}
 function matchesRule(value, rule) {
   if (Object.keys(rule).some((keyword) => !RULE_KEYWORDS.has(keyword)))
     return false;
   if ("const" in rule)
     return value === rule.const;
   const types = typeof rule.type === "string" ? [rule.type] : rule.type ?? [];
+  if (types.includes("object")) {
+    if (!isPlainObject(value) || !rule.additionalProperties)
+      return false;
+    const entries = rule.additionalProperties;
+    return Object.entries(value).every(([key, entry]) => key.length > 0 && matchesObject(entry, entries));
+  }
   if (value === null)
     return types.includes("null");
   if (typeof value !== "string" || !types.includes("string"))
@@ -949,7 +1118,7 @@ function matchesRule(value, rule) {
   return true;
 }
 function isStoredLogin(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value))
+  if (!isPlainObject(value))
     return false;
   const login = value;
   const schema = credentialsContract.schema;
@@ -960,6 +1129,44 @@ function isStoredLogin(value) {
   const properties = schema.properties;
   return Object.entries(properties).every(([name, rule]) => !Object.hasOwn(login, name) || matchesRule(login[name], rule));
 }
+function accountLogins(login) {
+  const entries = Object.entries(login.accounts ?? {}).map(([account_id, entry]) => ({
+    ...entry,
+    account_id,
+    kind: entry.kind ?? null,
+    name: entry.name ?? null
+  }));
+  if (!entries.some((entry) => entry.account_id === login.account_id))
+    entries.unshift({
+      account_id: login.account_id,
+      key_id: login.key_id,
+      key: login.key,
+      expires_at: login.expires_at,
+      kind: null,
+      name: null
+    });
+  return entries;
+}
+function withAccountLogin(file, entry, options) {
+  const accounts = {};
+  if (file)
+    for (const known of accountLogins(file)) {
+      const { account_id: account_id2, ...rest2 } = known;
+      accounts[account_id2] = rest2;
+    }
+  const { account_id, ...rest } = entry;
+  accounts[account_id] = rest;
+  const top = options.current || !file ? entry : file;
+  return {
+    version: 1,
+    account_id: top.account_id,
+    key_id: top.key_id,
+    key: top.key,
+    expires_at: top.expires_at,
+    login_secret: options.loginSecret,
+    accounts
+  };
+}
 async function preparePrivateDirectory(directory) {
   const stat = await lstat(directory);
   if (stat.isSymbolicLink() || !stat.isDirectory())
@@ -989,6 +1196,9 @@ async function assertPrivateRegularFile(filename) {
 var exec = promisify(execFile);
 var DEFAULT_LOGIN_HINT = credentialsContract.reader.login_hint;
 var LOOPBACK_HOST = "127.0.0.1";
+function newLoginSecret() {
+  return randomBytes(32).toString("base64url");
+}
 function loginHostname(hostname = os2.hostname()) {
   const cleaned = hostname.replace(/[^A-Za-z0-9._-]/g, "-").replace(/^[^A-Za-z0-9]+/, "").slice(0, 64);
   return cleaned || "computer";
@@ -1023,11 +1233,21 @@ var AuthClient = class {
   }
   /**
    * The browser handoff of /cli/login: PKCE S256 with a loopback redirect on
-   * a free port, then the one-time code is redeemed for a personal key named
-   * "CLI on <hostname>", which replaces that host's earlier login key.
+   * a free port, then the one-time code is redeemed, with this device's login
+   * secret, for the account's login key, which replaces this device's earlier
+   * login key there ("CLI on <hostname>" in a personal account, `Yield CLI ·
+   * <8 hex>` in any other). The key joins the file's `accounts`; it becomes
+   * the top level too unless `current` is false (a login made only to publish
+   * into an organization). Answers that account's login.
    */
   async login(progress = () => {
-  }, account) {
+  }, account, { current = true } = {}) {
+    const existing = await this.credentials.load().catch((error) => {
+      if (error instanceof UnusableLoginError)
+        return null;
+      throw error;
+    });
+    const loginSecret = existing?.login_secret ?? newLoginSecret();
     const verifier = randomBytes(48).toString("base64url");
     const challenge = createHash("sha256").update(verifier).digest("base64url");
     const state = randomBytes(24).toString("base64url");
@@ -1047,18 +1267,24 @@ var AuthClient = class {
     const redeemed = await requestJson(this.fetcher, new URL("/api/cli/login/token", this.loginOrigin).toString(), {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify({ code, code_verifier: verifier })
+      // The secret goes only here, in the POST body, never in the URL.
+      body: JSON.stringify({ code, code_verifier: verifier, login_secret: loginSecret })
     });
     progress({ status: "completed", step: "key-redemption" });
     const login = {
-      version: 1,
       account_id: redeemed.account_id,
       key_id: redeemed.api_key.id,
       key: redeemed.key,
-      expires_at: redeemed.api_key.expires_at
+      expires_at: redeemed.api_key.expires_at,
+      kind: redeemed.account_kind ?? null,
+      name: redeemed.account_name ?? null
     };
     progress({ status: "started", step: "credential-store" });
-    await this.credentials.save(login);
+    const latest = await this.credentials.load().catch(() => existing);
+    await this.credentials.save(withAccountLogin(latest, login, {
+      current,
+      loginSecret: latest?.login_secret ?? loginSecret
+    }));
     progress({ status: "completed", step: "credential-store" });
     return login;
   }
@@ -1452,12 +1678,15 @@ var ManagementApi = class {
     });
   }
   /** With `etag`, only the Machine that ETag names, at that revision, is put
-   * to sleep (machine-v2.json `etag.if_match.sleep` is optional). */
-  sleepMachine(key, name, etag) {
-    return this.call("sleepMachine", key, {
-      params: { name },
-      ...etag ? { ifMatch: etag } : {}
+   * to sleep (machine-v2.json `etag.if_match.sleep` is optional). A 202
+   * carries the `Retry-After` to read the Machine again after
+   * (machine-v2.json `sleep.poll_after_seconds`); a 200 carries none. */
+  async sleepMachine(key, name, etag) {
+    const headers = { retryAfter: null };
+    const answer = await this.request("sleepMachine", key, { params: { name }, ...etag ? { ifMatch: etag } : {} }, (response) => {
+      headers.retryAfter = response.headers.get("retry-after");
     });
+    return { machine: answer.data, retryAfterSeconds: retryAfterSeconds(headers.retryAfter) };
   }
   /** The Machine being deleted or the device forgotten, with its kind; the
    * Machine is null when the API answered 204, whose `X-Tonbo-Machine-Kind`
@@ -1474,6 +1703,14 @@ var ManagementApi = class {
       return { machine: answer.data, kind: answer.data.kind };
     return { machine: null, kind: headers.kind === "byoc" ? "byoc" : "managed" };
   }
+  /** One page of a managed Machine's activations, newest first; the cursor
+   * pages that Machine only. */
+  listMachineActivations(key, name, { limit, cursor } = {}) {
+    return this.request("listMachineActivations", key, {
+      params: { name },
+      query: { limit, cursor }
+    });
+  }
   /** The whole answer: the shapes and the default one. */
   listMachineShapes(key) {
     return this.request("listMachineShapes", key, {});
@@ -1538,8 +1775,9 @@ function when(timestamp, absent = "never") {
 // ../../packages/tonbo-cli-core/dist/src/login.js
 async function loginCommand(deps, options = {}) {
   try {
-    const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account);
-    deps.output(`Logged in to account ${login.account_id}.${login.expires_at ? ` The login expires ${login.expires_at}.` : ""}`);
+    const login = await deps.auth.login((event) => reportLoginProgress(deps.progress, event), options.account, { current: options.current });
+    deps.output(`Logged in to account ${login.name ?? login.account_id}.${login.expires_at ? ` The login expires ${login.expires_at}.` : ""}`);
+    return login;
   } catch (error) {
     deps.progress.fail();
     throw error;
@@ -1603,17 +1841,23 @@ async function logoutCommand(deps) {
     deps.output("Not logged in.");
     return;
   }
-  let failure;
-  try {
-    await deps.api.revokeApiKey(login.key, login.key_id);
-  } catch (error) {
-    if (!(error instanceof HttpError && (error.status === 401 || error.status === 404)))
-      failure = error instanceof Error ? error : new Error("The revocation failed.");
+  const failures = [];
+  let first;
+  for (const entry of accountLogins(login)) {
+    try {
+      await deps.api.revokeApiKey(entry.key, entry.key_id);
+    } catch (error) {
+      if (error instanceof HttpError && (error.status === 401 || error.status === 404))
+        continue;
+      const failure = error instanceof Error ? error : new Error("The revocation failed.");
+      first ??= failure;
+      failures.push(`${entry.key_id}: ${failure.message}`);
+    }
   }
   await deps.credentials.remove();
-  if (failure)
-    throw new Error(`Removed the saved login, but could not revoke its key ${login.key_id}: ${failure.message} Revoke it under API keys in the Tonbo console.`, { cause: failure });
-  deps.output("Logged out. The CLI key is revoked.");
+  if (failures.length)
+    throw new Error(`Removed the saved login, but could not revoke ${failures.length === 1 ? "its key" : "these keys"} ${failures.join("; ")} Revoke ${failures.length === 1 ? "it" : "them"} under API keys in the Tonbo console.`, { cause: first });
+  deps.output(login.accounts && Object.keys(login.accounts).length > 1 ? "Logged out. Every account's CLI key on this computer is revoked." : "Logged out. The CLI key is revoked.");
 }
 
 // ../../packages/tonbo-cli-core/dist/src/origin.js
@@ -2488,7 +2732,7 @@ function portText(port) {
 function machinePortsText(machine) {
   return machine.ports.length ? machine.ports.map(portText).join(", ") : "none";
 }
-var { earlyReclaimSeconds, pollAfterSeconds, wakeHoldSeconds } = machineTimings;
+var { earlyReclaimSeconds, pollAfterSeconds, sleepPollAfterSeconds, wakeHoldSeconds } = machineTimings;
 function machineState(machine) {
   if (machine.failure)
     return `${machine.state}: ${machine.failure.code}: ${machine.failure.message}`;
@@ -2516,17 +2760,36 @@ function sleepText(machine) {
 function activationFields(machine) {
   const { activation } = machine;
   if (!activation) return [];
-  return [
+  const fields2 = [
     [
       "Activation",
       `${activation.state} since ${activation.started_at} (wake ${activation.wake_gen}, from ${activation.source})`
     ]
   ];
-}
-function conditionText(condition) {
+  if (typeof activation.revision === "number" && activation.revision !== machine.revision)
+    fields2.push([
+      "Pending",
+      `Spec ${machine.revision}, admitted at ${activation.revision}: ports and sleep-after already apply; if the image, command, shape or env changed, run \`tonbo machine sleep ${machine.name}\` to apply it`
+    ]);
+  return fields2;
+}
+var MACHINE_WAKE_BLOCKED_HINTS = {
+  payment_required: "The account's credit does not cover a wake: add credit, and the next request wakes it.",
+  standing: "The account's Streams standing is not solvent: settle the account, and the next request wakes it.",
+  meter_lag: "Tonbo could not confirm the account's usage in time; the next request tries again.",
+  crash_backoff: "Its recent wakes failed; see `tonbo machine activations <name>`.",
+  capacity: "No host had room for its shape; the next request tries again.",
+  region_closed: "Machines are closed in its region for now; the next request after they reopen wakes it."
+};
+function conditionText(name, condition) {
   switch (condition.type) {
-    case "wake_blocked":
-      return `wake blocked (${condition.reason.replaceAll("_", " ")}) since ${condition.since}`;
+    case "wake_blocked": {
+      const retry = condition.retry_at ? `, retry after ${condition.retry_at}` : "";
+      const hint = MACHINE_WAKE_BLOCKED_HINTS[condition.reason]?.replaceAll("<name>", name);
+      return `wake blocked (${condition.reason.replaceAll("_", " ")}) since ${condition.since}${retry}.${hint ? ` ${hint}` : ""}`;
+    }
+    case "creation_delayed":
+      return `still creating since ${condition.since}, longer than usual; Tonbo's operators are alerted, and creation goes on until it is active or failed.`;
     case "node_unreachable":
       return `its host is unreachable since ${condition.since}`;
     case "egress_blocked":
@@ -2538,9 +2801,13 @@ function conditionText(condition) {
 function conditionFields(machine) {
   return (machine.status.conditions ?? []).map((condition) => [
     "Condition",
-    conditionText(condition)
+    conditionText(machine.name, condition)
   ]);
 }
+function endText(end) {
+  const status = end.exit_code !== null ? `, exit code ${end.exit_code}` : end.signal !== null ? `, signal ${end.signal}` : "";
+  return `${end.state} (${end.reason.replaceAll("_", " ")}${status}) at ${end.at}`;
+}
 var DURABILITY_LINK = "https://tonbo.dev/docs/machines/guarantees#sleep";
 var PRIVATE_PORTS_LINK = "https://tonbo.dev/docs/machines/requests#private-ports";
 function privatePortLines(machine) {
@@ -2574,7 +2841,7 @@ function imageFailureFields(machine) {
     ...next ? [["Next step", next]] : []
   ];
 }
-function machineFields(machine, etag = null) {
+function machineFields(machine, etag = null, lastEnd = null) {
   return fields([
     ["Name", machine.name],
     ["ID", machine.id],
@@ -2582,6 +2849,7 @@ function machineFields(machine, etag = null) {
     ["State", machineState(machine)],
     ["Power", powerText(machine)],
     ...activationFields(machine),
+    ...lastEnd ? [["Last end", endText(lastEnd)]] : [],
     ...conditionFields(machine),
     ["Sleeps", sleepText(machine)],
     ["Shape", machine.shape],
@@ -2600,12 +2868,13 @@ function machineFields(machine, etag = null) {
     ["Durability", DURABILITY_LINK],
     ["Revision", String(machine.revision)],
     ...etag ? [["ETag", etag]] : [],
+    ...machine.created_by ? [["Created by", machine.created_by]] : [],
     ["Created", machine.created_at],
     ["Updated", machine.updated_at]
   ]);
 }
-function machineText(machine, etag = null) {
-  return [machineFields(machine, etag), ...privatePortLines(machine)].join("\n");
+function machineText(machine, etag = null, lastEnd = null) {
+  return [machineFields(machine, etag, lastEnd), ...privatePortLines(machine)].join("\n");
 }
 function keyStateText(machine) {
   const state = machine.byoc.key_state;
@@ -2630,8 +2899,8 @@ function deviceFields(machine) {
     ["Updated", machine.updated_at]
   ]);
 }
-function anyMachineText(machine, etag = null) {
-  return machine.kind === "byoc" ? deviceFields(machine) : machineText(machine, etag);
+function anyMachineText(machine, etag = null, lastEnd = null) {
+  return machine.kind === "byoc" ? deviceFields(machine) : machineText(machine, etag, lastEnd);
 }
 function parsePorts(specs) {
   const accesses = machinePortAccess;
@@ -2681,7 +2950,7 @@ function waitTimeout(options) {
   return options.timeout ?? DEFAULT_WAIT_SECONDS;
 }
 var DEFAULT_WAIT_SECONDS = 300;
-async function waitForMachine(deps, key, name, firstWait, timeout, settled) {
+async function waitForMachine(deps, key, name, firstWait, every, timeout, settled) {
   const now = deps.now ?? Date.now;
   const pause = deps.pause ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
   const start = now();
@@ -2697,7 +2966,7 @@ async function waitForMachine(deps, key, name, firstWait, timeout, settled) {
     if (settled(machine))
       return { machine, last: machine, waited: Math.round((now() - start) / 1e3) };
     last = machine;
-    wait = pollAfterSeconds;
+    wait = every;
   }
 }
 async function machineListCommand(deps, options = {}) {
@@ -2713,7 +2982,7 @@ async function machineListCommand(deps, options = {}) {
       if (managed.length)
         tables.push(
           table(
-            ["NAME", "REGION", "STATE", "POWER", "SHAPE", "IMAGE", "HTTPS"],
+            ["NAME", "REGION", "STATE", "POWER", "SHAPE", "IMAGE", "HTTPS", "CONDITIONS"],
             managed.map((machine) => [
               machine.name,
               machine.region,
@@ -2721,7 +2990,8 @@ async function machineListCommand(deps, options = {}) {
               machine.status.power,
               machine.shape,
               machine.image.reference,
-              machine.hostnames.https
+              machine.hostnames.https,
+              conditionsCell(machine)
             ])
           )
         );
@@ -2747,6 +3017,13 @@ async function machineListCommand(deps, options = {}) {
       );
   });
 }
+function conditionsCell(machine) {
+  const conditions = machine.status.conditions ?? [];
+  if (!conditions.length) return "-";
+  return conditions.map(
+    (condition) => condition.type === "wake_blocked" ? `wake_blocked:${condition.reason}` : condition.type
+  ).join(",");
+}
 function createdText(machine) {
   if (machine.state === "creating")
     return `Machine ${machine.name} is being created; \`tonbo machine show ${machine.name}\` reports it active when it is ready, or create with --wait.`;
@@ -2783,6 +3060,7 @@ async function waitForCreate(deps, key, machine, name, firstWait, timeout, json)
     key,
     name,
     firstWait,
+    pollAfterSeconds,
     timeout,
     (read) => read.state !== "creating"
   );
@@ -2870,8 +3148,46 @@ async function machineCreateCommand(deps, name, command, options = {}) {
 }
 async function machineShowCommand(deps, name, options = {}) {
   await machineCommand(async () => {
-    const { machine, etag } = await deps.api.getMachineWithEtag(await deps.auth.apiKey(), name);
-    print(deps, options.json, machine, anyMachineText(machine, etag));
+    const key = await deps.auth.apiKey();
+    const { machine, etag } = await deps.api.getMachineWithEtag(key, name);
+    const lastEnd = options.json || machine.kind === "byoc" || machine.state !== "active" ? null : await lastActivationEnd(deps, key, machine.name);
+    print(deps, options.json, machine, anyMachineText(machine, etag, lastEnd));
+  });
+}
+async function lastActivationEnd(deps, key, name) {
+  try {
+    const page = await deps.api.listMachineActivations(key, name, { limit: 2 });
+    return page.data.find((entry) => entry.end !== null)?.end ?? null;
+  } catch (error) {
+    if (!(error instanceof HttpError)) throw error;
+    deps.notice(
+      `Could not read how its last activation ended (${error.status}); \`tonbo machine activations ${name}\` lists them.`
+    );
+    return null;
+  }
+}
+async function machineActivationsCommand(deps, name, options = {}) {
+  await machineCommand(async () => {
+    const page = await deps.api.listMachineActivations(await deps.auth.apiKey(), name, {
+      limit: options.limit,
+      cursor: options.cursor
+    });
+    printPage(
+      deps,
+      options.json,
+      page,
+      (activations) => activations.length ? table(
+        ["WAKE", "SOURCE", "REVISION", "SHAPE", "STARTED", "END"],
+        activations.map((entry) => [
+          String(entry.wake_gen),
+          entry.source,
+          String(entry.revision),
+          entry.shape,
+          entry.started_at,
+          entry.end ? endText(entry.end) : "live"
+        ])
+      ) : `Machine ${name} has not been woken yet.`
+    );
   });
 }
 function appliesText(name, change) {
@@ -2954,7 +3270,11 @@ async function machineSleepCommand(deps, name, options = {}) {
   await machineCommand(async () => {
     const timeout = waitTimeout(options);
     const key = await deps.auth.apiKey();
-    const machine = await deps.api.sleepMachine(key, name, ifMatchHeader(options.ifMatch));
+    const { machine, retryAfterSeconds: retryAfterSeconds2 } = await deps.api.sleepMachine(
+      key,
+      name,
+      ifMatchHeader(options.ifMatch)
+    );
     const going = options.wait && machine.state === "active" && machine.status.power !== "asleep";
     if (!going) {
       print(deps, options.json, machine, sleptText(machine));
@@ -2964,7 +3284,8 @@ async function machineSleepCommand(deps, name, options = {}) {
       deps,
       key,
       name,
-      pollAfterSeconds,
+      retryAfterSeconds2 ?? sleepPollAfterSeconds,
+      sleepPollAfterSeconds,
       timeout,
       (read) => read.status.power === "asleep" || read.state !== "active"
     );
@@ -3160,7 +3481,9 @@ function parseUsageSort(value) {
 }
 function createProgram(dependencies = createDependencies) {
   const program = new Command().name("tonbo").description("Sign in to Tonbo and manage account resources.").version(packageVersion.version);
-  program.command("login").description("sign in through the browser and save a personal key for this computer").option("--account <name>", "the account to log in to; defaults to your personal account").action(async (options) => loginCommand(dependencies(), options));
+  program.command("login").description("sign in through the browser and save a personal key for this computer").option("--account <name>", "the account to log in to; defaults to your personal account").action(async (options) => {
+    await loginCommand(dependencies(), options);
+  });
   program.command("logout").description("revoke this computer's key and remove the saved login").action(async () => logoutCommand(dependencies()));
   const account = program.command("account").description("the account you are logged in to");
   operationOptions(
@@ -3465,6 +3788,12 @@ function createProgram(dependencies = createDependencies) {
   ).action(
     async (name, options) => machineDeleteCommand(dependencies(), name, options)
   );
+  operationOptions(
+    machine.command("activations <name>").description("list a Machine's activations, newest first, and how each ended"),
+    "listMachineActivations"
+  ).action(
+    async (name, options) => machineActivationsCommand(dependencies(), name, options)
+  );
   operationOptions(
     machine.command("shapes").description("list the shapes a Machine may have"),
     "listMachineShapes"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tonbo/cli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "The Tonbo CLI: sign in and manage account resources from the command line.",
   "homepage": "https://tonbo.dev",
   "bugs": {