Submit a signed §8.3.8 enforcement-result receipt

import { createGatekeeper } from "@phosra/gatekeeper"

const gk = createGatekeeper({
  platformDid:          "did:ocss:loopline",
  platformKeyId:        "did:ocss:loopline#2026-06",
  gatekeeperSigningKey: { seed: /* 32-byte Ed25519 seed */ new Uint8Array(32), keyID: "did:ocss:loopline#2026-06" },
  censusBaseUrl:        "https://phosra-api-sandbox-production.up.railway.app",
  trustRootXB64Url:     process.env.PHOSRA_TRUST_ROOT_X!,
  endpointId:           "iGrFqzp43O0S9YTNN2oAT6zMzcugEX_EwZbraWrE1AA",
})

const verdict = gk.isAllowed({ category: "infinite_scroll_block" })
// ...apply the decision at the edge, then attest the outcome:
await verdict.confirm("applied")   // signs the §8.3.8 receipt + POSTs /enforcement-confirmations

import { signRequest, signReceipt, receiptToWire, ed25519Sign } from "@openchildsafety/ocss"
import { randomBytes } from "node:crypto"

const BASE  = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
const seed  = new Uint8Array(Buffer.from("bG9vcGxpbmUBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE", "base64url"))
const keyID = "did:ocss:loopline#2026-06"
const key   = { keyId: keyID, sign: (m) => ed25519Sign(seed, m) }

// rule_ref comes from the enforcement profile's categories[] row you enforced.
const body = {
  envelope_ref:     "env_abc123",
  rule_ref:         "rr_mia_infinite_scroll",
  enforcement_state: "applied",             // applied | degraded | refused
  applied_at:       new Date().toISOString(),
  method_class:     "platform_gate",         // non-empty when enforcement_state === "applied"
}
const receipt = signReceipt("enforcement_result", body, key, new Date(), new Uint8Array(randomBytes(10)))

const targetURI = BASE + "/enforcement-confirmations", bodyText = JSON.stringify(receiptToWire(receipt))
const headers = signRequest({ method: "POST", targetURI, body: new TextEncoder().encode(bodyText), keyID, seed, created: Math.floor(Date.now() / 1000) })
headers["Content-Type"] = "application/json"
const res = await fetch(targetURI, { method: "POST", headers, body: bodyText })
console.log(res.status)   // 201 recorded, 200 idempotent re-submit

# sign_request(...) is the RFC 9421 transport signer from /concepts/signing-requests.
# sign_receipt(...) below signs the INNER §8.3.8 receipt (JCS over {body, spec, type}).
import base64, json, os, time, requests
from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

BASE, SPEC = "https://phosra-api-sandbox-production.up.railway.app/api/v1", "OCSS-v1.0-pre"
SEED  = "bG9vcGxpbmUBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE"
KEYID = "did:ocss:loopline#2026-06"
_CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"

def _b64u(s): return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
def _jcs(v):  return json.dumps(v, sort_keys=True, separators=(",", ":"), ensure_ascii=False)

def _ulid() -> str:                       # rcpt_ + a Crockford ULID (SDK-compatible shape)
    n = (int(time.time() * 1000) << 80) | int.from_bytes(os.urandom(10), "big")
    return "".join(_CROCKFORD[(n >> (5 * (25 - i))) & 31] for i in range(26))

def sign_receipt(rtype: str, body: dict) -> dict:
    sk = Ed25519PrivateKey.from_private_bytes(_b64u(SEED))
    sig = sk.sign(_jcs({"body": body, "spec": SPEC, "type": rtype}).encode())
    return {"id": "rcpt_" + _ulid(), "type": rtype, "spec": SPEC, "body": body,
            "key_id": KEYID, "sig": "ed25519:" + base64.urlsafe_b64encode(sig).decode().rstrip("=")}

# rule_ref MUST be a live per-child ref from a profile you actually enforced (§8.3.8 cl.1).
receipt = sign_receipt("enforcement_result", {
    "envelope_ref": "env_abc123", "rule_ref": "rr_mia_infinite_scroll",
    "enforcement_state": "applied", "applied_at": "2026-07-06T09:43:59.612Z",
    "method_class": "platform_gate",                # non-empty when state == "applied"
})
url  = BASE + "/enforcement-confirmations"
body = json.dumps(receipt).encode()
h    = sign_request("POST", url, KEYID, SEED, body); h["Content-Type"] = "application/json"
print(requests.post(url, data=body, headers=h).status_code)   # 201 recorded, 200 idempotent

// SignRequest(...) is the RFC 9421 transport signer from /concepts/signing-requests.
// signReceipt below signs the INNER §8.3.8 receipt (JCS over {body, spec, type}).
package main

import (
	"bytes"; "crypto/ed25519"; "crypto/rand"; "encoding/base64"; "encoding/json"
	"fmt"; "io"; "net/http"; "sort"; "strings"; "time"
)

const (
	base  = "https://phosra-api-sandbox-production.up.railway.app/api/v1"
	spec  = "OCSS-v1.0-pre"
	seed  = "bG9vcGxpbmUBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE"
	keyID = "did:ocss:loopline#2026-06"
)

// jcs renders RFC 8785 canonical JSON for the receipt's flat, ASCII value domain.
func jcs(v any) []byte {
	switch t := v.(type) {
	case map[string]any:
		keys := make([]string, 0, len(t))
		for k := range t {
			keys = append(keys, k)
		}
		sort.Strings(keys)
		var b strings.Builder
		b.WriteByte('{')
		for i, k := range keys {
			if i > 0 {
				b.WriteByte(',')
			}
			kb, _ := json.Marshal(k)
			b.Write(kb)
			b.WriteByte(':')
			b.Write(jcs(t[k]))
		}
		b.WriteByte('}')
		return []byte(b.String())
	default:
		out, _ := json.Marshal(v)
		return out
	}
}

func signReceipt(rtype string, body map[string]any) map[string]any {
	sk := ed25519.NewKeyFromSeed(mustSeed())
	sig := ed25519.Sign(sk, jcs(map[string]any{"body": body, "spec": spec, "type": rtype}))
	var ent [10]byte
	rand.Read(ent[:])
	id := fmt.Sprintf("rcpt_%d%X", time.Now().UnixMilli(), ent)
	return map[string]any{"id": id, "type": rtype, "spec": spec, "body": body,
		"key_id": keyID, "sig": "ed25519:" + base64.RawURLEncoding.EncodeToString(sig)}
}

func mustSeed() []byte { s, _ := base64.RawURLEncoding.DecodeString(seed); return s }

func main() {
	// rule_ref MUST be a live per-child ref from a profile you enforced (§8.3.8 cl.1).
	receipt := signReceipt("enforcement_result", map[string]any{
		"envelope_ref": "env_abc123", "rule_ref": "rr_mia_infinite_scroll",
		"enforcement_state": "applied", "applied_at": "2026-07-06T09:43:59.612Z",
		"method_class": "platform_gate",
	})
	url := base + "/enforcement-confirmations"
	body, _ := json.Marshal(receipt)
	h, _ := SignRequest("POST", url, keyID, seed, body)
	req, _ := http.NewRequest("POST", url, bytes.NewReader(body))
	for k, v := range h {
		req.Header.Set(k, v)
	}
	req.Header.Set("Content-Type", "application/json")
	resp, _ := http.DefaultClient.Do(req)
	defer resp.Body.Close()
	b, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.StatusCode, string(b)) // 201 recorded, 200 idempotent
}