@rentaltide/cli 0.1.1 → 0.2.0

package/README.md

@@ -36,6 +36,40 @@ installed points all of them at your laptop.
 | `webhook trigger <event>`      | Send yourself a signed webhook                                         |
 | `open [booking\|portal\|docs]` | Open a sandbox surface                                                 |
 
+## Embedded insurance
+
+An underwriter builds no iframe and holds no OAuth token — RentalTide calls
+*them*. Different world, same CLI:
+
+```bash
+rentaltide init --underwriter acme-cover
+cd acme-cover
+export SIGNING_SECRET=whsec_…          # shown once when you created the offering
+npm run dev                            # six endpoints on :8787
+
+rentaltide coverage link
+rentaltide coverage secret
+rentaltide coverage test --url http://localhost:8787
+```
+
+`coverage test` signs its requests exactly as the platform does and checks the
+rules that fail *quietly*:
+
+```
+✓ Refuses an unsigned request
+✓ Quote answers inside 800ms            2ms
+✓ Premium is a JSON number
+✓ Deposit effect is coherent
+✓ A decline is a 200 with decision: declined
+✓ Bind is idempotent on quoteId
+✓ Policy document is https
+```
+
+Then `coverage dev --url https://…` points the offering at a deployed endpoint,
+`coverage status` says what is still missing, and `coverage submit` sends it for
+review. `dev` refuses on an approved offering — repointing its base URL sends
+real renters' quotes somewhere else.
+
 ## `rentaltide.app.json`
 
 Scopes and embed locations decide what your app may read and where it renders.

package/dist/commands/coverage.js

@@ -0,0 +1,273 @@
+/**
+ * The underwriter's side of the CLI.
+ *
+ * A coverage partner builds no iframe and holds no OAuth token — we call them.
+ * So `dev` in the app sense is meaningless here, and what matters instead is
+ * being able to exercise the contract before a booking exists: sign a request
+ * the way we sign it, and be told which of the quiet rules you are breaking.
+ */
+import { request } from '../api.js';
+import { readSigningSecret, requireCoverageConfig, readCoverageConfig, saveSigningSecret, writeCoverageConfig, COVERAGE_CONFIG_FILENAME, } from '../config.js';
+import { probe } from '../coverageProbe.js';
+import { ask, bold, confirm, cyan, dim, fail, green, ok, red, say, step, warn } from '../ui.js';
+const toConfig = (provider, existing) => ({
+    providerId: provider.id,
+    name: provider.name,
+    baseUrl: provider.baseUrl,
+    supportEmail: provider.supportEmail ?? undefined,
+    countries: provider.supportedCountries || [],
+    currencies: provider.supportedCurrencies || [],
+    quoteTimeoutMs: provider.quoteTimeoutMs,
+    ...(existing?.dev ? { dev: existing.dev } : {}),
+});
+async function listProviders() {
+    const data = await request('/developer/coverage-providers');
+    return data.providers || [];
+}
+async function getProvider(providerId) {
+    const providers = await listProviders();
+    const found = providers.find((p) => p.id === providerId);
+    if (!found)
+        fail('That offering is not on your account any more.', 'Run `rentaltide coverage link`.');
+    return found;
+}
+export async function coverage(args) {
+    const [sub, ...rest] = args;
+    switch (sub) {
+        case 'link':
+            return link();
+        case 'pull':
+            return pull();
+        case 'push':
+            return push(rest);
+        case 'test':
+            return test(rest);
+        case 'dev':
+            return dev(rest);
+        case 'secret':
+            return secret();
+        case 'status':
+            return status();
+        case 'submit':
+            return submit();
+        default:
+            say(`${bold('rentaltide coverage')} <command>`);
+            say();
+            say('  link      attach this directory to one of your coverage offerings');
+            say('  pull      write the offering into rentaltide.coverage.json');
+            say('  push      apply rentaltide.coverage.json to the offering');
+            say('  test      call your endpoints exactly as RentalTide does');
+            say('  dev       point the offering at a URL while you work, restore on exit');
+            say('  secret    store the signing secret for this machine');
+            say('  status    what still has to be true before review');
+            say('  submit    submit the offering for review');
+    }
+}
+async function link() {
+    const providers = await listProviders();
+    if (providers.length === 0) {
+        fail('You have no coverage offerings yet.', 'Create one at partners.rentaltide.com → Developer → Embedded insurance.');
+    }
+    let chosen = providers[0];
+    if (providers.length > 1) {
+        providers.forEach((p, i) => say(`  ${bold(String(i + 1))}. ${p.name} ${dim(`(${p.status})`)}`));
+        const answer = await ask(`Which one? ${dim('1-' + providers.length)}`);
+        chosen = providers[Number(answer) - 1];
+        if (!chosen)
+            fail('That is not one of the options.');
+    }
+    writeCoverageConfig(toConfig(chosen, readCoverageConfig()));
+    ok(`Linked to ${chosen.name}. Wrote ${COVERAGE_CONFIG_FILENAME}.`);
+    if (!readSigningSecret(chosen.id)) {
+        say(dim('Run `rentaltide coverage secret` to store your signing secret for testing.'));
+    }
+}
+async function pull() {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const provider = await getProvider(config.providerId);
+    writeCoverageConfig(toConfig(provider, config));
+    ok(`Pulled ${provider.name} into ${COVERAGE_CONFIG_FILENAME}.`);
+}
+async function push(args) {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const before = toConfig(await getProvider(config.providerId));
+    const fields = [
+        ['name', before.name, config.name],
+        ['baseUrl', before.baseUrl, config.baseUrl],
+        ['supportEmail', before.supportEmail, config.supportEmail],
+        ['countries', before.countries.join(', '), config.countries.join(', ')],
+        ['currencies', before.currencies.join(', '), config.currencies.join(', ')],
+        ['quoteTimeoutMs', before.quoteTimeoutMs, config.quoteTimeoutMs],
+    ];
+    const changed = fields.filter(([, a, b]) => String(a ?? '') !== String(b ?? ''));
+    if (changed.length === 0) {
+        ok('Nothing to push.');
+        return;
+    }
+    say(`${bold('Changes to')} ${before.name}:`);
+    for (const [field, a, b] of changed) {
+        say(`  ${field}`);
+        say(`    ${red('-')} ${dim(String(a ?? '(none)'))}`);
+        say(`    ${green('+')} ${String(b ?? '(none)')}`);
+    }
+    // The three that send an approved offering back for review, said before it
+    // happens rather than discovered from a status badge afterwards.
+    const material = changed.filter(([field]) => ['baseUrl', 'countries', 'currencies'].includes(field));
+    if (material.length > 0) {
+        say();
+        warn('baseUrl, countries and currencies decide where renter data and money go. Changing one sends an approved offering back for review (it keeps working in sandbox).');
+    }
+    say();
+    if (!args.includes('--yes') && !(await confirm('Apply?'))) {
+        say('Nothing pushed.');
+        return;
+    }
+    await request(`/developer/coverage-providers/${config.providerId}`, {
+        method: 'PATCH',
+        body: {
+            name: config.name,
+            baseUrl: config.baseUrl,
+            supportEmail: config.supportEmail,
+            supportedCountries: config.countries,
+            supportedCurrencies: config.currencies,
+            quoteTimeoutMs: config.quoteTimeoutMs,
+        },
+    });
+    ok('Pushed.');
+}
+async function secret() {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    say(dim('RentalTide shows a signing secret once, at creation, and cannot return it again.'));
+    const value = await ask('Signing secret:', { mask: true });
+    if (!value.startsWith('whsec_')) {
+        warn('That does not look like a signing secret (they start with whsec_). Saved anyway.');
+    }
+    saveSigningSecret(config.providerId, value);
+    ok('Saved to ~/.rentaltide/credentials.json — this machine only, never the project.');
+}
+async function test(args) {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const urlFlag = args.indexOf('--url');
+    const baseUrl = (urlFlag >= 0 ? args[urlFlag + 1] : undefined) || config.dev?.baseUrl || config.baseUrl;
+    if (!baseUrl)
+        fail('No URL to test.', 'Add dev.baseUrl to rentaltide.coverage.json or pass --url.');
+    const signingSecret = readSigningSecret(config.providerId);
+    if (!signingSecret) {
+        fail('No signing secret for this offering.', 'Run `rentaltide coverage secret`, or set RENTALTIDE_SIGNING_SECRET.');
+    }
+    step(`Calling ${bold(baseUrl)} the way RentalTide does`);
+    say();
+    const results = await probe({
+        baseUrl,
+        secret: signingSecret,
+        currency: config.currencies[0] || 'USD',
+        quoteTimeoutMs: config.quoteTimeoutMs,
+    });
+    for (const result of results) {
+        const mark = result.ok ? green('✓') : red('✗');
+        const timing = result.ms !== undefined ? dim(` ${result.ms}ms`) : '';
+        say(`  ${mark} ${result.name}${timing}`);
+        if (result.detail)
+            say(`      ${dim(result.detail)}`);
+    }
+    const failed = results.filter((r) => !r.ok);
+    say();
+    if (failed.length === 0) {
+        ok(`All ${results.length} checks passed. This endpoint can serve a renter.`);
+        return;
+    }
+    // Exit non-zero so this is usable in CI.
+    say(`${red(`${failed.length} of ${results.length} checks failed.`)}`);
+    say(dim('Full contract: https://docs.rentaltide.com/developers/embedded-insurance/'));
+    process.exit(1);
+}
+async function dev(args) {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const urlFlag = args.indexOf('--url');
+    const target = (urlFlag >= 0 ? args[urlFlag + 1] : undefined) || config.dev?.baseUrl;
+    if (!target) {
+        fail('No URL to point at.', 'Pass --url https://…, or set dev.baseUrl in the config.');
+    }
+    if (!target.startsWith('https://')) {
+        // Not a preference: the platform rejects a plaintext base URL outright,
+        // because renter identity is sent to it at bind.
+        fail('A base URL must be https.', 'We sign every call to it and send renter identity at bind.');
+    }
+    const provider = await getProvider(config.providerId);
+    if (provider.status === 'approved') {
+        fail(`${provider.name} is approved and may be live in merchants' checkouts.`, 'Repointing its base URL sends real renters\u2019 quotes to your test endpoint.');
+    }
+    const previous = provider.baseUrl;
+    step(`Pointing ${provider.name} at ${bold(target)}`);
+    await request(`/developer/coverage-providers/${config.providerId}`, {
+        method: 'PATCH',
+        body: { baseUrl: target },
+    });
+    let restored = false;
+    const restore = async () => {
+        if (restored)
+            return;
+        restored = true;
+        try {
+            await request(`/developer/coverage-providers/${config.providerId}`, {
+                method: 'PATCH',
+                body: { baseUrl: previous },
+            });
+            say(`\n${dim(`Restored base URL to ${previous}.`)}`);
+        }
+        catch {
+            warn(`Could not restore the base URL. Set it back to ${previous} in the portal.`);
+        }
+    };
+    process.on('SIGINT', () => void restore().then(() => process.exit(0)));
+    process.on('SIGTERM', () => void restore().then(() => process.exit(0)));
+    say();
+    ok(`${provider.name} now quotes from ${target}.`);
+    say(`  ${dim('Sandbox locations only until the offering is approved.')}`);
+    say(`  ${cyan('rentaltide coverage test')} ${dim('exercises it without a booking.')}`);
+    say();
+    say(dim('Ctrl-C restores the base URL.'));
+    await new Promise(() => { });
+}
+async function status() {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    const provider = await getProvider(config.providerId);
+    const checks = [
+        [Boolean(provider.baseUrl), 'An https endpoint for us to call'],
+        [provider.supportedCountries.length > 0, 'At least one country you are licensed to write in'],
+        [provider.supportedCurrencies.length > 0, 'The currencies you price in'],
+        [Boolean(provider.stripeAccountId), 'A connected payout account'],
+        [Boolean(provider.supportEmail), 'A support address renters can reply to'],
+        [provider.isActive, 'Switched on'],
+    ];
+    say(`${bold(provider.name)} ${dim(`· ${provider.status}`)}`);
+    if (provider.rejectionReason)
+        say(`  ${red(provider.rejectionReason)}`);
+    say();
+    for (const [done, label] of checks) {
+        say(`  ${done ? green('✓') : dim('○')} ${label}`);
+    }
+    say();
+    say(provider.status === 'approved'
+        ? dim('Approved. Merchants can enable it for their locations.')
+        : dim('Sandbox locations only until approved. `rentaltide coverage submit` when ready.'));
+}
+async function submit() {
+    const config = requireCoverageConfig();
+    if (!config.providerId)
+        fail('Not linked yet.', 'Run `rentaltide coverage link`.');
+    await request(`/developer/coverage-providers/${config.providerId}/submit`, { method: 'POST' });
+    ok('Submitted for review. It keeps working in sandbox meanwhile.');
+}

package/dist/commands/init.js

@@ -8,19 +8,19 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { writeAppConfig } from '../config.js';
+import { writeAppConfig, writeCoverageConfig } from '../config.js';
 import { ask, bold, dim, fail, ok, say } from '../ui.js';
 const here = path.dirname(fileURLToPath(import.meta.url));
-function templateDir() {
+function templateDir(name) {
     // dist/commands/init.js → package root → templates
     const candidates = [
-        path.resolve(here, '../../templates/starter'),
-        path.resolve(here, '../templates/starter'),
+        path.resolve(here, `../../templates/${name}`),
+        path.resolve(here, `../templates/${name}`),
     ];
     for (const dir of candidates)
         if (fs.existsSync(dir))
             return dir;
-    return fail('The starter template is missing from this install of the CLI.');
+    return fail(`The ${name} template is missing from this install of the CLI.`);
 }
 function copyTree(from, to, replace) {
     fs.mkdirSync(to, { recursive: true });
@@ -37,6 +37,9 @@ function copyTree(from, to, replace) {
     }
 }
 export async function init(args) {
+    // An underwriter builds something structurally different: no iframe, no
+    // scopes, six endpoints we call. Same command, different world.
+    const underwriter = args.includes('--underwriter') || args.includes('--coverage');
     const target = args.find((a) => !a.startsWith('-'));
     const name = (await ask(`App name: ${dim('(e.g. Dock Weather)')}`)) || 'My RentalTide App';
     const slug = (await ask(`Slug: ${dim(slugify(name))}`)) || slugify(name);
@@ -44,7 +47,30 @@ export async function init(args) {
     if (fs.existsSync(dir) && fs.readdirSync(dir).length > 0) {
         fail(`${dir} already exists and is not empty.`);
     }
-    copyTree(templateDir(), dir, (body) => body.replaceAll('__APP_NAME__', name).replaceAll('__APP_SLUG__', slug));
+    copyTree(templateDir(underwriter ? 'underwriter' : 'starter'), dir, (body) => body.replaceAll('__APP_NAME__', name).replaceAll('__APP_SLUG__', slug));
+    const where = path.relative(process.cwd(), dir) || '.';
+    if (underwriter) {
+        const config = {
+            name,
+            baseUrl: 'https://example.com',
+            countries: ['US'],
+            currencies: ['USD'],
+            quoteTimeoutMs: 800,
+            dev: { baseUrl: 'http://localhost:8787' },
+        };
+        writeCoverageConfig(config, dir);
+        ok(`Created ${bold(where)}`);
+        say();
+        say('Next:');
+        say(`  ${bold(`cd ${where}`)}`);
+        say(`  ${bold('export SIGNING_SECRET=whsec_…')}  ${dim('shown once when you created the offering')}`);
+        say(`  ${bold('npm run dev')}`);
+        say(`  ${bold('rentaltide login')}`);
+        say(`  ${bold('rentaltide coverage link')}    ${dim('attach this to your offering')}`);
+        say(`  ${bold('rentaltide coverage secret')}  ${dim('store the secret for testing')}`);
+        say(`  ${bold('rentaltide coverage test')}    ${dim('call it the way RentalTide does')}`);
+        return;
+    }
     const config = {
         name,
         slug,
@@ -56,10 +82,10 @@ export async function init(args) {
         dev: { embedUrl: 'http://localhost:5173' },
     };
     writeAppConfig(config, dir);
-    ok(`Created ${bold(path.relative(process.cwd(), dir) || '.')}`);
+    ok(`Created ${bold(where)}`);
     say();
     say('Next:');
-    say(`  ${bold(`cd ${path.relative(process.cwd(), dir) || '.'}`)}`);
+    say(`  ${bold(`cd ${where}`)}`);
     say(`  ${bold('npm install')}`);
     say(`  ${bold('rentaltide login')}      ${dim('once per machine')}`);
     say(`  ${bold('rentaltide link')}       ${dim('pick the app this belongs to')}`);

package/dist/config.js

@@ -14,6 +14,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 export const CONFIG_FILENAME = 'rentaltide.app.json';
+export const COVERAGE_CONFIG_FILENAME = 'rentaltide.coverage.json';
 export const DEFAULT_API = 'https://v3.api.rentaltide.com';
 const CREDENTIALS_DIR = path.join(os.homedir(), '.rentaltide');
 const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
@@ -53,6 +54,41 @@ export function readAppConfig(cwd = process.cwd()) {
 export function writeAppConfig(config, cwd = process.cwd()) {
     fs.writeFileSync(configPath(cwd), `${JSON.stringify(config, null, 2)}\n`);
 }
+export function coverageConfigPath(cwd = process.cwd()) {
+    return path.join(cwd, COVERAGE_CONFIG_FILENAME);
+}
+export function readCoverageConfig(cwd = process.cwd()) {
+    try {
+        return JSON.parse(fs.readFileSync(coverageConfigPath(cwd), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function writeCoverageConfig(config, cwd = process.cwd()) {
+    fs.writeFileSync(coverageConfigPath(cwd), `${JSON.stringify(config, null, 2)}\n`);
+}
+export function requireCoverageConfig(cwd = process.cwd()) {
+    const config = readCoverageConfig(cwd);
+    if (!config) {
+        throw new Error(`No ${COVERAGE_CONFIG_FILENAME} here. Run \`rentaltide init --underwriter\` to start one, or \`rentaltide coverage link\` in an existing project.`);
+    }
+    return config;
+}
+export function readSigningSecret(providerId) {
+    return (process.env.RENTALTIDE_SIGNING_SECRET ||
+        readCredentials()?.signingSecrets?.[providerId] ||
+        null);
+}
+export function saveSigningSecret(providerId, secret) {
+    const credentials = readCredentials();
+    if (!credentials)
+        throw new Error('Sign in first: `rentaltide login`.');
+    writeCredentials({
+        ...credentials,
+        signingSecrets: { ...(credentials.signingSecrets || {}), [providerId]: secret },
+    });
+}
 /** The config, or a message telling them exactly what to run. */
 export function requireAppConfig(cwd = process.cwd()) {
     const config = readAppConfig(cwd);

package/dist/coverageProbe.js

@@ -0,0 +1,255 @@
+/**
+ * Call an underwriter exactly the way RentalTide does.
+ *
+ * The signature is the one part of this integration that cannot be checked by
+ * reading the docs, and before this the only way to exercise it was to make a
+ * real booking happen. Everything here mirrors
+ * `services/coverages/providerClient.ts`: the same header names, the same
+ * signed payload (`{timestamp}.{raw body}`), the same idempotency key on bind,
+ * the same deadlines.
+ *
+ * It is deliberately picky about the things that are silently wrong rather than
+ * loud: a premium sent as a string, a reducing deposit effect with no number, a
+ * bind that writes a second policy on retry.
+ */
+import crypto from 'node:crypto';
+function sign(secret, timestamp, body) {
+    return `v1=${crypto.createHmac('sha256', secret).update(`${timestamp}.${body}`).digest('hex')}`;
+}
+async function call(opts, path, payload, timeoutMs, idempotencyKey) {
+    const raw = JSON.stringify(payload);
+    const timestamp = new Date().toISOString();
+    const started = Date.now();
+    try {
+        const response = await fetch(`${opts.baseUrl.replace(/\/$/, '')}${path}`, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'X-RentalTide-Signature': sign(opts.secret, timestamp, raw),
+                'X-RentalTide-Timestamp': timestamp,
+                ...(idempotencyKey ? { 'X-RentalTide-Idempotency-Key': idempotencyKey } : {}),
+            },
+            body: raw,
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        const text = await response.text();
+        let body = null;
+        try {
+            body = text ? JSON.parse(text) : null;
+        }
+        catch {
+            body = { __unparseable: text.slice(0, 300) };
+        }
+        return { status: response.status, body, ms: Date.now() - started };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return {
+            status: 0,
+            body: null,
+            ms: Date.now() - started,
+            error: /timeout|abort/i.test(message) ? `timed out after ${timeoutMs}ms` : message,
+        };
+    }
+}
+/** An unsigned call, to prove the endpoint refuses one. */
+async function callUnsigned(opts, path, payload) {
+    try {
+        const response = await fetch(`${opts.baseUrl.replace(/\/$/, '')}${path}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify(payload),
+            signal: AbortSignal.timeout(5000),
+        });
+        return response.status;
+    }
+    catch {
+        return 0;
+    }
+}
+const money = (value) => typeof value === 'number' && Number.isFinite(value) && value >= 0;
+export async function probe(opts) {
+    const results = [];
+    const currency = opts.currency || 'USD';
+    const subtotal = opts.subtotal ?? 850;
+    const quoteDeadline = opts.quoteTimeoutMs ?? 800;
+    const starts = new Date(Date.now() + 86_400_000).toISOString();
+    const ends = new Date(Date.now() + 100_800_000).toISOString();
+    // ── 1. An unsigned request must be refused ────────────────────────────────
+    const unsignedStatus = await callUnsigned(opts, '/quote', { bookingSubtotal: subtotal });
+    results.push({
+        name: 'Refuses an unsigned request',
+        ok: unsignedStatus === 401 || unsignedStatus === 403,
+        detail: unsignedStatus === 0
+            ? 'no response'
+            : unsignedStatus === 200
+                ? 'answered 200 — anyone on the internet can quote, requote and bind as us'
+                : `answered ${unsignedStatus}`,
+    });
+    // ── 2. Quote ──────────────────────────────────────────────────────────────
+    const quoteRequest = {
+        productCode: 'hull-basic',
+        assetCategory: 'pontoon',
+        assetValue: 48000,
+        units: 1,
+        startsAt: starts,
+        endsAt: ends,
+        days: 1,
+        bookingSubtotal: subtotal,
+        securityDeposit: 2000,
+        currency,
+        region: null,
+    };
+    const quote = await call(opts, '/quote', quoteRequest, Math.max(quoteDeadline, 2000));
+    const quoteBody = (quote.body || {});
+    results.push({
+        name: 'POST /quote answers',
+        ok: quote.status === 200,
+        detail: quote.error || `HTTP ${quote.status}`,
+        request: quoteRequest,
+        response: quote.body,
+        ms: quote.ms,
+    });
+    const quoted = quote.status === 200 && typeof quoteBody.quoteId === 'string';
+    if (quoted) {
+        results.push({
+            name: `Quote answers inside ${quoteDeadline}ms`,
+            ok: quote.ms <= quoteDeadline,
+            detail: `${quote.ms}ms — a slower quote does not render, and the booking proceeds without you`,
+            ms: quote.ms,
+        });
+        results.push({
+            name: 'Premium is a JSON number',
+            ok: money(quoteBody.premium),
+            detail: typeof quoteBody.premium === 'string'
+                ? `sent "${quoteBody.premium}" as a string — rejected`
+                : `premium: ${String(quoteBody.premium)}`,
+        });
+        const effect = String(quoteBody.depositEffect ?? 'none');
+        const reducing = effect !== 'none' && effect !== 'waive';
+        results.push({
+            name: 'Deposit effect is coherent',
+            ok: !reducing || money(quoteBody.depositEffectValue),
+            detail: reducing
+                ? `${effect} with depositEffectValue ${String(quoteBody.depositEffectValue)}`
+                : effect,
+        });
+        results.push({
+            name: 'Quote carries a schema version',
+            ok: typeof quoteBody.questionSchemaVersion === 'string',
+            detail: String(quoteBody.questionSchemaVersion ?? '(none — no questions will be asked)'),
+        });
+    }
+    // ── 3. Schema ─────────────────────────────────────────────────────────────
+    const version = String(quoteBody.questionSchemaVersion ?? '');
+    if (version) {
+        const schema = await call(opts, '/schema', { version }, 5000);
+        const schemaBody = (schema.body || {});
+        const fields = Array.isArray(schemaBody.fields) ? schemaBody.fields : [];
+        results.push({
+            name: 'POST /schema answers with fields',
+            ok: schema.status === 200 && fields.length > 0,
+            detail: schema.error || `HTTP ${schema.status} · ${fields.length} field(s)`,
+            response: schema.body,
+            ms: schema.ms,
+        });
+        results.push({
+            name: 'At most 12 questions',
+            ok: fields.length <= 12,
+            detail: `${fields.length} — each one is friction at the moment somebody is deciding to pay`,
+        });
+    }
+    // ── 4. Requote ────────────────────────────────────────────────────────────
+    const quoteId = String(quoteBody.quoteId ?? '');
+    if (quoteId) {
+        const accepted = await call(opts, '/requote', {
+            quoteId,
+            basePremium: quoteBody.premium,
+            answers: { date_of_birth: '1988-03-14', prior_claims_3y: false },
+        }, 5000);
+        const acceptedBody = (accepted.body || {});
+        results.push({
+            name: 'POST /requote accepts a clean answer set',
+            ok: accepted.status === 200 && acceptedBody.decision === 'accepted',
+            detail: accepted.error || `HTTP ${accepted.status} · decision ${String(acceptedBody.decision)}`,
+            response: accepted.body,
+            ms: accepted.ms,
+        });
+        const declined = await call(opts, '/requote', { quoteId, basePremium: quoteBody.premium, answers: { date_of_birth: '2015-01-01' } }, 5000);
+        const declinedBody = (declined.body || {});
+        results.push({
+            name: 'A decline is a 200 with decision: declined',
+            ok: declined.status === 200 && ['declined', 'accepted'].includes(String(declinedBody.decision)),
+            detail: declined.status !== 200
+                ? `answered HTTP ${declined.status} — an error is not a decline, and drops the coverage silently`
+                : `decision ${String(declinedBody.decision)}`,
+            response: declined.body,
+        });
+        // ── 5. Bind, twice ──────────────────────────────────────────────────────
+        const bindRequest = {
+            quoteId,
+            bookingReference: `bkg_probe_${crypto.randomBytes(3).toString('hex')}`,
+            premiumCharged: quoteBody.premium,
+            renter: {
+                firstName: 'Probe',
+                lastName: 'Renter',
+                email: 'probe@example.invalid',
+                phone: '+14165550142',
+                dateOfBirth: '1988-03-14',
+            },
+            answers: { date_of_birth: '1988-03-14', prior_claims_3y: false },
+        };
+        const first = await call(opts, '/bind', bindRequest, 15000, quoteId);
+        const firstBody = (first.body || {});
+        results.push({
+            name: 'POST /bind issues a policy',
+            ok: first.status === 200 && typeof firstBody.policyId === 'string',
+            detail: first.error || `HTTP ${first.status} · policy ${String(firstBody.policyId)}`,
+            response: first.body,
+            ms: first.ms,
+        });
+        if (typeof firstBody.policyId === 'string') {
+            const second = await call(opts, '/bind', bindRequest, 15000, quoteId);
+            const secondBody = (second.body || {});
+            results.push({
+                name: 'Bind is idempotent on quoteId',
+                ok: secondBody.policyId === firstBody.policyId,
+                detail: secondBody.policyId === firstBody.policyId
+                    ? `retry returned ${String(firstBody.policyId)} again`
+                    : `retry issued ${String(secondBody.policyId)} — we retry on timeout, so this writes a second policy on the same booking`,
+            });
+            const documentUrl = String(firstBody.documentUrl ?? '');
+            results.push({
+                name: 'Policy document is https',
+                ok: !documentUrl || documentUrl.startsWith('https://'),
+                detail: documentUrl || '(none)',
+            });
+            // ── 6. Reschedule ─────────────────────────────────────────────────────
+            const moved = await call(opts, '/reschedule', {
+                policyId: firstBody.policyId,
+                bookingReference: bindRequest.bookingReference,
+                previousStartsAt: starts,
+                previousEndsAt: ends,
+                startsAt: new Date(Date.now() + 8 * 86_400_000).toISOString(),
+                endsAt: new Date(Date.now() + 8 * 86_400_000 + 14_400_000).toISOString(),
+                days: 1,
+            }, 10000);
+            results.push({
+                name: 'POST /reschedule answers',
+                ok: moved.status === 200,
+                detail: moved.error ||
+                    `HTTP ${moved.status} · decision ${String(moved.body?.decision ?? 'accepted')}`,
+                response: moved.body,
+            });
+            // ── 7. Cancel ─────────────────────────────────────────────────────────
+            const cancelled = await call(opts, '/cancel', { policyId: firstBody.policyId, reason: 'probe' }, 10000);
+            results.push({
+                name: 'POST /cancel answers',
+                ok: cancelled.status === 200,
+                detail: cancelled.error || `HTTP ${cancelled.status}`,
+                response: cancelled.body,
+            });
+        }
+    }
+    return results;
+}

package/dist/index.js

@@ -14,13 +14,15 @@ import { dev } from './commands/dev.js';
 import { init } from './commands/init.js';
 import { webhook } from './commands/webhook.js';
 import { open } from './commands/open.js';
+import { coverage } from './commands/coverage.js';
 import { bold, dim, say } from './ui.js';
-const VERSION = '0.1.1';
+const VERSION = '0.2.0';
 function usage() {
     say(`${bold('rentaltide')} ${dim(VERSION)} — build apps for RentalTide`);
     say();
     say(bold('  Getting started'));
     say(`    init [dir]              scaffold an app that already runs`);
+    say(`    init --underwriter      scaffold a coverage underwriter instead`);
     say(`    login                   sign in to your partner account`);
     say(`    link                    attach this directory to one of your apps`);
     say();
@@ -31,6 +33,12 @@ function usage() {
     say(`    webhook trigger <event> send yourself a signed webhook`);
     say(`    open [booking|portal|docs]`);
     say();
+    say(bold('  Embedded insurance'));
+    say(`    coverage link           attach this directory to a coverage offering`);
+    say(`    coverage test           call your endpoints the way RentalTide does`);
+    say(`    coverage dev            point the offering at a URL while you work`);
+    say(`    coverage status|submit|push|pull|secret`);
+    say();
     say(bold('  Other'));
     say(`    whoami                  who you are signed in as`);
     say(`    logout`);
@@ -60,6 +68,8 @@ async function main() {
             return webhook(args);
         case 'open':
             return open(args);
+        case 'coverage':
+            return coverage(args);
         case '--version':
         case '-v':
             say(VERSION);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rentaltide/cli",
-  "version": "0.1.1",
-  "description": "Build RentalTide apps: scaffold, run against your sandbox, push config, trigger webhooks.",
+  "version": "0.2.0",
+  "description": "Build RentalTide apps and coverage offerings: scaffold, run against your sandbox, push config, and test an underwriter the way RentalTide calls it.",
   "license": "MIT",
   "author": "RentalTide Inc.",
   "homepage": "https://docs.rentaltide.com/developers/cli/",
@@ -37,7 +37,9 @@
     "rentaltide",
     "cli",
     "apps",
-    "developer"
+    "developer",
+    "insurance",
+    "underwriter"
   ],
   "devDependencies": {
     "typescript": "^5.6.0",

package/templates/underwriter/README.md

@@ -0,0 +1,33 @@
+# __APP_NAME__
+
+A RentalTide coverage underwriter. Six endpoints, no dependencies.
+
+```bash
+export SIGNING_SECRET=whsec_...       # shown once when you created the offering
+npm run dev                           # http://localhost:8787
+
+rentaltide coverage link              # attach this directory to the offering
+rentaltide coverage secret            # store the secret for testing
+rentaltide coverage test --url http://localhost:8787
+```
+
+`coverage test` signs its requests exactly as RentalTide does and checks the
+rules that fail quietly: a premium sent as a string, a reducing deposit effect
+with no value, a bind that writes a second policy on retry, a decline returned
+as an error.
+
+When it passes, point the offering at a deployed URL and run the whole renter
+flow against your sandbox marina:
+
+```bash
+rentaltide coverage dev --url https://your-deployed-underwriter.example.com
+rentaltide coverage status            # what is still missing before review
+rentaltide coverage submit
+```
+
+- `server.mjs` — your underwriting. Replace the pricing and the questions; keep
+  the signature check.
+- `rentaltide.coverage.json` — base URL, licensed countries, currencies, quote
+  timeout. `push` applies it, `pull` brings it back.
+
+Contract: <https://docs.rentaltide.com/developers/embedded-insurance/>

package/templates/underwriter/_gitignore

@@ -0,0 +1,3 @@
+node_modules
+.env
+.DS_Store

package/templates/underwriter/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "__APP_SLUG__",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "start": "node server.mjs",
+    "dev": "node --watch server.mjs"
+  }
+}

package/templates/underwriter/server.mjs

@@ -0,0 +1,221 @@
+/**
+ * __APP_NAME__ — a RentalTide coverage underwriter.
+ *
+ * Six endpoints. RentalTide calls you; you never call a renter, never render a
+ * page, and never see a card number.
+ *
+ *   POST /quote       a boat and a time, no renter identity  → a price
+ *   POST /schema      your underwriting questions            → a field list
+ *   POST /requote     the answers                            → the final price
+ *   POST /bind        AFTER payment succeeds                 → a policy
+ *   POST /reschedule  the booking's dates moved              → does it stand
+ *   POST /cancel      cancelled or refunded                  → void it
+ *
+ * Plain Node, no dependencies, so nothing here is hidden behind a framework.
+ * Replace the pricing and the questions; keep the signature check exactly as it
+ * is — it is the only thing standing between your policies and anyone on the
+ * internet.
+ *
+ * Run it:   npm start
+ * Test it:  rentaltide coverage test --url http://localhost:8787
+ */
+
+import http from 'node:http';
+import crypto from 'node:crypto';
+
+const PORT = Number(process.env.PORT || 8787);
+const SECRET = process.env.SIGNING_SECRET || '';
+const SCHEMA_VERSION = '2026-09-01';
+
+if (!SECRET) {
+  console.error('Set SIGNING_SECRET — the secret RentalTide showed you once, at creation.');
+  process.exit(1);
+}
+
+/** Policies in memory. Use your real book of business here. */
+const policies = new Map();
+
+const round2 = (n) => Math.round((Number(n) || 0) * 100) / 100;
+
+/**
+ * Verify the signature the way RentalTide sends it.
+ *
+ * Timing-safe, and a stale timestamp is refused: a replayed bind is a second
+ * policy on somebody else's booking.
+ */
+function verify(headers, rawBody) {
+  const signature = headers['x-rentaltide-signature'] || '';
+  const timestamp = headers['x-rentaltide-timestamp'] || '';
+  if (!signature || !timestamp) return false;
+
+  const age = Date.now() - new Date(timestamp).getTime();
+  if (!Number.isFinite(age) || Math.abs(age) > 5 * 60_000) return false;
+
+  const expected =
+    'v1=' + crypto.createHmac('sha256', SECRET).update(`${timestamp}.${rawBody}`).digest('hex');
+  const a = Buffer.from(signature);
+  const b = Buffer.from(expected);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+// ── Your underwriting ───────────────────────────────────────────────────────
+
+const BASE_RATE = 0.065;
+const FLOOR = 12;
+const MINIMUM_BOOKING = 50;
+
+function priceFor({ bookingSubtotal, days }) {
+  return round2(Math.max(bookingSubtotal * BASE_RATE, FLOOR) + Math.max(0, days - 1) * 3);
+}
+
+const QUESTIONS = {
+  version: SCHEMA_VERSION,
+  fields: [
+    {
+      id: 'date_of_birth',
+      label: 'Date of birth',
+      type: 'date',
+      required: true,
+      notBefore: '1920-01-01',
+      minAgeYears: 18,
+    },
+    { id: 'boating_licence', label: 'Boating licence number', type: 'text', required: false },
+    {
+      id: 'prior_claims_3y',
+      label: 'Any claims in the last 3 years?',
+      type: 'checkbox',
+      required: false,
+    },
+  ],
+};
+
+// ── Handlers ────────────────────────────────────────────────────────────────
+
+const routes = {
+  '/quote': (body) => {
+    const subtotal = Number(body.bookingSubtotal) || 0;
+    const days = Number(body.days) || 1;
+
+    // Decline a risk you do not want rather than pricing it at zero. No card
+    // renders and the booking proceeds without you.
+    if (subtotal < MINIMUM_BOOKING) return { error: 'below_minimum' };
+
+    return {
+      // Anything you can price the same cart from twice.
+      quoteId: `q_${crypto.randomBytes(12).toString('hex')}`,
+      expiresAt: new Date(Date.now() + 30 * 60_000).toISOString(),
+      // A JSON number. "44.50" is rejected.
+      premium: priceFor({ bookingSubtotal: subtotal, days }),
+      currency: body.currency || 'USD',
+      coverageLimit: 25000,
+      // A reducing effect MUST carry a value, or it renders to the renter as a
+      // saving and then changes nothing at hold time.
+      depositEffect: 'reduce_to',
+      depositEffectValue: 500,
+      displayName: '__APP_NAME__',
+      shortDescription: 'Covers hull damage up to $25,000. Drops your deposit to $500.',
+      terms: 'Excess $500 per incident. Operator must be 18 or over.',
+      questionSchemaVersion: SCHEMA_VERSION,
+    };
+  },
+
+  '/schema': () => QUESTIONS,
+
+  '/requote': (body) => {
+    const answers = body.answers || {};
+    const quoteId = String(body.quoteId || '');
+
+    const dob = answers.date_of_birth ? new Date(String(answers.date_of_birth)) : null;
+    if (dob && !Number.isNaN(dob.getTime())) {
+      const years = (Date.now() - dob.getTime()) / (365.25 * 86_400_000);
+      // A decline is a normal outcome, and a 200. An error here drops the
+      // coverage without telling the renter why.
+      if (years < 18) {
+        return { quoteId, decision: 'declined', declineReason: 'Operator must be 18 or over.' };
+      }
+    }
+
+    const base = Number(body.basePremium) || FLOOR;
+    const premium = answers.prior_claims_3y === true ? round2(base * 1.4) : base;
+
+    return {
+      quoteId,
+      decision: 'accepted',
+      premium,
+      finalUntil: new Date(Date.now() + 30 * 60_000).toISOString(),
+    };
+  },
+
+  '/bind': (body) => {
+    const quoteId = String(body.quoteId || '');
+
+    // Idempotent on quoteId. RentalTide retries on a timeout or a 5xx, and a
+    // retry that writes a second policy bills a renter twice for one booking.
+    const existing = policies.get(quoteId);
+    if (existing) return existing;
+
+    const policyId = `POL-${crypto.randomBytes(4).toString('hex').toUpperCase()}`;
+    const policy = {
+      policyId,
+      documentUrl: `https://example.com/policies/${policyId}.pdf`, // https, always
+      effectiveAt: new Date().toISOString(),
+      expiresAt: null,
+    };
+    policies.set(quoteId, policy);
+    console.log(`bound ${policyId} for booking ${body.bookingReference}`);
+    return policy;
+  },
+
+  '/reschedule': (body) => {
+    // The booking moved after you bound it. Say whether the policy still
+    // stands; you cannot reprice here, because the renter has already paid.
+    console.log(`policy ${body.policyId} moved to ${body.startsAt}`);
+    return { decision: 'accepted' };
+  },
+
+  '/cancel': (body) => {
+    for (const [quoteId, policy] of policies.entries()) {
+      if (policy.policyId === body.policyId) policies.delete(quoteId);
+    }
+    return { cancelled: true };
+  },
+};
+
+// ── Wiring ──────────────────────────────────────────────────────────────────
+
+const server = http.createServer((req, res) => {
+  const path = (req.url || '/').split('?')[0].replace(/\/+$/, '') || '/';
+  const send = (status, body) => {
+    res.writeHead(status, { 'content-type': 'application/json' });
+    res.end(JSON.stringify(body));
+  };
+
+  if (req.method === 'GET') {
+    return send(200, path === '/schema' ? QUESTIONS : { ok: true, service: '__APP_SLUG__' });
+  }
+  if (req.method !== 'POST' || !routes[path]) return send(404, { error: 'not_found' });
+
+  let raw = '';
+  req.on('data', (chunk) => {
+    raw += chunk;
+    // Nobody sends a megabyte of quote.
+    if (raw.length > 1_000_000) req.destroy();
+  });
+  req.on('end', () => {
+    if (!verify(req.headers, raw)) return send(401, { error: 'bad_signature' });
+    let body;
+    try {
+      body = raw ? JSON.parse(raw) : {};
+    } catch {
+      return send(400, { error: 'bad_json' });
+    }
+    try {
+      send(200, routes[path](body));
+    } catch (err) {
+      console.error(err);
+      send(500, { error: 'internal' });
+    }
+  });
+});
+
+server.listen(PORT, () => console.log(`__APP_NAME__ listening on http://localhost:${PORT}`));