@phosra/cli 0.1.0

package/dist/commands/link-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-write.d.ts","sourceRoot":"","sources":["../../src/commands/link-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CA6Gf"}

package/dist/commands/link-write.js

@@ -0,0 +1,129 @@
+/**
+ * phosra link write <category> — provider rule-write via the @phosra/link SDK.
+ *
+ * This is the "metered binding leg": the provider signs a rule on behalf of a
+ * parent's signed consent, writing it to the census.  Requires:
+ *   - PHOSRA_DATABASE_URL — Postgres connection string for the @phosra/link grant store
+ *   - PHOSRA_GRANT_ID     — active grant ID produced by the connect ceremony
+ *   - PHOSRA_CHILD_REF    — target child ref (e.g. "child:<uuid>")
+ *
+ * §12.3: the census is the safety authority.  This command drives the signed
+ * census write; it does NOT accept a rule, sign a trust-list, or hold billing
+ * authority.
+ *
+ * @phosra/link is a peer / optional dependency — the CLI core only requires
+ * @openchildsafety/ocss.  If @phosra/link is not installed this command will prompt for it.
+ */
+import { printJson } from "../out.js";
+export async function runLinkWrite(cfg, opts) {
+    // ── guard: DATABASE_URL required ─────────────────────────────────────────
+    if (!cfg.databaseUrl) {
+        const msg = "PHOSRA_DATABASE_URL is required for `phosra link write` — it is the " +
+            "Postgres connection string for the @phosra/link grant store.\n\n" +
+            "  Set it in .phosra.env:\n" +
+            "    PHOSRA_DATABASE_URL=postgresql://...\n\n" +
+            "  Or in the shell:\n" +
+            "    export PHOSRA_DATABASE_URL=postgresql://...\n";
+        if (opts.json) {
+            printJson({ ok: false, error: "missing_database_url", hint: msg });
+        }
+        else {
+            console.error("  ✘  " + msg);
+        }
+        process.exit(1);
+    }
+    // ── dynamic import of @phosra/link ──────────────────────────────────────
+    let linkModule;
+    try {
+        linkModule = await import("@phosra/link");
+    }
+    catch {
+        const msg = "`phosra link write` requires @phosra/link.\n\n" +
+            "  Install it:\n" +
+            "    npm install @phosra/link\n" +
+            "  or (workspace):\n" +
+            "    npm install -w @phosra/cli @phosra/link\n";
+        if (opts.json) {
+            printJson({ ok: false, error: "missing_peer_dep", package: "@phosra/link", hint: msg });
+        }
+        else {
+            console.error("  ✘  " + msg);
+        }
+        process.exit(1);
+    }
+    // ── dynamic import of pg ─────────────────────────────────────────────────
+    let pgModule;
+    try {
+        pgModule = await import("pg");
+    }
+    catch {
+        if (opts.json) {
+            printJson({ ok: false, error: "missing_peer_dep", package: "pg" });
+        }
+        else {
+            console.error("  ✘  `phosra link write` requires pg.  Run: npm install pg");
+        }
+        process.exit(1);
+    }
+    const { Pool } = pgModule.default ?? pgModule;
+    const { directive } = linkModule;
+    // ── build config ─────────────────────────────────────────────────────────
+    const { senderKeyFromSeedB64url } = await import("../sender-key.js");
+    const { HOUSEHOLD_ACME_KEY_ID } = await import("../config.js");
+    const parentKey = senderKeyFromSeedB64url(cfg.householdSeed, HOUSEHOLD_ACME_KEY_ID);
+    // Writer key: in the CLI context the writer IS the parent persona
+    // (the CLI doesn't hold a separate provider signing key — it drives the
+    // parent's own rule-write for sandbox demos, not a provider-on-behalf-of-parent flow).
+    const pool = new Pool({ connectionString: cfg.databaseUrl });
+    const linkCfg = {
+        censusBaseUrl: cfg.censusUrl,
+        trustRootXB64Url: cfg.trustRootX,
+        parentKey,
+        writerKey: parentKey,
+        writerDid: "did:ocss:household-acme",
+        routerDid: "did:ocss:phosra-router",
+        householdSecret: cfg.householdSeed, // seed doubles as secret in sandbox
+        pool,
+    };
+    let res;
+    try {
+        res = await directive(linkCfg, opts.grantId, opts.category, opts.childRef, {
+            decision: opts.decision,
+        });
+    }
+    catch (err) {
+        await pool.end();
+        if (opts.json) {
+            printJson({ ok: false, error: "directive_failed", message: err.message });
+        }
+        else {
+            console.error(`  ✘  directive failed: ${err.message}`);
+        }
+        process.exit(1);
+    }
+    await pool.end();
+    const body = await res.text();
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        parsed = body;
+    }
+    if (opts.json) {
+        printJson({ ok: res.ok, http_status: res.status, body: parsed });
+    }
+    else {
+        const icon = res.ok ? "✔" : "✘";
+        console.log(`  ${icon}  HTTP ${res.status}  ${opts.category} → ${opts.decision}`);
+        if (!res.ok) {
+            console.error(`\n  ${JSON.stringify(parsed, null, 2)}`);
+        }
+        else {
+            console.log(`\n  ${JSON.stringify(parsed, null, 2)}`);
+        }
+    }
+    if (!res.ok)
+        process.exit(1);
+}
+//# sourceMappingURL=link-write.js.map

package/dist/commands/link-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"link-write.js","sourceRoot":"","sources":["../../src/commands/link-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAWtC,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAiB,EACjB,IAAmB;IAEnB,4EAA4E;IAC5E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,GAAG,GACP,sEAAsE;YACtE,kEAAkE;YAClE,4BAA4B;YAC5B,8CAA8C;YAC9C,sBAAsB;YACtB,mDAAmD,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,IAAI,UAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GACP,gDAAgD;YAChD,iBAAiB;YACjB,gCAAgC;YAChC,qBAAqB;YACrB,+CAA+C,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4EAA4E;IAC5E,IAAI,QAA6B,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC;IAC9C,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAEjC,4EAA4E;IAC5E,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,uBAAuB,CAAC,GAAG,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;IAEpF,kEAAkE;IAClE,wEAAwE;IACxE,uFAAuF;IACvF,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7D,MAAM,OAAO,GAAG;QACd,aAAa,EAAG,GAAG,CAAC,SAAS;QAC7B,gBAAgB,EAAE,GAAG,CAAC,UAAU;QAChC,SAAS;QACT,SAAS,EAAO,SAAS;QACzB,SAAS,EAAO,yBAAyB;QACzC,SAAS,EAAO,wBAAwB;QACxC,eAAe,EAAE,GAAG,CAAC,aAAa,EAAI,oCAAoC;QAC1E,IAAI;KACL,CAAC;IAEF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YACzE,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;IAEjB,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAE3D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC"}

package/dist/commands/register.d.ts

@@ -0,0 +1,63 @@
+/**
+ * phosra register — Phase 2a self-serve SANDBOX provider onboarding.
+ *
+ * Workflow:
+ *   1. Generate a fresh Ed25519 keypair client-side (NEVER transmitted as a secret)
+ *   2. POST {did, public_key_b64url, roles} to /api/v1/advisors/self-register
+ *   3. Verify the new DID appears on the live trust-list immediately
+ *   4. Write a .phosra.env file with the party's OWN seed + DID
+ *   5. Prove a green round-trip: consent_attestation → rule write → receipt
+ *
+ * §12.3 clean: the CLI DRIVES the census (self-registers, proves) but carries
+ * NO authority. Self-register is gated by SANDBOX_MODE=true on the census.
+ * The generated seed is written to the env file ONCE; it has the same secret
+ * threat model as any API key.
+ *
+ * NOTE: "no household-acme" means the cold party's DID is NOT household-acme.
+ * household-acme still acts as the CONSENT ISSUER (parent persona) for the
+ * rule-write standing — that is its designed sandbox role. The registered
+ * party is the WRITER (rule_write writer_ref = this party's DID).
+ */
+export interface RegisterOpts {
+    /** Census base URL (no trailing slash). Defaults to staging sandbox. */
+    apiUrl?: string;
+    /** Trust-list root public key X (base64url-raw). Defaults to staging sandbox. */
+    trustRootX?: string;
+    /** Roles to request (informational for provisional entries). Default ["editor"]. */
+    roles?: string[];
+    /** Path to write the .phosra.env file. Default: .phosra.env in cwd. */
+    out?: string;
+    /** Party slug override (lowercase alphanum + -). Default: random p<hex>. */
+    slug?: string;
+    /** Household-acme seed for the consent issuer. Default: staging sandbox default. */
+    householdSeed?: string;
+    /** Mia policy ID for the round-trip proof. Default: staging sandbox default. */
+    miaPolicyId?: string;
+    /** Mia child ID for the round-trip proof. Default: staging sandbox default. */
+    miaChildId?: string;
+    /** Injectable fetch for testing. */
+    fetchImpl?: typeof fetch;
+    /** Injectable clock for testing. */
+    now?: () => number;
+}
+export interface RegisterResult {
+    /** The newly-registered DID (e.g. "did:ocss:p3a7f1c9"). */
+    PHOSRA_DID: string;
+    /** Base64url Ed25519 seed for this party's key. KEEP SECRET. */
+    PHOSRA_SENDER_SEED_B64URL: string;
+    /** Census URL the DID was registered against. */
+    PHOSRA_CENSUS_URL: string;
+    /** Trust-list root X used. */
+    PHOSRA_TRUST_ROOT_X: string;
+    /** Path to the written .phosra.env file. */
+    envFile: string;
+}
+/**
+ * runRegister — the `phosra register` implementation.
+ *
+ * Generates a fresh DID, self-registers it on the sandbox census, verifies it
+ * on the trust-list, and proves a rule-write round-trip WITHOUT impersonating
+ * household-acme as the writer.
+ */
+export declare function runRegister(opts?: RegisterOpts): Promise<RegisterResult>;
+//# sourceMappingURL=register.d.ts.map

package/dist/commands/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiCH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,gEAAgE;IAChE,yBAAyB,EAAE,MAAM,CAAC;IAClC,iDAAiD;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAqJlF"}

package/dist/commands/register.js

@@ -0,0 +1,167 @@
+/**
+ * phosra register — Phase 2a self-serve SANDBOX provider onboarding.
+ *
+ * Workflow:
+ *   1. Generate a fresh Ed25519 keypair client-side (NEVER transmitted as a secret)
+ *   2. POST {did, public_key_b64url, roles} to /api/v1/advisors/self-register
+ *   3. Verify the new DID appears on the live trust-list immediately
+ *   4. Write a .phosra.env file with the party's OWN seed + DID
+ *   5. Prove a green round-trip: consent_attestation → rule write → receipt
+ *
+ * §12.3 clean: the CLI DRIVES the census (self-registers, proves) but carries
+ * NO authority. Self-register is gated by SANDBOX_MODE=true on the census.
+ * The generated seed is written to the env file ONCE; it has the same secret
+ * threat model as any API key.
+ *
+ * NOTE: "no household-acme" means the cold party's DID is NOT household-acme.
+ * household-acme still acts as the CONSENT ISSUER (parent persona) for the
+ * rule-write standing — that is its designed sandbox role. The registered
+ * party is the WRITER (rule_write writer_ref = this party's DID).
+ */
+import { writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { verifyDocument, fromVerifiedDocument, } from "@openchildsafety/ocss";
+import { generateKey } from "../keygen.js";
+import { senderKeyFromSeedB64url } from "../sender-key.js";
+import { CensusTransport } from "../transport.js";
+import { buildConsentAttestation } from "../envelope.js";
+import { SANDBOX_DEFAULTS, HOUSEHOLD_ACME_KEY_ID, ROUTER_DID, ROUNDTRIP_APP_DID, ROUNDTRIP_RULE_CATEGORY, } from "../config.js";
+// ── helpers ────────────────────────────────────────────────────────────────────
+/** Generate a random lowercase alphanumeric slug safe for did:ocss use. */
+function randomSlug() {
+    // 8 lowercase hex chars → 4 bytes entropy → plenty for a sandbox party DID.
+    return "p" + randomBytes(4).toString("hex"); // e.g. "p3a7f1c9"
+}
+/**
+ * runRegister — the `phosra register` implementation.
+ *
+ * Generates a fresh DID, self-registers it on the sandbox census, verifies it
+ * on the trust-list, and proves a rule-write round-trip WITHOUT impersonating
+ * household-acme as the writer.
+ */
+export async function runRegister(opts = {}) {
+    const censusUrl = opts.apiUrl ?? SANDBOX_DEFAULTS.CENSUS_URL;
+    const trustRootX = opts.trustRootX ?? SANDBOX_DEFAULTS.TRUST_ROOT_X;
+    const roles = opts.roles ?? ["editor"];
+    const outFile = opts.out ?? join(process.cwd(), ".phosra.env");
+    const slug = opts.slug ?? randomSlug();
+    const householdSeed = opts.householdSeed ?? SANDBOX_DEFAULTS.HOUSEHOLD_SEED;
+    const miaPolicyId = opts.miaPolicyId ?? SANDBOX_DEFAULTS.MIA_POLICY_ID;
+    const miaChildId = opts.miaChildId ?? SANDBOX_DEFAULTS.MIA_CHILD_ID;
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const now = opts.now ?? (() => Date.now());
+    // ── Step 1: Generate a fresh Ed25519 keypair ───────────────────────────────
+    const generated = generateKey(slug);
+    const { did, seedB64Url: senderSeed, pubXB64Url: publicKeyB64URL } = generated;
+    // ── Step 2: POST /api/v1/advisors/self-register ──────────────────────────────
+    // Canonical sandbox self-register route (#6 route split). The legacy
+    // /advisors/register shim still works for backward compat but is deprecated.
+    const regRes = await fetchImpl(`${censusUrl}/api/v1/advisors/self-register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            did,
+            public_key_b64url: publicKeyB64URL,
+            roles,
+        }),
+    });
+    if (!regRes.ok) {
+        const body = await regRes.text().catch(() => "");
+        throw new Error(`register: census returned HTTP ${regRes.status}: ${body}`);
+    }
+    const regBody = (await regRes.json());
+    if (regBody.trust_tier !== "provisional") {
+        throw new Error(`register: census returned unexpected tier ${regBody.trust_tier} (want provisional) — SECURITY VIOLATION`);
+    }
+    if (regBody.did !== did) {
+        throw new Error(`register: DID mismatch — sent ${did}, got ${regBody.did}`);
+    }
+    // ── Step 3: Verify DID appears on the trust-list immediately ──────────────
+    const tlRes = await fetchImpl(`${censusUrl}/.well-known/ocss/trust-list`);
+    if (!tlRes.ok) {
+        throw new Error(`register: trust-list fetch returned HTTP ${tlRes.status}`);
+    }
+    const signed = (await tlRes.json());
+    const doc = verifyDocument(signed, trustRootX);
+    const entry = doc.entries?.find((e) => e.did === did);
+    if (!entry) {
+        throw new Error(`register: DID ${did} not found on trust-list after registration — recompile did not fire (${doc.entries?.length ?? 0} entries)`);
+    }
+    if (entry.tier !== "provisional") {
+        throw new Error(`register: trust-list tier = ${entry.tier ?? "?"}, want provisional`);
+    }
+    // ── Step 4: Write .phosra.env ───────────────────────────────────────────────
+    // Written idempotently: overwrite if it exists (the new DID IS the new config).
+    const envContent = [
+        `# Generated by phosra register — ${new Date(now()).toISOString()}`,
+        `# This party's registered DID and signing seed. Keep PHOSRA_SENDER_SEED_B64URL secret.`,
+        `PHOSRA_DID=${did}`,
+        `PHOSRA_SENDER_SEED_B64URL=${senderSeed}`,
+        `PHOSRA_CENSUS_URL=${censusUrl}`,
+        `PHOSRA_TRUST_ROOT_X=${trustRootX}`,
+        ``,
+    ].join("\n");
+    writeFileSync(outFile, envContent, "utf-8");
+    // ── Step 5: Prove a green round-trip ───────────────────────────────────────
+    // household-acme is the CONSENT ISSUER (parent persona) — that is its sandbox role.
+    // The cold party (this DID) is the WRITER (writer_ref = this party's did).
+    const householdKeyId = HOUSEHOLD_ACME_KEY_ID;
+    const hhSenderKey = senderKeyFromSeedB64url(householdSeed, householdKeyId);
+    const coldSenderKey = senderKeyFromSeedB64url(senderSeed, generated.keyId);
+    const resolver = fromVerifiedDocument(doc, now);
+    let routerJwk;
+    try {
+        routerJwk = resolver.payloadKey(ROUTER_DID);
+    }
+    catch (e) {
+        throw new Error(`register round-trip: router payload key not found: ${String(e)}`);
+    }
+    // Step 5a: ingest a consent_attestation (signed by household-acme as consent issuer).
+    const idemSuffix = now().toString(36);
+    const consentIdemKey = `cli-register-rt-${idemSuffix}`;
+    const consentPayload = {
+        app_ref: ROUNDTRIP_APP_DID,
+        target: `child:${miaChildId}`,
+        band: "13_15",
+        consent_scope: "collection_parental_authority",
+        consent_method: `parental_consent_link:cli-register-${idemSuffix}`,
+        attested_at: new Date(now()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+        expiry: "2030-01-01T00:00:00Z",
+        idempotency_key: consentIdemKey,
+    };
+    const transport = new CensusTransport({ baseUrl: censusUrl, senderKey: hhSenderKey, fetchImpl, now });
+    const consentEnvelope = await buildConsentAttestation(consentPayload, hhSenderKey, routerJwk, censusUrl, ROUTER_DID);
+    const consentRes = await transport.post("/api/v1/webhooks/inbound/app-store", consentEnvelope);
+    if (consentRes.status !== 201 && consentRes.status !== 200) {
+        const body = await consentRes.text().catch(() => "");
+        throw new Error(`register round-trip: consent ingest ${consentRes.status}: ${body}`);
+    }
+    // Step 5b: rule write signed by the COLD PARTY's key.
+    // writer_ref = cold party's DID (not household-acme); this proves the cold party
+    // can sign census requests now that it is on the trust-list.
+    const coldTransport = new CensusTransport({ baseUrl: censusUrl, senderKey: coldSenderKey, fetchImpl, now });
+    const ruleIdemKey = `cli-register-rule-${idemSuffix}`;
+    const coldDIDStr = did.split("#")[0]; // just the DID, no fragment
+    const ruleBody = {
+        rule_category: ROUNDTRIP_RULE_CATEGORY,
+        decision: "block",
+        target: { child_ref: `child:${miaChildId}` },
+        standing_ref: `consent:attestation:${consentIdemKey}`,
+        idempotency_key: ruleIdemKey,
+        writer_ref: coldDIDStr,
+    };
+    const ruleRes = await coldTransport.post(`/api/v1/policies/${miaPolicyId}/rules`, ruleBody);
+    if (ruleRes.status !== 201 && ruleRes.status !== 200) {
+        const body = await ruleRes.text().catch(() => "");
+        throw new Error(`register round-trip: rule write as ${coldDIDStr} returned HTTP ${ruleRes.status}: ${body}`);
+    }
+    return {
+        PHOSRA_DID: did,
+        PHOSRA_SENDER_SEED_B64URL: senderSeed,
+        PHOSRA_CENSUS_URL: censusUrl,
+        PHOSRA_TRUST_ROOT_X: trustRootX,
+        envFile: outFile,
+    };
+}
+//# sourceMappingURL=register.js.map

package/dist/commands/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/commands/register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAA8B,MAAM,SAAS,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,cAAc,EACd,oBAAoB,GAGrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,UAAU,EACV,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAEtB,kFAAkF;AAElF,2EAA2E;AAC3E,SAAS,UAAU;IACjB,4EAA4E;IAC5E,OAAO,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB;AACjE,CAAC;AAwCD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAqB,EAAE;IACvD,MAAM,SAAS,GAAI,IAAI,CAAC,MAAM,IAAS,gBAAgB,CAAC,UAAU,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAK,gBAAgB,CAAC,YAAY,CAAC;IACrE,MAAM,KAAK,GAAQ,IAAI,CAAC,KAAK,IAAU,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAM,IAAI,CAAC,GAAG,IAAY,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAS,IAAI,CAAC,IAAI,IAAW,UAAU,EAAE,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,gBAAgB,CAAC,cAAc,CAAC;IAC5E,MAAM,WAAW,GAAK,IAAI,CAAC,WAAW,IAAM,gBAAgB,CAAC,aAAa,CAAC;IAC3E,MAAM,UAAU,GAAM,IAAI,CAAC,UAAU,IAAO,gBAAgB,CAAC,YAAY,CAAC;IAC1E,MAAM,SAAS,GAAI,IAAI,CAAC,SAAS,IAAM,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAU,IAAI,CAAC,GAAG,IAAY,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAE1D,8EAA8E;IAC9E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,SAAS,CAAC;IAE/E,gFAAgF;IAChF,qEAAqE;IACrE,6EAA6E;IAC7E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,gCAAgC,EAAE;QAC3E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,GAAG;YACH,iBAAiB,EAAE,eAAe;YAClC,KAAK;SACN,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAInC,CAAC;IACF,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,6CAA6C,OAAO,CAAC,UAAW,0CAA0C,CAAC,CAAC;IAC9H,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,SAAS,OAAO,CAAC,GAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,SAAS,8BAA8B,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAmB,CAAC;IACtD,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,iBAAiB,GAAG,yEAAyE,GAAG,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,WAAW,CACjI,CAAC;IACJ,CAAC;IACD,IAAK,KAA2B,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,+BAAgC,KAA2B,CAAC,IAAI,IAAI,GAAG,oBAAoB,CAAC,CAAC;IAC/G,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,UAAU,GAAG;QACjB,oCAAoC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE;QACnE,wFAAwF;QACxF,cAAc,GAAG,EAAE;QACnB,6BAA6B,UAAU,EAAE;QACzC,qBAAqB,SAAS,EAAE;QAChC,uBAAuB,UAAU,EAAE;QACnC,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE5C,8EAA8E;IAC9E,oFAAoF;IACpF,2EAA2E;IAC3E,MAAM,cAAc,GAAG,qBAAqB,CAAC;IAC7C,MAAM,WAAW,GAAc,uBAAuB,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACtF,MAAM,aAAa,GAAc,uBAAuB,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAEhD,IAAI,SAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sDAAsD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,sFAAsF;IACtF,MAAM,UAAU,GAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAI,mBAAmB,UAAU,EAAE,CAAC;IACxD,MAAM,cAAc,GAAI;QACtB,OAAO,EAAU,iBAAiB;QAClC,MAAM,EAAW,SAAS,UAAU,EAAE;QACtC,IAAI,EAAa,OAAgB;QACjC,aAAa,EAAI,+BAA+B;QAChD,cAAc,EAAG,sCAAsC,UAAU,EAAE;QACnE,WAAW,EAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;QACxE,MAAM,EAAW,sBAAsB;QACvC,eAAe,EAAE,cAAc;KAChC,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAEtG,MAAM,eAAe,GAAG,MAAM,uBAAuB,CACnD,cAAc,EACd,WAAW,EACX,SAAS,EACT,SAAS,EACT,UAAU,CACX,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,oCAAoC,EAAE,eAAe,CAAC,CAAC;IAC/F,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,sDAAsD;IACtD,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,aAAa,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5G,MAAM,WAAW,GAAK,qBAAqB,UAAU,EAAE,CAAC;IACxD,MAAM,UAAU,GAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,4BAA4B;IACtE,MAAM,QAAQ,GAAG;QACf,aAAa,EAAI,uBAAuB;QACxC,QAAQ,EAAS,OAAO;QACxB,MAAM,EAAW,EAAE,SAAS,EAAE,SAAS,UAAU,EAAE,EAAE;QACrD,YAAY,EAAK,uBAAuB,cAAc,EAAE;QACxD,eAAe,EAAE,WAAW;QAC5B,UAAU,EAAO,UAAU;KAC5B,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,oBAAoB,WAAW,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5F,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,sCAAsC,UAAU,kBAAkB,OAAO,CAAC,MAAM,KAAK,IAAI,EAAE,CAC5F,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,GAAG;QACf,yBAAyB,EAAE,UAAU;QACrC,iBAAiB,EAAE,SAAS;QAC5B,mBAAmB,EAAE,UAAU;QAC/B,OAAO,EAAE,OAAO;KACjB,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Config loading for @phosra/cli.
+ *
+ * Priority: process.env > .phosra.env file > baked-in sandbox defaults.
+ * The sandbox defaults wire to the STAGING shared sandbox DID (household-acme,
+ * 16 seeded trust-list entries) — a partner goes green with ZERO new backend.
+ */
+export declare const SANDBOX_DEFAULTS: {
+    readonly CENSUS_URL: "https://phosra-api-sandbox-staging.up.railway.app";
+    readonly TRUST_ROOT_X: "jDWZfB70DM8B3ZnPG8FQ0tnanqLgwJX4ZMr_E1Ugv3w";
+    readonly HOUSEHOLD_SEED: "aG91c2Vob2xkLWFjbWUBAQEBAQEBAQEBAQEBAQEBAQE";
+    readonly MIA_POLICY_ID: "b011c1e5-0000-4000-8000-000000000b01";
+    readonly MIA_CHILD_ID: "a11ce0fa-0000-4000-8000-0000000000a1";
+};
+/**
+ * The canonical keyID for the household-acme parent persona in the sandbox trust-list.
+ * Matches apps/sim-common/sandbox-seed.json entry "keyId": "did:ocss:household-acme#2026-06".
+ * NOTE: household-acme uses "#2026-06" (no "sandbox-" prefix) unlike jefferson-union/beacon.
+ */
+export declare const HOUSEHOLD_ACME_KEY_ID = "did:ocss:household-acme#2026-06";
+/** Router DID — the envelope intermediary for consent_attestation sealing. */
+export declare const ROUTER_DID = "did:ocss:phosra-router";
+/**
+ * app_ref for the doctor round-trip consent_attestation.
+ * Must be in the census's OCSS_CONSENT_ATTESTATION_APPS env on the staging sandbox.
+ * loopline is in the roster: "did:ocss:loopline,...".
+ */
+export declare const ROUNDTRIP_APP_DID = "did:ocss:loopline";
+/** Rule category written in the doctor round-trip. household-acme is accredited for this. */
+export declare const ROUNDTRIP_RULE_CATEGORY = "addictive_pattern_block";
+export interface PhosraConfig {
+    /** Base URL of the OCSS census (no trailing slash). */
+    censusUrl: string;
+    /** Base64url-raw Ed25519 root public key X — anchors all trust-list verification. */
+    trustRootX: string;
+    /** Base64url Ed25519 seed for the household-acme parent persona. */
+    householdSeed: string;
+    /** Optional: Postgres URL for @phosra/link grant store (link write only). */
+    databaseUrl?: string;
+    /** Optional: §9.3(b) endpoint_id_label for gatekeeper check. */
+    endpointId?: string;
+    /** When true, deterministic test-key derivation is allowed (sandbox only). */
+    testKeys: boolean;
+    /** Integration role — provider (parental-controls vendor) or platform. */
+    role?: "provider" | "platform";
+    /** Sandbox Mia policy ID for doctor probe. */
+    miaPolicyId: string;
+    /** Sandbox Mia child ID for doctor probe. */
+    miaChildId: string;
+    /**
+     * Optional: the base64url-raw Ed25519 seed for THIS party's own registered DID.
+     * Set by `phosra register` and read by `phosra doctor` to use the registered DID
+     * rather than the household-acme demo key.
+     * NOT the household-acme seed — that path is the zero-config demo only.
+     */
+    senderSeed?: string;
+    /**
+     * Optional: the registered DID for this party (e.g. "did:ocss:my-company").
+     * Set alongside senderSeed by `phosra register`.
+     */
+    did?: string;
+}
+/**
+ * Load the PhosraConfig from, in priority order:
+ *   1. process.env
+ *   2. .phosra.env in cwd (or opts.envFile)
+ *   3. baked-in sandbox defaults
+ */
+export declare function loadConfig(opts?: {
+    envFile?: string;
+}): PhosraConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH,eAAO,MAAM,gBAAgB;;;;;;CAOnB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAEvE,8EAA8E;AAC9E,eAAO,MAAM,UAAU,2BAA2B,CAAC;AAEnD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAC/B,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAiCD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,YAAY,CAqBxE"}

package/dist/config.js

@@ -0,0 +1,94 @@
+/**
+ * Config loading for @phosra/cli.
+ *
+ * Priority: process.env > .phosra.env file > baked-in sandbox defaults.
+ * The sandbox defaults wire to the STAGING shared sandbox DID (household-acme,
+ * 16 seeded trust-list entries) — a partner goes green with ZERO new backend.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+// Sandbox defaults — the STAGING shared sandbox census + household-acme DID.
+// These baked-in values let `phosra init` and `phosra doctor` work out-of-the-box
+// against the existing 16-entry trust-list without any provisioning.
+export const SANDBOX_DEFAULTS = {
+    CENSUS_URL: "https://phosra-api-sandbox-staging.up.railway.app",
+    TRUST_ROOT_X: "jDWZfB70DM8B3ZnPG8FQ0tnanqLgwJX4ZMr_E1Ugv3w",
+    HOUSEHOLD_SEED: "aG91c2Vob2xkLWFjbWUBAQEBAQEBAQEBAQEBAQEBAQE",
+    // Sandbox Mia child/policy — seeded in the staging sandbox DB (doctor probe)
+    MIA_POLICY_ID: "b011c1e5-0000-4000-8000-000000000b01",
+    MIA_CHILD_ID: "a11ce0fa-0000-4000-8000-0000000000a1",
+};
+/**
+ * The canonical keyID for the household-acme parent persona in the sandbox trust-list.
+ * Matches apps/sim-common/sandbox-seed.json entry "keyId": "did:ocss:household-acme#2026-06".
+ * NOTE: household-acme uses "#2026-06" (no "sandbox-" prefix) unlike jefferson-union/beacon.
+ */
+export const HOUSEHOLD_ACME_KEY_ID = "did:ocss:household-acme#2026-06";
+/** Router DID — the envelope intermediary for consent_attestation sealing. */
+export const ROUTER_DID = "did:ocss:phosra-router";
+/**
+ * app_ref for the doctor round-trip consent_attestation.
+ * Must be in the census's OCSS_CONSENT_ATTESTATION_APPS env on the staging sandbox.
+ * loopline is in the roster: "did:ocss:loopline,...".
+ */
+export const ROUNDTRIP_APP_DID = "did:ocss:loopline";
+/** Rule category written in the doctor round-trip. household-acme is accredited for this. */
+export const ROUNDTRIP_RULE_CATEGORY = "addictive_pattern_block";
+/**
+ * Parse a .env-style key=value file.
+ * - Skips blank lines and # comments.
+ * - Strips optional surrounding single or double quotes from values.
+ * - Tolerates missing file (returns {}).
+ */
+function parseDotenv(filePath) {
+    try {
+        const text = readFileSync(filePath, "utf-8");
+        const out = {};
+        for (const raw of text.split("\n")) {
+            const line = raw.trim();
+            if (!line || line.startsWith("#"))
+                continue;
+            const eq = line.indexOf("=");
+            if (eq < 0)
+                continue;
+            const key = line.slice(0, eq).trim();
+            let val = line.slice(eq + 1).trim();
+            if ((val.startsWith('"') && val.endsWith('"')) ||
+                (val.startsWith("'") && val.endsWith("'"))) {
+                val = val.slice(1, -1);
+            }
+            if (key)
+                out[key] = val;
+        }
+        return out;
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Load the PhosraConfig from, in priority order:
+ *   1. process.env
+ *   2. .phosra.env in cwd (or opts.envFile)
+ *   3. baked-in sandbox defaults
+ */
+export function loadConfig(opts = {}) {
+    const file = opts.envFile ?? join(process.cwd(), ".phosra.env");
+    const dot = parseDotenv(file);
+    const get = (key) => process.env[key] ?? dot[key];
+    return {
+        censusUrl: get("PHOSRA_CENSUS_URL") ?? SANDBOX_DEFAULTS.CENSUS_URL,
+        trustRootX: get("PHOSRA_TRUST_ROOT_X") ?? SANDBOX_DEFAULTS.TRUST_ROOT_X,
+        householdSeed: get("PHOSRA_HOUSEHOLD_SEED") ?? SANDBOX_DEFAULTS.HOUSEHOLD_SEED,
+        databaseUrl: get("PHOSRA_DATABASE_URL"),
+        endpointId: get("PHOSRA_ENDPOINT_ID"),
+        testKeys: (get("PHOSRA_TEST_KEYS") ?? "1") === "1",
+        role: get("PHOSRA_ROLE"),
+        miaPolicyId: get("SANDBOX_MIA_POLICY_ID") ?? SANDBOX_DEFAULTS.MIA_POLICY_ID,
+        miaChildId: get("SANDBOX_MIA_CHILD_ID") ?? SANDBOX_DEFAULTS.MIA_CHILD_ID,
+        // Phase 2a — registered DID + own seed (set by `phosra register`).
+        senderSeed: get("PHOSRA_SENDER_SEED_B64URL"),
+        did: get("PHOSRA_DID"),
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,6EAA6E;AAC7E,kFAAkF;AAClF,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,UAAU,EAAQ,mDAAmD;IACrE,YAAY,EAAM,6CAA6C;IAC/D,cAAc,EAAI,6CAA6C;IAC/D,6EAA6E;IAC7E,aAAa,EAAK,sCAAsC;IACxD,YAAY,EAAM,sCAAsC;CAChD,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAmCjE;;;;;GAKG;AACH,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAS;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,IACE,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAC1C,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC1C,CAAC;gBACD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;YACD,IAAI,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAA6B,EAAE;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAE9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAsB,EAAE,CAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAE/B,OAAO;QACL,SAAS,EAAK,GAAG,CAAC,mBAAmB,CAAC,IAAS,gBAAgB,CAAC,UAAU;QAC1E,UAAU,EAAI,GAAG,CAAC,qBAAqB,CAAC,IAAO,gBAAgB,CAAC,YAAY;QAC5E,aAAa,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,gBAAgB,CAAC,cAAc;QAC9E,WAAW,EAAG,GAAG,CAAC,qBAAqB,CAAC;QACxC,UAAU,EAAI,GAAG,CAAC,oBAAoB,CAAC;QACvC,QAAQ,EAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG;QACtD,IAAI,EAAW,GAAG,CAAC,aAAa,CAAyC;QACzE,WAAW,EAAG,GAAG,CAAC,uBAAuB,CAAC,IAAK,gBAAgB,CAAC,aAAa;QAC7E,UAAU,EAAI,GAAG,CAAC,sBAAsB,CAAC,IAAM,gBAAgB,CAAC,YAAY;QAC5E,mEAAmE;QACnE,UAAU,EAAI,GAAG,CAAC,2BAA2B,CAAC;QAC9C,GAAG,EAAW,GAAG,CAAC,YAAY,CAAC;KAChC,CAAC;AACJ,CAAC"}

package/dist/envelope.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Build a §4.2 consent_attestation OCSS envelope for the doctor round-trip.
+ *
+ * Seals the payload bytes to the router's EC P-256 payload JWK (JWE),
+ * wraps in an Outer, and signs the outer with the parent Ed25519 sender key.
+ * Mirrors @phosra/link census-client.ts sealConsentAttestation without pg.
+ *
+ * SANDBOX ONLY — called with household-acme (pre-admitted test key).
+ */
+import { type Envelope, type SenderKey, type JWK } from "@openchildsafety/ocss";
+export interface ConsentPayload {
+    app_ref: string;
+    target: string;
+    band: "under_13" | "13_15" | "16_17";
+    consent_scope: string;
+    consent_method: string;
+    attested_at: string;
+    expiry: string;
+    idempotency_key: string;
+}
+/**
+ * buildConsentAttestation seals the payload to the router and signs the outer
+ * with the parent persona key. Returns the wire-ready Envelope.
+ *
+ * @param payload        Consent attestation fields (idempotency_key must be unique per run)
+ * @param parentKey      household-acme SenderKey (signs the outer + HTTP request)
+ * @param routerJwk      Router's EC P-256 payload public key (from the trust list)
+ * @param censusBaseUrl  Census base URL — sets the envelope's `resource`
+ * @param routerDid      Router DID — sets `inner.receiver` + `outer.intermediary_audience`
+ */
+export declare function buildConsentAttestation(payload: ConsentPayload, parentKey: SenderKey, routerJwk: JWK, censusBaseUrl: string, routerDid: string): Promise<Envelope>;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../src/envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAKL,KAAK,QAAQ,EAGb,KAAK,SAAS,EACd,KAAK,GAAG,EACT,MAAM,uBAAuB,CAAC;AAa/B,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,GAAG,EACd,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,QAAQ,CAAC,CAwBnB"}