neozip-cli 0.95.0 → 0.95.1

package/dist/src/account/token-service-identity.js

@@ -0,0 +1,488 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityKeyConflictError = exports.WalletLoginUnavailableError = void 0;
+exports.registerEmailWithDelivery = registerEmailWithDelivery;
+exports.registerEmailApp = registerEmailApp;
+exports.registerEmailCli = registerEmailCli;
+exports.verifyEmailAndExtractToken = verifyEmailAndExtractToken;
+exports.exchangeMagicLinkToken = exchangeMagicLinkToken;
+exports.requestWalletLoginChallenge = requestWalletLoginChallenge;
+exports.walletLogin = walletLogin;
+exports.requestPhoneOtp = requestPhoneOtp;
+exports.verifyPhoneOtp = verifyPhoneOtp;
+exports.fetchCoordinatorConfig = fetchCoordinatorConfig;
+exports.requestWalletEnsureChallenge = requestWalletEnsureChallenge;
+exports.completeWalletEnsure = completeWalletEnsure;
+exports.requestWalletAttachChallenge = requestWalletAttachChallenge;
+exports.completeWalletAttach = completeWalletAttach;
+exports.runWalletEnsureAndAttach = runWalletEnsureAndAttach;
+exports.getIdentityKeyBundle = getIdentityKeyBundle;
+exports.requestIdentityKeyInitChallenge = requestIdentityKeyInitChallenge;
+exports.completeIdentityKeyInit = completeIdentityKeyInit;
+const ethers_1 = require("ethers");
+const recipient_lookup_1 = require("../archive/recipient-lookup");
+const token_service_fetch_1 = require("../util/token-service-fetch");
+const token_auth_1 = require("../connection/token-auth");
+const wallet_evm_1 = require("./wallet-evm");
+const DEFAULT_RECIPIENT_SUITE = "ecies-x25519-aes256gcm";
+function challengeBody(bundle) {
+    return {
+        x25519PublicKeyB64: bundle.x25519PublicKeyB64,
+        wrappedPrivateKeyB64: bundle.wrappedPrivateKeyB64,
+        wrapFormatVersion: bundle.wrapFormatVersion,
+        wrapKdfInfo: bundle.wrapKdfInfo,
+        wrapKdfSaltB64: bundle.wrapKdfSaltB64,
+        wrapAead: bundle.wrapAead,
+        wrapIvB64: bundle.wrapIvB64,
+        wrapAadB64: bundle.wrapAadB64,
+        recipientSuites: bundle.recipientSuites ?? [DEFAULT_RECIPIENT_SUITE],
+    };
+}
+function pickString(obj, ...keys) {
+    for (const k of keys) {
+        const v = obj[k];
+        if (typeof v === "string" && v.length > 0)
+            return v;
+    }
+    return null;
+}
+function extractError(parsed, fallback, options) {
+    const authHint = options?.status != null
+        ? (0, token_auth_1.tokenServiceAuthErrorMessage)(options.status, options.email)
+        : null;
+    if (authHint)
+        return authHint;
+    if (parsed && typeof parsed === "object") {
+        const p = parsed;
+        if (typeof p.error === "string")
+            return p.error;
+        if (typeof p.message === "string")
+            return p.message;
+    }
+    return fallback;
+}
+async function safeJson(response) {
+    const ct = response.headers.get("content-type") || "";
+    if (!ct.includes("json"))
+        return null;
+    try {
+        return (await response.json());
+    }
+    catch {
+        return null;
+    }
+}
+async function registerEmailWithDelivery(baseUrl, email, verificationDelivery) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/register`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                email: email.trim().toLowerCase(),
+                verificationDelivery,
+            }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `HTTP ${res.status}`),
+        };
+    }
+    return {
+        success: true,
+        message: typeof parsed.message === "string" ? parsed.message : "Verification email sent.",
+    };
+}
+/** Desktop-style registration (deep link email). */
+async function registerEmailApp(baseUrl, email) {
+    return registerEmailWithDelivery(baseUrl, email, "app");
+}
+/** Terminal / neozip connect registration (6-digit code only). */
+async function registerEmailCli(baseUrl, email) {
+    return registerEmailWithDelivery(baseUrl, email, "cli");
+}
+async function verifyEmailAndExtractToken(baseUrl, email, code) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/verify-email-code`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ email: email.trim().toLowerCase(), code: code.trim() }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Verification failed (HTTP ${res.status})`, {
+            status: res.status,
+            email,
+        }));
+    }
+    const accessToken = pickString(parsed, "accessToken", "token", "bearerToken") ?? null;
+    if (!accessToken) {
+        throw new Error("Verification succeeded but no accessToken in response. Set NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN manually or update neozip-blockchain.");
+    }
+    const verifiedEmail = pickString(parsed, "email") ?? email.trim().toLowerCase();
+    return {
+        accessToken,
+        email: verifiedEmail,
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+async function exchangeMagicLinkToken(baseUrl, token) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/exchange-token`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ token: token.trim() }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Magic link exchange failed (HTTP ${res.status})`, {
+            status: res.status,
+        }));
+    }
+    const accessToken = pickString(parsed, "accessToken", "token", "bearerToken") ?? null;
+    if (!accessToken) {
+        throw new Error("Magic link exchange succeeded but no accessToken in response.");
+    }
+    const verifiedEmail = pickString(parsed, "email") ?? "";
+    if (!verifiedEmail) {
+        throw new Error("Magic link exchange succeeded but no email in response.");
+    }
+    return {
+        accessToken,
+        email: verifiedEmail,
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+/** Thrown when the Token Service does not expose the wallet-login endpoints (older deployment). */
+class WalletLoginUnavailableError extends Error {
+    constructor(message = 'Token Service does not support wallet login') {
+        super(message);
+        this.name = 'WalletLoginUnavailableError';
+    }
+}
+exports.WalletLoginUnavailableError = WalletLoginUnavailableError;
+async function requestWalletLoginChallenge(baseUrl, evmAddress) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(evmAddress.trim());
+    let res;
+    try {
+        res = await fetch(`${url}/auth/wallet-login/challenge`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ evmAddress: checksummed }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new WalletLoginUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet login challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, 'challengeId');
+    const message = pickString(parsed, 'message');
+    const addr = pickString(parsed, 'evmAddress');
+    if (!challengeId || !message || !addr) {
+        throw new Error('Wallet login challenge response missing fields');
+    }
+    return { challengeId, message, evmAddress: addr };
+}
+async function walletLogin(baseUrl, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/wallet-login`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                evmAddress: (0, ethers_1.getAddress)(input.evmAddress.trim()),
+                challengeId: input.challengeId,
+                evmSignature: input.evmSignature,
+            }),
+        });
+    }
+    catch (err) {
+        throw new Error((0, token_service_fetch_1.formatTokenServiceFetchError)(url, err));
+    }
+    if (res.status === 404) {
+        throw new WalletLoginUnavailableError();
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet login failed (HTTP ${res.status})`, { status: res.status }));
+    }
+    const accessToken = pickString(parsed, 'accessToken', 'token', 'bearerToken');
+    if (!accessToken) {
+        throw new Error('Wallet login succeeded but no accessToken in response.');
+    }
+    return {
+        accessToken,
+        email: pickString(parsed, 'email'),
+        expiresAt: (0, token_auth_1.parseAccessTokenExpiry)(parsed),
+    };
+}
+async function requestPhoneOtp(baseUrl, accessToken, phoneE164) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/phone/request-otp`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({ phoneE164: phoneE164.trim() }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `Phone OTP request failed (HTTP ${res.status})`),
+        };
+    }
+    return { success: true };
+}
+async function verifyPhoneOtp(baseUrl, accessToken, phoneE164, code) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    let res;
+    try {
+        res = await fetch(`${url}/auth/phone/verify`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                phoneE164: phoneE164.trim(),
+                code: code.trim(),
+            }),
+        });
+    }
+    catch (err) {
+        return { success: false, error: (0, token_service_fetch_1.formatTokenServiceFetchError)(url, err) };
+    }
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        return {
+            success: false,
+            error: extractError(parsed, `Phone verification failed (HTTP ${res.status})`),
+        };
+    }
+    return { success: true };
+}
+class IdentityKeyConflictError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyConflictError";
+    }
+}
+exports.IdentityKeyConflictError = IdentityKeyConflictError;
+function authHeaders(accessToken) {
+    return {
+        Authorization: `Bearer ${accessToken}`,
+        "content-type": "application/json",
+    };
+}
+async function fetchCoordinatorConfig(baseUrl) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    try {
+        const res = await fetch(`${url}/crypto/coordinator-config`, { method: "GET" });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function requestWalletEnsureChallenge(baseUrl, evmAddress) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/challenge`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ evmAddress: checksummed }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const addr = pickString(parsed, "evmAddress");
+    if (!challengeId || !message || !addr) {
+        throw new Error("Wallet challenge response missing fields");
+    }
+    return { challengeId, message, evmAddress: addr };
+}
+async function completeWalletEnsure(baseUrl, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const checksummed = (0, ethers_1.getAddress)(input.evmAddress.trim());
+    const res = await fetch(`${url}/identity/wallets/ensure`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            evmAddress: checksummed,
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Wallet ensure failed (HTTP ${res.status})`));
+    }
+    const walletId = typeof parsed.walletId === "number" ? parsed.walletId : Number(parsed.walletId);
+    const addr = pickString(parsed, "evmAddress");
+    if (!Number.isFinite(walletId) || !addr) {
+        throw new Error("Wallet ensure response missing walletId");
+    }
+    return { walletId, evmAddress: addr };
+}
+async function requestWalletAttachChallenge(baseUrl, accessToken, walletId) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/challenge`, { method: "POST", headers: authHeaders(accessToken) });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Attach challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const wid = typeof parsed.walletId === "number" ? parsed.walletId : Number(parsed.walletId);
+    const addr = pickString(parsed, "evmAddress");
+    if (!challengeId || !message || !Number.isFinite(wid) || !addr) {
+        throw new Error("Attach challenge response missing fields");
+    }
+    return { challengeId, message, walletId: wid, evmAddress: addr };
+}
+async function completeWalletAttach(baseUrl, accessToken, walletId, input) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/users/me/wallets/${walletId}/attach/complete`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            challengeId: input.challengeId,
+            evmSignature: input.evmSignature,
+            setPrimary: true,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `Attach complete failed (HTTP ${res.status})`));
+    }
+    const linkId = typeof parsed.linkId === "number" ? parsed.linkId : Number(parsed.linkId);
+    if (!Number.isFinite(linkId)) {
+        throw new Error("Attach complete response missing linkId");
+    }
+    return { linkId };
+}
+async function runWalletEnsureAndAttach(baseUrl, accessToken, evmPrivateKey, evmAddress) {
+    const ensureCh = await requestWalletEnsureChallenge(baseUrl, evmAddress);
+    const ensureSig = await (0, wallet_evm_1.signEvmMessage)(evmPrivateKey, ensureCh.message);
+    const ensured = await completeWalletEnsure(baseUrl, {
+        evmAddress,
+        challengeId: ensureCh.challengeId,
+        evmSignature: ensureSig,
+    });
+    const attachCh = await requestWalletAttachChallenge(baseUrl, accessToken, ensured.walletId);
+    const attachSig = await (0, wallet_evm_1.signEvmMessage)(evmPrivateKey, attachCh.message);
+    const { linkId } = await completeWalletAttach(baseUrl, accessToken, ensured.walletId, {
+        challengeId: attachCh.challengeId,
+        evmSignature: attachSig,
+    });
+    return { walletId: ensured.walletId, evmAddress: ensured.evmAddress, linkId };
+}
+async function getIdentityKeyBundle(baseUrl, accessToken, walletId) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key`, {
+        method: "GET",
+        headers: authHeaders(accessToken),
+    });
+    if (res.status === 404)
+        return { found: false };
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `identity-key GET failed (HTTP ${res.status})`));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error("identity-key response missing identityKey");
+    const identityKeyId = typeof ik.identityKeyId === "number" ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = pickString(ik, "x25519PublicKeyB64", "x25519PublicKey");
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error("identity-key response incomplete");
+    }
+    return { found: true, identityKeyId, x25519PublicKey };
+}
+async function requestIdentityKeyInitChallenge(baseUrl, accessToken, walletId, bundle) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/challenge`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify(challengeBody(bundle)),
+    });
+    const parsed = await safeJson(res);
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `init challenge failed (HTTP ${res.status})`));
+    }
+    const challengeId = pickString(parsed, "challengeId");
+    const message = pickString(parsed, "message");
+    const evmAddress = pickString(parsed, "evmAddress");
+    const wrappedSha256Hex = pickString(parsed, "wrappedSha256Hex");
+    if (!challengeId || !message || !evmAddress || !wrappedSha256Hex) {
+        throw new Error("init challenge response missing fields");
+    }
+    return { challengeId, message, evmAddress, wrappedSha256Hex };
+}
+async function completeIdentityKeyInit(baseUrl, accessToken, walletId, bundle, challengeId, evmSignature) {
+    const url = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)({ tokenServiceUrl: baseUrl });
+    const res = await fetch(`${url}/identity/wallets/${walletId}/identity-key/init/complete`, {
+        method: "POST",
+        headers: authHeaders(accessToken),
+        body: JSON.stringify({
+            ...challengeBody(bundle),
+            challengeId,
+            evmSignature,
+        }),
+    });
+    const parsed = await safeJson(res);
+    if (res.status === 409) {
+        throw new IdentityKeyConflictError(extractError(parsed, "Identity key already exists for this wallet."));
+    }
+    if (!res.ok || !parsed || parsed.success !== true) {
+        throw new Error(extractError(parsed, `init complete failed (HTTP ${res.status})`));
+    }
+    const ik = parsed.identityKey;
+    if (!ik)
+        throw new Error("init complete missing identityKey");
+    const identityKeyId = typeof ik.identityKeyId === "number" ? ik.identityKeyId : Number(ik.identityKeyId);
+    const x25519PublicKey = pickString(ik, "x25519PublicKeyB64", "x25519PublicKey");
+    if (!Number.isFinite(identityKeyId) || !x25519PublicKey) {
+        throw new Error("init complete response incomplete");
+    }
+    return { identityKeyId, x25519PublicKey };
+}
+//# sourceMappingURL=token-service-identity.js.map

package/dist/src/commands/verifyEmail.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * Verify email for Token Service timestamping
+ *
+ * Sets a default email for Token Service timestamps. Checks with the server whether
+ * the email is already verified; if not, sends a magic link. Always saves as default.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVerifyEmail = runVerifyEmail;
+const readline = __importStar(require("readline"));
+const token_service_1 = require("neozip-blockchain/token-service");
+const ConfigStore_1 = require("../config/ConfigStore");
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function isValidEmail(email) {
+    return EMAIL_REGEX.test(email.trim());
+}
+function isAlreadyVerifiedMessage(msg) {
+    if (!msg)
+        return false;
+    const lower = msg.toLowerCase();
+    return ((lower.includes('already') && (lower.includes('verified') || lower.includes('registered'))) ||
+        lower.includes('already verified') ||
+        lower.includes('email already'));
+}
+/**
+ * Run the verify-email flow.
+ * Calls the server to check verification status; if already verified, sets as default.
+ * If not, sends magic link and sets as default. Always saves email to config.
+ */
+async function runVerifyEmail(options) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    const prompt = (question, defaultValue) => {
+        return new Promise((resolve) => {
+            const display = defaultValue ? `${question} (${defaultValue}): ` : `${question}: `;
+            rl.question(display, (answer) => {
+                resolve((answer.trim() || defaultValue || '').trim());
+            });
+        });
+    };
+    try {
+        console.log('\n📧 Token Service Email Configuration\n');
+        console.log('Token Service requires a verified email to create timestamped ZIP files.');
+        console.log('');
+        const config = ConfigStore_1.ConfigStore.getConfig();
+        const defaultEmail = options?.email || config.timestampEmail || '';
+        const email = await prompt('Email address', defaultEmail || undefined);
+        if (!email) {
+            console.error('❌ Email is required');
+            rl.close();
+            return false;
+        }
+        if (!isValidEmail(email)) {
+            console.error('❌ Invalid email format');
+            rl.close();
+            return false;
+        }
+        // --set-default: skip server check, just save
+        if (options?.setDefaultOnly) {
+            const saved = ConfigStore_1.ConfigStore.set('tokenService.timestampEmail', email);
+            if (!saved) {
+                console.error('❌ Failed to save email to configuration');
+                rl.close();
+                return false;
+            }
+            console.log(`\n✅ ${email} set as default for Token Service timestamps.`);
+            console.log('\n💡 You can now create timestamped ZIPs: neozip -ts <archive> <files>\n');
+            rl.close();
+            return true;
+        }
+        // Check with server: register returns status (already verified vs magic link sent)
+        console.log(`\n📤 Checking verification status for ${email}...`);
+        const registerResult = await (0, token_service_1.registerEmail)(email, {
+            debug: options?.debug,
+        });
+        if (!registerResult.success) {
+            console.error('❌ Failed to register email:', registerResult.error || 'Unknown error');
+            rl.close();
+            return false;
+        }
+        const res = registerResult;
+        const msg = res.message || '';
+        const alreadyVerified = res.verified === true ||
+            res.alreadyVerified === true ||
+            isAlreadyVerifiedMessage(msg);
+        const saved = ConfigStore_1.ConfigStore.set('tokenService.timestampEmail', email);
+        if (!saved) {
+            console.error('❌ Failed to save email to configuration');
+            rl.close();
+            return false;
+        }
+        if (alreadyVerified) {
+            console.log('\n✅ Email is already verified. Set as default.');
+        }
+        else {
+            console.log('\n✅ Verification link sent. Check your inbox (and spam folder).');
+            console.log('   Click the magic link in the email to complete verification.');
+            console.log(`   ${email} has been set as default and will work once you've clicked the link.`);
+        }
+        console.log('\n💡 You can now create timestamped ZIPs: neozip -ts <archive> <files>\n');
+        rl.close();
+        return true;
+    }
+    catch (error) {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.error('❌ Error:', msg);
+        rl.close();
+        return false;
+    }
+}
+//# sourceMappingURL=verifyEmail.js.map