Environments & base URLs

// lib/phosra-link-server.ts — server-only singleton.
import { Pool } from "pg"
import { createGoldenLinkServer } from "@phosra/link/server"

export const phosraLinkServer = await createGoldenLinkServer({
  credential: process.env.PHOSRA_CREDENTIAL!,   // sandbox OR production — it decides
  database:   new Pool({ connectionString: process.env.DATABASE_URL }),
  authenticate, children, policy,               // your app's adapters
})
// No censusBaseUrl. No trustRootXB64Url. Swapping environments = swapping the credential.

import { createPlatform } from "@phosra/gatekeeper"

export const phosra = createPlatform({
  credential: process.env.PHOSRA_CREDENTIAL!,   // sandbox OR production — it decides
  adapter,                                      // your app's enforcement adapter
})
// Same rule: the credential is the only Phosra configuration variable.

import { PhosraClient } from "@phosra/sdk";

// Sandbox — no key required. baseUrl includes /api/v1.
const client = new PhosraClient({
  baseUrl: "https://phosra-api-sandbox-production.up.railway.app/api/v1",
});

// Production — drop baseUrl (defaults to https://prodapi.phosra.com/api/v1) and add a live key.
const prod = new PhosraClient({ apiKey: process.env.PHOSRA_API_KEY }); // phosra_live_…

import { createLink } from "@phosra/link";

// The compatibility path, for a raw writer with its own key material.
// `census` is the BARE host — no /api/v1 suffix.
const link = createLink({
  census:      "https://prodapi.phosra.com",
  writerSeed:  process.env.OCSS_WRITER_SEED!,
  writerKeyId: "did:ocss:acme#link-1",
  db:          process.env.DATABASE_URL!,
});
// The bundled pin table covers prodapi, census.phosra.com (pinned ahead of its attach —
// see the certificate caveat below), the prod-bootstrap Railway name, and both sandbox
// Railway names. For ANY other host (including sandbox.phosra.com) you MUST pass an explicit
// `trustRoot` — the SDK never accepts a root fetched from the census it is verifying.

# CLI reads the BARE host from PHOSRA_CENSUS_URL (defaults to the sandbox host).
export PHOSRA_CENSUS_URL="https://phosra-api-sandbox-production.up.railway.app"
npx @phosra/cli doctor
# Production: export PHOSRA_CENSUS_URL="https://prodapi.phosra.com"

# MCP takes the base URL WITH /api/v1 (defaults to production when --api-url is omitted).
npx @phosra/mcp \
  --api-url "https://phosra-api-sandbox-production.up.railway.app/api/v1" \
  --api-key "$PHOSRA_API_KEY"

# One env var for every raw HTTP snippet on this site. Includes /api/v1.
export PHOSRA_BASE_URL="https://phosra-api-sandbox-production.up.railway.app/api/v1"
curl -s "$PHOSRA_BASE_URL/families" | head
# Production: export PHOSRA_BASE_URL="https://prodapi.phosra.com/api/v1"