@learncard/cli 3.4.16 → 3.5.0

package/dist/index.js

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 'use strict';
 
-var fs = require('fs/promises');
+var fs$1 = require('fs/promises');
 var dns = require('node:dns');
 var promises = require('node:readline/promises');
 var node_stream = require('node:stream');
 var node_util = require('node:util');
 var core = require('@learncard/core');
-var init = require('@learncard/init');
+var init$1 = require('@learncard/init');
 var lcaApiPlugin = require('@learncard/lca-api-plugin');
 var openBadgeV2Plugin = require('@learncard/open-badge-v2-plugin');
 var types = require('@learncard/types');
@@ -18,8 +18,13 @@ var commander = require('commander');
 var clipboard = require('clipboardy');
 var lerRsPlugin = require('@learncard/ler-rs-plugin');
 var renderMethodPlugin = require('@learncard/render-method-plugin');
-var crypto = require('crypto');
 var holderContinuity = require('@learncard/holder-continuity');
+var fs = require('node:fs/promises');
+var path = require('node:path');
+var node_child_process = require('node:child_process');
+var path$1 = require('path');
+var node_crypto = require('node:crypto');
+var crypto = require('crypto');
 
 function _interopDefaultLegacy (e) { return e && typeof e === 'object' && 'default' in e ? e : { 'default': e }; }
 
@@ -41,35 +46,749 @@ function _interopNamespace(e) {
     return Object.freeze(n);
 }
 
-var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
+var fs__default$1 = /*#__PURE__*/_interopDefaultLegacy(fs$1);
 var dns__default = /*#__PURE__*/_interopDefaultLegacy(dns);
 var types__namespace = /*#__PURE__*/_interopNamespace(types);
 var gradient__default = /*#__PURE__*/_interopDefaultLegacy(gradient);
 var figlet__default = /*#__PURE__*/_interopDefaultLegacy(figlet);
 var clipboard__default = /*#__PURE__*/_interopDefaultLegacy(clipboard);
+var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
+var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
+var path__default$1 = /*#__PURE__*/_interopDefaultLegacy(path$1);
 var crypto__default = /*#__PURE__*/_interopDefaultLegacy(crypto);
 
 const generateRandomSeed = () => crypto__default["default"].randomBytes(32).toString("hex");
 
-var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
+const out = {
+  json: false,
+  log: (...a) => out.json ? console.error(...a) : console.log(...a),
+  result: {},
+  set: (patch) => Object.assign(out.result, patch)
+};
+
+var __defProp$a = Object.defineProperty;
+var __defProps$8 = Object.defineProperties;
+var __getOwnPropDescs$8 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$a = Object.getOwnPropertySymbols;
+var __hasOwnProp$a = Object.prototype.hasOwnProperty;
+var __propIsEnum$a = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$a = (obj, key, value) => key in obj ? __defProp$a(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$a = (a, b) => {
   for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
+    if (__hasOwnProp$a.call(b, prop))
+      __defNormalProp$a(a, prop, b[prop]);
+  if (__getOwnPropSymbols$a)
+    for (var prop of __getOwnPropSymbols$a(b)) {
+      if (__propIsEnum$a.call(b, prop))
+        __defNormalProp$a(a, prop, b[prop]);
     }
   return a;
 };
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+var __spreadProps$8 = (a, b) => __defProps$8(a, __getOwnPropDescs$8(b));
+const KEYS = {
+  SECURE_SEED: "SECURE_SEED",
+  // Private issuer seed; never regenerate or print.
+  PROFILE_ID: "PROFILE_ID",
+  // Public issuer handle shared by all commands.
+  DISPLAY_NAME: "DISPLAY_NAME",
+  // Issuer display name; set at creation, then synced from the network.
+  NETWORK_URL: "NETWORK_URL",
+  // Non-default network tRPC endpoint.
+  SIGNING_AUTHORITY_NAME: "SIGNING_AUTHORITY_NAME",
+  // Registered primary signer name.
+  SIGNING_AUTHORITY_ENDPOINT: "SIGNING_AUTHORITY_ENDPOINT",
+  // Hosted signing endpoint.
+  API_TOKEN: "API_TOKEN",
+  // Secret bearer token for REST requests.
+  API_TOKEN_SCOPE: "API_TOKEN_SCOPE",
+  // Space-separated permissions granted to the token.
+  TEMPLATE_URI: "TEMPLATE_URI",
+  // Reusable Boost template on this network.
+  CONTRACT_URI: "CONTRACT_URI",
+  // Consent contract for later commands.
+  PUBLISHABLE_KEY: "PUBLISHABLE_KEY",
+  // Public integration client key.
+  INTEGRATION_ID: "INTEGRATION_ID"
+  // Developer integration identifier.
+};
+const parseEnv = (text) => {
+  const env = {};
+  for (const line of text.split("\n")) {
+    const match = line.match(/^\s*(?:export\s+)?([\w]+)\s*=\s*(.*)$/);
+    if (!match) continue;
+    const key = match[1];
+    let value = match[2].trim();
+    if (value.startsWith('"') || value.startsWith("'")) {
+      const end = value.indexOf(value[0], 1);
+      if (end < 0) throw new Error(`Unclosed quote in .env for ${key}.`);
+      value = value.slice(1, end);
+    } else value = value.split("#")[0].trim();
+    if (key === "SECURE_SEED" && env[key] !== void 0 && env[key] !== value) {
+      throw new Error("Conflicting SECURE_SEED entries in .env. Keep the original identity.");
+    }
+    Object.defineProperty(env, key, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  }
+  return env;
+};
+const upsertEnv = (text, values) => {
+  const lines = text ? text.replace(/\n$/, "").split("\n") : [];
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = lines.map((line) => {
+    var _a;
+    const key = (_a = line.match(/^\s*(?:export\s+)?([\w]+)\s*=/)) == null ? void 0 : _a[1];
+    if (key && Object.prototype.hasOwnProperty.call(values, key)) {
+      seen.add(key);
+      const value = values[key];
+      if (/[\r\n]/.test(value)) throw new Error(`Invalid multiline value for ${key}`);
+      return `${key}=${/^[a-zA-Z0-9_./:@*=%+-]*$/.test(value) ? value : JSON.stringify(value)}`;
+    }
+    return line;
+  });
+  for (const [key, value] of Object.entries(values)) {
+    if (!seen.has(key)) out2.push(upsertEnv(`${key}=
+`, { [key]: value }).trimEnd());
+  }
+  return `${out2.join("\n")}
+`;
+};
+const toProfileId = (displayName) => {
+  const base = displayName.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);
+  return `${base || "issuer"}-${Math.random().toString(36).slice(2, 6)}`;
+};
+const readOptional = async (file) => {
+  try {
+    return await fs__default["default"].readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return "";
+    throw error;
+  }
+};
+const loadProject = async (cwd) => {
+  const envPath = path__default["default"].join(cwd, ".env");
+  await assertRegularEnv(envPath);
+  const existing = await readOptional(envPath);
+  return { env: parseEnv(existing), envPath, existing };
+};
+const assertRegularEnv = async (envPath) => {
+  const info = await fs__default["default"].lstat(envPath).catch((error) => {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  });
+  if (info && !info.isFile()) throw new Error(".env must be a regular file, not a symlink.");
+};
+const saveProject = async (project, updates) => {
+  const lockPath = `${project.envPath}.lock`;
+  const lock = await fs__default["default"].open(lockPath, "wx", 384).catch((error) => {
+    if (error.code === "EEXIST")
+      throw new Error(
+        "Another command is updating .env. Retry when it finishes; remove a stale .env.lock only if no command is running."
+      );
+    throw error;
+  });
+  const temporary = `${project.envPath}.${node_crypto.randomUUID()}.tmp`;
+  try {
+    await assertRegularEnv(project.envPath);
+    const existing = await readOptional(project.envPath);
+    const env = parseEnv(existing);
+    if (env.SECURE_SEED && updates.SECURE_SEED !== void 0 && env.SECURE_SEED !== updates.SECURE_SEED) {
+      throw new Error("Cannot replace an existing SECURE_SEED.");
+    }
+    const changed = Object.fromEntries(
+      Object.entries(updates).filter(([key, value]) => env[key] !== value)
+    );
+    project.existing = existing;
+    project.env = env;
+    if (!Object.keys(changed).length) return;
+    const next = upsertEnv(existing, changed);
+    await fs__default["default"].writeFile(temporary, next, { mode: 384, flag: "wx" });
+    await fs__default["default"].rename(temporary, project.envPath);
+    project.existing = next;
+    Object.assign(project.env, changed);
+    const keys = Object.keys(changed);
+    const list = keys.length > 2 ? `${keys.slice(0, -1).join(", ")}, and ${keys.at(-1)}` : keys.join(" and ");
+    out.log(`Wrote ${list} to .env`);
+  } finally {
+    await fs__default["default"].rm(temporary, { force: true });
+    await lock.close();
+    await fs__default["default"].unlink(lockPath);
+  }
+};
+const createPrompts = (yes) => {
+  const interactive = !yes && !!process.stdin.isTTY && process.env.LC_YES !== "1";
+  const rl = interactive ? promises.createInterface({ input: process.stdin, output: process.stdout }) : null;
+  return {
+    ask: async (question, fallback) => {
+      if (rl) return (await rl.question(`${question} [${fallback}] `)).trim() || fallback;
+      if (!fallback)
+        throw new Error(
+          `${question} is required when running non-interactively. Pass it as an argument or flag.`
+        );
+      return fallback;
+    },
+    close: () => {
+      rl == null ? void 0 : rl.close();
+    }
+  };
+};
+const ensureIdentity = async (project, options) => {
+  var _a, _b;
+  const existingProfileId = project.env.PROFILE_ID || options.profileId;
+  let displayName = (_b = (_a = options.name) != null ? _a : project.env.DISPLAY_NAME) != null ? _b : "";
+  if (!existingProfileId && !displayName) {
+    const prompts = createPrompts(options.yes);
+    try {
+      displayName = await prompts.ask(
+        "Display name for your issuer profile",
+        "My Organization"
+      );
+    } finally {
+      prompts.close();
+    }
+  }
+  if (!displayName) displayName = "My Organization";
+  if (!project.env.SECURE_SEED) {
+    const { network } = resolveServices(project.env, options.network);
+    const where = network === PRODUCTION_NETWORK ? "production" : network === STAGING_NETWORK ? "staging" : network;
+    out.log(`No .env here \u2014 creating a new ${where} identity in ${process.cwd()}`);
+  }
+  const seed = project.env.SECURE_SEED || generateRandomSeed();
+  const profileId = project.env.PROFILE_ID || options.profileId || toProfileId(displayName);
+  await saveProject(project, __spreadValues$a({
+    SECURE_SEED: seed,
+    PROFILE_ID: profileId
+  }, existingProfileId ? {} : { DISPLAY_NAME: displayName }));
+  const gitignorePath = path__default["default"].join(path__default["default"].dirname(project.envPath), ".gitignore");
+  const gitignore = await readOptional(gitignorePath);
+  if (await fs__default["default"].stat(gitignorePath).catch(() => null)) {
+    if (!gitignore.split("\n").some((line) => line.trim() === ".env")) {
+      await fs__default["default"].writeFile(gitignorePath, `${gitignore.replace(/\n?$/, "\n")}.env
+`);
+      out.log("Added .env to .gitignore");
+    }
+  } else {
+    await fs__default["default"].writeFile(gitignorePath, ".env\n");
+    out.log("Created .gitignore with .env");
+  }
+  return { seed, profileId, displayName };
+};
+const PRODUCTION_NETWORK = "https://network.learncard.com/trpc";
+const STAGING_NETWORK = "https://staging.network.learncard.com/trpc";
+const assertProjectNetwork = (project, network) => {
+  const previous = project.env.NETWORK_URL === "staging" ? STAGING_NETWORK : project.env.NETWORK_URL || PRODUCTION_NETWORK;
+  const hasResources = [
+    "SIGNING_AUTHORITY_NAME",
+    "API_TOKEN",
+    "TEMPLATE_URI",
+    "CONTRACT_URI",
+    "PUBLISHABLE_KEY",
+    "INTEGRATION_ID"
+  ].some((key) => project.env[key]);
+  if (previous !== network && hasResources) {
+    throw new Error(
+      "This project has resources on another network. Use a separate folder for staging or another network."
+    );
+  }
+};
+const resolveServices = (env, network, runtime = process.env) => {
+  const requested = network || runtime.NETWORK_URL || env.NETWORK_URL || PRODUCTION_NETWORK;
+  const url = requested === "staging" ? STAGING_NETWORK : requested;
+  const parsed = new URL(url);
+  if (!["http:", "https:"].includes(parsed.protocol))
+    throw new Error("Network must be an HTTP(S) tRPC URL or staging.");
+  const staging = url === STAGING_NETWORK;
+  return {
+    network: url,
+    cloud: runtime.CLOUD_URL || env.CLOUD_URL || (staging ? "https://staging.cloud.learncard.com/trpc" : void 0),
+    lcaAPI: runtime.LCA_API_URL || env.LCA_API_URL || (staging ? "https://staging.api.learncard.app/trpc" : void 0)
+  };
+};
+const PRODUCTION_APP = "https://learncard.app";
+const STAGING_APP = "https://staging.learncard.ai";
+const appUrlFor = (network, override) => {
+  if (override) return override.replace(/\/$/, "");
+  if (network === STAGING_NETWORK) return STAGING_APP;
+  if (network === PRODUCTION_NETWORK) return PRODUCTION_APP;
+  return PRODUCTION_APP;
+};
+const localizeSnippet = (source, services) => {
+  if (services.network === PRODUCTION_NETWORK) return source;
+  const cloud = services.cloud ? `, cloud: { url: '${services.cloud}' }` : "";
+  return source.replace(
+    /initLearnCard\(\{ seed: process\.env\.SECURE_SEED, network: true \}\)/g,
+    `initLearnCard({ seed: process.env.SECURE_SEED, network: '${services.network}'${cloud} })`
+  ).replace(
+    "https://network.learncard.com/api/send",
+    `${services.network.replace(/\/trpc$/, "")}/api/send`
+  );
+};
+const ENV_TOKEN_LOADER = `#!/bin/sh
+set -eu
+# Read API_TOKEN from .env without executing it (strips optional quotes).
+if [ -f .env ]; then
+  API_TOKEN=$(sed -n 's/^API_TOKEN=//p' .env | sed 's/^["'"'"']//; s/["'"'"']$//')
+fi
+TOKEN=\${TOKEN:-\${API_TOKEN:-}}
+: "\${TOKEN:?Run npx @learncard/cli token first}"
+
+`;
+const withEnvTokenLoader = (sendSh) => ENV_TOKEN_LOADER + sendSh;
+async function connect(project, options) {
+  const seed = project.env.SECURE_SEED;
+  if (!seed) throw new Error("Create an identity before connecting.");
+  const services = resolveServices(project.env, options.network);
+  assertProjectNetwork(project, services.network);
+  if (services.network !== PRODUCTION_NETWORK || project.env.NETWORK_URL) {
+    await saveProject(project, {
+      NETWORK_URL: services.network === PRODUCTION_NETWORK ? "" : services.network
+    });
+  }
+  out.log("Connecting to the LearnCard Network...");
+  const config = __spreadValues$a(__spreadValues$a({
+    seed,
+    network: services.network
+  }, services.cloud && { cloud: { url: services.cloud } }), options.didkit && { didkit: options.didkit });
+  return options.lca ? lcaApiPlugin.initLCALearnCard(__spreadValues$a(__spreadValues$a({}, config), services.lcaAPI && { lcaAPI: services.lcaAPI.replace(/\/api\/?$/, "/trpc") })) : init$1.initLearnCard(__spreadProps$8(__spreadValues$a({}, config), {
+    network: services.network === PRODUCTION_NETWORK ? true : services.network
+  }));
+}
+const ensureProfile = async (learnCard, identity, project) => {
+  const existing = await learnCard.invoke.getProfile();
+  if (existing) {
+    out.log(`Signed in as "${existing.displayName}" (${existing.profileId})`);
+    if (project && project.env.DISPLAY_NAME !== existing.displayName)
+      await saveProject(project, { DISPLAY_NAME: existing.displayName });
+    return;
+  }
+  await learnCard.invoke.createProfile({
+    profileId: identity.profileId,
+    displayName: identity.displayName,
+    bio: "",
+    shortBio: ""
+  });
+  out.log(`Created profile "${identity.displayName}" (${identity.profileId})`);
+};
+
+var __defProp$9 = Object.defineProperty;
+var __defProps$7 = Object.defineProperties;
+var __getOwnPropDescs$7 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$9 = Object.getOwnPropertySymbols;
+var __hasOwnProp$9 = Object.prototype.hasOwnProperty;
+var __propIsEnum$9 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$9 = (obj, key, value) => key in obj ? __defProp$9(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$9 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$9.call(b, prop))
+      __defNormalProp$9(a, prop, b[prop]);
+  if (__getOwnPropSymbols$9)
+    for (var prop of __getOwnPropSymbols$9(b)) {
+      if (__propIsEnum$9.call(b, prop))
+        __defNormalProp$9(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$7 = (a, b) => __defProps$7(a, __getOwnPropDescs$7(b));
+const authorityName = (project, name) => {
+  var _a;
+  return (_a = name != null ? name : project.env.SIGNING_AUTHORITY_NAME) != null ? _a : "default-issuer";
+};
+const setupSigning = async (project, learnCard, requestedName, options = {}) => {
+  const name = authorityName(project, requestedName);
+  const registered = (await learnCard.invoke.getRegisteredSigningAuthorities()).find(
+    (authority2) => authority2.relationship.name === name && (requestedName || !project.env.SIGNING_AUTHORITY_ENDPOINT || authority2.signingAuthority.endpoint === project.env.SIGNING_AUTHORITY_ENDPOINT)
+  );
+  if (registered) {
+    const endpoint = registered.signingAuthority.endpoint;
+    if (!registered.relationship.isPrimary) {
+      if (!await learnCard.invoke.setPrimaryRegisteredSigningAuthority(endpoint, name)) {
+        throw new Error(
+          "Could not select the primary signing authority. Please try again."
+        );
+      }
+    }
+    if (options.persist !== false) {
+      await saveProject(project, {
+        SIGNING_AUTHORITY_NAME: name,
+        SIGNING_AUTHORITY_ENDPOINT: endpoint
+      });
+    }
+    out.log(`Signing authority "${name}" is already your primary.`);
+    return { name, endpoint, did: registered.relationship.did, alreadyConfigured: true };
+  }
+  const hosted = await learnCard.invoke.getSigningAuthorities();
+  if (!hosted) throw new Error("Could not look up hosted signing authorities. Please try again.");
+  const existing = hosted.find((authority2) => authority2.name === name);
+  const authority = existing || await learnCard.invoke.createSigningAuthority(name);
+  if (!authority || !authority.endpoint || !authority.did)
+    throw new Error("Could not create signing authority. Please try again.");
+  const registeredSuccessfully = await learnCard.invoke.registerSigningAuthority(
+    authority.endpoint,
+    authority.name,
+    authority.did
+  );
+  if (!registeredSuccessfully)
+    throw new Error("Could not register signing authority. Please try again.");
+  if (!await learnCard.invoke.setPrimaryRegisteredSigningAuthority(
+    authority.endpoint,
+    authority.name
+  )) {
+    throw new Error("Could not select the primary signing authority. Please try again.");
+  }
+  if (options.persist !== false) {
+    await saveProject(project, {
+      SIGNING_AUTHORITY_NAME: authority.name,
+      SIGNING_AUTHORITY_ENDPOINT: authority.endpoint
+    });
+  }
+  out.log(`LearnCard will now sign credentials for ${project.env.PROFILE_ID}.`);
+  out.log("What this did:");
+  out.log(
+    existing ? `  const authority = (await learnCard.invoke.getSigningAuthorities()).find(authority => authority.name === ${JSON.stringify(name)});` : `  const authority = await learnCard.invoke.createSigningAuthority(${JSON.stringify(name)});`
+  );
+  out.log(
+    "  await learnCard.invoke.registerSigningAuthority(authority.endpoint, authority.name, authority.did);"
+  );
+  out.log(
+    "  await learnCard.invoke.setPrimaryRegisteredSigningAuthority(authority.endpoint, authority.name);"
+  );
+  return {
+    name: authority.name,
+    endpoint: authority.endpoint,
+    did: authority.did,
+    alreadyConfigured: false
+  };
+};
+const registerOwnAuthority = async (project, learnCard, name, endpoint, did) => {
+  if (!/^https:\/\//.test(endpoint)) throw new Error("--endpoint must be an https:// URL.");
+  if (!/^did:/.test(did)) throw new Error("--did must be a DID (did:web:..., did:key:...).");
+  if (!await learnCard.invoke.registerSigningAuthority(endpoint, name, did))
+    throw new Error("Could not register the signing authority.");
+  if (!await learnCard.invoke.setPrimaryRegisteredSigningAuthority(endpoint, name))
+    throw new Error("Could not set the signing authority as primary.");
+  await saveProject(project, {
+    SIGNING_AUTHORITY_NAME: name,
+    SIGNING_AUTHORITY_ENDPOINT: endpoint
+  });
+  out.log(`Your service at ${endpoint} will now sign credentials for this profile.`);
+  out.log("What this did:");
+  out.log(
+    `  await learnCard.invoke.registerSigningAuthority(${JSON.stringify(endpoint)}, ${JSON.stringify(name)}, ${JSON.stringify(did)});`
+  );
+  out.log(
+    `  await learnCard.invoke.setPrimaryRegisteredSigningAuthority(${JSON.stringify(endpoint)}, ${JSON.stringify(name)});`
+  );
+  return { name, endpoint, did, alreadyConfigured: false };
+};
+const runSetupSigning = async (options) => {
+  var _a;
+  const project = await loadProject(process.cwd());
+  const identity = await ensureIdentity(project, __spreadProps$7(__spreadValues$9({}, options), { name: void 0 }));
+  if (options.endpoint && !options.did || !options.endpoint && options.did)
+    throw new Error("Pass both --endpoint and --did to register your own signing service.");
+  let authority;
+  if (options.endpoint) {
+    const learnCard = await connect(project, options);
+    await ensureProfile(learnCard, identity, project);
+    authority = await registerOwnAuthority(
+      project,
+      learnCard,
+      (_a = options.name) != null ? _a : "my-issuer",
+      options.endpoint,
+      options.did
+    );
+  } else {
+    const learnCard = await connect(project, __spreadProps$7(__spreadValues$9({}, options), { lca: true }));
+    await ensureProfile(learnCard, identity, project);
+    authority = await setupSigning(project, learnCard, options.name);
+  }
+  out.set({
+    profileId: identity.profileId,
+    signingAuthority: {
+      name: authority.name,
+      endpoint: authority.endpoint,
+      did: authority.did
+    },
+    alreadyConfigured: authority.alreadyConfigured
+  });
+  out.log(
+    "Send from a template: npx @learncard/cli send you@example.com --template\nSee it in the app: npx @learncard/cli open"
+  );
+};
+
+var setupSigning$1 = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    authorityName: authorityName,
+    setupSigning: setupSigning,
+    runSetupSigning: runSetupSigning
+});
+
+const SEND_MJS = "import { randomUUID } from 'node:crypto';\nimport { initLearnCard } from '@learncard/init';\n\nconst recipientEmail = process.argv[2];\nif (!recipientEmail) throw new Error('Usage: node --env-file=.env send.mjs you@example.com');\n\n// `network: true` connects to the production LearnCard Network.\nconst learnCard = await initLearnCard({ seed: process.env.SECURE_SEED, network: true });\n\n// Your public identity on the network. Created once; safe to re-run.\nif (!(await learnCard.invoke.getProfile())) {\n    await learnCard.invoke.createProfile({\n        profileId: process.env.PROFILE_ID,\n        displayName: 'My Organization',\n    });\n}\n\n// A minimal Open Badges 3.0 credential, signed by you.\nconst credential = await learnCard.invoke.issueCredential({\n    '@context': [\n        'https://www.w3.org/ns/credentials/v2',\n        'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',\n    ],\n    type: ['VerifiableCredential', 'OpenBadgeCredential'],\n    issuer: learnCard.id.did(),\n    validFrom: new Date().toISOString(),\n    name: 'Quickstart Complete',\n    credentialSubject: {\n        type: ['AchievementSubject'],\n        achievement: {\n            id: `urn:uuid:${randomUUID()}`,\n            type: ['Achievement'],\n            name: 'Quickstart Complete',\n            description: 'Sent a verifiable credential with LearnCard.',\n            criteria: { narrative: 'Ran the LearnCard quickstart.' },\n        },\n    },\n});\n\n// Send it. The recipient can be an email, phone number, profile ID, or DID.\nconst result = await learnCard.invoke.send({\n    type: 'boost',\n    recipient: recipientEmail,\n    signedCredential: credential,\n});\n\nif (result.inbox?.status === 'PENDING') {\n    console.log(\n        `Sent. ${recipientEmail} will get a claim email. You can also share this link directly:\\n${result.inbox.claimUrl}`\n    );\n} else {\n    console.log(\n        `Delivered. ${recipientEmail} already uses LearnCard \u2014 the credential is in their wallet.`\n    );\n}\nconsole.log(`Reusable template for this badge: ${result.uri}`);\n";
+const SEND_SH = 'curl -X POST https://network.learncard.com/api/send \\\n  -H "Authorization: Bearer $TOKEN" \\\n  -H "Content-Type: application/json" \\\n  -d @request.json\n';
+const SEND_FROM_TEMPLATE_MJS = "import { initLearnCard } from '@learncard/init';\n\nconst recipient = process.argv[2];\nif (!recipient)\n    throw new Error('Usage: node --env-file=.env send-from-template.mjs you@example.com');\nif (!process.env.TEMPLATE_URI)\n    throw new Error('Run npx @learncard/cli send you@example.com --template first.');\n\n// The CLI saved a template and registered your primary signing authority once.\nconst learnCard = await initLearnCard({ seed: process.env.SECURE_SEED, network: true });\nconst result = await learnCard.invoke.send({\n    type: 'boost',\n    recipient,\n    templateUri: process.env.TEMPLATE_URI,\n});\nconsole.log(\n    result.inbox?.status === 'PENDING'\n        ? `Sent. ${recipient} will get a claim email. You can also share this link directly:\\n${result.inbox.claimUrl}`\n        : `Delivered. ${recipient} already uses LearnCard \u2014 the credential is in their wallet.`\n);\nconsole.log(`Reusable template for this badge: ${result.uri}`);\n";
+const WEBHOOK_MJS = "import { createServer } from 'node:http';\nimport { pathToFileURL } from 'node:url';\n\nexport const extractBearer = header =>\n    typeof header === 'string' ? /^Bearer\\s+(\\S+)$/i.exec(header)?.[1] : undefined;\n\nexport const webhookDedupeKey = payload => {\n    const id = payload?.data?.inbox?.issuanceId;\n    return ['ISSUANCE_DELIVERED', 'ISSUANCE_CLAIMED', 'ISSUANCE_ERROR'].includes(payload?.type) &&\n        typeof id === 'string' &&\n        id.length > 0\n        ? `${payload.type}:${id}`\n        : undefined;\n};\n\nexport const createWebhookReceiver = (verifier, expectedDid = process.env.EXPECTED_NETWORK_DID) => {\n    // Demo only: bounded, in-memory deduplication. Use durable storage in production.\n    const seen = new Set();\n    return createServer(async (req, res) => {\n        if (req.method !== 'POST') return void res.writeHead(404).end();\n        const token = extractBearer(req.headers.authorization);\n        try {\n            if (!token) return void res.writeHead(401).end();\n            const result = await verifier.invoke.verifyPresentation(token, { proofFormat: 'jwt' });\n            if (result.errors.length) return void res.writeHead(401).end();\n            const claims = JSON.parse(Buffer.from(token.split('.')[1], 'base64url').toString());\n            if (expectedDid && claims.iss !== expectedDid) return void res.writeHead(403).end();\n        } catch {\n            return void res.writeHead(401).end();\n        }\n        try {\n            const chunks = [];\n            let size = 0;\n            for await (const chunk of req) {\n                size += chunk.length;\n                if (size > 65536) return void res.writeHead(413).end();\n                chunks.push(chunk);\n            }\n            const payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));\n            const key = webhookDedupeKey(payload);\n            if (!key) return void res.writeHead(400).end();\n            // Acknowledge before doing any application work; LearnCard waits six seconds.\n            res.writeHead(200).end();\n            if (seen.has(key)) return;\n            if (seen.size >= 10000) seen.delete(seen.values().next().value);\n            seen.add(key);\n            const inbox = payload.data.inbox;\n            const fields = [\n                payload.type,\n                inbox.status,\n                inbox.issuanceId,\n                inbox.recipient?.learnCardId,\n            ];\n            console.log(\n                fields\n                    .map(value =>\n                        typeof value === 'string'\n                            ? value.replace(/[\\u0000-\\u001f\\u007f-\\u009f\\u2028\\u2029]/g, '?')\n                            : ''\n                    )\n                    .join(' ')\n                    .trim()\n            );\n        } catch {\n            if (!res.headersSent) res.writeHead(400).end();\n        }\n    });\n};\n\nif (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {\n    const { initLearnCard } = await import('@learncard/init');\n    const port = Number(process.env.PORT || 8787);\n    if (!Number.isInteger(port) || port < 1 || port > 65535)\n        throw new Error('PORT must be 1\u201365535');\n    const verifier = await initLearnCard();\n    if (!process.env.EXPECTED_NETWORK_DID) {\n        console.log(\n            'Demo: signatures are verified, but any DID is accepted. Set EXPECTED_NETWORK_DID to your trusted network DID before production.'\n        );\n    }\n    const server = createWebhookReceiver(verifier);\n    server.requestTimeout = 5000;\n    server.listen(port, () => console.log(`Listening on http://localhost:${port}`));\n}\n";
+const CLAIM_BUTTON_HTML = `<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>Claim your badge</title>
+    </head>
+    <body>
+        <h1>Claim your badge</h1>
+        <div id="claim-button"></div>
+        <script src="https://cdn.jsdelivr.net/npm/@learncard/embed-sdk@latest/dist/learncard.js"><\/script>
+        <script>
+            // init renders the Claim button into #claim-button.
+            LearnCard.init({
+                target: '#claim-button',
+                publishableKey: 'PUBLISHABLE_KEY_PLACEHOLDER',
+                apiBaseUrl: 'https://network.learncard.com/api',
+                // A full unsigned badge works without a named integration template.
+                credential: {
+                    '@context': [
+                        'https://www.w3.org/ns/credentials/v2',
+                        'https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json',
+                        'https://ctx.learncard.com/boosts/1.0.3.json',
+                    ],
+                    type: ['VerifiableCredential', 'OpenBadgeCredential', 'BoostCredential'],
+                    name: 'Badge Name',
+                    credentialSubject: {
+                        type: ['AchievementSubject'],
+                        achievement: {
+                            id: 'urn:uuid:552bf83b-7700-4c3a-b1ce-2d8f8ee68811',
+                            type: ['Achievement'],
+                            name: 'Badge Name',
+                            description: 'Claimed a badge with LearnCard.',
+                            criteria: { narrative: 'Clicked the Claim button.' },
+                        },
+                    },
+                },
+            });
+        <\/script>
+    </body>
+</html>
+`;
+const CREATE_CONTRACT_MJS = "import { initLearnCard } from '@learncard/init';\n\nconst { SECURE_SEED, PROFILE_ID, RETURN_TO } = process.env;\nif (!SECURE_SEED || !PROFILE_ID || !RETURN_TO) {\n    throw new Error('Set SECURE_SEED, PROFILE_ID, and RETURN_TO');\n}\nconst returnTo = new URL(RETURN_TO);\nif (returnTo.protocol !== 'https:') throw new Error('RETURN_TO must use HTTPS');\n\nconst learnCard = await initLearnCard({ seed: SECURE_SEED, network: true });\nif (!(await learnCard.invoke.getProfile())) {\n    await learnCard.invoke.createServiceProfile({\n        profileId: PROFILE_ID,\n        displayName: 'ConsentFlow Tutorial',\n    });\n}\n\nconst contractUri = await learnCard.invoke.createContract({\n    name: 'ConsentFlow Tutorial',\n    subtitle: 'Receive a tutorial badge',\n    description: 'Allow us to read your name and send an achievement.',\n    redirectUrl: returnTo.toString(),\n    contract: {\n        read: {\n            personal: { name: { required: false } },\n            credentials: { categories: { Achievement: { required: false } } },\n        },\n        write: {\n            personal: {},\n            credentials: { categories: { Achievement: { required: true } } },\n        },\n    },\n});\n\nconst consentUrl = new URL('https://learncard.app/consent-flow');\nconsentUrl.searchParams.set('uri', contractUri);\nconsentUrl.searchParams.set('returnTo', returnTo.toString());\nconsole.log(JSON.stringify({ contractUri, consentUrl: consentUrl.toString() }));\n";
+const CONSENT_CALLBACK_MJS = "import { createServer } from 'node:http';\nimport { pathToFileURL } from 'node:url';\nimport { initLearnCard } from '@learncard/init';\n\n// Decoding is not verification: inspect claims only after verifying the signature.\nexport const verifyConsentRedirect = async (learnCard, vp, contractUri) => {\n    if (!vp) return { status: 'denied-or-abandoned' };\n    if (typeof vp !== 'string' || vp.split('.').length !== 3 || !contractUri) {\n        throw new Error('Invalid consent proof');\n    }\n    const result = await learnCard.invoke.verifyPresentation(vp, { proofFormat: 'jwt' });\n    if (result.errors.length !== 0) throw new Error('Invalid consent proof');\n\n    const payload = JSON.parse(Buffer.from(vp.split('.')[1], 'base64url').toString('utf8'));\n    const userDid = payload.vp?.holder;\n    if (typeof userDid !== 'string' || !userDid.startsWith('did:') || payload.iss !== userDid) {\n        throw new Error('Invalid consent holder');\n    }\n    if (payload.vp.contractUri !== contractUri) throw new Error('Wrong consent contract');\n    return { status: 'verified', userDid };\n};\n\nexport const createConsentCallback = (learnCard, contractUri) => async (req, res) => {\n    res.setHeader('Cache-Control', 'no-store');\n    res.setHeader('Referrer-Policy', 'no-referrer');\n    res.setHeader('Content-Type', 'text/plain; charset=utf-8');\n    const url = new URL(req.url, 'http://localhost');\n    if (req.method !== 'GET' || url.pathname !== '/consent-callback') {\n        res.writeHead(404).end('Not found');\n        return;\n    }\n    try {\n        const verified = await verifyConsentRedirect(\n            learnCard,\n            url.searchParams.get('vp'),\n            contractUri\n        );\n        // The convenience `did` parameter is deliberately never read.\n        if (verified.status !== 'verified') {\n            res.writeHead(400).end('Consent denied or abandoned. Try again.');\n            return;\n        }\n        const { readUserData } = await import('./read-user-data.mjs');\n        const records = await readUserData(learnCard, verified.userDid, contractUri);\n        if (records.length === 0) {\n            res.writeHead(403).end('No active consent.');\n            return;\n        }\n        // Do not expose personal data, create a login session, or issue on this GET.\n        res.end('Consent verified. Active access confirmed.');\n    } catch {\n        res.writeHead(400).end('Unable to confirm consent. Try again.');\n    }\n};\n\nif (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {\n    const { SECURE_SEED, CONTRACT_URI } = process.env;\n    if (!SECURE_SEED || !CONTRACT_URI) throw new Error('Set SECURE_SEED and CONTRACT_URI');\n    const learnCard = await initLearnCard({ seed: SECURE_SEED, network: true });\n    createServer(createConsentCallback(learnCard, CONTRACT_URI)).listen(3000, '127.0.0.1');\n    console.log('Callback listening on port 3000.');\n}\n";
+const READ_USER_DATA_MJS = "import { pathToFileURL } from 'node:url';\nimport { initLearnCard } from '@learncard/init';\nimport { verifyConsentRedirect } from './consent-callback.mjs';\n\nexport const readUserData = async (learnCard, userDid, contractUri) => {\n    const profile = await learnCard.invoke.getProfile(userDid);\n    if (!profile) return [];\n    const hasAccess = () => learnCard.invoke.verifyConsent(contractUri, profile.profileId);\n    if (!(await hasAccess())) return [];\n    const records = [];\n    let cursor;\n    do {\n        const page = await learnCard.invoke.getConsentFlowDataForDid(userDid, {\n            limit: 100,\n            ...(cursor ? { cursor } : {}),\n        });\n        records.push(...page.records.filter(record => record.contractUri === contractUri));\n        if (!page.hasMore) return (await hasAccess()) ? records : [];\n        if (!page.cursor || page.cursor === cursor) throw new Error('Pagination did not advance');\n        cursor = page.cursor;\n    } while (true);\n};\n\nif (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {\n    const { SECURE_SEED, CONTRACT_URI, CONSENT_VP } = process.env;\n    if (!SECURE_SEED || !CONTRACT_URI) throw new Error('Set SECURE_SEED and CONTRACT_URI');\n    const learnCard = await initLearnCard({ seed: SECURE_SEED, network: true });\n    const verified = await verifyConsentRedirect(learnCard, CONSENT_VP, CONTRACT_URI);\n    if (verified.status !== 'verified') throw new Error('Consent denied or abandoned');\n    const records = await readUserData(learnCard, verified.userDid, CONTRACT_URI);\n    console.log(\n        records.length ? `Active consent: ${records.length} record(s).` : 'No active consent.'\n    );\n}\n";
+const ISSUE_THROUGH_CONTRACT_MJS = "import { pathToFileURL } from 'node:url';\nimport { initLearnCard } from '@learncard/init';\nimport { verifyConsentRedirect } from './consent-callback.mjs';\nimport { readUserData } from './read-user-data.mjs';\n\nexport const issueThroughContract = async (learnCard, userDid, contractUri) => {\n    if ((await readUserData(learnCard, userDid, contractUri)).length === 0) {\n        throw new Error('No active consent');\n    }\n    const base = learnCard.invoke.newCredential({ type: 'boost' });\n    const unsignedCredential = {\n        ...base,\n        issuer: learnCard.id.did(),\n        name: 'ConsentFlow Tutorial Complete',\n        credentialSubject: {\n            ...base.credentialSubject,\n            id: userDid,\n            achievement: {\n                ...base.credentialSubject.achievement,\n                name: 'ConsentFlow Tutorial Complete',\n                description: 'Completed the ConsentFlow tutorial.',\n            },\n        },\n    };\n    const boostUri = await learnCard.invoke.createBoost(unsignedCredential, {\n        name: 'ConsentFlow Tutorial Complete',\n        category: 'Achievement',\n        type: 'achievement',\n    });\n    const signedCredential = await learnCard.invoke.issueCredential({\n        ...unsignedCredential,\n        boostId: boostUri,\n    });\n    return learnCard.invoke.writeCredentialToContract(\n        userDid,\n        contractUri,\n        signedCredential,\n        boostUri\n    );\n};\n\nif (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {\n    const { SECURE_SEED, CONTRACT_URI, CONSENT_VP } = process.env;\n    if (!SECURE_SEED || !CONTRACT_URI) throw new Error('Set SECURE_SEED and CONTRACT_URI');\n    const learnCard = await initLearnCard({ seed: SECURE_SEED, network: true });\n    const verified = await verifyConsentRedirect(learnCard, CONSENT_VP, CONTRACT_URI);\n    if (verified.status !== 'verified') throw new Error('Consent denied or abandoned');\n    const credentialUri = await issueThroughContract(learnCard, verified.userDid, CONTRACT_URI);\n    console.log(`Issued: ${credentialUri}`);\n}\n";
+
+var __defProp$8 = Object.defineProperty;
+var __defProps$6 = Object.defineProperties;
+var __getOwnPropDescs$6 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$8 = Object.getOwnPropertySymbols;
+var __hasOwnProp$8 = Object.prototype.hasOwnProperty;
+var __propIsEnum$8 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$8 = (obj, key, value) => key in obj ? __defProp$8(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$8 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$8.call(b, prop))
+      __defNormalProp$8(a, prop, b[prop]);
+  if (__getOwnPropSymbols$8)
+    for (var prop of __getOwnPropSymbols$8(b)) {
+      if (__propIsEnum$8.call(b, prop))
+        __defNormalProp$8(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$6 = (a, b) => __defProps$6(a, __getOwnPropDescs$6(b));
+const DEFAULT_BADGE = {
+  name: "Quickstart Complete",
+  description: "Sent a verifiable credential with LearnCard."
+};
+const quickstartCredential = (issuerDid, badge = DEFAULT_BADGE) => ({
+  "@context": [
+    "https://www.w3.org/ns/credentials/v2",
+    "https://purl.imsglobal.org/spec/ob/v3p0/context-3.0.3.json"
+  ],
+  type: ["VerifiableCredential", "OpenBadgeCredential"],
+  issuer: issuerDid,
+  validFrom: (/* @__PURE__ */ new Date()).toISOString(),
+  name: badge.name,
+  credentialSubject: {
+    type: ["AchievementSubject"],
+    achievement: {
+      id: `urn:uuid:${node_crypto.randomUUID()}`,
+      type: ["Achievement"],
+      name: badge.name,
+      description: badge.description,
+      criteria: { narrative: "Ran the LearnCard quickstart." }
+    }
+  }
+});
+const templateCredential = (issuerDid, badge = DEFAULT_BADGE) => {
+  const credential = quickstartCredential(issuerDid, badge);
+  credential["@context"].push("https://ctx.learncard.com/boosts/1.0.1.json");
+  credential.type.push("BoostCredential");
+  return credential;
+};
+const sendOptions = (options) => {
+  const picked = {
+    webhookUrl: options.webhookUrl,
+    suppressDelivery: options.suppressDelivery,
+    guardianEmail: options.guardianEmail
+  };
+  return Object.values(picked).some((v) => v !== void 0) ? { options: picked } : {};
+};
+const withDeliveryOptions = (content, anchor, deliveryOptions) => deliveryOptions ? content.replace(
+  anchor,
+  () => `${anchor}
+    options: ${JSON.stringify(deliveryOptions)},`
+) : content;
+const personalizeSendMjs = (displayName, badge, deliveryOptions) => withDeliveryOptions(
+  SEND_MJS.replace(
+    "displayName: 'My Organization'",
+    () => `displayName: ${JSON.stringify(displayName)}`
+  ).split("'Quickstart Complete'").join(JSON.stringify(badge.name)).replace(
+    "'Sent a verifiable credential with LearnCard.'",
+    () => JSON.stringify(badge.description)
+  ),
+  "    signedCredential: credential,",
+  deliveryOptions
+);
+const personalizeSendFromTemplateMjs = (deliveryOptions) => withDeliveryOptions(
+  SEND_FROM_TEMPLATE_MJS,
+  "    templateUri: process.env.TEMPLATE_URI,",
+  deliveryOptions
+);
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const PHONE = /^\+?\d{10,15}$/;
+const runSend = async (recipientEmail, options) => {
+  var _a, _b, _c, _d, _e, _f, _g;
+  if (!EMAIL.test(recipientEmail) && !PHONE.test(recipientEmail))
+    throw new Error(
+      `"${recipientEmail}" is not an email address or phone number. Example: npx @learncard/cli send you@example.com`
+    );
+  const cwd = process.cwd();
+  const project = await loadProject(cwd);
+  const prompts = createPrompts(options.yes);
+  let displayName;
+  let badge;
+  try {
+    const needsName = !project.env.PROFILE_ID && !options.profileId && !options.name;
+    displayName = needsName ? await prompts.ask("Display name for your issuer profile", "My Organization") : options.name;
+    badge = {
+      name: (_a = options.badge) != null ? _a : await prompts.ask("Badge name", DEFAULT_BADGE.name),
+      description: (_b = options.description) != null ? _b : DEFAULT_BADGE.description
+    };
+  } finally {
+    prompts.close();
+  }
+  const identity = await ensureIdentity(project, __spreadProps$6(__spreadValues$8({}, options), { name: displayName, yes: true }));
+  const useTemplate = options.template || !!options.templateUri;
+  const learnCard = useTemplate ? await connect(project, __spreadProps$6(__spreadValues$8({}, options), { lca: true })) : await connect(project, options);
+  await ensureProfile(learnCard, identity, project);
+  const effectiveSendOptions = sendOptions(options);
+  let result;
+  if (useTemplate) {
+    await setupSigning(
+      project,
+      learnCard
+    );
+    if (options.templateUri) {
+      out.log(`Sending from template ${options.templateUri}.`);
+      if (!project.env.TEMPLATE_URI) {
+        await saveProject(project, { TEMPLATE_URI: options.templateUri });
+      }
+    } else if (!project.env.TEMPLATE_URI) {
+      const uri = await learnCard.invoke.createBoost(
+        templateCredential(learnCard.id.did(), badge),
+        {
+          name: badge.name,
+          category: "Achievement",
+          status: "LIVE"
+        }
+      );
+      await saveProject(project, { TEMPLATE_URI: uri });
+    } else {
+      out.log(
+        `Reusing template ${project.env.TEMPLATE_URI}; its saved badge name and description are unchanged.`
+      );
+    }
+    result = await learnCard.invoke.send(__spreadValues$8({
+      type: "boost",
+      recipient: recipientEmail,
+      templateUri: (_c = options.templateUri) != null ? _c : project.env.TEMPLATE_URI
+    }, effectiveSendOptions));
+  } else {
+    const credential = await learnCard.invoke.issueCredential(
+      quickstartCredential(learnCard.id.did(), badge)
+    );
+    result = await learnCard.invoke.send(__spreadValues$8({
+      type: "boost",
+      recipient: recipientEmail,
+      signedCredential: credential
+    }, effectiveSendOptions));
+  }
+  out.log("");
+  if (((_d = result.inbox) == null ? void 0 : _d.status) === "PENDING") {
+    out.log(
+      `Sent. ${recipientEmail} will get a claim email. You can also share this link directly:
+${result.inbox.claimUrl}`
+    );
+  } else {
+    out.log(
+      `Delivered. ${recipientEmail} already uses LearnCard \u2014 the credential is in their wallet.`
+    );
+  }
+  out.log(`Reusable template for this badge: ${result.uri}`);
+  const filename = useTemplate ? "send-from-template.mjs" : "send.mjs";
+  const sendPath = path__default$1["default"].join(cwd, filename);
+  let wroteSendFile = false;
+  if (!await fs__default$1["default"].stat(sendPath).catch(() => null)) {
+    await fs__default$1["default"].writeFile(
+      sendPath,
+      localizeSnippet(
+        useTemplate ? personalizeSendFromTemplateMjs(effectiveSendOptions.options) : personalizeSendMjs(identity.displayName, badge, effectiveSendOptions.options),
+        resolveServices(project.env, options.network)
+      )
+    );
+    wroteSendFile = true;
+    out.log(
+      `
+The code that just ran is in ./${filename} \u2014 run it yourself:
+  npm install @learncard/init
+  node --env-file=.env ${filename} ${recipientEmail}`
+    );
+  }
+  out.log(`Check whether it was claimed: npx @learncard/cli status ${result.activityId}`);
+  out.log(`See it in the app: npx @learncard/cli open${options.template ? " template" : ""}`);
+  out.set(__spreadProps$6(__spreadValues$8(__spreadValues$8(__spreadProps$6(__spreadValues$8({
+    profileId: identity.profileId,
+    did: learnCard.id.did(),
+    recipient: recipientEmail,
+    status: ((_e = result.inbox) == null ? void 0 : _e.status) === "PENDING" ? "PENDING" : "ISSUED"
+  }, ((_f = result.inbox) == null ? void 0 : _f.claimUrl) && { claimUrl: result.inbox.claimUrl }), {
+    templateUri: result.uri,
+    activityId: result.activityId
+  }), result.credentialUri && { credentialUri: result.credentialUri }), ((_g = result.inbox) == null ? void 0 : _g.issuanceId) && { issuanceId: result.inbox.issuanceId }), {
+    files: wroteSendFile ? [`./${filename}`] : []
+  }));
+};
+
+var __defProp$7 = Object.defineProperty;
+var __defProps$5 = Object.defineProperties;
+var __getOwnPropDescs$5 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$7 = Object.getOwnPropertySymbols;
+var __hasOwnProp$7 = Object.prototype.hasOwnProperty;
+var __propIsEnum$7 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$7 = (obj, key, value) => key in obj ? __defProp$7(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$7 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$7.call(b, prop))
+      __defNormalProp$7(a, prop, b[prop]);
+  if (__getOwnPropSymbols$7)
+    for (var prop of __getOwnPropSymbols$7(b)) {
+      if (__propIsEnum$7.call(b, prop))
+        __defNormalProp$7(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$5 = (a, b) => __defProps$5(a, __getOwnPropDescs$5(b));
 const createExportLearnCardBundleHelper = (exportBundle, defaultWallet) => {
   return (walletOrOptions, maybeOptions) => {
     if (maybeOptions)
@@ -80,25 +799,25 @@ const createExportLearnCardBundleHelper = (exportBundle, defaultWallet) => {
 const createRestoreLearnCardFromBundleHelper = (restoreBundle, defaultInit) => {
   return (path, options = {}) => {
     var _a;
-    return restoreBundle(path, __spreadProps(__spreadValues({}, options), {
-      init: __spreadValues(__spreadValues({}, defaultInit), (_a = options.init) != null ? _a : {})
+    return restoreBundle(path, __spreadProps$5(__spreadValues$7({}, options), {
+      init: __spreadValues$7(__spreadValues$7({}, defaultInit), (_a = options.init) != null ? _a : {})
     }));
   };
 };
 
 var name = "@learncard/cli";
-var version = "3.4.16";
+var version = "3.5.0";
 var description = "Command Line Interface for LearnCard";
 var main = "dist/index.js";
 var bin = "dist/index.js";
 var scripts = {
-	start: "bun --conditions=development src/index.tsx",
-	"start:built": "rollup -c && node --enable-source-maps dist/index.js",
-	dev: "bun --conditions=development src/index.tsx",
-	build: "rollup -c",
-	test: "vitest run",
-	"test:watch": "vitest",
-	"test:coverage": "vitest run --coverage"
+	start: "bun scripts/embed-snippets.ts && bun --conditions=development src/index.tsx",
+	"start:built": "bun run build && node --enable-source-maps dist/index.js",
+	dev: "bun run start",
+	build: "bun scripts/embed-snippets.ts && rollup -c",
+	test: "bun scripts/embed-snippets.ts && vitest run",
+	"test:watch": "bun scripts/embed-snippets.ts && vitest",
+	"test:coverage": "bun scripts/embed-snippets.ts && vitest run --coverage"
 };
 var author = "Learning Economy Foundation (www.learningeconomy.io)";
 var license = "MIT";
@@ -114,14 +833,11 @@ var dependencies = {
 	"@learncard/render-method-plugin": "workspace:*",
 	"@learncard/holder-continuity": "workspace:*",
 	"@learncard/types": "workspace:*",
-	"@rollup/plugin-json": "^4.1.0",
 	clipboardy: "^4.0.0",
 	commander: "^9.3.0",
 	figlet: "^1.5.2",
 	"gradient-string": "^2.0.1",
-	"pretty-repl": "^3.1.1",
-	rollup: "^2.80.0",
-	"rollup-plugin-esbuild": "^4.9.1"
+	"pretty-repl": "^3.1.1"
 };
 var devDependencies = {
 	"@types/cors": "^2.8.12",
@@ -129,7 +845,10 @@ var devDependencies = {
 	"@types/node": "^18.0.0",
 	nodemon: "^2.0.16",
 	"ts-node": "^10.8.1",
-	vitest: "4.1.10"
+	vitest: "4.1.10",
+	"@rollup/plugin-json": "^4.1.0",
+	rollup: "^2.80.0",
+	"rollup-plugin-esbuild": "^4.9.1"
 };
 var repository = {
 	type: "git",
@@ -155,8 +874,27 @@ var packageJson = {
 	bugs: bugs
 };
 
-var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
-var __forAwait = (obj, it, method) => (it = obj[__knownSymbol("asyncIterator")]) ? it.call(obj) : (obj = obj[__knownSymbol("iterator")](), it = {}, method = (key, fn) => (fn = obj[key]) && (it[key] = (arg) => new Promise((yes, no, done) => (arg = fn.call(obj, arg), done = arg.done, Promise.resolve(arg.value).then((value) => yes({ value, done }), no)))), method("next"), method("return"), it);
+var __defProp$6 = Object.defineProperty;
+var __defProps$4 = Object.defineProperties;
+var __getOwnPropDescs$4 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$6 = Object.getOwnPropertySymbols;
+var __hasOwnProp$6 = Object.prototype.hasOwnProperty;
+var __propIsEnum$6 = Object.prototype.propertyIsEnumerable;
+var __knownSymbol$1 = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
+var __defNormalProp$6 = (obj, key, value) => key in obj ? __defProp$6(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$6 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$6.call(b, prop))
+      __defNormalProp$6(a, prop, b[prop]);
+  if (__getOwnPropSymbols$6)
+    for (var prop of __getOwnPropSymbols$6(b)) {
+      if (__propIsEnum$6.call(b, prop))
+        __defNormalProp$6(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$4 = (a, b) => __defProps$4(a, __getOwnPropDescs$4(b));
+var __forAwait$1 = (obj, it, method) => (it = obj[__knownSymbol$1("asyncIterator")]) ? it.call(obj) : (obj = obj[__knownSymbol$1("iterator")](), it = {}, method = (key, fn) => (fn = obj[key]) && (it[key] = (arg) => new Promise((yes, no, done) => (arg = fn.call(obj, arg), done = arg.done, Promise.resolve(arg.value).then((value) => yes({ value, done }), no)))), method("next"), method("return"), it);
 dns__default["default"].setDefaultResultOrder("ipv4first");
 const cliGlobals = globalThis;
 const replGlobals = [
@@ -328,7 +1066,7 @@ const startReadlineRepl = async (colorize) => {
   });
   rl.prompt();
   try {
-    for (var iter = __forAwait(rl), more, temp, error; more = !(temp = await iter.next()).done; more = false) {
+    for (var iter = __forAwait$1(rl), more, temp, error; more = !(temp = await iter.next()).done; more = false) {
       const line = temp.value;
       const source = line.trim();
       if (source === ".exit") break;
@@ -373,14 +1111,199 @@ const startCliRepl = async (colorize) => {
   }
   await startBunRepl(colorize);
 };
-commander.program.version(packageJson.version).argument("[seed]").action(async (_seed = generateRandomSeed()) => {
+commander.program.command("send <email>").description(
+  'Send a "Quickstart Complete" badge to an email address. Creates .env and send.mjs in the current folder.'
+).option("-y, --yes", "accept defaults without prompting").option("--name <displayName>", "display name for your issuer profile").option("--badge <name>", 'name of the badge to send (default: "Quickstart Complete")').option("--description <text>", "badge description").option(
+  "--profile-id <id>",
+  "public handle for your profile (default: derived from the display name)"
+).option("--network <url>", "network tRPC URL (default: production)").option("--template", "send using a reusable template and hosted signing authority").option("--template-uri <uri>", "send from a specific template (implies --template)").option("--webhook-url <url>", "receive ISSUANCE_DELIVERED / ISSUANCE_CLAIMED at this URL").option("--suppress-delivery", "skip the claim email; you deliver inbox.claimUrl yourself").option(
+  "--guardian-email <email>",
+  "require a guardian's approval before the recipient can claim"
+).option("--json", "print a single JSON result on stdout").action(
+  async (email, opts) => {
+    out.json = !!opts.json;
+    out.result = {};
+    const didkit = fs__default$1["default"].readFile(
+      require.resolve("@learncard/didkit-plugin/dist/didkit/didkit_wasm_bg.wasm")
+    );
+    try {
+      await runSend(email, __spreadProps$4(__spreadValues$6({}, opts), { didkit }));
+      if (out.json) {
+        process.stdout.write(
+          JSON.stringify(__spreadValues$6({ ok: true, command: "send" }, out.result)) + "\n"
+        );
+      }
+      process.exit(0);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      const firstLine = message.split("\n")[0];
+      if (out.json) {
+        process.stdout.write(
+          JSON.stringify({ ok: false, command: "send", error: firstLine }) + "\n"
+        );
+        process.exit(1);
+      }
+      console.error(`
+${firstLine}`);
+      if (!/is not an email address/.test(firstLine))
+        console.error(
+          "Troubleshooting: https://docs.learncard.com/start-here/your-first-integration#if-something-goes-wrong"
+        );
+      process.exit(1);
+    }
+  }
+);
+const commandOptions = (command) => command.option("-y, --yes", "accept defaults without prompting").option("--profile-id <id>", "public handle for your issuer profile").option("--network <url>", "network tRPC URL or staging (default: production)").option("--json", "print a single JSON result on stdout");
+const runCommand = async (command, options, action, wrap = true) => {
+  out.json = !!options.json;
+  out.result = {};
+  try {
+    await action(
+      fs__default$1["default"].readFile(require.resolve("@learncard/didkit-plugin/dist/didkit/didkit_wasm_bg.wasm"))
+    );
+    if (out.json && wrap) {
+      process.stdout.write(JSON.stringify(__spreadValues$6({ ok: true, command }, out.result)) + "\n");
+    }
+    process.exit(process.exitCode || 0);
+  } catch (error) {
+    const message = error instanceof Error ? error.message.split("\n")[0] : "Command failed. Please try again.";
+    if (out.json && wrap) {
+      process.stdout.write(JSON.stringify({ ok: false, command, error: message }) + "\n");
+      process.exit(1);
+    }
+    console.error(message);
+    process.exit(1);
+  }
+};
+commandOptions(
+  commander.program.command("consent-contract").description("Connect a user's LearnCard to your platform.")
+).option("--name <name>", "contract name (default: issuer display name)").option(
+  "--redirect-url <url>",
+  "callback URL (default: http://localhost:3000/consent-callback)"
+).option("--description <text>", "what users see when asked to consent").option(
+  "--needs-guardian-consent",
+  "GameFlow: minors need a guardian to approve the connection"
+).action(
+  (options) => runCommand("consent-contract", options, async (didkit) => {
+    const { runConsentContract } = await Promise.resolve().then(function () { return consentContract; });
+    await runConsentContract(__spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commandOptions(commander.program.command("embed").description("Put a Claim button on your site.")).option("--name <name>", "integration name (default: issuer display name)").option(
+  "--domains <origins>",
+  "comma-separated origins (default: http://localhost:3000,http://localhost:5173)"
+).option("--rotate-key", "rotate the integration publishable key").action(
+  (options) => runCommand("embed", options, async (didkit) => {
+    const { runEmbed } = await Promise.resolve().then(function () { return embed; });
+    await runEmbed(__spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commandOptions(
+  commander.program.command("setup-signing").description("Set up LearnCard to sign credentials for your project.")
+).option("--name <name>", "signing authority name (default: default-issuer)").option("--endpoint <url>", "register your own VC-API signing service instead (with --did)").option("--did <did>", "DID of your own signing service (with --endpoint)").action(
+  (options) => runCommand("setup-signing", options, async (didkit) => {
+    const { runSetupSigning } = await Promise.resolve().then(function () { return setupSigning$1; });
+    await runSetupSigning(__spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commandOptions(
+  commander.program.command("token").description("Create a scoped API token and reusable send.sh.")
+).option("--name <name>", "auth grant name (default: cli-<date>)").option("--scope <scope>", "space-separated permissions (default: boosts:write)").option("--revoke <grantId>", "revoke an existing auth grant").option("--expires <days>", "token lifetime in days (default: no expiry)").option("--list", "list your auth grants").action(
+  (options) => runCommand("token", options, async (didkit) => {
+    const { runToken } = await Promise.resolve().then(function () { return token; });
+    await runToken(__spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commander.program.command("verify <file>").description("Verify a credential or presentation JSON file; use - for stdin.").option("--json", "print the raw verification result").action(
+  (file, options) => runCommand(
+    "verify",
+    options,
+    async (didkit) => {
+      const { runVerify } = await Promise.resolve().then(function () { return verify; });
+      await runVerify(file, __spreadProps$4(__spreadValues$6({}, options), { didkit }));
+    },
+    false
+  )
+);
+commandOptions(
+  commander.program.command("revoke <credentialUri>").description("Revoke or suspend an issued credential on the network.")
+).option("--suspend", "suspend instead of permanently revoking").option("--template-uri <uri>", "template URI if it cannot be read from the credential").option(
+  "--recipient <profileId>",
+  "recipient profile ID if it cannot be read from the credential"
+).action(
+  (uri, options) => runCommand("revoke", options, async (didkit) => {
+    const { runRevoke } = await Promise.resolve().then(function () { return revoke; });
+    await runRevoke(uri, __spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commandOptions(
+  commander.program.command("status [activityId]").description("What happened to a credential you sent: created, delivered, claimed.")
+).option("--limit <n>", "how many recent sends to list (default: 20)").option(
+  "--event <type>",
+  "only list sends whose latest event is this: created|delivered|claimed|expired|failed"
+).action(
+  (activityId, options) => runCommand("status", options, async (didkit) => {
+    const { runStatus } = await Promise.resolve().then(function () { return status; });
+    await runStatus(activityId, __spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commander.program.command("open [target]").description(
+  "Open the LearnCard app signed in as this project. Targets: portal (default), wallet, template, contract, integration."
+).option("-y, --yes", "accept defaults without prompting").option("--network <url>", "network tRPC URL or staging (default: production)").option("--app-url <url>", "LearnCard app URL for self-hosted or local networks").option("--url-fragment", "pass the seed in the URL fragment instead of the clipboard").option("--no-browser", "print the URL without opening a browser").option("--json", "print a single JSON result on stdout").action(
+  (target, options) => runCommand("open", options, async () => {
+    const { runOpen, OPEN_TARGETS } = await Promise.resolve().then(function () { return open; });
+    if (target && !(target in OPEN_TARGETS))
+      throw new Error(
+        `Unknown target "${target}". Use one of: ${Object.keys(OPEN_TARGETS).join(", ")}.`
+      );
+    await runOpen(target, options);
+  })
+);
+commandOptions(
+  commander.program.command("webhook [email]").description("Know when your credential was claimed.")
+).option("--to <email>", "recipient email").option("--url <publicUrl>", "public HTTPS webhook URL").option("--port <n>", "receiver port (default: 8787)").option("--name <name>", "display name for your issuer profile").option(
+  "--timeout <seconds>",
+  "in --json mode, seconds to wait for webhook events (default: 60)"
+).option("--wait-for-claim", "in --json mode, also wait for ISSUANCE_CLAIMED before exiting").action(
+  (email, options) => runCommand("webhook", options, async (didkit) => {
+    const { runWebhook } = await Promise.resolve().then(function () { return webhook; });
+    await runWebhook(email, __spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+const JOURNEY = [
+  "send",
+  "status",
+  "setup-signing",
+  "token",
+  "webhook",
+  "consent-contract",
+  "embed",
+  "verify",
+  "revoke",
+  "open",
+  "init",
+  "repl"
+];
+commander.program.name("learncard").description(
+  "Issue, track, and verify credentials from the terminal. Every command shares the .env in the current folder."
+).showSuggestionAfterError().configureHelp({
+  sortSubcommands: false,
+  visibleCommands: (cmd) => [...cmd.commands].sort((a, b) => JOURNEY.indexOf(a.name()) - JOURNEY.indexOf(b.name()))
+}).addHelpText(
+  "before",
+  "\nStart here:  npx @learncard/cli send you@example.com\nThen:        npx @learncard/cli status\n"
+).addHelpText(
+  "after",
+  "\nEvery command: -y skips prompts, --json prints one machine-readable result, --network staging|<url> picks the network.\nEnvironment:\n  LC_YES=1  Same as passing -y to every command.\n  LCA_API_URL, NETWORK_URL  Override service URLs for self-hosted networks.\n"
+);
+const runRepl = async (_seed = generateRandomSeed()) => {
   var _a, _b, _c, _d, _e;
   console.clear();
   const envSeed = (_a = process.env.LEARNCARD_CLI_SEED) != null ? _a : process.env.SEED;
   const seedInput = envSeed != null ? envSeed : _seed;
   const seed = seedInput.padStart(64, "0");
   console.log(
-    gradient__default["default"](["cyan", "green"])(figlet__default["default"].textSync("Learn Card", "Big Money-ne"))
+    gradient__default["default"](["cyan", "green"])(figlet__default["default"].textSync("Learn Card", { font: "Big Money-ne" }))
   );
   console.log("Welcome to the Learn Card CLI!\n");
   console.log(`Your seed is ${seed}
@@ -391,13 +1314,13 @@ commander.program.version(packageJson.version).argument("[seed]").action(async (
   console.log("Creating wallet...");
   cliGlobals.seed = seed;
   cliGlobals.generateRandomSeed = generateRandomSeed;
-  cliGlobals.emptyLearnCard = init.emptyLearnCard;
-  cliGlobals.learnCardFromSeed = init.learnCardFromSeed;
-  cliGlobals.initLearnCard = init.initLearnCard;
-  const didkit = fs__default["default"].readFile(
+  cliGlobals.emptyLearnCard = init$1.emptyLearnCard;
+  cliGlobals.learnCardFromSeed = init$1.learnCardFromSeed;
+  cliGlobals.initLearnCard = init$1.initLearnCard;
+  const didkit = fs__default$1["default"].readFile(
     require.resolve("@learncard/didkit-plugin/dist/didkit/didkit_wasm_bg.wasm")
   );
-  const _learnCard = await init.initLearnCard({
+  const _learnCard = await init$1.initLearnCard({
     seed,
     network: true,
     allowRemoteContexts: true,
@@ -424,14 +1347,11 @@ commander.program.version(packageJson.version).argument("[seed]").action(async (
     holderContinuity.exportLearnCardBundle,
     cliGlobals.learnCard
   );
-  cliGlobals.restoreLearnCardFromBundle = createRestoreLearnCardFromBundleHelper(
-    holderContinuity.restoreLearnCardFromBundle,
-    {
-      network: true,
-      allowRemoteContexts: true,
-      didkit
-    }
-  );
+  cliGlobals.restoreLearnCardFromBundle = createRestoreLearnCardFromBundleHelper(holderContinuity.restoreLearnCardFromBundle, {
+    network: true,
+    allowRemoteContexts: true,
+    didkit
+  });
   cliGlobals.importLearnCardBundle = holderContinuity.importLearnCardBundle;
   cliGlobals.createLearnCardBundle = holderContinuity.createLearnCardBundle;
   cliGlobals.readLearnCardBundle = holderContinuity.readLearnCardBundle;
@@ -455,9 +1375,7 @@ commander.program.version(packageJson.version).argument("[seed]").action(async (
   console.log(`\u2502 ${g.restoreLearnCardFromBundle} \u2502 Restore original wallet from ZIP \u2502`);
   console.log("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
   console.log("");
-  console.log(
-    "For help/documentation regarding your wallet, please read the documentation at\n"
-  );
+  console.log("For help/documentation regarding your wallet, please read the documentation at\n");
   console.log("https://docs.learncard.com/sdks/learncard-core/construction\n");
   console.log("To get a feel for what's possible, try some of the following commands\n");
   console.log(
@@ -501,4 +1419,963 @@ commander.program.version(packageJson.version).argument("[seed]").action(async (
   );
   console.log("");
   await startCliRepl(colorizeReplInput);
-}).parse(process.argv);
+};
+commandOptions(
+  commander.program.command("init").description("Create this folder's issuer identity and profile without sending anything.").option("--name <displayName>", "display name for your issuer profile")
+).action(
+  (options) => runCommand("init", options, async (didkit) => {
+    const { runInit } = await Promise.resolve().then(function () { return init; });
+    await runInit(__spreadProps$4(__spreadValues$6({}, options), { didkit }));
+  })
+);
+commander.program.command("repl [seed]").description("Interactive JavaScript console with a LearnCard preloaded (advanced).").action(runRepl);
+commander.program.version(packageJson.version);
+if (process.argv.length <= 2 && process.stdin.isTTY) {
+  runRepl();
+} else {
+  commander.program.parse(process.argv);
+}
+
+const writeSnippet = async (filename, source) => {
+  try {
+    await fs__default["default"].writeFile(path__default["default"].join(process.cwd(), filename), source, { flag: "wx" });
+    out.log(`Wrote ./${filename}`);
+    return true;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    out.log(`Kept existing ./${filename}`);
+    return false;
+  }
+};
+
+var __defProp$5 = Object.defineProperty;
+var __defProps$3 = Object.defineProperties;
+var __getOwnPropDescs$3 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$5 = Object.getOwnPropertySymbols;
+var __hasOwnProp$5 = Object.prototype.hasOwnProperty;
+var __propIsEnum$5 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$5 = (obj, key, value) => key in obj ? __defProp$5(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$5 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$5.call(b, prop))
+      __defNormalProp$5(a, prop, b[prop]);
+  if (__getOwnPropSymbols$5)
+    for (var prop of __getOwnPropSymbols$5(b)) {
+      if (__propIsEnum$5.call(b, prop))
+        __defNormalProp$5(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$3 = (a, b) => __defProps$3(a, __getOwnPropDescs$3(b));
+const consentUrl = (uri, returnTo, network) => {
+  const url = new URL("/consent-flow", appUrlFor(network));
+  url.searchParams.set("uri", uri);
+  url.searchParams.set("returnTo", returnTo);
+  return url.toString();
+};
+const runConsentContract = async (options) => {
+  var _a, _b;
+  const project = await loadProject(process.cwd());
+  const returnTo = options.redirectUrl || project.env.RETURN_TO || "http://localhost:3000/consent-callback";
+  if (!["http:", "https:"].includes(new URL(returnTo).protocol)) {
+    throw new Error("Redirect URL must use HTTP or HTTPS.");
+  }
+  const identity = await ensureIdentity(project, options);
+  const learnCard = await connect(project, options);
+  await ensureProfile(learnCard, identity, project);
+  let uri = project.env[KEYS.CONTRACT_URI];
+  if (!uri) {
+    const prompts = createPrompts(options.yes);
+    let name;
+    try {
+      name = (_a = options.name) != null ? _a : await prompts.ask("Contract name", identity.displayName);
+    } finally {
+      prompts.close();
+    }
+    const contract = __spreadProps$3(__spreadValues$5({
+      name,
+      description: (_b = options.description) != null ? _b : "Allow us to read your name and achievements and send achievements."
+    }, options.needsGuardianConsent ? { needsGuardianConsent: true } : {}), {
+      redirectUrl: returnTo,
+      contract: {
+        read: {
+          personal: { name: { required: false } },
+          credentials: { categories: { Achievement: { required: false } } }
+        },
+        write: {
+          personal: {},
+          credentials: { categories: { Achievement: { required: false } } }
+        }
+      }
+    });
+    uri = await learnCard.invoke.createContract(contract);
+    out.log("Created your consent contract.");
+  } else {
+    out.log("Reusing your saved consent contract.");
+  }
+  await saveProject(project, { [KEYS.CONTRACT_URI]: uri, RETURN_TO: returnTo });
+  const services = resolveServices(project.env, options.network);
+  const files = [];
+  for (const [file, source] of Object.entries({
+    "create-contract.mjs": CREATE_CONTRACT_MJS,
+    "consent-callback.mjs": CONSENT_CALLBACK_MJS,
+    "read-user-data.mjs": READ_USER_DATA_MJS,
+    "issue-through-contract.mjs": ISSUE_THROUGH_CONTRACT_MJS
+  })) {
+    const localized = services.network === PRODUCTION_NETWORK ? source : localizeSnippet(
+      source.replaceAll(
+        "seed: SECURE_SEED, network: true",
+        "seed: process.env.SECURE_SEED, network: true"
+      ),
+      services
+    );
+    if (await writeSnippet(file, localized)) files.push(`./${file}`);
+  }
+  const contractConsentUrl = consentUrl(uri, returnTo, services.network);
+  out.log(contractConsentUrl);
+  if (![PRODUCTION_NETWORK, STAGING_NETWORK].includes(services.network)) {
+    out.log(
+      "Note: this is a production app URL; use an app connected to your local network to consent."
+    );
+  }
+  out.log(
+    "The tutorial create-contract.mjs creates a new contract and requires HTTPS; reuse CONTRACT_URI for this dev setup."
+  );
+  out.log("Read scripts require a verified CONSENT_VP, not a bare DID.");
+  out.log("Next: node --env-file=.env consent-callback.mjs");
+  out.log("See the contract in the app: npx @learncard/cli open contract");
+  out.set({ contractUri: uri, consentUrl: contractConsentUrl, returnTo, files });
+};
+
+var consentContract = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    consentUrl: consentUrl,
+    runConsentContract: runConsentContract
+});
+
+var __defProp$4 = Object.defineProperty;
+var __defProps$2 = Object.defineProperties;
+var __getOwnPropDescs$2 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$4 = Object.getOwnPropertySymbols;
+var __hasOwnProp$4 = Object.prototype.hasOwnProperty;
+var __propIsEnum$4 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$4 = (obj, key, value) => key in obj ? __defProp$4(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$4 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$4.call(b, prop))
+      __defNormalProp$4(a, prop, b[prop]);
+  if (__getOwnPropSymbols$4)
+    for (var prop of __getOwnPropSymbols$4(b)) {
+      if (__propIsEnum$4.call(b, prop))
+        __defNormalProp$4(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$2 = (a, b) => __defProps$2(a, __getOwnPropDescs$2(b));
+const validateDomains = (domains) => domains.split(",").map((domain) => {
+  const result = types.LCNDomainOrOriginValidator.safeParse(domain.trim());
+  if (!result.success)
+    throw new Error(result.error.format()._errors.join("; ") || result.error.message);
+  return result.data;
+});
+const scriptString = (value) => JSON.stringify(value).replace(/</g, "\\u003c");
+const personalizeClaimButton = (key, apiBaseUrl) => CLAIM_BUTTON_HTML.replace("'PUBLISHABLE_KEY_PLACEHOLDER'", () => scriptString(key)).replace(
+  "'https://network.learncard.com/api'",
+  () => scriptString(apiBaseUrl)
+);
+const runEmbed = async (options) => {
+  var _a, _b;
+  const domains = validateDomains(
+    (_a = options.domains) != null ? _a : "http://localhost:3000,http://localhost:5173"
+  );
+  const project = await loadProject(process.cwd());
+  const identity = await ensureIdentity(project, options);
+  const learnCard = await connect(project, __spreadProps$2(__spreadValues$4({}, options), { lca: true }));
+  await ensureProfile(learnCard, identity, project);
+  await setupSigning(project, learnCard);
+  let id = project.env[KEYS.INTEGRATION_ID];
+  const reused = Boolean(id);
+  if (!id) {
+    id = await learnCard.invoke.addIntegration({
+      name: (_b = options.name) != null ? _b : identity.displayName,
+      whitelistedDomains: domains,
+      guideType: "embed-claim"
+    });
+    await saveProject(project, { [KEYS.INTEGRATION_ID]: id });
+  }
+  let integration = await learnCard.invoke.getIntegration(id);
+  if (!integration) throw new Error("Saved integration was not found. Check INTEGRATION_ID.");
+  if (options.rotateKey) {
+    if (!await learnCard.invoke.updateIntegration(id, { rotatePublishableKey: true })) {
+      throw new Error("Could not rotate the publishable key.");
+    }
+    integration = await learnCard.invoke.getIntegration(id);
+    if (!integration) throw new Error("Could not read the rotated integration.");
+  }
+  await saveProject(project, {
+    [KEYS.INTEGRATION_ID]: id,
+    [KEYS.PUBLISHABLE_KEY]: integration.publishableKey
+  });
+  const apiBase = resolveServices(project.env, options.network).network.replace(
+    /\/trpc\/?$/,
+    "/api"
+  );
+  const wroteClaimButton = await writeSnippet(
+    "claim-button.html",
+    personalizeClaimButton(integration.publishableKey, apiBase)
+  );
+  out.log(`Publishable key: ${integration.publishableKey}`);
+  out.log(`Whitelisted origins: ${integration.whitelistedDomains.join(", ")}`);
+  if (options.domains && reused) {
+    out.log(
+      "Existing integrations keep their saved origins; change them in the Developer Portal."
+    );
+  }
+  if (options.rotateKey)
+    out.log("Update the publishable key in any existing claim-button.html and deployed pages.");
+  const firstDomain = integration.whitelistedDomains[0];
+  const origin = (firstDomain == null ? void 0 : firstDomain.startsWith("http")) ? firstDomain : firstDomain ? `http://${firstDomain}` : void 0;
+  out.log(
+    origin ? `Next: Open claim-button.html from ${origin} (a whitelisted origin), not file://.
+See the integration in the app: npx @learncard/cli open integration` : "Next: add a whitelisted origin in the Developer Portal, then serve claim-button.html there, not file://."
+  );
+  out.set({
+    integrationId: id,
+    publishableKey: integration.publishableKey,
+    whitelistedDomains: integration.whitelistedDomains,
+    files: wroteClaimButton ? ["./claim-button.html"] : []
+  });
+};
+
+var embed = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    validateDomains: validateDomains,
+    personalizeClaimButton: personalizeClaimButton,
+    runEmbed: runEmbed
+});
+
+var __defProp$3 = Object.defineProperty;
+var __defProps$1 = Object.defineProperties;
+var __getOwnPropDescs$1 = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols$3 = Object.getOwnPropertySymbols;
+var __hasOwnProp$3 = Object.prototype.hasOwnProperty;
+var __propIsEnum$3 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$3 = (obj, key, value) => key in obj ? __defProp$3(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$3 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$3.call(b, prop))
+      __defNormalProp$3(a, prop, b[prop]);
+  if (__getOwnPropSymbols$3)
+    for (var prop of __getOwnPropSymbols$3(b)) {
+      if (__propIsEnum$3.call(b, prop))
+        __defNormalProp$3(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps$1 = (a, b) => __defProps$1(a, __getOwnPropDescs$1(b));
+const SCOPE_RESOURCES = [
+  "boosts",
+  "inbox",
+  "credentials",
+  "presentations",
+  "profiles",
+  "profileManagers",
+  "connections",
+  "contracts",
+  "contracts-data",
+  "signingAuthorities",
+  "authGrants",
+  "didMetadata",
+  "claimHooks",
+  "skills",
+  "app-store",
+  "integrations",
+  "contact-methods",
+  "activity",
+  "storage"
+];
+const validateScope = (scope) => {
+  for (const part of scope.trim().split(/\s+/).filter(Boolean)) {
+    const [resource, action, extra] = part.split(":");
+    if (extra !== void 0 || !resource || resource !== "*" && !SCOPE_RESOURCES.some((value) => value === resource)) {
+      throw new Error(
+        `Unknown scope resource in "${part}". Choose: ${SCOPE_RESOURCES.join(", ")}, or *.`
+      );
+    }
+    if (!action || !["read", "write", "delete", "*"].includes(action)) {
+      throw new Error(`Invalid action in "${part}". Use read, write, delete, or *.`);
+    }
+  }
+  return scope.trim().split(/\s+/).filter(Boolean).join(" ");
+};
+const runToken = async (options) => {
+  var _a, _b, _c, _d, _e, _f;
+  const scope = validateScope((_a = options.scope) != null ? _a : "boosts:write");
+  const project = await loadProject(process.cwd());
+  const identity = await ensureIdentity(project, __spreadProps$1(__spreadValues$3({}, options), { name: void 0 }));
+  const learnCard = await connect(project, options);
+  await ensureProfile(learnCard, identity, project);
+  if (options.list) {
+    const grants = (_b = await learnCard.invoke.getAuthGrants()) != null ? _b : [];
+    for (const g of grants)
+      out.log(
+        `${g.id}  ${((_c = g.status) != null ? _c : "").padEnd(8)} ${((_d = g.scope) != null ? _d : "").padEnd(22)} ${(_e = g.name) != null ? _e : ""}${g.expiresAt ? `  expires ${g.expiresAt.slice(0, 10)}` : ""}`
+      );
+    if (!grants.length) out.log("No auth grants yet.");
+    out.set({
+      grants: grants.map((g) => ({
+        id: g.id,
+        name: g.name,
+        scope: g.scope,
+        status: g.status,
+        expiresAt: g.expiresAt
+      }))
+    });
+    return;
+  }
+  if (options.revoke) {
+    if (!await learnCard.invoke.revokeAuthGrant(options.revoke))
+      throw new Error("Could not revoke auth grant.");
+    out.log(`Revoked auth grant ${options.revoke}.`);
+    out.log("Create a replacement: npx @learncard/cli token");
+    out.set({ grantId: options.revoke });
+    return;
+  }
+  const id = await learnCard.invoke.addAuthGrant(__spreadValues$3({
+    name: (_f = options.name) != null ? _f : `cli-${( new Date()).toISOString().slice(0, 10)}`,
+    scope
+  }, options.expires ? {
+    expiresAt: new Date(
+      Date.now() + Number(options.expires) * 864e5
+    ).toISOString()
+  } : {}));
+  const token = await learnCard.invoke.getAPITokenForAuthGrant(id);
+  await fs__default["default"].chmod(project.envPath, 384);
+  await saveProject(project, { API_TOKEN: token, API_TOKEN_SCOPE: scope });
+  out.log(`Created auth grant ${id}.`);
+  out.log(
+    "Warning: this token won't be shown again by this command. It is saved in .env; keep it private."
+  );
+  out.log(token);
+  const file = path__default["default"].join(process.cwd(), "send.sh");
+  let wroteSendSh = false;
+  try {
+    await fs__default["default"].writeFile(
+      file,
+      withEnvTokenLoader(
+        localizeSnippet(SEND_SH, resolveServices(project.env, options.network))
+      ),
+      {
+        flag: "wx",
+        mode: 448
+      }
+    );
+    out.log("Wrote ./send.sh");
+    wroteSendSh = true;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    out.log("Kept existing ./send.sh");
+  }
+  out.log(
+    "Next: save your send payload as request.json, then run sh ./send.sh (example: https://docs.learncard.com/start-here/your-first-integration)."
+  );
+  out.set({ grantId: id, scope, token, files: wroteSendSh ? ["./send.sh"] : [] });
+};
+
+var token = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    SCOPE_RESOURCES: SCOPE_RESOURCES,
+    validateScope: validateScope,
+    runToken: runToken
+});
+
+var __defProp$2 = Object.defineProperty;
+var __getOwnPropSymbols$2 = Object.getOwnPropertySymbols;
+var __hasOwnProp$2 = Object.prototype.hasOwnProperty;
+var __propIsEnum$2 = Object.prototype.propertyIsEnumerable;
+var __knownSymbol = (name, symbol) => (symbol = Symbol[name]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name);
+var __defNormalProp$2 = (obj, key, value) => key in obj ? __defProp$2(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$2 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$2.call(b, prop))
+      __defNormalProp$2(a, prop, b[prop]);
+  if (__getOwnPropSymbols$2)
+    for (var prop of __getOwnPropSymbols$2(b)) {
+      if (__propIsEnum$2.call(b, prop))
+        __defNormalProp$2(a, prop, b[prop]);
+    }
+  return a;
+};
+var __forAwait = (obj, it, method) => (it = obj[__knownSymbol("asyncIterator")]) ? it.call(obj) : (obj = obj[__knownSymbol("iterator")](), it = {}, method = (key, fn) => (fn = obj[key]) && (it[key] = (arg) => new Promise((yes, no, done) => (arg = fn.call(obj, arg), done = arg.done, Promise.resolve(arg.value).then((value) => yes({ value, done }), no)))), method("next"), method("return"), it);
+const isPresentation = (value) => {
+  if (!value || typeof value !== "object" || !("type" in value)) return false;
+  const types = Array.isArray(value.type) ? value.type : [value.type];
+  return types.includes("VerifiablePresentation");
+};
+const checkName = (value) => value === "signature" ? "proof" : value;
+const verificationFailed = (result) => Array.isArray(result) ? result.some((item) => item.status === "Failed") : result.errors.length > 0;
+const formatVerification = (result) => {
+  if (Array.isArray(result))
+    return result.map((item) => {
+      const check = checkName(item.check);
+      if (item.status === "Success") return `\u2713 ${check}`;
+      return `${item.status === "Failed" ? "\u2717" : "!"} ${check}: ${item.details || item.message || "Check failed"}`;
+    });
+  return [
+    ...result.checks.map((check) => `\u2713 ${checkName(check)}`),
+    ...result.warnings.map((warning) => `! ${warning}`),
+    ...result.errors.map((error) => {
+      const match = error.match(/^(.+?) error:\s*(.*)$/);
+      return match ? `\u2717 ${checkName(match[1])}: ${match[2]}` : `\u2717 ${error}`;
+    })
+  ];
+};
+const runVerify = async (file, options) => {
+  let text;
+  if (file === "-") {
+    const chunks = [];
+    try {
+      for (var iter = __forAwait(process.stdin), more, temp, error; more = !(temp = await iter.next()).done; more = false) {
+        const chunk = temp.value;
+        chunks.push(Buffer.from(chunk));
+      }
+    } catch (temp) {
+      error = [temp];
+    } finally {
+      try {
+        more && (temp = iter.return) && await temp.call(iter);
+      } finally {
+        if (error)
+          throw error[0];
+      }
+    }
+    text = Buffer.concat(chunks).toString("utf8");
+  } else text = await fs__default["default"].readFile(file, "utf8");
+  const input = JSON.parse(text);
+  if (!input || typeof input !== "object" || !("type" in input))
+    throw new Error("Expected a credential or presentation JSON object with a type.");
+  const presentation = isPresentation(input);
+  const types = Array.isArray(input.type) ? input.type : [input.type];
+  if (!presentation && !types.includes("VerifiableCredential"))
+    throw new Error("Expected VerifiableCredential or VerifiablePresentation in type.");
+  const learnCard = await init$1.initLearnCard(__spreadValues$2({}, options.didkit && { didkit: options.didkit }));
+  const result = presentation ? await learnCard.invoke.verifyPresentation(input) : options.json ? await learnCard.invoke.verifyCredential(input) : await learnCard.invoke.verifyCredential(input, {}, true);
+  if (options.json) console.log(JSON.stringify(result, null, 2));
+  else {
+    for (const line of formatVerification(result)) console.log(line);
+    console.log("Next: review warnings and issuer trust before accepting this credential.");
+  }
+  if (verificationFailed(result)) process.exitCode = 1;
+};
+
+var verify = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    isPresentation: isPresentation,
+    verificationFailed: verificationFailed,
+    formatVerification: formatVerification,
+    runVerify: runVerify
+});
+
+const templateUriOf = (credential, options) => {
+  const value = credential && typeof credential === "object" ? credential : {};
+  const templateUri = options.templateUri || (typeof value.boostId === "string" ? value.boostId : void 0);
+  if (!templateUri)
+    throw new Error(
+      "This credential was not issued from a template. Pass --template-uri <uri> and --recipient <profileId>."
+    );
+  return templateUri;
+};
+const recipientOf = (records, credentialUri) => {
+  var _a;
+  return (_a = records.find((record) => record.uri === credentialUri)) == null ? void 0 : _a.to.profileId;
+};
+const runRevoke = async (uri, options) => {
+  var _a;
+  const project = await loadProject(process.cwd());
+  await ensureIdentity(project, options);
+  const learnCard = await connect(project, options);
+  const credential = options.templateUri && options.recipient ? void 0 : await learnCard.read.get(uri);
+  const templateUri = templateUriOf(credential, options);
+  let profileId = options.recipient;
+  let cursor;
+  while (!profileId) {
+    const page = await learnCard.invoke.getPaginatedBoostRecipients(
+      templateUri,
+      100,
+      cursor,
+      true
+    );
+    profileId = recipientOf(page.records, uri);
+    if (profileId || !page.hasMore) break;
+    cursor = (_a = page.cursor) != null ? _a : void 0;
+  }
+  if (!profileId)
+    throw new Error(
+      `No recipient of ${templateUri} holds ${uri}. If it was sent to an email and not yet claimed, there is nothing to revoke; otherwise pass --recipient <profileId>.`
+    );
+  const target = { templateUri, profileId };
+  const result = options.suspend ? await learnCard.invoke.suspendBoostRecipient(target.templateUri, target.profileId, uri) : await learnCard.invoke.revokeBoostRecipient(target.templateUri, target.profileId, uri);
+  if (!result) throw new Error("The network did not update this credential.");
+  const status = options.suspend ? "suspended" : "revoked";
+  out.log(
+    `${options.suspend ? "Suspended" : "Revoked"} ${uri}. Verifiers will see status: ${status} when they next refresh its status list; no propagation interval is documented.`
+  );
+  out.log("Only credentials with a credentialStatus entry support status-list verification.");
+  out.log("Check the delivered JSON: npx @learncard/cli verify credential.json");
+  out.set({ credentialUri: uri, templateUri, recipient: profileId, action: status });
+};
+
+var revoke = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    templateUriOf: templateUriOf,
+    recipientOf: recipientOf,
+    runRevoke: runRevoke
+});
+
+var __defProp$1 = Object.defineProperty;
+var __getOwnPropSymbols$1 = Object.getOwnPropertySymbols;
+var __hasOwnProp$1 = Object.prototype.hasOwnProperty;
+var __propIsEnum$1 = Object.prototype.propertyIsEnumerable;
+var __defNormalProp$1 = (obj, key, value) => key in obj ? __defProp$1(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues$1 = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp$1.call(b, prop))
+      __defNormalProp$1(a, prop, b[prop]);
+  if (__getOwnPropSymbols$1)
+    for (var prop of __getOwnPropSymbols$1(b)) {
+      if (__propIsEnum$1.call(b, prop))
+        __defNormalProp$1(a, prop, b[prop]);
+    }
+  return a;
+};
+const LATEST_FIRST = (a, b) => b.timestamp.localeCompare(a.timestamp);
+const formatEvent = (event) => {
+  var _a, _b;
+  const when = event.timestamp.replace("T", " ").slice(0, 19);
+  const failure = event.eventType === "FAILED" ? `  ${String((_b = (_a = event.metadata) == null ? void 0 : _a.error) != null ? _b : "")}` : "";
+  return `${when}  ${event.eventType.padEnd(9)} ${event.recipientIdentifier}${failure}`;
+};
+const summarize = (chain) => {
+  var _a, _b, _c;
+  const ordered = [...chain].sort(LATEST_FIRST);
+  const latest = ordered[0];
+  const claimed = chain.find((e) => e.eventType === "CLAIMED");
+  return {
+    state: (_a = latest == null ? void 0 : latest.eventType) != null ? _a : "UNKNOWN",
+    recipient: latest == null ? void 0 : latest.recipientIdentifier,
+    template: (_b = latest == null ? void 0 : latest.boost) == null ? void 0 : _b.name,
+    credentialUri: (_c = claimed == null ? void 0 : claimed.credentialUri) != null ? _c : latest == null ? void 0 : latest.credentialUri,
+    credentialStatus: latest == null ? void 0 : latest.status,
+    events: ordered.map((e) => {
+      var _a2;
+      return __spreadValues$1({
+        type: e.eventType,
+        at: e.timestamp
+      }, e.eventType === "FAILED" && ((_a2 = e.metadata) == null ? void 0 : _a2.error) ? { error: e.metadata.error } : {});
+    })
+  };
+};
+const runStatus = async (activityId, options) => {
+  var _a, _b, _c;
+  const project = await loadProject(process.cwd());
+  if (!project.env.SECURE_SEED)
+    throw new Error(
+      "No SECURE_SEED in .env. Send something first: npx @learncard/cli send you@example.com"
+    );
+  await ensureIdentity(project, options);
+  const learnCard = await connect(project, options);
+  if (activityId) {
+    const chain = await learnCard.invoke.getActivityChain({ activityId });
+    if (!chain.length) throw new Error(`No activity found for ${activityId}.`);
+    const summary = summarize(chain);
+    out.log(`${summary.state}  ${(_a = summary.template) != null ? _a : ""} \u2192 ${summary.recipient}`);
+    for (const e of [...chain].sort(LATEST_FIRST)) out.log(`  ${formatEvent(e)}`);
+    if (summary.credentialUri) out.log(`Credential: ${summary.credentialUri}`);
+    if (summary.state !== "CLAIMED")
+      out.log("Not claimed yet. Re-run to check again, or use `webhook` to be told.");
+    out.set(__spreadValues$1({ activityId }, summary));
+    return;
+  }
+  const limit = Number((_b = options.limit) != null ? _b : 20);
+  const eventType = (_c = options.event) == null ? void 0 : _c.toUpperCase();
+  const page = await learnCard.invoke.getMyActivities(__spreadValues$1({
+    limit
+  }, eventType ? { eventType } : {}));
+  const records = page.records;
+  if (!records.length) {
+    out.log("No sends yet. Try: npx @learncard/cli send you@example.com");
+    out.set({ activities: [] });
+    return;
+  }
+  out.log("activityId                            state      recipient");
+  for (const r of records)
+    out.log(`${r.activityId}  ${r.eventType.padEnd(9)}  ${r.recipientIdentifier}`);
+  if (page.hasMore)
+    out.log(`\u2026more. Raise --limit or filter with --event claimed|delivered|created.`);
+  out.log("Details for one: npx @learncard/cli status <activityId>");
+  out.set({
+    activities: records.map((r) => {
+      var _a2;
+      return {
+        activityId: r.activityId,
+        state: r.eventType,
+        recipient: r.recipientIdentifier,
+        template: (_a2 = r.boost) == null ? void 0 : _a2.name,
+        at: r.timestamp
+      };
+    }),
+    hasMore: page.hasMore
+  });
+};
+
+var status = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    formatEvent: formatEvent,
+    summarize: summarize,
+    runStatus: runStatus
+});
+
+const OPEN_TARGETS = {
+  portal: "the Developer Portal",
+  wallet: "your wallet",
+  template: "the template you last sent from",
+  contract: "your consent contract",
+  integration: "your Claim button's integration"
+};
+const openPath = (target, env) => {
+  switch (target) {
+    case "portal":
+      return "/app-store/developer";
+    case "wallet":
+      return "/wallet";
+    case "template":
+      return env.TEMPLATE_URI ? `/app-store/developer?template=${encodeURIComponent(env.TEMPLATE_URI)}` : null;
+    case "contract":
+      return env.CONTRACT_URI ? `/app-store/developer?contract=${encodeURIComponent(env.CONTRACT_URI)}` : null;
+    case "integration":
+      return env.INTEGRATION_ID ? `/app-store/developer/integrations/${encodeURIComponent(env.INTEGRATION_ID)}` : null;
+  }
+};
+const signInUrl = (appUrl, next, seedInFragment) => {
+  const url = new URL("/developer/sign-in", appUrl);
+  url.searchParams.set("next", next);
+  if (seedInFragment) url.hash = `seed=${seedInFragment}`;
+  return url.toString();
+};
+const CLIPBOARD_TTL_MS = 6e4;
+const isHttpUrl = (value) => {
+  try {
+    return ["http:", "https:"].includes(new URL(value).protocol);
+  } catch (e) {
+    return false;
+  }
+};
+const launchBrowser = (url) => {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? (
+    // No shell involved: rundll32 receives the URL as a normal argv entry, so
+    // cmd.exe metacharacters (&, |, ^, etc.) in the URL are never interpreted.
+    ["rundll32", ["url.dll,FileProtocolHandler", url]]
+  ) : ["xdg-open", [url]];
+  node_child_process.spawn(cmd, args, { stdio: "ignore", detached: true }).unref();
+};
+const waitForClipboardClear = (seed) => new Promise((resolve) => {
+  let settled = false;
+  const finish = async () => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    process.removeListener("SIGINT", onSigint);
+    if (await clipboard__default["default"].read().catch(() => "") === seed)
+      await clipboard__default["default"].write("").catch(() => {
+      });
+    out.log("Clipboard cleared.");
+    resolve();
+  };
+  const onSigint = () => {
+    void finish();
+  };
+  const timer = setTimeout(() => void finish(), CLIPBOARD_TTL_MS);
+  process.once("SIGINT", onSigint);
+});
+const impliesNoBrowser = (options, isTTY) => options.browser === false || !isTTY || !!options.json;
+const runOpen = async (target = "portal", options) => {
+  const project = await loadProject(process.cwd());
+  const seed = project.env.SECURE_SEED;
+  if (!seed)
+    throw new Error(
+      "No SECURE_SEED in .env. Run a command that creates one first, e.g. npx @learncard/cli send you@example.com"
+    );
+  const path = openPath(target, project.env);
+  if (!path)
+    throw new Error(
+      `Nothing saved for "${target}" yet. Run the command that creates it first (send --template, consent-contract, or embed).`
+    );
+  const { network } = resolveServices(project.env, options.network);
+  if (options.appUrl && !isHttpUrl(options.appUrl))
+    throw new Error("--app-url must be a valid http(s) URL.");
+  if (!options.appUrl && network !== PRODUCTION_NETWORK && network !== STAGING_NETWORK)
+    throw new Error(
+      `${network} has no hosted LearnCard app. Pass --app-url <url> for the app connected to it.`
+    );
+  const appUrl = appUrlFor(network, options.appUrl);
+  const noBrowser = impliesNoBrowser(options, !!process.stdout.isTTY);
+  let url;
+  let seedDelivery;
+  let clipboardCleared;
+  if (options.urlFragment) {
+    url = signInUrl(appUrl, path, seed);
+    out.log(
+      "Warning: --url-fragment puts your seed in the browser URL (history, screenshots)."
+    );
+    seedDelivery = "fragment";
+  } else if (out.json) {
+    url = signInUrl(appUrl, path);
+    out.log(
+      "Seed not copied in --json mode. Paste it from .env, or re-run with --url-fragment."
+    );
+    seedDelivery = "none";
+  } else {
+    url = signInUrl(appUrl, path);
+    try {
+      await clipboard__default["default"].write(seed);
+      out.log(`Copied your seed to the clipboard (clears in ${CLIPBOARD_TTL_MS / 1e3}s).`);
+      seedDelivery = "clipboard";
+      clipboardCleared = waitForClipboardClear(seed);
+    } catch (e) {
+      out.log(
+        "Clipboard unavailable. Paste the seed from .env, or re-run with --url-fragment."
+      );
+      seedDelivery = "none";
+    }
+  }
+  if (!options.urlFragment) out.log('\u2192 Click "Paste from clipboard", then Sign in.');
+  if (!noBrowser) launchBrowser(url);
+  out.log(
+    `Opening ${OPEN_TARGETS[target]}: ${options.urlFragment ? url.split("#")[0] + "#seed=\u2026" : url}`
+  );
+  out.set({ url, target, next: path, seedDelivery });
+  await clipboardCleared;
+};
+
+var open = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    OPEN_TARGETS: OPEN_TARGETS,
+    openPath: openPath,
+    signInUrl: signInUrl,
+    impliesNoBrowser: impliesNoBrowser,
+    runOpen: runOpen
+});
+
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+const webhookConfig = (env, options, runtime = process.env) => {
+  var _a, _b, _c, _d;
+  const port = Number((_c = (_b = (_a = options.port) != null ? _a : runtime.PORT) != null ? _b : env.PORT) != null ? _c : 8787);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error("Port must be 1\u201365535.");
+  return { port, expectedDid: (_d = runtime.EXPECTED_NETWORK_DID) != null ? _d : env.EXPECTED_NETWORK_DID };
+};
+const closeWebhookReceiver = (server) => new Promise((resolve, reject) => {
+  const timer = setTimeout(() => server.closeAllConnections(), 1e3);
+  timer.unref();
+  server.close((error) => {
+    clearTimeout(timer);
+    if (error) reject(error);
+    else resolve();
+  });
+});
+const loadWebhookModule = async () => {
+  return import(`data:text/javascript;base64,${Buffer.from(WEBHOOK_MJS).toString("base64")}`);
+};
+const parseWebhookLogLine = (line) => {
+  const [type, status, issuanceId, recipient] = line.trim().split(/\s+/);
+  if (!type) return void 0;
+  return __spreadValues(__spreadValues(__spreadValues({
+    type
+  }, status && { status }), issuanceId && { issuanceId }), recipient && { recipient });
+};
+const collectWebhookEvents = (timeoutMs, waitForClaim, registerStop) => new Promise((resolve) => {
+  const events = [];
+  const originalLog = console.log;
+  const finish = () => {
+    clearTimeout(timer);
+    console.log = originalLog;
+    resolve(events);
+  };
+  const timer = setTimeout(finish, Math.max(0, timeoutMs));
+  registerStop == null ? void 0 : registerStop(finish);
+  console.log = (...args) => {
+    const [first] = args;
+    const event = typeof first === "string" ? parseWebhookLogLine(first) : void 0;
+    if (!event) return;
+    events.push(event);
+    const delivered = events.some((e) => e.type === "ISSUANCE_DELIVERED");
+    const claimed = events.some((e) => e.type === "ISSUANCE_CLAIMED");
+    if (delivered && (!waitForClaim || claimed)) finish();
+  };
+});
+const runWebhook = async (email, options) => {
+  var _a, _b, _c, _d;
+  const project = await loadProject(process.cwd());
+  const { port, expectedDid } = webhookConfig(project.env, options);
+  const production = resolveServices(project.env, options.network).network === PRODUCTION_NETWORK;
+  if (options.url && production && new URL(options.url).protocol !== "https:") {
+    throw new Error("--url must be a public HTTPS URL when using the production network.");
+  }
+  const identity = await ensureIdentity(project, options);
+  const learnCard = await connect(project, __spreadProps(__spreadValues({}, options), { lca: true }));
+  await ensureProfile(learnCard, identity, project);
+  const wroteWebhookMjs = await writeSnippet(
+    "webhook.mjs",
+    localizeSnippet(WEBHOOK_MJS, resolveServices(project.env, options.network))
+  );
+  const verifier = await init$1.initLearnCard(__spreadValues({}, options.didkit && { didkit: options.didkit }));
+  const { createWebhookReceiver } = await loadWebhookModule();
+  const server = createWebhookReceiver(verifier, expectedDid);
+  server.requestTimeout = 5e3;
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, () => {
+      server.removeListener("error", reject);
+      resolve();
+    });
+  });
+  out.log(`Listening on http://localhost:${port}`);
+  try {
+    if (!options.url) {
+      out.log(
+        `Next: expose port ${port} with ngrok/cloudflared and re-run with --url <publicUrl>. No credential sent.`
+      );
+      out.set({ port, files: wroteWebhookMjs ? ["./webhook.mjs"] : [] });
+      return;
+    }
+    if (!expectedDid) {
+      out.log(
+        "Demo: signatures are verified, but any DID is accepted. Set EXPECTED_NETWORK_DID to your trusted network DID before production."
+      );
+    }
+    const prompts = createPrompts(options.yes);
+    let recipient;
+    try {
+      recipient = email || options.to || await prompts.ask("Recipient email (--to <email>)", "");
+    } finally {
+      prompts.close();
+    }
+    if (!recipient) throw new Error("Provide an email argument or --to <email>.");
+    await setupSigning(project, learnCard, void 0, { persist: false });
+    if (!project.env[KEYS.TEMPLATE_URI]) {
+      const uri = await learnCard.invoke.createBoost(templateCredential(learnCard.id.did()), {
+        name: DEFAULT_BADGE.name,
+        category: "Achievement",
+        status: "LIVE"
+      });
+      await saveProject(project, { [KEYS.TEMPLATE_URI]: uri });
+    }
+    const templateUri = project.env[KEYS.TEMPLATE_URI];
+    const timeoutMs = (Number(options.timeout) > 0 ? Number(options.timeout) : 60) * 1e3;
+    let stopCollectingEvents;
+    const eventsPromise = out.json ? collectWebhookEvents(timeoutMs, !!options.waitForClaim, (stop) => {
+      stopCollectingEvents = stop;
+    }) : void 0;
+    const onServerError = () => {
+    };
+    if (eventsPromise) server.on("error", onServerError);
+    const result = await learnCard.invoke.send({
+      type: "boost",
+      recipient,
+      templateUri,
+      options: { webhookUrl: options.url }
+    }).catch((error) => {
+      if (eventsPromise) {
+        server.removeListener("error", onServerError);
+        stopCollectingEvents == null ? void 0 : stopCollectingEvents();
+      }
+      throw error;
+    });
+    out.log(`Sent. Watch for ISSUANCE_DELIVERED ${(_b = (_a = result.inbox) == null ? void 0 : _a.status) != null ? _b : ""}.`);
+    out.log(
+      ((_c = result.inbox) == null ? void 0 : _c.status) === "PENDING" ? `Next: click the claim link in your email to see ISSUANCE_CLAIMED. Ctrl+C to stop.` : "Next: this recipient already has LearnCard; no claim event is expected. Ctrl+C to stop."
+    );
+    if (eventsPromise) {
+      const events = await eventsPromise;
+      server.removeListener("error", onServerError);
+      out.set({
+        port,
+        url: options.url,
+        templateUri,
+        issuanceId: (_d = result.inbox) == null ? void 0 : _d.issuanceId,
+        events
+      });
+      return;
+    }
+    await new Promise((resolve, reject) => {
+      const stop = () => {
+        cleanup();
+        resolve();
+      };
+      const fail = (error) => {
+        cleanup();
+        reject(error);
+      };
+      const cleanup = () => {
+        process.removeListener("SIGINT", stop);
+        process.removeListener("SIGTERM", stop);
+        server.removeListener("error", fail);
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+      server.once("error", fail);
+    });
+  } finally {
+    await closeWebhookReceiver(server);
+  }
+};
+
+var webhook = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    webhookConfig: webhookConfig,
+    closeWebhookReceiver: closeWebhookReceiver,
+    loadWebhookModule: loadWebhookModule,
+    parseWebhookLogLine: parseWebhookLogLine,
+    collectWebhookEvents: collectWebhookEvents,
+    runWebhook: runWebhook
+});
+
+const runInit = async (options) => {
+  const project = await loadProject(process.cwd());
+  const fresh = !project.env.SECURE_SEED;
+  const identity = await ensureIdentity(project, options);
+  const learnCard = await connect(project, options);
+  await ensureProfile(learnCard, identity, project);
+  out.set({
+    profileId: identity.profileId,
+    displayName: identity.displayName,
+    did: learnCard.id.did(),
+    created: fresh,
+    envPath: project.envPath
+  });
+  out.log(fresh ? "Ready. Your identity is in .env (keep it out of git)." : "Already set up.");
+  out.log("Next: npx @learncard/cli send you@example.com");
+};
+
+var init = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    runInit: runInit
+});