@scam-ai/cli 0.1.0

package/README.md

@@ -0,0 +1,20 @@
+# @scam-ai/cli
+
+Check a photo, video or audio file for AI generation or manipulation from the terminal.
+
+```
+npx @scam-ai/cli check photo.jpg
+```
+
+```
+export SCAMAI_API_KEY=sk_...        # from app.scam.ai → API keys
+
+scamai check <file> [--json]   verdict, score, credits used
+scamai balance                 credits remaining
+scamai usage [--limit N]       credit movements, newest first
+scamai history                 past detection runs
+scamai keys                    your API keys, masked
+scamai whoami                  who this key belongs to
+```
+
+Formats: JPG, PNG, WEBP · MP4, MOV, WEBM · MP3, WAV, M4A, FLAC, OGG, AAC. Anything else is refused. Built on [`@scam-ai/sdk`](https://www.npmjs.com/package/@scam-ai/sdk); API reference at https://scam.ai/docs.

package/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "@scam-ai/cli",
+  "version": "0.1.0",
+  "description": "scamai — command line client for the ScamAI detection platform, built on @scam-ai/sdk.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "scamai": "./scamai.mjs"
+  },
+  "files": [
+    "scamai.mjs",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "//dependencies": "@scam-ai/sdk is the REGISTRY version, not file:../sdk/typescript — a file: link survives npm pack and only fails on the customer's machine (see mcp/package.json).",
+  "dependencies": {
+    "@scam-ai/sdk": "^0.1.2"
+  }
+}

package/scamai.mjs

@@ -0,0 +1,216 @@
+#!/usr/bin/env node
+/**
+ * scamai — command line client.
+ *
+ * Same contract as everything else: your API key, the documented routes, the
+ * same credit gate. It adds no pricing path and no privileged endpoint of its
+ * own — anything this can do, curl can do; it just makes the common things
+ * one line.
+ *
+ *   export SCAMAI_API_KEY=sk_...
+ *   export SCAMAI_API_BASE=https://api.scam.ai   # default
+ *
+ *   scamai check ./photo.jpg          # detect ANY media, prints the verdict
+ *   scamai check ./clip.mp4 --json    # same, as machine-readable JSON
+ *   scamai balance                    # credits remaining
+ *   scamai usage --limit 10           # recent credit movements
+ *   scamai history                    # past detection runs
+ *   scamai keys                       # list API keys (masked)
+ *   scamai whoami                     # who this key belongs to
+ *
+ * Built on @scam-ai/sdk — the same client the MCP server uses, so the CLI can
+ * never disagree with it about routes, errors or retry rules.
+ *
+ * Credits, never dollars. It used to multiply by a hard-coded $0.04 — double
+ * the $0.02 the dashboard sells a credit at — so `scamai balance` and the
+ * Billing page disagreed about the same account by a factor of two. The API
+ * states no dollar price (`usage.pricing()` returns the per-check credit
+ * table, not a rate), so there is nothing honest to multiply by: what a
+ * credit costs is on the Billing page.
+ */
+import { existsSync } from "node:fs";
+import { basename } from "node:path";
+import {
+  ScamAI,
+  AuthError,
+  ScopeError,
+  CreditsError,
+  RateLimitError,
+  UnprocessableError,
+  ConnectionError,
+  TimeoutError,
+} from "@scam-ai/sdk";
+
+const BASE = (process.env.SCAMAI_API_BASE || "https://api.scam.ai").replace(/\/$/, "");
+
+const c = {
+  dim: (s) => `\x1b[2m${s}\x1b[0m`,
+  bold: (s) => `\x1b[1m${s}\x1b[0m`,
+  red: (s) => `\x1b[31m${s}\x1b[0m`,
+  green: (s) => `\x1b[32m${s}\x1b[0m`,
+  amber: (s) => `\x1b[33m${s}\x1b[0m`,
+};
+
+const credits = (n) => `${n} credit${n === 1 ? "" : "s"}`;
+
+function die(msg, hint) {
+  console.error(`${c.red("✗")} ${msg}`);
+  if (hint) console.error(`  ${c.dim(hint)}`);
+  process.exit(1);
+}
+
+function client() {
+  if (!process.env.SCAMAI_API_KEY) {
+    die("SCAMAI_API_KEY is not set.", "Create a key under Dashboard → API keys, then export it.");
+  }
+  return new ScamAI({ baseUrl: BASE });
+}
+
+/** The two errors people actually hit get their own sentence; the rest stay honest. */
+function explain(e) {
+  if (e instanceof CreditsError) {
+    die(`Out of credits — balance ${e.balance ?? "?"}.`, "Top up under Dashboard → Billing, then retry.");
+  }
+  if (e instanceof AuthError) die("Unauthorized — the key was rejected.", "Check SCAMAI_API_KEY, or create a new key.");
+  if (e instanceof ScopeError) die(e.message, "This key's scope can't call that. Use a universal key.");
+  if (e instanceof RateLimitError) {
+    die("Rate limited.", e.retryAfterSeconds ? `Retry in ${e.retryAfterSeconds}s.` : "Back off and retry.");
+  }
+  if (e instanceof UnprocessableError) {
+    const codes = e.reasons.map((r) => r?.code ?? r).join(", ");
+    die(`The platform could not judge this file${codes ? ` (${codes})` : ""}.`, "That is an answer, not an outage — a different file may score.");
+  }
+  if (e instanceof TimeoutError) die("Timed out waiting.", "The run may still have completed AND been billed — check `scamai history` before retrying.");
+  if (e instanceof ConnectionError) die(`Could not reach ${BASE}`, "Is SCAMAI_API_BASE correct?");
+  die(e.message ?? String(e));
+}
+
+/* ------------------------------------------------------------ commands */
+
+async function check(file, { json = false } = {}) {
+  if (!file) die("Usage: scamai check <file> [--json]");
+  if (!existsSync(file)) die(`No such file: ${file}`);
+
+  if (!json) process.stderr.write(c.dim(`checking ${basename(file)}…\n`));
+  const det = await client().detect(file);
+
+  if (json) {
+    console.log(JSON.stringify(det, null, 2));
+    return;
+  }
+
+  /* Three tiers, one fall-through. An unrecognised verdict paints as the
+     alerting one on purpose: the safe direction to be wrong is loud. */
+  const TIER = {
+    LIKELY_REAL: c.green("✓ LIKELY REAL"),
+    ALERT: c.amber("? ALERT"),
+    LIKELY_AI: c.red("! LIKELY AI"),
+    /* What a gateway answered before 2026-09-14, for a CLI pointed at one. */
+    LIKELY_AUTHENTIC: c.green("✓ LIKELY REAL"),
+    SUSPICIOUS: c.amber("? ALERT"),
+    LIKELY_AI_MANIPULATED: c.red("! LIKELY AI"),
+  };
+  const verdict = TIER[det.verdict] ?? c.red(`! ${String(det.verdict ?? "UNKNOWN")}`);
+
+  console.log(`\n  ${verdict}  ${c.dim(`(${det.media?.type ?? "media"})`)}`);
+  if (det.summary) console.log(`  ${det.summary}`);
+  /* `score` is the envelope's one number (0–1, null when nothing scored). This
+     read `confidence`, which the 2026-09-15 envelope no longer carries, and
+     printed a dash for every run. */
+  console.log(`  ${c.dim("score")}       ${typeof det.score === "number" ? det.score.toFixed(2) : "—"}`);
+  console.log(`  ${c.dim("model")}       ${det.model ?? "unknown"}`);
+  /* What the ledger was debited for this run, as the API reported it. */
+  const charged = typeof det.credits_used === "number" ? credits(det.credits_used) : "not reported";
+  const why = det.zero_charge_reason ? c.dim(` (${det.zero_charge_reason})`) : "";
+  console.log(`  ${c.dim("cost")}        ${charged}${why}`);
+  console.log(`\n  ${c.dim("AI isn't always right. Verify important results.")}\n`);
+}
+
+async function balance() {
+  const b = await client().account.balance();
+  console.log(`\n  ${c.bold(String(b))} credits\n`);
+  if (b <= 0) console.log(`  ${c.amber("Out of credits.")} Top up under Dashboard → Billing.\n`);
+}
+
+async function usage(limit = 20) {
+  const { entries = [], pagination } = await client().account.ledger({ limit });
+  if (!entries.length) return console.log(`\n  ${c.dim("No credit movements yet.")}\n`);
+  console.log("");
+  for (const e of entries) {
+    const sign = e.delta >= 0 ? c.green(`+${e.delta}`) : c.red(String(e.delta));
+    const when = new Date(e.created_at).toISOString().slice(0, 16).replace("T", " ");
+    console.log(`  ${c.dim(when)}  ${sign.padStart(14)}  ${e.reason}  ${c.dim(e.ref ?? "")}`);
+  }
+  console.log(`\n  ${c.dim(`${entries.length} of ${pagination?.total ?? entries.length} entries`)}\n`);
+}
+
+async function history() {
+  const { history: rows = [] } = await client().history.list({ limit: 20 });
+  if (!rows.length) return console.log(`\n  ${c.dim("No detections yet. Try: scamai check ./photo.jpg")}\n`);
+  console.log("");
+  for (const d of rows.slice(0, 20)) {
+    const when = String(d.createdAt ?? d.created_at ?? "").slice(0, 16).replace("T", " ");
+    /* The charge the run recorded; a row that records none says so. */
+    const cost = typeof d.credits_used === "number" ? credits(d.credits_used) : "cost not recorded";
+    console.log(`  ${c.dim(when)}  ${d.serviceType ?? d.service_type ?? ""}  ${c.dim(cost)}  ${d.success === false ? c.red("failed") : ""}`);
+  }
+  console.log("");
+}
+
+async function keys() {
+  const list = await client().keys.list();
+  if (!list.length) return console.log(`\n  ${c.dim("No active keys.")}\n`);
+  console.log("");
+  for (const k of list) {
+    const scope = k.isUniversal ? "universal" : (k.serviceType ?? "scoped");
+    console.log(`  ${(k.name || "(unnamed)").padEnd(20)} ${c.dim(k.keyPreview ?? "")}  ${c.dim(scope)}`);
+  }
+  console.log(`\n  ${c.dim("Full keys are shown once, at creation — they are hashed at rest.")}\n`);
+}
+
+async function whoami() {
+  const u = await client().account.profile();
+  console.log(`\n  ${c.bold(u.email ?? "unknown")}  ${c.dim(u.tier ?? "")}\n`);
+}
+
+function help() {
+  console.log(`
+  ${c.bold("scamai")} — detect AI-generated and manipulated media
+
+  ${c.dim("USAGE")}
+    scamai check <file> [--json]   Check a photo, video or audio file
+    scamai balance                 Credits remaining
+    scamai usage [--limit N]       Credit movements, newest first
+    scamai history                 Past detection runs
+    scamai keys                    Your API keys (masked)
+    scamai whoami                  Who this key belongs to
+
+  ${c.dim("SETUP")}
+    export SCAMAI_API_KEY=sk_...
+    export SCAMAI_API_BASE=${BASE}
+`);
+}
+
+/* --------------------------------------------------------------- main */
+const [cmd, ...rest] = process.argv.slice(2);
+const flag = (name, fallback) => {
+  const i = rest.indexOf(`--${name}`);
+  return i >= 0 ? rest[i + 1] : fallback;
+};
+const hasFlag = (name) => rest.includes(`--${name}`);
+
+const commands = {
+  check: () => check(rest.find((a) => !a.startsWith("--")), { json: hasFlag("json") }),
+  balance,
+  usage: () => usage(Number(flag("limit", 20))),
+  history,
+  keys,
+  whoami,
+  help,
+};
+
+try {
+  await (commands[cmd] ?? help)();
+} catch (e) {
+  explain(e);
+}