@learncard/cli 3.6.8 → 4.0.0

package/src/verify.ts

@@ -1,66 +0,0 @@
-import fs from 'node:fs/promises';
-import { initLearnCard } from '@learncard/init';
-import { type VC, type VP, type VerificationCheck, type VerificationItem } from '@learncard/types';
-
-export type VerifyResult = VerificationCheck | VerificationItem[];
-
-export const isPresentation = (value: unknown): boolean => {
-    if (!value || typeof value !== 'object' || !('type' in value)) return false;
-    const types = Array.isArray(value.type) ? value.type : [value.type];
-    return types.includes('VerifiablePresentation');
-};
-
-const checkName = (value: string): string => (value === 'signature' ? 'proof' : value);
-
-export const verificationFailed = (result: VerifyResult): boolean =>
-    Array.isArray(result)
-        ? result.some(item => item.status === 'Failed')
-        : result.errors.length > 0;
-
-export const formatVerification = (result: VerifyResult): string[] => {
-    if (Array.isArray(result))
-        return result.map(item => {
-            const check = checkName(item.check);
-            if (item.status === 'Success') return `✓ ${check}`;
-            return `${item.status === 'Failed' ? '✗' : '!'} ${check}: ${item.details || item.message || 'Check failed'}`;
-        });
-    return [
-        ...result.checks.map(check => `✓ ${checkName(check)}`),
-        ...result.warnings.map(warning => `! ${warning}`),
-        ...result.errors.map(error => {
-            const match = error.match(/^(.+?) error:\s*(.*)$/);
-            return match ? `✗ ${checkName(match[1]!)}: ${match[2]}` : `✗ ${error}`;
-        }),
-    ];
-};
-
-export const runVerify = async (
-    file: string,
-    options: { json?: boolean; didkit?: Promise<Buffer> }
-): Promise<void> => {
-    let text: string;
-    if (file === '-') {
-        const chunks: Buffer[] = [];
-        for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
-        text = Buffer.concat(chunks).toString('utf8');
-    } else text = await fs.readFile(file, 'utf8');
-    const input: unknown = JSON.parse(text);
-    if (!input || typeof input !== 'object' || !('type' in input))
-        throw new Error('Expected a credential or presentation JSON object with a type.');
-    const presentation = isPresentation(input);
-    const types = Array.isArray(input.type) ? input.type : [input.type];
-    if (!presentation && !types.includes('VerifiableCredential'))
-        throw new Error('Expected VerifiableCredential or VerifiablePresentation in type.');
-    const learnCard = await initLearnCard({ ...(options.didkit && { didkit: options.didkit }) });
-    const result = presentation
-        ? await learnCard.invoke.verifyPresentation(input as VP)
-        : options.json
-          ? await learnCard.invoke.verifyCredential(input as VC)
-          : await learnCard.invoke.verifyCredential(input as VC, {}, true);
-    if (options.json) console.log(JSON.stringify(result, null, 2));
-    else {
-        for (const line of formatVerification(result)) console.log(line);
-        console.log('Next: review warnings and issuer trust before accepting this credential.');
-    }
-    if (verificationFailed(result)) process.exitCode = 1;
-};

package/src/webhook.ts

@@ -1,247 +0,0 @@
-import type { Server } from 'node:http';
-import { initLearnCard } from '@learncard/init';
-import {
-    connect,
-    createPrompts,
-    ensureIdentity,
-    ensureProfile,
-    KEYS,
-    loadProject,
-    localizeSnippet,
-    resolveServices,
-    saveProject,
-    type ProjectOptions,
-    PRODUCTION_NETWORK,
-} from './project';
-import { DEFAULT_BADGE, templateCredential } from './send';
-import { WEBHOOK_MJS } from './generated/snippets';
-import { writeSnippet } from './snippet-files';
-import { setupSigning } from './setup-signing';
-import { out } from './out';
-
-interface WebhookModule {
-    extractBearer: (header: unknown) => string | undefined;
-    webhookDedupeKey: (payload: unknown) => string | undefined;
-    createWebhookReceiver: (
-        verifier: {
-            invoke: {
-                verifyPresentation: (
-                    token: string,
-                    options: { proofFormat: 'jwt' }
-                ) => Promise<{ errors: unknown[] }>;
-            };
-        },
-        expectedDid?: string
-    ) => Server;
-}
-
-export const webhookConfig = (
-    env: Record<string, string>,
-    options: { port?: string },
-    runtime: Record<string, string | undefined> = process.env
-): { port: number; expectedDid: string | undefined } => {
-    const port = Number(options.port ?? runtime.PORT ?? env.PORT ?? 8787);
-    if (!Number.isInteger(port) || port < 1 || port > 65535)
-        throw new Error('Port must be 1–65535.');
-    return { port, expectedDid: runtime.EXPECTED_NETWORK_DID ?? env.EXPECTED_NETWORK_DID };
-};
-
-export const closeWebhookReceiver = (server: Server): Promise<void> =>
-    new Promise((resolve, reject) => {
-        // Verification may be waiting on a remote DID. Do not let it block Ctrl+C indefinitely.
-        const timer = setTimeout(() => server.closeAllConnections(), 1000);
-        timer.unref();
-        server.close(error => {
-            clearTimeout(timer);
-            if (error) reject(error);
-            else resolve();
-        });
-    });
-
-/** Execute the embedded, canonical receiver, never a possibly edited file from the cwd. */
-export const loadWebhookModule = async (): Promise<WebhookModule> => {
-    return import(`data:text/javascript;base64,${Buffer.from(WEBHOOK_MJS).toString('base64')}`);
-};
-
-export interface WebhookEvent {
-    type: string;
-    status?: string;
-    issuanceId?: string;
-    recipient?: string;
-}
-
-/** The embedded receiver logs one space-separated line per event: type, status, issuanceId, recipient DID. */
-export const parseWebhookLogLine = (line: string): WebhookEvent | undefined => {
-    const [type, status, issuanceId, recipient] = line.trim().split(/\s+/);
-    if (!type) return undefined;
-    return {
-        type,
-        ...(status && { status }),
-        ...(issuanceId && { issuanceId }),
-        ...(recipient && { recipient }),
-    };
-};
-
-/**
- * `--json` mode does not stream: intercept the receiver's own console.log lines (never
- * forwarding them to real stdout) and resolve with everything seen once ISSUANCE_DELIVERED
- * (and ISSUANCE_CLAIMED, if requested) has arrived, or once the timeout elapses.
- */
-export const collectWebhookEvents = (
-    timeoutMs: number,
-    waitForClaim: boolean,
-    registerStop?: (stop: () => void) => void
-): Promise<WebhookEvent[]> =>
-    new Promise(resolve => {
-        const events: WebhookEvent[] = [];
-        const originalLog = console.log;
-        const finish = (): void => {
-            clearTimeout(timer);
-            console.log = originalLog;
-            resolve(events);
-        };
-        const timer = setTimeout(finish, Math.max(0, timeoutMs));
-        registerStop?.(finish);
-        console.log = (...args: unknown[]): void => {
-            const [first] = args;
-            const event = typeof first === 'string' ? parseWebhookLogLine(first) : undefined;
-            if (!event) return;
-            events.push(event);
-            const delivered = events.some(e => e.type === 'ISSUANCE_DELIVERED');
-            const claimed = events.some(e => e.type === 'ISSUANCE_CLAIMED');
-            if (delivered && (!waitForClaim || claimed)) finish();
-        };
-    });
-
-export const runWebhook = async (
-    email: string | undefined,
-    options: ProjectOptions & {
-        to?: string;
-        url?: string;
-        port?: string;
-        timeout?: string;
-        waitForClaim?: boolean;
-    }
-): Promise<void> => {
-    const project = await loadProject(process.cwd());
-    const { port, expectedDid } = webhookConfig(project.env, options);
-    const production = resolveServices(project.env, options.network).network === PRODUCTION_NETWORK;
-    if (options.url && production && new URL(options.url).protocol !== 'https:') {
-        throw new Error('--url must be a public HTTPS URL when using the production network.');
-    }
-    const identity = await ensureIdentity(project, options);
-    const learnCard = await connect(project, { ...options, lca: true });
-    await ensureProfile(learnCard, identity, project);
-    const wroteWebhookMjs = await writeSnippet(
-        'webhook.mjs',
-        localizeSnippet(WEBHOOK_MJS, resolveServices(project.env, options.network))
-    );
-    const verifier = await initLearnCard({ ...(options.didkit && { didkit: options.didkit }) });
-    const { createWebhookReceiver } = await loadWebhookModule();
-    const server = createWebhookReceiver(verifier, expectedDid);
-    server.requestTimeout = 5000;
-    await new Promise<void>((resolve, reject) => {
-        server.once('error', reject);
-        server.listen(port, () => {
-            server.removeListener('error', reject);
-            resolve();
-        });
-    });
-    out.log(`Listening on http://localhost:${port}`);
-    try {
-        if (!options.url) {
-            out.log(
-                `Next: expose port ${port} with ngrok/cloudflared and re-run with --url <publicUrl>. No credential sent.`
-            );
-            out.set({ port, files: wroteWebhookMjs ? ['./webhook.mjs'] : [] });
-            return;
-        }
-        if (!expectedDid) {
-            out.log(
-                'Demo: signatures are verified, but any DID is accepted. Set EXPECTED_NETWORK_DID to your trusted network DID before production.'
-            );
-        }
-        const prompts = createPrompts(options.yes);
-        let recipient: string;
-        try {
-            recipient =
-                email || options.to || (await prompts.ask('Recipient email (--to <email>)', ''));
-        } finally {
-            prompts.close();
-        }
-        if (!recipient) throw new Error('Provide an email argument or --to <email>.');
-        // Template claims need a hosted signer; the demo does not persist signer configuration.
-        await setupSigning(project, learnCard, undefined, { persist: false });
-        if (!project.env[KEYS.TEMPLATE_URI]) {
-            const uri = await learnCard.invoke.createBoost(templateCredential(learnCard.id.did()), {
-                name: DEFAULT_BADGE.name,
-                category: 'Achievement',
-                status: 'LIVE',
-            });
-            await saveProject(project, { [KEYS.TEMPLATE_URI]: uri });
-        }
-        const templateUri = project.env[KEYS.TEMPLATE_URI]!;
-        // Start collecting before send() so an ISSUANCE_DELIVERED that arrives mid-call isn't missed.
-        const timeoutMs = (Number(options.timeout) > 0 ? Number(options.timeout) : 60) * 1000;
-        let stopCollectingEvents: (() => void) | undefined;
-        const eventsPromise = out.json
-            ? collectWebhookEvents(timeoutMs, !!options.waitForClaim, stop => {
-                  stopCollectingEvents = stop;
-              })
-            : undefined;
-        const onServerError = (): void => {};
-        if (eventsPromise) server.on('error', onServerError);
-        const result = await learnCard.invoke
-            .send({
-                type: 'boost',
-                recipient,
-                templateUri,
-                options: { webhookUrl: options.url },
-            })
-            .catch(error => {
-                if (eventsPromise) {
-                    server.removeListener('error', onServerError);
-                    stopCollectingEvents?.();
-                }
-                throw error;
-            });
-        out.log(`Sent. Watch for ISSUANCE_DELIVERED ${result.inbox?.status ?? ''}.`);
-        out.log(
-            result.inbox?.status === 'PENDING'
-                ? `Next: click the claim link in your email to see ISSUANCE_CLAIMED. Ctrl+C to stop.`
-                : 'Next: this recipient already has LearnCard; no claim event is expected. Ctrl+C to stop.'
-        );
-        if (eventsPromise) {
-            const events = await eventsPromise;
-            server.removeListener('error', onServerError);
-            out.set({
-                port,
-                url: options.url,
-                templateUri,
-                issuanceId: result.inbox?.issuanceId,
-                events,
-            });
-            return;
-        }
-        await new Promise<void>((resolve, reject) => {
-            const stop = (): void => {
-                cleanup();
-                resolve();
-            };
-            const fail = (error: Error): void => {
-                cleanup();
-                reject(error);
-            };
-            const cleanup = (): void => {
-                process.removeListener('SIGINT', stop);
-                process.removeListener('SIGTERM', stop);
-                server.removeListener('error', fail);
-            };
-            process.once('SIGINT', stop);
-            process.once('SIGTERM', stop);
-            server.once('error', fail);
-        });
-    } finally {
-        await closeWebhookReceiver(server);
-    }
-};

package/src/whoami.test.ts

@@ -1,67 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { Command } from 'commander';
-
-import { registerWhoamiCommand, summarizeServiceAccounts } from './whoami';
-import type { AuthGrantWithActAs } from './auth-grant';
-
-describe('whoami command', () => {
-    it('registers with --network and --json only', () => {
-        const program = new Command();
-        registerWhoamiCommand(program, async () => {});
-        const cmd = program.commands.find(c => c.name() === 'whoami');
-        expect(cmd).toBeDefined();
-        expect(
-            program
-                .createHelp()
-                .visibleOptions(cmd!)
-                .map(o => o.long)
-                .filter(l => l !== '--help')
-                .sort()
-        ).toEqual(['--json', '--network']);
-    });
-});
-
-describe('summarizeServiceAccounts', () => {
-    it('shapes active grants as { name, scope, actAs } for --json, dropping revoked ones', () => {
-        const grants: AuthGrantWithActAs[] = [
-            {
-                id: 'g1',
-                name: 'ea-clr-issuer',
-                status: 'active',
-                scope: 'inbox:write',
-                actAs: 'sc-greenville,sc-north',
-            },
-            { id: 'g2', name: 'star-issuer', status: 'active', scope: 'inbox:write', actAs: '*' },
-            { id: 'g3', name: 'no-delegation', status: 'active', scope: 'inbox:write' },
-            { id: 'g4', name: 'old-issuer', status: 'revoked', scope: 'inbox:write', actAs: '*' },
-        ];
-
-        expect(summarizeServiceAccounts(grants)).toEqual([
-            { name: 'ea-clr-issuer', scope: 'inbox:write', actAs: 'sc-greenville,sc-north' },
-            { name: 'star-issuer', scope: 'inbox:write', actAs: '*' },
-            { name: 'no-delegation', scope: 'inbox:write', actAs: undefined },
-        ]);
-    });
-
-    it('returns an empty array when there are no grants', () => {
-        expect(summarizeServiceAccounts([])).toEqual([]);
-    });
-});
-
-describe('LEARNCARD_AS', () => {
-    it('is the env fallback for --as on inbox list', async () => {
-        const { registerInboxCommand } = await import('./inbox');
-        const program = new Command().exitOverride();
-        let seen: Record<string, unknown> | undefined;
-        registerInboxCommand(program, async (_cmd, options) => {
-            seen = options as Record<string, unknown>;
-        });
-        process.env.LEARNCARD_AS = 'cs-exampleville';
-        try {
-            await program.parseAsync(['node', 'learncard', 'inbox', 'list']);
-        } finally {
-            delete process.env.LEARNCARD_AS;
-        }
-        expect(seen?.as).toBe('cs-exampleville');
-    });
-});

package/src/whoami.ts

@@ -1,129 +0,0 @@
-import type { Command } from 'commander';
-import type { AuthGrantType } from '@learncard/types';
-
-import {
-    connect,
-    connectAsDidWeb,
-    loadProject,
-    resolveServices,
-    type ProjectOptions,
-} from './project';
-import { out } from './out';
-import type { RunCommand } from './doctor';
-import { describeActAs, getGrantActAs } from './auth-grant';
-
-export interface ManagedSummary {
-    profileId: string;
-    displayName: string;
-    did: string;
-}
-
-export interface ServiceAccountSummary {
-    name: string;
-    scope: string;
-    actAs?: string;
-}
-
-/** Only active grants are relevant here; revoked ones are noise for this summary. */
-export const summarizeServiceAccounts = (
-    grants: Array<Partial<AuthGrantType>>
-): ServiceAccountSummary[] =>
-    grants
-        .filter(grant => grant.status === 'active')
-        .map(grant => ({
-            name: grant.name ?? '',
-            scope: grant.scope ?? '',
-            actAs: getGrantActAs(grant),
-        }));
-
-export const runWhoami = async (options: ProjectOptions): Promise<void> => {
-    const project = await loadProject(process.cwd());
-    if (!project.env.SECURE_SEED) {
-        throw new Error(
-            'No identity in this folder. Run `npx @learncard/cli send you@example.com` or `org apply` first.'
-        );
-    }
-    const services = resolveServices(project.env, options.network);
-    const learnCard = await connect(project, options);
-    const profile = await learnCard.invoke.getProfile();
-
-    out.log(
-        profile
-            ? `You are "${profile.displayName}" (${profile.profileId}) on ${services.network}`
-            : `Seed present but no profile on ${services.network} yet (PROFILE_ID=${project.env.PROFILE_ID ?? '?'}).`
-    );
-    out.log(`  did: ${learnCard.id.did()}`);
-    if (project.env.SIGNING_AUTHORITY_NAME)
-        out.log(`  signing authority: ${project.env.SIGNING_AUTHORITY_NAME}`);
-
-    const managerDid = project.env.ORG_PROFILE_MANAGER_DID;
-    const managed: ManagedSummary[] = [];
-    if (managerDid) {
-        const manager = await connectAsDidWeb(project, options, managerDid);
-        let cursor: string | undefined;
-        do {
-            const page = await manager.invoke.getManagedProfiles({ limit: 100, cursor });
-            for (const record of page.records) {
-                managed.push({
-                    profileId: record.profileId,
-                    displayName: record.displayName,
-                    did: record.did,
-                });
-            }
-            cursor = page.hasMore ? (page.cursor ?? undefined) : undefined;
-        } while (cursor);
-
-        out.log(`  manager: ${managerDid}`);
-        if (managed.length) {
-            out.log('You can act as (--as <profileId> or LEARNCARD_AS=<profileId>):');
-            for (const entry of managed)
-                out.log(`  ${entry.profileId.padEnd(24)} ${entry.displayName}`);
-        } else {
-            out.log(
-                '  no managed profiles yet — add them under profileManager.managed and run `org apply`.'
-            );
-        }
-    }
-
-    const grants = profile ? ((await learnCard.invoke.getAuthGrants()) ?? []) : [];
-    const serviceAccounts = summarizeServiceAccounts(grants);
-    if (serviceAccounts.length) {
-        out.log('Service accounts:');
-        const nameWidth = Math.max(...serviceAccounts.map(entry => entry.name.length));
-        const scopeWidth = Math.max(...serviceAccounts.map(entry => entry.scope.length));
-        for (const entry of serviceAccounts)
-            out.log(
-                `  ${entry.name.padEnd(nameWidth)}  ${entry.scope.padEnd(scopeWidth)}  ${describeActAs(entry.actAs)}`
-            );
-    }
-
-    if (process.env.LEARNCARD_AS)
-        out.log(
-            `LEARNCARD_AS is set: commands that support --as will act as "${process.env.LEARNCARD_AS}".`
-        );
-
-    out.set({
-        network: services.network,
-        profileId: profile?.profileId ?? project.env.PROFILE_ID,
-        displayName: profile?.displayName,
-        did: learnCard.id.did(),
-        signingAuthority: project.env.SIGNING_AUTHORITY_NAME,
-        managerDid,
-        managed,
-        serviceAccounts,
-        actingAs: process.env.LEARNCARD_AS,
-    });
-};
-
-export const registerWhoamiCommand = (program: Command, run: RunCommand): void => {
-    program
-        .command('whoami')
-        .description('Show the identity in this folder and the managed profiles --as can target.')
-        .option('--network <url>', 'network tRPC URL or staging (default: production)')
-        .option('--json', 'print a single JSON result on stdout')
-        .action(options =>
-            run('whoami', options, async didkit => {
-                await runWhoami({ ...options, didkit });
-            })
-        );
-};

package/tsconfig.json

@@ -1,38 +0,0 @@
-{
-    "extends": "../../tsconfig.library.json",
-    "compilerOptions": {
-        "lib": ["es2022", "DOM"],
-        "module": "esnext",
-        "moduleResolution": "bundler",
-        "resolveJsonModule": true,
-        "removeComments": true,
-        "preserveConstEnums": true,
-        "strict": true,
-        "alwaysStrict": true,
-        "strictNullChecks": true,
-        "noUncheckedIndexedAccess": true,
-        "jsx": "react",
-
-        "noImplicitAny": true,
-        "noImplicitReturns": true,
-        "noImplicitThis": true,
-        "noUnusedLocals": true,
-        "noUnusedParameters": true,
-        "allowUnreachableCode": false,
-        "noFallthroughCasesInSwitch": true,
-
-        "target": "es2017",
-        "outDir": "dist",
-        "declaration": true,
-        "declarationMap": true,
-        "sourceMap": true,
-
-        "esModuleInterop": true,
-        "allowSyntheticDefaultImports": true,
-        "allowJs": false,
-        "skipLibCheck": true,
-        "forceConsistentCasingInFileNames": true
-    },
-    "include": ["src/**/*", "scripts/**/*.ts"],
-    "exclude": ["./dist/**/*", "./node_modules/**/*"]
-}

package/vitest.config.ts

@@ -1,8 +0,0 @@
-import { createVitestConfig, nodePreset } from '../../vitest.shared';
-
-export default createVitestConfig(nodePreset, {
-    test: {
-        include: ['src/**/*.test.ts'],
-        exclude: ['src/bundle/**'],
-    },
-});