mycomesh-relay 0.1.7 → 0.6.1

package/README.md

@@ -1,33 +1,19 @@
 # mycomesh-relay
 
-The MycoMesh Relay installer is a small Node.js launcher around the repository's
-Docker Compose Relay runtime. It downloads a pinned checkout, opens the
-loopback browser onboarding wizard, and then runs `make relay-start`.
-
-## Install
+Run an independent MycoMesh V11 Relay. Like a Bitcoin node, it needs no domain
+name and no certificate authority: its self-signed TLS certificate is pinned in
+the on-chain Relay directory, and every Consumer and Provider checks the pin.
+Requires Node.js 20+, Docker, and ports 10443 and 10991 open.
 
 ```sh
 npm install --global mycomesh-relay
-mycomesh-relay
+mycomesh-relay init            # owner + signer keys, self-signed certificate for this machine's public IP
+mycomesh-relay register        # bind the signer, fund probes, announce the pinned endpoints on-chain
+mycomesh-relay start --with-keeper
+mycomesh-relay status
+mycomesh-relay earnings        # the Relay's share of every fee it dispatched
 ```
 
-The wizard asks for a public payout address, maximum concurrent sessions and an
-optional usage limit. It never accepts an EVM private key, seed phrase, OAuth
-credential or API key. If on-screen browser opening is unavailable, use
-`--no-browser` and open the printed loopback URL yourself.
-
-```sh
-mycomesh-relay --ref <reviewed-commit> --no-browser
-```
-
-Docker Engine, Docker Compose V2 and GNU Make are still required. The npm
-package is only the onboarding launcher; the Relay remains Docker-backed.
-
-Settlement configuration is deliberately separate. Put the protected Relay
-transaction signer and the public contract/RPC settings in the checkout's
-`.env.deploy` according to the operator documentation. The public payout
-address entered in the wizard is not the gas-funded transaction identity.
-
-Use `--no-start` to download a checkout without starting it, and
-`--source-dir /srv/mycomesh` to choose a persistent location. Keep the checkout
-and named Docker volumes for upgrades; do not run `docker compose down -v`.
+Once announced, Providers join the Relay automatically and Consumers discover it
+from the chain. The Relay probes its Providers with free known-answer requests,
+records re-gradable verdicts in the probe ledger, and helps run Provider-AI juries.

package/bin/mycomesh-relay.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { main } from "../src/cli.mjs";
+
+main().then((code) => { if (typeof code === "number") process.exitCode = code; }).catch((error) => {
+  process.stderr.write(`mycomesh-relay: ${error.message}\n`);
+  process.exitCode = 1;
+});

package/networks/mycomesh-testnet-ca.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEKTCCApGgAwIBAgIUDwYNmg71zXD2ycqGMXfAmTtb9E8wDQYJKoZIhvcNAQEL
+BQAwKzEpMCcGA1UEAwwgTXljb01lc2ggSVAgdGVzdG5ldCBkZWRpY2F0ZWQgQ0Ew
+HhcNMjYwOTE1MDM0NjQ3WhcNMjcwOTE1MDM1NjQ3WjArMSkwJwYDVQQDDCBNeWNv
+TWVzaCBJUCB0ZXN0bmV0IGRlZGljYXRlZCBDQTCCAaIwDQYJKoZIhvcNAQEBBQAD
+ggGPADCCAYoCggGBAKSXx/8p203JtQSav+7wt7xYfWURFe0DQODb3XNIc2YFe7j4
+HDEiL47sDpBd4JY9NELjzA47vIRkRdLlfit5JKWy1+ozzlJ6G2qs9o3vFK+Xho8K
+8D8Q6hXCUaaKPFAg6vONH0OHnCMaWmq+3gKzdgId1ci4QopjAVvaxUj/CcpFVl1E
+JdGjVhj+SVWE/fKb5Ullbw6UIhjpAbH4BmsOHJLfPJuw94lFWHgCJgcMWF8qxeTU
+fL4Kwp6hUAgH0BOiD4NsNTn4lIFnqwzb+Cu6vqSdd/poTOMvKj7sjl+tZdphtCB5
+DOZr066mAKlY91goM1BUD2y8ozBiDDUmJSeGp3eUy8Iuch2A9sEupDpt0z/cvs2W
+BXqJdbvVEMY+TFVRPkSmG2FfnWvzoHx5QD7o4dYLIrN/nD5y44NypAdpR1n1IHs0
+8EF1Lae80FHM3Jwt3mLqnhAvwKqMfAr71gFxolbLhO/O2RWd11UuBIy/ORsXFUGB
+d/JurXmMC9kajoeg4wIDAQABo0UwQzASBgNVHRMBAf8ECDAGAQH/AgEAMA4GA1Ud
+DwEB/wQEAwIBBjAdBgNVHQ4EFgQUr/zADf47qEsS1yVwDgx6CvjN/5kwDQYJKoZI
+hvcNAQELBQADggGBAHnJExIh4oxx8xkLsNVKb6hQyM6814wP6gUmLLUAZXfu6LV1
+PoiMoeUWLd02JocyGLJnVmBgUFJHab16GUEwldYNBvnaeycrpQXP/Bu9Kl6Tr2Ku
+Efv8veCY+tj6GWgv/HkRGrvdn6LPhVE84zvrkLthwn262FxPqeb1dt/RkgrDBPKL
+YEN2QG8uyo10YSQm7jgyl22f/QrLB3jEO3lhVqzu0lKz6TZrv1ikvl1gtAV3rEfW
+vszRlgkJqcFV/2cZmEN6iflq3LZNlnUWxgtLaMpCGlPRnQ9sLbPTFfqMHOyeWaCS
+8odcemTNIJSmiyv/3HTjcmqDt9k1UGU8PwOMeKhHe/0hbgtqAxLajiz0VFDAo9MS
+IH5wUcg3vY6LEV0TzkrQxobo2sAFArkJpoDafYRoZu0vnAfkQndQP66l9KzL33EP
+PtV09Z9vNbjGC0NpJpop2J0J69VdDk9wHHJOQHYDPSxbL8eQKcQwtkOBCq0N1u6c
+RQc4USIGi/decqtfJA==
+-----END CERTIFICATE-----

package/networks/mycomesh-v11-sepolia.json

@@ -0,0 +1,45 @@
+{
+  "schema": "mycomesh.v11.network.v1",
+  "network_id": "mycomesh-v11-sepolia",
+  "chain_id": 11155111,
+  "settlement": "0xd46b7efb1e650e83cdeb4a36fdfef33499e54842",
+  "stablecoin": "0xbce27efad4191277167fe76819581a97959048cf",
+  "registry": "0x0ff3210e8e8abf5f5bfa73a39e60db7416b6c8c7",
+  "relay_directory": "0xa0aaad9393f51cb5786c69f152133a174588bdab",
+  "probe_ledger": "0x30055eae6645cce8754f834a17689d20a3795ca3",
+  "tiers": {
+    "1": {
+      "name": "OpenAI frontier",
+      "models": [
+        "gpt-5.5"
+      ]
+    },
+    "2": {
+      "name": "Anthropic Claude",
+      "models": [
+        "claude-sonnet-4-6",
+        "claude-opus-4-8"
+      ]
+    }
+  },
+  "deployment_block": 11809185,
+  "rpc_urls": [
+    "https://ethereum-sepolia-rpc.publicnode.com",
+    "https://rpc.sepolia.ethpandaops.io",
+    "https://sepolia.gateway.tenderly.co"
+  ],
+  "tls_ca_file": "mycomesh-testnet-ca.crt",
+  "faucet_url": "https://136.0.3.126:10443",
+  "relays": [
+    {
+      "url": "https://136.0.3.126:10443",
+      "signer": "0x58fb2f217f3065d67cdde9d5231aa9388cf72297",
+      "link": "136.0.3.126:10991"
+    },
+    {
+      "url": "https://166.88.96.60:10443",
+      "signer": "0x2211e0288ef46a7b4ea03a5022f4a96f146d8c9d",
+      "link": "166.88.96.60:10991"
+    }
+  ]
+}

package/package.json

@@ -1,24 +1,30 @@
 {
   "name": "mycomesh-relay",
-  "version": "0.1.7",
-  "description": "MycoMesh Relay onboarding and Docker launcher.",
+  "version": "0.6.1",
+  "description": "Run an independent MycoMesh V11 Relay in Docker: no domain, no certificate authority, discoverable on-chain.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Charleslzp/mycomesh"
+  },
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
   "bin": {
-    "mycomesh-relay": "bin/mycomesh-relay"
+    "mycomesh-relay": "bin/mycomesh-relay.mjs"
   },
   "files": [
-    "bin",
-    "src",
+    "bin/mycomesh-relay.mjs",
+    "src/*.mjs",
+    "networks/mycomesh-v11-sepolia.json",
+    "networks/mycomesh-testnet-ca.crt",
     "README.md"
   ],
   "engines": {
     "node": ">=20"
   },
   "scripts": {
-    "test": "node --test"
+    "test": "node --test test/*.test.mjs"
   },
   "license": "UNLICENSED"
 }

package/src/cli.mjs

@@ -0,0 +1,176 @@
+// mycomesh-relay (V11): run an independent MycoMesh Relay (and optionally a keeper) in Docker.
+// No domain name and no certificate authority: the Relay's self-signed certificate is pinned on-chain.
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { request } from "node:https";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+export const IMAGE = "ghcr.io/charleslzp/mycomesh:latest";
+export const RELAY = "mycomesh-relay";
+export const KEEPER = "mycomesh-keeper";
+const NETWORKS = join(dirname(fileURLToPath(import.meta.url)), "../networks");
+const NETWORK_FILE = "mycomesh-v11-sepolia.json";
+
+const USAGE = `Usage: mycomesh-relay <command> [options]
+
+  init [--public-ip IP]      create the owner and signer keys and a self-signed TLS certificate
+  register [--deposit UNITS] bind the signer on-chain, fund probes, and announce the Relay (with its
+                             certificate pin) in the on-chain Relay directory; testnet gas comes from the faucet
+  start [--with-keeper]      run the Relay on ports 10443 (HTTPS) and 10991 (Provider links)
+  status | logs | stop       inspect or stop it
+  earnings | claim           the Relay's share of fees and paying it out
+  address                    print the owner address (fund it with a little ETH on mainnets)
+
+Options: --home DIR (default ~/.mycomesh/relay), --image REF, --network FILE,
+  --http-port 10443, --link-port 10991`;
+
+function docker(args, { capture = true } = {}) {
+  const result = spawnSync("docker", args, { encoding: "utf8", stdio: capture ? "pipe" : "inherit" });
+  if (result.error) throw new Error(`docker is required: ${result.error.message}`);
+  if (result.status !== 0) throw new Error((result.stderr || result.stdout || `docker ${args[0]} failed`).trim().slice(-600));
+  return capture ? result.stdout.trim() : "";
+}
+
+const user = () => (typeof process.getuid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`, "-e", "HOME=/tmp"] : []);
+
+function layout(values) {
+  const home = resolve(values.home || process.env.MYCOMESH_RELAY_HOME || join(homedir(), ".mycomesh", "relay"));
+  const paths = { home, keys: join(home, "keys"), data: join(home, "data"), config: join(home, "relay.json") };
+  for (const dir of [home, paths.keys, paths.data]) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const config = existsSync(paths.config) ? JSON.parse(readFileSync(paths.config, "utf8")) : {};
+  return { paths, config };
+}
+
+const save = (paths, config) => writeFileSync(paths.config, `${JSON.stringify(config, null, 2)}\n`, { mode: 0o600 });
+
+function network(values) {
+  const file = resolve(values.network || join(NETWORKS, NETWORK_FILE));
+  const manifest = JSON.parse(readFileSync(file, "utf8"));
+  if (manifest.schema !== "mycomesh.v11.network.v1") throw new Error(`${file} is not a MycoMesh V11 network manifest`);
+  return { file, manifest, mount: ["-v", `${dirname(file)}:/config:ro`], inside: `/config/${file.split("/").pop()}` };
+}
+
+function mycomesh(values, paths, args, extra = []) {
+  const net = network(values);
+  return docker(["run", "--rm", ...user(), ...net.mount, "-v", `${paths.keys}:/keys`, "-v", `${paths.data}:/data`, ...extra,
+    values.image || IMAGE, ...args.map((arg) => (arg === "@network" ? net.inside : arg))]);
+}
+
+function publicIp() {
+  return new Promise((resolvePromise, reject) => {
+    request("https://api.ipify.org", (res) => {
+      let body = "";
+      res.on("data", (chunk) => { body += chunk; });
+      res.on("end", () => (/^[0-9a-f.:]+$/i.test(body.trim()) ? resolvePromise(body.trim()) : reject(new Error("cannot detect the public IP; pass --public-ip"))));
+    }).on("error", () => reject(new Error("cannot detect the public IP; pass --public-ip"))).end();
+  });
+}
+
+function faucet(net, address) {
+  const { manifest, file } = net;
+  if (!manifest.faucet_url) return Promise.resolve(null);
+  const target = new URL(`${manifest.faucet_url}/v11/faucet`);
+  const ca = manifest.tls_ca_file ? readFileSync(join(dirname(file), manifest.tls_ca_file), "utf8") : undefined;
+  const body = JSON.stringify({ address });
+  return new Promise((resolvePromise) => {
+    const req = request(target, { method: "POST", ca, headers: { "content-type": "application/json", "content-length": body.length } }, (res) => {
+      res.resume();
+      res.on("end", () => resolvePromise(res.statusCode));
+    });
+    req.on("error", () => resolvePromise(null));
+    req.end(body);
+  });
+}
+
+export async function main(argv = process.argv.slice(2), { stdout = process.stdout } = {}) {
+  const { values, positionals } = parseArgs({
+    args: argv, allowPositionals: true,
+    options: {
+      home: { type: "string" }, image: { type: "string" }, network: { type: "string" }, "public-ip": { type: "string" },
+      deposit: { type: "string", default: "20000000" }, "http-port": { type: "string", default: "10443" },
+      "link-port": { type: "string", default: "10991" }, "with-keeper": { type: "boolean" }, help: { type: "boolean" },
+      version: { type: "boolean" },
+    },
+  });
+  const [command = "help"] = positionals;
+  if (values.version) {
+    stdout.write(`${JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version}\n`);
+    return 0;
+  }
+  if (values.help || command === "help") { stdout.write(`${USAGE}\n`); return 0; }
+  const { paths, config } = layout(values);
+  const has = (name) => existsSync(join(paths.keys, name));
+
+  if (command === "init") {
+    const ip = values["public-ip"] || config.public_ip || await publicIp();
+    for (const name of ["owner.key", "signer.key"]) if (!has(name)) mycomesh(values, paths, ["key", "new", `/keys/${name}`]);
+    if (!has("relay.crt")) {
+      mycomesh(values, paths, ["relay", "cert", "--network", "@network", "--public-host", ip,
+        "--tls-cert", "/keys/relay.crt", "--tls-key", "/keys/relay.key"]);
+    }
+    const owner = mycomesh(values, paths, ["key", "address", "/keys/owner.key"]);
+    save(paths, { ...config, public_ip: ip, owner });
+    stdout.write(`Relay owner ${owner}\npublic endpoint https://${ip}:${values["http-port"]} (self-signed, pinned on-chain at register)\n`);
+    return 0;
+  }
+  if (!has("owner.key")) throw new Error("run `mycomesh-relay init` first");
+  if (command === "address") { stdout.write(`${config.owner}\n`); return 0; }
+  if (command === "register") {
+    const net = network(values);
+    const status = await faucet(net, config.owner);
+    if (status === 200) stdout.write("funded the owner from the testnet faucet\n");
+    const output = mycomesh(values, paths, ["relay", "register", "--network", "@network", "--owner-key", "/keys/owner.key",
+      "--signer-key", "/keys/signer.key", "--deposit", values.deposit, "--tls-cert", "/keys/relay.crt",
+      "--public-host", config.public_ip, "--public-http-port", values["http-port"], "--public-link-port", values["link-port"]]);
+    save(paths, { ...config, registered: true, http_port: values["http-port"], link_port: values["link-port"] });
+    stdout.write(`${output.split("\n").filter((line) => !line.startsWith("  0x")).join("\n")}\nnext: mycomesh-relay start\n`);
+    return 0;
+  }
+  if (command === "start") {
+    if (!config.registered) throw new Error("run `mycomesh-relay register` first");
+    const net = network(values);
+    const http = config.http_port || values["http-port"];
+    const link = config.link_port || values["link-port"];
+    spawnSync("docker", ["rm", "-f", RELAY], { stdio: "ignore" });
+    docker(["run", "-d", "--name", RELAY, "--restart", "unless-stopped", ...user(), ...net.mount,
+      "-v", `${paths.keys}:/keys:ro`, "-v", `${paths.data}:/data`, "-p", `${http}:${http}`, "-p", `${link}:${link}`,
+      "--log-opt", "max-size=20m", "--log-opt", "max-file=3", values.image || IMAGE,
+      "relay", "serve", "--network", net.inside, "--owner-key", "/keys/owner.key", "--signer-key", "/keys/signer.key",
+      "--data-dir", "/data/relay", "--http", `0.0.0.0:${http}`, "--link", `0.0.0.0:${link}`,
+      "--tls-cert", "/keys/relay.crt", "--tls-key", "/keys/relay.key"]);
+    if (values["with-keeper"]) {
+      spawnSync("docker", ["rm", "-f", KEEPER], { stdio: "ignore" });
+      docker(["run", "-d", "--name", KEEPER, "--restart", "unless-stopped", ...user(), ...net.mount,
+        "-v", `${paths.keys}:/keys:ro`, "-v", `${paths.data}:/data`, values.image || IMAGE,
+        "keeper", "serve", "--network", net.inside, "--key", "/keys/owner.key", "--data-dir", "/data/keeper"]);
+    }
+    stdout.write(`started ${RELAY}${values["with-keeper"] ? ` and ${KEEPER}` : ""} on https://${config.public_ip}:${http}\n`);
+    return 0;
+  }
+  if (command === "status") {
+    for (const name of [RELAY, KEEPER]) {
+      const state = spawnSync("docker", ["ps", "-a", "--filter", `name=^${name}$`, "--format", "{{.Status}}"], { encoding: "utf8" }).stdout.trim();
+      if (state) stdout.write(`${name}: ${state}\n`);
+    }
+    stdout.write(`${spawnSync("docker", ["logs", "--tail", "5", RELAY], { encoding: "utf8" }).stdout || ""}`);
+    return 0;
+  }
+  if (command === "logs") { docker(["logs", "-f", "--tail", "100", RELAY], { capture: false }); return 0; }
+  if (command === "stop") {
+    for (const name of [RELAY, KEEPER]) spawnSync("docker", ["rm", "-f", name], { stdio: "ignore" });
+    stdout.write("stopped\n");
+    return 0;
+  }
+  if (command === "earnings") {
+    stdout.write(`${mycomesh(values, paths, ["relay", "earnings", "--network", "@network", "--owner", config.owner])}\n`);
+    return 0;
+  }
+  if (command === "claim") {
+    stdout.write(`${mycomesh(values, paths, ["relay", "claim", "--network", "@network", "--owner-key", "/keys/owner.key"]).split("\n").pop()}\n`);
+    return 0;
+  }
+  throw new Error(`unknown command ${command}\n${USAGE}`);
+}

package/bin/mycomesh-relay

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-
-import { main } from "../src/relay.mjs";
-
-process.exitCode = await main(process.argv.slice(2));

package/src/relay.mjs

@@ -1,255 +0,0 @@
-import { mkdtemp, rm, writeFile } from "node:fs/promises";
-import { spawn as defaultSpawn } from "node:child_process";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-
-const DEFAULT_REPOSITORY_URL = "https://github.com/Charleslzp/mycomesh";
-const DEFAULT_REF = "399cecef701d33beaaf56a18c811cf73d761723d";
-const DEFAULT_BOOTSTRAP_REPOSITORY = "https://raw.githubusercontent.com/Charleslzp/mycomesh";
-const MAX_BOOTSTRAP_BYTES = 256 * 1024;
-
-const HELP = `Usage: mycomesh-relay [options]
-
-Start the MycoMesh Relay through the Docker-backed bootstrap installer.
-The first run opens a loopback browser wizard for public Relay settings.
-
-Options:
-  --ref REF              Git branch, tag, or commit (default: V8 release commit)
-  --repo-url URL         HTTPS repository URL for the Relay checkout
-  --source-dir PATH      Persistent checkout directory (default: ./mycomesh)
-  --wizard-port PORT     Loopback onboarding port (default: 8766)
-  --no-browser           Print the wizard URL without opening a browser
-  --no-start             Prepare the checkout without starting Relay
-  --dry-run              Print the planned operations only
-  -h, --help             Show this help
-
-The wizard accepts only a public payout address, concurrency and usage limit.
-Settlement transaction credentials stay in the Relay operator environment;
-this launcher never accepts or stores a private key. Docker Compose V2 and
-GNU Make are required on the Relay machine.
-
-Example:
-  npm install --global mycomesh-relay
-  mycomesh-relay --ref <reviewed-commit> --no-browser`;
-
-class RelayCliError extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
-    this.name = "RelayCliError";
-    this.exitCode = exitCode;
-  }
-}
-
-export async function main(argv, dependencies = {}) {
-  const env = dependencies.env ?? process.env;
-  const stdout = dependencies.stdout ?? process.stdout;
-  const stderr = dependencies.stderr ?? process.stderr;
-
-  try {
-    const parsed = parseArguments(argv, env);
-    if (parsed.help) {
-      stdout.write(`${HELP}\n`);
-      return 0;
-    }
-
-    const fetchImpl = dependencies.fetch ?? globalThis.fetch;
-    if (typeof fetchImpl !== "function") {
-      throw new RelayCliError("Node.js 20 or newer is required");
-    }
-
-    const bootstrap = await downloadBootstrap(parsed, fetchImpl);
-    try {
-      return await runBootstrap(
-        bootstrap.path,
-        toBootstrapArgs(parsed),
-        {
-          env,
-          spawn: dependencies.spawn ?? defaultSpawn,
-        },
-      );
-    } finally {
-      await rm(bootstrap.directory, { recursive: true, force: true });
-    }
-  } catch (error) {
-    const exitCode = error instanceof RelayCliError ? error.exitCode : 1;
-    const message = error instanceof Error ? error.message : String(error);
-    stderr.write(`mycomesh relay: ${message}\n`);
-    return exitCode;
-  }
-}
-
-export function parseArguments(argv, env = process.env) {
-  const parsed = {
-    ref: env.MYCOMESH_REF || DEFAULT_REF,
-    repositoryUrl: env.MYCOMESH_REPOSITORY_URL || DEFAULT_REPOSITORY_URL,
-    sourceDir: env.MYCOMESH_SOURCE_DIR || undefined,
-    wizardPort: env.MYCOMESH_RELAY_WIZARD_PORT || "8766",
-    noBrowser: false,
-    noStart: false,
-    dryRun: false,
-    help: false,
-  };
-
-  for (let index = 0; index < argv.length; index += 1) {
-    const token = argv[index];
-    if (token === "-h" || token === "--help") {
-      parsed.help = true;
-      continue;
-    }
-    if (token === "--no-browser") {
-      parsed.noBrowser = true;
-      continue;
-    }
-    if (token === "--no-start") {
-      parsed.noStart = true;
-      continue;
-    }
-    if (token === "--dry-run") {
-      parsed.dryRun = true;
-      continue;
-    }
-    if (!token.startsWith("--")) {
-      throw new RelayCliError(`unexpected argument: ${token}`, 2);
-    }
-
-    const separator = token.indexOf("=");
-    const name = separator === -1 ? token : token.slice(0, separator);
-    let value = separator === -1 ? undefined : token.slice(separator + 1);
-    if (value === undefined) {
-      index += 1;
-      value = argv[index];
-    }
-    if (value === undefined || value === "") {
-      throw new RelayCliError(`${name} requires a value`, 2);
-    }
-
-    switch (name) {
-      case "--ref":
-        parsed.ref = value;
-        break;
-      case "--repo-url":
-        parsed.repositoryUrl = value;
-        break;
-      case "--source-dir":
-        parsed.sourceDir = value;
-        break;
-      case "--wizard-port":
-        parsed.wizardPort = value;
-        break;
-      default:
-        throw new RelayCliError(`unknown option: ${name}`, 2);
-    }
-  }
-
-  validateRef(parsed.ref);
-  validateRepositoryUrl(parsed.repositoryUrl);
-  validatePort(parsed.wizardPort);
-  return parsed;
-}
-
-function validateRef(ref) {
-  if (
-    typeof ref !== "string" ||
-    !/^[A-Za-z0-9._/-]{1,160}$/.test(ref) ||
-    ref.includes("..") ||
-    ref.startsWith("/")
-  ) {
-    throw new RelayCliError("invalid repository ref", 2);
-  }
-}
-
-function validateRepositoryUrl(repositoryUrl) {
-  let parsed;
-  try {
-    parsed = new URL(repositoryUrl);
-  } catch {
-    throw new RelayCliError("--repo-url must be an HTTPS URL", 2);
-  }
-  if (parsed.protocol !== "https:") {
-    throw new RelayCliError("--repo-url must be an HTTPS URL", 2);
-  }
-}
-
-function validatePort(port) {
-  if (!/^\d+$/.test(String(port))) {
-    throw new RelayCliError("--wizard-port must be an integer", 2);
-  }
-  const value = Number(port);
-  if (!Number.isSafeInteger(value) || value < 1 || value > 65535) {
-    throw new RelayCliError("--wizard-port is out of range", 2);
-  }
-}
-
-function bootstrapUrl(ref) {
-  return `${DEFAULT_BOOTSTRAP_REPOSITORY}/${ref}/scripts/bootstrap-relay.sh`;
-}
-
-async function downloadBootstrap(parsed, fetchImpl) {
-  const response = await fetchImpl(bootstrapUrl(parsed.ref), {
-    headers: { accept: "text/plain" },
-  });
-  if (!response?.ok) {
-    const status = response ? `${response.status} ${response.statusText || ""}`.trim() : "unknown response";
-    throw new RelayCliError(`could not download Relay bootstrap (${status})`);
-  }
-  const script = await response.text();
-  if (Buffer.byteLength(script, "utf8") > MAX_BOOTSTRAP_BYTES) {
-    throw new RelayCliError("Relay bootstrap script is unexpectedly large");
-  }
-  if (!script.startsWith("#!/usr/bin/env bash")) {
-    throw new RelayCliError("downloaded Relay bootstrap is not a Bash script");
-  }
-
-  const directory = await mkdtemp(join(tmpdir(), "mycomesh-relay-"));
-  const path = join(directory, "bootstrap-relay.sh");
-  await writeFile(path, script, { encoding: "utf8", mode: 0o700 });
-  return { directory, path };
-}
-
-function toBootstrapArgs(parsed) {
-  const args = [
-    "--ref",
-    parsed.ref,
-    "--repo-url",
-    parsed.repositoryUrl,
-    "--wizard-port",
-    String(parsed.wizardPort),
-  ];
-  if (parsed.sourceDir) args.push("--source-dir", parsed.sourceDir);
-  if (parsed.noBrowser) args.push("--no-browser");
-  if (parsed.noStart) args.push("--no-start");
-  if (parsed.dryRun) args.push("--dry-run");
-  return args;
-}
-
-function runBootstrap(scriptPath, args, { env, spawn }) {
-  return new Promise((resolve, reject) => {
-    let child;
-    try {
-      child = spawn("bash", [scriptPath, ...args], {
-        env: { ...env },
-        stdio: "inherit",
-      });
-    } catch (error) {
-      reject(new RelayCliError(`could not start bash: ${error.message}`));
-      return;
-    }
-    child.once("error", (error) => {
-      reject(new RelayCliError(`could not start bash: ${error.message}`));
-    });
-    child.once("exit", (code, signal) => {
-      if (typeof code === "number") {
-        resolve(code);
-      } else {
-        resolve(128 + signalNumber(signal));
-      }
-    });
-  });
-}
-
-function signalNumber(signal) {
-  const signals = { SIGINT: 2, SIGTERM: 15, SIGHUP: 1 };
-  return signals[signal] || 1;
-}
-
-export { toBootstrapArgs };