@splitin/verification-cli 0.1.0-beta.0

package/dist/cli.js

@@ -0,0 +1,941 @@
+#!/usr/bin/env node
+import { pathToFileURL, fileURLToPath } from 'url';
+import { readFileSync, existsSync, mkdirSync, writeFileSync, readdirSync } from 'fs';
+import { createServer } from 'http';
+import { join, dirname, resolve, isAbsolute } from 'path';
+import { VERIFICATION_ADAPTER_CONTRACT_VERSION, ENGINE_CONTRACT_VERSION, STANDARD_PACKAGE_CODES, STANDARD_WEBHOOK_PROTOCOLS, CANONICAL_STATUSES, createFakeAdapterForScenario, runAdapterConformance, runAdapterConformanceScenarios, majorsCompatible } from '@splitin/verification-adapter-sdk';
+
+// src/argv.ts
+var COMMANDS_WITH_SUBCOMMAND = /* @__PURE__ */ new Set(["config", "db", "provider", "registry", "release"]);
+function parseArgv(argv) {
+  const tokens = argv.slice(2);
+  const flags = {};
+  const rest = [];
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token === "--") {
+      rest.push(...tokens.slice(index + 1));
+      break;
+    }
+    if (token.startsWith("--")) {
+      const eq = token.indexOf("=");
+      if (eq !== -1) {
+        flags[token.slice(2, eq)] = token.slice(eq + 1);
+        continue;
+      }
+      const key = token.slice(2);
+      const next = tokens[index + 1];
+      if (next && !next.startsWith("-")) {
+        flags[key] = next;
+        index += 1;
+      } else {
+        flags[key] = true;
+      }
+      continue;
+    }
+    if (token.startsWith("-") && token.length === 2) {
+      const key = token.slice(1);
+      const next = tokens[index + 1];
+      if (next && !next.startsWith("-")) {
+        flags[key] = next;
+        index += 1;
+      } else {
+        flags[key] = true;
+      }
+      continue;
+    }
+    rest.push(token);
+  }
+  const command = rest[0] ?? "help";
+  let subcommand = null;
+  let positionals = rest.slice(1);
+  if (COMMANDS_WITH_SUBCOMMAND.has(command) && positionals[0] && !positionals[0].startsWith("-")) {
+    subcommand = positionals[0];
+    positionals = positionals.slice(1);
+  }
+  if (flags.help === true || flags.h === true) {
+    return { command: command === "help" ? "help" : command, subcommand, positionals, flags: { ...flags, help: true } };
+  }
+  return { command, subcommand, positionals, flags };
+}
+function flagString(flags, name, fallback = "") {
+  const value = flags[name];
+  return typeof value === "string" ? value : fallback;
+}
+function flagBoolean(flags, name) {
+  return flags[name] === true || flags[name] === "true" || flags[name] === "1";
+}
+
+// src/redact.ts
+var SECRET_PREFIX = /\b((?:sk_|rk_|whsec_)[A-Za-z0-9_-]+)/g;
+var TOKEN_ASSIGNMENT = /(\b(?:token|access_token|refresh_token|id_token|api[_-]?key|client[_-]?secret|private[_-]?key|signing[_-]?secret)\b\s*[:=]\s*)(["']?)([^\s"',}]+)\2/gi;
+var BEARER = /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._~+/-]+=*/g;
+function redactSecrets(value) {
+  return value.replace(BEARER, "Bearer ***").replace(JWT, "***").replace(SECRET_PREFIX, (_, match) => `${match.slice(0, match.indexOf("_") + 1)}***`).replace(TOKEN_ASSIGNMENT, (_, prefix, quote) => `${prefix}${quote}***${quote}`);
+}
+function redactValue(value) {
+  if (typeof value === "string") return redactSecrets(value);
+  if (Array.isArray(value)) return value.map(redactValue);
+  if (value && typeof value === "object") {
+    const entries = Object.entries(value).map(([key, nested]) => {
+      if (isSecretKey(key) && typeof nested === "string" && nested.length > 0) {
+        return [key, redactSecrets(nested) === nested ? "***" : redactSecrets(nested)];
+      }
+      return [key, redactValue(nested)];
+    });
+    return Object.fromEntries(entries);
+  }
+  return value;
+}
+function isSecretKey(key) {
+  return /secret|token|password|authorization|api[_-]?key|private[_-]?key|signing/i.test(key);
+}
+
+// src/config.ts
+var CONFIG_FILE_NAME = "verification.config.json";
+var CLI_VERSION = "0.1.0-beta.0";
+function defaultConfig() {
+  return {
+    contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,
+    engineCompatibility: ENGINE_CONTRACT_VERSION,
+    environment: "sandbox",
+    productionEnabled: false,
+    productionRoutesEnabled: false,
+    database: {
+      url: "",
+      schema: "verification",
+      migrationsDirectory: "migrations/verification"
+    },
+    webhooks: {
+      publicBaseUrl: "",
+      toleranceSeconds: 300
+    },
+    browser: {
+      publishableKeys: {}
+    },
+    routing: {
+      defaultProvider: "test_fake",
+      rules: [{ packageCode: "human_idv", provider: "test_fake", countryCode: "US" }]
+    },
+    providers: {
+      test_fake: disabledProvider("sandbox", "fake-1"),
+      stripe_identity: disabledProvider("sandbox", "2024-06-20"),
+      persona: disabledProvider("sandbox", "2023-01-05"),
+      plaid_idv: disabledProvider("sandbox", "2020-09-14")
+    }
+  };
+}
+function disabledProvider(environment, apiVersion) {
+  return {
+    enabled: false,
+    environment,
+    secretKey: "",
+    webhookSecret: "",
+    publishableKey: "",
+    apiVersion
+  };
+}
+function configPath(cwd) {
+  return join(cwd, CONFIG_FILE_NAME);
+}
+function loadConfig(cwd) {
+  const path = configPath(cwd);
+  if (!existsSync(path)) {
+    throw new Error(`Missing ${CONFIG_FILE_NAME}. Run \`splitin-verification init\` first.`);
+  }
+  const parsed = JSON.parse(readFileSync(path, "utf8"));
+  return { ...defaultConfig(), ...parsed, providers: { ...defaultConfig().providers, ...parsed.providers } };
+}
+function writeConfig(cwd, config) {
+  const path = configPath(cwd);
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, "utf8");
+  return path;
+}
+function safeConfigView(config) {
+  return redactValue(config);
+}
+function validateCompatibility(config) {
+  const issues = [];
+  if (config.contractVersion !== VERIFICATION_ADAPTER_CONTRACT_VERSION) {
+    issues.push({
+      code: "contract_version",
+      message: `Config contract ${config.contractVersion} does not match SDK ${VERIFICATION_ADAPTER_CONTRACT_VERSION}.`
+    });
+  }
+  if (!majorsCompatible(config.engineCompatibility, ENGINE_CONTRACT_VERSION)) {
+    issues.push({
+      code: "engine_incompatible",
+      message: `Engine compatibility ${config.engineCompatibility} is not compatible with ${ENGINE_CONTRACT_VERSION}.`
+    });
+  }
+  if (config.productionEnabled || config.productionRoutesEnabled || config.environment === "production") {
+    issues.push({
+      code: "production_disabled",
+      message: "Production routes and production environment are disabled until sandbox certification."
+    });
+  }
+  return issues;
+}
+function validateProviderCredentials(config) {
+  const issues = [];
+  for (const [provider, credentials] of Object.entries(config.providers)) {
+    if (!credentials.enabled) continue;
+    if (credentials.environment === "production" || looksLikeLiveSecret(credentials.secretKey)) {
+      issues.push({
+        provider,
+        code: "production_credential_blocked",
+        message: `Provider "${provider}" has a live or production credential. The CLI never creates billable production attempts.`
+      });
+    }
+    if (credentials.secretKey && !looksLikeSandboxSecret(credentials.secretKey) && !looksLikeLiveSecret(credentials.secretKey)) {
+      issues.push({
+        provider,
+        code: "unrecognized_secret_prefix",
+        message: `Provider "${provider}" secret does not use a recognized sandbox prefix. Values are never printed.`
+      });
+    }
+    if (credentials.webhookSecret && !credentials.webhookSecret.startsWith("whsec_") && provider !== "test_fake") {
+      issues.push({
+        provider,
+        code: "webhook_secret_shape",
+        message: `Provider "${provider}" webhook secret should use a sandbox webhook prefix. The value is not printed.`
+      });
+    }
+    if (!credentials.apiVersion.trim()) {
+      issues.push({
+        provider,
+        code: "api_version_missing",
+        message: `Provider "${provider}" is missing a pinned API version.`
+      });
+    }
+  }
+  return issues;
+}
+function looksLikeLiveSecret(value) {
+  return /^(?:sk_live_|rk_live_)/.test(value) || value.startsWith("sk_") && !value.includes("test");
+}
+function looksLikeSandboxSecret(value) {
+  return /^(?:sk_test_|rk_test_|test_|sandbox_)/.test(value) || value.startsWith("whsec_test");
+}
+function resolveCwd(flags) {
+  const cwd = flags.cwd ?? flags.C;
+  return resolve(typeof cwd === "string" && cwd.length > 0 ? cwd : process.cwd());
+}
+function writeText(path, contents) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, contents, "utf8");
+}
+function envExample() {
+  return `# SplitIn verification adapter SDK \u2014 development placeholders only.
+# Production is disabled. Never commit real secrets.
+
+VERIFICATION_ENVIRONMENT=sandbox
+VERIFICATION_PRODUCTION_ENABLED=false
+VERIFICATION_PRODUCTION_ROUTES_ENABLED=false
+
+DATABASE_URL=
+VERIFICATION_DATABASE_SCHEMA=verification
+
+STRIPE_IDENTITY_SECRET_KEY=
+STRIPE_IDENTITY_WEBHOOK_SECRET=
+STRIPE_IDENTITY_PUBLISHABLE_KEY=
+
+PERSONA_API_KEY=
+PERSONA_WEBHOOK_SECRET=
+
+PLAID_CLIENT_ID=
+PLAID_SECRET=
+PLAID_WEBHOOK_SECRET=
+
+VERIFICATION_WEBHOOK_PUBLIC_BASE_URL=
+VERIFICATION_BROWSER_PUBLISHABLE_KEY=
+`;
+}
+var MIGRATION_FILES = [
+  { version: "001", name: "init" },
+  { version: "002", name: "seed" },
+  { version: "003", name: "retention" }
+];
+function migrationsDirectory() {
+  const here = dirname(fileURLToPath(import.meta.url));
+  const candidates = [
+    join(here, "..", "migrations"),
+    join(here, "..", "..", "verification-postgres", "migrations")
+  ];
+  for (const directory of candidates) {
+    if (existsSync(join(directory, "001_init.sql"))) return directory;
+  }
+  throw new Error("Bundled verification SQL migrations were not found.");
+}
+function loadBundledMigrations() {
+  const directory = migrationsDirectory();
+  return MIGRATION_FILES.map((item) => ({
+    version: item.version,
+    name: item.name,
+    up: readFileSync(join(directory, `${item.version}_${item.name}.sql`), "utf8"),
+    down: readFileSync(join(directory, `${item.version}_${item.name}.down.sql`), "utf8")
+  }));
+}
+var bundledMigrations = loadBundledMigrations();
+var STATE_FILE = ".verification/migrations-state.json";
+function statePath(cwd) {
+  return join(cwd, STATE_FILE);
+}
+function readState(cwd) {
+  const path = statePath(cwd);
+  if (!existsSync(path)) return { applied: [] };
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+function writeState(cwd, state) {
+  mkdirSync(join(cwd, ".verification"), { recursive: true });
+  writeFileSync(statePath(cwd), `${JSON.stringify(state, null, 2)}
+`, "utf8");
+}
+function writeMigrationFiles(cwd, config) {
+  const directory = join(cwd, config.database.migrationsDirectory);
+  mkdirSync(directory, { recursive: true });
+  for (const migration of bundledMigrations) {
+    writeFileSync(join(directory, `${migration.version}_${migration.name}.up.sql`), migration.up, "utf8");
+    writeFileSync(join(directory, `${migration.version}_${migration.name}.down.sql`), migration.down, "utf8");
+  }
+  return directory;
+}
+function migrateUp(cwd, config) {
+  writeMigrationFiles(cwd, config);
+  const state = readState(cwd);
+  const applied = [];
+  const sql = [];
+  for (const migration of bundledMigrations) {
+    if (state.applied.includes(migration.version)) continue;
+    sql.push(migration.up);
+    state.applied.push(migration.version);
+    applied.push(`${migration.version}_${migration.name}`);
+  }
+  writeState(cwd, state);
+  return { applied, sql };
+}
+function migrateDown(cwd, config) {
+  writeMigrationFiles(cwd, config);
+  const state = readState(cwd);
+  const version = state.applied.at(-1);
+  if (!version) return { rolledBack: null, sql: [] };
+  const migration = bundledMigrations.find((item) => item.version === version);
+  if (!migration) return { rolledBack: null, sql: [] };
+  state.applied = state.applied.filter((item) => item !== version);
+  writeState(cwd, state);
+  return { rolledBack: `${migration.version}_${migration.name}`, sql: [migration.down] };
+}
+function appliedMigrations(cwd) {
+  return readState(cwd).applied;
+}
+function listedMigrationFiles(cwd, config) {
+  const directory = join(cwd, config.database.migrationsDirectory);
+  if (!existsSync(directory)) return [];
+  return readdirSync(directory).filter((name) => name.endsWith(".sql")).sort();
+}
+var SCAFFOLD_PACKAGE = "com.example.employee_check";
+var SCAFFOLD_PROVIDER = "example_employee_check";
+function scaffoldProvider(cwd, directory = `adapters/${SCAFFOLD_PROVIDER}`) {
+  const root = join(cwd, directory);
+  writeText(join(root, "package.json"), `${JSON.stringify({
+    name: `@example/${SCAFFOLD_PROVIDER}`,
+    version: "0.1.0-beta.0",
+    private: true,
+    type: "module",
+    license: "MIT",
+    description: `Fourth-party verification adapter stub for ${SCAFFOLD_PACKAGE}.`,
+    main: "./src/index.ts",
+    dependencies: {
+      "@splitin/verification-adapter-sdk": "0.1.0-beta.0"
+    }
+  }, null, 2)}
+`);
+  writeText(join(root, "README.md"), `# Example employee-check adapter
+
+Fourth-party adapter stub. Package code: \`${SCAFFOLD_PACKAGE}\`.
+
+This adapter is sandbox-only. Production routes stay disabled until you run
+\`splitin-verification provider conformance\` against a non-billable fake or
+sandbox fixture.
+
+\`\`\`ts
+import { ExampleEmployeeCheckAdapter } from './src/index.ts';
+\`\`\`
+`);
+  writeText(join(root, "src/manifest.ts"), `import {
+  defineProviderManifest,
+  emptyConfigurationSchema,
+  VERIFICATION_ADAPTER_CONTRACT_VERSION,
+} from '@splitin/verification-adapter-sdk';
+
+export const exampleEmployeeCheckManifest = defineProviderManifest({
+  contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,
+  adapterVersion: '1.0.0',
+  engineCompatibility: '1.0.0',
+  provider: '${SCAFFOLD_PROVIDER}',
+  displayName: 'Example Employee Check',
+  description: 'Fourth-party adapter stub. Replace the retrieve mapping before production.',
+  supportedPackages: ['${SCAFFOLD_PACKAGE}'],
+  supportedCountries: ['US'],
+  environments: ['sandbox'],
+  capabilities: {
+    presentations: ['hosted'],
+    canResume: true,
+    canRetry: true,
+    canCancel: true,
+    canRedact: true,
+  },
+  launcherKeys: ['hosted'],
+  launchPresentations: ['hosted'],
+  configurationSchemaVersion: 'urn:example:employee-check:config:v1',
+  configurationSchema: emptyConfigurationSchema,
+  webhook: { protocol: 'none', eventFamilies: ['employee_check'] },
+  dataPolicy: {
+    classifications: ['normalized_status'],
+    prohibitedPersistence: ['raw_webhook', 'launch_secret', 'document', 'selfie'],
+    rawPayloadPersistence: false,
+    browserSecretPersistence: false,
+    governmentIdentifierPersistence: false,
+  },
+  retry: { sameResourceWhenResumable: true, newAttemptAfterTerminal: true },
+  cancellation: { supported: true, terminal: true },
+  redaction: { supported: true, asynchronous: false },
+  apiHosts: ['127.0.0.1'],
+  testedApiVersions: ['example-1'],
+});
+`);
+  writeText(join(root, "src/index.ts"), `import type {
+  NormalizedProviderEvent,
+  NormalizedProviderSnapshot,
+  ProviderAttemptCommand,
+  ProviderAttemptResult,
+  ProviderLaunchEnvelope,
+  ProviderOperationResult,
+  ProviderRedactionCommand,
+  ProviderRedactionResult,
+  ProviderResourceCommand,
+  ProviderRetryCommand,
+  ProviderRuntimeContext,
+  VerificationAdapterV1,
+  VerifiedWebhookEnvelope,
+} from '@splitin/verification-adapter-sdk';
+import {
+  ProviderError,
+  VERIFICATION_ADAPTER_CONTRACT_VERSION,
+  createDefaultRuntime,
+} from '@splitin/verification-adapter-sdk';
+import { exampleEmployeeCheckManifest } from './manifest.ts';
+
+export class ExampleEmployeeCheckAdapter implements VerificationAdapterV1<Record<string, never>> {
+  readonly contractVersion = VERIFICATION_ADAPTER_CONTRACT_VERSION;
+  readonly manifest = exampleEmployeeCheckManifest;
+  readonly provider = '${SCAFFOLD_PROVIDER}';
+  readonly environment = 'sandbox' as const;
+  readonly runtime: ProviderRuntimeContext<Record<string, never>>;
+
+  constructor(runtime?: ProviderRuntimeContext<Record<string, never>>) {
+    this.runtime = runtime ?? createDefaultRuntime('sandbox', {}, { allowedHosts: ['127.0.0.1'] });
+  }
+
+  validateConfiguration(): void {
+    if (this.runtime.environment !== 'sandbox') {
+      throw new ProviderError('INVALID_CONFIGURATION', 'The example adapter is sandbox-only.');
+    }
+  }
+
+  async createAttempt(command: ProviderAttemptCommand): Promise<ProviderAttemptResult> {
+    if (command.packageCode !== '${SCAFFOLD_PACKAGE}') {
+      throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This adapter only serves ${SCAFFOLD_PACKAGE}.');
+    }
+    const providerResourceId = \`eec_\${command.attemptId.replace(/[^a-zA-Z0-9]/g, '')}\`;
+    return {
+      attemptId: command.attemptId,
+      providerResourceId,
+      providerStatus: 'pending_user_input',
+      canonicalStatus: 'pending_user_input',
+      launch: this.launch(command.attemptId),
+    };
+  }
+
+  async resumeAttempt(command: ProviderResourceCommand): Promise<ProviderLaunchEnvelope> {
+    return this.launch(command.attemptId);
+  }
+
+  async retrieveAttempt(command: ProviderResourceCommand): Promise<NormalizedProviderSnapshot> {
+    return {
+      providerResourceId: command.providerResourceId,
+      providerStatus: 'pending_user_input',
+      canonicalStatus: 'pending_user_input',
+      occurredAt: this.runtime.now().toISOString(),
+      normalizedReasonCodes: [],
+      safeMetadata: { package: '${SCAFFOLD_PACKAGE}' },
+    };
+  }
+
+  async retryAttempt(command: ProviderRetryCommand): Promise<ProviderAttemptResult> {
+    return this.createAttempt({ ...command, attemptId: \`\${command.attemptId}_retry\` });
+  }
+
+  async cancelAttempt(): Promise<ProviderOperationResult> {
+    return { accepted: true, providerStatus: 'canceled', canonicalStatus: 'canceled' };
+  }
+
+  async redactSubject(_command: ProviderRedactionCommand): Promise<ProviderRedactionResult> {
+    return { completed: true, retryable: false, disposition: 'redacted' };
+  }
+
+  async verifyWebhook(): Promise<VerifiedWebhookEnvelope> {
+    throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This stub does not receive webhooks.', {
+      safeCode: 'webhooks_not_supported',
+    });
+  }
+
+  async normalizeWebhook(_input: VerifiedWebhookEnvelope): Promise<NormalizedProviderEvent> {
+    throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This stub does not receive webhooks.', {
+      safeCode: 'webhooks_not_supported',
+    });
+  }
+
+  private launch(attemptId: string): ProviderLaunchEnvelope {
+    return {
+      attemptId,
+      canonicalStatus: 'pending_user_input',
+      launcherKey: 'hosted',
+      presentation: 'hosted',
+      hostedUrl: 'https://127.0.0.1/example-employee-check',
+      continuationReference: \`cont_\${attemptId}\`,
+    };
+  }
+}
+`);
+  return root;
+}
+
+// src/commands.ts
+async function dispatch(parsed) {
+  if (parsed.flags.help === true || parsed.command === "help" || parsed.command === "--help") {
+    return ok(usage());
+  }
+  if (parsed.command === "version" || parsed.flags.version === true || parsed.flags.v === true) {
+    return ok(`${CLI_VERSION}
+`);
+  }
+  switch (parsed.command) {
+    case "init":
+      return cmdInit(parsed);
+    case "config":
+      return parsed.subcommand === "validate" ? cmdConfigValidate(parsed) : fail(`Unknown config command. Use \`config validate\`.
+`);
+    case "doctor":
+      return cmdDoctor(parsed);
+    case "db":
+      if (parsed.subcommand === "migrate") return cmdDbMigrate(parsed);
+      if (parsed.subcommand === "rollback") return cmdDbRollback(parsed);
+      return fail("Unknown db command. Use `db migrate` or `db rollback`.\n");
+    case "provider":
+      if (parsed.subcommand === "scaffold") return cmdProviderScaffold(parsed);
+      if (parsed.subcommand === "conformance") return cmdProviderConformance(parsed);
+      return fail("Unknown provider command. Use `provider scaffold` or `provider conformance`.\n");
+    case "registry":
+      return parsed.subcommand === "generate" ? cmdRegistryGenerate(parsed) : fail("Unknown registry command. Use `registry generate`.\n");
+    case "dev":
+      return cmdDev(parsed);
+    case "release":
+      return parsed.subcommand === "verify" ? cmdReleaseVerify(parsed) : fail("Unknown release command. Use `release verify`.\n");
+    default:
+      return fail(`Unknown command "${parsed.command}".
+
+${usage()}`);
+  }
+}
+function cmdInit(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const force = flagBoolean(parsed.flags, "force");
+  const config = defaultConfig();
+  const path = join(cwd, "verification.config.json");
+  if (existsSync(path) && !force) {
+    return fail(`Refusing to overwrite ${path}. Pass --force to replace it.
+`);
+  }
+  writeConfig(cwd, config);
+  writeText(join(cwd, ".env.example"), envExample());
+  writeText(join(cwd, "src/generated/.gitkeep"), "");
+  const stdout = [
+    "Initialized a disabled-by-default development configuration.",
+    `Wrote ${path}`,
+    "Wrote .env.example (empty placeholders only).",
+    "productionEnabled=false productionRoutesEnabled=false environment=sandbox",
+    "Fill sandbox credentials locally. The CLI redacts provider secrets and tokens.",
+    "Next: splitin-verification config validate && splitin-verification doctor",
+    ""
+  ].join("\n");
+  return ok(stdout);
+}
+function cmdConfigValidate(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  const compatibility = validateCompatibility(config);
+  const credentials = validateProviderCredentials(config);
+  const view = JSON.stringify(safeConfigView(config), null, 2);
+  const lines = [
+    `contractVersion=${config.contractVersion} engineCompatibility=${config.engineCompatibility}`,
+    `productionEnabled=${config.productionEnabled} productionRoutesEnabled=${config.productionRoutesEnabled}`,
+    "Credential check is shape-only. No Identity session, Persona inquiry, or Plaid IDV attempt is created.",
+    view
+  ];
+  if (compatibility.length || credentials.length) {
+    for (const issue of compatibility) lines.push(`ERROR ${issue.code}: ${issue.message}`);
+    for (const issue of credentials) lines.push(`ERROR ${issue.provider}/${issue.code}: ${issue.message}`);
+    return { exitCode: 1, stdout: redactSecrets(`${lines.join("\n")}
+`), stderr: "" };
+  }
+  lines.push("Configuration is valid for sandbox development.");
+  return ok(`${lines.join("\n")}
+`);
+}
+function cmdDoctor(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  const checks = [
+    diagnoseDatabase(config, cwd),
+    diagnoseWebhooks(config),
+    diagnoseProviders(config),
+    diagnoseBrowserKeys(config),
+    diagnoseRouting(config)
+  ];
+  const lines = ["Verification adapter doctor", ...checks.map((check) => `${check.ok ? "ok" : "fail"}  ${check.name}: ${check.detail}`)];
+  const failed = checks.some((check) => !check.ok);
+  return { exitCode: failed ? 1 : 0, stdout: redactSecrets(`${lines.join("\n")}
+`), stderr: "" };
+}
+function diagnoseDatabase(config, cwd) {
+  const applied = appliedMigrations(cwd);
+  if (!config.database.schema) {
+    return { ok: false, name: "database", detail: "Schema name is empty." };
+  }
+  if (!config.database.url) {
+    return {
+      ok: true,
+      name: "database",
+      detail: `No DATABASE_URL. Schema "${config.database.schema}" is configured. Applied local revisions: ${applied.join(", ") || "none"}.`
+    };
+  }
+  try {
+    const url = new URL(config.database.url);
+    return {
+      ok: url.protocol === "postgres:" || url.protocol === "postgresql:",
+      name: "database",
+      detail: `Host ${url.hostname} schema ${config.database.schema}. Doctor does not open a live connection or run SQL.`
+    };
+  } catch {
+    return { ok: false, name: "database", detail: "DATABASE_URL is not a valid URL. The value is not printed." };
+  }
+}
+function diagnoseWebhooks(config) {
+  if (!config.webhooks.publicBaseUrl) {
+    return { ok: true, name: "webhook", detail: "Public webhook base URL is unset (expected for local sandbox)." };
+  }
+  try {
+    const url = new URL(config.webhooks.publicBaseUrl);
+    const okHttps = url.protocol === "https:" || url.hostname === "127.0.0.1" || url.hostname === "localhost";
+    return {
+      ok: okHttps,
+      name: "webhook",
+      detail: okHttps ? `Endpoint origin ${url.origin} tolerance=${config.webhooks.toleranceSeconds}s.` : "Webhook public URL must be HTTPS or loopback."
+    };
+  } catch {
+    return { ok: false, name: "webhook", detail: "Webhook public URL is malformed." };
+  }
+}
+function diagnoseProviders(config) {
+  const credentials = validateProviderCredentials(config);
+  const enabled = Object.entries(config.providers).filter(([, value]) => value.enabled).map(([name]) => name);
+  if (credentials.length) {
+    return { ok: false, name: "provider", detail: credentials.map((issue) => `${issue.provider}:${issue.code}`).join(", ") };
+  }
+  return {
+    ok: true,
+    name: "provider",
+    detail: enabled.length ? `Enabled sandbox providers: ${enabled.join(", ")}. No billable production attempts.` : "No third-party provider enabled. Fake provider remains the default route."
+  };
+}
+function diagnoseBrowserKeys(config) {
+  const keys = Object.keys(config.browser.publishableKeys);
+  return {
+    ok: true,
+    name: "browser-key",
+    detail: keys.length ? `Publishable keys present for ${keys.join(", ")}. Values redacted.` : "No browser publishable keys configured (sandbox fake launcher does not need them)."
+  };
+}
+function diagnoseRouting(config) {
+  if (!config.routing.defaultProvider) {
+    return { ok: false, name: "routing", detail: "Default provider is missing." };
+  }
+  const known = config.providers[config.routing.defaultProvider];
+  if (!known && config.routing.defaultProvider !== "test_fake") {
+    return { ok: false, name: "routing", detail: `Default provider "${config.routing.defaultProvider}" is not in the config.` };
+  }
+  return {
+    ok: true,
+    name: "routing",
+    detail: `Default ${config.routing.defaultProvider}; ${config.routing.rules.length} package rule(s). Production routing is disabled.`
+  };
+}
+function cmdDbMigrate(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  const result = migrateUp(cwd, config);
+  const files = listedMigrationFiles(cwd, config);
+  return ok([
+    result.applied.length ? `Applied ${result.applied.join(", ")}.` : "No pending migrations.",
+    `Wrote SQL templates under ${config.database.migrationsDirectory} (${files.length} files).`,
+    "SQL is not executed against production. Apply with your own postgres client when ready.",
+    ""
+  ].join("\n"));
+}
+function cmdDbRollback(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  const result = migrateDown(cwd, config);
+  return ok(result.rolledBack ? `Rolled back ${result.rolledBack}. SQL was not executed against a live database.
+` : "No applied migrations to roll back.\n");
+}
+function cmdProviderScaffold(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const directory = flagString(parsed.flags, "out") || parsed.positionals[0];
+  const root = scaffoldProvider(cwd, directory);
+  return ok([
+    `Wrote fourth-party adapter stub at ${root}`,
+    `Custom package: ${SCAFFOLD_PACKAGE}`,
+    "The stub is sandbox-only and does not create billable provider attempts.",
+    ""
+  ].join("\n"));
+}
+async function cmdProviderConformance(parsed) {
+  const command = {
+    attemptId: "att_conformance_cli",
+    subjectReference: "sub_opaque_conformance",
+    packageCode: "human_idv",
+    countryCode: "US",
+    idempotencyKey: "idem_conformance_cli",
+    configurationRevision: "cfg_cli"
+  };
+  const modulePath = flagString(parsed.flags, "module");
+  const lines = [];
+  try {
+    if (!modulePath) {
+      const adapter = createFakeAdapterForScenario("input_required");
+      const results2 = await runAdapterConformance(adapter, command);
+      lines.push(
+        "Running @splitin/verification-adapter-sdk runAdapterConformance against the sandbox fake adapter.",
+        "This does not call Stripe, Persona, or Plaid and cannot create billable attempts.",
+        ...formatConformance(results2)
+      );
+      const failed2 = results2.filter((result) => !result.passed);
+      return { exitCode: failed2.length ? 1 : 0, stdout: redactSecrets(`${lines.join("\n")}
+`), stderr: "" };
+    }
+    const loaded = await loadConformanceModule(modulePath, resolveCwd(parsed.flags));
+    const results = await runAdapterConformance(loaded.adapter, command);
+    lines.push(
+      `Running runAdapterConformance against module ${modulePath}.`,
+      "Adapter output is redacted. Secrets, tokens, and credential material are never printed.",
+      ...formatConformance(results)
+    );
+    if (loaded.factory) {
+      const scenarios = await runAdapterConformanceScenarios(loaded.factory, command);
+      lines.push("Running runAdapterConformanceScenarios for the exported factory.", ...formatConformance(scenarios));
+      results.push(...scenarios);
+    }
+    const failed = results.filter((result) => !result.passed);
+    return { exitCode: failed.length ? 1 : 0, stdout: redactSecrets(`${lines.join("\n")}
+`), stderr: "" };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : "Unknown conformance module failure.";
+    return fail(`Unable to run provider conformance. ${detail}
+`);
+  }
+}
+function formatConformance(results) {
+  return results.map((result) => `${result.passed ? "pass" : "fail"}  ${result.name}${result.detail ? `  ${result.detail}` : ""}`);
+}
+async function loadConformanceModule(modulePath, cwd) {
+  const absolute = isAbsolute(modulePath) ? modulePath : resolve(cwd, modulePath);
+  const imported = await import(pathToFileURL(absolute).href);
+  const factoryCandidate = pickFunction(
+    imported.createAdapterForScenario,
+    imported.createAdapter,
+    imported.default
+  );
+  const isScenarioFactory = typeof factoryCandidate === "function" && factoryCandidate.length >= 1;
+  const adapter = isAdapter(imported.default) ? imported.default : isAdapter(imported.createAdapter) ? imported.createAdapter : typeof factoryCandidate === "function" ? await factoryCandidate(isScenarioFactory ? "input_required" : void 0) : null;
+  if (!isAdapter(adapter)) {
+    throw new Error("Module must export a default adapter, createAdapter, or createAdapterForScenario.");
+  }
+  return {
+    adapter,
+    factory: isScenarioFactory ? factoryCandidate : null
+  };
+}
+function pickFunction(...candidates) {
+  for (const candidate of candidates) {
+    if (typeof candidate === "function") return candidate;
+  }
+  return null;
+}
+function isAdapter(value) {
+  return Boolean(value) && typeof value === "object" && typeof value.createAttempt === "function" && typeof value.retrieveAttempt === "function";
+}
+function cmdRegistryGenerate(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  const out = flagString(parsed.flags, "out", "src/generated/verification-registry.ts");
+  const contents = `/* Generated by splitin-verification registry generate. Do not edit. */
+export const verificationAdapterContractVersion = ${JSON.stringify(VERIFICATION_ADAPTER_CONTRACT_VERSION)} as const;
+export const verificationEngineContractVersion = ${JSON.stringify(ENGINE_CONTRACT_VERSION)} as const;
+export const verificationCliVersion = ${JSON.stringify(CLI_VERSION)} as const;
+export const standardPackageCodes = ${JSON.stringify(STANDARD_PACKAGE_CODES, null, 2)} as const;
+export const standardWebhookProtocols = ${JSON.stringify(STANDARD_WEBHOOK_PROTOCOLS, null, 2)} as const;
+export const canonicalStatuses = ${JSON.stringify(CANONICAL_STATUSES, null, 2)} as const;
+export const configuredProviders = ${JSON.stringify(Object.keys(config.providers), null, 2)} as const;
+export const productionRoutesEnabled = false;
+export type StandardPackageCode = typeof standardPackageCodes[number];
+export type ConfiguredProvider = typeof configuredProviders[number];
+`;
+  writeText(join(cwd, out), contents);
+  return ok(`Wrote typed registry ${out}. productionRoutesEnabled=false.
+`);
+}
+function cmdDev(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const config = loadConfig(cwd);
+  if (config.productionEnabled || config.productionRoutesEnabled) {
+    return fail("Refusing to start because production routes are enabled. Set productionEnabled=false.\n");
+  }
+  const port = Number(flagString(parsed.flags, "port", "8787")) || 8787;
+  if (flagBoolean(parsed.flags, "print-only")) {
+    return ok(`Sandbox dev listener would bind 127.0.0.1:${port}. Production routes stay disabled.
+`);
+  }
+  const server = createServer((request, response) => {
+    void handleDevRequest(request, response);
+  });
+  server.listen(port, "127.0.0.1");
+  return ok(`Sandbox verification listener on http://127.0.0.1:${port}
+Production routes disabled. GET /health, POST /sandbox/attempts.
+`);
+}
+async function handleDevRequest(request, response) {
+  const url = new URL(request.url ?? "/", "http://127.0.0.1");
+  if (url.pathname === "/health") {
+    json(response, 200, { ok: true, environment: "sandbox", productionRoutesEnabled: false });
+    return;
+  }
+  if (url.pathname.startsWith("/v1/") || url.pathname.startsWith("/production/")) {
+    json(response, 403, { error: "production_routes_disabled" });
+    return;
+  }
+  if (request.method === "POST" && url.pathname === "/sandbox/attempts") {
+    const adapter = createFakeAdapterForScenario("input_required");
+    const created = await adapter.createAttempt({
+      attemptId: "att_dev_local",
+      subjectReference: "sub_opaque_dev",
+      packageCode: "human_idv",
+      countryCode: "US",
+      idempotencyKey: "idem_dev_local",
+      configurationRevision: "cfg_dev"
+    });
+    json(response, 201, redactValue({
+      attemptId: created.attemptId,
+      providerResourceId: created.providerResourceId,
+      canonicalStatus: created.canonicalStatus,
+      launcherKey: created.launch.launcherKey
+    }));
+    return;
+  }
+  json(response, 404, { error: "not_found" });
+}
+function json(response, status, body) {
+  response.writeHead(status, { "content-type": "application/json" });
+  response.end(`${JSON.stringify(body)}
+`);
+}
+function cmdReleaseVerify(parsed) {
+  const cwd = resolveCwd(parsed.flags);
+  const lines = [
+    `cli=${CLI_VERSION} contract=${VERIFICATION_ADAPTER_CONTRACT_VERSION} engine=${ENGINE_CONTRACT_VERSION}`,
+    "npm trusted publishing must use OIDC (id-token: write). Do not embed an npm token.",
+    "Publish 0.1.0-beta.0 first. Promote to 1.0.0 only after sandbox certification.",
+    "productionEnabled must remain false in distributed examples."
+  ];
+  if (existsSync(join(cwd, "verification.config.json"))) {
+    const config = loadConfig(cwd);
+    if (config.productionEnabled || config.productionRoutesEnabled) {
+      return fail(`${lines.join("\n")}
+ERROR production_disabled: release artifacts must keep production routes off.
+`);
+    }
+  }
+  lines.push("Release preflight passed.");
+  return ok(`${lines.join("\n")}
+`);
+}
+function usage() {
+  return `splitin-verification ${CLI_VERSION}
+
+Usage: splitin-verification <command> [subcommand] [options]
+
+Commands:
+  init                     Write disabled-by-default sandbox configuration
+  config validate          Validate contract/API versions and credential shape
+  doctor                   Diagnose database, webhook, provider, browser-key, routing
+  db migrate               Write and record SQL migrations (does not apply to prod)
+  db rollback              Roll back the last recorded local migration
+  provider scaffold        Write a fourth-party adapter stub (${SCAFFOLD_PACKAGE})
+  provider conformance     Run @splitin/verification-adapter-sdk runAdapterConformance
+  registry generate        Write a typed provider/package registry
+  dev                      Bind a sandbox-only listener (production routes disabled)
+  release verify           Check versions, provenance policy, and production flags
+
+Global options:
+  --cwd <dir>              Working directory
+  --module <path>          Adapter module for \`provider conformance\` (default: fake)
+  --help                   Show this help
+`;
+}
+function ok(stdout) {
+  return { exitCode: 0, stdout: redactSecrets(stdout), stderr: "" };
+}
+function fail(stderr) {
+  return { exitCode: 1, stdout: "", stderr: redactSecrets(stderr) };
+}
+
+// src/cli.ts
+async function run(argv = process.argv) {
+  const parsed = parseArgv(argv);
+  return dispatch(parsed);
+}
+var isMain = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isMain) {
+  void run().then((result) => {
+    if (result.stdout) process.stdout.write(result.stdout);
+    if (result.stderr) process.stderr.write(result.stderr);
+    const parsed = parseArgv(process.argv);
+    if (parsed.command === "dev" && parsed.flags["print-only"] !== true && result.exitCode === 0) {
+      return;
+    }
+    process.exit(result.exitCode);
+  }).catch((error) => {
+    const message = error instanceof Error ? error.message : "Unknown CLI failure.";
+    process.stderr.write(`${message}
+`);
+    process.exit(1);
+  });
+}
+
+export { defaultConfig, dispatch, parseArgv, redactSecrets, redactValue, run };
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map