@krovacloud/cli 0.3.1 → 0.4.0

package/dist/index.js

@@ -0,0 +1,1070 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command as Command10 } from "commander";
+
+// src/commands/auth.ts
+import { Command } from "commander";
+
+// src/lib/config.ts
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEFAULT_BASE_URL = "https://krova.cloud/api/v1";
+var DEFAULT_CONTEXT_NAME = "default";
+var ENV = {
+  apiKey: "KROVA_API_KEY",
+  spaceId: "KROVA_SPACE_ID",
+  baseUrl: "KROVA_BASE_URL",
+  context: "KROVA_CONTEXT"
+};
+function configDir() {
+  const xdg = (process.env.XDG_CONFIG_HOME ?? "").trim();
+  if (xdg) return join(xdg, "krova");
+  return join(homedir(), ".config", "krova");
+}
+function configPath() {
+  return join(configDir(), "config.json");
+}
+function load() {
+  let cfg = {};
+  try {
+    cfg = JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    cfg = {};
+  }
+  return migrate(cfg);
+}
+function migrate(cfg) {
+  if ((cfg.apiKey ?? "").trim() && (!cfg.contexts || cfg.contexts.length === 0)) {
+    cfg.contexts = [
+      {
+        name: DEFAULT_CONTEXT_NAME,
+        apiKey: cfg.apiKey,
+        spaceId: cfg.spaceId,
+        baseUrl: cfg.baseUrl
+      }
+    ];
+    cfg.currentContext = DEFAULT_CONTEXT_NAME;
+  }
+  cfg.apiKey = void 0;
+  cfg.spaceId = void 0;
+  cfg.baseUrl = void 0;
+  return cfg;
+}
+function save(cfg) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const clean = {};
+  if (cfg.currentContext) clean.currentContext = cfg.currentContext;
+  if (cfg.contexts && cfg.contexts.length) {
+    clean.contexts = cfg.contexts.map((c) => {
+      const o = { name: c.name };
+      if (c.apiKey) o.apiKey = c.apiKey;
+      if (c.spaceId) o.spaceId = c.spaceId;
+      if (c.spaceName) o.spaceName = c.spaceName;
+      if (c.baseUrl) o.baseUrl = c.baseUrl;
+      return o;
+    });
+  }
+  writeFileSync(path, `${JSON.stringify(clean, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
+function find(cfg, name) {
+  return (cfg.contexts ?? []).find((c) => c.name === name);
+}
+function current(cfg, override) {
+  const name = (override ?? "").trim() || (cfg.currentContext ?? "").trim();
+  if (!name) return void 0;
+  return find(cfg, name);
+}
+function upsert(cfg, incoming) {
+  cfg.contexts ??= [];
+  let ctx = cfg.contexts.find((c) => c.name === incoming.name);
+  if (!ctx) {
+    ctx = { name: incoming.name };
+    cfg.contexts.push(ctx);
+    if (!cfg.currentContext) cfg.currentContext = ctx.name;
+  }
+  if ((incoming.apiKey ?? "").trim()) ctx.apiKey = incoming.apiKey;
+  if ((incoming.spaceId ?? "").trim()) ctx.spaceId = incoming.spaceId;
+  if ((incoming.spaceName ?? "").trim()) ctx.spaceName = incoming.spaceName;
+  ctx.baseUrl = incoming.baseUrl;
+  return ctx;
+}
+function remove(cfg, name) {
+  const before = (cfg.contexts ?? []).length;
+  cfg.contexts = (cfg.contexts ?? []).filter((c) => c.name !== name);
+  if (cfg.contexts.length === before) return false;
+  if (cfg.currentContext === name) {
+    cfg.currentContext = cfg.contexts[0]?.name ?? "";
+  }
+  return true;
+}
+function resolve(cfg, flags) {
+  const ctx = current(cfg, (flags.context ?? "").trim() || process.env[ENV.context]);
+  const pick = (flag, env, ctxVal) => {
+    if ((flag ?? "").trim()) return [flag, "flag"];
+    if ((env ?? "").trim()) return [env, "env"];
+    if ((ctxVal ?? "").trim()) return [ctxVal, "context"];
+    return ["", ""];
+  };
+  const [apiKey, apiKeySource] = pick(flags.apiKey, process.env[ENV.apiKey], ctx?.apiKey);
+  const [spaceId, spaceIdSource] = pick(flags.space, process.env[ENV.spaceId], ctx?.spaceId);
+  const [baseUrlRaw] = pick(flags.baseUrl, process.env[ENV.baseUrl], ctx?.baseUrl);
+  return {
+    apiKey,
+    spaceId,
+    baseUrl: baseUrlRaw || DEFAULT_BASE_URL,
+    apiKeySource,
+    spaceIdSource,
+    contextName: ctx?.name ?? ""
+  };
+}
+function sanitizeContextName(name) {
+  return name.trim().toLowerCase().replace(/\s+/g, "-");
+}
+function maskKey(key) {
+  if (!key) return "";
+  if (key.length <= 8) return "****";
+  return `${key.slice(0, 6)}\u2026${key.slice(-4)}`;
+}
+
+// src/lib/output.ts
+function printJSON(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function printTable(header, rows) {
+  const widths = header.map(
+    (h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length))
+  );
+  const fmt = (cols) => cols.map((c, i) => (c ?? "").padEnd(widths[i] ?? 0)).join("  ").replace(/\s+$/, "");
+  process.stdout.write(`${fmt(header)}
+`);
+  for (const r of rows) process.stdout.write(`${fmt(r)}
+`);
+}
+function printKeyValue(pairs) {
+  const w = Math.max(0, ...pairs.map(([k]) => k.length));
+  for (const [k, v] of pairs) {
+    process.stdout.write(`${k.padEnd(w)}  ${v}
+`);
+  }
+}
+
+// src/lib/client.ts
+import { KrovaClient } from "@krovacloud/sdk";
+function makeClient(res) {
+  if (!res.apiKey) {
+    throw new Error(
+      "no API key found: run `krova auth login`, set KROVA_API_KEY, or pass --api-key"
+    );
+  }
+  return new KrovaClient({ apiKey: res.apiKey, baseUrl: res.baseUrl });
+}
+async function rawRequest(opts) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs);
+  try {
+    const headers = { Accept: "application/json" };
+    if (opts.apiKey) headers["X-API-KEY"] = opts.apiKey;
+    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+    const res = await fetch(`${opts.baseUrl.replace(/\/+$/, "")}${opts.path}`, {
+      method: opts.method,
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0,
+      redirect: "manual",
+      signal: controller.signal
+    });
+    let data;
+    const text = await res.text();
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        data = void 0;
+      }
+    }
+    return { status: res.status, data };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/lib/runtime.ts
+function parseDuration(input) {
+  const s = (input ?? "").trim();
+  if (!s) return 3e4;
+  let total = 0;
+  const re = /(\d+(?:\.\d+)?)(ms|s|m|h)/g;
+  let m = re.exec(s);
+  let matched = false;
+  while (m) {
+    matched = true;
+    const n = Number(m[1]);
+    const unit = m[2];
+    total += unit === "ms" ? n : unit === "s" ? n * 1e3 : unit === "m" ? n * 6e4 : n * 36e5;
+    m = re.exec(s);
+  }
+  if (!matched) {
+    const n = Number(s);
+    if (Number.isFinite(n)) total = n * 1e3;
+  }
+  return total > 0 ? total : 3e4;
+}
+function getRuntime(cmd) {
+  const opts = cmd.optsWithGlobals();
+  const flags = {
+    apiKey: opts.apiKey,
+    space: opts.space,
+    baseUrl: opts.baseUrl,
+    context: opts.context
+  };
+  const cfg = load();
+  const res = resolve(cfg, flags);
+  return {
+    flags,
+    cfg,
+    res,
+    json: Boolean(opts.json),
+    timeoutMs: parseDuration(opts.timeout)
+  };
+}
+async function fetchSpace(baseUrl, apiKey, timeoutMs) {
+  try {
+    const { status, data } = await rawRequest({
+      method: "GET",
+      baseUrl,
+      path: "/space",
+      apiKey,
+      timeoutMs
+    });
+    if (status === 200 && data?.id) return data;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function resolveSpace(rt) {
+  if (rt.res.spaceId) return rt.res.spaceId;
+  const { status, data } = await rawRequest({
+    method: "GET",
+    baseUrl: rt.res.baseUrl,
+    path: "/space",
+    apiKey: rt.res.apiKey,
+    timeoutMs: rt.timeoutMs
+  });
+  if (status === 200 && data?.id) {
+    if (rt.res.contextName) {
+      upsert(rt.cfg, {
+        name: rt.res.contextName,
+        spaceId: data.id,
+        spaceName: data.name,
+        baseUrl: rt.res.baseUrl
+      });
+      try {
+        save(rt.cfg);
+      } catch {
+      }
+    }
+    return data.id;
+  }
+  if (status === 404) {
+    throw new Error(
+      "couldn't auto-detect your space (the server doesn't support it yet) \u2014 pass --space, set KROVA_SPACE_ID, or run `krova login`"
+    );
+  }
+  if (status === 401 || status === 403) {
+    throw new Error(`auto-detect space failed: the API key was rejected (HTTP ${status})`);
+  }
+  throw new Error(`auto-detect space failed (HTTP ${status})`);
+}
+
+// src/lib/persist.ts
+async function persistLogin(input) {
+  const cfg = load();
+  let spaceId = input.spaceId ?? "";
+  let spaceName = "";
+  let derivedName = "";
+  const sp = await fetchSpace(input.baseUrl, input.apiKey, input.timeoutMs);
+  if (sp) {
+    spaceId = sp.id;
+    spaceName = sp.name ?? "";
+    derivedName = (sp.slug || sp.name || "").trim();
+  }
+  let name = (input.ctxName ?? "").trim();
+  if (!name) name = derivedName || DEFAULT_CONTEXT_NAME;
+  name = sanitizeContextName(name);
+  const cur = upsert(cfg, {
+    name,
+    apiKey: input.apiKey,
+    spaceId,
+    spaceName,
+    baseUrl: input.baseUrl
+  });
+  cfg.currentContext = cur.name;
+  save(cfg);
+  return { ctxName: cur.name, spaceName: cur.spaceName ?? "" };
+}
+
+// src/commands/auth.ts
+function promptAPIKey() {
+  return new Promise((resolve2, reject) => {
+    process.stdout.write("Krova API key: ");
+    const stdin = process.stdin;
+    const tty = Boolean(stdin.isTTY);
+    let buf = "";
+    if (tty) stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    const finish = (fn) => {
+      if (tty) stdin.setRawMode(false);
+      stdin.pause();
+      stdin.removeListener("data", onData);
+      fn();
+    };
+    const onData = (ch) => {
+      for (const c of ch) {
+        const code = c.charCodeAt(0);
+        if (code === 10 || code === 13) {
+          finish(() => {
+            process.stdout.write("\n");
+            resolve2(buf.trim());
+          });
+          return;
+        }
+        if (code === 3) {
+          finish(() => reject(new Error("cancelled")));
+          return;
+        }
+        if (code === 127 || code === 8) {
+          buf = buf.slice(0, -1);
+        } else if (code >= 32) {
+          buf += c;
+        }
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+function authCommand() {
+  const auth = new Command("auth").description("manage Krova Cloud credentials");
+  auth.command("login").description("log in by pasting an API key").option("--api-key <key>", "API key (else you'll be prompted)").option("--space <id>", "Space ID to store with the key").option("--context <name>", "name for the saved context").action(async (opts, cmd) => {
+    const rt = getRuntime(cmd);
+    let key = opts.apiKey || rt.flags.apiKey || "";
+    if (!key.trim()) key = await promptAPIKey();
+    if (!key.trim()) throw new Error("no API key provided");
+    const { ctxName, spaceName } = await persistLogin({
+      apiKey: key.trim(),
+      baseUrl: rt.res.baseUrl,
+      spaceId: opts.space,
+      ctxName: opts.context,
+      timeoutMs: rt.timeoutMs
+    });
+    process.stdout.write(`Logged in. Saved context "${ctxName}" to ${configPath()}
+`);
+    if (spaceName) process.stdout.write(`Space: ${spaceName}
+`);
+  });
+  auth.command("status").description("show the resolved credentials").action((_opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const authenticated = Boolean(rt.res.apiKey);
+    if (rt.json) {
+      return printJSON({
+        authenticated,
+        context: rt.res.contextName,
+        apiKeySource: rt.res.apiKeySource,
+        apiKeyMasked: maskKey(rt.res.apiKey),
+        spaceId: rt.res.spaceId,
+        spaceSource: rt.res.spaceIdSource,
+        baseUrl: rt.res.baseUrl,
+        configPath: configPath()
+      });
+    }
+    printKeyValue([
+      ["Authenticated", authenticated ? "yes" : "no"],
+      ["Context", rt.res.contextName || "\u2014"],
+      ["API key", rt.res.apiKey ? `${maskKey(rt.res.apiKey)} (${rt.res.apiKeySource})` : "\u2014"],
+      ["Space ID", rt.res.spaceId ? `${rt.res.spaceId} (${rt.res.spaceIdSource})` : "\u2014"],
+      ["Base URL", rt.res.baseUrl],
+      ["Config", configPath()]
+    ]);
+  });
+  return auth;
+}
+
+// src/commands/catalog.ts
+import { Command as Command2 } from "commander";
+function fmtVal(v) {
+  if (v === null || v === void 0) return "";
+  if (typeof v === "object") return JSON.stringify(v);
+  return String(v);
+}
+function renderCatalog(obj) {
+  const arrKey = Object.keys(obj).find((k) => Array.isArray(obj[k]));
+  if (arrKey) {
+    const arr = obj[arrKey] ?? [];
+    const cols = [...new Set(arr.flatMap((o) => Object.keys(o)))];
+    printTable(
+      cols.map((c) => c.toUpperCase()),
+      arr.map((o) => cols.map((c) => fmtVal(o[c])))
+    );
+    return;
+  }
+  printKeyValue(Object.entries(obj).map(([k, v]) => [k, fmtVal(v)]));
+}
+function catalogCmd(name, desc, fetch2) {
+  return new Command2(name).description(desc).action(async (_opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const data = await fetch2(client);
+    if (rt.json) return printJSON(data);
+    renderCatalog(data);
+  });
+}
+function regionsCommand() {
+  return catalogCmd(
+    "regions",
+    "list regions with available capacity",
+    (c) => c.catalog.regions()
+  );
+}
+function imagesCommand() {
+  return catalogCmd(
+    "images",
+    "list available OS images",
+    (c) => c.catalog.images()
+  );
+}
+function pricingCommand() {
+  return catalogCmd(
+    "pricing",
+    "show per-resource hourly pricing",
+    (c) => c.catalog.pricing()
+  );
+}
+
+// src/commands/context.ts
+import { Command as Command3 } from "commander";
+function contextCommand() {
+  const ctx = new Command3("context").aliases(["ctx", "contexts"]).description("manage named credential contexts (like kubectl/aws profiles)");
+  ctx.command("list").aliases(["ls"]).description("list all contexts").action((_opts, cmd) => {
+    const { json } = getRuntime(cmd);
+    const cfg = load();
+    if (json) {
+      return printJSON({
+        currentContext: cfg.currentContext ?? "",
+        contexts: (cfg.contexts ?? []).map((c) => ({
+          name: c.name,
+          apiKey: maskKey(c.apiKey ?? ""),
+          spaceId: c.spaceId ?? "",
+          spaceName: c.spaceName ?? "",
+          baseUrl: c.baseUrl ?? ""
+        }))
+      });
+    }
+    printTable(
+      ["CURRENT", "NAME", "SPACE", "SPACE ID", "BASE URL"],
+      (cfg.contexts ?? []).map((c) => [
+        c.name === cfg.currentContext ? "*" : "",
+        c.name,
+        c.spaceName ?? "",
+        c.spaceId ?? "",
+        c.baseUrl ?? ""
+      ])
+    );
+  });
+  ctx.command("current").description("print the current context name").action(() => {
+    const cfg = load();
+    if (!cfg.currentContext) throw new Error("no current context set");
+    process.stdout.write(`${cfg.currentContext}
+`);
+  });
+  ctx.command("use").argument("<name>", "context name").description("switch the current context").action((name) => {
+    const cfg = load();
+    if (!(cfg.contexts ?? []).some((c) => c.name === name)) {
+      throw new Error(`no context named "${name}"`);
+    }
+    cfg.currentContext = name;
+    save(cfg);
+    process.stdout.write(`Switched to context ${name}
+`);
+  });
+  ctx.command("rename").argument("<old>", "current name").argument("<new>", "new name").description("rename a context").action((oldName, newName) => {
+    const cfg = load();
+    if (!newName.trim()) throw new Error("new name must not be empty");
+    const c = (cfg.contexts ?? []).find((x) => x.name === oldName);
+    if (!c) throw new Error(`no context named "${oldName}"`);
+    if ((cfg.contexts ?? []).some((x) => x.name === newName)) {
+      throw new Error(`a context named "${newName}" already exists`);
+    }
+    c.name = newName;
+    if (cfg.currentContext === oldName) cfg.currentContext = newName;
+    save(cfg);
+    process.stdout.write(`Renamed ${oldName} \u2192 ${newName}
+`);
+  });
+  ctx.command("delete").aliases(["rm"]).argument("<name>", "context name").description("delete a context").action((name) => {
+    const cfg = load();
+    if (!remove(cfg, name)) throw new Error(`no context named "${name}"`);
+    save(cfg);
+    process.stdout.write(`Deleted context ${name}
+`);
+  });
+  return ctx;
+}
+
+// src/commands/cubes.ts
+import { Command as Command4 } from "commander";
+
+// src/lib/resolve.ts
+async function resolveCube(client, spaceId, ref) {
+  const { cubes } = await client.cubes.list(spaceId);
+  if (cubes.some((c) => c.id === ref)) return ref;
+  const byName = cubes.filter((c) => c.name === ref);
+  if (byName.length === 1) return byName[0].id;
+  if (byName.length === 0) {
+    throw new Error(
+      `no cube named or with ID "${ref}" in this space (see \`krova cubes list\`)`
+    );
+  }
+  const ids = byName.map((c) => c.id).join(", ");
+  throw new Error(
+    `cube name "${ref}" is ambiguous: it matches ${byName.length} cubes (${ids}) \u2014 use the cube ID instead`
+  );
+}
+
+// src/commands/cubes.ts
+function listCmd() {
+  return new Command4("list").aliases(["ls"]).description("list Cubes in the space").action(async (_opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const { cubes } = await client.cubes.list(space);
+    if (rt.json) return printJSON(cubes);
+    printTable(
+      ["ID", "NAME", "STATE", "VCPU", "RAM(GB)", "DISK(GB)", "IMAGE", "IPV4"],
+      cubes.map((c) => [
+        c.id,
+        c.name,
+        c.state,
+        String(c.resources.vcpu),
+        String(c.resources.ramGb),
+        String(c.resources.diskGb),
+        c.image,
+        c.publicIpv4 ?? "\u2014"
+      ])
+    );
+  });
+}
+function getCmd() {
+  return new Command4("get").argument("<cube>", "cube name or ID").description("show a single Cube").action(async (cubeRef, _opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const id = await resolveCube(client, space, cubeRef);
+    const cube = await client.cubes.get(space, id);
+    if (rt.json) return printJSON(cube);
+    printKeyValue([
+      ["ID", cube.id],
+      ["Name", cube.name],
+      ["State", cube.state],
+      ["Image", cube.image],
+      ["vCPU", String(cube.resources.vcpu)],
+      ["RAM (GB)", String(cube.resources.ramGb)],
+      ["Disk (GB)", String(cube.resources.diskGb)],
+      ["Public IPv4", cube.publicIpv4 ?? "\u2014"],
+      ["Cost/hour", `$${cube.costPerHour}`]
+    ]);
+  });
+}
+function createCmd() {
+  return new Command4("create").description("provision a new Cube").requiredOption("--name <name>", "cube name").requiredOption("--image <slug>", "OS image slug (see `krova images`)").requiredOption("--ssh-key <key>", "SSH public key written to authorized_keys").option("--vcpu <n>", "number of vCPUs", "1").option("--ram <gb>", "RAM in GB", "1").option("--disk <gb>", "disk size in GB", "10").option("--region <slug>", "region slug (see `krova regions`)").option("--user-data <script>", "cloud-init script").option("--idempotency-key <key>", "idempotency key (24h dedupe)").action(async (opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const body = {
+      name: opts.name,
+      image: opts.image,
+      sshPublicKey: opts.sshKey,
+      resources: {
+        vcpu: Number(opts.vcpu),
+        ramGb: Number(opts.ram),
+        diskGb: Number(opts.disk)
+      }
+    };
+    if (opts.region) body.region = opts.region;
+    if (opts.userData) body.userData = opts.userData;
+    const cube = await client.cubes.create(
+      space,
+      body,
+      opts.idempotencyKey ? { idempotencyKey: opts.idempotencyKey } : void 0
+    );
+    if (rt.json) return printJSON(cube);
+    process.stdout.write(`Created cube ${cube.id} (${cube.state})
+`);
+  });
+}
+function actionCmd(name, past, fn) {
+  return new Command4(name).argument("<cube>", "cube name or ID").description(`${name} a Cube`).action(async (cubeRef, _opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const id = await resolveCube(client, space, cubeRef);
+    await fn(client.cubes, space, id);
+    if (rt.json) return printJSON({ id, result: past });
+    process.stdout.write(`${past} cube ${id}
+`);
+  });
+}
+function sshPortCmd() {
+  return new Command4("ssh-port").argument("<cube>", "cube name or ID").requiredOption("--port <n>", "the host port to expose SSH on").description("change the host port a Cube's SSH is reachable on").action(async (cubeRef, opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const id = await resolveCube(client, space, cubeRef);
+    const cubePort = Number(opts.port);
+    if (!Number.isInteger(cubePort) || cubePort < 1 || cubePort > 65535) {
+      throw new Error("--port must be an integer between 1 and 65535");
+    }
+    await client.cubes.update(space, id, { cubePort });
+    if (rt.json) return printJSON({ id, cubePort });
+    process.stdout.write(`SSH port for cube ${id} set to ${cubePort}
+`);
+  });
+}
+function cubesCommand() {
+  const cubes = new Command4("cubes").description("manage Cubes (Firecracker microVMs)");
+  cubes.addCommand(listCmd());
+  cubes.addCommand(getCmd());
+  cubes.addCommand(createCmd());
+  cubes.addCommand(actionCmd("sleep", "Sleeping", (c, s, id) => c.sleep(s, id)));
+  cubes.addCommand(actionCmd("wake", "Waking", (c, s, id) => c.wake(s, id)));
+  cubes.addCommand(actionCmd("delete", "Deleting", (c, s, id) => c.delete(s, id)));
+  cubes.addCommand(sshPortCmd());
+  return cubes;
+}
+var rootListCommand = listCmd;
+var rootGetCommand = getCmd;
+
+// src/commands/login.ts
+import { spawn } from "child_process";
+import { Command as Command5 } from "commander";
+var BROWSER_UNAVAILABLE = "Browser login isn't enabled on this server yet \u2014 run `krova auth login` to paste an API key from https://krova.cloud";
+function safeBrowserURL(raw) {
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.protocol === "https:" && u.hostname) return raw;
+  if (u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1")) {
+    return raw;
+  }
+  return null;
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  const args = process.platform === "win32" ? ["", url] : [url];
+  const child = spawn(cmd, args, { stdio: "ignore", detached: true, shell: process.platform === "win32" });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function loginCommand() {
+  return new Command5("login").description("log in through your browser (device authorization)").option("--no-browser", "don't open a browser; just print the URL").option("--context <name>", "name for the saved context").action(async (opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const baseUrl = rt.res.baseUrl;
+    const start = await rawRequest({
+      method: "POST",
+      baseUrl,
+      path: "/auth/cli/start",
+      timeoutMs: rt.timeoutMs
+    });
+    if (start.status === 404) throw new Error(BROWSER_UNAVAILABLE);
+    if (start.status !== 200 || !start.data?.deviceCode) {
+      throw new Error(`device login failed to start (HTTP ${start.status})`);
+    }
+    const s = start.data;
+    process.stdout.write(`Your verification code is: ${s.userCode}
+`);
+    const target = s.verificationUriComplete || s.verificationUri;
+    const safe = safeBrowserURL(target);
+    if (safe && opts.browser !== false) {
+      process.stdout.write(`Opening ${safe} \u2026
+`);
+      openBrowser(safe);
+    } else {
+      process.stdout.write(`Open this URL to approve the login:
+  ${target}
+`);
+    }
+    const intervalMs = Math.max((s.interval || 5) * 1e3, 5e3);
+    const deadline = Date.now() + Math.max(s.expiresIn || 600, 1) * 1e3;
+    process.stdout.write("Waiting for approval\u2026\n");
+    for (; ; ) {
+      if (Date.now() >= deadline) {
+        throw new Error(
+          "login timed out: the verification code expired before it was approved"
+        );
+      }
+      await sleep(intervalMs);
+      const poll = await rawRequest({
+        method: "POST",
+        baseUrl,
+        path: "/auth/cli/poll",
+        body: { deviceCode: s.deviceCode },
+        timeoutMs: rt.timeoutMs
+      });
+      if (poll.status === 200) {
+        if (!poll.data?.apiKey) throw new Error("login succeeded but no API key was returned");
+        const { ctxName, spaceName } = await persistLogin({
+          apiKey: poll.data.apiKey,
+          baseUrl,
+          spaceId: poll.data.spaceId,
+          ctxName: opts.context,
+          timeoutMs: rt.timeoutMs
+        });
+        process.stdout.write(`Logged in. Saved context "${ctxName}" to ${configPath()}
+`);
+        if (spaceName) process.stdout.write(`Space: ${spaceName}
+`);
+        return;
+      }
+      if (poll.status === 202 || poll.status === 425 || poll.status === 428) continue;
+      if (poll.status === 410) {
+        throw new Error("login expired: request a new code with `krova login`");
+      }
+      if (poll.status === 404) throw new Error(BROWSER_UNAVAILABLE);
+      throw new Error(`login failed while polling (HTTP ${poll.status})`);
+    }
+  });
+}
+
+// src/commands/ssh.ts
+import { Command as Command6 } from "commander";
+
+// src/lib/ssh.ts
+import { spawn as spawn2 } from "child_process";
+import { appendFileSync, chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2 } from "path";
+import { join as join2 } from "path";
+var HOST_BANNED = new Set(
+  "@/\\'\"`$;&|<>(){}*?!#=,".split("")
+);
+var USER_BANNED = new Set(
+  "@/\\'\"`$;&|<>(){}*?!#,".split("")
+);
+function validateSSHHost(host) {
+  const h = host.trim();
+  if (!h) throw new Error("empty host");
+  if (h.startsWith("-")) throw new Error("host must not start with '-'");
+  for (const r of h) {
+    const code = r.codePointAt(0) ?? 0;
+    if (code <= 32 || code === 127) {
+      throw new Error("host contains whitespace or control characters");
+    }
+    if (HOST_BANNED.has(r)) {
+      throw new Error(`host contains a disallowed character ${JSON.stringify(r)}`);
+    }
+  }
+}
+function validateSSHUser(user) {
+  const u = user.trim();
+  if (!u) return;
+  if (u.startsWith("-")) throw new Error("user must not start with '-'");
+  for (const r of u) {
+    const code = r.codePointAt(0) ?? 0;
+    if (code <= 32 || code === 127) {
+      throw new Error("user contains whitespace or control characters");
+    }
+    if (USER_BANNED.has(r)) {
+      throw new Error(`user contains a disallowed character ${JSON.stringify(r)}`);
+    }
+  }
+}
+function knownHostsHost(host, port) {
+  if (port > 0 && port !== 22) return `[${host}]:${port}`;
+  return host;
+}
+function knownHostsPath() {
+  return join2(configDir(), "known_hosts");
+}
+function writeKnownHosts(info) {
+  const path = knownHostsPath();
+  mkdirSync2(dirname2(path), { recursive: true, mode: 448 });
+  const field = knownHostsHost(info.host, info.port);
+  let existing = "";
+  try {
+    existing = readFileSync2(path, "utf8");
+  } catch {
+    existing = "";
+  }
+  const kept = existing.split("\n").filter((line) => line.trim() && line.split(/\s+/)[0] !== field);
+  writeFileSync2(path, kept.length ? `${kept.join("\n")}
+` : "", { mode: 384 });
+  chmodSync2(path, 384);
+  for (const k of info.hostKeys) {
+    appendFileSync(path, `${field} ${k.type} ${k.key}
+`);
+  }
+  return path;
+}
+function buildSSHArgs(info, o) {
+  const args = [];
+  if (o.knownHosts) {
+    args.push("-o", `UserKnownHostsFile=${o.knownHosts}`, "-o", "StrictHostKeyChecking=yes");
+  }
+  if ((o.identity ?? "").trim()) args.push("-i", o.identity);
+  if (info.port > 0) args.push("-p", String(info.port));
+  for (const l of o.localFwd ?? []) if (l.trim()) args.push("-L", l);
+  for (const r of o.remoteFwd ?? []) if (r.trim()) args.push("-R", r);
+  const user = info.user.trim();
+  const target = user ? `${user}@${info.host}` : info.host;
+  args.push("--", target);
+  args.push(...o.remoteCmd ?? []);
+  return args;
+}
+function execSSH(args) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn2("ssh", args, { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => resolve2(code ?? 0));
+  });
+}
+
+// src/commands/ssh.ts
+var collect = (v, acc) => {
+  acc.push(v);
+  return acc;
+};
+function sshCommand() {
+  return new Command6("ssh").argument("<cube>", "cube name or ID").argument("[command...]", "command to run non-interactively (after --)").description("open an SSH session to a Cube (by name or ID)").option("-i, --identity <file>", "SSH identity (private key) file, passed to ssh -i").option("-L, --local-forward <spec>", "local port forward, passed to ssh -L (repeatable)", collect, []).option("-R, --remote-forward <spec>", "remote port forward, passed to ssh -R (repeatable)", collect, []).action(async (cubeRef, command, opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const client = makeClient(rt.res);
+    const space = await resolveSpace(rt);
+    const id = await resolveCube(client, space, cubeRef);
+    const { status, data } = await rawRequest({
+      method: "GET",
+      baseUrl: rt.res.baseUrl,
+      path: `/spaces/${space}/cubes/${id}/ssh`,
+      apiKey: rt.res.apiKey,
+      timeoutMs: rt.timeoutMs
+    });
+    if (status === 404) {
+      throw new Error(
+        `SSH info isn't available on this server yet \u2014 try \`krova cubes get ${cubeRef}\` for the Cube's IP and ssh manually`
+      );
+    }
+    if (status === 401 || status === 403) {
+      throw new Error(`SSH info request was rejected (HTTP ${status})`);
+    }
+    if (status !== 200 || !data?.host) {
+      throw new Error(`couldn't fetch SSH info (HTTP ${status})`);
+    }
+    const info = {
+      host: data.host,
+      port: data.port ?? 0,
+      user: data.user ?? "",
+      hostKeys: data.hostKeys ?? []
+    };
+    validateSSHHost(info.host);
+    validateSSHUser(info.user);
+    if (info.port < 0 || info.port > 65535) throw new Error("invalid ssh port");
+    let knownHosts = "";
+    if (info.hostKeys.length) {
+      knownHosts = writeKnownHosts(info);
+    } else {
+      process.stderr.write(
+        "note: this server didn't provide host keys \u2014 using ssh trust-on-first-use (host-key checking stays on).\n"
+      );
+    }
+    const args = buildSSHArgs(info, {
+      identity: opts.identity,
+      localFwd: opts.localForward,
+      remoteFwd: opts.remoteForward,
+      knownHosts,
+      remoteCmd: command
+    });
+    process.exitCode = await execSSH(args);
+  });
+}
+
+// src/commands/version.ts
+import { createRequire } from "module";
+import { Command as Command7 } from "commander";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var CLI_VERSION = pkg.version;
+function versionCommand() {
+  return new Command7("version").description("print the krova CLI version").action((_opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const info = {
+      version: CLI_VERSION,
+      node: process.version,
+      platform: `${process.platform}/${process.arch}`
+    };
+    if (rt.json) return printJSON(info);
+    process.stdout.write(`krova ${info.version} (node ${info.node}, ${info.platform})
+`);
+  });
+}
+
+// src/commands/webhooks.ts
+import { createServer } from "http";
+import { verifyKrovaWebhookOrThrow } from "@krovacloud/webhook";
+import { Command as Command8 } from "commander";
+function webhooksCommand() {
+  const wh = new Command8("webhooks").description("developer tools for Krova Cloud webhooks");
+  wh.command("listen").description("run a local server that verifies + prints incoming webhook deliveries").option("--addr <host:port>", "address to listen on", "127.0.0.1:4666").option("--path <path>", "path to accept POSTs on", "/").option("--secret <secret>", "signing secret (or the KROVA_WEBHOOK_SECRET env var)").action((opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const secret = opts.secret || process.env.KROVA_WEBHOOK_SECRET || "";
+    if (!secret) {
+      throw new Error(
+        "a signing secret is required: pass --secret or set KROVA_WEBHOOK_SECRET"
+      );
+    }
+    const addr = String(opts.addr);
+    const lastColon = addr.lastIndexOf(":");
+    const host = lastColon > 0 ? addr.slice(0, lastColon) : "127.0.0.1";
+    const port = Number(lastColon > 0 ? addr.slice(lastColon + 1) : addr) || 4666;
+    const wantPath = String(opts.path);
+    const server = createServer((req, res) => {
+      const reqPath = (req.url ?? "/").split("?")[0];
+      if (req.method !== "POST" || reqPath !== wantPath) {
+        res.writeHead(405);
+        res.end("method not allowed");
+        return;
+      }
+      const chunks = [];
+      let size = 0;
+      req.on("data", (c) => {
+        size += c.length;
+        if (size <= 1048576) chunks.push(c);
+      });
+      req.on("end", () => {
+        const body = Buffer.concat(chunks).toString("utf8");
+        const sig = req.headers["x-krova-signature"] || "";
+        try {
+          verifyKrovaWebhookOrThrow({ payload: body, signature: sig, secret });
+        } catch (e) {
+          process.stderr.write(`\u2717 rejected delivery: ${e.message}
+`);
+          res.writeHead(400);
+          res.end("invalid signature");
+          return;
+        }
+        try {
+          const event = JSON.parse(body);
+          if (rt.json) process.stdout.write(`${JSON.stringify(event)}
+`);
+          else printJSON(event);
+        } catch {
+          process.stdout.write(`${body}
+`);
+        }
+        res.writeHead(200);
+        res.end("ok");
+      });
+    });
+    server.listen(port, host, () => {
+      process.stderr.write(`Listening for webhooks on http://${host}:${port}${wantPath}
+`);
+    });
+    const stop = () => server.close(() => process.exit(0));
+    process.on("SIGINT", stop);
+    process.on("SIGTERM", stop);
+  });
+  return wh;
+}
+
+// src/commands/whoami.ts
+import { Command as Command9 } from "commander";
+function whoamiCommand() {
+  return new Command9("whoami").description("show the current context, space, and base URL").action(async (_opts, cmd) => {
+    const rt = getRuntime(cmd);
+    const ctx = find(rt.cfg, rt.res.contextName);
+    let spaceId = rt.res.spaceId;
+    let spaceName = ctx?.spaceName ?? "";
+    let spaceLive = false;
+    if (rt.res.apiKey) {
+      const sp = await fetchSpace(rt.res.baseUrl, rt.res.apiKey, rt.timeoutMs);
+      if (sp) {
+        spaceId = sp.id;
+        spaceName = sp.name ?? spaceName;
+        spaceLive = true;
+      }
+    }
+    if (rt.json) {
+      return printJSON({
+        context: rt.res.contextName,
+        spaceId,
+        spaceName,
+        apiKeyMasked: maskKey(rt.res.apiKey),
+        apiKeySource: rt.res.apiKeySource,
+        baseUrl: rt.res.baseUrl,
+        spaceLive
+      });
+    }
+    printKeyValue([
+      ["Context", rt.res.contextName || "\u2014"],
+      ["Space", spaceName || "\u2014"],
+      ["Space ID", spaceId || "\u2014"],
+      ["API key", rt.res.apiKey ? `${maskKey(rt.res.apiKey)} (${rt.res.apiKeySource})` : "\u2014"],
+      ["Base URL", rt.res.baseUrl]
+    ]);
+  });
+}
+
+// src/index.ts
+function addGlobalOptions(cmd) {
+  const have = new Set(cmd.options.map((o) => o.long));
+  const add = (flags, desc, def) => {
+    const long = flags.split(/[ ,<[]/).find((f) => f.startsWith("--"));
+    if (long && !have.has(long)) cmd.option(flags, desc, def);
+  };
+  add("--api-key <key>", "Krova Cloud API key (overrides env and context)");
+  add("--space <id>", "Space ID (overrides KROVA_SPACE_ID and context)");
+  add("--base-url <url>", "override the API base URL");
+  add("--context <name>", "use a named context (overrides KROVA_CONTEXT)");
+  add("--json", "output machine-readable JSON instead of a table");
+  add("--timeout <duration>", "per-request timeout", "30s");
+}
+var program = new Command10();
+program.name("krova").description(
+  "krova is the command-line interface for Krova Cloud \u2014 manage Cubes (Firecracker microVMs), browse the catalog, and receive webhooks."
+).version(CLI_VERSION, "-v, --version", "print the krova CLI version").showHelpAfterError();
+program.addCommand(loginCommand());
+program.addCommand(authCommand());
+program.addCommand(contextCommand());
+program.addCommand(whoamiCommand());
+program.addCommand(cubesCommand());
+program.addCommand(sshCommand());
+program.addCommand(rootListCommand());
+program.addCommand(rootGetCommand());
+program.addCommand(regionsCommand());
+program.addCommand(imagesCommand());
+program.addCommand(pricingCommand());
+program.addCommand(webhooksCommand());
+program.addCommand(versionCommand());
+var applyAll = (cmd) => {
+  addGlobalOptions(cmd);
+  for (const c of cmd.commands) applyAll(c);
+};
+applyAll(program);
+async function main() {
+  try {
+    await program.parseAsync(process.argv);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Error: ${msg}
+`);
+    process.exitCode = 1;
+  }
+}
+void main();
+//# sourceMappingURL=index.js.map