@arker-ai/sdk 0.6.2 → 0.7.0

package/dist/{chunk-7BHPVQNG.js → chunk-4NHUAVXK.js}

@@ -56,6 +56,7 @@ var Arker = class {
   provider;
   apiKey;
   fetchImpl;
+  http2;
   retry;
   constructor(opts = {}) {
     const apiKey = opts.apiKey ?? env("ARKER_API_KEY") ?? env("AUTH_KEY");
@@ -77,6 +78,7 @@ var Arker = class {
     this.region = region ? normalizeRegion(region) : void 0;
     this.provider = effectiveProvider;
     this.fetchImpl = opts.fetch ?? globalThis.fetch;
+    this.http2 = opts.fetch === void 0;
     this.retry = normalizeRetry(opts.retry);
     if (!this.fetchImpl) throw new Error("fetch is required in this runtime");
   }
@@ -137,7 +139,10 @@ var Arker = class {
       egress: src.egress ?? null,
       disk: src.disk ?? true,
       durable: src.durable ?? null,
-      resources
+      resources,
+      // ARK-125: omit to inherit the source's policy; pass a doc to override
+      // (an empty `{ policies: [] }` clears to allow-all, NOT inherit).
+      policies: src.policies ?? null
     };
     const useBurst = sourceOrgId === ARKER_ORG_ID && src.sourceVmName !== void 0 && isBurstRef(src.sourceVmName);
     const baseUrl = useBurst && this.burstBaseUrl ? this.burstBaseUrl : this.baseUrl;
@@ -232,30 +237,29 @@ var Arker = class {
         if (value !== void 0) headers[key] = value;
       }
     }
-    const init = { method, headers };
+    let requestBody;
     if (body !== void 0) {
       headers["content-type"] = "application/json";
-      init.body = JSON.stringify(withoutUndefined(body));
+      requestBody = JSON.stringify(withoutUndefined(body));
     }
     let lastStatus = 0;
     let lastText = "";
     let lastError;
     for (let attempt = 0; attempt < this.retry.attempts; attempt++) {
       try {
-        const response = await this.fetchImpl(url, init);
-        const text = await response.text();
+        const { status, ok, text } = await sendRequest(url, { method, headers, body: requestBody }, this.fetchImpl, this.http2);
         const payload = parseJson(text);
         const parsedError = extractError(payload);
-        lastStatus = response.status;
+        lastStatus = status;
         lastText = text;
         lastError = parsedError;
-        if (isRetryable(response.status, parsedError) && attempt < this.retry.attempts - 1) {
+        if (isRetryable(status, parsedError) && attempt < this.retry.attempts - 1) {
           await sleep(retryDelay(this.retry, attempt));
           continue;
         }
-        if (parsedError) throw new ArkerError(parsedError.code, parsedError.message, response.status);
-        if (!response.ok) {
-          throw new ArkerError("internal", lastText.slice(0, 300) || `HTTP ${response.status}`, response.status);
+        if (parsedError) throw new ArkerError(parsedError.code, parsedError.message, status);
+        if (!ok) {
+          throw new ArkerError("internal", lastText.slice(0, 300) || `HTTP ${status}`, status);
         }
         return payload;
       } catch (error) {
@@ -467,6 +471,32 @@ var VM = class _VM {
   async delete() {
     return this._client._request("DELETE", vmPath(this.id), void 0, this.baseUrl);
   }
+  // ── ARK-125 egress policy ────────────────────────────────────────
+  /**
+   * Read this VM's outbound egress policy document (ARK-125). Returns an
+   * empty doc (`{}`) when no policy is set.
+   */
+  async getPolicies() {
+    return this._client._request("GET", `${vmPath(this.id)}/policies`, void 0, this.baseUrl);
+  }
+  /**
+   * Replace this VM's outbound egress policy with `doc` — an ordered,
+   * first-match-wins rule list. An empty doc (`{}` or `{ policies: [] }`)
+   * clears the policy to allow-all. Returns the stored policy plus the
+   * domains it escalates to MITM and any degrade warnings.
+   *
+   *     await vm.setPolicies({
+   *       policies: [
+   *         { type: "network.outbound",
+   *           match: { domains: ["github.com"], ports: [443] },
+   *           action: "allow" },
+   *         { type: "network.outbound", action: "deny" },
+   *       ],
+   *     });
+   */
+  async setPolicies(doc) {
+    return this._client._request("PUT", `${vmPath(this.id)}/policies`, doc, this.baseUrl);
+  }
   // ── Syncs: bindings of a filesystem into this VM at a path ────────
   async listSyncs(opts = {}) {
     return this._client._request("GET", buildQuery(`${vmPath(this.id)}/syncs`, {
@@ -518,6 +548,20 @@ var VM = class _VM {
   async deleteSession(sessionId) {
     return this._client._request("DELETE", `${vmPath(this.id)}/sessions/${pathSegment(sessionId)}`, void 0, this.baseUrl);
   }
+  /**
+   * Update a session via `PATCH /v1/vms/{id}/sessions/{sid}`: resize its PTY
+   * (`cols`/`rows`) and/or set the idle `timeoutSecs`. Works whether or not a
+   * PTY is currently attached — the REST equivalent of {@link PtyConnection.resize}
+   * (which sends an in-band control frame on the live WebSocket).
+   */
+  async updateSession(sessionId, update) {
+    return this._client._request(
+      "PATCH",
+      `${vmPath(this.id)}/sessions/${pathSegment(sessionId)}`,
+      { cols: update.cols, rows: update.rows, timeout_secs: update.timeoutSecs },
+      this.baseUrl
+    );
+  }
   async connectPty(options = {}) {
     const sessionId = options.sessionId ?? sessionIdFrom(await this.createSession());
     const useTicket = options.useTicket ?? !isNodeRuntime();
@@ -929,6 +973,84 @@ function base64ToBytes(text) {
 function bufferConstructor() {
   return globalThis.Buffer;
 }
+var http2Module;
+function loadHttp2() {
+  return http2Module ??= (async () => {
+    const proc = globalThis.process;
+    if (!proc?.versions?.node) return null;
+    try {
+      return await import(
+        /* webpackIgnore: true */
+        /* @vite-ignore */
+        "http2"
+      );
+    } catch {
+      return null;
+    }
+  })();
+}
+var HTTP2_REQUEST_TIMEOUT_MS = 12e4;
+var Http2Connection = class {
+  confirmed = false;
+  streams = 0;
+  session;
+  constructor(http2, origin) {
+    this.session = http2.connect(origin);
+    this.session.on("error", () => {
+    });
+  }
+  get closed() {
+    return this.session.closed || this.session.destroyed;
+  }
+  request(method, path, headers, body) {
+    if (this.streams === 0) this.session.ref();
+    this.streams++;
+    return new Promise((resolve, reject) => {
+      const stream = this.session.request({ ...headers, ":method": method, ":path": path });
+      let status = 0;
+      let text = "";
+      stream.setEncoding("utf8");
+      stream.setTimeout(HTTP2_REQUEST_TIMEOUT_MS, () => stream.destroy(new Error("HTTP/2 request timed out")));
+      stream.on("response", (responseHeaders) => {
+        this.confirmed = true;
+        status = Number(responseHeaders[":status"]) || 0;
+      });
+      stream.on("data", (chunk) => {
+        text += chunk;
+      });
+      stream.on("end", () => resolve({ status, ok: status >= 200 && status < 300, text }));
+      stream.on("error", reject);
+      stream.end(body);
+    }).finally(() => {
+      if (--this.streams === 0) this.session.unref();
+    });
+  }
+};
+var http2Connections = /* @__PURE__ */ new Map();
+async function sendRequest(url, init, fetchImpl, http2Enabled) {
+  if (http2Enabled) {
+    const http2 = await loadHttp2();
+    if (http2) {
+      const { origin, pathname, search } = new URL(url);
+      const cached = http2Connections.get(origin);
+      if (cached !== null) {
+        let connection = cached;
+        if (!connection || connection.closed) {
+          connection = new Http2Connection(http2, origin);
+          http2Connections.set(origin, connection);
+        }
+        try {
+          return await connection.request(init.method, `${pathname}${search}`, init.headers, init.body);
+        } catch (error) {
+          if (connection.confirmed) throw error;
+          http2Connections.set(origin, null);
+        }
+      }
+    }
+  }
+  const response = await fetchImpl(url, init);
+  return { status: response.status, ok: response.ok, text: await response.text() };
+}
 
 export {
   CHUNK_SIZE,

package/dist/{chunk-35IEV6BU.js → chunk-YFJEL7PF.js}

@@ -1,7 +1,7 @@
 import {
   Arker,
   ArkerError
-} from "./chunk-7BHPVQNG.js";
+} from "./chunk-4NHUAVXK.js";
 
 // src/compat/common.ts
 function shouldGuardNested(value) {

package/dist/cli.cjs

@@ -26,6 +26,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/cli.ts
 var import_node_fs = require("fs");
 var import_node_child_process = require("child_process");
+var import_node_module = require("module");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var import_node_process = require("process");
@@ -88,6 +89,7 @@ var Arker = class {
   provider;
   apiKey;
   fetchImpl;
+  http2;
   retry;
   constructor(opts = {}) {
     const apiKey = opts.apiKey ?? env("ARKER_API_KEY") ?? env("AUTH_KEY");
@@ -109,6 +111,7 @@ var Arker = class {
     this.region = region ? normalizeRegion(region) : void 0;
     this.provider = effectiveProvider;
     this.fetchImpl = opts.fetch ?? globalThis.fetch;
+    this.http2 = opts.fetch === void 0;
     this.retry = normalizeRetry(opts.retry);
     if (!this.fetchImpl) throw new Error("fetch is required in this runtime");
   }
@@ -169,7 +172,10 @@ var Arker = class {
       egress: src.egress ?? null,
       disk: src.disk ?? true,
       durable: src.durable ?? null,
-      resources
+      resources,
+      // ARK-125: omit to inherit the source's policy; pass a doc to override
+      // (an empty `{ policies: [] }` clears to allow-all, NOT inherit).
+      policies: src.policies ?? null
     };
     const useBurst = sourceOrgId === ARKER_ORG_ID && src.sourceVmName !== void 0 && isBurstRef(src.sourceVmName);
     const baseUrl = useBurst && this.burstBaseUrl ? this.burstBaseUrl : this.baseUrl;
@@ -264,30 +270,29 @@ var Arker = class {
         if (value !== void 0) headers[key] = value;
       }
     }
-    const init = { method, headers };
+    let requestBody;
     if (body !== void 0) {
       headers["content-type"] = "application/json";
-      init.body = JSON.stringify(withoutUndefined(body));
+      requestBody = JSON.stringify(withoutUndefined(body));
     }
     let lastStatus = 0;
     let lastText = "";
     let lastError;
     for (let attempt = 0; attempt < this.retry.attempts; attempt++) {
       try {
-        const response = await this.fetchImpl(url, init);
-        const text = await response.text();
+        const { status, ok, text } = await sendRequest(url, { method, headers, body: requestBody }, this.fetchImpl, this.http2);
         const payload = parseJson(text);
         const parsedError = extractError(payload);
-        lastStatus = response.status;
+        lastStatus = status;
         lastText = text;
         lastError = parsedError;
-        if (isRetryable(response.status, parsedError) && attempt < this.retry.attempts - 1) {
+        if (isRetryable(status, parsedError) && attempt < this.retry.attempts - 1) {
           await sleep(retryDelay(this.retry, attempt));
           continue;
         }
-        if (parsedError) throw new ArkerError(parsedError.code, parsedError.message, response.status);
-        if (!response.ok) {
-          throw new ArkerError("internal", lastText.slice(0, 300) || `HTTP ${response.status}`, response.status);
+        if (parsedError) throw new ArkerError(parsedError.code, parsedError.message, status);
+        if (!ok) {
+          throw new ArkerError("internal", lastText.slice(0, 300) || `HTTP ${status}`, status);
         }
         return payload;
       } catch (error) {
@@ -499,6 +504,32 @@ var VM = class _VM {
   async delete() {
     return this._client._request("DELETE", vmPath(this.id), void 0, this.baseUrl);
   }
+  // ── ARK-125 egress policy ────────────────────────────────────────
+  /**
+   * Read this VM's outbound egress policy document (ARK-125). Returns an
+   * empty doc (`{}`) when no policy is set.
+   */
+  async getPolicies() {
+    return this._client._request("GET", `${vmPath(this.id)}/policies`, void 0, this.baseUrl);
+  }
+  /**
+   * Replace this VM's outbound egress policy with `doc` — an ordered,
+   * first-match-wins rule list. An empty doc (`{}` or `{ policies: [] }`)
+   * clears the policy to allow-all. Returns the stored policy plus the
+   * domains it escalates to MITM and any degrade warnings.
+   *
+   *     await vm.setPolicies({
+   *       policies: [
+   *         { type: "network.outbound",
+   *           match: { domains: ["github.com"], ports: [443] },
+   *           action: "allow" },
+   *         { type: "network.outbound", action: "deny" },
+   *       ],
+   *     });
+   */
+  async setPolicies(doc) {
+    return this._client._request("PUT", `${vmPath(this.id)}/policies`, doc, this.baseUrl);
+  }
   // ── Syncs: bindings of a filesystem into this VM at a path ────────
   async listSyncs(opts = {}) {
     return this._client._request("GET", buildQuery(`${vmPath(this.id)}/syncs`, {
@@ -550,6 +581,20 @@ var VM = class _VM {
   async deleteSession(sessionId) {
     return this._client._request("DELETE", `${vmPath(this.id)}/sessions/${pathSegment(sessionId)}`, void 0, this.baseUrl);
   }
+  /**
+   * Update a session via `PATCH /v1/vms/{id}/sessions/{sid}`: resize its PTY
+   * (`cols`/`rows`) and/or set the idle `timeoutSecs`. Works whether or not a
+   * PTY is currently attached — the REST equivalent of {@link PtyConnection.resize}
+   * (which sends an in-band control frame on the live WebSocket).
+   */
+  async updateSession(sessionId, update) {
+    return this._client._request(
+      "PATCH",
+      `${vmPath(this.id)}/sessions/${pathSegment(sessionId)}`,
+      { cols: update.cols, rows: update.rows, timeout_secs: update.timeoutSecs },
+      this.baseUrl
+    );
+  }
   async connectPty(options = {}) {
     const sessionId = options.sessionId ?? sessionIdFrom(await this.createSession());
     const useTicket = options.useTicket ?? !isNodeRuntime();
@@ -961,8 +1006,94 @@ function base64ToBytes(text) {
 function bufferConstructor() {
   return globalThis.Buffer;
 }
+var http2Module;
+function loadHttp2() {
+  return http2Module ??= (async () => {
+    const proc = globalThis.process;
+    if (!proc?.versions?.node) return null;
+    try {
+      return await import(
+        /* webpackIgnore: true */
+        /* @vite-ignore */
+        "http2"
+      );
+    } catch {
+      return null;
+    }
+  })();
+}
+var HTTP2_REQUEST_TIMEOUT_MS = 12e4;
+var Http2Connection = class {
+  confirmed = false;
+  streams = 0;
+  session;
+  constructor(http2, origin) {
+    this.session = http2.connect(origin);
+    this.session.on("error", () => {
+    });
+  }
+  get closed() {
+    return this.session.closed || this.session.destroyed;
+  }
+  request(method, path, headers, body) {
+    if (this.streams === 0) this.session.ref();
+    this.streams++;
+    return new Promise((resolve, reject) => {
+      const stream = this.session.request({ ...headers, ":method": method, ":path": path });
+      let status = 0;
+      let text = "";
+      stream.setEncoding("utf8");
+      stream.setTimeout(HTTP2_REQUEST_TIMEOUT_MS, () => stream.destroy(new Error("HTTP/2 request timed out")));
+      stream.on("response", (responseHeaders) => {
+        this.confirmed = true;
+        status = Number(responseHeaders[":status"]) || 0;
+      });
+      stream.on("data", (chunk) => {
+        text += chunk;
+      });
+      stream.on("end", () => resolve({ status, ok: status >= 200 && status < 300, text }));
+      stream.on("error", reject);
+      stream.end(body);
+    }).finally(() => {
+      if (--this.streams === 0) this.session.unref();
+    });
+  }
+};
+var http2Connections = /* @__PURE__ */ new Map();
+async function sendRequest(url, init, fetchImpl, http2Enabled) {
+  if (http2Enabled) {
+    const http2 = await loadHttp2();
+    if (http2) {
+      const { origin, pathname, search } = new URL(url);
+      const cached = http2Connections.get(origin);
+      if (cached !== null) {
+        let connection = cached;
+        if (!connection || connection.closed) {
+          connection = new Http2Connection(http2, origin);
+          http2Connections.set(origin, connection);
+        }
+        try {
+          return await connection.request(init.method, `${pathname}${search}`, init.headers, init.body);
+        } catch (error) {
+          if (connection.confirmed) throw error;
+          http2Connections.set(origin, null);
+        }
+      }
+    }
+  }
+  const response = await fetchImpl(url, init);
+  return { status: response.status, ok: response.ok, text: await response.text() };
+}
 
 // src/cli.ts
+var import_meta = {};
+var VERSION = (() => {
+  try {
+    return (0, import_node_module.createRequire)(import_meta.url)("../package.json").version;
+  } catch {
+    return "unknown";
+  }
+})();
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
@@ -1001,6 +1132,7 @@ function readFileConfig() {
   }
   return {};
 }
+var DEFAULT_REGION = "us-west-2";
 function clientFromArgs(args) {
   const file = readFileConfig();
   const explicitBaseUrl = args.flags["base-url"] ?? process.env.ARKER_BASE_URL;
@@ -1008,14 +1140,11 @@ function clientFromArgs(args) {
   const apiKey = args.flags["api-key"] ?? process.env.ARKER_API_KEY ?? file.apiKey;
   const baseUrl = explicitBaseUrl ?? (explicitRegion ? void 0 : file.baseUrl);
   const controlBaseUrl = args.flags["control-base-url"] ?? process.env.ARKER_CONTROL_BASE_URL;
-  const region = explicitRegion ?? file.region;
+  const region = explicitRegion ?? file.region ?? (baseUrl ? void 0 : DEFAULT_REGION);
   const provider = args.flags.provider ?? process.env.ARKER_PROVIDER;
   if (!apiKey) {
     die("Missing API key. Set ARKER_API_KEY or pass --api-key.");
   }
-  if (!baseUrl && !region) {
-    die("Missing region. Set ARKER_REGION or pass --region (e.g. us-west-2). --provider (aws|aws-burst) defaults to aws.");
-  }
   return new Arker({ apiKey, baseUrl, region, provider, controlBaseUrl });
 }
 function out(value) {
@@ -1503,134 +1632,6 @@ function bridgePty(pty, options) {
     });
   });
 }
-var SSH_PORT_DEFAULT = 22;
-function defaultIdentityBase() {
-  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".ssh", "id_ed25519");
-}
-function resolveLocalSshKey(args) {
-  const explicit = args.flags.identity;
-  const privateKeyPath = explicit ? explicit.replace(/\.pub$/, "") : defaultIdentityBase();
-  const publicKeyPath = `${privateKeyPath}.pub`;
-  if (!(0, import_node_fs.existsSync)(publicKeyPath)) {
-    if (!boolFlag(args, "generate")) {
-      die(
-        `no SSH public key at ${publicKeyPath}. Pass --identity <path>, or --generate to create an ed25519 key pair.`
-      );
-    }
-    err(`generating ed25519 key pair at ${privateKeyPath}`);
-    const gen = (0, import_node_child_process.spawnSync)(
-      "ssh-keygen",
-      ["-t", "ed25519", "-N", "", "-f", privateKeyPath, "-C", "arker-cli"],
-      { stdio: "inherit" }
-    );
-    if (gen.status !== 0) die("ssh-keygen failed to generate a key pair");
-  }
-  const publicKey = (0, import_node_fs.readFileSync)(publicKeyPath, "utf8").trim();
-  if (!publicKey) die(`SSH public key at ${publicKeyPath} is empty`);
-  return { publicKey, privateKeyPath, publicKeyPath };
-}
-async function registerAccountSshKey(client, publicKey, label) {
-  return client._request(
-    "POST",
-    "/v1/account/ssh-keys",
-    { public_key: publicKey, label: label ?? null },
-    client.baseUrl
-  );
-}
-function resolveSshHost(args, client) {
-  const explicit = args.flags.host ?? process.env.ARKER_SSH_HOST;
-  if (explicit) return explicit;
-  if (client.region) return `aws-${client.region}.arker.ai`;
-  try {
-    return new URL(client.baseUrl).hostname;
-  } catch {
-    die("could not determine SSH host; pass --host <hostname>");
-  }
-}
-async function cmdSsh(args, client) {
-  const vmId = args.flags["vm-id"] ?? args.positional[0];
-  if (!vmId) {
-    die(
-      "usage: arker ssh <vm_id> [--identity <path>] [--generate] [--host <h>] [--port <n>] [--connect|-c] [--skip-register]"
-    );
-  }
-  const { publicKey, privateKeyPath } = resolveLocalSshKey(args);
-  if (!boolFlag(args, "skip-register")) {
-    const label = args.flags.label ?? `arker-cli ${(0, import_node_os.homedir)().split("/").pop() ?? ""}`.trim();
-    try {
-      const key = await registerAccountSshKey(client, publicKey, label);
-      err(`registered SSH key ${key.fingerprint}${key.label ? ` (${key.label})` : ""}`);
-    } catch (e) {
-      if (e instanceof ArkerError && e.status === 409) {
-        die(`this SSH key is already registered to a different account: ${e.message}`);
-      }
-      if (e instanceof ArkerError && e.status === 403) {
-        die(
-          "your API key lacks the developer role required to register SSH keys. Register the key in the console, then re-run with --skip-register."
-        );
-      }
-      throw e;
-    }
-  }
-  const host = resolveSshHost(args, client);
-  const port = numFlag(args, "port") ?? SSH_PORT_DEFAULT;
-  const sshArgs = [
-    "-i",
-    privateKeyPath,
-    ...port !== 22 ? ["-p", String(port)] : [],
-    `${vmId}@${host}`
-  ];
-  const command = `ssh ${sshArgs.join(" ")}`;
-  if (boolFlag(args, "connect") || boolFlag(args, "c")) {
-    err(`connecting: ${command}`);
-    const r = (0, import_node_child_process.spawnSync)("ssh", sshArgs, { stdio: "inherit" });
-    process.exit(r.status ?? 1);
-  }
-  out(command);
-}
-async function cmdSshKeys(args, client) {
-  const sub = args.positional[0];
-  const rest = args.positional.slice(1);
-  switch (sub) {
-    case void 0:
-    case "ls":
-    case "list": {
-      const res = await client._request(
-        "GET",
-        "/v1/account/ssh-keys",
-        void 0,
-        client.baseUrl
-      );
-      if (args.flags.json) return out(res);
-      for (const k of res.keys) {
-        out(`${k.id}	${k.fingerprint}	${k.label ?? "\u2014"}`);
-      }
-      return;
-    }
-    case "add": {
-      const { publicKey } = resolveLocalSshKey(args);
-      const label = args.flags.label;
-      const key = await registerAccountSshKey(client, publicKey, label);
-      if (args.flags.json) return out(key);
-      out(`${key.id}	${key.fingerprint}	${key.label ?? "\u2014"}`);
-      return;
-    }
-    case "rm":
-    case "delete": {
-      const id = rest[0] ?? die("usage: arker ssh-keys rm <key_id>");
-      const r = await client._request(
-        "DELETE",
-        `/v1/account/ssh-keys/${encodeURIComponent(id)}`,
-        void 0,
-        client.baseUrl
-      );
-      out(r.deleted ? `deleted ${id}` : "delete failed");
-      return;
-    }
-    default:
-      die("usage: arker ssh-keys <ls|add|rm> ...");
-  }
-}
 function numFlag(args, name) {
   const v = args.flags[name];
   if (typeof v === "string") return Number(v);
@@ -1651,7 +1652,7 @@ async function readAllStdin() {
 function usage() {
   out(
     [
-      "arker \u2014 VM control plane CLI",
+      `arker v${VERSION}`,
       "",
       "Usage:",
       "  arker <command> [args]",
@@ -1668,8 +1669,6 @@ function usage() {
       "  arker run <vm> <command> [--session-id <id>] [--session-idx N]   run a command",
       "  arker resize <vm> [--memory-mib N] [--vcpu N] [--disk-mib N]   resize a VM (PATCH)",
       "  arker shell [vm_id]                            native PTY shell (forks ubuntu-full if no vm)",
-      "  arker ssh <vm_id>                              register your SSH key + print the ssh command",
-      "  arker ssh <vm_id> --connect                    register + drop straight into the ssh session",
       "",
       "Resources:",
       "  arker vms         <ls|get|rm|fork|run> ...",
@@ -1677,12 +1676,11 @@ function usage() {
       "  arker sessions    <ls|get|create|rm> <vm_id> ...",
       "  arker syncs       <ls|create|rm> <vm_id> ...",
       "  arker filesystems <ls|create|get|rm> ...   (alias: fs)",
-      "  arker ssh-keys    <ls|add|rm> ...           manage account SSH keys",
       "",
       "Flags:",
       "  --api-key <key>            (or env ARKER_API_KEY)",
       "  --region <region>          (or env ARKER_REGION; e.g. us-west-2)",
-      "  --provider <aws|aws-burst> (or env ARKER_PROVIDER; default aws)",
+      "  --provider <aws>           (or env ARKER_PROVIDER; default aws)",
       "  --base-url <url>           override compute URL (env ARKER_BASE_URL)",
       "  --control-base-url <url>   override CF Worker URL (env ARKER_CONTROL_BASE_URL)",
       "  --json                     emit JSON instead of tabular output",
@@ -1705,18 +1703,7 @@ function usage() {
       "  --session-id <id>          reconnect to an existing PTY session",
       "  --command <path>           shell executable path (default: /bin/bash)",
       "  --cols <n> --rows <n>      initial terminal size",
-      "  --no-persist               close the remote PTY process on disconnect",
-      "",
-      "SSH flags:",
-      "  --identity <path>          local key (private or .pub); default ~/.ssh/id_ed25519",
-      "  --generate                 create an ed25519 key pair if none exists",
-      "  --host <hostname>          SSH host (or env ARKER_SSH_HOST; default aws-<region>.arker.ai)",
-      "  --port <n>                 SSH port (default 22)",
-      "  --connect, -c              exec ssh instead of just printing the command",
-      "  --skip-register            don't register the key (assume already registered)",
-      "  --label <text>             label for the registered key",
-      "",
-      `Arker org id: ${ARKER_ORG_ID}`
+      "  --no-persist               close the remote PTY process on disconnect"
     ].join("\n")
   );
   process.exit(2);
@@ -1746,11 +1733,10 @@ async function main() {
         return await cmdSyncs(args, client);
       case "shell":
         return await cmdShell(args, client);
-      case "ssh":
-        return await cmdSsh(args, client);
-      case "ssh-keys":
-      case "ssh_keys":
-        return await cmdSshKeys(args, client);
+      // SSH is descoped/unsupported and hidden from the interface. The
+      // implementation below (cmdSsh / cmdSshKeys) is kept intact; re-add
+      // the `ssh` / `ssh-keys` cases here and their help entries to expose
+      // it once the server-side SSH path is supported.
       // Resources.
       case "vms":
         return await cmdVms(args, client);