@alilis/k-hat 0.1.0

package/dist/server.js

@@ -0,0 +1,228 @@
+import { createServer } from 'node:http';
+import { watch } from 'node:fs';
+import { readJsonFile, saveJsonAtomic, validateConfig, defaultTimeouts } from './config.js';
+import { LogWriter } from './logger.js';
+import { join, basename } from 'node:path';
+import { resolveProvider } from './router.js';
+import { WeightedSelector } from './selector.js';
+import { handleAdmin } from './admin.js';
+import { ACCESS_TOKEN_REF } from './vault.js';
+const RETRYABLE = new Set([401, 402, 429]);
+const HOP_BY_HOP = new Set(['content-length', 'transfer-encoding', 'connection']);
+const ANTHROPIC_VERSION = '2023-06-01';
+/** Entry paths accepted by the proxy, mapped to the protocol family they speak. */
+const ENDPOINTS = {
+    '/v1/chat/completions': 'openai',
+    '/v1/responses': 'openai',
+    '/v1/messages': 'anthropic'
+};
+/** Rewrite the client-facing auth into the upstream auth convention for the target protocol. */
+function upstreamHeaders(protocol, secret, accept) {
+    if (protocol === 'anthropic')
+        return { 'content-type': 'application/json', accept: accept ?? '*/*', 'x-api-key': secret, 'anthropic-version': ANTHROPIC_VERSION };
+    return { 'content-type': 'application/json', accept: accept ?? '*/*', authorization: `Bearer ${secret}` };
+}
+async function readBody(req, limit) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        const part = Buffer.from(chunk);
+        size += part.length;
+        if (size > limit)
+            throw Object.assign(new Error('Request body too large'), { statusCode: 413 });
+        chunks.push(part);
+    }
+    return Buffer.concat(chunks);
+}
+function scanUsage(protocol, text) {
+    let tokensIn = 0;
+    let tokensOut = 0;
+    for (const line of text.split('\n')) {
+        if (!line.startsWith('data: '))
+            continue;
+        try {
+            const usage = JSON.parse(line.slice(6)).usage;
+            if (!usage || typeof usage !== 'object')
+                continue;
+            if (protocol === 'openai') {
+                tokensIn += Number(usage.prompt_tokens ?? usage.input_tokens ?? 0) || 0;
+                tokensOut += Number(usage.completion_tokens ?? usage.output_tokens ?? 0) || 0;
+            }
+            else {
+                tokensIn += Number(usage.input_tokens ?? 0) || 0;
+                tokensOut += Number(usage.output_tokens ?? 0) || 0;
+            }
+        }
+        catch { }
+    }
+    return { tokensIn, tokensOut };
+}
+function json(res, status, value) { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(value)); }
+/** Abort reason carrier so timeouts map to 504 instead of a generic 502. */
+function upstreamAbort(abort, message) {
+    const reason = new Error(message);
+    reason.upstreamTimeout = true;
+    abort.abort(reason);
+}
+export function createKhatServer(options) {
+    const states = options.states ?? {};
+    const secrets = { ...(options.secrets ?? {}) };
+    const currentSecret = (ref) => options.store?.vault.get(ref) ?? secrets[ref];
+    const selector = new WeightedSelector();
+    const statePath = options.statePath;
+    const logger = options.store ? new LogWriter(join(options.store.dir, 'logs')) : undefined;
+    const timeouts = () => ({ ...defaultTimeouts, ...options.config.timeouts });
+    const markUnavailable = async (providerId, keyId, status) => {
+        states[`${providerId}/${keyId}`] = { status: 'unavailable', lastError: { http: status, at: new Date().toISOString() } };
+        if (statePath)
+            await saveJsonAtomic(statePath, { keys: states, counters: options.store?.counters ?? {} });
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            if (req.url?.startsWith('/_keys')) {
+                if (!options.store)
+                    return json(res, 503, { error: { message: 'Admin API is not available (no store attached)' } });
+                await handleAdmin(req, res, options.store, () => options.store?.vault.get(ACCESS_TOKEN_REF) ?? options.accessToken);
+                return;
+            }
+            const currentAccessToken = options.store?.vault.get(ACCESS_TOKEN_REF) ?? options.accessToken;
+            if (currentAccessToken && req.headers.authorization !== `Bearer ${currentAccessToken}`)
+                return json(res, 401, { error: { message: 'Unauthorized' } });
+            if (req.method !== 'POST' || !(req.url in ENDPOINTS))
+                return json(res, 404, { error: { message: 'Not found' } });
+            const protocol = ENDPOINTS[req.url];
+            const body = await readBody(req, options.config.requestBodyLimitMB * 1024 * 1024);
+            let parsed;
+            try {
+                parsed = JSON.parse(body.toString('utf8'));
+            }
+            catch {
+                return json(res, 400, { error: { message: 'Invalid JSON' } });
+            }
+            if (!parsed.model || typeof parsed.model !== 'string')
+                return json(res, 400, { error: { message: 'model is required' } });
+            const provider = resolveProvider(options.config, parsed.model);
+            if (!provider)
+                return json(res, 404, { error: { message: `No route for model: ${parsed.model}` } });
+            if (provider.protocol !== protocol)
+                return json(res, 400, { error: { message: `Model ${parsed.model} resolves to a ${provider.protocol} provider, but ${req.url} speaks ${protocol}` } });
+            const tried = new Set();
+            while (true) {
+                const key = selector.select(provider.id, provider.keys.filter((item) => !tried.has(item.id)), states);
+                if (!key)
+                    return json(res, 503, { error: { message: 'All keys are unavailable', keys: provider.keys.map((item) => ({ id: item.id, ...(states[`${provider.id}/${item.id}`] ?? { status: 'available' }) })) } });
+                tried.add(key.id);
+                const secret = currentSecret(key.vaultRef);
+                if (secret === undefined)
+                    continue;
+                const abort = new AbortController();
+                const clientGone = () => abort.abort(new Error('client disconnected'));
+                res.on('close', clientGone);
+                const headerTimer = setTimeout(() => upstreamAbort(abort, 'upstream response header timeout'), timeouts().headerMs);
+                let upstream;
+                try {
+                    upstream = await fetch(new URL(req.url, provider.baseUrl), { method: 'POST', headers: upstreamHeaders(protocol, secret, req.headers.accept), body: new Uint8Array(body), signal: abort.signal });
+                }
+                catch (error) {
+                    if (error?.upstreamTimeout)
+                        error.statusCode = 504;
+                    throw error;
+                }
+                finally {
+                    clearTimeout(headerTimer);
+                }
+                if (RETRYABLE.has(upstream.status)) {
+                    await markUnavailable(provider.id, key.id, upstream.status);
+                    if (tried.size < provider.keys.length) {
+                        res.off('close', clientGone);
+                        continue;
+                    }
+                }
+                const startedAt = Date.now();
+                let firstByteAt;
+                let bytes = 0;
+                let sseRemainder = '';
+                let tokensIn = 0;
+                let tokensOut = 0;
+                const responseHeaders = {};
+                upstream.headers.forEach((value, name) => { if (!HOP_BY_HOP.has(name))
+                    responseHeaders[name] = value; });
+                res.writeHead(upstream.status, responseHeaders);
+                if (upstream.body) {
+                    const idleTimer = setTimeout(() => upstreamAbort(abort, 'upstream stream idle timeout'), timeouts().streamIdleMs);
+                    try {
+                        for await (const chunk of upstream.body) {
+                            const buffer = Buffer.from(chunk);
+                            if (firstByteAt === undefined)
+                                firstByteAt = Date.now();
+                            bytes += buffer.length;
+                            const combined = sseRemainder + buffer.toString('utf8');
+                            const lastNewline = combined.lastIndexOf('\n');
+                            if (lastNewline >= 0) {
+                                const usage = scanUsage(protocol, combined.slice(0, lastNewline + 1));
+                                tokensIn += usage.tokensIn;
+                                tokensOut += usage.tokensOut;
+                                sseRemainder = combined.slice(lastNewline + 1);
+                            }
+                            else
+                                sseRemainder = combined;
+                            res.write(buffer);
+                            idleTimer.refresh();
+                        }
+                        const usage = scanUsage(protocol, sseRemainder);
+                        tokensIn += usage.tokensIn;
+                        tokensOut += usage.tokensOut;
+                    }
+                    catch (error) {
+                        if (error?.upstreamTimeout)
+                            res.destroy(error);
+                        throw error;
+                    }
+                    finally {
+                        clearTimeout(idleTimer);
+                    }
+                }
+                res.end();
+                res.off('close', clientGone);
+                const durationMs = Date.now() - startedAt;
+                const ttfbMs = (firstByteAt ?? Date.now()) - startedAt;
+                const keyRef = `${provider.id}/${key.id}`;
+                options.store?.recordCounter(keyRef, { requests: 1, failed: upstream.ok ? 0 : 1, bytesOut: bytes, tokensIn, tokensOut });
+                void logger?.append({ ts: new Date().toISOString(), event: 'forward', model: parsed.model, provider: provider.id, key: keyRef, status: upstream.status, ttfbMs, durationMs, bytes, tokensIn, tokensOut });
+                return;
+            }
+        }
+        catch (error) {
+            if (!res.headersSent)
+                json(res, error.statusCode ?? 502, { error: { message: error.message ?? 'Proxy error' } });
+            else
+                res.destroy(error);
+        }
+    });
+    const configWatcher = options.store ? watch(options.store.dir, (_event, filename) => {
+        if (filename?.toString() !== basename(options.store.configPath))
+            return;
+        void (async () => {
+            try {
+                const next = await readJsonFile(options.store.configPath);
+                if (next === undefined)
+                    return;
+                const validated = validateConfig(next);
+                Object.assign(options.config, validated);
+                for (const key of Object.keys(secrets))
+                    delete secrets[key];
+                for (const provider of validated.providers)
+                    for (const key of provider.keys) {
+                        const secret = options.store?.vault.get(key.vaultRef);
+                        if (secret !== undefined)
+                            secrets[key.vaultRef] = secret;
+                    }
+            }
+            catch (error) {
+                console.error(`[khat] ignored invalid external config update: ${error?.message ?? error}`);
+            }
+        })();
+    }) : undefined;
+    server.once('close', () => configWatcher?.close());
+    return server;
+}

package/dist/store.js

@@ -0,0 +1,240 @@
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { readJsonFile, saveJsonAtomic, loadState, validateConfig, defaultConfig } from './config.js';
+import { Vault } from './vault.js';
+/** Ids appear in `provider/model` routing syntax and in vault refs, so they cannot contain `/`. */
+const ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+export function maskSecret(value) {
+    // Short values would be almost fully revealed by a 4-char tail, so mask them entirely.
+    return value.length <= 8 ? '****' : `****${value.slice(-4)}`;
+}
+function requireValidId(kind, id) {
+    if (!ID_PATTERN.test(id))
+        throw new Error(`${kind} id '${id}' is invalid: use letters, digits, '-' or '_'`);
+}
+export async function openStore(dir, protector) {
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    const configPath = join(dir, 'config.json');
+    const statePath = join(dir, 'state.json');
+    const vaultPath = join(dir, 'vault.json');
+    const vault = await Vault.openOrCreate(vaultPath, protector);
+    const raw = await readJsonFile(configPath);
+    const config = raw === undefined ? structuredClone(defaultConfig) : raw;
+    // Runs before validation: M1-era configs carry inline `value` fields and no vaultRef.
+    const migrated = raw !== undefined && migrateLegacyKeyValues(raw, vault);
+    validateConfig(config);
+    const persistedState = await loadState(statePath);
+    let stateTimer;
+    let mutationTail = Promise.resolve();
+    const store = {
+        dir, configPath, statePath, vaultPath, config, states: persistedState.keys, counters: persistedState.counters, vault,
+        mutate: async (operation) => {
+            const previous = mutationTail;
+            let release;
+            mutationTail = new Promise((resolve) => { release = resolve; });
+            await previous;
+            try {
+                return await operation();
+            }
+            finally {
+                release();
+            }
+        },
+        saveConfig: () => saveJsonAtomic(configPath, config),
+        saveState: () => saveJsonAtomic(statePath, { keys: store.states, counters: store.counters }),
+        recordCounter: (keyRef, delta) => {
+            const current = store.counters[keyRef] ?? { requests: 0, failed: 0, bytesOut: 0, tokensIn: 0, tokensOut: 0 };
+            store.counters[keyRef] = {
+                requests: current.requests + (delta.requests ?? 0),
+                failed: current.failed + (delta.failed ?? 0),
+                bytesOut: current.bytesOut + (delta.bytesOut ?? 0),
+                tokensIn: current.tokensIn + (delta.tokensIn ?? 0),
+                tokensOut: current.tokensOut + (delta.tokensOut ?? 0)
+            };
+            if (!stateTimer)
+                stateTimer = setTimeout(() => {
+                    stateTimer = undefined;
+                    void store.saveState();
+                }, 1_000);
+            stateTimer.unref();
+        }
+    };
+    if (migrated) {
+        // Vault first: a crash between the two writes leaves plaintext in config,
+        // which simply re-migrates on the next run; the reverse could lose secrets.
+        await vault.save();
+        await store.saveConfig();
+    }
+    return store;
+}
+/** Move remaining M1-era inline key values into the vault, leaving only vaultRefs in config. */
+function migrateLegacyKeyValues(raw, vault) {
+    let changed = false;
+    for (const provider of raw?.providers ?? []) {
+        if (!provider?.id || !Array.isArray(provider.keys))
+            continue;
+        for (const key of provider.keys) {
+            if (typeof key.value !== 'string' || !key.value)
+                continue;
+            if (key.vaultRef === undefined)
+                key.vaultRef = `${provider.id}/${key.id}`;
+            if (vault.get(key.vaultRef) === undefined)
+                vault.set(key.vaultRef, key.value);
+            delete key.value;
+            changed = true;
+        }
+    }
+    return changed;
+}
+function findProvider(store, id) {
+    const provider = store.config.providers.find((item) => item.id === id);
+    if (!provider)
+        throw new Error(`unknown provider: ${id}`);
+    return provider;
+}
+async function persistConfig(store) {
+    validateConfig(store.config);
+    await store.saveConfig();
+}
+export async function addProvider(store, input) {
+    requireValidId('provider', input.id);
+    if (store.config.providers.some((item) => item.id === input.id))
+        throw new Error(`provider already exists: ${input.id}`);
+    store.config.providers.push({ id: input.id, name: input.name?.trim() || input.id, protocol: input.protocol, baseUrl: input.baseUrl, keys: [] });
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        store.config.providers.pop();
+        throw error;
+    }
+}
+export async function updateProvider(store, id, input) {
+    const provider = findProvider(store, id);
+    const previous = { name: provider.name, protocol: provider.protocol, baseUrl: provider.baseUrl };
+    if (input.name !== undefined)
+        provider.name = input.name.trim() || provider.id;
+    if (input.protocol !== undefined)
+        provider.protocol = input.protocol;
+    if (input.baseUrl !== undefined)
+        provider.baseUrl = input.baseUrl.replace(/\/+$/, '');
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        Object.assign(provider, previous);
+        throw error;
+    }
+}
+export async function removeProvider(store, id) {
+    const provider = findProvider(store, id);
+    store.config.providers = store.config.providers.filter((item) => item.id !== id);
+    store.config.routes = store.config.routes.filter((route) => route.provider !== id);
+    for (const key of provider.keys) {
+        store.vault.delete(key.vaultRef);
+        delete store.states[`${id}/${key.id}`];
+    }
+    await persistConfig(store);
+    await store.vault.save();
+    await store.saveState();
+}
+export async function addKey(store, providerId, keyId, value, weight = 1) {
+    const provider = findProvider(store, providerId);
+    requireValidId('key', keyId);
+    if (provider.keys.some((item) => item.id === keyId))
+        throw new Error(`key already exists: ${providerId}/${keyId}`);
+    const ref = `${providerId}/${keyId}`;
+    if (store.vault.get(ref) !== undefined)
+        throw new Error(`vault already holds a secret for ${ref}; remove the old key or pick another id`);
+    store.vault.set(ref, value);
+    provider.keys.push({ id: keyId, weight, vaultRef: ref });
+    try {
+        await persistConfig(store);
+        await store.vault.save();
+    }
+    catch (error) {
+        store.vault.delete(ref);
+        provider.keys.pop();
+        throw error;
+    }
+}
+export async function updateKey(store, providerId, keyId, input) {
+    const provider = findProvider(store, providerId);
+    const key = provider.keys.find((item) => item.id === keyId);
+    if (!key)
+        throw new Error(`unknown key: ${providerId}/${keyId}`);
+    const previousWeight = key.weight;
+    const previousValue = store.vault.get(key.vaultRef);
+    if (input.weight !== undefined)
+        key.weight = input.weight;
+    if (input.value !== undefined)
+        store.vault.set(key.vaultRef, input.value);
+    try {
+        await persistConfig(store);
+        if (input.value !== undefined)
+            await store.vault.save();
+    }
+    catch (error) {
+        key.weight = previousWeight;
+        if (previousValue === undefined)
+            store.vault.delete(key.vaultRef);
+        else
+            store.vault.set(key.vaultRef, previousValue);
+        throw error;
+    }
+}
+export async function removeKey(store, providerId, keyId) {
+    const provider = findProvider(store, providerId);
+    const key = provider.keys.find((item) => item.id === keyId);
+    if (!key)
+        throw new Error(`unknown key: ${providerId}/${keyId}`);
+    provider.keys = provider.keys.filter((item) => item.id !== keyId);
+    store.vault.delete(key.vaultRef);
+    delete store.states[`${providerId}/${keyId}`];
+    await persistConfig(store);
+    await store.vault.save();
+    await store.saveState();
+}
+export async function enableKey(store, providerId, keyId) {
+    const provider = findProvider(store, providerId);
+    if (!provider.keys.some((item) => item.id === keyId))
+        throw new Error(`unknown key: ${providerId}/${keyId}`);
+    delete store.states[`${providerId}/${keyId}`];
+    await store.saveState();
+}
+export async function addRoute(store, model, providerId) {
+    findProvider(store, providerId);
+    const existing = store.config.routes.find((route) => route.model === model);
+    if (existing)
+        throw new Error(`route already exists: ${model} -> ${existing.provider}`);
+    store.config.routes.push({ model, provider: providerId });
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        store.config.routes.pop();
+        throw error;
+    }
+}
+export async function updateRoute(store, model, providerId) {
+    findProvider(store, providerId);
+    const route = store.config.routes.find((item) => item.model === model);
+    if (!route)
+        throw new Error(`unknown route: ${model}`);
+    const previous = route.provider;
+    route.provider = providerId;
+    try {
+        await persistConfig(store);
+    }
+    catch (error) {
+        route.provider = previous;
+        throw error;
+    }
+}
+export async function removeRoute(store, model) {
+    const before = store.config.routes.length;
+    store.config.routes = store.config.routes.filter((route) => route.model !== model);
+    if (store.config.routes.length === before)
+        throw new Error(`unknown route: ${model}`);
+    await persistConfig(store);
+}

package/dist/supervisor.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { readFile, unlink, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+const dataDir = process.env.KHAT_HOME ?? join(homedir(), '.khat');
+const pidPath = join(dataDir, 'daemon.pid');
+const signalPath = join(dataDir, 'daemon.signal');
+const cliPath = fileURLToPath(new URL('./cli.js', import.meta.url));
+const maxCrashes = 5;
+const maxBackoffMs = 60_000;
+function log(message) {
+    console.error(`[khat-supervisor] ${message}`);
+}
+async function removeIfPresent(path) {
+    try {
+        await unlink(path);
+    }
+    catch { }
+}
+async function main() {
+    await removeIfPresent(signalPath);
+    await writeFile(pidPath, `${process.pid}\n`, { mode: 0o600 });
+    let child;
+    let stopping = false;
+    let crashes = 0;
+    let restartTimer;
+    const cleanup = async (code) => {
+        if (restartTimer)
+            clearTimeout(restartTimer);
+        await removeIfPresent(signalPath);
+        await removeIfPresent(pidPath);
+        process.exit(code);
+    };
+    const stop = () => {
+        if (stopping)
+            return;
+        stopping = true;
+        if (restartTimer)
+            clearTimeout(restartTimer);
+        if (child && child.exitCode === null && !child.killed)
+            child.kill('SIGTERM');
+        else
+            void cleanup(0);
+    };
+    const launch = () => {
+        if (stopping)
+            return;
+        child = spawn(process.execPath, [cliPath, 'start', '--foreground'], {
+            cwd: process.cwd(),
+            env: process.env,
+            stdio: 'ignore',
+            windowsHide: true
+        });
+        child.unref();
+        child.once('error', (error) => {
+            log(`could not start daemon: ${error.message}`);
+            void cleanup(1);
+        });
+        child.once('exit', (code, signal) => {
+            child = undefined;
+            if (stopping) {
+                void cleanup(0);
+                return;
+            }
+            if (code === 0) {
+                void cleanup(0);
+                return;
+            }
+            crashes += 1;
+            if (crashes >= maxCrashes) {
+                log(`daemon crashed ${maxCrashes} times consecutively; run "khat doctor" for diagnostics`);
+                void cleanup(1);
+                return;
+            }
+            const delay = Math.min(1_000 * 2 ** (crashes - 1), maxBackoffMs);
+            log(`daemon exited (${signal ?? code ?? 'unknown'}); restarting in ${delay}ms`);
+            restartTimer = setTimeout(launch, delay);
+        });
+    };
+    const poll = setInterval(async () => {
+        if (stopping)
+            return;
+        try {
+            if ((await readFile(signalPath, 'utf8')).trim() === 'stop')
+                stop();
+        }
+        catch { }
+    }, 250);
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+    launch();
+}
+main().catch((error) => {
+    console.error(`[khat-supervisor] ${error.message}`);
+    process.exit(1);
+});

package/dist/tui-client.js

@@ -0,0 +1,87 @@
+export class TuiApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'TuiApiError';
+    }
+}
+export class AdminClient {
+    baseUrl;
+    token;
+    constructor(baseUrl, token) {
+        this.baseUrl = baseUrl;
+        this.token = token;
+    }
+    async health() {
+        return this.request('/_keys/health');
+    }
+    async status() {
+        return this.request('/_keys/status');
+    }
+    async logs(tail = 50, filters = {}) {
+        const params = new URLSearchParams({ tail: String(tail) });
+        if (filters.model)
+            params.set('model', filters.model);
+        if (filters.key)
+            params.set('key', filters.key);
+        if (filters.status)
+            params.set('status', filters.status);
+        const result = await this.request(`/_keys/logs?${params}`);
+        return result.logs;
+    }
+    async rotateToken() {
+        return this.request('/_keys/token/rotate', { method: 'POST' });
+    }
+    async createProvider(input) {
+        await this.request('/_keys/providers', { method: 'POST', body: input });
+    }
+    async updateProvider(id, input) {
+        await this.request(`/_keys/providers/${encodeURIComponent(id)}`, { method: 'PUT', body: input });
+    }
+    async deleteProvider(id) {
+        await this.request(`/_keys/providers/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    }
+    async createKey(providerId, input) {
+        await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys`, { method: 'POST', body: input });
+    }
+    async updateKey(providerId, keyId, input) {
+        await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}`, { method: 'PUT', body: input });
+    }
+    async deleteKey(providerId, keyId) {
+        await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE' });
+    }
+    async enableKey(providerId, keyId) {
+        await this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/enable`, { method: 'POST' });
+    }
+    async probeKey(providerId, keyId) {
+        return this.request(`/_keys/providers/${encodeURIComponent(providerId)}/keys/${encodeURIComponent(keyId)}/probe`, { method: 'POST' });
+    }
+    async createRoute(model, provider) {
+        await this.request('/_keys/routes', { method: 'POST', body: { model, provider } });
+    }
+    async updateRoute(model, provider) {
+        await this.request(`/_keys/routes/${encodeURIComponent(model)}`, { method: 'PUT', body: { provider } });
+    }
+    async deleteRoute(model) {
+        await this.request(`/_keys/routes?model=${encodeURIComponent(model)}`, { method: 'DELETE' });
+    }
+    async request(path, init = {}) {
+        let response;
+        try {
+            response = await fetch(`${this.baseUrl}${path}`, {
+                method: init.method ?? 'GET',
+                headers: { authorization: `Bearer ${this.token}`, accept: 'application/json', ...(init.body === undefined ? {} : { 'content-type': 'application/json' }) },
+                ...(init.body === undefined ? {} : { body: JSON.stringify(init.body) }),
+                signal: AbortSignal.timeout(5_000)
+            });
+        }
+        catch (error) {
+            throw new Error(`unable to reach khat daemon: ${error?.message ?? error}`);
+        }
+        const body = await response.json().catch(() => ({}));
+        if (!response.ok)
+            throw new TuiApiError(response.status, body?.error?.message ?? `Admin API returned ${response.status}`);
+        return body;
+    }
+}

package/dist/tui-main.js

@@ -0,0 +1,8 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { render } from 'ink';
+import { AdminClient } from './tui-client.js';
+import { Tui } from './tui.js';
+export async function runTui(baseUrl, token) {
+    const instance = render(_jsx(Tui, { client: new AdminClient(baseUrl, token) }));
+    await instance.waitUntilExit();
+}

package/dist/tui-types.js

@@ -0,0 +1 @@
+export {};