@ukiyocompute/cli 0.3.0 → 0.3.1

package/README.md

@@ -1,6 +1,6 @@
-# Ukiyo CLI 0.3.0
+# Ukiyo CLI 0.3.1
 
-Requires Node.js 24+. Install with `npm install -g @ukiyocompute/cli@0.3.0`.
+Requires Node.js 24+. Install with `npm install -g @ukiyocompute/cli@0.3.1`.
 Packages are staged for owner-approved publication; availability is not implied.
 
 Read `https://pay.u-kiyo.ai/api/v1/terms` and its linked document, then explicitly

package/dist/bin.js

@@ -444,8 +444,8 @@ var UkiyoClient = class {
   offers() {
     return this.request("/offers", { authenticated: false });
   }
-  me() {
-    return this.request("/me");
+  me(signal) {
+    return this.request("/me", { signal: signal ?? null });
   }
   balance() {
     return this.request("/billing/balance");
@@ -477,11 +477,11 @@ var UkiyoClient = class {
       throw error;
     }
   }
-  rent(offerId, budgetMinor, idempotencyKey) {
-    return this.request("/rentals", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, ...budgetMinor === void 0 ? {} : { budgetMinor } }) });
+  rent(offerId, budgetMinor, idempotencyKey, signal) {
+    return this.request("/rentals", { signal: signal ?? null, method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, ...budgetMinor === void 0 ? {} : { budgetMinor } }) });
   }
-  rentGpu(input, idempotencyKey) {
-    return this.request("/rentals", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify(input) });
+  rentGpu(input, idempotencyKey, signal) {
+    return this.request("/rentals", { signal: signal ?? null, method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify(input) });
   }
   rental(id, signal) {
     return this.request(`/rentals/${encodeURIComponent(id)}`, signal ? { signal } : {});
@@ -495,8 +495,8 @@ var UkiyoClient = class {
   credentials(id) {
     return this.request(`/deployments/${encodeURIComponent(id)}/credentials/reveal`, { method: "POST" });
   }
-  terminate(id) {
-    return this.request(`/deployments/${encodeURIComponent(id)}/terminate`, { method: "POST", body: JSON.stringify({ reason: "USER_REQUESTED" }) });
+  terminate(id, signal) {
+    return this.request(`/deployments/${encodeURIComponent(id)}/terminate`, { signal: signal ?? null, method: "POST", body: JSON.stringify({ reason: "USER_REQUESTED" }) });
   }
   checkout(offerId, budgetMinor, idempotencyKey) {
     return this.request("/orders/checkout", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, budgetMinor }) });
@@ -700,7 +700,7 @@ async function connectExistingAccount(printUrl, baseUrl = DEFAULT_API_URL, fetch
       return result;
     } catch (error) {
       if (!(error instanceof Error) || !error.message.startsWith("Waiting for account-owner approval.")) throw error;
-      await new Promise((resolve2) => setTimeout(resolve2, 2e3));
+      await new Promise((resolve3) => setTimeout(resolve3, 2e3));
     }
   }
   throw new Error("Authorization expired. Run ukiyo connect again.");
@@ -750,7 +750,7 @@ async function signupAgent(limits, baseUrl = DEFAULT_API_URL, fetcher = fetch, a
 // apps/cli/src/ssh.ts
 import { execFile } from "node:child_process";
 import { constants as constants3, closeSync as closeSync3, mkdtempSync, unlinkSync as unlinkSync2, rmdirSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { resolve as resolve2, join as join4 } from "node:path";
 
 // apps/cli/src/output.ts
 function redact(text, secrets = []) {
@@ -818,12 +818,12 @@ async function executeSsh(id, access, command, timeout = 60, runner = execFile)
     if (isWindows()) {
       for (const name of ["SystemRoot", "WINDIR", "USERPROFILE", "LOCALAPPDATA", "TEMP", "TMP"]) if (process.env[name]) env[name] = process.env[name];
     }
-    return await new Promise((resolve2, reject) => runner("ssh", args, { timeout: timeout * 1e3, maxBuffer: 4 * 1024 * 1024, env, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
+    return await new Promise((resolve3, reject) => runner("ssh", args, { timeout: timeout * 1e3, maxBuffer: 4 * 1024 * 1024, env, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
       if (error && typeof error.code !== "number") {
         reject(new Error(error.killed ? "SSH command timed out." : "SSH transport failed. Check SSH availability and the deployment state."));
         return;
       }
-      resolve2({ exitCode: error?.code ?? 0, stdout: redact(String(stdout), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]), stderr: redact(String(stderr), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]) });
+      resolve3({ exitCode: error?.code ?? 0, stdout: redact(String(stdout), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]), stderr: redact(String(stderr), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]) });
     }));
   } finally {
     try {
@@ -837,6 +837,29 @@ async function executeSsh(id, access, command, timeout = 60, runner = execFile)
     }
   }
 }
+function saveSshKey(path, access) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9.:-]*$/.test(access.host) || !/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(access.username) || !Number.isInteger(access.port) || access.port < 1 || access.port > 65535 || !access.privateKey?.includes("PRIVATE KEY")) throw new Error("Invalid SSH connection.");
+  const keyPath = resolve2(path);
+  const fd = openPrivateFile(keyPath, constants3.O_WRONLY, true);
+  try {
+    writeFileSync2(fd, access.privateKey);
+  } catch (error) {
+    unlinkSync2(keyPath);
+    throw error;
+  } finally {
+    closeSync3(fd);
+  }
+  const quoted = isWindows() ? "'" + keyPath.replaceAll("'", "''") + "'" : "'" + keyPath.replaceAll("'", "'\\''") + "'";
+  return {
+    deploymentId: access.deploymentId,
+    rentalId: access.rentalId,
+    host: access.host,
+    port: access.port,
+    username: access.username,
+    keyPath,
+    sshCommand: `ssh -i ${quoted} -p ${access.port} -o IdentitiesOnly=yes ${access.username}@${access.host}`
+  };
+}
 
 // apps/cli/src/wait.ts
 function timeoutSeconds(value) {
@@ -844,28 +867,45 @@ function timeoutSeconds(value) {
   if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > 3600) throw new ApiError(0, "INVALID_USAGE", "Timeout must be 1\u20133600 seconds.", null);
   return seconds;
 }
-async function waitFor(read, done, seconds, context) {
-  const deadline = Date.now() + seconds * 1e3;
-  let latest;
-  const timedOut = () => {
-    const error = new ApiError(0, "WAIT_TIMEOUT", "Wait ended; the resource still exists. Inspect the known ID. Do not create a replacement rental.", null);
-    error.context = { ...context, ...latest ? { resource: latest } : {} };
+async function beforeDeadline(read, deadline, context) {
+  const expired = () => {
+    const error = new ApiError(0, "WAIT_TIMEOUT", "Wait ended; inspect the known resource ID. For a write, retry only with the same Idempotency-Key and original parameters; never create a replacement rental.", null);
+    error.context = { ...context };
     return error;
   };
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) throw expired();
+  const controller = new AbortController();
+  let timer;
+  try {
+    const value = await Promise.race([read(controller.signal), new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(expired());
+      }, remaining);
+    })]);
+    if (Date.now() >= deadline) throw expired();
+    return value;
+  } catch (error) {
+    if (Date.now() >= deadline) throw expired();
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function waitFor(read, done, seconds, context, deadline = Date.now() + seconds * 1e3) {
+  let latest;
   for (; ; ) {
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) throw timedOut();
     try {
-      latest = await read(AbortSignal.timeout(Math.max(1, Math.min(15e3, remaining))));
+      latest = await beforeDeadline(read, deadline, { ...context, ...latest ? { resource: latest } : {} });
     } catch (error) {
-      if (Date.now() >= deadline) throw timedOut();
       if (error instanceof ApiError) error.context = { ...context, ...error.context };
       throw error;
     }
     if (latest?.rentalId) context.rentalId = latest.rentalId;
     if (latest?.deploymentId) context.deploymentId = latest.deploymentId;
     if (done(latest)) return latest;
-    await new Promise((resolve2) => setTimeout(resolve2, Math.max(0, Math.min(1e3, deadline - Date.now()))));
+    await new Promise((resolve3) => setTimeout(resolve3, Math.max(0, Math.min(1e3, deadline - Date.now()))));
   }
 }
 
@@ -890,7 +930,7 @@ function buildProgram(options = {}) {
     return new UkiyoClient({ baseUrl, ...token ? { token } : {} });
   };
   const print = (value) => out(JSON.stringify(safeOutput(value), null, 2));
-  const program = new Command().name("ukiyo").description("Manage Ukiyo compute through the public API").version("0.3.0").configureOutput({ writeErr: () => {
+  const program = new Command().name("ukiyo").description("Manage Ukiyo compute through the public API").version("0.3.1").configureOutput({ writeErr: () => {
   } }).exitOverride();
   const machine = program.command("machine").description("Wallet-paid compute with no prior Ukiyo account; requires local signer config and explicit spend caps");
   const machineClient = () => {
@@ -941,11 +981,12 @@ function buildProgram(options = {}) {
   topup.command("status").requiredOption("--topup-id <id>").option("--json").description("Inspect funding; pending means do not pay again").action(async (opts) => print(await client().topupStatus(opts.topupId)));
   program.command("rent").option("--offer <id>").option("--gpu <name>").option("--count <count>").option("--budget <usd>", "required for fixed-prepaid accounts; optional for account-balance billing").option("--max-hourly-price <usd>", "GPU/count accepted hourly ceiling; reuse the same ceiling on retries").option("--idempotency-key <key>", "unique per intended rental; reuse with original parameters on retries").option("--json").option("--wait").option("--timeout <seconds>", "maximum status wait", "600").action(async (opts) => {
     const seconds = timeoutSeconds(opts.timeout);
+    const deadline = Date.now() + seconds * 1e3;
     const budget = opts.budget === void 0 ? void 0 : dollarsToMinor(opts.budget);
     if (Boolean(opts.offer) === Boolean(opts.gpu) || opts.offer && (opts.count || opts.maxHourlyPrice)) throw new ApiError(0, "INVALID_USAGE", "Choose --offer OR --gpu with optional --count and hourly ceiling.", null);
     const api = client();
     if (budget === void 0) {
-      const account = await api.me();
+      const account = await (opts.wait ? beforeDeadline((signal) => api.me(signal), deadline, {}) : api.me());
       if (account.billing?.model !== "ACCOUNT_BALANCE" || account.billing.budgetRequired !== false) {
         throw new ApiError(0, "INVALID_USAGE", "--budget is required for this account. Budget-free rentals require account-balance billing.", null);
       }
@@ -965,9 +1006,10 @@ function buildProgram(options = {}) {
     const idempotencyKey = opts.idempotencyKey ?? randomUUID3();
     const context = { ...intent ?? { offerId: opts.offer, ...budgetFields }, idempotencyKey };
     try {
-      const rental = await (intent ? api.rentGpu(intent, idempotencyKey) : api.rent(opts.offer, budget, idempotencyKey));
+      const create = (signal) => intent ? api.rentGpu(intent, idempotencyKey, signal) : api.rent(opts.offer, budget, idempotencyKey, signal);
+      const rental = await (opts.wait ? beforeDeadline(create, deadline, context) : create());
       Object.assign(context, { rentalId: rental.rentalId, deploymentId: rental.deploymentId });
-      const result = opts.wait && !["ACTIVE", "FAILED", "TERMINATED"].includes(rental.status) ? await waitFor((signal) => api.rental(rental.rentalId, signal), (value) => ["ACTIVE", "FAILED", "TERMINATED"].includes(value.status), seconds, context) : rental;
+      const result = opts.wait && !["ACTIVE", "FAILED", "TERMINATED"].includes(rental.status) ? await waitFor((signal) => api.rental(rental.rentalId, signal), (value) => ["ACTIVE", "FAILED", "TERMINATED"].includes(value.status), seconds, context, deadline) : rental;
       print({ ...result, ...context });
       if (opts.wait && result.status !== "ACTIVE") process.exitCode = 1;
     } catch (error) {
@@ -984,23 +1026,32 @@ function buildProgram(options = {}) {
   program.command("exec <id> <command...>").option("--json").option("--timeout <seconds>", "command timeout", "60").description("Execute a command over authenticated SSH (first host key is pinned locally)").action(async (id, command, opts) => {
     const seconds = timeoutSeconds(opts.timeout);
     const access = await client().credentials(id);
-    const result = await executeSsh(id, access, command, seconds);
-    print({ deploymentId: id, ...result });
+    const result = await executeSsh(access.deploymentId ?? id, access, command, seconds);
+    print({ deploymentId: access.deploymentId ?? id, rentalId: access.rentalId, ...result });
     if (result.exitCode) process.exitCode = 1;
   });
   program.command("offers").option("--json").option("--gpu <name>").option("--count <count>").description("List available compute").action(async (opts) => print(filteredOffers(await client().offers(), opts.gpu, opts.count)));
   program.command("list").option("--json").description("List your deployments").action(async () => print(await client().deployments()));
   program.command("status <id>").option("--json").description("Show one deployment").action(async (id) => print(await client().deployment(id)));
-  program.command("credentials <id>").option("--json").description("Reveal SSH access; response contains a private key and is audited server-side. Prefer ukiyo exec, which uses the key without printing it. Do not redirect into a file or shared transcript. CLI output redacts private keys.").addHelpText("after", "\nThe API response contains a private key and each reveal is audited server-side. Prefer ukiyo exec, which uses the key without printing it. Do not redirect this command into a file or shared transcript.").action(async (id) => print(await client().credentials(id)));
+  program.command("credentials <id>").option("--json").option("--save-key <path>", "save a private SSH key securely without printing it").option("--reveal", "explicitly print the private key; audited and unsafe for shared transcripts").description("Audited SSH connection metadata; private keys are redacted by default. Prefer exec or --save-key.").action(async (id, opts) => {
+    if (opts.saveKey && opts.reveal) throw new ApiError(0, "INVALID_USAGE", "Choose --save-key or --reveal, not both.", null);
+    const access = await client().credentials(id);
+    if (opts.saveKey) print(saveSshKey(opts.saveKey, access));
+    else if (opts.reveal) {
+      console.error("WARNING: credential reveal is audited. This output contains a private key; do not share or log it.");
+      out(JSON.stringify(access, null, 2));
+    } else print(access);
+  });
   program.command("deploy").description("Rent an offer").requiredOption("--offer <id>").requiredOption("--budget <usd>", "budget in dollars, e.g. 20 or 19.99").action(async (opts) => print(await client().checkout(opts.offer, dollarsToMinor(opts.budget), randomUUID3())));
   program.command("terminate <id>").option("--json").option("--wait").option("--timeout <seconds>", "maximum termination wait", "600").description("Terminate a deployment. This is irreversible.").option("--yes", "skip the confirmation prompt").action(async (id, opts) => {
     const seconds = timeoutSeconds(opts.timeout);
     if (!opts.yes) throw new ApiError(0, "CONFIRMATION_REQUIRED", `Terminating ${id} is irreversible and destroys anything on the instance. Re-run with --yes to confirm.`, null);
     const api = client();
     try {
-      const accepted = await api.terminate(id);
-      const value = opts.wait ? await waitFor((signal) => api.deployment(id, signal), (value2) => value2.status === "TERMINATED", seconds, { deploymentId: id }) : accepted;
-      print({ ...value, deploymentId: id });
+      const deadline = Date.now() + seconds * 1e3;
+      const accepted = await (opts.wait ? beforeDeadline((signal) => api.terminate(id, signal), deadline, { deploymentId: id }) : api.terminate(id));
+      const value = opts.wait ? await waitFor((signal) => api.deployment(id, signal), (value2) => value2.status === "TERMINATED", seconds, { deploymentId: id, ...accepted }, deadline) : accepted;
+      print({ deploymentId: id, ...value });
     } catch (error) {
       contextError(error, { deploymentId: id });
     }

package/dist/library.js

@@ -444,8 +444,8 @@ var UkiyoClient = class {
   offers() {
     return this.request("/offers", { authenticated: false });
   }
-  me() {
-    return this.request("/me");
+  me(signal) {
+    return this.request("/me", { signal: signal ?? null });
   }
   balance() {
     return this.request("/billing/balance");
@@ -477,11 +477,11 @@ var UkiyoClient = class {
       throw error;
     }
   }
-  rent(offerId, budgetMinor, idempotencyKey) {
-    return this.request("/rentals", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, ...budgetMinor === void 0 ? {} : { budgetMinor } }) });
+  rent(offerId, budgetMinor, idempotencyKey, signal) {
+    return this.request("/rentals", { signal: signal ?? null, method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, ...budgetMinor === void 0 ? {} : { budgetMinor } }) });
   }
-  rentGpu(input, idempotencyKey) {
-    return this.request("/rentals", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify(input) });
+  rentGpu(input, idempotencyKey, signal) {
+    return this.request("/rentals", { signal: signal ?? null, method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify(input) });
   }
   rental(id, signal) {
     return this.request(`/rentals/${encodeURIComponent(id)}`, signal ? { signal } : {});
@@ -495,8 +495,8 @@ var UkiyoClient = class {
   credentials(id) {
     return this.request(`/deployments/${encodeURIComponent(id)}/credentials/reveal`, { method: "POST" });
   }
-  terminate(id) {
-    return this.request(`/deployments/${encodeURIComponent(id)}/terminate`, { method: "POST", body: JSON.stringify({ reason: "USER_REQUESTED" }) });
+  terminate(id, signal) {
+    return this.request(`/deployments/${encodeURIComponent(id)}/terminate`, { signal: signal ?? null, method: "POST", body: JSON.stringify({ reason: "USER_REQUESTED" }) });
   }
   checkout(offerId, budgetMinor, idempotencyKey) {
     return this.request("/orders/checkout", { method: "POST", headers: { "idempotency-key": idempotencyKey }, body: JSON.stringify({ offerId, budgetMinor }) });
@@ -700,7 +700,7 @@ async function connectExistingAccount(printUrl, baseUrl = DEFAULT_API_URL, fetch
       return result;
     } catch (error) {
       if (!(error instanceof Error) || !error.message.startsWith("Waiting for account-owner approval.")) throw error;
-      await new Promise((resolve2) => setTimeout(resolve2, 2e3));
+      await new Promise((resolve3) => setTimeout(resolve3, 2e3));
     }
   }
   throw new Error("Authorization expired. Run ukiyo connect again.");
@@ -750,7 +750,7 @@ async function signupAgent(limits, baseUrl = DEFAULT_API_URL, fetcher = fetch, a
 // apps/cli/src/ssh.ts
 import { execFile } from "node:child_process";
 import { constants as constants3, closeSync as closeSync3, mkdtempSync, unlinkSync as unlinkSync2, rmdirSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { resolve as resolve2, join as join4 } from "node:path";
 
 // apps/cli/src/output.ts
 function redact(text, secrets = []) {
@@ -818,12 +818,12 @@ async function executeSsh(id, access, command, timeout = 60, runner = execFile)
     if (isWindows()) {
       for (const name of ["SystemRoot", "WINDIR", "USERPROFILE", "LOCALAPPDATA", "TEMP", "TMP"]) if (process.env[name]) env[name] = process.env[name];
     }
-    return await new Promise((resolve2, reject) => runner("ssh", args, { timeout: timeout * 1e3, maxBuffer: 4 * 1024 * 1024, env, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
+    return await new Promise((resolve3, reject) => runner("ssh", args, { timeout: timeout * 1e3, maxBuffer: 4 * 1024 * 1024, env, encoding: "utf8", windowsHide: true }, (error, stdout, stderr) => {
       if (error && typeof error.code !== "number") {
         reject(new Error(error.killed ? "SSH command timed out." : "SSH transport failed. Check SSH availability and the deployment state."));
         return;
       }
-      resolve2({ exitCode: error?.code ?? 0, stdout: redact(String(stdout), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]), stderr: redact(String(stderr), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]) });
+      resolve3({ exitCode: error?.code ?? 0, stdout: redact(String(stdout), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]), stderr: redact(String(stderr), [access.privateKey, process.env.UKIYO_API_TOKEN ?? ""]) });
     }));
   } finally {
     try {
@@ -837,6 +837,29 @@ async function executeSsh(id, access, command, timeout = 60, runner = execFile)
     }
   }
 }
+function saveSshKey(path, access) {
+  if (!/^[a-zA-Z0-9][a-zA-Z0-9.:-]*$/.test(access.host) || !/^[a-zA-Z0-9_][a-zA-Z0-9_-]*$/.test(access.username) || !Number.isInteger(access.port) || access.port < 1 || access.port > 65535 || !access.privateKey?.includes("PRIVATE KEY")) throw new Error("Invalid SSH connection.");
+  const keyPath = resolve2(path);
+  const fd = openPrivateFile(keyPath, constants3.O_WRONLY, true);
+  try {
+    writeFileSync2(fd, access.privateKey);
+  } catch (error) {
+    unlinkSync2(keyPath);
+    throw error;
+  } finally {
+    closeSync3(fd);
+  }
+  const quoted = isWindows() ? "'" + keyPath.replaceAll("'", "''") + "'" : "'" + keyPath.replaceAll("'", "'\\''") + "'";
+  return {
+    deploymentId: access.deploymentId,
+    rentalId: access.rentalId,
+    host: access.host,
+    port: access.port,
+    username: access.username,
+    keyPath,
+    sshCommand: `ssh -i ${quoted} -p ${access.port} -o IdentitiesOnly=yes ${access.username}@${access.host}`
+  };
+}
 
 // apps/cli/src/wait.ts
 function timeoutSeconds(value) {
@@ -844,28 +867,45 @@ function timeoutSeconds(value) {
   if (!Number.isSafeInteger(seconds) || seconds < 1 || seconds > 3600) throw new ApiError(0, "INVALID_USAGE", "Timeout must be 1\u20133600 seconds.", null);
   return seconds;
 }
-async function waitFor(read, done, seconds, context) {
-  const deadline = Date.now() + seconds * 1e3;
-  let latest;
-  const timedOut = () => {
-    const error = new ApiError(0, "WAIT_TIMEOUT", "Wait ended; the resource still exists. Inspect the known ID. Do not create a replacement rental.", null);
-    error.context = { ...context, ...latest ? { resource: latest } : {} };
+async function beforeDeadline(read, deadline, context) {
+  const expired = () => {
+    const error = new ApiError(0, "WAIT_TIMEOUT", "Wait ended; inspect the known resource ID. For a write, retry only with the same Idempotency-Key and original parameters; never create a replacement rental.", null);
+    error.context = { ...context };
     return error;
   };
+  const remaining = deadline - Date.now();
+  if (remaining <= 0) throw expired();
+  const controller = new AbortController();
+  let timer;
+  try {
+    const value = await Promise.race([read(controller.signal), new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        reject(expired());
+      }, remaining);
+    })]);
+    if (Date.now() >= deadline) throw expired();
+    return value;
+  } catch (error) {
+    if (Date.now() >= deadline) throw expired();
+    throw error;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function waitFor(read, done, seconds, context, deadline = Date.now() + seconds * 1e3) {
+  let latest;
   for (; ; ) {
-    const remaining = deadline - Date.now();
-    if (remaining <= 0) throw timedOut();
     try {
-      latest = await read(AbortSignal.timeout(Math.max(1, Math.min(15e3, remaining))));
+      latest = await beforeDeadline(read, deadline, { ...context, ...latest ? { resource: latest } : {} });
     } catch (error) {
-      if (Date.now() >= deadline) throw timedOut();
       if (error instanceof ApiError) error.context = { ...context, ...error.context };
       throw error;
     }
     if (latest?.rentalId) context.rentalId = latest.rentalId;
     if (latest?.deploymentId) context.deploymentId = latest.deploymentId;
     if (done(latest)) return latest;
-    await new Promise((resolve2) => setTimeout(resolve2, Math.max(0, Math.min(1e3, deadline - Date.now()))));
+    await new Promise((resolve3) => setTimeout(resolve3, Math.max(0, Math.min(1e3, deadline - Date.now()))));
   }
 }
 
@@ -890,7 +930,7 @@ function buildProgram(options = {}) {
     return new UkiyoClient({ baseUrl, ...token ? { token } : {} });
   };
   const print = (value) => out(JSON.stringify(safeOutput(value), null, 2));
-  const program = new Command().name("ukiyo").description("Manage Ukiyo compute through the public API").version("0.3.0").configureOutput({ writeErr: () => {
+  const program = new Command().name("ukiyo").description("Manage Ukiyo compute through the public API").version("0.3.1").configureOutput({ writeErr: () => {
   } }).exitOverride();
   const machine = program.command("machine").description("Wallet-paid compute with no prior Ukiyo account; requires local signer config and explicit spend caps");
   const machineClient = () => {
@@ -941,11 +981,12 @@ function buildProgram(options = {}) {
   topup.command("status").requiredOption("--topup-id <id>").option("--json").description("Inspect funding; pending means do not pay again").action(async (opts) => print(await client().topupStatus(opts.topupId)));
   program.command("rent").option("--offer <id>").option("--gpu <name>").option("--count <count>").option("--budget <usd>", "required for fixed-prepaid accounts; optional for account-balance billing").option("--max-hourly-price <usd>", "GPU/count accepted hourly ceiling; reuse the same ceiling on retries").option("--idempotency-key <key>", "unique per intended rental; reuse with original parameters on retries").option("--json").option("--wait").option("--timeout <seconds>", "maximum status wait", "600").action(async (opts) => {
     const seconds = timeoutSeconds(opts.timeout);
+    const deadline = Date.now() + seconds * 1e3;
     const budget = opts.budget === void 0 ? void 0 : dollarsToMinor(opts.budget);
     if (Boolean(opts.offer) === Boolean(opts.gpu) || opts.offer && (opts.count || opts.maxHourlyPrice)) throw new ApiError(0, "INVALID_USAGE", "Choose --offer OR --gpu with optional --count and hourly ceiling.", null);
     const api = client();
     if (budget === void 0) {
-      const account = await api.me();
+      const account = await (opts.wait ? beforeDeadline((signal) => api.me(signal), deadline, {}) : api.me());
       if (account.billing?.model !== "ACCOUNT_BALANCE" || account.billing.budgetRequired !== false) {
         throw new ApiError(0, "INVALID_USAGE", "--budget is required for this account. Budget-free rentals require account-balance billing.", null);
       }
@@ -965,9 +1006,10 @@ function buildProgram(options = {}) {
     const idempotencyKey = opts.idempotencyKey ?? randomUUID3();
     const context = { ...intent ?? { offerId: opts.offer, ...budgetFields }, idempotencyKey };
     try {
-      const rental = await (intent ? api.rentGpu(intent, idempotencyKey) : api.rent(opts.offer, budget, idempotencyKey));
+      const create = (signal) => intent ? api.rentGpu(intent, idempotencyKey, signal) : api.rent(opts.offer, budget, idempotencyKey, signal);
+      const rental = await (opts.wait ? beforeDeadline(create, deadline, context) : create());
       Object.assign(context, { rentalId: rental.rentalId, deploymentId: rental.deploymentId });
-      const result = opts.wait && !["ACTIVE", "FAILED", "TERMINATED"].includes(rental.status) ? await waitFor((signal) => api.rental(rental.rentalId, signal), (value) => ["ACTIVE", "FAILED", "TERMINATED"].includes(value.status), seconds, context) : rental;
+      const result = opts.wait && !["ACTIVE", "FAILED", "TERMINATED"].includes(rental.status) ? await waitFor((signal) => api.rental(rental.rentalId, signal), (value) => ["ACTIVE", "FAILED", "TERMINATED"].includes(value.status), seconds, context, deadline) : rental;
       print({ ...result, ...context });
       if (opts.wait && result.status !== "ACTIVE") process.exitCode = 1;
     } catch (error) {
@@ -984,23 +1026,32 @@ function buildProgram(options = {}) {
   program.command("exec <id> <command...>").option("--json").option("--timeout <seconds>", "command timeout", "60").description("Execute a command over authenticated SSH (first host key is pinned locally)").action(async (id, command, opts) => {
     const seconds = timeoutSeconds(opts.timeout);
     const access = await client().credentials(id);
-    const result = await executeSsh(id, access, command, seconds);
-    print({ deploymentId: id, ...result });
+    const result = await executeSsh(access.deploymentId ?? id, access, command, seconds);
+    print({ deploymentId: access.deploymentId ?? id, rentalId: access.rentalId, ...result });
     if (result.exitCode) process.exitCode = 1;
   });
   program.command("offers").option("--json").option("--gpu <name>").option("--count <count>").description("List available compute").action(async (opts) => print(filteredOffers(await client().offers(), opts.gpu, opts.count)));
   program.command("list").option("--json").description("List your deployments").action(async () => print(await client().deployments()));
   program.command("status <id>").option("--json").description("Show one deployment").action(async (id) => print(await client().deployment(id)));
-  program.command("credentials <id>").option("--json").description("Reveal SSH access; response contains a private key and is audited server-side. Prefer ukiyo exec, which uses the key without printing it. Do not redirect into a file or shared transcript. CLI output redacts private keys.").addHelpText("after", "\nThe API response contains a private key and each reveal is audited server-side. Prefer ukiyo exec, which uses the key without printing it. Do not redirect this command into a file or shared transcript.").action(async (id) => print(await client().credentials(id)));
+  program.command("credentials <id>").option("--json").option("--save-key <path>", "save a private SSH key securely without printing it").option("--reveal", "explicitly print the private key; audited and unsafe for shared transcripts").description("Audited SSH connection metadata; private keys are redacted by default. Prefer exec or --save-key.").action(async (id, opts) => {
+    if (opts.saveKey && opts.reveal) throw new ApiError(0, "INVALID_USAGE", "Choose --save-key or --reveal, not both.", null);
+    const access = await client().credentials(id);
+    if (opts.saveKey) print(saveSshKey(opts.saveKey, access));
+    else if (opts.reveal) {
+      console.error("WARNING: credential reveal is audited. This output contains a private key; do not share or log it.");
+      out(JSON.stringify(access, null, 2));
+    } else print(access);
+  });
   program.command("deploy").description("Rent an offer").requiredOption("--offer <id>").requiredOption("--budget <usd>", "budget in dollars, e.g. 20 or 19.99").action(async (opts) => print(await client().checkout(opts.offer, dollarsToMinor(opts.budget), randomUUID3())));
   program.command("terminate <id>").option("--json").option("--wait").option("--timeout <seconds>", "maximum termination wait", "600").description("Terminate a deployment. This is irreversible.").option("--yes", "skip the confirmation prompt").action(async (id, opts) => {
     const seconds = timeoutSeconds(opts.timeout);
     if (!opts.yes) throw new ApiError(0, "CONFIRMATION_REQUIRED", `Terminating ${id} is irreversible and destroys anything on the instance. Re-run with --yes to confirm.`, null);
     const api = client();
     try {
-      const accepted = await api.terminate(id);
-      const value = opts.wait ? await waitFor((signal) => api.deployment(id, signal), (value2) => value2.status === "TERMINATED", seconds, { deploymentId: id }) : accepted;
-      print({ ...value, deploymentId: id });
+      const deadline = Date.now() + seconds * 1e3;
+      const accepted = await (opts.wait ? beforeDeadline((signal) => api.terminate(id, signal), deadline, { deploymentId: id }) : api.terminate(id));
+      const value = opts.wait ? await waitFor((signal) => api.deployment(id, signal), (value2) => value2.status === "TERMINATED", seconds, { deploymentId: id, ...accepted }, deadline) : accepted;
+      print({ deploymentId: id, ...value });
     } catch (error) {
       contextError(error, { deploymentId: id });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ukiyocompute/cli",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "main": "./dist/library.js",
   "exports": {
@@ -18,8 +18,7 @@
     "node": ">=24"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "repository": {
     "type": "git",