@credda/cli 0.1.0

package/README.md

@@ -0,0 +1,85 @@
+# @credda/cli
+
+The official Credda CLI — portable trust from the terminal. A thin client
+over [`@credda/js`](../sdk)'s headless export; **no scoring logic lives
+here** (the deterministic score is computed only by the API's
+`score.service`).
+
+## Install / run
+
+Not yet published to npm (same status as `@credda/mcp-server`). Run from a
+checkout:
+
+```sh
+pnpm --filter @credda/js run build   # build the SDK first (dist/ is gitignored)
+pnpm --filter @credda/cli run build
+node packages/cli/dist/index.js help
+```
+
+## Commands
+
+Public — no API key:
+
+```sh
+credda lookup <token>       # trust check for a share token (GET /verify/:token)
+credda export <token>       # full self-verifying trust export bundle
+credda verify <file|->      # OFFLINE-verify a credential someone handed you:
+                            #   a W3C VC-JWT, a compact Trust Credential, or a
+                            #   saved trust-export bundle — auto-detected.
+                            #   '-' reads stdin. Exit 0 valid / 2 invalid.
+credda registry             # federated trust registry (/.well-known)
+credda did                  # issuer DID document
+```
+
+Platform — set `CREDDA_API_KEY` (a `crd_live_…` platform key):
+
+```sh
+credda score <userId>       # current score
+credda explain <userId>     # factor-level explanation
+credda components <userId>  # six named 0-100 components
+credda risk <userId>        # advisory risk signals
+credda usage [days]         # your platform's metered usage
+credda mint <userId>        # mint a share token
+credda revoke <userId>      # revoke a share token
+```
+
+Webhooks — set `CREDDA_API_KEY`:
+
+```sh
+credda webhooks list
+credda webhooks create https://hooks.you/credda score.updated score.band_changed
+                            # signing secret shown ONCE
+credda webhooks delete <id>
+credda webhooks test <id>   # synthetic signed delivery
+credda webhooks deliveries <id>   # recent attempts, incl. retries
+```
+
+Local development:
+
+```sh
+CREDDA_WEBHOOK_SECRET=whsec_... credda listen 4141
+```
+
+`credda listen` runs a local receiver that HMAC-verifies each delivery (the
+same check your production handler must do) and pretty-prints the payload.
+Credda delivers to public HTTPS only, so expose the port with your own tunnel
+(e.g. `cloudflared tunnel --url http://localhost:4141`) and register the
+tunnel URL as the webhook — the Stripe-CLI-style local loop without Credda
+running a tunneling service.
+
+Environment: `CREDDA_API_URL` overrides the API base (default
+`https://api.credda.io`); `CREDDA_WEBHOOK_SECRET` enables signature
+verification in `credda listen`.
+
+## Design
+
+- `src/cli.ts` is the pure command router — no `process`, `fs`, or env access,
+  so the whole surface is unit-tested with a mocked `CreddaClient` (same
+  pattern as `packages/mcp`'s `tools.ts`).
+- `src/index.ts` only wires the real environment (env vars, stdin/file
+  reading, exit codes).
+- `verify` uses the SDK's offline verifiers (WebCrypto Ed25519 + StatusList
+  revocation) — the point is that a received credential can be checked
+  without trusting the wire it arrived on.
+- Every command is read-only against the score. `mint`/`revoke` manage a
+  share token — a capability, not a score write.

package/dist/cli.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Command router — pure of process/env/fs so it's testable with a mocked
+ * context (same pattern as packages/mcp's tools.ts).
+ *
+ * Every command is READ-ONLY against Credda's deterministic score. Nothing
+ * here writes an Event, adjusts a score, or makes a trust decision — the CLI
+ * looks up and offline-verifies EXISTING, already-computed trust facts.
+ * `mint`/`revoke` manage a share token (a capability, not a score write).
+ */
+import type { CreddaClient, VerifiedCredential, VerifiedVc, VerifiedTrustExport, TrustExport } from '@credda/js/headless';
+export interface CliContext {
+    client: CreddaClient;
+    /** Platform API key from CREDDA_API_KEY — only needed for keyed commands. */
+    apiKey?: string;
+    out: (line: string) => void;
+    err: (line: string) => void;
+    readInput: (pathOrDash: string) => Promise<string>;
+    /** Injected so tests can mock offline verification. */
+    verifiers: {
+        trustCredential: (credential: string) => Promise<VerifiedCredential>;
+        verifiableCredential: (vcJwt: string) => Promise<VerifiedVc>;
+        trustExport: (bundle: TrustExport) => Promise<VerifiedTrustExport>;
+    };
+    /** whsec_… signing secret from CREDDA_WEBHOOK_SECRET — used by `listen`. */
+    webhookSecret?: string;
+    /**
+     * Starts the local webhook receiver (`credda listen`). Injected so the pure
+     * router stays free of node:http; resolves when the server has stopped.
+     */
+    startListener?: (opts: {
+        port: number;
+        secret?: string;
+    }) => Promise<void>;
+}
+export declare const VERSION = "0.0.1";
+export declare const HELP = "credda \u2014 portable trust from the terminal\n\nPublic (no API key):\n  credda lookup <token>          Trust check for a share token\n  credda export <token>          Full self-verifying trust export bundle\n  credda verify <file|->         Offline-verify a credential: a W3C VC-JWT,\n                                 a compact Trust Credential, or a saved trust\n                                 export bundle (auto-detected). '-' = stdin.\n  credda registry                Federated trust registry\n  credda did                     Issuer DID document\n\nPlatform (needs CREDDA_API_KEY):\n  credda score <userId>          Current score\n  credda explain <userId>        Factor-level score explanation\n  credda components <userId>     Six named 0-100 score components\n  credda risk <userId>           Advisory risk signals\n  credda usage [days]            Your platform's metered API usage\n  credda mint <userId>           Mint a share token for a user\n  credda revoke <userId>         Revoke a user's share token\n\nWebhooks (needs CREDDA_API_KEY):\n  credda webhooks list                     Your webhook subscriptions\n  credda webhooks create <url> <event..>   Subscribe (secret shown ONCE)\n  credda webhooks delete <id>              Remove a webhook\n  credda webhooks test <id>                Send a synthetic signed delivery\n  credda webhooks deliveries <id>          Recent delivery attempts (incl. retries)\n\nLocal development:\n  credda listen [port]           Local webhook receiver: verifies each delivery's\n                                 HMAC signature (CREDDA_WEBHOOK_SECRET) and\n                                 pretty-prints the payload. Default port 4141.\n                                 Credda delivers to public HTTPS only \u2014 expose\n                                 this port with your own tunnel (e.g. cloudflared).\n\nEnvironment:\n  CREDDA_API_URL                 API base (default https://api.credda.io)\n  CREDDA_API_KEY                 Platform API key for keyed commands\n  CREDDA_WEBHOOK_SECRET          whsec_\u2026 signing secret for \"credda listen\"\n\nExit codes: 0 ok/valid \u00B7 1 error \u00B7 2 credential failed verification";
+/** Classify verify input: trust-export bundle JSON, VC-JWT, or compact credential. */
+export declare function classifyCredentialInput(raw: string): {
+    kind: 'export';
+    bundle: TrustExport;
+} | {
+    kind: 'vc-jwt';
+    jwt: string;
+} | {
+    kind: 'compact';
+    credential: string;
+};
+/** Run one CLI invocation. Returns the process exit code. */
+export declare function runCli(argv: string[], ctx: CliContext): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,kBAAkB,EAClB,UAAU,EACV,mBAAmB,EACnB,WAAW,EACZ,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,uDAAuD;IACvD,SAAS,EAAE;QACT,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;QACrE,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;QAC7D,WAAW,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;KACpE,CAAC;IACF,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5E;AAED,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,eAAO,MAAM,IAAI,4oEAuCmD,CAAC;AAmBrE,sFAAsF;AACtF,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,GACV;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAcrH;AAED,6DAA6D;AAC7D,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA6I7E"}

package/dist/cli.js

@@ -0,0 +1,214 @@
+/**
+ * Command router — pure of process/env/fs so it's testable with a mocked
+ * context (same pattern as packages/mcp's tools.ts).
+ *
+ * Every command is READ-ONLY against Credda's deterministic score. Nothing
+ * here writes an Event, adjusts a score, or makes a trust decision — the CLI
+ * looks up and offline-verifies EXISTING, already-computed trust facts.
+ * `mint`/`revoke` manage a share token (a capability, not a score write).
+ */
+export const VERSION = '0.0.1';
+export const HELP = `credda — portable trust from the terminal
+
+Public (no API key):
+  credda lookup <token>          Trust check for a share token
+  credda export <token>          Full self-verifying trust export bundle
+  credda verify <file|->         Offline-verify a credential: a W3C VC-JWT,
+                                 a compact Trust Credential, or a saved trust
+                                 export bundle (auto-detected). '-' = stdin.
+  credda registry                Federated trust registry
+  credda did                     Issuer DID document
+
+Platform (needs CREDDA_API_KEY):
+  credda score <userId>          Current score
+  credda explain <userId>        Factor-level score explanation
+  credda components <userId>     Six named 0-100 score components
+  credda risk <userId>           Advisory risk signals
+  credda usage [days]            Your platform's metered API usage
+  credda mint <userId>           Mint a share token for a user
+  credda revoke <userId>         Revoke a user's share token
+
+Webhooks (needs CREDDA_API_KEY):
+  credda webhooks list                     Your webhook subscriptions
+  credda webhooks create <url> <event..>   Subscribe (secret shown ONCE)
+  credda webhooks delete <id>              Remove a webhook
+  credda webhooks test <id>                Send a synthetic signed delivery
+  credda webhooks deliveries <id>          Recent delivery attempts (incl. retries)
+
+Local development:
+  credda listen [port]           Local webhook receiver: verifies each delivery's
+                                 HMAC signature (CREDDA_WEBHOOK_SECRET) and
+                                 pretty-prints the payload. Default port 4141.
+                                 Credda delivers to public HTTPS only — expose
+                                 this port with your own tunnel (e.g. cloudflared).
+
+Environment:
+  CREDDA_API_URL                 API base (default https://api.credda.io)
+  CREDDA_API_KEY                 Platform API key for keyed commands
+  CREDDA_WEBHOOK_SECRET          whsec_… signing secret for "credda listen"
+
+Exit codes: 0 ok/valid · 1 error · 2 credential failed verification`;
+function requireKey(ctx) {
+    if (!ctx.apiKey) {
+        throw new Error('this command needs CREDDA_API_KEY set (a platform API key)');
+    }
+    return ctx.apiKey;
+}
+function requireArg(args, name) {
+    const v = args[0];
+    if (!v)
+        throw new Error(`missing required argument <${name}> — see "credda help"`);
+    return v;
+}
+function show(ctx, value) {
+    ctx.out(JSON.stringify(value, null, 2));
+}
+/** Classify verify input: trust-export bundle JSON, VC-JWT, or compact credential. */
+export function classifyCredentialInput(raw) {
+    const trimmed = raw.trim();
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed && typeof parsed === 'object' && parsed.format === 'credda-trust-export/1') {
+            return { kind: 'export', bundle: parsed };
+        }
+    }
+    catch {
+        // not JSON — fall through to string formats
+    }
+    if (/^eyJ[\w-]*\.[\w-]+\.[\w-]+$/.test(trimmed)) {
+        return { kind: 'vc-jwt', jwt: trimmed };
+    }
+    return { kind: 'compact', credential: trimmed };
+}
+/** Run one CLI invocation. Returns the process exit code. */
+export async function runCli(argv, ctx) {
+    const [command, ...args] = argv;
+    try {
+        switch (command) {
+            case undefined:
+            case 'help':
+            case '--help':
+            case '-h':
+                ctx.out(HELP);
+                return 0;
+            case 'version':
+            case '--version':
+            case '-v':
+                ctx.out(VERSION);
+                return 0;
+            case 'lookup':
+                show(ctx, await ctx.client.resolveToken(requireArg(args, 'token')));
+                return 0;
+            case 'export':
+                show(ctx, await ctx.client.getTrustExport(requireArg(args, 'token')));
+                return 0;
+            case 'verify': {
+                const raw = await ctx.readInput(requireArg(args, 'file'));
+                const input = classifyCredentialInput(raw);
+                try {
+                    if (input.kind === 'export') {
+                        const verified = await ctx.verifiers.trustExport(input.bundle);
+                        show(ctx, { valid: true, kind: 'trust-export', facts: verified.credential.cred });
+                    }
+                    else if (input.kind === 'vc-jwt') {
+                        const verified = await ctx.verifiers.verifiableCredential(input.jwt);
+                        show(ctx, { valid: true, kind: 'w3c-vc', facts: verified.cred });
+                    }
+                    else {
+                        const verified = await ctx.verifiers.trustCredential(input.credential);
+                        show(ctx, { valid: true, kind: 'trust-credential', facts: verified.cred });
+                    }
+                    return 0;
+                }
+                catch (e) {
+                    show(ctx, { valid: false, kind: input.kind, reason: e instanceof Error ? e.message : String(e) });
+                    return 2;
+                }
+            }
+            case 'registry':
+                show(ctx, await ctx.client.getTrustRegistry());
+                return 0;
+            case 'did':
+                show(ctx, await ctx.client.getDidDocument());
+                return 0;
+            case 'score':
+                show(ctx, await ctx.client.getScore(requireArg(args, 'userId'), requireKey(ctx)));
+                return 0;
+            case 'explain':
+                show(ctx, await ctx.client.getScoreExplain(requireArg(args, 'userId'), requireKey(ctx)));
+                return 0;
+            case 'components':
+                show(ctx, await ctx.client.getScoreComponents(requireArg(args, 'userId'), requireKey(ctx)));
+                return 0;
+            case 'risk':
+                show(ctx, await ctx.client.getRisk(requireArg(args, 'userId'), requireKey(ctx)));
+                return 0;
+            case 'usage': {
+                const days = args[0] ? Number(args[0]) : undefined;
+                if (days !== undefined && (!Number.isInteger(days) || days < 1)) {
+                    throw new Error('usage [days] — days must be a positive integer');
+                }
+                show(ctx, await ctx.client.getUsage(requireKey(ctx), days));
+                return 0;
+            }
+            case 'webhooks': {
+                const [sub, ...rest] = args;
+                const key = requireKey(ctx);
+                switch (sub) {
+                    case 'list':
+                        show(ctx, await ctx.client.listWebhooks(key));
+                        return 0;
+                    case 'create': {
+                        const url = requireArg(rest, 'url');
+                        const events = rest.slice(1);
+                        if (events.length === 0) {
+                            throw new Error('webhooks create <url> <event...> — provide at least one event (score.updated, score.band_changed, dispute.resolved)');
+                        }
+                        const created = await ctx.client.createWebhook({ url, events: events }, key);
+                        ctx.err('NOTE: the signing secret below is shown ONCE — store it now.');
+                        show(ctx, created);
+                        return 0;
+                    }
+                    case 'delete':
+                        await ctx.client.deleteWebhook(requireArg(rest, 'id'), key);
+                        show(ctx, { deleted: true });
+                        return 0;
+                    case 'test':
+                        show(ctx, await ctx.client.testWebhook(requireArg(rest, 'id'), key));
+                        return 0;
+                    case 'deliveries':
+                        show(ctx, await ctx.client.getWebhookDeliveries(requireArg(rest, 'id'), key, 25));
+                        return 0;
+                    default:
+                        throw new Error(`unknown webhooks subcommand "${sub ?? ''}" — see "credda help"`);
+                }
+            }
+            case 'listen': {
+                if (!ctx.startListener)
+                    throw new Error('listen is not available in this environment');
+                const port = args[0] ? Number(args[0]) : 4141;
+                if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                    throw new Error('listen [port] — port must be 1-65535');
+                }
+                await ctx.startListener({ port, secret: ctx.webhookSecret });
+                return 0;
+            }
+            case 'mint':
+                show(ctx, await ctx.client.mintShareToken(requireArg(args, 'userId'), requireKey(ctx)));
+                return 0;
+            case 'revoke':
+                await ctx.client.revokeShareToken(requireArg(args, 'userId'), requireKey(ctx));
+                show(ctx, { revoked: true });
+                return 0;
+            default:
+                throw new Error(`unknown command "${command}" — see "credda help"`);
+        }
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        // SDK errors already carry a "credda:" prefix — don't double it.
+        ctx.err(message.startsWith('credda:') ? message : `credda: ${message}`);
+        return 1;
+    }
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAgCH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oEAuCgD,CAAC;AAErE,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,uBAAuB,CAAC,CAAC;IACnF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,IAAI,CAAC,GAAe,EAAE,KAAc;IAC3C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,uBAAuB,CACrC,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;QAC1D,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;YACtF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAqB,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc,EAAE,GAAe;IAC1D,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEhC,IAAI,CAAC;QACH,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,SAAS,CAAC;YACf,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACP,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO,CAAC,CAAC;YAEX,KAAK,SAAS,CAAC;YACf,KAAK,WAAW,CAAC;YACjB,KAAK,IAAI;gBACP,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACjB,OAAO,CAAC,CAAC;YAEX,KAAK,QAAQ;gBACX,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACpE,OAAO,CAAC,CAAC;YAEX,KAAK,QAAQ;gBACX,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBACtE,OAAO,CAAC,CAAC;YAEX,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC1D,MAAM,KAAK,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,CAAC;oBACH,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAC5B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC/D,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBACpF,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBACrE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBACnE,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;wBACvE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC7E,CAAC;oBACD,OAAO,CAAC,CAAC;gBACX,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAClG,OAAO,CAAC,CAAC;gBACX,CAAC;YACH,CAAC;YAED,KAAK,UAAU;gBACb,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBAC/C,OAAO,CAAC,CAAC;YAEX,KAAK,KAAK;gBACR,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;gBAC7C,OAAO,CAAC,CAAC;YAEX,KAAK,OAAO;gBACV,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAClF,OAAO,CAAC,CAAC;YAEX,KAAK,SAAS;gBACZ,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzF,OAAO,CAAC,CAAC;YAEX,KAAK,YAAY;gBACf,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAC5F,OAAO,CAAC,CAAC;YAEX,KAAK,MAAM;gBACT,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjF,OAAO,CAAC,CAAC;YAEX,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBACpE,CAAC;gBACD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC5D,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;gBAC5B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC5B,QAAQ,GAAG,EAAE,CAAC;oBACZ,KAAK,MAAM;wBACT,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,OAAO,CAAC,CAAC;oBACX,KAAK,QAAQ,CAAC,CAAC,CAAC;wBACd,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;wBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;4BACxB,MAAM,IAAI,KAAK,CAAC,qHAAqH,CAAC,CAAC;wBACzI,CAAC;wBACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAe,EAAE,EAAE,GAAG,CAAC,CAAC;wBACtF,GAAG,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;wBACxE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;wBACnB,OAAO,CAAC,CAAC;oBACX,CAAC;oBACD,KAAK,QAAQ;wBACX,MAAM,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;wBAC5D,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;wBAC7B,OAAO,CAAC,CAAC;oBACX,KAAK,MAAM;wBACT,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;wBACrE,OAAO,CAAC,CAAC;oBACX,KAAK,YAAY;wBACf,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;wBAClF,OAAO,CAAC,CAAC;oBACX;wBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,IAAI,EAAE,uBAAuB,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;YAED,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,aAAa;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBACxD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC1D,CAAC;gBACD,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;gBAC7D,OAAO,CAAC,CAAC;YACX,CAAC;YAED,KAAK,MAAM;gBACT,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxF,OAAO,CAAC,CAAC;YAEX,KAAK,QAAQ;gBACX,MAAM,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/E,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO,CAAC,CAAC;YAEX;gBACE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,uBAAuB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3D,iEAAiE;QACjE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/cli.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.test.d.ts.map

package/dist/cli.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.test.d.ts","sourceRoot":"","sources":["../src/cli.test.ts"],"names":[],"mappings":""}

package/dist/cli.test.js

@@ -0,0 +1,159 @@
+import { describe, expect, it, vi } from 'vitest';
+import { classifyCredentialInput, runCli } from './cli.js';
+function makeCtx(overrides = {}) {
+    const lines = [];
+    const errors = [];
+    const client = {
+        resolveToken: vi.fn().mockResolvedValue({ token: 'tok', finalScore: 87 }),
+        getTrustExport: vi.fn().mockResolvedValue({ format: 'credda-trust-export/1' }),
+        getTrustRegistry: vi.fn().mockResolvedValue({ issuers: [] }),
+        getDidDocument: vi.fn().mockResolvedValue({ id: 'did:web:api.credda.io' }),
+        getScore: vi.fn().mockResolvedValue({ finalScore: 87 }),
+        getScoreExplain: vi.fn().mockResolvedValue({ factors: [] }),
+        getScoreComponents: vi.fn().mockResolvedValue({ components: [] }),
+        getRisk: vi.fn().mockResolvedValue({ signals: [] }),
+        getUsage: vi.fn().mockResolvedValue({ days: [] }),
+        mintShareToken: vi.fn().mockResolvedValue({ token: 'newtok' }),
+        revokeShareToken: vi.fn().mockResolvedValue(undefined),
+        listWebhooks: vi.fn().mockResolvedValue({ data: [] }),
+        createWebhook: vi.fn().mockResolvedValue({ webhook: { id: 'wh_1' }, secret: 'whsec_x' }),
+        deleteWebhook: vi.fn().mockResolvedValue(undefined),
+        testWebhook: vi.fn().mockResolvedValue({ success: true }),
+        getWebhookDeliveries: vi.fn().mockResolvedValue({ data: [], nextCursor: null }),
+    };
+    return {
+        client,
+        apiKey: undefined,
+        out: (l) => lines.push(l),
+        err: (l) => errors.push(l),
+        readInput: vi.fn().mockResolvedValue(''),
+        verifiers: {
+            trustCredential: vi.fn().mockResolvedValue({ valid: true, cred: { scoreBand: 'GOOD' } }),
+            verifiableCredential: vi.fn().mockResolvedValue({ valid: true, cred: { scoreBand: 'GOOD' } }),
+            trustExport: vi.fn().mockResolvedValue({ credential: { cred: { scoreBand: 'GOOD' } } }),
+        },
+        lines,
+        errors,
+        ...overrides,
+    };
+}
+describe('classifyCredentialInput', () => {
+    it('detects a trust-export bundle by its format marker', () => {
+        const raw = JSON.stringify({ format: 'credda-trust-export/1', score: {} });
+        expect(classifyCredentialInput(raw)).toMatchObject({ kind: 'export' });
+    });
+    it('detects a VC-JWT by its three-part eyJ shape', () => {
+        expect(classifyCredentialInput('eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ4In0.c2ln')).toMatchObject({ kind: 'vc-jwt' });
+    });
+    it('falls back to compact trust credential for anything else', () => {
+        expect(classifyCredentialInput('CRD1.someopaquecredential')).toMatchObject({ kind: 'compact' });
+        // JSON that is NOT an export bundle is still treated as an opaque string
+        expect(classifyCredentialInput('{"foo":1}')).toMatchObject({ kind: 'compact' });
+    });
+});
+describe('runCli', () => {
+    it('help exits 0 and prints usage', async () => {
+        const ctx = makeCtx();
+        expect(await runCli(['help'], ctx)).toBe(0);
+        expect(ctx.lines.join('\n')).toContain('credda lookup');
+    });
+    it('no command behaves like help', async () => {
+        const ctx = makeCtx();
+        expect(await runCli([], ctx)).toBe(0);
+        expect(ctx.lines.join('\n')).toContain('Exit codes');
+    });
+    it('lookup resolves the token and prints JSON', async () => {
+        const ctx = makeCtx();
+        expect(await runCli(['lookup', 'tok'], ctx)).toBe(0);
+        expect(ctx.client.resolveToken).toHaveBeenCalledWith('tok');
+        expect(JSON.parse(ctx.lines[0])).toMatchObject({ finalScore: 87 });
+    });
+    it('lookup without a token is a usage error (exit 1)', async () => {
+        const ctx = makeCtx();
+        expect(await runCli(['lookup'], ctx)).toBe(1);
+        expect(ctx.errors[0]).toContain('missing required argument');
+    });
+    it('unknown command exits 1 with a pointer to help', async () => {
+        const ctx = makeCtx();
+        expect(await runCli(['frobnicate'], ctx)).toBe(1);
+        expect(ctx.errors[0]).toContain('unknown command');
+    });
+    it('keyed commands refuse to run without CREDDA_API_KEY', async () => {
+        const ctx = makeCtx();
+        expect(await runCli(['score', 'user_1'], ctx)).toBe(1);
+        expect(ctx.errors[0]).toContain('CREDDA_API_KEY');
+        expect(ctx.client.getScore).not.toHaveBeenCalled();
+    });
+    it('score passes the key through when present', async () => {
+        const ctx = makeCtx({ apiKey: 'crd_live_x' });
+        expect(await runCli(['score', 'user_1'], ctx)).toBe(0);
+        expect(ctx.client.getScore).toHaveBeenCalledWith('user_1', 'crd_live_x');
+    });
+    it('usage validates the optional days argument', async () => {
+        const ctx = makeCtx({ apiKey: 'k' });
+        expect(await runCli(['usage', 'nope'], ctx)).toBe(1);
+        expect(await runCli(['usage', '30'], ctx)).toBe(0);
+        expect(ctx.client.getUsage).toHaveBeenCalledWith('k', 30);
+    });
+    it('verify routes a VC-JWT to the vc verifier and exits 0 when valid', async () => {
+        const ctx = makeCtx({
+            readInput: vi.fn().mockResolvedValue('eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ4In0.c2ln'),
+        });
+        expect(await runCli(['verify', 'cred.jwt'], ctx)).toBe(0);
+        expect(ctx.verifiers.verifiableCredential).toHaveBeenCalled();
+        expect(JSON.parse(ctx.lines[0])).toMatchObject({ valid: true, kind: 'w3c-vc' });
+    });
+    it('verify exits 2 (not 1) when the credential fails verification', async () => {
+        const ctx = makeCtx({
+            readInput: vi.fn().mockResolvedValue('eyJhbGciOiJFZERTQSJ9.eyJzdWIiOiJ4In0.c2ln'),
+            verifiers: {
+                trustCredential: vi.fn(),
+                verifiableCredential: vi.fn().mockRejectedValue(new Error('credda: signature verification failed')),
+                trustExport: vi.fn(),
+            },
+        });
+        expect(await runCli(['verify', 'cred.jwt'], ctx)).toBe(2);
+        expect(JSON.parse(ctx.lines[0])).toMatchObject({ valid: false, kind: 'vc-jwt' });
+    });
+    it('verify routes a trust-export bundle to the export verifier', async () => {
+        const ctx = makeCtx({
+            readInput: vi.fn().mockResolvedValue(JSON.stringify({ format: 'credda-trust-export/1' })),
+        });
+        expect(await runCli(['verify', 'export.json'], ctx)).toBe(0);
+        expect(ctx.verifiers.trustExport).toHaveBeenCalled();
+        expect(JSON.parse(ctx.lines[0])).toMatchObject({ valid: true, kind: 'trust-export' });
+    });
+    it('webhooks subcommands require a key and route to the client', async () => {
+        const noKey = makeCtx();
+        expect(await runCli(['webhooks', 'list'], noKey)).toBe(1);
+        expect(noKey.errors[0]).toContain('CREDDA_API_KEY');
+        const ctx = makeCtx({ apiKey: 'k' });
+        expect(await runCli(['webhooks', 'list'], ctx)).toBe(0);
+        expect(ctx.client.listWebhooks).toHaveBeenCalledWith('k');
+        expect(await runCli(['webhooks', 'create', 'https://h.example/w', 'score.updated'], ctx)).toBe(0);
+        expect(ctx.client.createWebhook).toHaveBeenCalledWith({ url: 'https://h.example/w', events: ['score.updated'] }, 'k');
+        expect(ctx.errors.join(' ')).toContain('shown ONCE');
+        expect(await runCli(['webhooks', 'create', 'https://h.example/w'], ctx)).toBe(1); // no events
+        expect(await runCli(['webhooks', 'test', 'wh_1'], ctx)).toBe(0);
+        expect(await runCli(['webhooks', 'deliveries', 'wh_1'], ctx)).toBe(0);
+        expect(await runCli(['webhooks', 'nope'], ctx)).toBe(1);
+    });
+    it('listen validates the port and delegates to the injected listener', async () => {
+        const started = [];
+        const ctx = makeCtx({
+            webhookSecret: 'whsec_s',
+            startListener: async (o) => { started.push(o); },
+        });
+        expect(await runCli(['listen'], ctx)).toBe(0);
+        expect(started[0]).toEqual({ port: 4141, secret: 'whsec_s' });
+        expect(await runCli(['listen', '9999'], ctx)).toBe(0);
+        expect(started[1].port).toBe(9999);
+        expect(await runCli(['listen', 'abc'], ctx)).toBe(1);
+    });
+    it('revoke reports success as JSON', async () => {
+        const ctx = makeCtx({ apiKey: 'k' });
+        expect(await runCli(['revoke', 'user_1'], ctx)).toBe(0);
+        expect(JSON.parse(ctx.lines[0])).toEqual({ revoked: true });
+    });
+});
+//# sourceMappingURL=cli.test.js.map

package/dist/cli.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.test.js","sourceRoot":"","sources":["../src/cli.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAmB,MAAM,UAAU,CAAC;AAG5E,SAAS,OAAO,CAAC,YAAiC,EAAE;IAIlD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG;QACb,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACzE,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QAC9E,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5D,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,uBAAuB,EAAE,CAAC;QAC1E,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACvD,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3D,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QACjE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnD,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACjD,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAC9D,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACtD,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrD,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxF,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC;QACnD,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;KACrD,CAAC;IAE7B,OAAO;QACL,MAAM;QACN,MAAM,EAAE,SAAS;QACjB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACzB,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxC,SAAS,EAAE;YACT,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;YACxF,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;YAC7F,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;SACxF;QACD,KAAK;QACL,MAAM;QACN,GAAG,SAAS;KACyC,CAAC;AAC1D,CAAC;AAED,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,uBAAuB,CAAC,2CAA2C,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,uBAAuB,CAAC,2BAA2B,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAChG,yEAAyE;QACzE,MAAM,CAAC,uBAAuB,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE;IACtB,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC5C,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,2CAA2C,CAAC;SAClF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,2CAA2C,CAAC;YACjF,SAAS,EAAE;gBACT,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;gBACxB,oBAAoB,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBACnG,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;aACrB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC;SAC1F,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAEpD,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1D,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,qBAAqB,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACtH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAErD,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY;QAC9F,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,OAAO,GAA6C,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,OAAO,CAAC;YAClB,aAAa,EAAE,SAAS;YACxB,aAAa,EAAE,KAAK,EAAE,CAAoC,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3E,CAAC,CAAC;QACZ,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+/**
+ * `credda` — entry point. All logic lives in cli.ts (testable); this file only
+ * wires the real environment: env vars, stdin/file reading, process exit.
+ */
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG"}

package/dist/index.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+/**
+ * `credda` — entry point. All logic lives in cli.ts (testable); this file only
+ * wires the real environment: env vars, stdin/file reading, process exit.
+ */
+import { readFile } from 'node:fs/promises';
+import { CreddaClient, verifyTrustCredential, verifyVerifiableCredential, verifyTrustExport, } from '@credda/js/headless';
+import { runCli } from './cli.js';
+import { startListener } from './listener.js';
+async function readInput(pathOrDash) {
+    if (pathOrDash === '-') {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(chunk);
+        return Buffer.concat(chunks).toString('utf8');
+    }
+    return readFile(pathOrDash, 'utf8');
+}
+// process.exitCode (not process.exit()) — a hard exit right after a fetch
+// trips a libuv assertion on Windows Node while handles are still closing.
+process.exitCode = await runCli(process.argv.slice(2), {
+    client: new CreddaClient({ apiBase: process.env.CREDDA_API_URL }),
+    apiKey: process.env.CREDDA_API_KEY,
+    webhookSecret: process.env.CREDDA_WEBHOOK_SECRET,
+    startListener,
+    out: (line) => console.log(line),
+    err: (line) => console.error(line),
+    readInput,
+    verifiers: {
+        trustCredential: (credential) => verifyTrustCredential(credential),
+        verifiableCredential: (vcJwt) => verifyVerifiableCredential(vcJwt),
+        trustExport: (bundle) => verifyTrustExport(bundle),
+    },
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,KAAK,UAAU,SAAS,CAAC,UAAkB;IACzC,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,OAAO,CAAC,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;IACrD,MAAM,EAAE,IAAI,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;IACjE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc;IAClC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;IAChD,aAAa;IACb,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;IAClC,SAAS;IACT,SAAS,EAAE;QACT,eAAe,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,UAAU,CAAC;QAClE,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC,KAAK,CAAC;QAClE,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;KACnD;CACF,CAAC,CAAC"}

package/dist/listener.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `credda listen` — a local webhook receiver for development.
+ *
+ * Accepts POSTs on a local port, verifies each delivery's HMAC signature with
+ * the webhook's signing secret (when provided), and pretty-prints the payload.
+ * Responds 200 so a tunneled Credda delivery counts as delivered.
+ *
+ * Honest scope: Credda only delivers to public HTTPS endpoints, so this does
+ * NOT tunnel by itself — put your own tunnel in front (cloudflared, ngrok, …)
+ * and register the tunnel URL as the webhook. What this gives you is the
+ * Stripe-CLI-style local loop: see every delivery, verify its signature the
+ * same way your production handler must, and iterate without redeploying.
+ */
+export declare function startListener(opts: {
+    port: number;
+    secret?: string;
+}): Promise<void>;
+//# sourceMappingURL=listener.d.ts.map

package/dist/listener.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8DpF"}

package/dist/listener.js

@@ -0,0 +1,74 @@
+/**
+ * `credda listen` — a local webhook receiver for development.
+ *
+ * Accepts POSTs on a local port, verifies each delivery's HMAC signature with
+ * the webhook's signing secret (when provided), and pretty-prints the payload.
+ * Responds 200 so a tunneled Credda delivery counts as delivered.
+ *
+ * Honest scope: Credda only delivers to public HTTPS endpoints, so this does
+ * NOT tunnel by itself — put your own tunnel in front (cloudflared, ngrok, …)
+ * and register the tunnel URL as the webhook. What this gives you is the
+ * Stripe-CLI-style local loop: see every delivery, verify its signature the
+ * same way your production handler must, and iterate without redeploying.
+ */
+import { createServer } from 'node:http';
+import { verifyWebhookSignature } from '@credda/js/headless';
+export function startListener(opts) {
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            const chunks = [];
+            req.on('data', (c) => chunks.push(c));
+            req.on('end', () => {
+                void (async () => {
+                    const rawBody = Buffer.concat(chunks).toString('utf8');
+                    const time = new Date().toISOString();
+                    let verdict = 'unverified (set CREDDA_WEBHOOK_SECRET to verify signatures)';
+                    if (opts.secret) {
+                        try {
+                            const result = await verifyWebhookSignature({
+                                secret: opts.secret,
+                                rawBody,
+                                signatureHeader: req.headers['x-credda-signature'],
+                                timestampHeader: req.headers['x-credda-timestamp'],
+                            });
+                            verdict = result.valid ? 'signature VERIFIED' : `signature INVALID — ${result.reason}`;
+                        }
+                        catch (e) {
+                            verdict = `signature check errored — ${e instanceof Error ? e.message : String(e)}`;
+                        }
+                    }
+                    let pretty = rawBody;
+                    let eventType = req.headers['x-credda-event'] ?? '?';
+                    try {
+                        const parsed = JSON.parse(rawBody);
+                        if (parsed.type)
+                            eventType = parsed.type;
+                        pretty = JSON.stringify(parsed, null, 2);
+                    }
+                    catch {
+                        // non-JSON body — print raw
+                    }
+                    console.log(`\n── ${time} · ${req.method} ${req.url} · ${String(eventType)} · ${verdict}`);
+                    console.log(pretty);
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end('{"received":true}');
+                })();
+            });
+        });
+        server.on('error', reject);
+        server.listen(opts.port, () => {
+            console.error(`credda listen — receiving webhook deliveries on http://localhost:${opts.port}`);
+            console.error(opts.secret
+                ? 'Signatures will be verified with CREDDA_WEBHOOK_SECRET.'
+                : 'No CREDDA_WEBHOOK_SECRET set — payloads will print unverified.');
+            console.error('Expose this port with your own tunnel and register the HTTPS URL as your webhook. Ctrl+C to stop.');
+        });
+        // Runs until the process is interrupted.
+        process.on('SIGINT', () => {
+            server.close(() => resolve());
+            // Give close a moment, then let the default handler end the process.
+            setTimeout(() => resolve(), 200);
+        });
+    });
+}
+//# sourceMappingURL=listener.js.map

package/dist/listener.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listener.js","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,UAAU,aAAa,CAAC,IAAuC;IACnE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,KAAK,CAAC,KAAK,IAAI,EAAE;oBACf,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACvD,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;oBAEtC,IAAI,OAAO,GAAG,6DAA6D,CAAC;oBAC5E,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;gCAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;gCACnB,OAAO;gCACP,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAuB;gCACxE,eAAe,EAAE,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAuB;6BACzE,CAAC,CAAC;4BACH,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB,MAAM,CAAC,MAAM,EAAE,CAAC;wBACzF,CAAC;wBAAC,OAAO,CAAC,EAAE,CAAC;4BACX,OAAO,GAAG,6BAA6B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,CAAC;oBACH,CAAC;oBAED,IAAI,MAAM,GAAG,OAAO,CAAC;oBACrB,IAAI,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC;oBACrD,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAsB,CAAC;wBACxD,IAAI,MAAM,CAAC,IAAI;4BAAE,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;wBACzC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAC3C,CAAC;oBAAC,MAAM,CAAC;wBACP,4BAA4B;oBAC9B,CAAC;oBAED,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;oBAC3F,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAEpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAC/B,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;YAC5B,OAAO,CAAC,KAAK,CAAC,oEAAoE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/F,OAAO,CAAC,KAAK,CACX,IAAI,CAAC,MAAM;gBACT,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,gEAAgE,CACrE,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;QACrH,CAAC,CAAC,CAAC;QAEH,yCAAyC;QACzC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,qEAAqE;YACrE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@credda/cli",
+  "version": "0.1.0",
+  "description": "Official Credda CLI \u2014 look up and offline-verify portable trust from the terminal: public trust checks, credential verification, platform score reads, share-token minting. A thin client over @credda/js; no scoring logic lives here.",
+  "type": "module",
+  "bin": {
+    "credda": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "start": "node dist/index.js",
+    "dev": "tsx src/index.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@credda/js": "workspace:*"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.2",
+    "tsx": "^4.15.2",
+    "typescript": "^5.4.5",
+    "vitest": "^1.6.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}