npm install @phosra/gatekeeper

import { createPlatform } from "@phosra/gatekeeper"

export const phosra = createPlatform({
  credential: process.env.PHOSRA_CREDENTIAL!,
  onDiagnostic: (d) => console.error(JSON.stringify(d)),
  humanRecovery: { signInPath: "/login", createProfilePath: "/profiles/manage" },
  adapter: {
    database: pool,                          // pg.Pool — the SDK migrates this
    authorizedProviders: ["did:ocss:custo"], // see "Who goes in authorizedProviders"
    resolveAccount,                          // (Request) => { accountId, profiles } | null
    apply, observe, release, observeRelease,
  },
})

curl -s https://prodapi.phosra.com/api/v1/providers/did:ocss:castle-plus/connect | jq

{
  "directory_version": 1,
  "name": "Castle+",
  "authorize_url": "https://castle-api-production-7071.up.railway.app/api/phosra/authorize",
  "par_url": "https://castle-api-production-7071.up.railway.app/api/phosra/par",
  "token_url": "https://castle-api-production-7071.up.railway.app/api/phosra/token",
  "profiles_url": "https://castle-api-production-7071.up.railway.app/api/phosra/profiles",
  "connect_url": "https://castle-api-production-7071.up.railway.app/api/phosra/delivery",
  "scopes": ["child_profiles.read", "content_rating"],
  "provisioning_form": "per_child"
}

ORIGIN=https://your-app.example.com
curl -s https://prodapi.phosra.com/api/v1/providers/did:ocss:YOUR-DID/connect \
| jq --arg o "$ORIGIN" '{
    directory_version_ok: (.directory_version == 1),
    name: .name,
    authorize_ok: (.authorize_url == ($o + "/api/phosra/authorize")),
    par_ok:       (.par_url       == ($o + "/api/phosra/par")),
    token_ok:     (.token_url     == ($o + "/api/phosra/token")),
    profiles_same_origin: (.profiles_url | startswith($o))
  }'

# Unsigned, to prove the route exists (401 = registered; a bogus sibling path returns
# the plain-text "404 page not found").
curl -s -o /dev/null -w '%{http_code}\n' -X PATCH \
  https://prodapi.phosra.com/api/v1/platforms/did:ocss:castle-plus/connect
# → 401

// app/api/ocss/profiles/route.ts — Notflix's real handler, trimmed.
export async function GET(req: Request): Promise<Response> {
  const auth = req.headers.get("authorization") ?? ""
  const token = auth.startsWith("Bearer ") ? auth.slice(7).trim() : ""
  const uid = token ? uidFromAccessToken(token) : null
  if (!uid) {
    return Response.json({ error: "invalid_token" }, {
      status: 401,
      headers: { "WWW-Authenticate": 'Bearer realm="notflix"' },
    })
  }
  // Child profiles ONLY — [] when the account has none.
  const profiles = await connectableProfiles(uid)
  return Response.json(profiles, { status: 200, headers: { "Cache-Control": "no-store" } })
}

curl -s -o /dev/null -w '%{http_code}\n' https://your-app.example.com/api/ocss/profiles
# → 401  (a real handler refusing an anonymous read)
# → 404  means you have not written it yet

curl -s https://prodapi.phosra.com/.well-known/ocss/trust-list \
| jq -r '.document | fromjson | .entries[]
         | select(.status=="active" and .tier=="accredited" and .role=="enforcement-agent")
         | .did'

curl -s https://prodapi.phosra.com/.well-known/ocss/trust-list \
| jq -r '.document | fromjson | .entries[] | select(.did=="did:ocss:phosra-router")
         | "\(.status)  \(.tier)  role=\(.role)"'
# → active  accredited  role=null

403  failed binding: app_ref — the attestation names an app this receiving surface
     does not operate (§8.3.2 IngestConsentAttestation cl.4)

// app/api/phosra/[...phosra]/route.ts
import { phosra } from "@/lib/phosra/platform"
export const { GET, POST } = phosra.next.handlers()

phosra.handlers.status.GET       // GET  /api/phosra/status
phosra.handlers.par.POST         // POST /api/phosra/par
phosra.handlers.authorize.GET    // GET  /api/phosra/authorize
phosra.handlers.authorize.POST   // POST /api/phosra/authorize
phosra.handlers.token.POST       // POST /api/phosra/token
phosra.handlers.delivery.POST    // POST /api/phosra/delivery
phosra.handlers.retry.POST       // POST /api/phosra/retry

import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify"

export async function phosraPlugin(app: FastifyInstance, opts: {
  phosra: GoldenPlatform
  applicationOrigin: string   // must equal the credential's application origin
}) {
  // 1. RAW BODY. The SDK verifies signatures over the exact bytes; a pre-parsed
  //    body is a different byte sequence and every signed request fails.
  app.addContentTypeParser("*", { parseAs: "buffer" }, (_req, body, done) => done(null, body))

  const bridge = (handler: (r: Request) => Promise<Response>) =>
    async (req: FastifyRequest, reply: FastifyReply) => {
      const url = new URL(req.url, opts.applicationOrigin)
      const headers = new Headers()
      for (const [k, v] of Object.entries(req.headers)) {
        if (v === undefined) continue
        Array.isArray(v) ? v.forEach((x) => headers.append(k, x)) : headers.set(k, String(v))
      }
      const hasBody = req.method !== "GET" && req.method !== "HEAD" && Buffer.isBuffer(req.body)
      const request = hasBody
        ? new Request(url, { method: req.method, headers, body: new Uint8Array(req.body as Buffer) })
        : new Request(url, { method: req.method, headers })
      const response = await handler(request)
      reply.code(response.status)
      response.headers.forEach((value, key) => {
        if (key !== "content-length") reply.header(key, value)
      })
      await reply.send(Buffer.from(await response.arrayBuffer()))
    }

  app.get("/api/phosra/status",    bridge(opts.phosra.handlers.status.GET))
  app.post("/api/phosra/par",      bridge(opts.phosra.handlers.par.POST))
  app.get("/api/phosra/authorize", bridge(opts.phosra.handlers.authorize.GET))
  app.post("/api/phosra/authorize",bridge(opts.phosra.handlers.authorize.POST))
  app.post("/api/phosra/token",    bridge(opts.phosra.handlers.token.POST))
  app.post("/api/phosra/delivery", bridge(opts.phosra.handlers.delivery.POST))
  app.post("/api/phosra/retry",    bridge(opts.phosra.handlers.retry.POST))
}

// middleware.ts
import { assertGatekeeperConfig, gatekeeperConnectRoutes } from "@phosra/gatekeeper"

export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)", "/api/phosra/:path*"],
}

assertGatekeeperConfig({ matcher: config.matcher })  // throws GatekeeperConfigError at boot

readonly ready: () => Promise<{ ready: boolean; missing: readonly string[] }>

const readiness = await phosra.ready()
if (!readiness.ready) {
  throw new Error(`Phosra schema not ready: ${readiness.missing.join(", ")}`)
}

const worker = phosra.worker.start({ signal, onError: (e) => console.error(e) })
await worker.drain()

onDiagnostic: (d) => console.error(JSON.stringify(d))

interface NormalizedVerifiedRule {
  readonly ruleRef: string
  readonly category: string
  readonly decision: string
  readonly failMode: "open" | "closed"
  readonly ruleSlug: string
  readonly statuteMappingRef?: string
  readonly enforcement?: "unsupported"
  readonly parameters: Readonly<Record<string, unknown>> | null
}

{
  "category": "content_rating",
  "decision": "allow",
  "failMode": "closed",
  "parameters": { "family": "numeric_threshold", "scale": "ratings_age", "max_allowed": 13 }
}

recoverSelectedProfileForRemoval: async ({ priorApplyIdempotencyKey }) => {
  const operation = await overlayStore.getOperation(priorApplyIdempotencyKey)
  if (!operation || operation.kind !== "apply") return null
  return Object.freeze({ selectedProfileId: operation.selectedProfileId })
}

curl -s https://your-app.example.com/api/phosra/status | jq '{precondition, versions}'

# 1. Your profiles endpoint answers (401 is correct; 404 means you never wrote it).
curl -s -o /dev/null -w 'profiles %{http_code}\n' https://your-app.example.com/api/ocss/profiles

# 2. Your directory row still matches your origin.
curl -s https://prodapi.phosra.com/api/v1/providers/did:ocss:YOUR-DID/connect | jq

# 3. Your worker is running (whatever health surface you gave it).