import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
export let lastModified = undefined;
export let frontmatter = {
    "name": "scrollport-start",
    "description": "Get this agent a scrollport key — reliable tools and APIs through one key and one prepaid balance. Use when the user pastes \"set up https://scrollport.com/start\" or asks the agent to give itself new capabilities (scraping, search, enrichment, voice, video) without per-provider signups. Read once, to get a key; the capability document to keep is https://scrollport.com/skill.",
    "license": "MIT"
};
export let structuredData = {
    "contents": [
        {
            "heading": "scrollport--start-here",
            "content": "Status: live. The flow below is the deployed contract.This document is read once, to get a key. The document to keep and\nre-read every session is the scrollport skill\n— doctrine, the four tools, pricing behaviour and error handling."
        },
        {
            "heading": "get-a-key--run-the-cli-if-you-can",
            "content": "If you can run a shell command, run the CLI. If you cannot, call the API\ndirectly. That is the whole decision, and it is yours rather than the human's:\nboth routes perform the same device authorization, ask the human for the same\nsingle approval and end with the same key."
        },
        {
            "heading": "get-a-key--run-the-cli-if-you-can",
            "content": "It prints a link with the code already in it, waits while the human approves,\nand then stores the key at ~/.scrollport/credentials.json — mode 0600,\ninside a 0700 directory, written atomically. That persistence is the reason it\nis the default: the key outlives this session, scrollport status and\nscrollport logout find it later, and no one has to move a secret by hand.\nnpx scrollport setup --invite <code> redeems an invite instead, when a human\nhas already sent you one."
        },
        {
            "heading": "get-a-key--run-the-cli-if-you-can",
            "content": "Nothing else about setup is worth the user's attention. Do not offer them a\nchoice of route, and do not report the CLI as a prerequisite they must satisfy —\nif you cannot run it, drop to the next section and keep going."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "No shell, no filesystem, no browser — a container, a hosted runtime, a\nserverless function. The device flow is plain HTTP, and both endpoints below are\nunauthenticated because getting a key is the one thing you cannot already have a\nkey for. The only thing you give up is the stored credentials file: you keep the\nkey yourself."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "Show the human verification_uri_complete and user_code. Both, always —\nsee the security note below."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "Poll POST https://api.scrollport.com/v1/auth/token { \"device_code\": \"...\" }\nevery interval seconds.\nWhile it waits it answers HTTP 400 with authorization_pending, or\nslow_down (back off and use the new interval). Neither is an error."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "On approval it returns { \"api_key\": \"sp_live_…\", \"account_id\": \"...\" }\nexactly once. Store it wherever this agent keeps secrets — environment,\nsecret manager, whatever you already use. Never print it, never write it to a\nfile the human will read, never put it in a log."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "Ask for all four scopes. discover, inspect, run and wallet are what a\nuser agent gets — there is nothing else to ask for, and a narrower request only\nleaves you unable to answer \"can I afford this?\". wallet is read-only over MCP\nregardless, so asking for it widens nothing a human should worry about."
        },
        {
            "heading": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "If a human already sent you an invite, redeem it instead — one call, no\napproval step, because the human decided when they created it:"
        },
        {
            "heading": "security-note--this-is-not-optional",
            "content": "This applies to both routes. The consent click is a security boundary against\nprompt injection: an agent-printed URL must never auto-provision spending\nauthority. Show the human the user_code alongside the link so they can match it\nagainst the code on the consent screen — the CLI prints both for exactly this\nreason. An agent that hides the code has removed the only thing tying the page in\nfront of the human to the agent asking."
        },
        {
            "heading": "then-save-the-skill-and-register-it",
            "content": "Once you hold a key, fetch https://scrollport.com/skill\nand follow it. That is the durable document: what the four meta-tools are, how to\ndecide what to call, how billing behaves per call and what an error is telling\nyou."
        },
        {
            "heading": "then-save-the-skill-and-register-it",
            "content": "Do not just read it — keep it. Save it wherever this agent keeps skills: a\nskill directory, a tool manifest, a memory file, whatever your harness loads at\nthe start of a session. Then register or enable it there, so it is present in\nevery future session without a human pasting a URL again. A capability document\nread once is a capability you will have forgotten by tomorrow."
        },
        {
            "heading": "then-save-the-skill-and-register-it",
            "content": "It carries a version in its frontmatter. The first time you use scrollport in\nany later session, re-fetch it, compare its version with your saved copy, and\nreplace yours if they differ — a saved file never re-fetches itself, and this\nsetup you are doing now happens only once."
        },
        {
            "heading": "then-save-the-skill-and-register-it",
            "content": "Getting a key is done once. The skill is read every session."
        }
    ],
    "headings": [
        {
            "id": "scrollport--start-here",
            "content": "scrollport — start here"
        },
        {
            "id": "get-a-key--run-the-cli-if-you-can",
            "content": "Get a key — run the CLI if you can"
        },
        {
            "id": "if-you-cannot-run-a-command-call-the-api-directly",
            "content": "If you cannot run a command, call the API directly"
        },
        {
            "id": "security-note--this-is-not-optional",
            "content": "Security note — this is not optional"
        },
        {
            "id": "then-save-the-skill-and-register-it",
            "content": "Then save the skill, and register it"
        }
    ]
};
export const toc = [
    {
        depth: 1,
        url: "#scrollport--start-here",
        title: _jsx(_Fragment, {
            children: "scrollport — start here"
        })
    },
    {
        depth: 2,
        url: "#get-a-key--run-the-cli-if-you-can",
        title: _jsx(_Fragment, {
            children: "Get a key — run the CLI if you can"
        })
    },
    {
        depth: 2,
        url: "#if-you-cannot-run-a-command-call-the-api-directly",
        title: _jsx(_Fragment, {
            children: "If you cannot run a command, call the API directly"
        })
    },
    {
        depth: 2,
        url: "#security-note--this-is-not-optional",
        title: _jsx(_Fragment, {
            children: "Security note — this is not optional"
        })
    },
    {
        depth: 2,
        url: "#then-save-the-skill-and-register-it",
        title: _jsx(_Fragment, {
            children: "Then save the skill, and register it"
        })
    }
];
function _createMdxContent(props) {
    const _components = {
        a: "a",
        blockquote: "blockquote",
        code: "code",
        h1: "h1",
        h2: "h2",
        li: "li",
        ol: "ol",
        p: "p",
        pre: "pre",
        span: "span",
        strong: "strong",
        ...props.components
    };
    return _jsxs(_Fragment, {
        children: [
            _jsx(_components.h1, {
                id: "scrollport--start-here",
                children: "scrollport — start here"
            }),
            "\n",
            _jsxs(_components.blockquote, {
                children: [
                    "\n",
                    _jsx(_components.p, {
                        children: "Status: live. The flow below is the deployed contract."
                    }),
                    "\n",
                    _jsxs(_components.p, {
                        children: [
                            "This document is read ",
                            _jsx(_components.strong, {
                                children: "once"
                            }),
                            ", to get a key. The document to keep and\nre-read every session is the ",
                            _jsx(_components.a, {
                                href: "https://scrollport.com/skill",
                                children: "scrollport skill"
                            }),
                            "\n— doctrine, the four tools, pricing behaviour and error handling."
                        ]
                    }),
                    "\n"
                ]
            }),
            "\n",
            _jsx(_components.h2, {
                id: "get-a-key--run-the-cli-if-you-can",
                children: "Get a key — run the CLI if you can"
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    _jsx(_components.strong, {
                        children: "If you can run a shell command, run the CLI. If you cannot, call the API\ndirectly."
                    }),
                    " That is the whole decision, and it is yours rather than the human's:\nboth routes perform the same device authorization, ask the human for the same\nsingle approval and end with the same key."
                ]
            }),
            "\n",
            _jsx(_Fragment, {
                children: _jsx(_components.pre, {
                    className: "shiki shiki-themes github-light github-dark",
                    style: {
                        "--shiki-light": "#24292e",
                        "--shiki-dark": "#e1e4e8",
                        "--shiki-light-bg": "#fff",
                        "--shiki-dark-bg": "#24292e"
                    },
                    tabIndex: "0",
                    icon: "<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>",
                    children: _jsx(_components.code, {
                        children: _jsx(_components.span, {
                            className: "line",
                            children: _jsx(_components.span, {
                                children: "npx scrollport setup"
                            })
                        })
                    })
                })
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    "It prints a link with the code already in it, waits while the human approves,\nand then ",
                    _jsx(_components.strong, {
                        children: "stores the key"
                    }),
                    " at ",
                    _jsx(_components.code, {
                        children: "~/.scrollport/credentials.json"
                    }),
                    " — mode ",
                    _jsx(_components.code, {
                        children: "0600"
                    }),
                    ",\ninside a ",
                    _jsx(_components.code, {
                        children: "0700"
                    }),
                    " directory, written atomically. That persistence is the reason it\nis the default: the key outlives this session, ",
                    _jsx(_components.code, {
                        children: "scrollport status"
                    }),
                    " and\n",
                    _jsx(_components.code, {
                        children: "scrollport logout"
                    }),
                    " find it later, and no one has to move a secret by hand.\n",
                    _jsx(_components.code, {
                        children: "npx scrollport setup --invite <code>"
                    }),
                    " redeems an invite instead, when a human\nhas already sent you one."
                ]
            }),
            "\n",
            _jsx(_components.p, {
                children: "Nothing else about setup is worth the user's attention. Do not offer them a\nchoice of route, and do not report the CLI as a prerequisite they must satisfy —\nif you cannot run it, drop to the next section and keep going."
            }),
            "\n",
            _jsx(_components.h2, {
                id: "if-you-cannot-run-a-command-call-the-api-directly",
                children: "If you cannot run a command, call the API directly"
            }),
            "\n",
            _jsx(_components.p, {
                children: "No shell, no filesystem, no browser — a container, a hosted runtime, a\nserverless function. The device flow is plain HTTP, and both endpoints below are\nunauthenticated because getting a key is the one thing you cannot already have a\nkey for. The only thing you give up is the stored credentials file: you keep the\nkey yourself."
            }),
            "\n",
            _jsx(_Fragment, {
                children: _jsx(_components.pre, {
                    className: "shiki shiki-themes github-light github-dark",
                    style: {
                        "--shiki-light": "#24292e",
                        "--shiki-dark": "#e1e4e8",
                        "--shiki-light-bg": "#fff",
                        "--shiki-dark-bg": "#24292e"
                    },
                    tabIndex: "0",
                    icon: "<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>",
                    children: _jsxs(_components.code, {
                        children: [
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "POST https://api.scrollport.com/v1/auth/device"
                                })
                            }),
                            "\n",
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "     { \"client_name\": \"your-harness/1.0\", \"scopes\": [\"discover\",\"inspect\",\"run\",\"wallet\"] }"
                                })
                            }),
                            "\n",
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "  -> { \"verification_uri_complete\": \"...\", \"user_code\": \"HXTQ-4417\","
                                })
                            }),
                            "\n",
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "       \"device_code\": \"...\", \"interval\": 5, \"expires_in\": 600 }"
                                })
                            })
                        ]
                    })
                })
            }),
            "\n",
            _jsxs(_components.ol, {
                children: [
                    "\n",
                    _jsxs(_components.li, {
                        children: [
                            "Show the human ",
                            _jsx(_components.code, {
                                children: "verification_uri_complete"
                            }),
                            " ",
                            _jsx(_components.strong, {
                                children: "and"
                            }),
                            " ",
                            _jsx(_components.code, {
                                children: "user_code"
                            }),
                            ". Both, always —\nsee the security note below."
                        ]
                    }),
                    "\n",
                    _jsxs(_components.li, {
                        children: [
                            "Poll ",
                            _jsx(_components.code, {
                                children: "POST https://api.scrollport.com/v1/auth/token { \"device_code\": \"...\" }"
                            }),
                            "\nevery ",
                            _jsx(_components.code, {
                                children: "interval"
                            }),
                            " seconds.\nWhile it waits it answers ",
                            _jsx(_components.strong, {
                                children: "HTTP 400"
                            }),
                            " with ",
                            _jsx(_components.code, {
                                children: "authorization_pending"
                            }),
                            ", or\n",
                            _jsx(_components.code, {
                                children: "slow_down"
                            }),
                            " (back off and use the new ",
                            _jsx(_components.code, {
                                children: "interval"
                            }),
                            "). Neither is an error."
                        ]
                    }),
                    "\n",
                    _jsxs(_components.li, {
                        children: [
                            "On approval it returns ",
                            _jsx(_components.code, {
                                children: "{ \"api_key\": \"sp_live_…\", \"account_id\": \"...\" }"
                            }),
                            "\n",
                            _jsx(_components.strong, {
                                children: "exactly once"
                            }),
                            ". Store it wherever this agent keeps secrets — environment,\nsecret manager, whatever you already use. Never print it, never write it to a\nfile the human will read, never put it in a log."
                        ]
                    }),
                    "\n"
                ]
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    _jsx(_components.strong, {
                        children: "Ask for all four scopes."
                    }),
                    " ",
                    _jsx(_components.code, {
                        children: "discover"
                    }),
                    ", ",
                    _jsx(_components.code, {
                        children: "inspect"
                    }),
                    ", ",
                    _jsx(_components.code, {
                        children: "run"
                    }),
                    " and ",
                    _jsx(_components.code, {
                        children: "wallet"
                    }),
                    " are what a\nuser agent gets — there is nothing else to ask for, and a narrower request only\nleaves you unable to answer \"can I afford this?\". ",
                    _jsx(_components.code, {
                        children: "wallet"
                    }),
                    " is read-only over MCP\nregardless, so asking for it widens nothing a human should worry about."
                ]
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    _jsx(_components.strong, {
                        children: "If a human already sent you an invite"
                    }),
                    ", redeem it instead — one call, no\napproval step, because the human decided when they created it:"
                ]
            }),
            "\n",
            _jsx(_Fragment, {
                children: _jsx(_components.pre, {
                    className: "shiki shiki-themes github-light github-dark",
                    style: {
                        "--shiki-light": "#24292e",
                        "--shiki-dark": "#e1e4e8",
                        "--shiki-light-bg": "#fff",
                        "--shiki-dark-bg": "#24292e"
                    },
                    tabIndex: "0",
                    icon: "<svg viewBox=\"0 0 24 24\"><path d=\"M 6,1 C 4.354992,1 3,2.354992 3,4 v 16 c 0,1.645008 1.354992,3 3,3 h 12 c 1.645008,0 3,-1.354992 3,-3 V 8 7 A 1.0001,1.0001 0 0 0 20.707031,6.2929687 l -5,-5 A 1.0001,1.0001 0 0 0 15,1 h -1 z m 0,2 h 7 v 3 c 0,1.645008 1.354992,3 3,3 h 3 v 11 c 0,0.564129 -0.435871,1 -1,1 H 6 C 5.4358712,21 5,20.564129 5,20 V 4 C 5,3.4358712 5.4358712,3 6,3 Z M 15,3.4140625 18.585937,7 H 16 C 15.435871,7 15,6.5641288 15,6 Z\" fill=\"currentColor\" /></svg>",
                    children: _jsxs(_components.code, {
                        children: [
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "POST https://api.scrollport.com/v1/auth/invite/redeem"
                                })
                            }),
                            "\n",
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "     { \"code\": \"...\", \"client_name\": \"your-harness/1.0\" }"
                                })
                            }),
                            "\n",
                            _jsx(_components.span, {
                                className: "line",
                                children: _jsx(_components.span, {
                                    children: "  -> { \"api_key\": \"sp_live_…\", \"account_id\": \"...\" }"
                                })
                            })
                        ]
                    })
                })
            }),
            "\n",
            _jsx(_components.h2, {
                id: "security-note--this-is-not-optional",
                children: "Security note — this is not optional"
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    "This applies to both routes. The consent click is a security boundary against\nprompt injection: an agent-printed URL must never auto-provision spending\nauthority. Show the human the ",
                    _jsx(_components.code, {
                        children: "user_code"
                    }),
                    " alongside the link so they can match it\nagainst the code on the consent screen — the CLI prints both for exactly this\nreason. An agent that hides the code has removed the only thing tying the page in\nfront of the human to the agent asking."
                ]
            }),
            "\n",
            _jsx(_components.h2, {
                id: "then-save-the-skill-and-register-it",
                children: "Then save the skill, and register it"
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    "Once you hold a key, fetch ",
                    _jsx(_components.a, {
                        href: "https://scrollport.com/skill",
                        children: "https://scrollport.com/skill"
                    }),
                    "\nand follow it. That is the durable document: what the four meta-tools are, how to\ndecide what to call, how billing behaves per call and what an error is telling\nyou."
                ]
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    _jsx(_components.strong, {
                        children: "Do not just read it — keep it."
                    }),
                    " Save it wherever this agent keeps skills: a\nskill directory, a tool manifest, a memory file, whatever your harness loads at\nthe start of a session. Then register or enable it there, so it is present in\nevery future session without a human pasting a URL again. A capability document\nread once is a capability you will have forgotten by tomorrow."
                ]
            }),
            "\n",
            _jsxs(_components.p, {
                children: [
                    "It carries a ",
                    _jsx(_components.code, {
                        children: "version"
                    }),
                    " in its frontmatter. The first time you use scrollport in\nany later session, re-fetch it, compare its ",
                    _jsx(_components.code, {
                        children: "version"
                    }),
                    " with your saved copy, and\nreplace yours if they differ — a saved file never re-fetches itself, and this\nsetup you are doing now happens only once."
                ]
            }),
            "\n",
            _jsx(_components.p, {
                children: "Getting a key is done once. The skill is read every session."
            })
        ]
    });
}
export default function MDXContent(props = {}) {
    const { wrapper: MDXLayout } = props.components || {};
    return MDXLayout ? _jsx(MDXLayout, {
        ...props,
        children: _jsx(_createMdxContent, {
            ...props
        })
    }) : _createMdxContent(props);
}