@oneaddress/setup 1.1.0

package/dist/index.js

@@ -0,0 +1,3515 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../../node_modules/sisteransi/src/index.js
+var require_src = __commonJS({
+  "../../node_modules/sisteransi/src/index.js"(exports2, module2) {
+    "use strict";
+    var ESC = "\x1B";
+    var CSI = `${ESC}[`;
+    var beep = "\x07";
+    var cursor = {
+      to(x2, y3) {
+        if (!y3) return `${CSI}${x2 + 1}G`;
+        return `${CSI}${y3 + 1};${x2 + 1}H`;
+      },
+      move(x2, y3) {
+        let ret = "";
+        if (x2 < 0) ret += `${CSI}${-x2}D`;
+        else if (x2 > 0) ret += `${CSI}${x2}C`;
+        if (y3 < 0) ret += `${CSI}${-y3}A`;
+        else if (y3 > 0) ret += `${CSI}${y3}B`;
+        return ret;
+      },
+      up: (count = 1) => `${CSI}${count}A`,
+      down: (count = 1) => `${CSI}${count}B`,
+      forward: (count = 1) => `${CSI}${count}C`,
+      backward: (count = 1) => `${CSI}${count}D`,
+      nextLine: (count = 1) => `${CSI}E`.repeat(count),
+      prevLine: (count = 1) => `${CSI}F`.repeat(count),
+      left: `${CSI}G`,
+      hide: `${CSI}?25l`,
+      show: `${CSI}?25h`,
+      save: `${ESC}7`,
+      restore: `${ESC}8`
+    };
+    var scroll = {
+      up: (count = 1) => `${CSI}S`.repeat(count),
+      down: (count = 1) => `${CSI}T`.repeat(count)
+    };
+    var erase = {
+      screen: `${CSI}2J`,
+      up: (count = 1) => `${CSI}1J`.repeat(count),
+      down: (count = 1) => `${CSI}J`.repeat(count),
+      line: `${CSI}2K`,
+      lineEnd: `${CSI}K`,
+      lineStart: `${CSI}1K`,
+      lines(count) {
+        let clear = "";
+        for (let i = 0; i < count; i++)
+          clear += this.line + (i < count - 1 ? cursor.up() : "");
+        if (count)
+          clear += cursor.left;
+        return clear;
+      }
+    };
+    module2.exports = { cursor, scroll, erase, beep };
+  }
+});
+
+// ../../node_modules/picocolors/picocolors.js
+var require_picocolors = __commonJS({
+  "../../node_modules/picocolors/picocolors.js"(exports2, module2) {
+    "use strict";
+    var p2 = process || {};
+    var argv = p2.argv || [];
+    var env = p2.env || {};
+    var isColorSupported = !(!!env.NO_COLOR || argv.includes("--no-color")) && (!!env.FORCE_COLOR || argv.includes("--color") || p2.platform === "win32" || (p2.stdout || {}).isTTY && env.TERM !== "dumb" || !!env.CI);
+    var formatter = (open, close, replace = open) => (input) => {
+      let string = "" + input, index = string.indexOf(close, open.length);
+      return ~index ? open + replaceClose(string, close, replace, index) + close : open + string + close;
+    };
+    var replaceClose = (string, close, replace, index) => {
+      let result = "", cursor = 0;
+      do {
+        result += string.substring(cursor, index) + replace;
+        cursor = index + close.length;
+        index = string.indexOf(close, cursor);
+      } while (~index);
+      return result + string.substring(cursor);
+    };
+    var createColors = (enabled = isColorSupported) => {
+      let f2 = enabled ? formatter : () => String;
+      return {
+        isColorSupported: enabled,
+        reset: f2("\x1B[0m", "\x1B[0m"),
+        bold: f2("\x1B[1m", "\x1B[22m", "\x1B[22m\x1B[1m"),
+        dim: f2("\x1B[2m", "\x1B[22m", "\x1B[22m\x1B[2m"),
+        italic: f2("\x1B[3m", "\x1B[23m"),
+        underline: f2("\x1B[4m", "\x1B[24m"),
+        inverse: f2("\x1B[7m", "\x1B[27m"),
+        hidden: f2("\x1B[8m", "\x1B[28m"),
+        strikethrough: f2("\x1B[9m", "\x1B[29m"),
+        black: f2("\x1B[30m", "\x1B[39m"),
+        red: f2("\x1B[31m", "\x1B[39m"),
+        green: f2("\x1B[32m", "\x1B[39m"),
+        yellow: f2("\x1B[33m", "\x1B[39m"),
+        blue: f2("\x1B[34m", "\x1B[39m"),
+        magenta: f2("\x1B[35m", "\x1B[39m"),
+        cyan: f2("\x1B[36m", "\x1B[39m"),
+        white: f2("\x1B[37m", "\x1B[39m"),
+        gray: f2("\x1B[90m", "\x1B[39m"),
+        bgBlack: f2("\x1B[40m", "\x1B[49m"),
+        bgRed: f2("\x1B[41m", "\x1B[49m"),
+        bgGreen: f2("\x1B[42m", "\x1B[49m"),
+        bgYellow: f2("\x1B[43m", "\x1B[49m"),
+        bgBlue: f2("\x1B[44m", "\x1B[49m"),
+        bgMagenta: f2("\x1B[45m", "\x1B[49m"),
+        bgCyan: f2("\x1B[46m", "\x1B[49m"),
+        bgWhite: f2("\x1B[47m", "\x1B[49m"),
+        blackBright: f2("\x1B[90m", "\x1B[39m"),
+        redBright: f2("\x1B[91m", "\x1B[39m"),
+        greenBright: f2("\x1B[92m", "\x1B[39m"),
+        yellowBright: f2("\x1B[93m", "\x1B[39m"),
+        blueBright: f2("\x1B[94m", "\x1B[39m"),
+        magentaBright: f2("\x1B[95m", "\x1B[39m"),
+        cyanBright: f2("\x1B[96m", "\x1B[39m"),
+        whiteBright: f2("\x1B[97m", "\x1B[39m"),
+        bgBlackBright: f2("\x1B[100m", "\x1B[49m"),
+        bgRedBright: f2("\x1B[101m", "\x1B[49m"),
+        bgGreenBright: f2("\x1B[102m", "\x1B[49m"),
+        bgYellowBright: f2("\x1B[103m", "\x1B[49m"),
+        bgBlueBright: f2("\x1B[104m", "\x1B[49m"),
+        bgMagentaBright: f2("\x1B[105m", "\x1B[49m"),
+        bgCyanBright: f2("\x1B[106m", "\x1B[49m"),
+        bgWhiteBright: f2("\x1B[107m", "\x1B[49m")
+      };
+    };
+    module2.exports = createColors();
+    module2.exports.createColors = createColors;
+  }
+});
+
+// ../../node_modules/@clack/prompts/dist/index.mjs
+var import_node_util = require("util");
+
+// ../../node_modules/@clack/core/dist/index.mjs
+var import_sisteransi = __toESM(require_src(), 1);
+var import_node_process = require("process");
+var f = __toESM(require("readline"), 1);
+var import_node_readline = __toESM(require("readline"), 1);
+var import_node_tty = require("tty");
+var import_picocolors = __toESM(require_picocolors(), 1);
+function J({ onlyFirst: t = false } = {}) {
+  const F = ["[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?(?:\\u0007|\\u001B\\u005C|\\u009C))", "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))"].join("|");
+  return new RegExp(F, t ? void 0 : "g");
+}
+var Q = J();
+function T(t) {
+  if (typeof t != "string") throw new TypeError(`Expected a \`string\`, got \`${typeof t}\``);
+  return t.replace(Q, "");
+}
+function O(t) {
+  return t && t.__esModule && Object.prototype.hasOwnProperty.call(t, "default") ? t.default : t;
+}
+var P = { exports: {} };
+(function(t) {
+  var u2 = {};
+  t.exports = u2, u2.eastAsianWidth = function(e2) {
+    var s = e2.charCodeAt(0), i = e2.length == 2 ? e2.charCodeAt(1) : 0, D = s;
+    return 55296 <= s && s <= 56319 && 56320 <= i && i <= 57343 && (s &= 1023, i &= 1023, D = s << 10 | i, D += 65536), D == 12288 || 65281 <= D && D <= 65376 || 65504 <= D && D <= 65510 ? "F" : D == 8361 || 65377 <= D && D <= 65470 || 65474 <= D && D <= 65479 || 65482 <= D && D <= 65487 || 65490 <= D && D <= 65495 || 65498 <= D && D <= 65500 || 65512 <= D && D <= 65518 ? "H" : 4352 <= D && D <= 4447 || 4515 <= D && D <= 4519 || 4602 <= D && D <= 4607 || 9001 <= D && D <= 9002 || 11904 <= D && D <= 11929 || 11931 <= D && D <= 12019 || 12032 <= D && D <= 12245 || 12272 <= D && D <= 12283 || 12289 <= D && D <= 12350 || 12353 <= D && D <= 12438 || 12441 <= D && D <= 12543 || 12549 <= D && D <= 12589 || 12593 <= D && D <= 12686 || 12688 <= D && D <= 12730 || 12736 <= D && D <= 12771 || 12784 <= D && D <= 12830 || 12832 <= D && D <= 12871 || 12880 <= D && D <= 13054 || 13056 <= D && D <= 19903 || 19968 <= D && D <= 42124 || 42128 <= D && D <= 42182 || 43360 <= D && D <= 43388 || 44032 <= D && D <= 55203 || 55216 <= D && D <= 55238 || 55243 <= D && D <= 55291 || 63744 <= D && D <= 64255 || 65040 <= D && D <= 65049 || 65072 <= D && D <= 65106 || 65108 <= D && D <= 65126 || 65128 <= D && D <= 65131 || 110592 <= D && D <= 110593 || 127488 <= D && D <= 127490 || 127504 <= D && D <= 127546 || 127552 <= D && D <= 127560 || 127568 <= D && D <= 127569 || 131072 <= D && D <= 194367 || 177984 <= D && D <= 196605 || 196608 <= D && D <= 262141 ? "W" : 32 <= D && D <= 126 || 162 <= D && D <= 163 || 165 <= D && D <= 166 || D == 172 || D == 175 || 10214 <= D && D <= 10221 || 10629 <= D && D <= 10630 ? "Na" : D == 161 || D == 164 || 167 <= D && D <= 168 || D == 170 || 173 <= D && D <= 174 || 176 <= D && D <= 180 || 182 <= D && D <= 186 || 188 <= D && D <= 191 || D == 198 || D == 208 || 215 <= D && D <= 216 || 222 <= D && D <= 225 || D == 230 || 232 <= D && D <= 234 || 236 <= D && D <= 237 || D == 240 || 242 <= D && D <= 243 || 247 <= D && D <= 250 || D == 252 || D == 254 || D == 257 || D == 273 || D == 275 || D == 283 || 294 <= D && D <= 295 || D == 299 || 305 <= D && D <= 307 || D == 312 || 319 <= D && D <= 322 || D == 324 || 328 <= D && D <= 331 || D == 333 || 338 <= D && D <= 339 || 358 <= D && D <= 359 || D == 363 || D == 462 || D == 464 || D == 466 || D == 468 || D == 470 || D == 472 || D == 474 || D == 476 || D == 593 || D == 609 || D == 708 || D == 711 || 713 <= D && D <= 715 || D == 717 || D == 720 || 728 <= D && D <= 731 || D == 733 || D == 735 || 768 <= D && D <= 879 || 913 <= D && D <= 929 || 931 <= D && D <= 937 || 945 <= D && D <= 961 || 963 <= D && D <= 969 || D == 1025 || 1040 <= D && D <= 1103 || D == 1105 || D == 8208 || 8211 <= D && D <= 8214 || 8216 <= D && D <= 8217 || 8220 <= D && D <= 8221 || 8224 <= D && D <= 8226 || 8228 <= D && D <= 8231 || D == 8240 || 8242 <= D && D <= 8243 || D == 8245 || D == 8251 || D == 8254 || D == 8308 || D == 8319 || 8321 <= D && D <= 8324 || D == 8364 || D == 8451 || D == 8453 || D == 8457 || D == 8467 || D == 8470 || 8481 <= D && D <= 8482 || D == 8486 || D == 8491 || 8531 <= D && D <= 8532 || 8539 <= D && D <= 8542 || 8544 <= D && D <= 8555 || 8560 <= D && D <= 8569 || D == 8585 || 8592 <= D && D <= 8601 || 8632 <= D && D <= 8633 || D == 8658 || D == 8660 || D == 8679 || D == 8704 || 8706 <= D && D <= 8707 || 8711 <= D && D <= 8712 || D == 8715 || D == 8719 || D == 8721 || D == 8725 || D == 8730 || 8733 <= D && D <= 8736 || D == 8739 || D == 8741 || 8743 <= D && D <= 8748 || D == 8750 || 8756 <= D && D <= 8759 || 8764 <= D && D <= 8765 || D == 8776 || D == 8780 || D == 8786 || 8800 <= D && D <= 8801 || 8804 <= D && D <= 8807 || 8810 <= D && D <= 8811 || 8814 <= D && D <= 8815 || 8834 <= D && D <= 8835 || 8838 <= D && D <= 8839 || D == 8853 || D == 8857 || D == 8869 || D == 8895 || D == 8978 || 9312 <= D && D <= 9449 || 9451 <= D && D <= 9547 || 9552 <= D && D <= 9587 || 9600 <= D && D <= 9615 || 9618 <= D && D <= 9621 || 9632 <= D && D <= 9633 || 9635 <= D && D <= 9641 || 9650 <= D && D <= 9651 || 9654 <= D && D <= 9655 || 9660 <= D && D <= 9661 || 9664 <= D && D <= 9665 || 9670 <= D && D <= 9672 || D == 9675 || 9678 <= D && D <= 9681 || 9698 <= D && D <= 9701 || D == 9711 || 9733 <= D && D <= 9734 || D == 9737 || 9742 <= D && D <= 9743 || 9748 <= D && D <= 9749 || D == 9756 || D == 9758 || D == 9792 || D == 9794 || 9824 <= D && D <= 9825 || 9827 <= D && D <= 9829 || 9831 <= D && D <= 9834 || 9836 <= D && D <= 9837 || D == 9839 || 9886 <= D && D <= 9887 || 9918 <= D && D <= 9919 || 9924 <= D && D <= 9933 || 9935 <= D && D <= 9953 || D == 9955 || 9960 <= D && D <= 9983 || D == 10045 || D == 10071 || 10102 <= D && D <= 10111 || 11093 <= D && D <= 11097 || 12872 <= D && D <= 12879 || 57344 <= D && D <= 63743 || 65024 <= D && D <= 65039 || D == 65533 || 127232 <= D && D <= 127242 || 127248 <= D && D <= 127277 || 127280 <= D && D <= 127337 || 127344 <= D && D <= 127386 || 917760 <= D && D <= 917999 || 983040 <= D && D <= 1048573 || 1048576 <= D && D <= 1114109 ? "A" : "N";
+  }, u2.characterLength = function(e2) {
+    var s = this.eastAsianWidth(e2);
+    return s == "F" || s == "W" || s == "A" ? 2 : 1;
+  };
+  function F(e2) {
+    return e2.match(/[\uD800-\uDBFF][\uDC00-\uDFFF]|[^\uD800-\uDFFF]/g) || [];
+  }
+  u2.length = function(e2) {
+    for (var s = F(e2), i = 0, D = 0; D < s.length; D++) i = i + this.characterLength(s[D]);
+    return i;
+  }, u2.slice = function(e2, s, i) {
+    textLen = u2.length(e2), s = s || 0, i = i || 1, s < 0 && (s = textLen + s), i < 0 && (i = textLen + i);
+    for (var D = "", C = 0, o = F(e2), E2 = 0; E2 < o.length; E2++) {
+      var a2 = o[E2], n = u2.length(a2);
+      if (C >= s - (n == 2 ? 1 : 0)) if (C + n <= i) D += a2;
+      else break;
+      C += n;
+    }
+    return D;
+  };
+})(P);
+var X = P.exports;
+var DD = O(X);
+var uD = function() {
+  return /\uD83C\uDFF4\uDB40\uDC67\uDB40\uDC62(?:\uDB40\uDC77\uDB40\uDC6C\uDB40\uDC73|\uDB40\uDC73\uDB40\uDC63\uDB40\uDC74|\uDB40\uDC65\uDB40\uDC6E\uDB40\uDC67)\uDB40\uDC7F|(?:\uD83E\uDDD1\uD83C\uDFFF\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1|\uD83D\uDC69\uD83C\uDFFF\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFE])|(?:\uD83E\uDDD1\uD83C\uDFFE\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1|\uD83D\uDC69\uD83C\uDFFE\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB-\uDFFD\uDFFF])|(?:\uD83E\uDDD1\uD83C\uDFFD\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1|\uD83D\uDC69\uD83C\uDFFD\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])|(?:\uD83E\uDDD1\uD83C\uDFFC\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1|\uD83D\uDC69\uD83C\uDFFC\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFB\uDFFD-\uDFFF])|(?:\uD83E\uDDD1\uD83C\uDFFB\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83E\uDDD1|\uD83D\uDC69\uD83C\uDFFB\u200D\uD83E\uDD1D\u200D(?:\uD83D[\uDC68\uDC69]))(?:\uD83C[\uDFFC-\uDFFF])|\uD83D\uDC68(?:\uD83C\uDFFB(?:\u200D(?:\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFF])|\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFF]))|\uD83E\uDD1D\u200D\uD83D\uDC68(?:\uD83C[\uDFFC-\uDFFF])|[\u2695\u2696\u2708]\uFE0F|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD]))?|(?:\uD83C[\uDFFC-\uDFFF])\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFF])|\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFF]))|\u200D(?:\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D)?\uD83D\uDC68|(?:\uD83D[\uDC68\uDC69])\u200D(?:\uD83D\uDC66\u200D\uD83D\uDC66|\uD83D\uDC67\u200D(?:\uD83D[\uDC66\uDC67]))|\uD83D\uDC66\u200D\uD83D\uDC66|\uD83D\uDC67\u200D(?:\uD83D[\uDC66\uDC67])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFF\u200D(?:\uD83E\uDD1D\u200D\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFE])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFE\u200D(?:\uD83E\uDD1D\u200D\uD83D\uDC68(?:\uD83C[\uDFFB-\uDFFD\uDFFF])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFD\u200D(?:\uD83E\uDD1D\u200D\uD83D\uDC68(?:\uD83C[\uDFFB\uDFFC\uDFFE\uDFFF])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFC\u200D(?:\uD83E\uDD1D\u200D\uD83D\uDC68(?:\uD83C[\uDFFB\uDFFD-\uDFFF])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|(?:\uD83C\uDFFF\u200D[\u2695\u2696\u2708]|\uD83C\uDFFE\u200D[\u2695\u2696\u2708]|\uD83C\uDFFD\u200D[\u2695\u2696\u2708]|\uD83C\uDFFC\u200D[\u2695\u2696\u2708]|\u200D[\u2695\u2696\u2708])\uFE0F|\u200D(?:(?:\uD83D[\uDC68\uDC69])\u200D(?:\uD83D[\uDC66\uDC67])|\uD83D[\uDC66\uDC67])|\uD83C\uDFFF|\uD83C\uDFFE|\uD83C\uDFFD|\uD83C\uDFFC)?|(?:\uD83D\uDC69(?:\uD83C\uDFFB\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D(?:\uD83D[\uDC68\uDC69])|\uD83D[\uDC68\uDC69])|(?:\uD83C[\uDFFC-\uDFFF])\u200D\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D(?:\uD83D[\uDC68\uDC69])|\uD83D[\uDC68\uDC69]))|\uD83E\uDDD1(?:\uD83C[\uDFFB-\uDFFF])\u200D\uD83E\uDD1D\u200D\uD83E\uDDD1)(?:\uD83C[\uDFFB-\uDFFF])|\uD83D\uDC69\u200D\uD83D\uDC69\u200D(?:\uD83D\uDC66\u200D\uD83D\uDC66|\uD83D\uDC67\u200D(?:\uD83D[\uDC66\uDC67]))|\uD83D\uDC69(?:\u200D(?:\u2764\uFE0F\u200D(?:\uD83D\uDC8B\u200D(?:\uD83D[\uDC68\uDC69])|\uD83D[\uDC68\uDC69])|\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFF\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFE\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFD\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFC\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFB\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD]))|\uD83E\uDDD1(?:\u200D(?:\uD83E\uDD1D\u200D\uD83E\uDDD1|\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFF\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFE\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFD\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFC\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD])|\uD83C\uDFFB\u200D(?:\uD83C[\uDF3E\uDF73\uDF7C\uDF84\uDF93\uDFA4\uDFA8\uDFEB\uDFED]|\uD83D[\uDCBB\uDCBC\uDD27\uDD2C\uDE80\uDE92]|\uD83E[\uDDAF-\uDDB3\uDDBC\uDDBD]))|\uD83D\uDC69\u200D\uD83D\uDC66\u200D\uD83D\uDC66|\uD83D\uDC69\u200D\uD83D\uDC69\u200D(?:\uD83D[\uDC66\uDC67])|\uD83D\uDC69\u200D\uD83D\uDC67\u200D(?:\uD83D[\uDC66\uDC67])|(?:\uD83D\uDC41\uFE0F\u200D\uD83D\uDDE8|\uD83E\uDDD1(?:\uD83C\uDFFF\u200D[\u2695\u2696\u2708]|\uD83C\uDFFE\u200D[\u2695\u2696\u2708]|\uD83C\uDFFD\u200D[\u2695\u2696\u2708]|\uD83C\uDFFC\u200D[\u2695\u2696\u2708]|\uD83C\uDFFB\u200D[\u2695\u2696\u2708]|\u200D[\u2695\u2696\u2708])|\uD83D\uDC69(?:\uD83C\uDFFF\u200D[\u2695\u2696\u2708]|\uD83C\uDFFE\u200D[\u2695\u2696\u2708]|\uD83C\uDFFD\u200D[\u2695\u2696\u2708]|\uD83C\uDFFC\u200D[\u2695\u2696\u2708]|\uD83C\uDFFB\u200D[\u2695\u2696\u2708]|\u200D[\u2695\u2696\u2708])|\uD83D\uDE36\u200D\uD83C\uDF2B|\uD83C\uDFF3\uFE0F\u200D\u26A7|\uD83D\uDC3B\u200D\u2744|(?:(?:\uD83C[\uDFC3\uDFC4\uDFCA]|\uD83D[\uDC6E\uDC70\uDC71\uDC73\uDC77\uDC81\uDC82\uDC86\uDC87\uDE45-\uDE47\uDE4B\uDE4D\uDE4E\uDEA3\uDEB4-\uDEB6]|\uD83E[\uDD26\uDD35\uDD37-\uDD39\uDD3D\uDD3E\uDDB8\uDDB9\uDDCD-\uDDCF\uDDD4\uDDD6-\uDDDD])(?:\uD83C[\uDFFB-\uDFFF])|\uD83D\uDC6F|\uD83E[\uDD3C\uDDDE\uDDDF])\u200D[\u2640\u2642]|(?:\u26F9|\uD83C[\uDFCB\uDFCC]|\uD83D\uDD75)(?:\uFE0F|\uD83C[\uDFFB-\uDFFF])\u200D[\u2640\u2642]|\uD83C\uDFF4\u200D\u2620|(?:\uD83C[\uDFC3\uDFC4\uDFCA]|\uD83D[\uDC6E\uDC70\uDC71\uDC73\uDC77\uDC81\uDC82\uDC86\uDC87\uDE45-\uDE47\uDE4B\uDE4D\uDE4E\uDEA3\uDEB4-\uDEB6]|\uD83E[\uDD26\uDD35\uDD37-\uDD39\uDD3D\uDD3E\uDDB8\uDDB9\uDDCD-\uDDCF\uDDD4\uDDD6-\uDDDD])\u200D[\u2640\u2642]|[\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u2328\u23CF\u23ED-\u23EF\u23F1\u23F2\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB\u25FC\u2600-\u2604\u260E\u2611\u2618\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u265F\u2660\u2663\u2665\u2666\u2668\u267B\u267E\u2692\u2694-\u2697\u2699\u269B\u269C\u26A0\u26A7\u26B0\u26B1\u26C8\u26CF\u26D1\u26D3\u26E9\u26F0\u26F1\u26F4\u26F7\u26F8\u2702\u2708\u2709\u270F\u2712\u2714\u2716\u271D\u2721\u2733\u2734\u2744\u2747\u2763\u27A1\u2934\u2935\u2B05-\u2B07\u3030\u303D\u3297\u3299]|\uD83C[\uDD70\uDD71\uDD7E\uDD7F\uDE02\uDE37\uDF21\uDF24-\uDF2C\uDF36\uDF7D\uDF96\uDF97\uDF99-\uDF9B\uDF9E\uDF9F\uDFCD\uDFCE\uDFD4-\uDFDF\uDFF5\uDFF7]|\uD83D[\uDC3F\uDCFD\uDD49\uDD4A\uDD6F\uDD70\uDD73\uDD76-\uDD79\uDD87\uDD8A-\uDD8D\uDDA5\uDDA8\uDDB1\uDDB2\uDDBC\uDDC2-\uDDC4\uDDD1-\uDDD3\uDDDC-\uDDDE\uDDE1\uDDE3\uDDE8\uDDEF\uDDF3\uDDFA\uDECB\uDECD-\uDECF\uDEE0-\uDEE5\uDEE9\uDEF0\uDEF3])\uFE0F|\uD83C\uDFF3\uFE0F\u200D\uD83C\uDF08|\uD83D\uDC69\u200D\uD83D\uDC67|\uD83D\uDC69\u200D\uD83D\uDC66|\uD83D\uDE35\u200D\uD83D\uDCAB|\uD83D\uDE2E\u200D\uD83D\uDCA8|\uD83D\uDC15\u200D\uD83E\uDDBA|\uD83E\uDDD1(?:\uD83C\uDFFF|\uD83C\uDFFE|\uD83C\uDFFD|\uD83C\uDFFC|\uD83C\uDFFB)?|\uD83D\uDC69(?:\uD83C\uDFFF|\uD83C\uDFFE|\uD83C\uDFFD|\uD83C\uDFFC|\uD83C\uDFFB)?|\uD83C\uDDFD\uD83C\uDDF0|\uD83C\uDDF6\uD83C\uDDE6|\uD83C\uDDF4\uD83C\uDDF2|\uD83D\uDC08\u200D\u2B1B|\u2764\uFE0F\u200D(?:\uD83D\uDD25|\uD83E\uDE79)|\uD83D\uDC41\uFE0F|\uD83C\uDFF3\uFE0F|\uD83C\uDDFF(?:\uD83C[\uDDE6\uDDF2\uDDFC])|\uD83C\uDDFE(?:\uD83C[\uDDEA\uDDF9])|\uD83C\uDDFC(?:\uD83C[\uDDEB\uDDF8])|\uD83C\uDDFB(?:\uD83C[\uDDE6\uDDE8\uDDEA\uDDEC\uDDEE\uDDF3\uDDFA])|\uD83C\uDDFA(?:\uD83C[\uDDE6\uDDEC\uDDF2\uDDF3\uDDF8\uDDFE\uDDFF])|\uD83C\uDDF9(?:\uD83C[\uDDE6\uDDE8\uDDE9\uDDEB-\uDDED\uDDEF-\uDDF4\uDDF7\uDDF9\uDDFB\uDDFC\uDDFF])|\uD83C\uDDF8(?:\uD83C[\uDDE6-\uDDEA\uDDEC-\uDDF4\uDDF7-\uDDF9\uDDFB\uDDFD-\uDDFF])|\uD83C\uDDF7(?:\uD83C[\uDDEA\uDDF4\uDDF8\uDDFA\uDDFC])|\uD83C\uDDF5(?:\uD83C[\uDDE6\uDDEA-\uDDED\uDDF0-\uDDF3\uDDF7-\uDDF9\uDDFC\uDDFE])|\uD83C\uDDF3(?:\uD83C[\uDDE6\uDDE8\uDDEA-\uDDEC\uDDEE\uDDF1\uDDF4\uDDF5\uDDF7\uDDFA\uDDFF])|\uD83C\uDDF2(?:\uD83C[\uDDE6\uDDE8-\uDDED\uDDF0-\uDDFF])|\uD83C\uDDF1(?:\uD83C[\uDDE6-\uDDE8\uDDEE\uDDF0\uDDF7-\uDDFB\uDDFE])|\uD83C\uDDF0(?:\uD83C[\uDDEA\uDDEC-\uDDEE\uDDF2\uDDF3\uDDF5\uDDF7\uDDFC\uDDFE\uDDFF])|\uD83C\uDDEF(?:\uD83C[\uDDEA\uDDF2\uDDF4\uDDF5])|\uD83C\uDDEE(?:\uD83C[\uDDE8-\uDDEA\uDDF1-\uDDF4\uDDF6-\uDDF9])|\uD83C\uDDED(?:\uD83C[\uDDF0\uDDF2\uDDF3\uDDF7\uDDF9\uDDFA])|\uD83C\uDDEC(?:\uD83C[\uDDE6\uDDE7\uDDE9-\uDDEE\uDDF1-\uDDF3\uDDF5-\uDDFA\uDDFC\uDDFE])|\uD83C\uDDEB(?:\uD83C[\uDDEE-\uDDF0\uDDF2\uDDF4\uDDF7])|\uD83C\uDDEA(?:\uD83C[\uDDE6\uDDE8\uDDEA\uDDEC\uDDED\uDDF7-\uDDFA])|\uD83C\uDDE9(?:\uD83C[\uDDEA\uDDEC\uDDEF\uDDF0\uDDF2\uDDF4\uDDFF])|\uD83C\uDDE8(?:\uD83C[\uDDE6\uDDE8\uDDE9\uDDEB-\uDDEE\uDDF0-\uDDF5\uDDF7\uDDFA-\uDDFF])|\uD83C\uDDE7(?:\uD83C[\uDDE6\uDDE7\uDDE9-\uDDEF\uDDF1-\uDDF4\uDDF6-\uDDF9\uDDFB\uDDFC\uDDFE\uDDFF])|\uD83C\uDDE6(?:\uD83C[\uDDE8-\uDDEC\uDDEE\uDDF1\uDDF2\uDDF4\uDDF6-\uDDFA\uDDFC\uDDFD\uDDFF])|[#\*0-9]\uFE0F\u20E3|\u2764\uFE0F|(?:\uD83C[\uDFC3\uDFC4\uDFCA]|\uD83D[\uDC6E\uDC70\uDC71\uDC73\uDC77\uDC81\uDC82\uDC86\uDC87\uDE45-\uDE47\uDE4B\uDE4D\uDE4E\uDEA3\uDEB4-\uDEB6]|\uD83E[\uDD26\uDD35\uDD37-\uDD39\uDD3D\uDD3E\uDDB8\uDDB9\uDDCD-\uDDCF\uDDD4\uDDD6-\uDDDD])(?:\uD83C[\uDFFB-\uDFFF])|(?:\u26F9|\uD83C[\uDFCB\uDFCC]|\uD83D\uDD75)(?:\uFE0F|\uD83C[\uDFFB-\uDFFF])|\uD83C\uDFF4|(?:[\u270A\u270B]|\uD83C[\uDF85\uDFC2\uDFC7]|\uD83D[\uDC42\uDC43\uDC46-\uDC50\uDC66\uDC67\uDC6B-\uDC6D\uDC72\uDC74-\uDC76\uDC78\uDC7C\uDC83\uDC85\uDC8F\uDC91\uDCAA\uDD7A\uDD95\uDD96\uDE4C\uDE4F\uDEC0\uDECC]|\uD83E[\uDD0C\uDD0F\uDD18-\uDD1C\uDD1E\uDD1F\uDD30-\uDD34\uDD36\uDD77\uDDB5\uDDB6\uDDBB\uDDD2\uDDD3\uDDD5])(?:\uD83C[\uDFFB-\uDFFF])|(?:[\u261D\u270C\u270D]|\uD83D[\uDD74\uDD90])(?:\uFE0F|\uD83C[\uDFFB-\uDFFF])|[\u270A\u270B]|\uD83C[\uDF85\uDFC2\uDFC7]|\uD83D[\uDC08\uDC15\uDC3B\uDC42\uDC43\uDC46-\uDC50\uDC66\uDC67\uDC6B-\uDC6D\uDC72\uDC74-\uDC76\uDC78\uDC7C\uDC83\uDC85\uDC8F\uDC91\uDCAA\uDD7A\uDD95\uDD96\uDE2E\uDE35\uDE36\uDE4C\uDE4F\uDEC0\uDECC]|\uD83E[\uDD0C\uDD0F\uDD18-\uDD1C\uDD1E\uDD1F\uDD30-\uDD34\uDD36\uDD77\uDDB5\uDDB6\uDDBB\uDDD2\uDDD3\uDDD5]|\uD83C[\uDFC3\uDFC4\uDFCA]|\uD83D[\uDC6E\uDC70\uDC71\uDC73\uDC77\uDC81\uDC82\uDC86\uDC87\uDE45-\uDE47\uDE4B\uDE4D\uDE4E\uDEA3\uDEB4-\uDEB6]|\uD83E[\uDD26\uDD35\uDD37-\uDD39\uDD3D\uDD3E\uDDB8\uDDB9\uDDCD-\uDDCF\uDDD4\uDDD6-\uDDDD]|\uD83D\uDC6F|\uD83E[\uDD3C\uDDDE\uDDDF]|[\u231A\u231B\u23E9-\u23EC\u23F0\u23F3\u25FD\u25FE\u2614\u2615\u2648-\u2653\u267F\u2693\u26A1\u26AA\u26AB\u26BD\u26BE\u26C4\u26C5\u26CE\u26D4\u26EA\u26F2\u26F3\u26F5\u26FA\u26FD\u2705\u2728\u274C\u274E\u2753-\u2755\u2757\u2795-\u2797\u27B0\u27BF\u2B1B\u2B1C\u2B50\u2B55]|\uD83C[\uDC04\uDCCF\uDD8E\uDD91-\uDD9A\uDE01\uDE1A\uDE2F\uDE32-\uDE36\uDE38-\uDE3A\uDE50\uDE51\uDF00-\uDF20\uDF2D-\uDF35\uDF37-\uDF7C\uDF7E-\uDF84\uDF86-\uDF93\uDFA0-\uDFC1\uDFC5\uDFC6\uDFC8\uDFC9\uDFCF-\uDFD3\uDFE0-\uDFF0\uDFF8-\uDFFF]|\uD83D[\uDC00-\uDC07\uDC09-\uDC14\uDC16-\uDC3A\uDC3C-\uDC3E\uDC40\uDC44\uDC45\uDC51-\uDC65\uDC6A\uDC79-\uDC7B\uDC7D-\uDC80\uDC84\uDC88-\uDC8E\uDC90\uDC92-\uDCA9\uDCAB-\uDCFC\uDCFF-\uDD3D\uDD4B-\uDD4E\uDD50-\uDD67\uDDA4\uDDFB-\uDE2D\uDE2F-\uDE34\uDE37-\uDE44\uDE48-\uDE4A\uDE80-\uDEA2\uDEA4-\uDEB3\uDEB7-\uDEBF\uDEC1-\uDEC5\uDED0-\uDED2\uDED5-\uDED7\uDEEB\uDEEC\uDEF4-\uDEFC\uDFE0-\uDFEB]|\uD83E[\uDD0D\uDD0E\uDD10-\uDD17\uDD1D\uDD20-\uDD25\uDD27-\uDD2F\uDD3A\uDD3F-\uDD45\uDD47-\uDD76\uDD78\uDD7A-\uDDB4\uDDB7\uDDBA\uDDBC-\uDDCB\uDDD0\uDDE0-\uDDFF\uDE70-\uDE74\uDE78-\uDE7A\uDE80-\uDE86\uDE90-\uDEA8\uDEB0-\uDEB6\uDEC0-\uDEC2\uDED0-\uDED6]|(?:[\u231A\u231B\u23E9-\u23EC\u23F0\u23F3\u25FD\u25FE\u2614\u2615\u2648-\u2653\u267F\u2693\u26A1\u26AA\u26AB\u26BD\u26BE\u26C4\u26C5\u26CE\u26D4\u26EA\u26F2\u26F3\u26F5\u26FA\u26FD\u2705\u270A\u270B\u2728\u274C\u274E\u2753-\u2755\u2757\u2795-\u2797\u27B0\u27BF\u2B1B\u2B1C\u2B50\u2B55]|\uD83C[\uDC04\uDCCF\uDD8E\uDD91-\uDD9A\uDDE6-\uDDFF\uDE01\uDE1A\uDE2F\uDE32-\uDE36\uDE38-\uDE3A\uDE50\uDE51\uDF00-\uDF20\uDF2D-\uDF35\uDF37-\uDF7C\uDF7E-\uDF93\uDFA0-\uDFCA\uDFCF-\uDFD3\uDFE0-\uDFF0\uDFF4\uDFF8-\uDFFF]|\uD83D[\uDC00-\uDC3E\uDC40\uDC42-\uDCFC\uDCFF-\uDD3D\uDD4B-\uDD4E\uDD50-\uDD67\uDD7A\uDD95\uDD96\uDDA4\uDDFB-\uDE4F\uDE80-\uDEC5\uDECC\uDED0-\uDED2\uDED5-\uDED7\uDEEB\uDEEC\uDEF4-\uDEFC\uDFE0-\uDFEB]|\uD83E[\uDD0C-\uDD3A\uDD3C-\uDD45\uDD47-\uDD78\uDD7A-\uDDCB\uDDCD-\uDDFF\uDE70-\uDE74\uDE78-\uDE7A\uDE80-\uDE86\uDE90-\uDEA8\uDEB0-\uDEB6\uDEC0-\uDEC2\uDED0-\uDED6])|(?:[#\*0-9\xA9\xAE\u203C\u2049\u2122\u2139\u2194-\u2199\u21A9\u21AA\u231A\u231B\u2328\u23CF\u23E9-\u23F3\u23F8-\u23FA\u24C2\u25AA\u25AB\u25B6\u25C0\u25FB-\u25FE\u2600-\u2604\u260E\u2611\u2614\u2615\u2618\u261D\u2620\u2622\u2623\u2626\u262A\u262E\u262F\u2638-\u263A\u2640\u2642\u2648-\u2653\u265F\u2660\u2663\u2665\u2666\u2668\u267B\u267E\u267F\u2692-\u2697\u2699\u269B\u269C\u26A0\u26A1\u26A7\u26AA\u26AB\u26B0\u26B1\u26BD\u26BE\u26C4\u26C5\u26C8\u26CE\u26CF\u26D1\u26D3\u26D4\u26E9\u26EA\u26F0-\u26F5\u26F7-\u26FA\u26FD\u2702\u2705\u2708-\u270D\u270F\u2712\u2714\u2716\u271D\u2721\u2728\u2733\u2734\u2744\u2747\u274C\u274E\u2753-\u2755\u2757\u2763\u2764\u2795-\u2797\u27A1\u27B0\u27BF\u2934\u2935\u2B05-\u2B07\u2B1B\u2B1C\u2B50\u2B55\u3030\u303D\u3297\u3299]|\uD83C[\uDC04\uDCCF\uDD70\uDD71\uDD7E\uDD7F\uDD8E\uDD91-\uDD9A\uDDE6-\uDDFF\uDE01\uDE02\uDE1A\uDE2F\uDE32-\uDE3A\uDE50\uDE51\uDF00-\uDF21\uDF24-\uDF93\uDF96\uDF97\uDF99-\uDF9B\uDF9E-\uDFF0\uDFF3-\uDFF5\uDFF7-\uDFFF]|\uD83D[\uDC00-\uDCFD\uDCFF-\uDD3D\uDD49-\uDD4E\uDD50-\uDD67\uDD6F\uDD70\uDD73-\uDD7A\uDD87\uDD8A-\uDD8D\uDD90\uDD95\uDD96\uDDA4\uDDA5\uDDA8\uDDB1\uDDB2\uDDBC\uDDC2-\uDDC4\uDDD1-\uDDD3\uDDDC-\uDDDE\uDDE1\uDDE3\uDDE8\uDDEF\uDDF3\uDDFA-\uDE4F\uDE80-\uDEC5\uDECB-\uDED2\uDED5-\uDED7\uDEE0-\uDEE5\uDEE9\uDEEB\uDEEC\uDEF0\uDEF3-\uDEFC\uDFE0-\uDFEB]|\uD83E[\uDD0C-\uDD3A\uDD3C-\uDD45\uDD47-\uDD78\uDD7A-\uDDCB\uDDCD-\uDDFF\uDE70-\uDE74\uDE78-\uDE7A\uDE80-\uDE86\uDE90-\uDEA8\uDEB0-\uDEB6\uDEC0-\uDEC2\uDED0-\uDED6])\uFE0F|(?:[\u261D\u26F9\u270A-\u270D]|\uD83C[\uDF85\uDFC2-\uDFC4\uDFC7\uDFCA-\uDFCC]|\uD83D[\uDC42\uDC43\uDC46-\uDC50\uDC66-\uDC78\uDC7C\uDC81-\uDC83\uDC85-\uDC87\uDC8F\uDC91\uDCAA\uDD74\uDD75\uDD7A\uDD90\uDD95\uDD96\uDE45-\uDE47\uDE4B-\uDE4F\uDEA3\uDEB4-\uDEB6\uDEC0\uDECC]|\uD83E[\uDD0C\uDD0F\uDD18-\uDD1F\uDD26\uDD30-\uDD39\uDD3C-\uDD3E\uDD77\uDDB5\uDDB6\uDDB8\uDDB9\uDDBB\uDDCD-\uDDCF\uDDD1-\uDDDD])/g;
+};
+var FD = O(uD);
+function A(t, u2 = {}) {
+  if (typeof t != "string" || t.length === 0 || (u2 = { ambiguousIsNarrow: true, ...u2 }, t = T(t), t.length === 0)) return 0;
+  t = t.replace(FD(), "  ");
+  const F = u2.ambiguousIsNarrow ? 1 : 2;
+  let e2 = 0;
+  for (const s of t) {
+    const i = s.codePointAt(0);
+    if (i <= 31 || i >= 127 && i <= 159 || i >= 768 && i <= 879) continue;
+    switch (DD.eastAsianWidth(s)) {
+      case "F":
+      case "W":
+        e2 += 2;
+        break;
+      case "A":
+        e2 += F;
+        break;
+      default:
+        e2 += 1;
+    }
+  }
+  return e2;
+}
+var m = 10;
+var L = (t = 0) => (u2) => `\x1B[${u2 + t}m`;
+var N = (t = 0) => (u2) => `\x1B[${38 + t};5;${u2}m`;
+var I = (t = 0) => (u2, F, e2) => `\x1B[${38 + t};2;${u2};${F};${e2}m`;
+var r = { modifier: { reset: [0, 0], bold: [1, 22], dim: [2, 22], italic: [3, 23], underline: [4, 24], overline: [53, 55], inverse: [7, 27], hidden: [8, 28], strikethrough: [9, 29] }, color: { black: [30, 39], red: [31, 39], green: [32, 39], yellow: [33, 39], blue: [34, 39], magenta: [35, 39], cyan: [36, 39], white: [37, 39], blackBright: [90, 39], gray: [90, 39], grey: [90, 39], redBright: [91, 39], greenBright: [92, 39], yellowBright: [93, 39], blueBright: [94, 39], magentaBright: [95, 39], cyanBright: [96, 39], whiteBright: [97, 39] }, bgColor: { bgBlack: [40, 49], bgRed: [41, 49], bgGreen: [42, 49], bgYellow: [43, 49], bgBlue: [44, 49], bgMagenta: [45, 49], bgCyan: [46, 49], bgWhite: [47, 49], bgBlackBright: [100, 49], bgGray: [100, 49], bgGrey: [100, 49], bgRedBright: [101, 49], bgGreenBright: [102, 49], bgYellowBright: [103, 49], bgBlueBright: [104, 49], bgMagentaBright: [105, 49], bgCyanBright: [106, 49], bgWhiteBright: [107, 49] } };
+Object.keys(r.modifier);
+var tD = Object.keys(r.color);
+var eD = Object.keys(r.bgColor);
+[...tD, ...eD];
+function sD() {
+  const t = /* @__PURE__ */ new Map();
+  for (const [u2, F] of Object.entries(r)) {
+    for (const [e2, s] of Object.entries(F)) r[e2] = { open: `\x1B[${s[0]}m`, close: `\x1B[${s[1]}m` }, F[e2] = r[e2], t.set(s[0], s[1]);
+    Object.defineProperty(r, u2, { value: F, enumerable: false });
+  }
+  return Object.defineProperty(r, "codes", { value: t, enumerable: false }), r.color.close = "\x1B[39m", r.bgColor.close = "\x1B[49m", r.color.ansi = L(), r.color.ansi256 = N(), r.color.ansi16m = I(), r.bgColor.ansi = L(m), r.bgColor.ansi256 = N(m), r.bgColor.ansi16m = I(m), Object.defineProperties(r, { rgbToAnsi256: { value: (u2, F, e2) => u2 === F && F === e2 ? u2 < 8 ? 16 : u2 > 248 ? 231 : Math.round((u2 - 8) / 247 * 24) + 232 : 16 + 36 * Math.round(u2 / 255 * 5) + 6 * Math.round(F / 255 * 5) + Math.round(e2 / 255 * 5), enumerable: false }, hexToRgb: { value: (u2) => {
+    const F = /[a-f\d]{6}|[a-f\d]{3}/i.exec(u2.toString(16));
+    if (!F) return [0, 0, 0];
+    let [e2] = F;
+    e2.length === 3 && (e2 = [...e2].map((i) => i + i).join(""));
+    const s = Number.parseInt(e2, 16);
+    return [s >> 16 & 255, s >> 8 & 255, s & 255];
+  }, enumerable: false }, hexToAnsi256: { value: (u2) => r.rgbToAnsi256(...r.hexToRgb(u2)), enumerable: false }, ansi256ToAnsi: { value: (u2) => {
+    if (u2 < 8) return 30 + u2;
+    if (u2 < 16) return 90 + (u2 - 8);
+    let F, e2, s;
+    if (u2 >= 232) F = ((u2 - 232) * 10 + 8) / 255, e2 = F, s = F;
+    else {
+      u2 -= 16;
+      const C = u2 % 36;
+      F = Math.floor(u2 / 36) / 5, e2 = Math.floor(C / 6) / 5, s = C % 6 / 5;
+    }
+    const i = Math.max(F, e2, s) * 2;
+    if (i === 0) return 30;
+    let D = 30 + (Math.round(s) << 2 | Math.round(e2) << 1 | Math.round(F));
+    return i === 2 && (D += 60), D;
+  }, enumerable: false }, rgbToAnsi: { value: (u2, F, e2) => r.ansi256ToAnsi(r.rgbToAnsi256(u2, F, e2)), enumerable: false }, hexToAnsi: { value: (u2) => r.ansi256ToAnsi(r.hexToAnsi256(u2)), enumerable: false } }), r;
+}
+var iD = sD();
+var v = /* @__PURE__ */ new Set(["\x1B", "\x9B"]);
+var CD = 39;
+var w = "\x07";
+var W = "[";
+var rD = "]";
+var R = "m";
+var y = `${rD}8;;`;
+var V = (t) => `${v.values().next().value}${W}${t}${R}`;
+var z = (t) => `${v.values().next().value}${y}${t}${w}`;
+var ED = (t) => t.split(" ").map((u2) => A(u2));
+var _ = (t, u2, F) => {
+  const e2 = [...u2];
+  let s = false, i = false, D = A(T(t[t.length - 1]));
+  for (const [C, o] of e2.entries()) {
+    const E2 = A(o);
+    if (D + E2 <= F ? t[t.length - 1] += o : (t.push(o), D = 0), v.has(o) && (s = true, i = e2.slice(C + 1).join("").startsWith(y)), s) {
+      i ? o === w && (s = false, i = false) : o === R && (s = false);
+      continue;
+    }
+    D += E2, D === F && C < e2.length - 1 && (t.push(""), D = 0);
+  }
+  !D && t[t.length - 1].length > 0 && t.length > 1 && (t[t.length - 2] += t.pop());
+};
+var nD = (t) => {
+  const u2 = t.split(" ");
+  let F = u2.length;
+  for (; F > 0 && !(A(u2[F - 1]) > 0); ) F--;
+  return F === u2.length ? t : u2.slice(0, F).join(" ") + u2.slice(F).join("");
+};
+var oD = (t, u2, F = {}) => {
+  if (F.trim !== false && t.trim() === "") return "";
+  let e2 = "", s, i;
+  const D = ED(t);
+  let C = [""];
+  for (const [E2, a2] of t.split(" ").entries()) {
+    F.trim !== false && (C[C.length - 1] = C[C.length - 1].trimStart());
+    let n = A(C[C.length - 1]);
+    if (E2 !== 0 && (n >= u2 && (F.wordWrap === false || F.trim === false) && (C.push(""), n = 0), (n > 0 || F.trim === false) && (C[C.length - 1] += " ", n++)), F.hard && D[E2] > u2) {
+      const B3 = u2 - n, p2 = 1 + Math.floor((D[E2] - B3 - 1) / u2);
+      Math.floor((D[E2] - 1) / u2) < p2 && C.push(""), _(C, a2, u2);
+      continue;
+    }
+    if (n + D[E2] > u2 && n > 0 && D[E2] > 0) {
+      if (F.wordWrap === false && n < u2) {
+        _(C, a2, u2);
+        continue;
+      }
+      C.push("");
+    }
+    if (n + D[E2] > u2 && F.wordWrap === false) {
+      _(C, a2, u2);
+      continue;
+    }
+    C[C.length - 1] += a2;
+  }
+  F.trim !== false && (C = C.map((E2) => nD(E2)));
+  const o = [...C.join(`
+`)];
+  for (const [E2, a2] of o.entries()) {
+    if (e2 += a2, v.has(a2)) {
+      const { groups: B3 } = new RegExp(`(?:\\${W}(?<code>\\d+)m|\\${y}(?<uri>.*)${w})`).exec(o.slice(E2).join("")) || { groups: {} };
+      if (B3.code !== void 0) {
+        const p2 = Number.parseFloat(B3.code);
+        s = p2 === CD ? void 0 : p2;
+      } else B3.uri !== void 0 && (i = B3.uri.length === 0 ? void 0 : B3.uri);
+    }
+    const n = iD.codes.get(Number(s));
+    o[E2 + 1] === `
+` ? (i && (e2 += z("")), s && n && (e2 += V(n))) : a2 === `
+` && (s && n && (e2 += V(s)), i && (e2 += z(i)));
+  }
+  return e2;
+};
+function G(t, u2, F) {
+  return String(t).normalize().replace(/\r\n/g, `
+`).split(`
+`).map((e2) => oD(e2, u2, F)).join(`
+`);
+}
+var aD = ["up", "down", "left", "right", "space", "enter", "cancel"];
+var c = { actions: new Set(aD), aliases: /* @__PURE__ */ new Map([["k", "up"], ["j", "down"], ["h", "left"], ["l", "right"], ["", "cancel"], ["escape", "cancel"]]) };
+function k(t, u2) {
+  if (typeof t == "string") return c.aliases.get(t) === u2;
+  for (const F of t) if (F !== void 0 && k(F, u2)) return true;
+  return false;
+}
+function lD(t, u2) {
+  if (t === u2) return;
+  const F = t.split(`
+`), e2 = u2.split(`
+`), s = [];
+  for (let i = 0; i < Math.max(F.length, e2.length); i++) F[i] !== e2[i] && s.push(i);
+  return s;
+}
+var xD = globalThis.process.platform.startsWith("win");
+var S = /* @__PURE__ */ Symbol("clack:cancel");
+function BD(t) {
+  return t === S;
+}
+function d(t, u2) {
+  const F = t;
+  F.isTTY && F.setRawMode(u2);
+}
+function cD({ input: t = import_node_process.stdin, output: u2 = import_node_process.stdout, overwrite: F = true, hideCursor: e2 = true } = {}) {
+  const s = f.createInterface({ input: t, output: u2, prompt: "", tabSize: 1 });
+  f.emitKeypressEvents(t, s), t.isTTY && t.setRawMode(true);
+  const i = (D, { name: C, sequence: o }) => {
+    const E2 = String(D);
+    if (k([E2, C, o], "cancel")) {
+      e2 && u2.write(import_sisteransi.cursor.show), process.exit(0);
+      return;
+    }
+    if (!F) return;
+    const a2 = C === "return" ? 0 : -1, n = C === "return" ? -1 : 0;
+    f.moveCursor(u2, a2, n, () => {
+      f.clearLine(u2, 1, () => {
+        t.once("keypress", i);
+      });
+    });
+  };
+  return e2 && u2.write(import_sisteransi.cursor.hide), t.once("keypress", i), () => {
+    t.off("keypress", i), e2 && u2.write(import_sisteransi.cursor.show), t.isTTY && !xD && t.setRawMode(false), s.terminal = false, s.close();
+  };
+}
+var AD = Object.defineProperty;
+var pD = (t, u2, F) => u2 in t ? AD(t, u2, { enumerable: true, configurable: true, writable: true, value: F }) : t[u2] = F;
+var h = (t, u2, F) => (pD(t, typeof u2 != "symbol" ? u2 + "" : u2, F), F);
+var x = class {
+  constructor(u2, F = true) {
+    h(this, "input"), h(this, "output"), h(this, "_abortSignal"), h(this, "rl"), h(this, "opts"), h(this, "_render"), h(this, "_track", false), h(this, "_prevFrame", ""), h(this, "_subscribers", /* @__PURE__ */ new Map()), h(this, "_cursor", 0), h(this, "state", "initial"), h(this, "error", ""), h(this, "value");
+    const { input: e2 = import_node_process.stdin, output: s = import_node_process.stdout, render: i, signal: D, ...C } = u2;
+    this.opts = C, this.onKeypress = this.onKeypress.bind(this), this.close = this.close.bind(this), this.render = this.render.bind(this), this._render = i.bind(this), this._track = F, this._abortSignal = D, this.input = e2, this.output = s;
+  }
+  unsubscribe() {
+    this._subscribers.clear();
+  }
+  setSubscriber(u2, F) {
+    const e2 = this._subscribers.get(u2) ?? [];
+    e2.push(F), this._subscribers.set(u2, e2);
+  }
+  on(u2, F) {
+    this.setSubscriber(u2, { cb: F });
+  }
+  once(u2, F) {
+    this.setSubscriber(u2, { cb: F, once: true });
+  }
+  emit(u2, ...F) {
+    const e2 = this._subscribers.get(u2) ?? [], s = [];
+    for (const i of e2) i.cb(...F), i.once && s.push(() => e2.splice(e2.indexOf(i), 1));
+    for (const i of s) i();
+  }
+  prompt() {
+    return new Promise((u2, F) => {
+      if (this._abortSignal) {
+        if (this._abortSignal.aborted) return this.state = "cancel", this.close(), u2(S);
+        this._abortSignal.addEventListener("abort", () => {
+          this.state = "cancel", this.close();
+        }, { once: true });
+      }
+      const e2 = new import_node_tty.WriteStream(0);
+      e2._write = (s, i, D) => {
+        this._track && (this.value = this.rl?.line.replace(/\t/g, ""), this._cursor = this.rl?.cursor ?? 0, this.emit("value", this.value)), D();
+      }, this.input.pipe(e2), this.rl = import_node_readline.default.createInterface({ input: this.input, output: e2, tabSize: 2, prompt: "", escapeCodeTimeout: 50 }), import_node_readline.default.emitKeypressEvents(this.input, this.rl), this.rl.prompt(), this.opts.initialValue !== void 0 && this._track && this.rl.write(this.opts.initialValue), this.input.on("keypress", this.onKeypress), d(this.input, true), this.output.on("resize", this.render), this.render(), this.once("submit", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), d(this.input, false), u2(this.value);
+      }), this.once("cancel", () => {
+        this.output.write(import_sisteransi.cursor.show), this.output.off("resize", this.render), d(this.input, false), u2(S);
+      });
+    });
+  }
+  onKeypress(u2, F) {
+    if (this.state === "error" && (this.state = "active"), F?.name && (!this._track && c.aliases.has(F.name) && this.emit("cursor", c.aliases.get(F.name)), c.actions.has(F.name) && this.emit("cursor", F.name)), u2 && (u2.toLowerCase() === "y" || u2.toLowerCase() === "n") && this.emit("confirm", u2.toLowerCase() === "y"), u2 === "	" && this.opts.placeholder && (this.value || (this.rl?.write(this.opts.placeholder), this.emit("value", this.opts.placeholder))), u2 && this.emit("key", u2.toLowerCase()), F?.name === "return") {
+      if (this.opts.validate) {
+        const e2 = this.opts.validate(this.value);
+        e2 && (this.error = e2 instanceof Error ? e2.message : e2, this.state = "error", this.rl?.write(this.value));
+      }
+      this.state !== "error" && (this.state = "submit");
+    }
+    k([u2, F?.name, F?.sequence], "cancel") && (this.state = "cancel"), (this.state === "submit" || this.state === "cancel") && this.emit("finalize"), this.render(), (this.state === "submit" || this.state === "cancel") && this.close();
+  }
+  close() {
+    this.input.unpipe(), this.input.removeListener("keypress", this.onKeypress), this.output.write(`
+`), d(this.input, false), this.rl?.close(), this.rl = void 0, this.emit(`${this.state}`, this.value), this.unsubscribe();
+  }
+  restoreCursor() {
+    const u2 = G(this._prevFrame, process.stdout.columns, { hard: true }).split(`
+`).length - 1;
+    this.output.write(import_sisteransi.cursor.move(-999, u2 * -1));
+  }
+  render() {
+    const u2 = G(this._render(this) ?? "", process.stdout.columns, { hard: true });
+    if (u2 !== this._prevFrame) {
+      if (this.state === "initial") this.output.write(import_sisteransi.cursor.hide);
+      else {
+        const F = lD(this._prevFrame, u2);
+        if (this.restoreCursor(), F && F?.length === 1) {
+          const e2 = F[0];
+          this.output.write(import_sisteransi.cursor.move(0, e2)), this.output.write(import_sisteransi.erase.lines(1));
+          const s = u2.split(`
+`);
+          this.output.write(s[e2]), this._prevFrame = u2, this.output.write(import_sisteransi.cursor.move(0, s.length - e2 - 1));
+          return;
+        }
+        if (F && F?.length > 1) {
+          const e2 = F[0];
+          this.output.write(import_sisteransi.cursor.move(0, e2)), this.output.write(import_sisteransi.erase.down());
+          const s = u2.split(`
+`).slice(e2);
+          this.output.write(s.join(`
+`)), this._prevFrame = u2;
+          return;
+        }
+        this.output.write(import_sisteransi.erase.down());
+      }
+      this.output.write(u2), this.state === "initial" && (this.state = "active"), this._prevFrame = u2;
+    }
+  }
+};
+var fD = class extends x {
+  get cursor() {
+    return this.value ? 0 : 1;
+  }
+  get _value() {
+    return this.cursor === 0;
+  }
+  constructor(u2) {
+    super(u2, false), this.value = !!u2.initialValue, this.on("value", () => {
+      this.value = this._value;
+    }), this.on("confirm", (F) => {
+      this.output.write(import_sisteransi.cursor.move(0, -1)), this.value = F, this.state = "submit", this.close();
+    }), this.on("cursor", () => {
+      this.value = !this.value;
+    });
+  }
+};
+var yD = Object.defineProperty;
+var _D = (t, u2, F) => u2 in t ? yD(t, u2, { enumerable: true, configurable: true, writable: true, value: F }) : t[u2] = F;
+var Z = (t, u2, F) => (_D(t, typeof u2 != "symbol" ? u2 + "" : u2, F), F);
+var kD = class extends x {
+  constructor({ mask: u2, ...F }) {
+    super(F), Z(this, "valueWithCursor", ""), Z(this, "_mask", "\u2022"), this._mask = u2 ?? "\u2022", this.on("finalize", () => {
+      this.valueWithCursor = this.masked;
+    }), this.on("value", () => {
+      if (this.cursor >= this.value.length) this.valueWithCursor = `${this.masked}${import_picocolors.default.inverse(import_picocolors.default.hidden("_"))}`;
+      else {
+        const e2 = this.masked.slice(0, this.cursor), s = this.masked.slice(this.cursor);
+        this.valueWithCursor = `${e2}${import_picocolors.default.inverse(s[0])}${s.slice(1)}`;
+      }
+    });
+  }
+  get cursor() {
+    return this._cursor;
+  }
+  get masked() {
+    return this.value.replaceAll(/./g, this._mask);
+  }
+};
+var SD = Object.defineProperty;
+var $D = (t, u2, F) => u2 in t ? SD(t, u2, { enumerable: true, configurable: true, writable: true, value: F }) : t[u2] = F;
+var q = (t, u2, F) => ($D(t, typeof u2 != "symbol" ? u2 + "" : u2, F), F);
+var jD = class extends x {
+  constructor(u2) {
+    super(u2, false), q(this, "options"), q(this, "cursor", 0), this.options = u2.options, this.cursor = this.options.findIndex(({ value: F }) => F === u2.initialValue), this.cursor === -1 && (this.cursor = 0), this.changeValue(), this.on("cursor", (F) => {
+      switch (F) {
+        case "left":
+        case "up":
+          this.cursor = this.cursor === 0 ? this.options.length - 1 : this.cursor - 1;
+          break;
+        case "down":
+        case "right":
+          this.cursor = this.cursor === this.options.length - 1 ? 0 : this.cursor + 1;
+          break;
+      }
+      this.changeValue();
+    });
+  }
+  get _value() {
+    return this.options[this.cursor];
+  }
+  changeValue() {
+    this.value = this._value.value;
+  }
+};
+var PD = class extends x {
+  get valueWithCursor() {
+    if (this.state === "submit") return this.value;
+    if (this.cursor >= this.value.length) return `${this.value}\u2588`;
+    const u2 = this.value.slice(0, this.cursor), [F, ...e2] = this.value.slice(this.cursor);
+    return `${u2}${import_picocolors.default.inverse(F)}${e2.join("")}`;
+  }
+  get cursor() {
+    return this._cursor;
+  }
+  constructor(u2) {
+    super(u2), this.on("finalize", () => {
+      this.value || (this.value = u2.defaultValue);
+    });
+  }
+};
+
+// ../../node_modules/@clack/prompts/dist/index.mjs
+var import_node_process2 = __toESM(require("process"), 1);
+var import_picocolors2 = __toESM(require_picocolors(), 1);
+var import_sisteransi2 = __toESM(require_src(), 1);
+function X2() {
+  return import_node_process2.default.platform !== "win32" ? import_node_process2.default.env.TERM !== "linux" : !!import_node_process2.default.env.CI || !!import_node_process2.default.env.WT_SESSION || !!import_node_process2.default.env.TERMINUS_SUBLIME || import_node_process2.default.env.ConEmuTask === "{cmd::Cmder}" || import_node_process2.default.env.TERM_PROGRAM === "Terminus-Sublime" || import_node_process2.default.env.TERM_PROGRAM === "vscode" || import_node_process2.default.env.TERM === "xterm-256color" || import_node_process2.default.env.TERM === "alacritty" || import_node_process2.default.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
+}
+var E = X2();
+var u = (s, n) => E ? s : n;
+var ee = u("\u25C6", "*");
+var A2 = u("\u25A0", "x");
+var B = u("\u25B2", "x");
+var S2 = u("\u25C7", "o");
+var te = u("\u250C", "T");
+var a = u("\u2502", "|");
+var m2 = u("\u2514", "\u2014");
+var j2 = u("\u25CF", ">");
+var R2 = u("\u25CB", " ");
+var V2 = u("\u25FB", "[\u2022]");
+var M2 = u("\u25FC", "[+]");
+var G2 = u("\u25FB", "[ ]");
+var se = u("\u25AA", "\u2022");
+var N2 = u("\u2500", "-");
+var re = u("\u256E", "+");
+var ie = u("\u251C", "+");
+var ne = u("\u256F", "+");
+var ae = u("\u25CF", "\u2022");
+var oe = u("\u25C6", "*");
+var ce = u("\u25B2", "!");
+var le = u("\u25A0", "x");
+var y2 = (s) => {
+  switch (s) {
+    case "initial":
+    case "active":
+      return import_picocolors2.default.cyan(ee);
+    case "cancel":
+      return import_picocolors2.default.red(A2);
+    case "error":
+      return import_picocolors2.default.yellow(B);
+    case "submit":
+      return import_picocolors2.default.green(S2);
+  }
+};
+var k2 = (s) => {
+  const { cursor: n, options: t, style: i } = s, r2 = s.maxItems ?? Number.POSITIVE_INFINITY, c2 = Math.max(process.stdout.rows - 4, 0), o = Math.min(c2, Math.max(r2, 5));
+  let l2 = 0;
+  n >= l2 + o - 3 ? l2 = Math.max(Math.min(n - o + 3, t.length - o), 0) : n < l2 + 2 && (l2 = Math.max(n - 2, 0));
+  const $2 = o < t.length && l2 > 0, d2 = o < t.length && l2 + o < t.length;
+  return t.slice(l2, l2 + o).map((w2, b2, C) => {
+    const I2 = b2 === 0 && $2, x2 = b2 === C.length - 1 && d2;
+    return I2 || x2 ? import_picocolors2.default.dim("...") : i(w2, b2 + l2 === n);
+  });
+};
+var ue = (s) => new PD({ validate: s.validate, placeholder: s.placeholder, defaultValue: s.defaultValue, initialValue: s.initialValue, render() {
+  const n = `${import_picocolors2.default.gray(a)}
+${y2(this.state)}  ${s.message}
+`, t = s.placeholder ? import_picocolors2.default.inverse(s.placeholder[0]) + import_picocolors2.default.dim(s.placeholder.slice(1)) : import_picocolors2.default.inverse(import_picocolors2.default.hidden("_")), i = this.value ? this.valueWithCursor : t;
+  switch (this.state) {
+    case "error":
+      return `${n.trim()}
+${import_picocolors2.default.yellow(a)}  ${i}
+${import_picocolors2.default.yellow(m2)}  ${import_picocolors2.default.yellow(this.error)}
+`;
+    case "submit":
+      return `${n}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(this.value || s.placeholder)}`;
+    case "cancel":
+      return `${n}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(this.value ?? ""))}${this.value?.trim() ? `
+${import_picocolors2.default.gray(a)}` : ""}`;
+    default:
+      return `${n}${import_picocolors2.default.cyan(a)}  ${i}
+${import_picocolors2.default.cyan(m2)}
+`;
+  }
+} }).prompt();
+var $e = (s) => new kD({ validate: s.validate, mask: s.mask ?? se, render() {
+  const n = `${import_picocolors2.default.gray(a)}
+${y2(this.state)}  ${s.message}
+`, t = this.valueWithCursor, i = this.masked;
+  switch (this.state) {
+    case "error":
+      return `${n.trim()}
+${import_picocolors2.default.yellow(a)}  ${i}
+${import_picocolors2.default.yellow(m2)}  ${import_picocolors2.default.yellow(this.error)}
+`;
+    case "submit":
+      return `${n}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(i)}`;
+    case "cancel":
+      return `${n}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(i ?? ""))}${i ? `
+${import_picocolors2.default.gray(a)}` : ""}`;
+    default:
+      return `${n}${import_picocolors2.default.cyan(a)}  ${t}
+${import_picocolors2.default.cyan(m2)}
+`;
+  }
+} }).prompt();
+var me = (s) => {
+  const n = s.active ?? "Yes", t = s.inactive ?? "No";
+  return new fD({ active: n, inactive: t, initialValue: s.initialValue ?? true, render() {
+    const i = `${import_picocolors2.default.gray(a)}
+${y2(this.state)}  ${s.message}
+`, r2 = this.value ? n : t;
+    switch (this.state) {
+      case "submit":
+        return `${i}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(r2)}`;
+      case "cancel":
+        return `${i}${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(r2))}
+${import_picocolors2.default.gray(a)}`;
+      default:
+        return `${i}${import_picocolors2.default.cyan(a)}  ${this.value ? `${import_picocolors2.default.green(j2)} ${n}` : `${import_picocolors2.default.dim(R2)} ${import_picocolors2.default.dim(n)}`} ${import_picocolors2.default.dim("/")} ${this.value ? `${import_picocolors2.default.dim(R2)} ${import_picocolors2.default.dim(t)}` : `${import_picocolors2.default.green(j2)} ${t}`}
+${import_picocolors2.default.cyan(m2)}
+`;
+    }
+  } }).prompt();
+};
+var de = (s) => {
+  const n = (t, i) => {
+    const r2 = t.label ?? String(t.value);
+    switch (i) {
+      case "selected":
+        return `${import_picocolors2.default.dim(r2)}`;
+      case "active":
+        return `${import_picocolors2.default.green(j2)} ${r2} ${t.hint ? import_picocolors2.default.dim(`(${t.hint})`) : ""}`;
+      case "cancelled":
+        return `${import_picocolors2.default.strikethrough(import_picocolors2.default.dim(r2))}`;
+      default:
+        return `${import_picocolors2.default.dim(R2)} ${import_picocolors2.default.dim(r2)}`;
+    }
+  };
+  return new jD({ options: s.options, initialValue: s.initialValue, render() {
+    const t = `${import_picocolors2.default.gray(a)}
+${y2(this.state)}  ${s.message}
+`;
+    switch (this.state) {
+      case "submit":
+        return `${t}${import_picocolors2.default.gray(a)}  ${n(this.options[this.cursor], "selected")}`;
+      case "cancel":
+        return `${t}${import_picocolors2.default.gray(a)}  ${n(this.options[this.cursor], "cancelled")}
+${import_picocolors2.default.gray(a)}`;
+      default:
+        return `${t}${import_picocolors2.default.cyan(a)}  ${k2({ cursor: this.cursor, options: this.options, maxItems: s.maxItems, style: (i, r2) => n(i, r2 ? "active" : "inactive") }).join(`
+${import_picocolors2.default.cyan(a)}  `)}
+${import_picocolors2.default.cyan(m2)}
+`;
+    }
+  } }).prompt();
+};
+var ye = (s = "", n = "") => {
+  const t = `
+${s}
+`.split(`
+`), i = (0, import_node_util.stripVTControlCharacters)(n).length, r2 = Math.max(t.reduce((o, l2) => {
+    const $2 = (0, import_node_util.stripVTControlCharacters)(l2);
+    return $2.length > o ? $2.length : o;
+  }, 0), i) + 2, c2 = t.map((o) => `${import_picocolors2.default.gray(a)}  ${import_picocolors2.default.dim(o)}${" ".repeat(r2 - (0, import_node_util.stripVTControlCharacters)(o).length)}${import_picocolors2.default.gray(a)}`).join(`
+`);
+  process.stdout.write(`${import_picocolors2.default.gray(a)}
+${import_picocolors2.default.green(S2)}  ${import_picocolors2.default.reset(n)} ${import_picocolors2.default.gray(N2.repeat(Math.max(r2 - i - 1, 1)) + re)}
+${c2}
+${import_picocolors2.default.gray(ie + N2.repeat(r2 + 2) + ne)}
+`);
+};
+var ve = (s = "") => {
+  process.stdout.write(`${import_picocolors2.default.gray(m2)}  ${import_picocolors2.default.red(s)}
+
+`);
+};
+var we = (s = "") => {
+  process.stdout.write(`${import_picocolors2.default.gray(te)}  ${s}
+`);
+};
+var fe = (s = "") => {
+  process.stdout.write(`${import_picocolors2.default.gray(a)}
+${import_picocolors2.default.gray(m2)}  ${s}
+
+`);
+};
+var v2 = { message: (s = "", { symbol: n = import_picocolors2.default.gray(a) } = {}) => {
+  const t = [`${import_picocolors2.default.gray(a)}`];
+  if (s) {
+    const [i, ...r2] = s.split(`
+`);
+    t.push(`${n}  ${i}`, ...r2.map((c2) => `${import_picocolors2.default.gray(a)}  ${c2}`));
+  }
+  process.stdout.write(`${t.join(`
+`)}
+`);
+}, info: (s) => {
+  v2.message(s, { symbol: import_picocolors2.default.blue(ae) });
+}, success: (s) => {
+  v2.message(s, { symbol: import_picocolors2.default.green(oe) });
+}, step: (s) => {
+  v2.message(s, { symbol: import_picocolors2.default.green(S2) });
+}, warn: (s) => {
+  v2.message(s, { symbol: import_picocolors2.default.yellow(ce) });
+}, warning: (s) => {
+  v2.warn(s);
+}, error: (s) => {
+  v2.message(s, { symbol: import_picocolors2.default.red(le) });
+} };
+var L2 = () => {
+  const s = E ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], n = E ? 80 : 120, t = process.env.CI === "true";
+  let i, r2, c2 = false, o = "", l2;
+  const $2 = (h2) => {
+    const g2 = h2 > 1 ? "Something went wrong" : "Canceled";
+    c2 && P2(g2, h2);
+  }, d2 = () => $2(2), w2 = () => $2(1), b2 = () => {
+    process.on("uncaughtExceptionMonitor", d2), process.on("unhandledRejection", d2), process.on("SIGINT", w2), process.on("SIGTERM", w2), process.on("exit", $2);
+  }, C = () => {
+    process.removeListener("uncaughtExceptionMonitor", d2), process.removeListener("unhandledRejection", d2), process.removeListener("SIGINT", w2), process.removeListener("SIGTERM", w2), process.removeListener("exit", $2);
+  }, I2 = () => {
+    if (l2 === void 0) return;
+    t && process.stdout.write(`
+`);
+    const h2 = l2.split(`
+`);
+    process.stdout.write(import_sisteransi2.cursor.move(-999, h2.length - 1)), process.stdout.write(import_sisteransi2.erase.down(h2.length));
+  }, x2 = (h2) => h2.replace(/\.+$/, ""), O2 = (h2 = "") => {
+    c2 = true, i = cD(), o = x2(h2), process.stdout.write(`${import_picocolors2.default.gray(a)}
+`);
+    let g2 = 0, f2 = 0;
+    b2(), r2 = setInterval(() => {
+      if (t && o === l2) return;
+      I2(), l2 = o;
+      const W2 = import_picocolors2.default.magenta(s[g2]), _2 = t ? "..." : ".".repeat(Math.floor(f2)).slice(0, 3);
+      process.stdout.write(`${W2}  ${o}${_2}`), g2 = g2 + 1 < s.length ? g2 + 1 : 0, f2 = f2 < s.length ? f2 + 0.125 : 0;
+    }, n);
+  }, P2 = (h2 = "", g2 = 0) => {
+    c2 = false, clearInterval(r2), I2();
+    const f2 = g2 === 0 ? import_picocolors2.default.green(S2) : g2 === 1 ? import_picocolors2.default.red(A2) : import_picocolors2.default.red(B);
+    o = x2(h2 ?? o), process.stdout.write(`${f2}  ${o}
+`), C(), i();
+  };
+  return { start: O2, stop: P2, message: (h2 = "") => {
+    o = x2(h2 ?? o);
+  } };
+};
+
+// src/prompts.ts
+var import_node_crypto3 = require("crypto");
+var import_node_fs4 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path5 = require("path");
+
+// src/header.ts
+var R3 = "\x1B[0m";
+var B2 = "\x1B[1m";
+var AMB = "\x1B[38;2;224;162;72m";
+var CRM = "\x1B[38;2;245;238;216m";
+var FNT = "\x1B[38;2;130;100;45m";
+var DIM = "\x1B[38;2;70;58;35m";
+var MID = "\x1B[38;2;155;135;100m";
+var GRN = "\x1B[38;2;80;200;120m";
+var ab = (s) => `${B2}${AMB}${s}${R3}`;
+var wb = (s) => `${B2}${CRM}${s}${R3}`;
+var fn = (s) => `${FNT}${s}${R3}`;
+var dm = (s) => `${DIM}${s}${R3}`;
+var mi = (s) => `${MID}${s}${R3}`;
+var gn = (s) => `${GRN}${s}${R3}`;
+var _O = [" \u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", " \u2588\u2588\u2588\u2588\u2588 "];
+var _N = ["\u2588\u2588   \u2588\u2588", "\u2588\u2588\u2588  \u2588\u2588", "\u2588\u2588\u2588\u2588 \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588 \u2588\u2588\u2588\u2588", "\u2588\u2588  \u2588\u2588\u2588", "\u2588\u2588   \u2588\u2588"];
+var _E = ["\u2588\u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", "\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588     ", "\u2588\u2588     ", "\u2588\u2588\u2588\u2588\u2588\u2588\u2588"];
+var _A = ["  \u2588\u2588\u2588  ", " \u2588\u2588 \u2588\u2588 ", "\u2588\u2588   \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588"];
+var _D2 = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
+var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588", "\u2588\u2588   \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588\u2588\u2588   ", "\u2588\u2588 \u2588\u2588  ", "\u2588\u2588  \u2588\u2588 "];
+var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
+var ONE_ROWS = Array.from({ length: 7 }, (_2, i) => [_O[i], _N[i], _E[i]].join(" "));
+var ADDR_ROWS = Array.from({ length: 7 }, (_2, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
+function printHeader() {
+  const BAR_LEN = 86;
+  const TOP_BAR = fn("\u250C") + dm("\u2500".repeat(BAR_LEN)) + fn("\u2510");
+  const BOT_BAR = fn("\u2514") + dm("\u2500".repeat(BAR_LEN)) + fn("\u2518");
+  const SIDE = dm("\u2502");
+  console.log("");
+  console.log(" " + TOP_BAR);
+  console.log(` ${SIDE}${" ".repeat(BAR_LEN)}${SIDE}`);
+  for (let i = 0; i < 7; i++) {
+    const line = wb(ONE_ROWS[i]) + "   " + ab(ADDR_ROWS[i]);
+    console.log(`  ${SIDE}  ${line}  ${SIDE}`);
+  }
+  console.log(`  ${SIDE}  ${fn("\u2591".repeat(81))}  ${SIDE}`);
+  console.log(` ${SIDE}${" ".repeat(BAR_LEN)}${SIDE}`);
+  const wizard = mi("Partner Setup Wizard");
+  const version = fn("v2  \xB7  partners.oneaddress.io");
+  const tagLine = `  ${wizard}    ${version}    ${gn("\xB7io")}`;
+  const padLen = BAR_LEN - 4 - stripAnsi(tagLine).length;
+  console.log(` ${SIDE}  ${tagLine}${" ".repeat(Math.max(0, padLen))}  ${SIDE}`);
+  console.log(` ${SIDE}${" ".repeat(BAR_LEN)}${SIDE}`);
+  console.log(" " + BOT_BAR);
+  console.log("");
+}
+function stripAnsi(s) {
+  return s.replace(/\x1b\[[0-9;]*m/g, "");
+}
+
+// src/scaffold.ts
+var import_promises = require("fs/promises");
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+
+// src/templates.ts
+var TEMPLATES = {
+  // ── TypeScript / Node.js (Express) ─────────────────────────────────────────
+  "ts-node": [
+    {
+      name: ".env",
+      content: `# OneAddress webhook credentials \u2014 written by npx @oneaddress/setup
+PARTNER_ID=%%PARTNER_ID%%
+WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+PARTNER_PRIVATE_KEY_PEM=%%PRIVATE_KEY%%
+PORT=3001
+`
+    },
+    {
+      name: ".env.example",
+      content: `# OneAddress webhook credentials
+# Copy this file to .env and fill in real values. Never commit .env to source control.
+
+# Your partner UUID from the OneAddress Partner Portal
+PARTNER_ID=your-partner-uuid-here
+
+# HMAC-SHA256 webhook signing secret from the Partner Portal
+WEBHOOK_SECRET=your-webhook-secret-here
+
+# PKCS#8 PEM private key for decrypting address payloads.
+# Newlines encoded as literal \\n in a single-line value:
+# -----BEGIN PRIVATE KEY-----\\nMIGHAgEA...\\n-----END PRIVATE KEY-----
+PARTNER_PRIVATE_KEY_PEM=
+
+# HTTP port for the local webhook server
+PORT=3001
+`
+    },
+    {
+      name: ".gitignore",
+      content: `.env
+node_modules/
+dist/
+`
+    },
+    {
+      name: "package.json",
+      content: `{
+  "name": "oneaddress-webhook-handler",
+  "version": "1.0.0",
+  "private": true,
+  "scripts": {
+    "dev":   "tsx watch src/server.ts",
+    "start": "node dist/server.js",
+    "build": "tsup src/server.ts --format cjs --no-dts --outDir dist",
+    "test":  "tsx scripts/test.ts"
+  },
+  "dependencies": {
+    "@oneaddress/partner-sdk": "latest",
+    "dotenv":  "^16.0.0",
+    "express": "^4.18.0"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.0",
+    "@types/node":    "^20.0.0",
+    "tsup":           "^8.0.0",
+    "tsx":            "^4.0.0",
+    "typescript":     "^5.0.0"
+  },
+  "engines": { "node": ">=18" }
+}
+`
+    },
+    {
+      name: "src/store.ts",
+      content: `/**
+ * \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+ * \u2551  src/store.ts  \u2014  YOUR DATABASE INTEGRATION LIVES HERE          \u2551
+ * \u2551                                                                  \u2551
+ * \u2551  Implement the two functions below using whatever database,      \u2551
+ * \u2551  ORM, or API your organisation already uses.                     \u2551
+ * \u2551  server.ts calls them after verifying and decrypting each event  \u2551
+ * \u2551  \u2014 the protocol layer is handled for you, never touch it.        \u2551
+ * \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+ */
+
+export type Address = Record<string, unknown>;
+
+export type Customer = {
+  email: string;
+  name:  string;
+};
+
+export type VerifyResult = 'match' | 'mismatch' | 'not_found';
+
+/**
+ * Called when a consumer updates their address (address.updated event).
+ *
+ * The \`address\` object is already decrypted \u2014 fields vary by country but
+ * typically include: street, suburb, state, postcode, country.
+ *
+ * Persist this to your database (update the customer's address record,
+ * publish to a queue, call an internal API \u2014 whatever your system needs).
+ */
+export async function saveAddress(customer: Customer, address: Address): Promise<void> {
+  // \u2500\u2500\u2500 TODO: implement \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // Examples:
+  //
+  //   Prisma:
+  //     await prisma.customer.update({
+  //       where:  { email: customer.email },
+  //       data:   { address: JSON.stringify(address) },
+  //     });
+  //
+  //   Postgres.js:
+  //     await sql\`
+  //       UPDATE customers SET address = \${sql.json(address)}
+  //       WHERE email = \${customer.email}
+  //     \`;
+  //
+  //   HTTP / CRM:
+  //     await fetch('https://your-crm.internal/addresses', {
+  //       method: 'PUT',
+  //       body: JSON.stringify({ email: customer.email, address }),
+  //     });
+  //
+  // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+  console.log('[store] saveAddress \u2014 implement this function to persist the address');
+  console.log('[store] customer:', customer.email);
+  console.log('[store] address: ', JSON.stringify(address));
+}
+
+/**
+ * Called during an address verification check (address.verify event).
+ *
+ * The \`address\` object is already decrypted. Compare it against whatever
+ * you have on file for this customer and return the appropriate result.
+ *
+ * Return values:
+ *   'match'     \u2014 the address matches your records exactly
+ *   'mismatch'  \u2014 you have a record but the address differs
+ *   'not_found' \u2014 you have no record for this customer at all
+ */
+export async function verifyAddress(customer: Customer, address: Address): Promise<VerifyResult> {
+  // \u2500\u2500\u2500 TODO: implement \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  //
+  // Example:
+  //   const record = await prisma.customer.findUnique({ where: { email: customer.email } });
+  //   if (!record) return 'not_found';
+  //   const stored = JSON.parse(record.address ?? '{}') as Address;
+  //   const match  = Object.entries(address).every(([k, v]) => stored[k] === v);
+  //   return match ? 'match' : 'mismatch';
+  //
+  // \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+  console.log('[store] verifyAddress \u2014 returning stub "match". Implement this function.');
+  return 'match';
+}
+`
+    },
+    {
+      name: "src/server.ts",
+      content: `/**
+ * \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557
+ * \u2551  src/server.ts  \u2014  PROTOCOL LAYER (do not edit)                 \u2551
+ * \u2551                                                                  \u2551
+ * \u2551  Handles all OneAddress webhook mechanics: HMAC-SHA256           \u2551
+ * \u2551  verification, timestamp replay protection, ECDH address         \u2551
+ * \u2551  decryption, dispatch-ID deduplication, and callback posting.   \u2551
+ * \u2551                                                                  \u2551
+ * \u2551  To wire up your database: edit src/store.ts instead.           \u2551
+ * \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D
+ */
+import 'dotenv/config';
+import express, { Request, Response } from 'express';
+import { verifySignature, decryptAddress, isFreshTimestamp } from '@oneaddress/partner-sdk';
+import { saveAddress, verifyAddress } from './store.js';
+
+const WEBHOOK_SECRET      = process.env.WEBHOOK_SECRET          ?? '';
+const PARTNER_PRIVATE_KEY = process.env.PARTNER_PRIVATE_KEY_PEM ?? '';
+const PARTNER_ID          = process.env.PARTNER_ID              ?? '%%PARTNER_ID%%';
+const PORT                = Number(process.env.PORT ?? 3001);
+
+if (!WEBHOOK_SECRET || !PARTNER_PRIVATE_KEY || !PARTNER_ID) {
+  console.error('[startup] Missing required env vars. Check your .env file.');
+  process.exit(1);
+}
+
+// In-memory dedup cache \u2014 for production use a distributed store (Redis, etc.)
+const seenDispatches = new Set<string>();
+
+const app = express();
+app.use('/webhook', express.text({ type: 'application/json', limit: '1mb' }));
+
+app.post('/webhook', async (req: Request, res: Response) => {
+  const rawBody   = req.body    as string;
+  const signature = req.headers['x-oneaddress-signature'] as string ?? '';
+  const timestamp = req.headers['x-oneaddress-timestamp'] as string ?? '';
+  const dispatch  = req.headers['x-oneaddress-dispatch']  as string ?? '';
+
+  // 1. Timestamp freshness (\xB15-minute replay window)
+  if (!isFreshTimestamp(timestamp, 300)) {
+    return res.status(400).json({ error: 'Request timestamp out of tolerance' });
+  }
+
+  // 2. HMAC-SHA256 signature verification
+  if (!verifySignature(rawBody, signature, timestamp, WEBHOOK_SECRET)) {
+    return res.status(401).json({ error: 'Invalid signature' });
+  }
+
+  // 3. Parse body
+  let body: Record<string, unknown>;
+  try { body = JSON.parse(rawBody) as Record<string, unknown>; }
+  catch { return res.status(400).json({ error: 'Invalid JSON' }); }
+
+  // 4. Idempotency \u2014 ignore duplicate retries
+  if (dispatch && seenDispatches.has(dispatch)) {
+    return res.status(200).json({ ok: true, duplicate: true });
+  }
+  if (dispatch) seenDispatches.add(dispatch);
+
+  // 5. Decrypt address payload
+  const encPayload = body.address_encrypted as {
+    ephemeralPublicKey: string; iv: string; ciphertext: string; hkdfSalt?: string;
+  } | null;
+
+  if (!encPayload) {
+    return res.status(200).json({ ok: true, note: 'No encrypted payload' });
+  }
+
+  let address: Record<string, unknown>;
+  try {
+    address = await decryptAddress(encPayload, PARTNER_PRIVATE_KEY, PARTNER_ID);
+  } catch (err) {
+    console.error('[webhook] Decryption failed \u2014 check PARTNER_PRIVATE_KEY_PEM in .env:', err);
+    return res.status(200).json({ ok: true, note: 'Received \u2014 decryption pending key setup' });
+  }
+
+  const event    = body.event    as string;
+  const customer = body.customer as { email?: string; name?: string } | undefined;
+  const ctx      = { email: customer?.email ?? '', name: customer?.name ?? '' };
+
+  // \u2500\u2500 address.updated: consumer changed their address \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (event === 'address.updated') {
+    console.log(\`[webhook] address.updated for \${ctx.email}\`);
+    await saveAddress(ctx, address);
+    return res.status(200).json({ ok: true });
+  }
+
+  // \u2500\u2500 address.verify: consumer is running an address check \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  if (event === 'address.verify') {
+    const callbackUrl   = body.callback_url   as string;
+    const callbackToken = body.callback_token as string;
+    const batchId       = body.batch_id       as string;
+
+    console.log(\`[webhook] address.verify for \${ctx.email}\`);
+    const result = await verifyAddress(ctx, address);
+    console.log(\`[webhook] address.verify \u2192 \${result}\`);
+
+    await fetch(callbackUrl, {
+      method:  'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        batch_id:    batchId,
+        partner_id:  PARTNER_ID,
+        member_name: ctx.name,
+        result,
+        token:       callbackToken,
+      }),
+    });
+    return res.status(200).json({ ok: true });
+  }
+
+  // Unknown event \u2014 acknowledge (forward compatibility)
+  console.log(\`[webhook] Unknown event "\${event}" \u2014 acknowledged\`);
+  return res.status(200).json({ ok: true, skipped: true });
+});
+
+app.get('/health', (_req, res) => res.json({ status: 'ok' }));
+
+app.listen(PORT, () =>
+  console.log(\`[server] OneAddress webhook server \u2192 http://localhost:\${PORT}/webhook\`),
+);
+`
+    },
+    {
+      name: "scripts/test.ts",
+      content: `/**
+ * Conformance test runner.
+ *
+ * Usage:
+ *   npm test                                     \u2014 localhost:\${PORT}/webhook
+ *   npm test https://my-api.example.com/webhook  \u2014 live URL
+ */
+import 'dotenv/config';
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+
+const secret    = process.env.WEBHOOK_SECRET          ?? '';
+const partnerId = process.env.PARTNER_ID              ?? '%%PARTNER_ID%%';
+const keyPem    = (process.env.PARTNER_PRIVATE_KEY_PEM ?? '').replace(/\\\\n/g, '\\n');
+const port      = process.env.PORT ?? '3001';
+const targetUrl = process.argv[2] ?? \`http://localhost:\${port}/webhook\`;
+
+if (!secret || !partnerId || !keyPem) {
+  console.error('[test] Missing required env vars. Check your .env file.');
+  process.exit(1);
+}
+
+let publicKeyB64: string;
+try {
+  const priv = createPrivateKey({ key: keyPem, format: 'pem' });
+  const pub  = createPublicKey(priv);
+  publicKeyB64 = pub.export({ type: 'spki', format: 'der' }).toString('base64');
+} catch (err) {
+  console.error('[test] Failed to derive public key from PARTNER_PRIVATE_KEY_PEM:', err);
+  process.exit(1);
+}
+
+console.log(\`[test] Running conformance against \${targetUrl}\\n\`);
+
+const result = spawnSync(
+  'npx',
+  ['@oneaddress/conformance', 'test', targetUrl, '--secret', secret, '--partner-id', partnerId, '--public-key', publicKeyB64],
+  { stdio: 'inherit', shell: true },
+);
+
+process.exit(result.status ?? 1);
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler \u2014 TypeScript / Node.js
+
+Generated by \`npx @oneaddress/setup\` for partner **%%PARTNER_ID%%**.
+
+## Quick start
+
+\`\`\`bash
+npm install
+npm run dev          # hot-reload via tsx
+\`\`\`
+
+Webhook endpoint: \`POST http://localhost:3001/webhook\`
+Health check:     \`GET  http://localhost:3001/health\`
+
+## Architecture
+
+| File | Role |
+|------|------|
+| \`src/server.ts\` | **Protocol layer \u2014 do not edit.** HMAC verification, timestamp replay protection, ECDH decryption, deduplication. |
+| \`src/store.ts\`  | **Your integration \u2014 implement this.** Two functions called after every event. Wire up your database, ORM, or internal API here. |
+
+## Implementing src/store.ts
+
+After running the wizard, open \`src/store.ts\` and implement:
+
+\`\`\`typescript
+// Called on address.updated \u2014 persist the decrypted address
+async function saveAddress(customer, address): Promise<void>
+
+// Called on address.verify \u2014 return 'match' | 'mismatch' | 'not_found'
+async function verifyAddress(customer, address): Promise<VerifyResult>
+\`\`\`
+
+The file has commented examples for Prisma, Postgres.js, and plain HTTP calls.
+
+## Events
+
+| Event | What OneAddress sends | What you must do |
+|-------|-----------------------|------------------|
+| \`address.updated\` | Encrypted new address | Decrypt \u2192 \`saveAddress()\` \u2192 return 200 |
+| \`address.verify\`  | Encrypted address to check | Decrypt \u2192 \`verifyAddress()\` \u2192 POST result to \`callback_url\` |
+
+Valid verify results: \`"match"\` \xB7 \`"mismatch"\` \xB7 \`"not_found"\`
+
+## Conformance check
+
+\`\`\`bash
+npm test
+# or
+npx @oneaddress/conformance test %%WEBHOOK_URL%%
+\`\`\`
+
+## Configuration
+
+All credentials are in \`.env\` (written by the setup wizard \u2014 never commit it).
+Rotate keys and update your webhook URL at [partners.oneaddress.io](https://partners.oneaddress.io).
+`
+    }
+  ],
+  // ── Python (FastAPI) ───────────────────────────────────────────────────────
+  python: [
+    {
+      name: ".env",
+      content: `OA_PARTNER_ID=%%PARTNER_ID%%
+OA_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+OA_PRIVATE_KEY_PEM=%%PRIVATE_KEY%%
+`
+    },
+    {
+      name: "requirements.txt",
+      content: `fastapi>=0.110.0
+uvicorn[standard]>=0.27.0
+python-dotenv>=1.0.0
+cryptography>=42.0.0
+httpx>=0.27.0
+`
+    },
+    {
+      name: "app.py",
+      content: `"""
+OneAddress Webhook Handler \u2014 FastAPI
+Generated by npx @oneaddress/setup for %%PARTNER_ID%%
+
+All crypto inline \u2014 no OneAddress Python SDK required.
+Requires: cryptography>=42, httpx>=0.27, fastapi, uvicorn, python-dotenv
+
+Quick start:
+  pip install -r requirements.txt
+  uvicorn app:app --port 3001
+"""
+
+import base64
+import hashlib
+import hmac as hmac_lib
+import json
+import os
+import time
+from typing import Any
+
+import httpx
+from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.asymmetric.ec import (
+    ECDH,
+    EllipticCurvePublicNumbers,
+    SECP256R1,
+)
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.hashes import SHA256
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from dotenv import load_dotenv
+from fastapi import FastAPI, Request, Response
+
+load_dotenv()
+
+PARTNER_ID     = os.environ["OA_PARTNER_ID"]
+WEBHOOK_SECRET = os.environ["OA_WEBHOOK_SECRET"]
+PRIVATE_KEY    = os.environ["OA_PRIVATE_KEY_PEM"].replace("\\\\n", "\\n")
+
+app = FastAPI()
+seen_dispatches: set[str] = set()
+
+# \u2500\u2500 Crypto helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+def _b64decode(s: str) -> bytes:
+    s = s.replace("-", "+").replace("_", "/")
+    return base64.b64decode(s + "=" * (-len(s) % 4))
+
+def _verify_hmac(raw_body: str, signature: str, timestamp: str, secret: str) -> bool:
+    expected = hmac_lib.new(
+        secret.encode(), f"{timestamp}.{raw_body}".encode(), hashlib.sha256
+    ).hexdigest()
+    try:
+        return hmac_lib.compare_digest(expected, signature.lower())
+    except Exception:
+        return False
+
+def _is_fresh(timestamp: str, tolerance: int = 300) -> bool:
+    try:
+        return abs(int(time.time()) - int(timestamp)) <= tolerance
+    except ValueError:
+        return False
+
+def _decrypt_address(enc: dict[str, Any], private_key_pem: str, partner_id: str) -> dict[str, Any]:
+    priv_key = load_pem_private_key(private_key_pem.encode(), password=None)
+
+    eph_raw = _b64decode(enc["ephemeralPublicKey"])
+    assert len(eph_raw) == 65 and eph_raw[0] == 0x04, "Expected uncompressed P-256 point"
+    x = int.from_bytes(eph_raw[1:33], "big")
+    y = int.from_bytes(eph_raw[33:65], "big")
+    eph_pub = EllipticCurvePublicNumbers(x, y, SECP256R1()).public_key(default_backend())
+
+    shared = priv_key.exchange(ECDH(), eph_pub)  # type: ignore[arg-type]
+
+    hkdf_salt_b64 = enc.get("hkdfSalt")
+    salt = _b64decode(hkdf_salt_b64) if hkdf_salt_b64 else b"\\x00" * 32
+    aes_key = HKDF(
+        algorithm=SHA256(),
+        length=32,
+        salt=salt,
+        info=f"oneaddress:{partner_id}".encode(),
+        backend=default_backend(),
+    ).derive(shared)
+
+    iv              = _b64decode(enc["iv"])
+    ciphertext_full = _b64decode(enc["ciphertext"])  # ciphertext || 16-byte auth tag
+    plaintext = AESGCM(aes_key).decrypt(iv, ciphertext_full, None)
+    return json.loads(plaintext)  # type: ignore[return-value]
+
+# \u2500\u2500 Webhook handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+@app.post("/webhook")
+async def webhook(request: Request) -> Response:
+    raw_body  = (await request.body()).decode()
+    headers   = {k.lower(): v for k, v in request.headers.items()}
+    timestamp = headers.get("x-oneaddress-timestamp", "")
+    signature = headers.get("x-oneaddress-signature", "")
+    dispatch  = headers.get("x-oneaddress-dispatch", "")
+
+    if not _is_fresh(timestamp):
+        return Response(status_code=400, content='{"error":"Stale timestamp"}',
+                        media_type="application/json")
+    if not _verify_hmac(raw_body, signature, timestamp, WEBHOOK_SECRET):
+        return Response(status_code=401, content='{"error":"Invalid signature"}',
+                        media_type="application/json")
+
+    body  = json.loads(raw_body)
+    event = body.get("event", "")
+
+    if dispatch and dispatch in seen_dispatches:
+        return Response(content='{"ok":true,"duplicate":true}', media_type="application/json")
+    if dispatch:
+        seen_dispatches.add(dispatch)
+
+    enc = body.get("address_encrypted")
+    if not enc:
+        return Response(content='{"ok":true,"note":"no encrypted payload"}',
+                        media_type="application/json")
+
+    try:
+        address = _decrypt_address(enc, PRIVATE_KEY, PARTNER_ID)
+    except Exception as e:
+        print(f"[webhook] Decryption error (check OA_PRIVATE_KEY_PEM): {e}")
+        return Response(content='{"ok":true,"note":"received - decryption pending key setup"}',
+                        media_type="application/json")
+
+    if event == "address.updated":
+        customer = body.get("customer", {})
+        print(f"[webhook] Address for {customer.get('email', '?')}: "
+              f"{address.get('street')}, {address.get('suburb')} "
+              f"{address.get('state')} {address.get('postcode')}")
+        # TODO: persist address to your database
+
+    elif event == "address.verify":
+        customer      = body.get("customer", {})
+        callback_url  = body["callback_url"]
+        callback_token= body["callback_token"]
+        batch_id      = body["batch_id"]
+
+        # TODO: Replace "match" with a real DB lookup.
+        # Query your records for this customer and compare addresses.
+        # Valid results: "match" | "mismatch" | "not_found"
+        result = "match"
+
+        payload = {
+            "batch_id":    batch_id,
+            "partner_id":  PARTNER_ID,
+            "member_name": customer.get("name", ""),
+            "result":      result,
+            "token":       callback_token,
+        }
+        try:
+            async with httpx.AsyncClient(timeout=10) as client:
+                await client.post(callback_url, json=payload)
+        except Exception as e:
+            print(f"[webhook] Callback POST failed: {e}")
+
+    else:
+        print(f"[webhook] Unknown event '{event}' \u2014 acknowledged")
+
+    return Response(content='{"ok":true}', media_type="application/json")
+
+@app.get("/health")
+def health() -> dict[str, str]:
+    return {"status": "ok"}
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler (Python / FastAPI)
+
+Generated by \`npx @oneaddress/setup\` for **%%PARTNER_ID%%**.
+
+## Quick start
+
+\`\`\`bash
+pip install -r requirements.txt
+uvicorn app:app --port 3001
+\`\`\`
+
+Your webhook endpoint: \`POST http://localhost:3001/webhook\`
+
+## Events handled
+
+### address.updated
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+
+### address.verify
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to your records \u2192 POST callback_url.
+
+The stub in \`app.py\` always returns \`"match"\`. Replace it with a real DB lookup:
+
+\`\`\`python
+# In the address.verify branch of app.py, replace:
+result = "match"
+
+# With something like:
+record = db.get_customer(customer.get("email"))
+result = "not_found" if not record else (
+    "match" if addresses_match(record.address, address) else "mismatch"
+)
+\`\`\`
+
+Valid results: \`"match"\` | \`"mismatch"\` | \`"not_found"\`
+
+## Run conformance check
+
+\`\`\`bash
+npx @oneaddress/conformance test %%WEBHOOK_URL%%
+\`\`\`
+
+## Configuration
+
+Credentials are in \`.env\` (written by the setup wizard). Never commit \`.env\` to source control.
+`
+    }
+  ],
+  // ── Java (Spring Boot) ─────────────────────────────────────────────────────
+  "java-spring": [
+    {
+      name: "pom.xml",
+      content: `<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
+                             https://maven.apache.org/xsd/maven-4.0.0.xsd">
+  <modelVersion>4.0.0</modelVersion>
+
+  <parent>
+    <groupId>org.springframework.boot</groupId>
+    <artifactId>spring-boot-starter-parent</artifactId>
+    <version>3.2.4</version>
+    <relativePath/>
+  </parent>
+
+  <groupId>com.example</groupId>
+  <artifactId>oneaddress-webhook</artifactId>
+  <version>0.0.1-SNAPSHOT</version>
+  <packaging>jar</packaging>
+
+  <name>OneAddress Webhook Handler</name>
+  <description>Spring Boot webhook receiver for OneAddress partner integrations</description>
+
+  <properties>
+    <java.version>17</java.version>
+  </properties>
+
+  <dependencies>
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-web</artifactId>
+    </dependency>
+
+    <dependency>
+      <groupId>org.springframework.boot</groupId>
+      <artifactId>spring-boot-starter-test</artifactId>
+      <scope>test</scope>
+    </dependency>
+  </dependencies>
+
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-maven-plugin</artifactId>
+      </plugin>
+    </plugins>
+  </build>
+</project>
+`
+    },
+    {
+      name: "src/main/java/com/example/oneaddress/Application.java",
+      content: `package com.example.oneaddress;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class Application {
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+}
+`
+    },
+    {
+      name: "src/main/java/com/example/oneaddress/OneAddressVerifier.java",
+      content: `package com.example.oneaddress;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+
+/**
+ * Inline HMAC-SHA256 signature verification for OneAddress webhooks.
+ * No external SDK dependency \u2014 uses JDK 17 standard library only.
+ */
+public final class OneAddressVerifier {
+
+    private OneAddressVerifier() {}
+
+    public static boolean verify(String rawBody, String signature, String timestamp, String secret) {
+        try {
+            String payload = timestamp + "." + rawBody;
+            Mac mac = Mac.getInstance("HmacSHA256");
+            mac.init(new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
+            byte[] expected = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
+            byte[] received = hexToBytes(signature);
+            return MessageDigest.isEqual(expected, received);
+        } catch (Exception e) {
+            return false;
+        }
+    }
+
+    public static boolean isFresh(String timestamp, int toleranceSecs) {
+        try {
+            long ts = Long.parseLong(timestamp);
+            long now = System.currentTimeMillis() / 1000L;
+            return Math.abs(now - ts) <= toleranceSecs;
+        } catch (NumberFormatException e) {
+            return false;
+        }
+    }
+
+    private static byte[] hexToBytes(String hex) {
+        int len = hex.length();
+        byte[] out = new byte[len / 2];
+        for (int i = 0; i < len; i += 2) {
+            out[i / 2] = (byte) ((Character.digit(hex.charAt(i), 16) << 4)
+                               + Character.digit(hex.charAt(i + 1), 16));
+        }
+        return out;
+    }
+}
+`
+    },
+    {
+      name: "src/main/java/com/example/oneaddress/OneAddressDecryptor.java",
+      content: `package com.example.oneaddress;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import javax.crypto.Cipher;
+import javax.crypto.KeyAgreement;
+import javax.crypto.Mac;
+import javax.crypto.spec.GCMParameterSpec;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.KeyFactory;
+import java.security.spec.PKCS8EncodedKeySpec;
+import java.security.spec.X509EncodedKeySpec;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Map;
+
+/**
+ * Inline ECDH decryption for OneAddress encrypted address payloads.
+ * No external SDK dependency \u2014 uses JDK 17 standard library only.
+ */
+public final class OneAddressDecryptor {
+
+    // P-256 SPKI DER prefix (26 bytes) \u2014 prepend to the 65-byte uncompressed point
+    private static final byte[] SPKI_PREFIX = {
+        (byte)0x30, (byte)0x59, (byte)0x30, (byte)0x13, (byte)0x06, (byte)0x07,
+        (byte)0x2A, (byte)0x86, (byte)0x48, (byte)0xCE, (byte)0x3D, (byte)0x02,
+        (byte)0x01, (byte)0x06, (byte)0x08, (byte)0x2A, (byte)0x86, (byte)0x48,
+        (byte)0xCE, (byte)0x3D, (byte)0x03, (byte)0x01, (byte)0x07, (byte)0x03,
+        (byte)0x42, (byte)0x00
+    };
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private OneAddressDecryptor() {}
+
+    @SuppressWarnings("unchecked")
+    public static Map<String, Object> decrypt(
+            Map<String, Object> addressEncrypted,
+            String privateKeyPem,
+            String partnerId) throws Exception {
+
+        // 1. Load private key
+        String stripped = privateKeyPem
+            .replaceAll("-----BEGIN [^-]+-----", "")
+            .replaceAll("-----END [^-]+-----", "")
+            .replaceAll("\\\\s+", "");
+        byte[] der = Base64.getDecoder().decode(stripped);
+        var privateKey = KeyFactory.getInstance("EC")
+            .generatePrivate(new PKCS8EncodedKeySpec(der));
+
+        // 2. Load ephemeral public key (65-byte uncompressed P-256 point)
+        String ephB64 = (String) addressEncrypted.get("ephemeralPublicKey");
+        byte[] ephRaw = decodeBase64AnyVariant(ephB64);
+        byte[] spkiBytes = concat(SPKI_PREFIX, ephRaw);
+        var ephemeralKey = KeyFactory.getInstance("EC")
+            .generatePublic(new X509EncodedKeySpec(spkiBytes));
+
+        // 3. ECDH shared secret
+        KeyAgreement ka = KeyAgreement.getInstance("ECDH");
+        ka.init(privateKey);
+        ka.doPhase(ephemeralKey, true);
+        byte[] sharedSecret = ka.generateSecret();
+        if (sharedSecret.length > 32) sharedSecret = Arrays.copyOf(sharedSecret, 32);
+
+        // 4. HKDF-SHA256 (inline)
+        String hkdfSaltB64 = (String) addressEncrypted.get("hkdfSalt");
+        byte[] salt = (hkdfSaltB64 != null && !hkdfSaltB64.isEmpty())
+            ? Base64.getDecoder().decode(hkdfSaltB64)
+            : new byte[32]; // 32 zero bytes when absent (WebCrypto default)
+
+        byte[] info = ("oneaddress:" + partnerId).getBytes(StandardCharsets.UTF_8);
+
+        Mac mac = Mac.getInstance("HmacSHA256");
+        // Extract: PRK = HMAC-SHA256(salt, sharedSecret)
+        mac.init(new SecretKeySpec(salt, "HmacSHA256"));
+        byte[] prk = mac.doFinal(sharedSecret);
+        // Expand T(1): aesKey = HMAC-SHA256(PRK, info || 0x01)
+        mac.init(new SecretKeySpec(prk, "HmacSHA256"));
+        byte[] aesKey = mac.doFinal(concat(info, new byte[]{1}));
+
+        // 5. AES-256-GCM decrypt (ciphertext || 16-byte tag)
+        byte[] iv = decodeBase64AnyVariant((String) addressEncrypted.get("iv"));
+        byte[] ciphertextWithTag = decodeBase64AnyVariant((String) addressEncrypted.get("ciphertext"));
+
+        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
+        cipher.init(Cipher.DECRYPT_MODE,
+            new SecretKeySpec(aesKey, "AES"),
+            new GCMParameterSpec(128, iv));
+        byte[] plaintext = cipher.doFinal(ciphertextWithTag);
+
+        // 6. Parse JSON
+        return MAPPER.readValue(plaintext, Map.class);
+    }
+
+    private static byte[] decodeBase64AnyVariant(String s) {
+        try {
+            return Base64.getDecoder().decode(s);
+        } catch (IllegalArgumentException e) {
+            return Base64.getUrlDecoder().decode(s);
+        }
+    }
+
+    private static byte[] concat(byte[] a, byte[] b) {
+        byte[] result = new byte[a.length + b.length];
+        System.arraycopy(a, 0, result, 0, a.length);
+        System.arraycopy(b, 0, result, a.length, b.length);
+        return result;
+    }
+}
+`
+    },
+    {
+      name: "src/main/java/com/example/oneaddress/OneAddressWebhookController.java",
+      content: `package com.example.oneaddress;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.PostConstruct;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.util.Map;
+
+/**
+ * Webhook receiver for OneAddress address.updated and address.verify events.
+ * Endpoint: POST /webhooks/oneaddress
+ *
+ * Set environment variables:
+ *   ONEADDRESS_WEBHOOK_SECRET  \u2014 webhook secret from the Partner Portal
+ *   ONEADDRESS_PRIVATE_KEY     \u2014 PKCS8 PEM private key (use \\n for newlines)
+ *   ONEADDRESS_PARTNER_ID      \u2014 your partner UUID
+ */
+@RestController
+@RequestMapping("/webhooks")
+public class OneAddressWebhookController {
+
+    private static final Logger log = LoggerFactory.getLogger(OneAddressWebhookController.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    private String webhookSecret;
+    private String privateKeyPem;
+    private String partnerId;
+
+    @PostConstruct
+    void init() {
+        webhookSecret = System.getenv("ONEADDRESS_WEBHOOK_SECRET");
+        if (webhookSecret == null || webhookSecret.isBlank())
+            throw new IllegalStateException("ONEADDRESS_WEBHOOK_SECRET is required");
+
+        String rawKey = System.getenv("ONEADDRESS_PRIVATE_KEY");
+        if (rawKey == null || rawKey.isBlank())
+            throw new IllegalStateException("ONEADDRESS_PRIVATE_KEY is required");
+        privateKeyPem = rawKey.replace("\\\\n", "\\n");
+
+        partnerId = System.getenv("ONEADDRESS_PARTNER_ID");
+        if (partnerId == null || partnerId.isBlank())
+            throw new IllegalStateException("ONEADDRESS_PARTNER_ID is required");
+    }
+
+    @PostMapping("/oneaddress")
+    public ResponseEntity<String> receive(
+            @RequestBody String rawBody,
+            @RequestHeader Map<String, String> headers) {
+
+        try {
+            String timestamp = getHeader(headers, "x-oneaddress-timestamp");
+            String signature = getHeader(headers, "x-oneaddress-signature");
+
+            if (timestamp == null || signature == null)
+                return ResponseEntity.badRequest().body("{\\"error\\":\\"missing required headers\\"}");
+
+            if (!OneAddressVerifier.isFresh(timestamp, 300))
+                return ResponseEntity.badRequest().body("{\\"error\\":\\"stale timestamp\\"}");
+
+            if (!OneAddressVerifier.verify(rawBody, signature, timestamp, webhookSecret))
+                return ResponseEntity.status(401).body("{\\"error\\":\\"invalid signature\\"}");
+
+            @SuppressWarnings("unchecked")
+            Map<String, Object> body = MAPPER.readValue(rawBody, Map.class);
+            String event = (String) body.get("event");
+
+            @SuppressWarnings("unchecked")
+            Map<String, Object> enc = (Map<String, Object>) body.get("address_encrypted");
+            if (enc == null)
+                return ResponseEntity.ok("{\\"ok\\":true,\\"note\\":\\"no encrypted payload\\"}");
+
+            Map<String, Object> address = OneAddressDecryptor.decrypt(enc, privateKeyPem, partnerId);
+            String dispatchId = getHeader(headers, "x-oneaddress-dispatch");
+
+            if ("address.updated".equals(event)) {
+                handleAddressUpdate(address, dispatchId);
+            } else if ("address.verify".equals(event)) {
+                handleAddressVerify(body, address);
+            } else {
+                log.info("[OneAddress] skipping unknown event: {}", event);
+                return ResponseEntity.ok("{\\"ok\\":true,\\"skipped\\":true}");
+            }
+
+            return ResponseEntity.ok("{\\"ok\\":true}");
+
+        } catch (Exception e) {
+            log.error("[OneAddress] webhook processing error", e);
+            return ResponseEntity.status(500).body("{\\"error\\":\\"internal error\\"}");
+        }
+    }
+
+    private void handleAddressUpdate(Map<String, Object> address, String dispatchId) {
+        log.info("[OneAddress] address.updated  dispatchId={}", dispatchId);
+        log.info("[OneAddress]   street={} suburb={} state={} postcode={}",
+            address.get("street"), address.get("suburb"),
+            address.get("state"), address.get("postcode"));
+
+        // TODO: persist the new address to your database
+        // Deduplicate on dispatchId for at-least-once delivery:
+        //   if (dispatchRepo.existsByDispatchId(dispatchId)) return;
+        //   customerRepo.updateAddress(address);
+        //   dispatchRepo.markSeen(dispatchId);
+    }
+
+    @SuppressWarnings("unchecked")
+    private void handleAddressVerify(Map<String, Object> body, Map<String, Object> address) {
+        Map<String, Object> customer = (Map<String, Object>) body.getOrDefault("customer", Map.of());
+        String callbackUrl   = (String) body.get("callback_url");
+        String callbackToken = (String) body.get("callback_token");
+        String batchId       = (String) body.get("batch_id");
+        String memberName    = (String) customer.getOrDefault("name", "");
+
+        // TODO: Replace "match" with a real DB lookup.
+        // Valid results: "match" | "mismatch" | "not_found"
+        String result = "match";
+
+        try {
+            Map<String, Object> payload = Map.of(
+                "batch_id",    batchId       != null ? batchId       : "",
+                "partner_id",  partnerId,
+                "member_name", memberName,
+                "result",      result,
+                "token",       callbackToken != null ? callbackToken : ""
+            );
+            String payloadJson = MAPPER.writeValueAsString(payload);
+            HttpClient.newHttpClient().send(
+                HttpRequest.newBuilder()
+                    .uri(URI.create(callbackUrl))
+                    .header("Content-Type", "application/json")
+                    .POST(HttpRequest.BodyPublishers.ofString(payloadJson))
+                    .build(),
+                HttpResponse.BodyHandlers.discarding()
+            );
+        } catch (Exception e) {
+            log.error("[OneAddress] address.verify callback POST failed", e);
+        }
+    }
+
+    private static String getHeader(Map<String, String> headers, String name) {
+        for (Map.Entry<String, String> entry : headers.entrySet())
+            if (entry.getKey().equalsIgnoreCase(name)) return entry.getValue();
+        return null;
+    }
+}
+`
+    },
+    {
+      name: "src/main/java/com/example/oneaddress/HealthController.java",
+      content: `package com.example.oneaddress;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+@RestController
+public class HealthController {
+    @GetMapping("/health")
+    public ResponseEntity<Map<String, String>> health() {
+        return ResponseEntity.ok(Map.of("status", "ok"));
+    }
+}
+`
+    },
+    {
+      name: "src/main/resources/application.properties",
+      content: `server.port=3001
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler (Java / Spring Boot)
+
+Generated by \`npx @oneaddress/setup\` for **%%PARTNER_ID%%**.
+Inline crypto only \u2014 no external SDK dependency. Requires Java 17+.
+
+## Quick start
+
+\`\`\`bash
+export ONEADDRESS_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+export ONEADDRESS_PRIVATE_KEY="%%PRIVATE_KEY%%"
+export ONEADDRESS_PARTNER_ID=%%PARTNER_ID%%
+
+./mvnw spring-boot:run
+\`\`\`
+
+Endpoints:
+- \`POST http://localhost:3001/webhooks/oneaddress\` \u2014 webhook receiver
+- \`GET  http://localhost:3001/health\` \u2014 health check
+
+## Events handled
+
+### address.updated
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+
+### address.verify
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to records \u2192 POST callback_url.
+
+Find the \`TODO: Replace "match"\` comment in \`OneAddressWebhookController.java\`
+and add your DB lookup there.
+
+| Env var | Description |
+|---------|-------------|
+| \`ONEADDRESS_WEBHOOK_SECRET\` | Webhook secret from the Partner Portal |
+| \`ONEADDRESS_PRIVATE_KEY\` | PKCS#8 PEM private key (use \`\\n\` between lines) |
+| \`ONEADDRESS_PARTNER_ID\` | Your partner UUID |
+
+## Run conformance check
+
+\`\`\`bash
+npx @oneaddress/conformance test http://localhost:3001/webhooks/oneaddress
+\`\`\`
+`
+    }
+  ],
+  // ── C# (ASP.NET Core) ──────────────────────────────────────────────────────
+  "csharp-aspnet": [
+    {
+      name: "OneAddressWebhook.csproj",
+      content: `<Project Sdk="Microsoft.NET.Sdk.Web">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+</Project>
+`
+    },
+    {
+      name: "appsettings.json",
+      content: `{
+  "Logging": { "LogLevel": { "Default": "Information" } },
+  "AllowedHosts": "*"
+}
+`
+    },
+    {
+      name: "Program.cs",
+      content: `// OneAddress webhook handler \u2014 ASP.NET Core minimal API
+// Inline crypto only \u2014 no external SDK dependency. Requires .NET 8+.
+
+using System.Net.Http;
+using System.Security.Cryptography;
+using System.Text;
+using System.Text.Json;
+
+// \u2500\u2500 Read config from env \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+var webhookSecret = Environment.GetEnvironmentVariable("ONEADDRESS_WEBHOOK_SECRET")
+    ?? throw new InvalidOperationException("ONEADDRESS_WEBHOOK_SECRET is required");
+var privateKeyPem = (Environment.GetEnvironmentVariable("ONEADDRESS_PRIVATE_KEY") ?? "")
+    .Replace("\\\\n", "\\n");
+var partnerId = Environment.GetEnvironmentVariable("ONEADDRESS_PARTNER_ID") ?? "";
+
+var builder = WebApplication.CreateBuilder(args);
+var app = builder.Build();
+
+// \u2500\u2500 Webhook endpoint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+app.MapPost("/webhooks/oneaddress", async (HttpRequest request) =>
+{
+    using var reader = new StreamReader(request.Body);
+    string rawBody = await reader.ReadToEndAsync();
+
+    var headers = request.Headers.ToDictionary(h => h.Key, h => h.Value.ToString(),
+        StringComparer.OrdinalIgnoreCase);
+
+    if (!headers.TryGetValue("x-oneaddress-timestamp", out var timestamp) ||
+        !headers.TryGetValue("x-oneaddress-signature", out var signature))
+        return Results.Json(new { error = "missing required headers" }, statusCode: 400);
+
+    if (!IsFresh(timestamp))
+        return Results.Json(new { error = "stale timestamp" }, statusCode: 400);
+
+    if (!VerifySignature(rawBody, signature, timestamp, webhookSecret))
+        return Results.Json(new { error = "invalid signature" }, statusCode: 401);
+
+    JsonElement body;
+    try { body = JsonSerializer.Deserialize<JsonElement>(rawBody); }
+    catch { return Results.Json(new { error = "invalid json" }, statusCode: 400); }
+
+    var eventType = body.TryGetProperty("event", out var evtEl) ? evtEl.GetString() : null;
+
+    if (eventType != "address.updated" && eventType != "address.verify")
+    {
+        app.Logger.LogInformation("[OneAddress] skipping unknown event: {EventType}", eventType);
+        return Results.Json(new { ok = true, skipped = true });
+    }
+
+    if (!body.TryGetProperty("address_encrypted", out var encEl))
+        return Results.Json(new { ok = true, note = "no encrypted payload" }, statusCode: 200);
+
+    byte[] plaintext;
+    try { plaintext = DecryptAddress(encEl, privateKeyPem, partnerId); }
+    catch (Exception ex)
+    {
+        app.Logger.LogError(ex, "[OneAddress] decryption failed \u2014 check ONEADDRESS_PRIVATE_KEY");
+        return Results.Json(new { ok = true, note = "received - decryption pending key setup" }, statusCode: 200);
+    }
+
+    var address    = JsonSerializer.Deserialize<JsonElement>(plaintext);
+    var dispatchId = headers.TryGetValue("x-oneaddress-dispatch", out var dVal) ? dVal : null;
+
+    if (eventType == "address.updated")
+    {
+        HandleAddressUpdate(address, dispatchId);
+    }
+    else // address.verify
+    {
+        await HandleAddressVerify(body, partnerId, app.Logger);
+    }
+
+    return Results.Json(new { ok = true });
+});
+
+app.MapGet("/health", () => Results.Ok(new { status = "ok" }));
+
+app.Run("http://localhost:3001");
+
+// \u2500\u2500 Crypto helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+static bool VerifySignature(string rawBody, string signature, string timestamp, string secret)
+{
+    try
+    {
+        var payload  = Encoding.UTF8.GetBytes($"{timestamp}.{rawBody}");
+        var keyBytes = Encoding.UTF8.GetBytes(secret);
+        var expected = Convert.ToHexString(HMACSHA256.HashData(keyBytes, payload)).ToLowerInvariant();
+        var sigBytes = Convert.FromHexString(signature);
+        var expBytes = Convert.FromHexString(expected);
+        return sigBytes.Length == expBytes.Length
+            && CryptographicOperations.FixedTimeEquals(sigBytes, expBytes);
+    }
+    catch { return false; }
+}
+
+static bool IsFresh(string timestamp, int toleranceSecs = 300)
+{
+    if (!long.TryParse(timestamp, out var ts)) return false;
+    return Math.Abs(DateTimeOffset.UtcNow.ToUnixTimeSeconds() - ts) <= toleranceSecs;
+}
+
+static byte[] DecryptAddress(JsonElement addressEncrypted, string privateKeyPem, string partnerId)
+{
+    ReadOnlySpan<byte> spkiPrefix = new byte[]
+    {
+        0x30, 0x59, 0x30, 0x13, 0x06, 0x07, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
+        0x06, 0x08, 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, 0x03, 0x42, 0x00
+    };
+
+    var pemLines = privateKeyPem
+        .Split('\\n')
+        .Where(l => !l.StartsWith("-----"))
+        .Select(l => l.Trim());
+    var derBytes = Convert.FromBase64String(string.Concat(pemLines));
+
+    using var ecdh = ECDiffieHellman.Create();
+    ecdh.ImportPkcs8PrivateKey(derBytes, out _);
+
+    var ephB64 = addressEncrypted.GetProperty("ephemeralPublicKey").GetString()!;
+    var ephRaw = Convert.FromBase64String(NormBase64(ephB64));
+
+    var spkiBytes = new byte[spkiPrefix.Length + ephRaw.Length];
+    spkiPrefix.CopyTo(spkiBytes);
+    ephRaw.CopyTo(spkiBytes, spkiPrefix.Length);
+
+    using var tempEcdh = ECDiffieHellman.Create();
+    tempEcdh.ImportSubjectPublicKeyInfo(spkiBytes, out _);
+    var ephemeralPub = tempEcdh.PublicKey;
+
+    var sharedSecret = ecdh.DeriveRawSecretAgreement(ephemeralPub);
+
+    string? hkdfSaltB64 = addressEncrypted.TryGetProperty("hkdfSalt", out var saltEl)
+        ? saltEl.GetString() : null;
+    var salt = !string.IsNullOrEmpty(hkdfSaltB64)
+        ? Convert.FromBase64String(NormBase64(hkdfSaltB64))
+        : new byte[32];
+
+    var info   = Encoding.UTF8.GetBytes($"oneaddress:{partnerId}");
+    var aesKey = HKDF.DeriveKey(HashAlgorithmName.SHA256, sharedSecret, 32, salt, info);
+
+    var iv = Convert.FromBase64String(NormBase64(
+        addressEncrypted.GetProperty("iv").GetString()!));
+    var ciphertextWithTag = Convert.FromBase64String(NormBase64(
+        addressEncrypted.GetProperty("ciphertext").GetString()!));
+
+    var tag        = ciphertextWithTag[^16..];
+    var ciphertext = ciphertextWithTag[..^16];
+    var plaintext  = new byte[ciphertext.Length];
+
+    using var aesGcm = new AesGcm(aesKey, 16);
+    aesGcm.Decrypt(iv, ciphertext, tag, plaintext);
+
+    return plaintext;
+}
+
+static string NormBase64(string s)
+{
+    s = s.Replace('-', '+').Replace('_', '/');
+    return (s.Length % 4) switch { 2 => s + "==", 3 => s + "=", _ => s };
+}
+
+void HandleAddressUpdate(JsonElement address, string? dispatchId)
+{
+    app.Logger.LogInformation("[OneAddress] address.updated  dispatchId={DispatchId}", dispatchId);
+
+    // TODO: persist the new address to your database
+    // Deduplicate on dispatchId for at-least-once delivery:
+    //   if (db.Dispatches.Any(d => d.DispatchId == dispatchId)) return;
+    //   db.Customers.UpdateAddress(address);
+    //   db.Dispatches.Add(new SeenDispatch { DispatchId = dispatchId });
+    //   db.SaveChanges();
+}
+
+async Task HandleAddressVerify(JsonElement body, string pid, ILogger logger)
+{
+    var callbackUrl   = body.TryGetProperty("callback_url",   out var cuEl) ? cuEl.GetString()  : null;
+    var callbackToken = body.TryGetProperty("callback_token", out var ctEl) ? ctEl.GetString()  : null;
+    var batchId       = body.TryGetProperty("batch_id",       out var biEl) ? biEl.GetString()  : null;
+    var memberName    = body.TryGetProperty("customer",       out var custEl)
+        && custEl.TryGetProperty("name", out var nameEl) ? nameEl.GetString() ?? "" : "";
+
+    // TODO: Replace "match" with a real DB lookup.
+    // Valid results: "match" | "mismatch" | "not_found"
+    var result = "match";
+
+    if (string.IsNullOrEmpty(callbackUrl)) return;
+    try
+    {
+        var payload = JsonSerializer.Serialize(new {
+            batch_id    = batchId    ?? "",
+            partner_id  = pid,
+            member_name = memberName,
+            result,
+            token       = callbackToken ?? "",
+        });
+        using var http    = new HttpClient();
+        using var content = new StringContent(payload, Encoding.UTF8, "application/json");
+        await http.PostAsync(callbackUrl, content);
+    }
+    catch (Exception ex)
+    {
+        logger.LogError(ex, "[OneAddress] address.verify callback POST failed");
+    }
+}
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler (C# / ASP.NET Core)
+
+Generated by \`npx @oneaddress/setup\` for **%%PARTNER_ID%%**.
+Inline crypto only \u2014 no external SDK dependency. Requires .NET 8+.
+
+## Quick start
+
+\`\`\`bash
+export ONEADDRESS_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+export ONEADDRESS_PRIVATE_KEY="%%PRIVATE_KEY%%"
+export ONEADDRESS_PARTNER_ID=%%PARTNER_ID%%
+
+dotnet run
+\`\`\`
+
+Endpoints:
+- \`POST http://localhost:3001/webhooks/oneaddress\` \u2014 webhook receiver
+- \`GET  http://localhost:3001/health\` \u2014 health check
+
+## Events handled
+
+### address.updated
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+
+### address.verify
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to records \u2192 POST callback_url.
+
+Find \`TODO: Replace "match"\` in \`Program.cs\` \u2192 \`HandleAddressVerify\` and add your DB lookup.
+
+| Env var | Description |
+|---------|-------------|
+| \`ONEADDRESS_WEBHOOK_SECRET\` | Webhook secret from the Partner Portal |
+| \`ONEADDRESS_PRIVATE_KEY\` | PKCS#8 PEM key \u2014 use \`\\n\` between PEM lines |
+| \`ONEADDRESS_PARTNER_ID\` | Your partner UUID |
+
+## Run conformance check
+
+\`\`\`bash
+npx @oneaddress/conformance test http://localhost:3001/webhooks/oneaddress
+\`\`\`
+`
+    }
+  ],
+  // ── Go (net/http) ─────────────────────────────────────────────────────────
+  "go-http": [
+    {
+      name: ".env",
+      content: `PARTNER_ID=%%PARTNER_ID%%
+WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+PARTNER_PRIVATE_KEY_PEM=%%PRIVATE_KEY%%
+PORT=3001
+`
+    },
+    {
+      name: ".env.example",
+      content: `# OneAddress webhook credentials \u2014 copy to .env and fill in values.
+# Never commit .env to source control.
+
+# Your partner UUID from the OneAddress Partner Portal
+PARTNER_ID=your-partner-uuid-here
+
+# HMAC-SHA256 webhook signing secret from the Partner Portal
+WEBHOOK_SECRET=your-webhook-secret-here
+
+# PKCS#8 PEM private key for decrypting address payloads.
+# Use literal \\n between PEM lines in a single-line env var.
+# Example: -----BEGIN PRIVATE KEY-----\\nMIGH...\\n-----END PRIVATE KEY-----
+PARTNER_PRIVATE_KEY_PEM=
+
+# HTTP port (default 3001)
+PORT=3001
+`
+    },
+    {
+      name: "go.mod",
+      content: `module oneaddress-webhook
+
+go 1.21
+`
+    },
+    {
+      name: "main.go",
+      content: `// OneAddress Webhook Handler \u2014 Go (net/http)
+// Generated by npx @oneaddress/setup for %%PARTNER_ID%%
+//
+// All crypto is inline \u2014 no external SDK required. Requires Go 1.21+.
+
+package main
+
+import (
+	"bytes"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/ecdh"
+	"crypto/ecdsa"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+// \u2500\u2500 Config \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+func main() {
+	webhookSecret := os.Getenv("WEBHOOK_SECRET")
+	privateKeyPEM := strings.ReplaceAll(os.Getenv("PARTNER_PRIVATE_KEY_PEM"), \`\\n\`, "\\n")
+	partnerID     := os.Getenv("PARTNER_ID")
+	port          := os.Getenv("PORT")
+	if port == "" {
+		port = "3001"
+	}
+
+	if webhookSecret == "" || privateKeyPEM == "" || partnerID == "" {
+		log.Fatal("[startup] Missing required env vars: WEBHOOK_SECRET, PARTNER_PRIVATE_KEY_PEM, PARTNER_ID")
+	}
+
+	var mu sync.Mutex
+	seen := make(map[string]bool)
+
+	http.HandleFunc("/webhook", func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+			return
+		}
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			jsonResp(w, 400, map[string]any{"error": "failed to read body"})
+			return
+		}
+
+		timestamp := r.Header.Get("X-OneAddress-Timestamp")
+		signature := r.Header.Get("X-OneAddress-Signature")
+		dispatch  := r.Header.Get("X-OneAddress-Dispatch")
+
+		if !isFresh(timestamp, 300) {
+			jsonResp(w, 400, map[string]any{"error": "stale timestamp"})
+			return
+		}
+		if !verifyHMAC(string(body), signature, timestamp, webhookSecret) {
+			jsonResp(w, 401, map[string]any{"error": "invalid signature"})
+			return
+		}
+
+		if dispatch != "" {
+			mu.Lock()
+			if seen[dispatch] {
+				mu.Unlock()
+				jsonResp(w, 200, map[string]any{"ok": true, "duplicate": true})
+				return
+			}
+			seen[dispatch] = true
+			mu.Unlock()
+		}
+
+		var parsed map[string]any
+		if err = json.Unmarshal(body, &parsed); err != nil {
+			jsonResp(w, 400, map[string]any{"error": "invalid JSON"})
+			return
+		}
+
+		event, _ := parsed["event"].(string)
+		enc, hasEnc := parsed["address_encrypted"].(map[string]any)
+		if !hasEnc {
+			jsonResp(w, 200, map[string]any{"ok": true, "note": "no encrypted payload"})
+			return
+		}
+
+		address, err := decryptAddress(enc, privateKeyPEM, partnerID)
+		if err != nil {
+			log.Printf("[webhook] Decryption error (check PARTNER_PRIVATE_KEY_PEM): %v", err)
+			jsonResp(w, 200, map[string]any{"ok": true, "note": "received - decryption pending key setup"})
+			return
+		}
+
+		switch event {
+		case "address.updated":
+			customer, _ := parsed["customer"].(map[string]any)
+			email, _ := customer["email"].(string)
+			log.Printf("[webhook] Address for %s: %v %v %v %v",
+				email, address["street"], address["suburb"], address["state"], address["postcode"])
+			// TODO: persist address to your database
+
+		case "address.verify":
+			customer, _    := parsed["customer"].(map[string]any)
+			memberName, _  := customer["name"].(string)
+			callbackURL, _ := parsed["callback_url"].(string)
+			token, _       := parsed["callback_token"].(string)
+			batchID, _     := parsed["batch_id"].(string)
+
+			// TODO: Replace "match" with a real DB lookup.
+			// Valid values: "match" | "mismatch" | "not_found"
+			result := "match"
+
+			callbackBody, _ := json.Marshal(map[string]any{
+				"batch_id":    batchID,
+				"partner_id":  partnerID,
+				"member_name": memberName,
+				"result":      result,
+				"token":       token,
+			})
+			resp, err := http.Post(callbackURL, "application/json", bytes.NewReader(callbackBody))
+			if err != nil {
+				log.Printf("[webhook] Callback POST failed: %v", err)
+			} else {
+				resp.Body.Close()
+			}
+
+		default:
+			log.Printf("[webhook] Unknown event %q \u2014 acknowledged", event)
+		}
+
+		jsonResp(w, 200, map[string]any{"ok": true})
+	})
+
+	http.HandleFunc("/health", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte(\`{"status":"ok"}\`))
+	})
+
+	log.Printf("OneAddress webhook server on http://localhost:%s/webhook", port)
+	log.Fatal(http.ListenAndServe(":"+port, nil))
+}
+
+// \u2500\u2500 Crypto \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+func verifyHMAC(rawBody, signature, timestamp, secret string) bool {
+	payload := timestamp + "." + rawBody
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write([]byte(payload))
+	expected := hex.EncodeToString(mac.Sum(nil))
+	sigBytes, err := hex.DecodeString(signature)
+	if err != nil {
+		return false
+	}
+	expBytes, _ := hex.DecodeString(expected)
+	if len(sigBytes) != len(expBytes) {
+		return false
+	}
+	return subtle.ConstantTimeCompare(sigBytes, expBytes) == 1
+}
+
+func isFresh(timestamp string, toleranceSecs int) bool {
+	ts, err := strconv.ParseInt(timestamp, 10, 64)
+	if err != nil {
+		return false
+	}
+	diff := time.Now().Unix() - ts
+	if diff < 0 {
+		diff = -diff
+	}
+	return diff <= int64(toleranceSecs)
+}
+
+// hkdfSHA256 is a single-block RFC 5869 HKDF-SHA256 expand (length \u2264 32 bytes).
+func hkdfSHA256(ikm, salt, info []byte) []byte {
+	if len(salt) == 0 {
+		salt = make([]byte, sha256.Size)
+	}
+	h := hmac.New(sha256.New, salt)
+	h.Write(ikm)
+	prk := h.Sum(nil)
+	h = hmac.New(sha256.New, prk)
+	h.Write(info)
+	h.Write([]byte{0x01})
+	return h.Sum(nil) // 32 bytes
+}
+
+func decodeB64(s string) ([]byte, error) {
+	s = strings.NewReplacer("-", "+", "_", "/").Replace(s)
+	switch len(s) % 4 {
+	case 2:
+		s += "=="
+	case 3:
+		s += "="
+	}
+	return base64.StdEncoding.DecodeString(s)
+}
+
+func decryptAddress(enc map[string]any, privateKeyPEM, partnerID string) (map[string]any, error) {
+	// Parse PKCS#8 private key from PEM
+	keyStr := strings.NewReplacer(
+		"-----BEGIN PRIVATE KEY-----", "",
+		"-----END PRIVATE KEY-----", "",
+		"\\r", "", "\\n", "",
+	).Replace(privateKeyPEM)
+	keyStr = strings.TrimSpace(keyStr)
+
+	var derBytes []byte
+	// Try PEM block first, fall back to raw base64
+	block, _ := pem.Decode([]byte(privateKeyPEM))
+	if block != nil {
+		derBytes = block.Bytes
+	} else {
+		var err error
+		derBytes, err = base64.StdEncoding.DecodeString(keyStr)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	pkcsKey, err := x509.ParsePKCS8PrivateKey(derBytes)
+	if err != nil {
+		return nil, err
+	}
+	ecdsaKey, ok := pkcsKey.(*ecdsa.PrivateKey)
+	if !ok {
+		return nil, io.ErrUnexpectedEOF
+	}
+	ecdhPriv, err := ecdsaKey.ECDH()
+	if err != nil {
+		return nil, err
+	}
+
+	// Parse ephemeral public key (65-byte uncompressed P-256 point)
+	ephB64, _ := enc["ephemeralPublicKey"].(string)
+	ephRaw, err := decodeB64(ephB64)
+	if err != nil {
+		return nil, err
+	}
+	ephPub, err := ecdh.P256().NewPublicKey(ephRaw)
+	if err != nil {
+		return nil, err
+	}
+
+	sharedSecret, err := ecdhPriv.ECDH(ephPub)
+	if err != nil {
+		return nil, err
+	}
+
+	// HKDF-SHA256
+	var salt []byte
+	if hkdfSaltB64, _ := enc["hkdfSalt"].(string); hkdfSaltB64 != "" {
+		salt, err = decodeB64(hkdfSaltB64)
+		if err != nil {
+			return nil, err
+		}
+	}
+	info := []byte("oneaddress:" + partnerID)
+	aesKey := hkdfSHA256(sharedSecret, salt, info)
+
+	// AES-256-GCM decrypt (ciphertext field = ciphertext || 16-byte auth tag)
+	ivB64, _         := enc["iv"].(string)
+	ciphertextB64, _ := enc["ciphertext"].(string)
+	iv, err := decodeB64(ivB64)
+	if err != nil {
+		return nil, err
+	}
+	ciphertextWithTag, err := decodeB64(ciphertextB64)
+	if err != nil {
+		return nil, err
+	}
+
+	block, err := aes.NewCipher(aesKey)
+	if err != nil {
+		return nil, err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, err
+	}
+	plaintext, err := gcm.Open(nil, iv, ciphertextWithTag, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	var result map[string]any
+	err = json.Unmarshal(plaintext, &result)
+	return result, err
+}
+
+func jsonResp(w http.ResponseWriter, status int, data any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(data)
+}
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler (Go)
+
+Generated by \`npx @oneaddress/setup\` for **%%PARTNER_ID%%**.
+All crypto is inline \u2014 no external SDK required. Requires Go 1.21+.
+
+## Quick start
+
+\`\`\`bash
+# Load credentials from .env and run
+set -a; source .env; set +a
+go run .
+\`\`\`
+
+Your webhook endpoint: \`POST http://localhost:3001/webhook\`
+
+## Events handled
+
+### address.updated
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+
+### address.verify
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to records \u2192 POST callback_url.
+
+The stub always returns \`"match"\`. In \`main.go\`, find \`TODO: Replace "match"\`
+and add your DB lookup there.
+
+## Run conformance check
+
+\`\`\`bash
+npx @oneaddress/conformance test %%WEBHOOK_URL%%
+\`\`\`
+
+## Configuration
+
+Credentials are in \`.env\` (written by the setup wizard). Never commit \`.env\` to source control.
+`
+    }
+  ],
+  // ── PHP (Laravel) ─────────────────────────────────────────────────────────
+  "php-laravel": [
+    {
+      name: ".env.oneaddress",
+      content: `# OneAddress credentials \u2014 add these values to your Laravel .env file.
+OA_PARTNER_ID=%%PARTNER_ID%%
+OA_WEBHOOK_SECRET=%%WEBHOOK_SECRET%%
+OA_PRIVATE_KEY_PEM=%%PRIVATE_KEY%%
+`
+    },
+    {
+      name: "routes/webhook.php",
+      content: `<?php
+/**
+ * OneAddress Webhook Handler \u2014 Laravel
+ * Generated by npx @oneaddress/setup for %%PARTNER_ID%%
+ *
+ * Include this file in routes/api.php:
+ *   require __DIR__ . '/webhook.php';
+ *
+ * Requires PHP extensions: openssl
+ */
+
+use Illuminate\\Support\\Facades\\Route;
+use Illuminate\\Http\\Request;
+use Illuminate\\Http\\Response;
+
+Route::post('/webhook', function (Request $request): Response {
+    $partnerId     = env('OA_PARTNER_ID',      '%%PARTNER_ID%%');
+    $webhookSecret = env('OA_WEBHOOK_SECRET',  '');
+    $privateKeyB64 = env('OA_PRIVATE_KEY_PEM', '');
+
+    $rawBody   = $request->getContent();
+    $timestamp = $request->header('X-OneAddress-Timestamp', '');
+    $signature = $request->header('X-OneAddress-Signature', '');
+
+    // \u2500\u2500 Timestamp freshness (\xB15 minutes) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    if (!$timestamp || abs(time() - (int)$timestamp) > 300) {
+        return response()->json(['error' => 'Stale timestamp'], 400);
+    }
+
+    // \u2500\u2500 HMAC-SHA256 signature verification \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    $payload  = $timestamp . '.' . $rawBody;
+    $expected = hash_hmac('sha256', $payload, $webhookSecret);
+    if (!hash_equals($expected, strtolower($signature))) {
+        return response()->json(['error' => 'Invalid signature'], 401);
+    }
+
+    // \u2500\u2500 Parse body \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+    $body = json_decode($rawBody, true);
+    if ($body === null) {
+        return response()->json(['error' => 'Invalid JSON'], 400);
+    }
+
+    $eventType = $body['event'] ?? '';
+
+    if ($eventType !== 'address.updated' && $eventType !== 'address.verify') {
+        return response()->json(['ok' => true, 'skipped' => true]);
+    }
+
+    $enc = $body['address_encrypted'] ?? null;
+    if (!$enc) {
+        return response()->json(['ok' => true, 'note' => 'No encrypted payload']);
+    }
+
+    // \u2500\u2500 ECDH address decryption \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+
+    // Helper: decode standard or URL-safe base64
+    $b64decode = function (string $s): string {
+        return base64_decode(strtr($s, '-_', '+/'));
+    };
+
+    // Load private key \u2014 wrap bare base64 DER in PEM headers if needed
+    $keyStr = trim($privateKeyB64);
+    if (strpos($keyStr, '-----') === false) {
+        $keyStr = "-----BEGIN PRIVATE KEY-----\\n"
+            . chunk_split($keyStr, 64, "\\n")
+            . "-----END PRIVATE KEY-----";
+    }
+    $privateKey = openssl_pkey_get_private($keyStr);
+    if (!$privateKey) {
+        \\Log::error('[OneAddress] Failed to load private key');
+        return response()->json(['ok' => true, 'note' => 'Received \u2014 decryption pending key setup']);
+    }
+
+    // Build ephemeral public key SubjectPublicKeyInfo DER from raw uncompressed P-256 point
+    // DER prefix for P-256 SPKI (26 bytes, fixed for NIST P-256):
+    $spkiPrefix = "\\x30\\x59\\x30\\x13\\x06\\x07\\x2a\\x86\\x48\\xce\\x3d\\x02\\x01"
+                . "\\x06\\x08\\x2a\\x86\\x48\\xce\\x3d\\x03\\x01\\x07\\x03\\x42\\x00";
+    $ephemeralRaw = $b64decode($enc['ephemeralPublicKey']);
+    if (strlen($ephemeralRaw) !== 65 || ord($ephemeralRaw[0]) !== 0x04) {
+        return response()->json(['error' => 'Invalid ephemeral public key'], 400);
+    }
+    $ephemeralDer = $spkiPrefix . $ephemeralRaw;
+    $ephemeralPem = "-----BEGIN PUBLIC KEY-----\\n"
+        . chunk_split(base64_encode($ephemeralDer), 64, "\\n")
+        . "-----END PUBLIC KEY-----";
+
+    $ephemeralKey = openssl_pkey_get_public($ephemeralPem);
+    if (!$ephemeralKey) {
+        return response()->json(['error' => 'Invalid ephemeral public key'], 400);
+    }
+
+    // ECDH: derive shared secret
+    $sharedSecret = openssl_pkey_derive($ephemeralKey, $privateKey);
+    if ($sharedSecret === false) {
+        \\Log::error('[OneAddress] ECDH derive failed');
+        return response()->json(['ok' => true, 'note' => 'Received \u2014 decryption pending key setup']);
+    }
+
+    // HKDF-SHA256
+    $hkdfSaltB64 = $enc['hkdfSalt'] ?? null;
+    $salt = $hkdfSaltB64 ? $b64decode($hkdfSaltB64) : str_repeat("\\x00", 32);
+    $info = 'oneaddress:' . $partnerId;
+    $aesKey = hash_hkdf('sha256', $sharedSecret, 32, $info, $salt);
+
+    // AES-256-GCM decrypt \u2014 ciphertext field = actual_ciphertext || 16-byte auth tag
+    $iv              = $b64decode($enc['iv']);
+    $ciphertextFull  = $b64decode($enc['ciphertext']);
+    $tag             = substr($ciphertextFull, -16);
+    $ciphertext      = substr($ciphertextFull, 0, -16);
+
+    $plaintext = openssl_decrypt(
+        $ciphertext,
+        'aes-256-gcm',
+        $aesKey,
+        OPENSSL_RAW_DATA,
+        $iv,
+        $tag
+    );
+
+    if ($plaintext === false) {
+        \\Log::error('[OneAddress] AES-GCM decrypt failed \u2014 check private key');
+        return response()->json(['ok' => true, 'note' => 'Received \u2014 decryption pending key setup']);
+    }
+
+    $address = json_decode($plaintext, true);
+
+    if ($eventType === 'address.updated') {
+        // TODO: persist $address to your database
+        \\Log::info('[OneAddress] Address update received', [
+            'partner_id' => $partnerId,
+            'customer'   => $body['customer'] ?? null,
+            'address'    => $address,
+        ]);
+    } elseif ($eventType === 'address.verify') {
+        $customer     = $body['customer'] ?? [];
+        $callbackUrl  = $body['callback_url']  ?? '';
+        $callbackToken= $body['callback_token'] ?? '';
+        $batchId      = $body['batch_id'] ?? '';
+
+        // TODO: Replace "match" with a real DB lookup.
+        // Valid results: "match" | "mismatch" | "not_found"
+        $result = 'match';
+
+        $callbackPayload = json_encode([
+            'batch_id'    => $batchId,
+            'partner_id'  => $partnerId,
+            'member_name' => $customer['name'] ?? '',
+            'result'      => $result,
+            'token'       => $callbackToken,
+        ]);
+
+        $ch = curl_init($callbackUrl);
+        curl_setopt_array($ch, [
+            CURLOPT_RETURNTRANSFER => true,
+            CURLOPT_POST           => true,
+            CURLOPT_POSTFIELDS     => $callbackPayload,
+            CURLOPT_HTTPHEADER     => ['Content-Type: application/json'],
+            CURLOPT_TIMEOUT        => 10,
+        ]);
+        curl_exec($ch);
+        curl_close($ch);
+    }
+
+    return response()->json(['ok' => true]);
+});
+
+Route::get('/health', function (): \\Illuminate\\Http\\JsonResponse {
+    return response()->json(['status' => 'ok']);
+});
+`
+    },
+    {
+      name: ".env.example",
+      content: `# OneAddress webhook credentials \u2014 copy these into your Laravel .env file.
+OA_PARTNER_ID=your-partner-uuid-here
+OA_WEBHOOK_SECRET=your-webhook-secret-here
+OA_PRIVATE_KEY_PEM=<paste PKCS8 PEM private key here - use \\n between lines>
+`
+    },
+    {
+      name: "README.md",
+      content: `# OneAddress Webhook Handler (PHP / Laravel)
+
+Generated by \`npx @oneaddress/setup\` for **%%PARTNER_ID%%**.
+
+## Setup
+
+1. Add the route file to your Laravel application:
+
+\`\`\`php
+// In routes/api.php:
+require __DIR__ . '/webhook.php';
+\`\`\`
+
+2. Copy credentials from \`.env.oneaddress\` into your Laravel \`.env\` file.
+
+3. Start your server:
+
+\`\`\`bash
+php artisan serve --port=3001
+\`\`\`
+
+Your webhook endpoint: \`POST http://localhost:3001/api/webhook\`
+
+## Events handled
+
+### address.updated
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 persist to your DB.
+
+### address.verify
+Receive \u2192 verify HMAC \u2192 decrypt \u2192 compare to records \u2192 POST callback_url.
+
+Find the \`TODO: Replace "match"\` comment in \`routes/webhook.php\` and add your DB lookup.
+
+## Required PHP extensions
+
+- \`openssl\` (enabled by default on most hosts)
+- \`curl\` (used to POST the address.verify callback)
+
+## Run conformance check
+
+\`\`\`bash
+npx @oneaddress/conformance test %%WEBHOOK_URL%%
+\`\`\`
+
+## Configuration
+
+| Variable | Description |
+|---|---|
+| \`OA_PARTNER_ID\` | Your partner UUID |
+| \`OA_WEBHOOK_SECRET\` | HMAC-SHA256 signing secret |
+| \`OA_PRIVATE_KEY_PEM\` | PKCS#8 PEM private key (use \`\\\\n\` between lines) |
+`
+    }
+  ]
+};
+
+// src/scaffold.ts
+function applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey) {
+  return content.replaceAll("%%PARTNER_ID%%", partnerId).replaceAll("%%WEBHOOK_SECRET%%", webhookSecret).replaceAll("%%WEBHOOK_URL%%", webhookUrl || "<your-webhook-url>").replaceAll("%%PRIVATE_KEY%%", privateKey || "<paste your PKCS8 PEM private key here>");
+}
+var SENSITIVE_FILES = /* @__PURE__ */ new Set([".env"]);
+async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUrl, privateKey = "") {
+  const templates = TEMPLATES[platform];
+  if (!templates) throw new Error(`Unknown platform: ${platform}`);
+  const written = [];
+  for (const { name, content } of templates) {
+    const dest = (0, import_node_path.join)(outputDir, name);
+    const dir = (0, import_node_path.dirname)(dest);
+    if (!(0, import_node_fs.existsSync)(dir)) {
+      await (0, import_promises.mkdir)(dir, { recursive: true });
+    }
+    const filled = applyTokens(content, partnerId, webhookSecret, webhookUrl, privateKey);
+    const isSensitive = SENSITIVE_FILES.has((0, import_node_path.basename)(name));
+    await (0, import_promises.writeFile)(dest, filled, { encoding: "utf8", mode: isSensitive ? 384 : 420 });
+    if (isSensitive && process.platform !== "win32") {
+      try {
+        await (0, import_promises.chmod)(dest, 384);
+      } catch {
+      }
+    }
+    written.push(name);
+  }
+  return written;
+}
+
+// src/register.ts
+var import_node_crypto = require("crypto");
+var PKG_VERSION = "1.0.0";
+var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
+function hmacSha256(secret, message) {
+  return (0, import_node_crypto.createHmac)("sha256", secret).update(message).digest("hex");
+}
+async function registerInstall(installId, partnerId, webhookSecret, platform, webhookUrl) {
+  try {
+    const ts = String(Math.floor(Date.now() / 1e3));
+    const body = JSON.stringify({
+      installId,
+      platform,
+      webhookUrl,
+      sdkVersion: PKG_VERSION,
+      nodeVersion: process.version,
+      os: process.platform
+    });
+    const sig = hmacSha256(webhookSecret, `${ts}.${body}`);
+    const res = await fetch(REGISTER_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-OneAddress-Partner": partnerId,
+        "X-OneAddress-Timestamp": ts,
+        "X-OneAddress-Signature": sig
+      },
+      body,
+      // 10-second timeout so the wizard doesn't hang
+      signal: AbortSignal.timeout(1e4)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+// src/conformance.ts
+var import_node_child_process = require("child_process");
+function runConformance(webhookUrl, partnerId, webhookSecret) {
+  (0, import_node_child_process.spawnSync)(
+    "npx",
+    [
+      "@oneaddress/conformance",
+      "test",
+      webhookUrl,
+      "--partner-id",
+      partnerId,
+      "--secret",
+      webhookSecret
+    ],
+    { stdio: "inherit" }
+  );
+}
+
+// src/install.ts
+var import_node_child_process2 = require("child_process");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var COMMANDS = {
+  "ts-node": { cmd: "npm", args: ["install"] },
+  "python": { cmd: "pip", args: ["install", "-r", "requirements.txt"] },
+  "go-http": { cmd: "go", args: ["mod", "tidy"] },
+  "php-laravel": { cmd: "composer", args: ["install"] },
+  "csharp-aspnet": { cmd: "dotnet", args: ["restore"] },
+  "java-spring": { cmd: "./mvnw", args: ["dependency:resolve", "-q"] }
+};
+function installDependencies(platform, outputDir) {
+  const spec = COMMANDS[platform];
+  if (!spec) {
+    return { ok: true, output: "", manualCommand: "" };
+  }
+  if (platform === "java-spring") {
+    const mvnw = (0, import_node_path2.join)(outputDir, "mvnw");
+    if ((0, import_node_fs2.existsSync)(mvnw)) {
+      try {
+        (0, import_node_fs2.chmodSync)(mvnw, 493);
+      } catch {
+      }
+    }
+  }
+  const cwd = spec.cwd ? (0, import_node_path2.join)(outputDir, spec.cwd) : outputDir;
+  const manualCommand = `cd ${outputDir} && ${spec.cmd} ${spec.args.join(" ")}`;
+  const result = (0, import_node_child_process2.spawnSync)(spec.cmd, spec.args, {
+    cwd,
+    stdio: "pipe",
+    encoding: "utf8",
+    timeout: 5 * 60 * 1e3,
+    // 5 min max
+    shell: process.platform === "win32"
+  });
+  const output = [result.stdout ?? "", result.stderr ?? ""].join("").trim();
+  return {
+    ok: result.status === 0 && !result.error,
+    output,
+    manualCommand
+  };
+}
+
+// src/autostart.ts
+var import_node_child_process3 = require("child_process");
+var import_node_path3 = require("path");
+var import_node_fs3 = require("fs");
+var COMMANDS2 = {
+  "ts-node": { cmd: "npx", args: ["tsx", "src/server.ts"] },
+  "python": { cmd: "uvicorn", args: ["app:app", "--port", "3001"] },
+  "go-http": { cmd: "go", args: ["run", "."] },
+  "php-laravel": { cmd: "php", args: ["artisan", "serve", "--port=3001"] },
+  "csharp-aspnet": { cmd: "dotnet", args: ["run"] },
+  "java-spring": { cmd: "./mvnw", args: ["spring-boot:run"] }
+};
+var serverProcess = null;
+var serverOutput = "";
+function stopServer() {
+  if (serverProcess) {
+    try {
+      serverProcess.kill("SIGTERM");
+    } catch {
+    }
+    serverProcess = null;
+  }
+}
+function watchServer(onLine, onExit) {
+  if (!serverProcess) {
+    onExit();
+    return;
+  }
+  const emit = (chunk) => {
+    chunk.toString().split("\n").forEach((l2) => {
+      if (l2.trim()) onLine(l2);
+    });
+  };
+  serverProcess.stdout?.on("data", emit);
+  serverProcess.stderr?.on("data", emit);
+  serverProcess.once("exit", () => onExit());
+}
+async function pollHealth(port, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(`http://localhost:${port}/health`, {
+        signal: AbortSignal.timeout(1e3)
+      });
+      if (res.ok) return true;
+    } catch {
+    }
+    await new Promise((r2) => setTimeout(r2, 600));
+  }
+  return false;
+}
+async function startServer(platform, outputDir, port = 3001) {
+  const spec = COMMANDS2[platform];
+  if (!spec) {
+    return { ok: false, output: `No start command defined for platform: ${platform}`, manualCommand: "" };
+  }
+  if (platform === "java-spring") {
+    const mvnw = (0, import_node_path3.join)(outputDir, "mvnw");
+    if ((0, import_node_fs3.existsSync)(mvnw)) {
+      try {
+        (0, import_node_fs3.chmodSync)(mvnw, 493);
+      } catch {
+      }
+    }
+  }
+  serverOutput = "";
+  const manualCommand = `cd ${outputDir} && ${spec.cmd} ${spec.args.join(" ")}`;
+  serverProcess = (0, import_node_child_process3.spawn)(spec.cmd, spec.args, {
+    cwd: outputDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: false,
+    shell: process.platform === "win32",
+    env: { ...process.env }
+  });
+  serverProcess.stdout?.on("data", (d2) => {
+    serverOutput += d2.toString();
+  });
+  serverProcess.stderr?.on("data", (d2) => {
+    serverOutput += d2.toString();
+  });
+  serverProcess.on("error", (err) => {
+    serverOutput += `
+[startup error] ${err.message}`;
+  });
+  const ok = await pollHealth(port, 15e3);
+  return { ok, output: serverOutput, manualCommand };
+}
+
+// src/tunnel.ts
+var import_node_child_process4 = require("child_process");
+var import_promises2 = require("fs/promises");
+var import_node_path4 = require("path");
+var import_node_os = __toESM(require("os"));
+var tunnelProcess = null;
+function stopTunnel() {
+  if (tunnelProcess) {
+    try {
+      tunnelProcess.kill("SIGTERM");
+    } catch {
+    }
+    tunnelProcess = null;
+  }
+}
+function cloudflaredFilename() {
+  const p2 = process.platform;
+  const a2 = import_node_os.default.arch();
+  if (p2 === "darwin") return a2 === "arm64" ? "cloudflared-darwin-arm64" : "cloudflared-darwin-amd64";
+  if (p2 === "win32") return a2 === "x64" ? "cloudflared-windows-amd64.exe" : "cloudflared-windows-386.exe";
+  if (a2 === "arm64") return "cloudflared-linux-arm64";
+  if (a2 === "arm") return "cloudflared-linux-armhf";
+  return "cloudflared-linux-amd64";
+}
+async function downloadCloudflared() {
+  const filename = cloudflaredFilename();
+  const dest = (0, import_node_path4.join)(import_node_os.default.tmpdir(), process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
+  const url = `https://github.com/cloudflare/cloudflared/releases/latest/download/${filename}`;
+  const res = await fetch(url, { signal: AbortSignal.timeout(6e4) });
+  if (!res.ok) throw new Error(`Failed to download cloudflared: HTTP ${res.status}`);
+  const buf = await res.arrayBuffer();
+  await (0, import_promises2.writeFile)(dest, Buffer.from(buf));
+  if (process.platform !== "win32") await (0, import_promises2.chmod)(dest, 493);
+  return dest;
+}
+async function resolveBinary() {
+  try {
+    (0, import_node_child_process4.execSync)("cloudflared --version", { stdio: "pipe" });
+    return "cloudflared";
+  } catch {
+  }
+  return downloadCloudflared();
+}
+async function startTunnel(port) {
+  const binary = await resolveBinary();
+  return new Promise((resolve2, reject) => {
+    tunnelProcess = (0, import_node_child_process4.spawn)(binary, ["tunnel", "--url", `http://localhost:${port}`], {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let resolved = false;
+    const timer = setTimeout(() => {
+      if (!resolved) {
+        resolved = true;
+        reject(new Error("Tunnel URL not received within 45 seconds"));
+      }
+    }, 45e3);
+    const tryMatch = (data) => {
+      const text = data.toString();
+      const match = text.match(/https:\/\/[a-z0-9-]+\.trycloudflare\.com/);
+      if (match && !resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        resolve2({ url: match[0], temporary: true });
+      }
+    };
+    tunnelProcess.stdout?.on("data", tryMatch);
+    tunnelProcess.stderr?.on("data", tryMatch);
+    tunnelProcess.on("error", (err) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        reject(new Error(`cloudflared failed to start: ${err.message}`));
+      }
+    });
+    tunnelProcess.on("close", (code) => {
+      if (!resolved) {
+        resolved = true;
+        clearTimeout(timer);
+        reject(new Error(`cloudflared exited early with code ${code}`));
+      }
+    });
+  });
+}
+
+// src/register-url.ts
+var import_node_crypto2 = require("crypto");
+var PORTAL_API = "https://partners.oneaddress.io/api/partner/webhook-url";
+async function registerWebhookUrl(partnerId, webhookSecret, webhookUrl) {
+  try {
+    const body = JSON.stringify({ webhook_url: webhookUrl });
+    const ts = String(Math.floor(Date.now() / 1e3));
+    const sig = (0, import_node_crypto2.createHmac)("sha256", webhookSecret).update(`${ts}.${body}`).digest("hex");
+    const res = await fetch(PORTAL_API, {
+      method: "PATCH",
+      headers: {
+        "Content-Type": "application/json",
+        "X-OneAddress-Timestamp": ts,
+        "X-OneAddress-Signature": sig,
+        "X-OneAddress-Partner": partnerId
+      },
+      body,
+      signal: AbortSignal.timeout(1e4)
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+// src/prompts.ts
+var R4 = "\x1B[0m";
+var AMB2 = "\x1B[38;2;224;162;72m";
+var MID2 = "\x1B[38;2;155;135;100m";
+var DIM2 = "\x1B[38;2;70;58;35m";
+var GRN2 = "\x1B[38;2;80;200;120m";
+var CRM2 = "\x1B[1m\x1B[38;2;245;238;216m";
+var cleanupFns = [];
+function onCleanup(fn2) {
+  cleanupFns.push(fn2);
+}
+process.on("SIGINT", () => {
+  for (const fn2 of cleanupFns) {
+    try {
+      fn2();
+    } catch {
+    }
+  }
+  console.log(`
+${DIM2}  Stopped.${R4}
+`);
+  process.exit(0);
+});
+function assertNotCancelled(value) {
+  if (BD(value)) {
+    for (const fn2 of cleanupFns) {
+      try {
+        fn2();
+      } catch {
+      }
+    }
+    ve("Setup cancelled.");
+    process.exit(0);
+  }
+}
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function wrapAsPkcs8(b64) {
+  const body = b64.match(/.{1,64}/g)?.join("\n") ?? b64;
+  return { pem: `-----BEGIN PRIVATE KEY-----
+${body}
+-----END PRIVATE KEY-----
+` };
+}
+function normalisePrivateKey(raw) {
+  const trimmed = raw.trim();
+  const isPath = /^(\/|\.\/|\.\.\/|~\/|[A-Za-z]:[/\\])/.test(trimmed) || trimmed.endsWith(".pem");
+  if (isPath) {
+    const abs = trimmed.startsWith("~/") ? (0, import_node_path5.resolve)((0, import_node_os2.homedir)(), trimmed.slice(2)) : (0, import_node_path5.resolve)(trimmed);
+    if (!(0, import_node_fs4.existsSync)(abs)) return { pem: "", error: `File not found: ${abs}` };
+    return normalisePrivateKey((0, import_node_fs4.readFileSync)(abs, "utf8"));
+  }
+  const unescaped = trimmed.replace(/\\n/g, "\n");
+  if (unescaped.includes("-----BEGIN PRIVATE KEY-----")) {
+    return { pem: unescaped };
+  }
+  if (trimmed.includes("-----BEGIN ONEADDRESS ECDH PRIVATE KEY-----") || trimmed.includes("BEGIN ONEADDRESS")) {
+    const lines = trimmed.split("\n");
+    const b64Lines = [];
+    let inBody = false;
+    for (const line of lines) {
+      if (line.includes("BEGIN ONEADDRESS") || line.includes("END ONEADDRESS")) continue;
+      if (line.trim() === "-----") {
+        inBody = true;
+        continue;
+      }
+      if (!inBody) continue;
+      if (line.trim()) b64Lines.push(line.trim());
+    }
+    if (b64Lines.length === 0) return { pem: "", error: "Could not extract key body from the OneAddress PEM file" };
+    return wrapAsPkcs8(b64Lines.join(""));
+  }
+  const b64clean = trimmed.replace(/\s+/g, "");
+  if (/^[A-Za-z0-9+/]+=*$/.test(b64clean) && b64clean.length >= 50) {
+    return wrapAsPkcs8(b64clean);
+  }
+  return {
+    pem: "",
+    error: 'Could not recognise the key format.\n  \u2022 Paste the base64 string from the portal "Copy" button, OR\n  \u2022 Enter the path to the .pem file you downloaded, e.g. ~/Downloads/oneaddress-private-key.pem'
+  };
+}
+function validatePkcs8Pem(pem) {
+  try {
+    (0, import_node_crypto3.createPrivateKey)({ key: pem, format: "pem", type: "pkcs8" });
+    return void 0;
+  } catch (err) {
+    return `Key validation failed: ${err instanceof Error ? err.message : String(err)}`;
+  }
+}
+async function main() {
+  printHeader();
+  we("OneAddress Partner Setup  \u2014  v2");
+  v2.info("We will:");
+  v2.info("  1. Collect your credentials from the Partner Portal");
+  v2.info("  2. Scaffold a working webhook server for your platform");
+  v2.info("  3. Get it live with a passing conformance check \u2014 in under 5 minutes");
+  v2.info("\nOpen partners.oneaddress.io \u2192 My Profile to find all three values below.\n");
+  const partnerId = await ue({
+    message: "Your Partner ID  (UUID format)",
+    placeholder: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
+    validate: (v3) => {
+      if (!v3.trim()) return "Partner ID is required";
+      if (!UUID_RE.test(v3.trim()))
+        return "Must be a valid UUID \u2014 find it at partners.oneaddress.io \u2192 My Profile";
+    }
+  });
+  assertNotCancelled(partnerId);
+  const webhookSecret = await $e({
+    message: "Your Webhook Secret  (min 20 chars)",
+    validate: (v3) => {
+      if (!v3.trim()) return "Webhook Secret is required";
+      if (v3.length < 20) return "That looks too short \u2014 paste the full secret from My Profile";
+    }
+  });
+  assertNotCancelled(webhookSecret);
+  const privateKeyRaw = await ue({
+    message: "Your ECDH Private Key",
+    placeholder: "Paste the base64 key body from My Profile, or enter a path to the .pem file",
+    validate: (v3) => {
+      if (!v3.trim()) return "Private key is required";
+      const { pem, error } = normalisePrivateKey(v3);
+      if (error) return error;
+      return validatePkcs8Pem(pem);
+    }
+  });
+  assertNotCancelled(privateKeyRaw);
+  const pid = partnerId.trim();
+  const secret = webhookSecret.trim();
+  const { pem: privateKey } = normalisePrivateKey(privateKeyRaw.trim());
+  const platform = await de({
+    message: "Which platform?",
+    options: [
+      {
+        value: "ts-node",
+        label: "TypeScript / Node.js  (Express) \u2014 RECOMMENDED",
+        hint: "Best supported, auto-installs, clean store interface"
+      },
+      { value: "python", label: "Python  (FastAPI)" },
+      { value: "go-http", label: "Go  (net/http)" },
+      { value: "php-laravel", label: "PHP  (Laravel)" },
+      { value: "java-spring", label: "Java  (Spring Boot)" },
+      { value: "csharp-aspnet", label: "C#  (ASP.NET Core)" }
+    ]
+  });
+  assertNotCancelled(platform);
+  const outputDir = await ue({
+    message: "Where to write the files?",
+    placeholder: "./oneaddress-webhook",
+    defaultValue: "./oneaddress-webhook"
+  });
+  assertNotCancelled(outputDir);
+  const outDir = outputDir.trim() || "./oneaddress-webhook";
+  if ((0, import_node_fs4.existsSync)(outDir)) {
+    const entries = (0, import_node_fs4.readdirSync)(outDir);
+    if (entries.length > 0) {
+      const overwrite = await me({
+        message: `${outDir} already has files \u2014 overwrite?`,
+        initialValue: false
+      });
+      assertNotCancelled(overwrite);
+      if (!overwrite) {
+        ve("Choose a different output directory and run again.");
+        process.exit(0);
+      }
+    }
+  }
+  const s1 = L2();
+  s1.start("Scaffolding files\u2026");
+  let written;
+  try {
+    written = await scaffold(
+      platform,
+      outDir,
+      pid,
+      secret,
+      "",
+      // webhookUrl — filled in after server starts
+      privateKey
+    );
+    s1.stop(`Scaffolded ${written.length} files in ${outDir}`);
+    for (const f2 of written) v2.success(`  ${f2}`);
+  } catch (err) {
+    s1.stop("Scaffold failed");
+    v2.error(`Could not write files: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+  const s2 = L2();
+  s2.start("Installing dependencies\u2026");
+  const install = installDependencies(platform, outDir);
+  if (install.ok) {
+    s2.stop("Dependencies installed");
+  } else {
+    s2.stop("Dependency install failed \u2014 continuing anyway");
+    v2.warn(`Install failed. Run manually:
+  ${install.manualCommand}`);
+    if (install.output) v2.warn(install.output.slice(0, 500));
+  }
+  const s3 = L2();
+  s3.start("Starting server (waiting up to 15 s for /health)\u2026");
+  onCleanup(stopServer);
+  const start = await startServer(platform, outDir, 3001);
+  let serverRunning = false;
+  if (start.ok) {
+    s3.stop("Server is healthy on port 3001");
+    serverRunning = true;
+  } else {
+    s3.stop("Server did not respond \u2014 continuing anyway");
+    v2.warn(`Could not auto-start the server. Start it manually:
+  ${start.manualCommand}`);
+    if (start.output) v2.warn(start.output.slice(0, 600));
+  }
+  let webhookUrl = "";
+  const hasPublicUrl = await me({
+    message: "Do you have a public HTTPS URL where this server is reachable?",
+    initialValue: false
+  });
+  assertNotCancelled(hasPublicUrl);
+  if (hasPublicUrl) {
+    const providedUrl = await ue({
+      message: "Your public HTTPS webhook URL",
+      placeholder: "https://my-api.example.com/webhook",
+      validate: (v3) => {
+        if (!v3.trim()) return "URL is required";
+        if (!v3.trim().startsWith("https://"))
+          return "Must start with https:// \u2014 OneAddress enforces HTTPS for outbound webhooks";
+      }
+    });
+    assertNotCancelled(providedUrl);
+    webhookUrl = providedUrl.trim();
+  } else {
+    v2.info("\nSetting up a free HTTPS tunnel via Cloudflare Tunnel\u2026");
+    const s4 = L2();
+    s4.start("Starting Cloudflare Tunnel\u2026");
+    onCleanup(stopTunnel);
+    try {
+      const tunnel = await startTunnel(3001);
+      webhookUrl = `${tunnel.url}/webhook`;
+      s4.stop(`Tunnel active: ${tunnel.url}`);
+      v2.warn(
+        "IMPORTANT: This tunnel URL is temporary \u2014 it expires when this process stops.\nBefore going to production, deploy to a permanent server and update the webhook URL in the portal."
+      );
+    } catch (err) {
+      s4.stop("Tunnel setup failed");
+      v2.warn(`Could not start tunnel: ${err instanceof Error ? err.message : String(err)}`);
+      v2.warn(
+        "To get a public URL manually, try: npx cloudflared tunnel --url http://localhost:3001\nOr deploy to any server and set the URL in partners.oneaddress.io \u2192 My Profile."
+      );
+    }
+  }
+  if (webhookUrl) {
+    const s5 = L2();
+    s5.start("Registering webhook URL in the Partner Portal\u2026");
+    const registered = await registerWebhookUrl(pid, secret, webhookUrl);
+    if (registered) {
+      s5.stop(`Webhook URL registered: ${webhookUrl}`);
+    } else {
+      s5.stop("Could not auto-register URL \u2014 update it manually");
+      v2.warn(
+        `Open partners.oneaddress.io \u2192 My Profile \u2192 Webhook URL and paste:
+  ${webhookUrl}`
+      );
+    }
+    registerInstall(
+      `OA-${(0, import_node_crypto3.randomUUID)()}`,
+      pid,
+      secret,
+      platform,
+      webhookUrl
+    ).catch(() => {
+    });
+  }
+  if (webhookUrl && serverRunning) {
+    v2.info("\nRunning conformance checks \u2014 this may take up to 60 seconds\u2026\n");
+    runConformance(webhookUrl, pid, secret);
+  } else if (webhookUrl) {
+    v2.info("\nStart your server, then run the conformance check:");
+    v2.info(`  npx @oneaddress/conformance test ${webhookUrl}`);
+  } else {
+    v2.info("\nOnce your endpoint is live, run the conformance check:");
+    v2.info("  npx @oneaddress/conformance test <your-https-url>/webhook");
+  }
+  const summary = [
+    `Partner ID:   ${pid}`,
+    `Webhook URL:  ${webhookUrl || "(not set \u2014 update in portal)"}`,
+    `Server port:  3001`,
+    `Files in:     ${outDir}`
+  ].join("\n");
+  const nextSteps = [
+    "1. Open src/store.ts and wire up saveAddress() + verifyAddress() to your database",
+    "2. Update your address at app.oneaddress.io to trigger a live address.updated event",
+    "3. For production: deploy to a permanent server and update the webhook URL in the portal",
+    "4. Questions? partners.oneaddress.io  or  partners@oneaddress.io"
+  ].join("\n\n");
+  ye(summary, "Setup summary");
+  ye(nextSteps, "Next steps");
+  fe("Setup complete! Welcome to the OneAddress Partner Network.");
+  if (serverRunning) {
+    console.log("");
+    console.log(`  ${DIM2}\u250C${"\u2500".repeat(56)}\u2510${R4}`);
+    console.log(`  ${DIM2}\u2502${R4}  ${GRN2}\u25C8${R4}  ${CRM2}Server live${R4} ${MID2}on http://localhost:3001/webhook${R4}  ${DIM2}\u2502${R4}`);
+    console.log(`  ${DIM2}\u2502${R4}  ${AMB2}\u25C8${R4}  ${MID2}Edit ${CRM2}src/store.ts${R4} ${MID2}to wire your database${R4}          ${DIM2}\u2502${R4}`);
+    console.log(`  ${DIM2}\u2502${R4}     ${MID2}Press Ctrl+C to stop the server and exit.${R4}  ${DIM2}      \u2502${R4}`);
+    console.log(`  ${DIM2}\u2514${"\u2500".repeat(56)}\u2518${R4}`);
+    console.log("");
+    watchServer(
+      (line) => console.log(`  ${DIM2}\u2502${R4} ${MID2}${line}${R4}`),
+      () => {
+        console.log(`
+  ${DIM2}Server process exited.${R4}
+`);
+        process.exit(0);
+      }
+    );
+    process.stdin.resume();
+  }
+}
+
+// src/index.ts
+main().catch((err) => {
+  console.error("\n[oneaddress/setup] Unexpected error:", err instanceof Error ? err.message : err);
+  process.exit(1);
+});