Node

// Silvector quickstart for Node 20 or later. No dependencies.
// Run: node quickstart.mjs
import { createPublicKey, verify } from "node:crypto";

const API = process.env.SILVECTOR_API ?? "https://api.silvector.com";

// Canonical JSON: keys sorted, no whitespace, integers only. This is the exact byte
// string the receipt signature covers.
function canonical(value) {
  if (value === null) return "null";
  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
  if (typeof value === "object") {
    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
  }
  if (typeof value === "number" && !Number.isInteger(value)) throw new Error("receipts carry integers only");
  return JSON.stringify(value);
}

function verifies(receipt, jwk) {
  const key = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: jwk.x }, format: "jwk" });
  return verify(null, Buffer.from(canonical(receipt.body)), key, Buffer.from(receipt.sig, "base64url"));
}

// 1. Ask for a decision. The response carries a signed receipt.
const checked = await fetch(`${API}/v1/check`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ method: "GET", path: "/pricing" }),
});
if (!checked.ok) throw new Error(`/v1/check returned ${checked.status}`);
const decision = await checked.json();
const receipt = decision.receipt;

// 2. Fetch the published keys.
const jwks = await (await fetch(`${API}/.well-known/jwks.json`)).json();
const keys = jwks.keys.filter((key) => key.kty === "OKP" && key.crv === "Ed25519");

// 3. Verify with the one key whose kid equals the receipt's agent_kid. Other published
// keys sign other things, so never fall back to them.
const key = keys.find((candidate) => candidate.kid === receipt.body.agent_kid);
const verified = Boolean(key) && verifies(receipt, key);

// 4. Change one field and check that the signature no longer holds.
const tampered = { ...receipt, body: { ...receipt.body, outcome: receipt.body.outcome === "allow" ? "deny" : "allow" } };
const tamperedVerifies = Boolean(key) && verifies(tampered, key);

console.log(`receipt: ${decision.receiptId}`);
console.log(`outcome: ${receipt.body.outcome} (rule ${receipt.body.rule_id})`);
console.log(`key: ${key ? key.kid : `none published for ${receipt.body.agent_kid}`}`);
console.log(`verified: ${verified}`);
console.log(`tampered copy verifies: ${tamperedVerifies}`);
console.log("evidence grade: rung 2 Operational, confidence none, uncalibrated (assigned by the docs, not a signed field)");
process.exit(verified && !tamperedVerifies ? 0 : 1);

node quickstart.mjs