@phosra/cli 0.1.0

package/dist/commands/doctor.js

@@ -0,0 +1,321 @@
+/**
+ * phosra doctor — end-to-end setup verification.
+ *
+ * Runs 5 checks in order, reporting PASS / FAIL / WARN for each.
+ * Exits 0 if all checks pass (warns are non-fatal).  Exits 1 on any FAIL.
+ *
+ * Checks:
+ *   1. census_reachable     GET /health → 200
+ *   2. trust_list_verified  GET /.well-known/ocss/trust-list + Ed25519 root-sig verify
+ *   3. caps_verified        GET /.well-known/ocss/capabilities + root-sig verify (WARN if 404)
+ *   4. version_negotiates   negotiate(SUPPORTED_VERSIONS, caps.version_range.supported)
+ *   5. sandbox_round_trip   Full §8.3.2 + §8.3.1 write cycle via runProviderRoundTrip:
+ *                             trust-list fetch → router JWK extract →
+ *                             consent_attestation ingest (201) → rule write (201)
+ *
+ * Check 5 uses the zero-provisioning sandbox: household-acme against the STAGING
+ * shared sandbox trust-list + Mia child/policy — no DB, no per-org provisioning,
+ * no extra backend.
+ *
+ * §12.3: census is the safety authority. The CLI verifies; it never decides.
+ * Fail-closed: any FAIL exits non-zero, never a false green.
+ */
+import { verifyDocument, verifyCapabilitiesDocument, negotiate, SUPPORTED_VERSIONS, fromVerifiedDocument, b64urlRaw, } from "@openchildsafety/ocss";
+import { HOUSEHOLD_ACME_KEY_ID } from "../config.js";
+import { senderKeyFromSeedB64url, publicXFromSenderKey } from "../sender-key.js";
+import { runProviderRoundTrip } from "../round-trip.js";
+import { printCheck, printJson, heading, summary, } from "../out.js";
+/**
+ * Run all doctor checks.
+ * Returns the array of CheckResults; the caller (bin.ts) sets the exit code.
+ *
+ * fetchImpl is injectable for unit tests — real commands pass global fetch.
+ */
+export async function runDoctor(cfg, json, fetchImpl = fetch) {
+    heading("Phosra doctor", json);
+    const results = [];
+    // ── 1: census reachable ──────────────────────────────────────────────────
+    const c1 = await checkCensusReachable(cfg.censusUrl, fetchImpl);
+    results.push(c1);
+    printCheck(c1, json);
+    if (c1.status === "fail") {
+        const skips = [
+            ["trust_list_verified", "skipped — census unreachable"],
+            ["caps_verified", "skipped — census unreachable"],
+            ["version_negotiates", "skipped — no caps doc"],
+            ["sandbox_round_trip", "skipped — census unreachable"],
+        ];
+        for (const [name, msg] of skips) {
+            const r = skip(name, msg);
+            results.push(r);
+            printCheck(r, json);
+        }
+        finish(results, json);
+        return results;
+    }
+    // ── 2: trust-list verified ──────────────────────────────────────────────
+    const c2 = await checkTrustListVerified(cfg.censusUrl, cfg.trustRootX, fetchImpl);
+    results.push(c2);
+    printCheck(c2, json);
+    let resolver;
+    if (c2.status === "pass" && c2.data) {
+        const tlDoc = c2.data.doc;
+        try {
+            resolver = fromVerifiedDocument(tlDoc);
+        }
+        catch { /* resolver stays undefined */ }
+    }
+    // ── 3: capabilities verified ────────────────────────────────────────────
+    const c3 = await checkCapsVerified(cfg.censusUrl, cfg.trustRootX, fetchImpl);
+    results.push(c3);
+    printCheck(c3, json);
+    // ── 4: version negotiates ───────────────────────────────────────────────
+    const serverVersions = c3.status === "pass" && c3.data
+        ? c3.data.supported
+        : undefined;
+    const c4 = checkVersionNegotiates(serverVersions);
+    results.push(c4);
+    printCheck(c4, json);
+    // ── 5: sandbox round-trip ───────────────────────────────────────────────
+    const c5 = await checkSandboxRoundTrip(cfg, resolver, fetchImpl);
+    results.push(c5);
+    printCheck(c5, json);
+    finish(results, json);
+    return results;
+}
+// ── output helpers ────────────────────────────────────────────────────────────
+function skip(name, message) {
+    return { name, status: "skip", message };
+}
+function finish(results, json) {
+    if (json) {
+        printJson({
+            ok: results.every((r) => r.status !== "fail"),
+            checks: results.map((r) => ({
+                name: r.name,
+                status: r.status,
+                message: r.message,
+                ...(r.data !== undefined ? { data: r.data } : {}),
+            })),
+        });
+    }
+    else {
+        summary(results, json);
+    }
+}
+// ── individual check implementations ─────────────────────────────────────────
+async function checkCensusReachable(censusUrl, fetchImpl) {
+    try {
+        const res = await fetchImpl(`${censusUrl}/health`, { method: "GET" });
+        if (res.status === 200) {
+            return { name: "census_reachable", status: "pass", message: censusUrl };
+        }
+        return {
+            name: "census_reachable",
+            status: "fail",
+            message: `GET /health → HTTP ${res.status}`,
+            hint: `Check PHOSRA_CENSUS_URL (currently: ${censusUrl})`,
+        };
+    }
+    catch (err) {
+        return {
+            name: "census_reachable",
+            status: "fail",
+            message: `network error: ${err.message}`,
+            hint: `Check PHOSRA_CENSUS_URL and network connectivity.  Current: ${censusUrl}`,
+        };
+    }
+}
+async function checkTrustListVerified(censusUrl, trustRootX, fetchImpl) {
+    try {
+        const res = await fetchImpl(`${censusUrl}/.well-known/ocss/trust-list`, {
+            method: "GET",
+        });
+        if (!res.ok) {
+            return {
+                name: "trust_list_verified",
+                status: "fail",
+                message: `GET /.well-known/ocss/trust-list → HTTP ${res.status}`,
+                hint: "The census may not have the Trust List endpoint enabled.",
+            };
+        }
+        const signed = (await res.json());
+        const doc = verifyDocument(signed, trustRootX);
+        const entryCount = doc.entries?.length ?? 0;
+        const serial = doc.issue?.serial ?? "?";
+        return {
+            name: "trust_list_verified",
+            status: "pass",
+            message: `${entryCount} entr${entryCount === 1 ? "y" : "ies"}, serial ${serial}`,
+            data: { doc, entry_count: entryCount },
+        };
+    }
+    catch (err) {
+        const msg = err.message;
+        const isSignatureErr = msg.includes("signature") || msg.includes("verify");
+        return {
+            name: "trust_list_verified",
+            status: "fail",
+            message: msg,
+            hint: isSignatureErr
+                ? `PHOSRA_TRUST_ROOT_X may not match the census root key.  Current: ${trustRootX}`
+                : "Inspect the raw Trust List response for malformed JSON.",
+        };
+    }
+}
+async function checkCapsVerified(censusUrl, trustRootX, fetchImpl) {
+    try {
+        const res = await fetchImpl(`${censusUrl}/.well-known/ocss/capabilities`, {
+            method: "GET",
+        });
+        if (res.status === 404) {
+            return {
+                name: "caps_verified",
+                status: "warn",
+                message: "404 — capabilities doc not yet published (P1 feature)",
+                hint: "Expected for pre-P1 censuses.  `phosra doctor` still passes overall.",
+            };
+        }
+        if (!res.ok) {
+            return {
+                name: "caps_verified",
+                status: "warn",
+                message: `HTTP ${res.status}`,
+                hint: "Caps endpoint error; skipping version-range check.",
+            };
+        }
+        const signed = (await res.json());
+        const doc = verifyCapabilitiesDocument(signed, trustRootX);
+        return {
+            name: "caps_verified",
+            status: "pass",
+            message: `ocss_version ${doc.ocss_version}, ${doc.rule_categories?.length ?? 0} rules, serial ${doc.serial}`,
+            data: {
+                ocss_version: doc.ocss_version,
+                supported: doc.version_range?.supported ?? [],
+                rule_categories: doc.rule_categories?.length ?? 0,
+            },
+        };
+    }
+    catch (err) {
+        return {
+            name: "caps_verified",
+            status: "warn",
+            message: err.message,
+            hint: "Caps doc failed verification (non-fatal — continuing without it).",
+        };
+    }
+}
+function checkVersionNegotiates(serverVersions) {
+    if (!serverVersions) {
+        return {
+            name: "version_negotiates",
+            status: "skip",
+            message: "no caps doc — version negotiation check skipped",
+        };
+    }
+    const agreed = negotiate(SUPPORTED_VERSIONS, serverVersions);
+    if (agreed === null) {
+        return {
+            name: "version_negotiates",
+            status: "fail",
+            message: `no common version  client: [${SUPPORTED_VERSIONS.join(", ")}]  server: [${serverVersions.join(", ")}]`,
+            hint: "Upgrade @phosra/cli or the census to share a common OCSS spec version.",
+        };
+    }
+    return {
+        name: "version_negotiates",
+        status: "pass",
+        message: `agreed ${agreed}`,
+        data: { agreed, client: SUPPORTED_VERSIONS, server: serverVersions },
+    };
+}
+/**
+ * Check 5: full §8.3.2 + §8.3.1 sandbox provider round-trip.
+ *
+ * Calls runProviderRoundTrip (round-trip.ts) which:
+ *   1. Fetches + verifies the trust list from the sandbox census
+ *   2. Extracts the router P-256 payload key
+ *   3. Seals a consent_attestation envelope to the router
+ *   4. POSTs to /api/v1/webhooks/inbound/app-store → expects 201/200
+ *   5. Writes addictive_pattern_block citing the attestation as standing
+ *   6. Returns ok = true iff both POST calls succeeded
+ *
+ * Also cross-checks the key material: derives the household-acme public key X
+ * from the config seed and (optionally) verifies it against the trust-list entry.
+ */
+async function checkSandboxRoundTrip(cfg, resolver, fetchImpl) {
+    // ── build SenderKey from seed ──────────────────────────────────────────
+    let key;
+    try {
+        key = senderKeyFromSeedB64url(cfg.householdSeed, HOUSEHOLD_ACME_KEY_ID);
+    }
+    catch (err) {
+        return {
+            name: "sandbox_round_trip",
+            status: "fail",
+            message: `seed decode failed: ${err.message}`,
+            hint: "Check PHOSRA_HOUSEHOLD_SEED — must be a base64url-encoded 32-byte Ed25519 seed.",
+        };
+    }
+    // ── optional key-material cross-check against the trust-list ──────────
+    let keyNote = "";
+    if (resolver) {
+        try {
+            const derivedX = publicXFromSenderKey(key);
+            const tlRaw = resolver.signingKey(HOUSEHOLD_ACME_KEY_ID);
+            const tlX = b64urlRaw(tlRaw);
+            if (derivedX !== tlX) {
+                return {
+                    name: "sandbox_round_trip",
+                    status: "fail",
+                    message: `key mismatch: seed derives ${derivedX.slice(0, 10)}… ` +
+                        `but trust-list has ${tlX.slice(0, 10)}…`,
+                    hint: `PHOSRA_HOUSEHOLD_SEED does not match the trust-list entry ` +
+                        `for ${HOUSEHOLD_ACME_KEY_ID}.`,
+                };
+            }
+            keyNote = " — key verified vs trust-list";
+        }
+        catch {
+            keyNote = " — household-acme not in trust-list (sandbox may differ)";
+        }
+    }
+    // ── full §8.3.2 + §8.3.1 round-trip ────────────────────────────────
+    const rt = await runProviderRoundTrip(key, {
+        censusUrl: cfg.censusUrl,
+        trustRootX: cfg.trustRootX,
+        miaPolicyId: cfg.miaPolicyId,
+        miaChildId: cfg.miaChildId,
+        fetchImpl,
+    });
+    if (!rt.ok) {
+        return {
+            name: "sandbox_round_trip",
+            status: "fail",
+            message: rt.error ?? `consent=${rt.consentStatus} rule=${rt.ruleStatus}`,
+            hint: (rt.error?.includes("trust-list"))
+                ? "Trust-list fetch failed — check census connectivity and PHOSRA_TRUST_ROOT_X."
+                : rt.error?.includes("401")
+                    ? "The census rejected the RFC-9421 signature.  Check PHOSRA_HOUSEHOLD_SEED."
+                    : "Check census connectivity and that the sandbox Mia policy is seeded.",
+            data: {
+                trust_list_entries: rt.trustListEntries,
+                consent_status: rt.consentStatus,
+                rule_status: rt.ruleStatus,
+            },
+        };
+    }
+    return {
+        name: "sandbox_round_trip",
+        status: "pass",
+        message: `consent ${rt.consentStatus}, rule ${rt.ruleStatus}, ` +
+            `${rt.trustListEntries} trust-list entries${keyNote}`,
+        data: {
+            trust_list_entries: rt.trustListEntries,
+            consent_status: rt.consentStatus,
+            rule_status: rt.ruleStatus,
+        },
+    };
+}
+//# sourceMappingURL=doctor.js.map

package/dist/commands/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,cAAc,EACd,0BAA0B,EAC1B,SAAS,EACT,kBAAkB,EAClB,oBAAoB,EACpB,SAAS,GAGV,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAEL,UAAU,EACV,SAAS,EACT,OAAO,EACP,OAAO,GACR,MAAM,WAAW,CAAC;AAInB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAiB,EACjB,IAAa,EACb,YAAuB,KAAK;IAE5B,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAE/B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,4EAA4E;IAC5E,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAErB,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,KAAK,GAA4B;YACrC,CAAC,qBAAqB,EAAE,8BAA8B,CAAC;YACvD,CAAC,eAAe,EAAQ,8BAA8B,CAAC;YACvD,CAAC,oBAAoB,EAAG,uBAAuB,CAAC;YAChD,CAAC,oBAAoB,EAAG,8BAA8B,CAAC;SACxD,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2EAA2E;IAC3E,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAClF,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAErB,IAAI,QAA8B,CAAC;IACnC,IAAI,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAI,EAAE,CAAC,IAAmD,CAAC,GAAG,CAAC;QAC1E,IAAI,CAAC;YAAC,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAC1F,CAAC;IAED,2EAA2E;IAC3E,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC7E,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAErB,2EAA2E;IAC3E,MAAM,cAAc,GAClB,EAAE,CAAC,MAAM,KAAK,MAAM,IAAI,EAAE,CAAC,IAAI;QAC7B,CAAC,CAAE,EAAE,CAAC,IAAgC,CAAC,SAAS;QAChD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,EAAE,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAErB,2EAA2E;IAC3E,MAAM,EAAE,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAErB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AAEjF,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe;IACzC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,OAAsB,EAAE,IAAa;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC;YACR,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC;YAC7C,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC,CAAC;SACJ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,oBAAoB,CACjC,SAAiB,EACjB,SAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC1E,CAAC;QACD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB,GAAG,CAAC,MAAM,EAAE;YAC3C,IAAI,EAAE,uCAAuC,SAAS,GAAG;SAC1D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;YACnD,IAAI,EAAE,+DAA+D,SAAS,EAAE;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,UAAkB,EAClB,SAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,8BAA8B,EAAE;YACtE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,qBAAqB;gBAC3B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2CAA2C,GAAG,CAAC,MAAM,EAAE;gBAChE,IAAI,EAAE,0DAA0D;aACjE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QACpD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAI,GAAG,CAAC,KAA6B,EAAE,MAAM,IAAI,GAAG,CAAC;QACjE,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,UAAU,QAAQ,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,YAAY,MAAM,EAAE;YAChF,IAAI,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE;SACvC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;QACnC,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3E,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG;YACZ,IAAI,EAAE,cAAc;gBAClB,CAAC,CAAC,oEAAoE,UAAU,EAAE;gBAClF,CAAC,CAAC,yDAAyD;SAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,UAAkB,EAClB,SAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,gCAAgC,EAAE;YACxE,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,uDAAuD;gBAChE,IAAI,EAAE,sEAAsE;aAC7E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE;gBAC7B,IAAI,EAAE,oDAAoD;aAC3D,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmB,CAAC;QACpD,MAAM,GAAG,GAAG,0BAA0B,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gBAAgB,GAAG,CAAC,YAAY,KAAK,GAAG,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,kBAAkB,GAAG,CAAC,MAAM,EAAE;YAC5G,IAAI,EAAE;gBACJ,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,SAAS,EAAE,GAAG,CAAC,aAAa,EAAE,SAAS,IAAI,EAAE;gBAC7C,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC;aAClD;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAG,GAAa,CAAC,OAAO;YAC/B,IAAI,EAAE,mEAAmE;SAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,cAAoC;IAEpC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,iDAAiD;SAC3D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+BAA+B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAChH,IAAI,EAAE,wEAAwE;SAC/E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,UAAU,MAAM,EAAE;QAC3B,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,cAAc,EAAE;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAiB,EACjB,QAA8B,EAC9B,SAAoB;IAEpB,0EAA0E;IAC1E,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,uBAAuB,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uBAAwB,GAAa,CAAC,OAAO,EAAE;YACxD,IAAI,EACF,iFAAiF;SACpF,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;gBACrB,OAAO;oBACL,IAAI,EAAE,oBAAoB;oBAC1B,MAAM,EAAE,MAAM;oBACd,OAAO,EACL,8BAA8B,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;wBACvD,sBAAsB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG;oBAC3C,IAAI,EACF,4DAA4D;wBAC5D,OAAO,qBAAqB,GAAG;iBAClC,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,+BAA+B,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,0DAA0D,CAAC;QACvE,CAAC;IACH,CAAC;IAED,sEAAsE;IACtE,MAAM,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE;QACzC,SAAS,EAAI,GAAG,CAAC,SAAS;QAC1B,UAAU,EAAG,GAAG,CAAC,UAAU;QAC3B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAG,GAAG,CAAC,UAAU;QAC3B,SAAS;KACV,CAAC,CAAC;IAEH,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC,aAAa,SAAS,EAAE,CAAC,UAAU,EAAE;YACxE,IAAI,EACF,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAChC,CAAC,CAAC,8EAA8E;gBAChF,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;oBACzB,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,sEAAsE;YAC9E,IAAI,EAAE;gBACJ,kBAAkB,EAAE,EAAE,CAAC,gBAAgB;gBACvC,cAAc,EAAE,EAAE,CAAC,aAAa;gBAChC,WAAW,EAAE,EAAE,CAAC,UAAU;aAC3B;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,MAAM;QACd,OAAO,EACL,WAAW,EAAE,CAAC,aAAa,UAAU,EAAE,CAAC,UAAU,IAAI;YACtD,GAAG,EAAE,CAAC,gBAAgB,sBAAsB,OAAO,EAAE;QACvD,IAAI,EAAE;YACJ,kBAAkB,EAAE,EAAE,CAAC,gBAAgB;YACvC,cAAc,EAAE,EAAE,CAAC,aAAa;YAChC,WAAW,EAAE,EAAE,CAAC,UAAU;SAC3B;KACF,CAAC;AACJ,CAAC"}

package/dist/commands/gk-check.d.ts

@@ -0,0 +1,29 @@
+/**
+ * phosra gatekeeper check — platform isAllowed() against live census.
+ *
+ * Drives the @phosra/gatekeeper SDK to:
+ *   1. Refresh the trust list
+ *   2. Refresh the enforcement profile for the configured endpoint
+ *   3. Call isAllowed({ category }) → Verdict (allow / warn / block)
+ *   4. Print the verdict + optionally confirm enforcement via --confirm
+ *
+ * Required config:
+ *   PHOSRA_ENDPOINT_ID   §9.3(b) bound-resolver label (from connect ceremony)
+ *   PHOSRA_TRUST_ROOT_X  Ed25519 root public key X
+ *   PHOSRA_CENSUS_URL    Census base URL
+ *
+ * @phosra/gatekeeper is a peer / optional dependency.  If not installed, the
+ * command will prompt for it.
+ *
+ * §12.3: the CLI surfaces the verdict; the census is the safety authority.
+ * The CLI must NOT make an offline enforcement decision.
+ */
+import type { PhosraConfig } from "../config.js";
+export interface GkCheckOpts {
+    category: string;
+    endpointId?: string;
+    confirm?: "applied" | "degraded" | "refused";
+    json: boolean;
+}
+export declare function runGkCheck(cfg: PhosraConfig, opts: GkCheckOpts): Promise<void>;
+//# sourceMappingURL=gk-check.d.ts.map

package/dist/commands/gk-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gk-check.d.ts","sourceRoot":"","sources":["../../src/commands/gk-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAIjD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7C,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,IAAI,CAAC,CAuHf"}

package/dist/commands/gk-check.js

@@ -0,0 +1,134 @@
+/**
+ * phosra gatekeeper check — platform isAllowed() against live census.
+ *
+ * Drives the @phosra/gatekeeper SDK to:
+ *   1. Refresh the trust list
+ *   2. Refresh the enforcement profile for the configured endpoint
+ *   3. Call isAllowed({ category }) → Verdict (allow / warn / block)
+ *   4. Print the verdict + optionally confirm enforcement via --confirm
+ *
+ * Required config:
+ *   PHOSRA_ENDPOINT_ID   §9.3(b) bound-resolver label (from connect ceremony)
+ *   PHOSRA_TRUST_ROOT_X  Ed25519 root public key X
+ *   PHOSRA_CENSUS_URL    Census base URL
+ *
+ * @phosra/gatekeeper is a peer / optional dependency.  If not installed, the
+ * command will prompt for it.
+ *
+ * §12.3: the CLI surfaces the verdict; the census is the safety authority.
+ * The CLI must NOT make an offline enforcement decision.
+ */
+import { printJson } from "../out.js";
+import { senderKeyFromSeedB64url } from "../sender-key.js";
+import { HOUSEHOLD_ACME_KEY_ID } from "../config.js";
+export async function runGkCheck(cfg, opts) {
+    const endpointId = opts.endpointId ?? cfg.endpointId;
+    if (!endpointId) {
+        const msg = "PHOSRA_ENDPOINT_ID is required for `phosra gatekeeper check`.\n\n" +
+            "  It is the §9.3(b) bound-resolver label returned by the connect ceremony.\n" +
+            "  Set it in .phosra.env:\n" +
+            "    PHOSRA_ENDPOINT_ID=<label from connect ceremony>\n";
+        if (opts.json) {
+            printJson({ ok: false, error: "missing_endpoint_id", hint: msg });
+        }
+        else {
+            console.error("  ✘  " + msg);
+        }
+        process.exit(1);
+    }
+    // ── dynamic import of @phosra/gatekeeper ────────────────────────────────
+    let gkModule;
+    try {
+        gkModule = await import("@phosra/gatekeeper");
+    }
+    catch {
+        const msg = "`phosra gatekeeper check` requires @phosra/gatekeeper.\n\n" +
+            "  Install it:\n" +
+            "    npm install @phosra/gatekeeper\n";
+        if (opts.json) {
+            printJson({ ok: false, error: "missing_peer_dep", package: "@phosra/gatekeeper", hint: msg });
+        }
+        else {
+            console.error("  ✘  " + msg);
+        }
+        process.exit(1);
+    }
+    const { createGatekeeper } = gkModule;
+    // Build a platform signing key from the household-acme seed (sandbox demo mode).
+    // In production, the platform has its own Ed25519 key registered in the trust-list.
+    const signingKey = senderKeyFromSeedB64url(cfg.householdSeed, HOUSEHOLD_ACME_KEY_ID);
+    const gkCfg = {
+        platformDid: "did:ocss:household-acme",
+        platformKeyId: HOUSEHOLD_ACME_KEY_ID,
+        gatekeeperSigningKey: signingKey,
+        censusBaseUrl: cfg.censusUrl,
+        trustRootXB64Url: cfg.trustRootX,
+        endpointId,
+        ratingMappings: [], // no rating-mapping needed for categorical checks
+    };
+    let gk;
+    try {
+        gk = await createGatekeeper(gkCfg);
+        await gk.refreshTrustList();
+        await gk.refreshProfile(endpointId);
+    }
+    catch (err) {
+        if (opts.json) {
+            printJson({ ok: false, error: "gatekeeper_init_failed", message: err.message });
+        }
+        else {
+            console.error(`  ✘  gatekeeper init failed: ${err.message}`);
+        }
+        process.exit(1);
+    }
+    const verdict = gk.isAllowed({ endpointId, category: opts.category });
+    if (opts.json && !opts.confirm) {
+        printJson({
+            ok: true,
+            verdict: {
+                decision: verdict.decision,
+                fail_mode: verdict.failMode,
+                rule_slug: verdict.ruleSlug,
+                rule_ref: verdict.ruleRef,
+            },
+        });
+        gk.destroy();
+        return;
+    }
+    if (!opts.json) {
+        const icon = verdict.decision === "allow" ? "✔" :
+            verdict.decision === "warn" ? "⚠" : "✘";
+        console.log(`\n  ${icon}  ${opts.category}  →  ${verdict.decision.toUpperCase()}` +
+            `  (fail-mode: ${verdict.failMode})\n`);
+        if (verdict.ruleRef)
+            console.log(`     rule_ref: ${verdict.ruleRef}`);
+    }
+    // ── optional §8.3.8 confirmation ─────────────────────────────────────────
+    if (opts.confirm) {
+        try {
+            const receipt = await verdict.confirm(opts.confirm);
+            if (opts.json) {
+                printJson({
+                    ok: true,
+                    verdict: { decision: verdict.decision },
+                    confirmation: { state: opts.confirm, receipt },
+                });
+            }
+            else {
+                console.log(`  ✔  Confirmation sent (${opts.confirm})  receipt: ${receipt ? JSON.stringify(receipt).slice(0, 80) + "…" : "(none)"}\n`);
+            }
+        }
+        catch (err) {
+            if (opts.json) {
+                printJson({ ok: false, error: "confirm_failed", message: err.message });
+            }
+            else {
+                console.error(`  ✘  confirm failed: ${err.message}`);
+            }
+            gk.destroy();
+            process.exit(1);
+        }
+    }
+    gk.destroy();
+}
+//# sourceMappingURL=gk-check.js.map

package/dist/commands/gk-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gk-check.js","sourceRoot":"","sources":["../../src/commands/gk-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AASrD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,IAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,GACP,mEAAmE;YACnE,8EAA8E;YAC9E,4BAA4B;YAC5B,wDAAwD,CAAC;QAC3D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACpE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,IAAI,QAA6C,CAAC;IAClD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GACP,4DAA4D;YAC5D,iBAAiB;YACjB,sCAAsC,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;IAEtC,iFAAiF;IACjF,oFAAoF;IACpF,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAErF,MAAM,KAAK,GAAG;QACZ,WAAW,EAAW,yBAAyB;QAC/C,aAAa,EAAS,qBAAqB;QAC3C,oBAAoB,EAAE,UAAU;QAChC,aAAa,EAAS,GAAG,CAAC,SAAS;QACnC,gBAAgB,EAAM,GAAG,CAAC,UAAU;QACpC,UAAU;QACV,cAAc,EAAQ,EAAE,EAAK,kDAAkD;KAChF,CAAC;IAEF,IAAI,EAAgD,CAAC;IACrD,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;QAC5B,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,gCAAiC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEtE,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,SAAS,CAAC;YACR,EAAE,EAAE,IAAI;YACR,OAAO,EAAE;gBACP,QAAQ,EAAG,OAAO,CAAC,QAAQ;gBAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;gBAC3B,QAAQ,EAAG,OAAO,CAAC,OAAO;aAC3B;SACF,CAAC,CAAC;QACH,EAAE,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACpC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3C,OAAO,CAAC,GAAG,CACT,OAAO,IAAI,KAAK,IAAI,CAAC,QAAQ,QAAQ,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE;YACrE,iBAAiB,OAAO,CAAC,QAAQ,KAAK,CACvC,CAAC;QACF,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,SAAS,CAAC;oBACR,EAAE,EAAE,IAAI;oBACR,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;oBACvC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE;iBAC/C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,2BAA2B,IAAI,CAAC,OAAO,eACrC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,QACzD,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,wBAAyB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;YACD,EAAE,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,EAAE,CAAC,OAAO,EAAE,CAAC;AACf,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,18 @@
+/**
+ * phosra init — scaffold a .phosra.env for a partner integration.
+ *
+ * Writes a working .phosra.env in the current directory wired to the EXISTING
+ * shared sandbox DID (household-acme, 16 seeded trust-list entries) against the
+ * STAGING sandbox census — ZERO new backend required.
+ *
+ * §12.3 invariant: the scaffolded file contains only the household-acme SEED
+ * (a deterministic test key, not production key material).  It never contains
+ * production signing keys; those are Jake-gated and set only in Railway env vars.
+ */
+export declare function runInit(opts: {
+    role: "provider" | "platform";
+    force: boolean;
+    json: boolean;
+    cwd?: string;
+}): Promise<void>;
+//# sourceMappingURL=init.d.ts.map

package/dist/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAyEH,wBAAsB,OAAO,CAAC,IAAI,EAAE;IAClC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA6BhB"}

package/dist/commands/init.js

@@ -0,0 +1,90 @@
+/**
+ * phosra init — scaffold a .phosra.env for a partner integration.
+ *
+ * Writes a working .phosra.env in the current directory wired to the EXISTING
+ * shared sandbox DID (household-acme, 16 seeded trust-list entries) against the
+ * STAGING sandbox census — ZERO new backend required.
+ *
+ * §12.3 invariant: the scaffolded file contains only the household-acme SEED
+ * (a deterministic test key, not production key material).  It never contains
+ * production signing keys; those are Jake-gated and set only in Railway env vars.
+ */
+import { writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { SANDBOX_DEFAULTS, HOUSEHOLD_ACME_KEY_ID } from "../config.js";
+import { printJson } from "../out.js";
+const IS_TTY = Boolean(process.stdout.isTTY);
+const bold = (s) => IS_TTY ? `\x1b[1m${s}\x1b[0m` : s;
+const green = (s) => IS_TTY ? `\x1b[32m${s}\x1b[0m` : s;
+const red = (s) => IS_TTY ? `\x1b[31m${s}\x1b[0m` : s;
+const dim = (s) => IS_TTY ? `\x1b[2m${s}\x1b[0m` : s;
+const ENV_FILE = ".phosra.env";
+function buildEnvContent(role) {
+    const lines = [
+        "# Phosra partner integration config",
+        "# Generated by: phosra init",
+        "# Wired to the STAGING shared sandbox — run `phosra doctor` to verify",
+        "#",
+        "# ⚠  This file uses deterministic test keys (sandbox only).",
+        "#    NEVER commit to git.  Add .phosra.env to .gitignore.",
+        "",
+        "# Census URL — OCSS census API (no trailing slash)",
+        `PHOSRA_CENSUS_URL=${SANDBOX_DEFAULTS.CENSUS_URL}`,
+        "",
+        "# Trust root — Ed25519 root public key X (base64url-raw) for the sandbox",
+        `PHOSRA_TRUST_ROOT_X=${SANDBOX_DEFAULTS.TRUST_ROOT_X}`,
+        "",
+        "# Household-acme parent persona — the shared sandbox DID (16 trust-list entries)",
+        `PHOSRA_HOUSEHOLD_SEED=${SANDBOX_DEFAULTS.HOUSEHOLD_SEED}`,
+        `# Key ID: ${HOUSEHOLD_ACME_KEY_ID}`,
+        "",
+        "# Sandbox round-trip targets (seeded in the staging sandbox DB)",
+        `SANDBOX_MIA_POLICY_ID=${SANDBOX_DEFAULTS.MIA_POLICY_ID}`,
+        `SANDBOX_MIA_CHILD_ID=${SANDBOX_DEFAULTS.MIA_CHILD_ID}`,
+        "",
+        "# Allow deterministic test-key derivation (sandbox only — never production)",
+        "PHOSRA_TEST_KEYS=1",
+        "",
+        `# Integration role: ${role}`,
+        `PHOSRA_ROLE=${role}`,
+        "",
+    ];
+    if (role === "provider") {
+        lines.push("# Provider (parental-controls vendor): @phosra/link — connect → directive → confirm", "# PHOSRA_DATABASE_URL=postgresql://...  (Postgres for grant store; required for link write)", "");
+    }
+    else {
+        lines.push("# Platform: @phosra/gatekeeper — refreshProfile → isAllowed → confirm", "# PHOSRA_ENDPOINT_ID=...  (§9.3(b) bound-resolver label; returned by link connect ceremony)", "");
+    }
+    lines.push("# --- Production upgrade path ---", "# When ready for production, replace the values above with per-org material:", "# PHOSRA_CENSUS_URL=https://phosra-api-sandbox-production.up.railway.app  (or self-hosted)", "# PHOSRA_TRUST_ROOT_X=<prod root X>", "# PHOSRA_HOUSEHOLD_SEED=<your org seed from phosra onboarding>", "# PHOSRA_TEST_KEYS=0", "");
+    return lines.join("\n");
+}
+export async function runInit(opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const dest = join(cwd, ENV_FILE);
+    if (existsSync(dest) && !opts.force) {
+        if (opts.json) {
+            printJson({ ok: false, error: "file_exists", path: dest });
+        }
+        else {
+            console.error(red(`  ✘  ${ENV_FILE} already exists.  Use --force to overwrite.`));
+        }
+        process.exit(1);
+    }
+    const content = buildEnvContent(opts.role);
+    writeFileSync(dest, content, "utf-8");
+    if (opts.json) {
+        printJson({
+            ok: true,
+            path: dest,
+            role: opts.role,
+            census_url: SANDBOX_DEFAULTS.CENSUS_URL,
+            trust_root_x: SANDBOX_DEFAULTS.TRUST_ROOT_X,
+        });
+    }
+    else {
+        console.log(bold("\n  Phosra — init\n"));
+        console.log(`  ${green("✔")}  Wrote ${bold(ENV_FILE)} (role: ${opts.role})`);
+        console.log(dim(`\n  Next: run ${bold("phosra doctor")} to verify the setup end-to-end.\n`));
+    }
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7C,MAAM,IAAI,GAAI,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,GAAG,GAAK,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,GAAG,GAAK,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAE,CAAC,CAAC,CAAC,CAAC;AAEhE,MAAM,QAAQ,GAAG,aAAa,CAAC;AAE/B,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,KAAK,GAAG;QACZ,qCAAqC;QACrC,6BAA6B;QAC7B,uEAAuE;QACvE,GAAG;QACH,6DAA6D;QAC7D,2DAA2D;QAC3D,EAAE;QACF,oDAAoD;QACpD,qBAAqB,gBAAgB,CAAC,UAAU,EAAE;QAClD,EAAE;QACF,0EAA0E;QAC1E,uBAAuB,gBAAgB,CAAC,YAAY,EAAE;QACtD,EAAE;QACF,kFAAkF;QAClF,yBAAyB,gBAAgB,CAAC,cAAc,EAAE;QAC1D,aAAa,qBAAqB,EAAE;QACpC,EAAE;QACF,iEAAiE;QACjE,yBAAyB,gBAAgB,CAAC,aAAa,EAAE;QACzD,wBAAwB,gBAAgB,CAAC,YAAY,EAAE;QACvD,EAAE;QACF,6EAA6E;QAC7E,oBAAoB;QACpB,EAAE;QACF,uBAAuB,IAAI,EAAE;QAC7B,eAAe,IAAI,EAAE;QACrB,EAAE;KACH,CAAC;IAEF,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,qFAAqF,EACrF,6FAA6F,EAC7F,EAAE,CACH,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,uEAAuE,EACvE,6FAA6F,EAC7F,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,mCAAmC,EACnC,8EAA8E,EAC9E,4FAA4F,EAC5F,qCAAqC,EACrC,gEAAgE,EAChE,sBAAsB,EACtB,EAAE,CACH,CAAC;IAEF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAK7B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,QAAQ,6CAA6C,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,CAAC;YACR,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,gBAAgB,CAAC,UAAU;YACvC,YAAY,EAAE,gBAAgB,CAAC,YAAY;SAC5C,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC7E,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,eAAe,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC"}

package/dist/commands/link-write.d.ts

@@ -0,0 +1,26 @@
+/**
+ * phosra link write <category> — provider rule-write via the @phosra/link SDK.
+ *
+ * This is the "metered binding leg": the provider signs a rule on behalf of a
+ * parent's signed consent, writing it to the census.  Requires:
+ *   - PHOSRA_DATABASE_URL — Postgres connection string for the @phosra/link grant store
+ *   - PHOSRA_GRANT_ID     — active grant ID produced by the connect ceremony
+ *   - PHOSRA_CHILD_REF    — target child ref (e.g. "child:<uuid>")
+ *
+ * §12.3: the census is the safety authority.  This command drives the signed
+ * census write; it does NOT accept a rule, sign a trust-list, or hold billing
+ * authority.
+ *
+ * @phosra/link is a peer / optional dependency — the CLI core only requires
+ * @openchildsafety/ocss.  If @phosra/link is not installed this command will prompt for it.
+ */
+import type { PhosraConfig } from "../config.js";
+export interface LinkWriteOpts {
+    category: string;
+    decision: "block" | "warn" | "allow";
+    grantId: string;
+    childRef: string;
+    json: boolean;
+}
+export declare function runLinkWrite(cfg: PhosraConfig, opts: LinkWriteOpts): Promise<void>;
+//# sourceMappingURL=link-write.d.ts.map