@scp-dev/cli 0.0.0-stage → 0.1.2

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,34 @@
-# Temporary Holding Version
+# @scp-dev/cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The `swarm` command line tool, the reference binding of SCP for shells, hooks and MCP.
+
+```sh
+npm install -g @scp-dev/cli
+```
+
+## Usage
+
+```sh
+swarm login
+swarm setup --write
+swarm spawn --name parser -- claude "Fix the parser tests"
+swarm send parser "Also cover the empty-input case."
+swarm list --tree
+swarm inbox --wait 30
+```
+
+Headless (CI, cron, cloud runners): `swarm login --token scp_t_...` or `SCP_TOKEN`. `swarm up --token ...` logs in, links the broker to the hub and runs setup in one step. The default relay is https://app.scp.dev; `swarm relay use <url>` picks another. Runs on Node 22.13 or later.
+
+## Provides
+
+- Messaging: `send`, `reply`, `ask`, `inbox`, `ack`.
+- Spawn and supervision: `spawn`, `spawn-env`, `peek`.
+- Scopes and policy: `rules`, `why`, `group`, `admin`, `policy`, `holds`.
+- Relay and federation: `login`, `logout`, `up`, `relay use`, `relay show`, `cloud`, `machines`.
+- Integration: `daemon`, `mcp`, `hooks install`, `setup`, `hook`.
+
+Implements [Appendix E, CLI verbs](https://scp.dev/spec#appendix-e-reference-binding-cli-verbs) and [Appendix F, MCP tools](https://scp.dev/spec#appendix-f-reference-binding-mcp-tools). See the [root README](https://github.com/scphq/scp#readme).
+
+## License
+
+[Apache-2.0](LICENSE).

package/dist/chunk-4DNQFATX.js

@@ -0,0 +1,221 @@
+import {
+  RelayUsage
+} from "./chunk-7KP6TAJW.js";
+import {
+  AGY_HOOK_SET,
+  AGY_UNVERIFIED,
+  BLOCK_STOP,
+  PUSH_WAIT,
+  PUSH_WAIT_DEFAULT_S,
+  agyHookSet,
+  hasOurHooks,
+  hookEntries,
+  mergeHooks,
+  musePlugin,
+  opencodePlugin
+} from "./chunk-XWLF7ON2.js";
+import {
+  gitToplevel
+} from "./chunk-DA3EB2YF.js";
+
+// src/install.ts
+import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { basename, dirname, join } from "path";
+import { CLI_NAME, LIMITS, validHandle } from "@scp-dev/core";
+function home(env) {
+  return env.HOME || homedir();
+}
+function hooksTarget(harness, scope, env, cwd) {
+  const project = gitToplevel(cwd) ?? cwd;
+  switch (harness) {
+    case "claude":
+      if (scope === "local") return join(project, ".claude", "settings.local.json");
+      return scope === "user" ? join(env.CLAUDE_CONFIG_DIR || join(home(env), ".claude"), "settings.json") : join(project, ".claude", "settings.json");
+    case "codex":
+      return scope === "user" ? join(env.CODEX_HOME || join(home(env), ".codex"), "hooks.json") : join(project, ".codex", "hooks.json");
+    case "opencode":
+      return scope === "user" ? join(env.XDG_CONFIG_HOME || join(home(env), ".config"), "opencode", "plugin", "scp.ts") : join(project, ".opencode", "plugin", "scp.ts");
+    case "agy":
+      return scope === "user" ? join(home(env), ".gemini", "config", "hooks.json") : join(project, ".agents", "hooks.json");
+    case "muse":
+      return join(env.XDG_CONFIG_HOME || join(home(env), ".config"), "scp", "muse-plugin", ".muse-plugin", "plugin.json");
+  }
+}
+function stamp(now) {
+  const pad = (n) => String(n).padStart(2, "0");
+  return `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+}
+function writeAtomic(target, content, now) {
+  const file = existsSync(target) && lstatSync(target).isSymbolicLink() ? realpathSync(target) : target;
+  const existing = existsSync(file) ? readFileSync(file, "utf8") : void 0;
+  if (existing === content) return { changed: false };
+  mkdirSync(dirname(file), { recursive: true });
+  let backup;
+  let mode = 420;
+  if (existing !== void 0) {
+    mode = statSync(file).mode & 4095;
+    const stamped = `${file}.bak-${stamp(now)}`;
+    backup = stamped;
+    for (let n = 2; existsSync(backup); n++) backup = `${stamped}-${n}`;
+    copyFileSync(file, backup);
+    chmodSync(backup, mode);
+  }
+  const temp = join(dirname(file), `.${basename(file)}.tmp-${process.pid}`);
+  try {
+    writeFileSync(temp, content, { mode });
+    renameSync(temp, file);
+  } catch (error) {
+    try {
+      unlinkSync(temp);
+    } catch {
+    }
+    throw error;
+  }
+  return { changed: true, ...backup ? { backup } : {} };
+}
+function installHooks(options) {
+  if (options.env.SCP_TRANSPORT === "cloud") {
+    throw new RelayUsage(
+      `relay hooks report to the local broker, and SCP_TRANSPORT=cloud bypasses it; link the broker instead (${CLI_NAME} cloud enable) and install the hooks without it`
+    );
+  }
+  const harness = options.harness;
+  if (harness === "grok") {
+    throw new RelayUsage(
+      "Grok runs the Claude Code hooks (install those with --harness claude) and is labelled grok by them; it drops a prompt hook's context, so new messages reach it after tools only"
+    );
+  }
+  if (harness !== "claude" && harness !== "codex" && harness !== "opencode" && harness !== "agy" && harness !== "muse") {
+    throw new RelayUsage("hooks install takes --harness claude, codex, opencode, agy or muse");
+  }
+  const scope = options.scope ?? (harness === "claude" ? "local" : harness === "muse" ? "user" : "project");
+  if (scope !== "project" && scope !== "user" && !(scope === "local" && harness === "claude")) {
+    throw new RelayUsage("--scope is project or user (and local for claude, its default: .claude/settings.local.json, the per-person file)");
+  }
+  const target = hooksTarget(harness, scope, options.env, options.cwd);
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  if (options.pushWait !== void 0 && (!Number.isInteger(options.pushWait) || options.pushWait < 0 || options.pushWait > 3600)) {
+    throw new RelayUsage(`${PUSH_WAIT} takes whole seconds, 0 to 3600`);
+  }
+  const blockStop = { blockStop: options.blockStop === true, ...options.pushWait !== void 0 ? { pushWait: options.pushWait } : {} };
+  let content;
+  if (harness === "opencode") content = opencodePlugin({ blockStop: blockStop.blockStop });
+  else if (harness === "muse") content = `${JSON.stringify(musePlugin(blockStop), null, 2)}
+`;
+  else {
+    let settings = {};
+    if (options.write && existsSync(target)) {
+      try {
+        settings = JSON.parse(readFileSync(target, "utf8"));
+      } catch (error) {
+        throw new RelayUsage(`${target} is not valid JSON (${error instanceof Error ? error.message : String(error)}); fix it or add the hooks by hand`);
+      }
+    }
+    try {
+      if (harness === "agy") {
+        if (typeof settings !== "object" || settings === null || Array.isArray(settings)) throw new Error("the hooks file is not a JSON object");
+        content = `${JSON.stringify({ ...settings, [AGY_HOOK_SET]: agyHookSet({ blockStop: blockStop.blockStop }) }, null, 2)}
+`;
+      } else
+        content = `${JSON.stringify(options.write ? mergeHooks(settings, hookEntries(harness, blockStop)) : { hooks: hookEntries(harness, blockStop) }, null, 2)}
+`;
+    } catch (error) {
+      throw new RelayUsage(`${target}: ${error instanceof Error ? error.message : String(error)}; fix it or add the hooks by hand`);
+    }
+  }
+  const shared = harness === "claude" && scope === "local" ? hooksTarget("claude", "project", options.env, options.cwd) : void 0;
+  if (shared && hasOurHooks(shared)) {
+    options.out(`# ${shared} already runs the ${CLI_NAME} hooks; remove them there, or every event reports twice`);
+  }
+  if (!options.write) {
+    options.out(`# ${harness === "opencode" || harness === "muse" ? "the plugin file" : "merge into"} ${target} (or rerun with --write)`);
+    options.out(content.trimEnd());
+  } else {
+    const result = writeAtomic(target, content, now);
+    options.out(result.changed ? `wrote ${target}${result.backup ? ` (backup ${result.backup})` : ""}` : `${target} already has the ${CLI_NAME} hooks`);
+    if (result.changed) options.out("# restart sessions started before this install: harnesses read hooks only at session start");
+  }
+  for (const line of injectionNotes(harness, scope, target, options.blockStop === true, options.pushWait ?? PUSH_WAIT_DEFAULT_S)) options.out(`# ${line}`);
+  return 0;
+}
+function injectionNotes(harness, scope, target, blockStop, wait) {
+  const stop = `a stop names each request not yet answered once, and is held while a require_reply request waits (at most ${LIMITS.stopBlocks} times a session)`;
+  const held = `${stop}; ${blockStop ? `with ${BLOCK_STOP} it is also held while messages are unread` : `add ${BLOCK_STOP} to also hold it while messages are unread`}`;
+  const pushed = wait > 0 ? `while workers you started with ${CLI_NAME} spawn still run, a stop waits up to ${wait} s for their next message or handback and hands it to the model, which goes on (on by default, since spawning is explicit; ${PUSH_WAIT} 0 turns it off, SCP_PUSH_WAIT=<s> lowers it per session, 0 opts out); spawn itself returns at once without a terminal, so the model never backgrounds it` : `the stop never waits on workers started with ${CLI_NAME} spawn (${PUSH_WAIT} 0); ${PUSH_WAIT} <s> lets it wait for their next message`;
+  switch (harness) {
+    case "claude":
+      return [
+        `new relay messages reach the model after each tool call and with each prompt; ${held}`,
+        pushed,
+        "Grok runs these hooks too, but drops a prompt hook's context: it gets new messages after tools"
+      ];
+    case "codex":
+      return [
+        `new relay messages reach the model after each tool call and with each prompt; ${held}`,
+        pushed,
+        "Codex runs new hooks only after you review them in /hooks"
+      ];
+    case "agy":
+      return [
+        `agy reads nothing from a PostToolUse hook, so new relay messages go in before each model call (PreInvocation) as ephemeral steps; ${held}`,
+        AGY_UNVERIFIED
+      ];
+    case "opencode":
+      return [
+        "new relay messages are appended to tool results; a prompt gets only how many are unread",
+        `OpenCode has no stop hook: when the session goes idle, the plugin starts a new turn instead of holding a stop; ${held}`
+      ];
+    case "muse":
+      return [
+        `Muse loads hooks only from plugins: muse plugins install ${dirname(dirname(target))} --scope ${scope}`,
+        `new relay messages reach the model after each tool call and with each prompt; ${held}`,
+        pushed,
+        "Muse hands plugin hooks no SCP_* variables: they key the session by the harness process, so set no SCP_SESSION for Muse's shim"
+      ];
+  }
+}
+function shellWord(word) {
+  return /^[A-Za-z0-9._/=-]+$/.test(word) ? word : `'${word.replaceAll("'", "'\\''")}'`;
+}
+function mcpInstall(harness, as, out) {
+  if (as !== void 0 && !validHandle(as)) throw new RelayUsage(`--as ${JSON.stringify(as)} is not a valid agent handle`);
+  const tail = (extra) => [...extra, ...as ? ["--as", as] : []];
+  const args = (extra = []) => ["mcp", ...tail(extra)];
+  const line = (cli, extra = []) => out([...cli, CLI_NAME, ...args(extra)].map(shellWord).join(" "));
+  switch (harness) {
+    case "claude":
+      line(["claude", "mcp", "add", "scp", "--"]);
+      return 0;
+    case "codex":
+      line(["codex", "mcp", "add", "scp", "--"], ["--harness", "codex"]);
+      return 0;
+    case "grok":
+      line(["grok", "mcp", "add", "scp", "--"], ["--harness", "grok"]);
+      return 0;
+    case "opencode":
+      line(["opencode", "mcp", "add", "scp", "--"], ["--harness", "opencode"]);
+      out("# that writes OpenCode's global config; for one project, add this to its opencode.json instead:");
+      out(JSON.stringify({ mcp: { scp: { type: "local", command: [CLI_NAME, ...args(["--harness", "opencode"])], enabled: true } } }, null, 2));
+      return 0;
+    case "agy":
+      line(["agy", "mcp", "add", "scp", "--"], ["--harness", "agy"]);
+      out("# that always writes your user file ~/.gemini/config/mcp_config.json; for one project, add this to <repo>/.agents/mcp_config.json instead:");
+      out(JSON.stringify({ mcpServers: { scp: { command: CLI_NAME, args: args(["--harness", "agy"]) } } }, null, 2));
+      out(`# ${AGY_UNVERIFIED}`);
+      return 0;
+    case "muse":
+      out(
+        "# Muse has no mcp add: merge this into ~/.config/muse/settings.json (never add a mcp_servers key next to mcpServers, Muse then drops every MCP server)"
+      );
+      out(JSON.stringify({ mcpServers: { scp: { type: "stdio", command: CLI_NAME, args: args(["--harness", "muse"]), mode: "optional" } } }, null, 2));
+      return 0;
+  }
+  throw new RelayUsage("mcp install takes --harness claude, codex, opencode, grok, muse or agy");
+}
+
+export {
+  hooksTarget,
+  installHooks,
+  mcpInstall
+};

package/dist/chunk-4QYUPPGV.js

@@ -0,0 +1,147 @@
+import {
+  RelayUsage
+} from "./chunk-7KP6TAJW.js";
+import {
+  note
+} from "./chunk-DA3EB2YF.js";
+
+// src/relay.ts
+import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "fs";
+import { join, dirname } from "path";
+import { randomUUID } from "crypto";
+import { CLI_NAME } from "@scp-dev/core";
+var DEFAULT_RELAY = "https://app.scp.dev";
+function configDir(env = process.env) {
+  const base = env.XDG_CONFIG_HOME || (env.HOME ? join(env.HOME, ".config") : void 0);
+  if (!base) throw new RelayUsage("neither XDG_CONFIG_HOME nor HOME is set, so there is no place for the relay configuration");
+  return join(base, "scp");
+}
+function checkRelayUrl(text, what = "relay URL") {
+  let url;
+  try {
+    url = new URL(text);
+  } catch {
+    throw new RelayUsage(`${what} must be an absolute https URL (http is allowed only for localhost)`);
+  }
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname)) || url.username || url.password) {
+    throw new RelayUsage(`${what} must be an absolute https URL without credentials (http is allowed only for localhost)`);
+  }
+  return url.origin;
+}
+function readObject(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw new RelayUsage(`could not read ${path}`);
+  }
+  try {
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
+    return value;
+  } catch {
+    throw new RelayUsage(`${path} must contain a JSON object`);
+  }
+}
+function writePrivateJson(path, value) {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  chmodSync(dir, 448);
+  const temp = join(dir, `.${randomUUID()}.tmp`);
+  try {
+    writeFileSync(temp, `${JSON.stringify(value, null, 2)}
+`, { mode: 384, flag: "wx" });
+    chmodSync(temp, 384);
+    renameSync(temp, path);
+  } finally {
+    rmSync(temp, { force: true });
+  }
+}
+function activeRelay(env = process.env) {
+  if (env.SCP_RELAY !== void 0) return { url: checkRelayUrl(env.SCP_RELAY, "$SCP_RELAY"), source: "SCP_RELAY" };
+  const path = join(configDir(env), "config.json");
+  const config = readObject(path);
+  if (config?.relay !== void 0) {
+    if (typeof config.relay !== "string") throw new RelayUsage(`relay in ${path} must be a URL`);
+    return { url: checkRelayUrl(config.relay, `relay in ${path}`), source: "config" };
+  }
+  return { url: DEFAULT_RELAY, source: "default" };
+}
+function readCredentials(env = process.env) {
+  const path = join(configDir(env), "credentials.json");
+  const entries = readObject(path) ?? {};
+  for (const entry of Object.values(entries)) {
+    if (!entry || typeof entry !== "object" || typeof entry.token !== "string" || !entry.token.trim() || typeof entry.saved_at !== "string") {
+      throw new RelayUsage(`${path} contains an invalid credential`);
+    }
+  }
+  return entries;
+}
+function saveCredential(env, origin, credential) {
+  const url = checkRelayUrl(origin);
+  writePrivateJson(join(configDir(env), "credentials.json"), { ...readCredentials(env), [url]: { ...credential, saved_at: (/* @__PURE__ */ new Date()).toISOString() } });
+}
+function removeCredential(env, origin) {
+  const entries = readCredentials(env);
+  const url = checkRelayUrl(origin);
+  if (!Object.hasOwn(entries, url)) return false;
+  delete entries[url];
+  writePrivateJson(join(configDir(env), "credentials.json"), entries);
+  return true;
+}
+function relayCredential(env, origin) {
+  const token = env.SCP_TOKEN?.trim();
+  if (token) return { token, source: "SCP_TOKEN", problem: null };
+  const stored = readCredentials(env)[checkRelayUrl(origin)];
+  if (stored) return { token: stored.token, source: "credentials", problem: null };
+  return { token: null, source: null, problem: `no login for ${origin}: run ${CLI_NAME} login, or set SCP_TOKEN` };
+}
+function relayVerb(positionals, asJson, env = process.env) {
+  const [action, text] = positionals;
+  if (action === "use" && text !== void 0 && positionals.length === 2) {
+    const url = checkRelayUrl(text);
+    writePrivateJson(join(configDir(env), "config.json"), { relay: url });
+    if (asJson) console.log(JSON.stringify({ url }));
+    else console.log(`saved relay ${url}`);
+    if (env.SCP_RELAY !== void 0) note("$SCP_RELAY still selects the active relay");
+    return 0;
+  }
+  if (action === "show" && positionals.length === 1) {
+    const relay = activeRelay(env);
+    const credential = relayCredential(env, relay.url);
+    const result = { ...relay, credential: credential.token ? "found" : "missing", credential_source: credential.source };
+    if (asJson) console.log(JSON.stringify(result));
+    else console.log(`${relay.url} (${relay.source}); credential ${result.credential}${credential.source ? ` (${credential.source})` : ""}`);
+    return 0;
+  }
+  throw new RelayUsage(`${CLI_NAME} relay takes use <url> or show`);
+}
+async function loginMain(positionals, values) {
+  if (positionals.length) throw new RelayUsage(`${CLI_NAME} login takes only flags`);
+  return (await import("./login-JTRUWG6Q.js")).login(values);
+}
+function logoutMain(positionals, asJson, env = process.env) {
+  if (positionals.length) throw new RelayUsage(`${CLI_NAME} logout takes no arguments`);
+  const { url } = activeRelay(env);
+  const removed = removeCredential(env, url);
+  if (asJson) console.log(JSON.stringify({ url, removed, env_token: !!env.SCP_TOKEN?.trim() }));
+  else console.log(removed ? `logged out of ${url}` : `no stored login for ${url}`);
+  if (env.SCP_TOKEN?.trim()) note("$SCP_TOKEN still applies");
+  return 0;
+}
+
+export {
+  DEFAULT_RELAY,
+  configDir,
+  checkRelayUrl,
+  writePrivateJson,
+  activeRelay,
+  readCredentials,
+  saveCredential,
+  removeCredential,
+  relayCredential,
+  relayVerb,
+  loginMain,
+  logoutMain
+};