@kimchi-dev/kimchictl 0.0.2

package/LICENSE

@@ -0,0 +1,203 @@
+Copyright 2024-2026 CAST AI Group, Inc.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2024-2026 CAST AI Group, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,105 @@
+# kimchictl
+
+`kimchictl` is the standalone CLI for [kimchi](https://kimchi.dev) remote workspaces — create them, list them, and attach your terminal or editor over plain SSH.
+
+- Run heavyweight agents, databases, dev servers in a remote workspace
+- Connect with any SSH-capable tool: terminal, `scp`, git-over-ssh, Editor remote extensions
+- Shares the `kimchi` coding agent's login — one sign-in for both tools
+
+## Install
+
+### Prebuilt binary (recommended)
+
+```sh
+curl -fsSL https://github.com/getkimchi/kimchictl/releases/latest/download/install.sh | sh
+```
+
+The installer ships as a release asset, so it always matches the binaries it downloads. macOS binaries are Developer ID–signed with a hardened runtime (same signing infrastructure as the kimchi harness); SHA-256 checksums ship alongside every release. Installs to `/usr/local/bin` (or `~/.local/bin`, override with `KIMCHICTL_INSTALL`), verifies checksums, and configures the SSH integration (see below). Pin a release with `VERSION=0.2.0 sh`.
+
+### Homebrew (macOS/Linux)
+
+```sh
+brew install getkimchi/tap/kimchictl
+```
+
+post-install, the formula offers the same SSH integration step.
+
+### npm (consumes the JS build, mainly for the kimchi harness)
+
+```sh
+npm install -g @kimchi-dev/kimchictl
+```
+
+## Getting started
+
+```sh
+kimchictl login                      # browser sign-in (shared with the kimchi agent)
+kimchictl workspace create --desc "blog refactor"
+kimchictl ssh pensive-brainy-kimchi-c711c6-56d6      # or plain: ssh <name>.remote.kimchi.dev
+```
+
+`workspace create` defaults to a random base template (Rust, Python, Go, JS/TS). Pass `--template <name>` once named templates ship; the CLI tells you when the API starts accepting them.
+
+## SSH integration
+
+At install time (and on first `kimchictl ssh`), kimchictl writes:
+
+- `~/.config/kimchi/kimchictl/ssh_config` — a `Host *.remote.kimchi.dev` block routing connections through `kimchictl ssh proxy %h` as `ProxyCommand`
+- an `Include ~/.config/kimchi/kimchictl/ssh_config` block (marker-wrapped) at the **top** of your `~/.ssh/config`, so it can't be shadowed by existing `Host *` default
+
+The ProxyCommand pins a fully-qualified command — the binary's own path, or `node <cli.js>` for JS-runtime installs — so connections never depend on `PATH`. If the executable later moves, the next `kimchictl ssh setup` detects the drift and rewrites it.
+
+That is all workspace connectivity needs — `ssh <name>.remote.kimchi.dev`, `scp`, git-over-ssh, and editor Remote-SSH extensions just work.
+
+- Remove: `kimchictl ssh setup --uninstall`
+- Opt out of auto-setup: `export KIMCHICTL_NO_SSH_SETUP=1`
+- The setup is **automatic with notice**, not interactive — it never prompts.
+
+## Commands
+
+```
+kimchictl login [--api-key <key>]     Sign in via browser or a kimi API key
+kimchictl logout [--all]              Remove kimchictl credentials (keeps kimchi agent auth by default)
+kimchictl whoami                      Show the logged-in account and auth source
+
+kimchictl workspace create [--desc "..."] [--no-wait]
+kimchictl workspace list [--output table|json]      (alias: ws)
+kimchictl workspace get <name>
+kimchictl workspace delete <name> [--force]
+
+kimchictl ssh <name> [command...]     Connect (resumes hibernated workspaces)
+kimchictl ssh setup [--uninstall]     Manage the native SSH integration
+
+kimchictl update                      Self-update binary installs (brew/npm tell you their path)
+kimchictl completion <bash|zsh|fish>  Print shell completions
+kimchictl version                     Print the version
+```
+
+Suspend/resume exposed by the API today: **none**. `workspace suspend` / `workspace resume` land when the endpoints exist.
+
+## Sharing auth with the kimchi agent
+
+`kimchictl login` writes the same credential files the kimchi coding agent uses — `~/.config/kimchi/harness/auth.json` (provider `kimchi-dev`) and the `apiKey` field of `~/.config/kimchi/config.json` — so either tool can sign you in and the other is logged in. `KIMCHI_API_KEY` overrides the file-based credentials.
+
+## Environment variables
+
+| Variable | Purpose |
+| --- | --- |
+| `KIMCHI_API_KEY` | API key override (highest precedence) |
+| `KIMCHI_REMOTE_ENDPOINT` | API endpoint override (default `https://app.kimchi.dev/api`) |
+| `KIMCHI_WEB_APP_URL` | Web app URL override for browser login |
+| `KIMCHI_CODING_AGENT_DIR` | Override the shared credential directory |
+| `KIMCHICTL_NO_SSH_SETUP` | Skip all automatic SSH integration |
+| `KIMCHICTL_SSH_DOMAIN` | Override the workspace wildcard domain |
+| `KIMCHICTL_NO_UPDATE_CHECK` | Disable the daily background update check |
+
+## Development
+
+```sh
+bun install              # or: pnpm install
+bun dev -- help          # run from source
+pnpm run check           # biome + typecheck + unit tests
+pnpm run build           # emit dist/
+```
+
+The release pipeline compiles single-file binaries via `bun build --compile` per platform and publishes them to GitHub Releases; the npm package is a thin ESM distribution.

package/bin/kimchictl.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// Thin bin entry for the published npm package. The real CLI is dist/cli.js
+// (built by `prepack`); it self-executes on import and sets process.exitCode.
+// A missing dist means this is a source checkout — tell the user to build.
+try {
+	await import("../dist/cli.js")
+} catch (error) {
+	const code = error && typeof error === "object" && "code" in error ? error.code : undefined
+	if (code === "ERR_MODULE_NOT_FOUND") {
+		console.error(
+			"kimchictl: dist/cli.js not found — run `pnpm run build` (source checkout) or install a published version.",
+		)
+	} else {
+		console.error(error instanceof Error ? error.message : String(error))
+	}
+	process.exitCode = 2
+}

package/dist/api/http.d.ts

@@ -0,0 +1,7 @@
+import type { ApiOptions } from "./types.js";
+/** Control-plane base URL: option → KIMCHI_REMOTE_ENDPOINT → https://app.kimchi.dev/api. */
+export declare function resolveEndpoint(options?: ApiOptions): string;
+export declare function fetchWithTimeout(url: string, init: RequestInit, fetchImpl: typeof globalThis.fetch, ms?: number, externalSignal?: AbortSignal): Promise<Response>;
+/** Status-to-error mapping shared by all control-plane calls (mirrors the harness). */
+export declare function checkResponse(resp: Response, endpoint: string): Promise<void>;
+//# sourceMappingURL=http.d.ts.map

package/dist/api/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"../src/","sources":["api/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG5C,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAE5D;AAED,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,EACjB,SAAS,EAAE,OAAO,UAAU,CAAC,KAAK,EAClC,EAAE,SAAS,EACX,cAAc,CAAC,EAAE,WAAW,GAC1B,OAAO,CAAC,QAAQ,CAAC,CASnB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BnF"}

package/dist/api/http.js

@@ -0,0 +1,60 @@
+import { RemoteAuthError, RemoteNetworkError, RemoteQuotaError } from "./types.js";
+/** Control-plane base URL: option → KIMCHI_REMOTE_ENDPOINT → https://app.kimchi.dev/api. */
+export function resolveEndpoint(options) {
+    return options?.endpoint ?? process.env.KIMCHI_REMOTE_ENDPOINT ?? "https://app.kimchi.dev/api";
+}
+export async function fetchWithTimeout(url, init, fetchImpl, ms = 30_000, externalSignal) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), ms);
+    const signal = externalSignal ? AbortSignal.any([ctrl.signal, externalSignal]) : ctrl.signal;
+    try {
+        return await fetchImpl(url, { ...init, signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Status-to-error mapping shared by all control-plane calls (mirrors the harness). */
+export async function checkResponse(resp, endpoint) {
+    if (resp.ok)
+        return;
+    const body = await resp.text().catch(() => "");
+    switch (resp.status) {
+        case 401:
+            throw new RemoteAuthError(`Invalid API key — run 'kimchictl login' to authenticate: ${endpoint}`, 401);
+        case 403:
+            throw new RemoteAuthError(`Forbidden — your API key does not have permission to use remote workspaces. ${endpoint}`, 403);
+        case 404:
+            throw new RemoteAuthError(`Workspace not found or endpoint not available. ${endpoint}`, 404);
+        case 409:
+            throw new RemoteAuthError(`Workspace conflict — another client may already own this workspace. ${endpoint}`, 409);
+        case 429: {
+            // Quota-exceeded bodies look like
+            // {"message":"quota exceeded: user CPU limit exceeded","fieldViolations":[]}.
+            const detail = parseQuotaDetail(body);
+            if (detail !== undefined) {
+                throw new RemoteQuotaError(`Unable to provision workspace: ${detail}`, 429);
+            }
+            throw new RemoteNetworkError(`HTTP ${resp.status} from ${endpoint}${body ? `: ${body}` : ""}`);
+        }
+        default: {
+            throw new RemoteNetworkError(`HTTP ${resp.status} from ${endpoint}${body ? `: ${body}` : ""}`);
+        }
+    }
+}
+/**
+ * Extract the human-readable reason from a 429 body, or undefined when the
+ * body is not JSON with a "message" string (plain rate-limit response).
+ */
+function parseQuotaDetail(body) {
+    try {
+        const parsed = JSON.parse(body);
+        if (typeof parsed.message !== "string" || parsed.message.length === 0)
+            return undefined;
+        return parsed.message.replace(/^quota exceeded:\s*/i, "");
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/api/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"../src/","sources":["api/http.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAElF,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,OAAoB;IACnD,OAAO,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,4BAA4B,CAAA;AAC/F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,GAAW,EACX,IAAiB,EACjB,SAAkC,EAClC,EAAE,GAAG,MAAM,EACX,cAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IAC5F,IAAI,CAAC;QACJ,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACjD,CAAC;YAAS,CAAC;QACV,YAAY,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACF,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc,EAAE,QAAgB;IACnE,IAAI,IAAI,CAAC,EAAE;QAAE,OAAM;IAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IAC9C,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,GAAG;YACP,MAAM,IAAI,eAAe,CAAC,4DAA4D,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QACvG,KAAK,GAAG;YACP,MAAM,IAAI,eAAe,CACxB,+EAA+E,QAAQ,EAAE,EACzF,GAAG,CACH,CAAA;QACF,KAAK,GAAG;YACP,MAAM,IAAI,eAAe,CAAC,kDAAkD,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QAC7F,KAAK,GAAG;YACP,MAAM,IAAI,eAAe,CAAC,uEAAuE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAA;QAClH,KAAK,GAAG,CAAC,CAAC,CAAC;YACV,kCAAkC;YAClC,8EAA8E;YAC9E,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;YAC5E,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,QAAQ,IAAI,CAAC,MAAM,SAAS,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/F,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACT,MAAM,IAAI,kBAAkB,CAAC,QAAQ,IAAI,CAAC,MAAM,SAAS,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC/F,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACrC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAA;QACxD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAA;QACvF,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAA;IACjB,CAAC;AACF,CAAC"}

package/dist/api/keys.d.ts

@@ -0,0 +1,7 @@
+import type { ApiOptions } from "./types.js";
+/**
+ * Verify an API key against the control plane. Returns the organization id.
+ * (Mirror of kimchi-dev:src/sandbox/cloud/keys.ts.)
+ */
+export declare function verifyApiKey(apiKey: string, options?: ApiOptions): Promise<string>;
+//# sourceMappingURL=keys.d.ts.map

package/dist/api/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"../src/","sources":["api/keys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAG5C;;;GAGG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BxF"}

package/dist/api/keys.js

@@ -0,0 +1,28 @@
+import { checkResponse, fetchWithTimeout, resolveEndpoint } from "./http.js";
+import { RemoteNetworkError } from "./types.js";
+/**
+ * Verify an API key against the control plane. Returns the organization id.
+ * (Mirror of kimchi-dev:src/sandbox/cloud/keys.ts.)
+ */
+export async function verifyApiKey(apiKey, options) {
+    const endpoint = resolveEndpoint(options);
+    const fetchImpl = options?.fetch ?? globalThis.fetch;
+    const url = `${endpoint}/ai-optimizer/v1beta/workspace-tokens:verifyKey`;
+    const resp = await fetchWithTimeout(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            "Content-Type": "application/json",
+        },
+    }, fetchImpl, 30_000, options?.signal);
+    await checkResponse(resp, url);
+    const data = await resp.json().catch(() => {
+        throw new RemoteNetworkError(`Unexpected non-JSON response from ${endpoint}`);
+    });
+    const orgId = data.organizationId;
+    if (typeof orgId !== "string") {
+        throw new RemoteNetworkError(`Missing organizationId in verify response from ${endpoint}`);
+    }
+    return orgId;
+}
+//# sourceMappingURL=keys.js.map

package/dist/api/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"../src/","sources":["api/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAE5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAE/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAAoB;IACtE,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAEpD,MAAM,GAAG,GAAG,GAAG,QAAQ,iDAAiD,CAAA;IACxE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAClC,GAAG,EACH;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SAClC;KACD,EACD,SAAS,EACT,MAAM,EACN,OAAO,EAAE,MAAM,CACf,CAAA;IAED,MAAM,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACzC,MAAM,IAAI,kBAAkB,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,MAAM,KAAK,GAAI,IAAqC,CAAC,cAAc,CAAA;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,kBAAkB,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAA;IAC3F,CAAC;IAED,OAAO,KAAK,CAAA;AACb,CAAC"}

package/dist/api/me.d.ts

@@ -0,0 +1,12 @@
+import type { ApiOptions } from "./types.js";
+/**
+ * GET /v1/me — the authenticated user's profile.
+ * (Mirror of kimchi-dev:src/api/me.ts.)
+ */
+export declare function getMe(apiKey: string, options?: ApiOptions): Promise<{
+    id: string;
+    username?: string;
+    name?: string;
+    email?: string;
+}>;
+//# sourceMappingURL=me.d.ts.map

package/dist/api/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"../src/","sources":["api/me.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;GAGG;AACH,wBAAsB,KAAK,CAC1B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;IACV,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;CACd,CAAC,CAgCD"}

package/dist/api/me.js

@@ -0,0 +1,28 @@
+import { fetchWithTimeout, resolveEndpoint } from "./http.js";
+/**
+ * GET /v1/me — the authenticated user's profile.
+ * (Mirror of kimchi-dev:src/api/me.ts.)
+ */
+export async function getMe(apiKey, options) {
+    const endpoint = resolveEndpoint(options);
+    const fetchImpl = options?.fetch ?? globalThis.fetch;
+    const url = `${endpoint}/v1/me`;
+    const resp = await fetchWithTimeout(url, {
+        method: "GET",
+        headers: {
+            Authorization: `Bearer ${apiKey}`,
+            Accept: "application/json",
+        },
+    }, fetchImpl, 30_000, options?.signal);
+    if (!resp.ok) {
+        throw new Error(`GET ${url} failed with HTTP ${resp.status}`);
+    }
+    const data = await resp.json().catch(() => {
+        throw new Error(`Unexpected non-JSON response from ${url}`);
+    });
+    if (typeof data?.id !== "string" || data.id.length === 0) {
+        throw new Error(`Missing id in /v1/me response from ${url}`);
+    }
+    return data;
+}
+//# sourceMappingURL=me.js.map

package/dist/api/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"../src/","sources":["api/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAC1B,MAAc,EACd,OAAoB;IAOpB,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,OAAO,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAA;IAEpD,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,CAAA;IAC/B,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAClC,GAAG,EACH;QACC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,MAAM,EAAE,kBAAkB;SAC1B;KACD,EACD,SAAS,EACT,MAAM,EACN,OAAO,EAAE,MAAM,CACf,CAAA;IAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,qBAAqB,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;QACzC,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,IAAI,OAAQ,IAAyB,EAAE,EAAE,KAAK,QAAQ,IAAK,IAAuB,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpG,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,IAAwE,CAAA;AAChF,CAAC"}

package/dist/api/resolver.d.ts

@@ -0,0 +1,26 @@
+import type { ApiOptions } from "./types.js";
+import { type Workspace, type WorkspaceCommandOptions } from "./workspaces.js";
+/**
+ * Workspace reference resolution — a port of kap's internal/resolver.
+ *
+ * Users type the alias (the first DNS label of the workspace URI) or a
+ * prefix of it; the control plane addresses workspaces by UUID. Resolution:
+ *   1. UUID-shaped refs go straight to GET (404 → not found).
+ *   2. Anything else lists workspaces and matches, in order:
+ *      exact id, exact alias, case-insensitive alias prefix.
+ *   3. No match → WorkspaceNotFoundError; multiple matches →
+ *      AmbiguousWorkspaceError listing the candidates.
+ *
+ * kap caches the list for 30s — pointless in a one-shot CLI process, so
+ * this port is uncached.
+ */
+export declare class WorkspaceNotFoundError extends Error {
+    constructor(ref: string);
+}
+export declare class AmbiguousWorkspaceError extends Error {
+    constructor(ref: string, candidates: readonly string[]);
+}
+export declare function isWorkspaceUuid(ref: string): boolean;
+/** Resolve a workspace reference (UUID, alias, or alias prefix) to the workspace. */
+export declare function resolveWorkspace(apiKey: string, ref: string, options?: WorkspaceCommandOptions & ApiOptions): Promise<Workspace>;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/api/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"../src/","sources":["api/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C,OAAO,EAAgC,KAAK,SAAS,EAAE,KAAK,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAE5G;;;;;;;;;;;;;GAaG;AAEH,qBAAa,sBAAuB,SAAQ,KAAK;gBACpC,GAAG,EAAE,MAAM;CAIvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACrC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE;CAItD;AAID,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAQD,qFAAqF;AACrF,wBAAsB,gBAAgB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,uBAAuB,GAAG,UAAU,GAC5C,OAAO,CAAC,SAAS,CAAC,CAqBpB"}

package/dist/api/resolver.js

@@ -0,0 +1,62 @@
+import { RemoteAuthError } from "./types.js";
+import { getWorkspace, listWorkspaces } from "./workspaces.js";
+/**
+ * Workspace reference resolution — a port of kap's internal/resolver.
+ *
+ * Users type the alias (the first DNS label of the workspace URI) or a
+ * prefix of it; the control plane addresses workspaces by UUID. Resolution:
+ *   1. UUID-shaped refs go straight to GET (404 → not found).
+ *   2. Anything else lists workspaces and matches, in order:
+ *      exact id, exact alias, case-insensitive alias prefix.
+ *   3. No match → WorkspaceNotFoundError; multiple matches →
+ *      AmbiguousWorkspaceError listing the candidates.
+ *
+ * kap caches the list for 30s — pointless in a one-shot CLI process, so
+ * this port is uncached.
+ */
+export class WorkspaceNotFoundError extends Error {
+    constructor(ref) {
+        super(`No workspace matches "${ref}" — list workspaces with: kimchictl workspace list`);
+        this.name = "WorkspaceNotFoundError";
+    }
+}
+export class AmbiguousWorkspaceError extends Error {
+    constructor(ref, candidates) {
+        super(`Multiple workspaces match "${ref}": ${candidates.join(", ")} — use the full alias`);
+        this.name = "AmbiguousWorkspaceError";
+    }
+}
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export function isWorkspaceUuid(ref) {
+    return UUID_RE.test(ref);
+}
+function matchesRef(ws, ref) {
+    if (ws.id === ref)
+        return true;
+    if (ws.alias === ref)
+        return true;
+    return ws.alias.toLowerCase().startsWith(ref.toLowerCase());
+}
+/** Resolve a workspace reference (UUID, alias, or alias prefix) to the workspace. */
+export async function resolveWorkspace(apiKey, ref, options) {
+    if (isWorkspaceUuid(ref)) {
+        try {
+            return await getWorkspace(apiKey, ref, options);
+        }
+        catch (err) {
+            if (err instanceof RemoteAuthError && err.statusCode === 404) {
+                throw new WorkspaceNotFoundError(ref);
+            }
+            throw err;
+        }
+    }
+    const workspaces = await listWorkspaces(apiKey, options);
+    const matched = workspaces.filter((ws) => matchesRef(ws, ref));
+    const [unique] = matched;
+    if (matched.length === 1 && unique)
+        return unique;
+    if (matched.length === 0)
+        throw new WorkspaceNotFoundError(ref);
+    throw new AmbiguousWorkspaceError(ref, matched.map((ws) => ws.alias));
+}
+//# sourceMappingURL=resolver.js.map

package/dist/api/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"../src/","sources":["api/resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAgD,MAAM,iBAAiB,CAAA;AAE5G;;;;;;;;;;;;;GAaG;AAEH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAChD,YAAY,GAAW;QACtB,KAAK,CAAC,yBAAyB,GAAG,oDAAoD,CAAC,CAAA;QACvF,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACrC,CAAC;CACD;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACjD,YAAY,GAAW,EAAE,UAA6B;QACrD,KAAK,CAAC,8BAA8B,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;QAC1F,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAA;IACtC,CAAC;CACD;AAED,MAAM,OAAO,GAAG,iEAAiE,CAAA;AAEjF,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,EAAa,EAAE,GAAW;IAC7C,IAAI,EAAE,CAAC,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,EAAE,CAAC,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACjC,OAAO,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAA;AAC5D,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACrC,MAAc,EACd,GAAW,EACX,OAA8C;IAE9C,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBAC9D,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAA;YACtC,CAAC;YACD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9D,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,CAAA;IACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAA;IAC/D,MAAM,IAAI,uBAAuB,CAChC,GAAG,EACH,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAC7B,CAAA;AACF,CAAC"}

package/dist/api/resources.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Kubernetes quantity parsing (port of kimchi-dev:src/sandbox/cloud/resources.ts,
+ * trimmed to what the workspace list/detail rendering needs) plus display
+ * formatters for human tables.
+ */
+/** "200m" → 200, "1.5" → 1500. Undefined for absent/invalid. */
+export declare function cpuQuantityToMillicores(raw: unknown): number | undefined;
+/** "512Mi" → 536870912, "1G" → 1000000000. Undefined for absent/invalid. */
+export declare function byteQuantityToBytes(raw: unknown): number | undefined;
+/** 1000 → "1", 1500 → "1.5", 250 → "250m", undefined → "-". */
+export declare function formatMillicores(millicores: number | undefined): string;
+/** 2147483648 → "2Gi", 536870912 → "512Mi", undefined → "-". */
+export declare function formatBytes(bytes: number | undefined): string;
+/** Relative age for table columns: "45s", "12m", "3h", "5d". */
+export declare function formatAge(since: Date, now?: Date): string;
+//# sourceMappingURL=resources.d.ts.map

package/dist/api/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"../src/","sources":["api/resources.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH,gEAAgE;AAChE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGxE;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAKvE;AAED,gEAAgE;AAChE,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAQ7D;AAMD,gEAAgE;AAChE,wBAAgB,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,GAAE,IAAiB,GAAG,MAAM,CAQrE"}