Cloudflare Workers

mkdir silvector-quickstart && cd silvector-quickstart && mkdir src

{
  "name": "silvector-quickstart",
  "main": "src/index.js",
  "compatibility_date": "2026-10-01",
  "vars": { "SILVECTOR_API": "https://api.silvector.com" }
}

// Silvector quickstart for Cloudflare Workers. No dependencies.
// Run: npx wrangler dev, then open the local URL it prints.

const encoder = new TextEncoder();

// Canonical JSON: keys sorted, no whitespace, integers only. This is the exact byte
// string the receipt signature covers.
function canonical(value) {
  if (value === null) return "null";
  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
  if (typeof value === "object") {
    return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonical(value[key])}`).join(",")}}`;
  }
  if (typeof value === "number" && !Number.isInteger(value)) throw new Error("receipts carry integers only");
  return JSON.stringify(value);
}

function b64url(text) {
  const base64 = text.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(text.length / 4) * 4, "=");
  return Uint8Array.from(atob(base64), (char) => char.charCodeAt(0));
}

async function verifies(receipt, jwk) {
  const key = await crypto.subtle.importKey("raw", b64url(jwk.x), { name: "Ed25519" }, false, ["verify"]);
  return crypto.subtle.verify({ name: "Ed25519" }, key, b64url(receipt.sig), encoder.encode(canonical(receipt.body)));
}

export default {
  async fetch(_request, env) {
    const api = env.SILVECTOR_API ?? "https://api.silvector.com";

    // 1. Ask for a decision. The response carries a signed receipt.
    const checked = await fetch(`${api}/v1/check`, {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({ method: "GET", path: "/pricing" }),
    });
    if (!checked.ok) return new Response(`/v1/check returned ${checked.status}\n`, { status: 502 });
    const decision = await checked.json();
    const receipt = decision.receipt;

    // 2. Fetch the published keys.
    const jwks = await (await fetch(`${api}/.well-known/jwks.json`)).json();
    const keys = jwks.keys.filter((key) => key.kty === "OKP" && key.crv === "Ed25519");

    // 3. Verify with the one key whose kid equals the receipt's agent_kid. Other published
    // keys sign other things, so never fall back to them.
    const key = keys.find((candidate) => candidate.kid === receipt.body.agent_kid);
    const verified = key ? await verifies(receipt, key) : false;

    // 4. Change one field and check that the signature no longer holds.
    const tampered = { ...receipt, body: { ...receipt.body, outcome: receipt.body.outcome === "allow" ? "deny" : "allow" } };
    const tamperedVerifies = key ? await verifies(tampered, key) : false;

    const lines = [
      `receipt: ${decision.receiptId}`,
      `outcome: ${receipt.body.outcome} (rule ${receipt.body.rule_id})`,
      `key: ${key ? key.kid : `none published for ${receipt.body.agent_kid}`}`,
      `verified: ${verified}`,
      `tampered copy verifies: ${tamperedVerifies}`,
      "evidence grade: rung 2 Operational, confidence none, uncalibrated (assigned by the docs, not a signed field)",
    ];
    return new Response(`${lines.join("\n")}\n`, {
      status: verified && !tamperedVerifies ? 200 : 500,
      headers: { "content-type": "text/plain; charset=utf-8" },
    });
  },
};

npx wrangler dev
# then, in a second terminal:
curl http://localhost:8787/