Same /v1 surface as curl. Both packages are on public npm under the @ysaere scope — MIT licensed, zero runtime dependencies, and published straight from CI with build provenance you can verify.
Published as @ysaere/cli. Commands: balance, run, pricing, status, wait, report, verify. Requires Node 20+. There is deliberately no --api-key flag — the key is read from the environment only, so it never lands in your shell history.
npm install -g @ysaere/cli export YSAERE_API_KEY=ysa_prod_YOUR_KEY ysaere balance ysaere run angel "Acme Robotics" ysaere wait RUN_ID ysaere report RUN_ID --format md ysaere verify RUN_ID
Sandbox: set YSAERE_ALLOW_SANDBOX=1 with a ysa_test key (mock runs, $0).
Published as @ysaere/sdk — a typed /v1 client. ESM only, Node 20+. The client refuses to send your API key over plain HTTP to a non-loopback host, and only requests that cannot double-charge are retried.
npm install @ysaere/sdk
import { YsaereClient } from '@ysaere/sdk'
const client = YsaereClient.fromEnv()
const { run } = await client.run('angel', 'Acme Robotics')
const report = await client.waitForReport(run.run_id)
const provenance = await client.getProvenance(run.run_id)
Both packages are published from GitHub Actions via OIDC trusted publishing, so every release carries a signed provenance attestation linking the tarball to the exact commit and workflow that built it. Source is public and MIT licensed.