Read & verify keys

curl https://mosskeys.com/api/acme/checkpoint

{
  "origin": "mosskeys.com/acme",
  "size": 42,
  "root": "<base64 32-byte Merkle root>",
  "note": "<C2SP signed checkpoint note>"
}

curl https://mosskeys.com/api/acme/log/entries/0

{
  "index": 0,
  "leaf": "<base64 canonical leaf bytes>",
  "leaf_hash": "<base64 32-byte RFC 6962 leaf hash>",
  "entry_hash": "<base64>",
  "prev_entry_hash": null
}

curl https://mosskeys.com/api/acme/log/label/alice@example.com

{
  "index": 41,
  "label": "alice@example.com",
  "leaf": "<base64 canonical leaf bytes>",
  "leaf_hash": "<base64 32-byte RFC 6962 leaf hash>",
  "entry_hash": "<base64>",
  "prev_entry_hash": "<base64>",
  "tree_size": 42,
  "checkpoint": {
    "origin": "mosskeys.com/acme",
    "size": 42,
    "root": "<base64 32-byte Merkle root>",
    "note": "<C2SP signed checkpoint note>"
  },
  "inclusion_proof": {
    "index": 41,
    "size": 42,
    "leaf_hash": "<base64>",
    "proof": ["<base64>", "<base64>", "…"]
  }
}

// Stopgap label lookup: resolve an identity/label to its current key +
// proof in one request, then verify against the bundled signed checkpoint.
// No token is needed: every byte below is already public.
import init, { checkpointVerifyInclusion } from "metamorphic-log";

const base = "https://mosskeys.com/api/acme";
const VKEYS = ["<namespace vkey>"]; // pinned out of band; your root of trust

await init();

// 1. Resolve the label to its newest entry + a bundled inclusion proof.
const res = await fetch(`${base}/log/label/${encodeURIComponent("alice@example.com")}`);
const head = await res.json();

// 2. If the head is already anchored in the signed checkpoint, verify the
//    bundled proof. Throws unless the checkpoint is validly signed AND the
//    leaf is provably included under its signed root.
if (head.inclusion_proof) {
  checkpointVerifyInclusion(
    head.checkpoint.note,          // the signed checkpoint note (C2SP)
    VKEYS,                         // trusted verifier key(s) for this namespace
    BigInt(head.inclusion_proof.index),
    head.inclusion_proof.leaf_hash,
    head.inclusion_proof.proof,
  );
} else {
  // The head was appended after the latest checkpoint, so it is not yet
  // anchored in a signed tree head. Re-fetch once the checkpoint advances,
  // or request GET /api/:slug/log/proof/inclusion?index=&size= directly.
}

curl "https://mosskeys.com/api/acme/lookup?label=alice@example.com"

{
  "directory_mode": "coniks",
  "namespace": "acme",
  "slug": "acme",
  "label": "alice@example.com",
  "status": "present",
  "value": "<base64 entry_hash the directory binds to this identity>",
  "proof": "<base64 CONIKS presence proof>",
  "root": "<base64 64-byte SHA3-512 directory root>",
  "vrf_public": "<base64 VRF public key>",
  "entries": 128
}

{
  "directory_mode": "coniks",
  "namespace": "acme",
  "slug": "acme",
  "label": "ghost@example.com",
  "status": "absent",
  "value": null,
  "proof": "<base64 CONIKS absence proof>",
  "root": "<base64 64-byte SHA3-512 directory root>",
  "vrf_public": "<base64 VRF public key>",
  "entries": 128
}

# Privacy-preserving CONIKS lookup: resolve an identity to the value the
# directory binds it to, and verify the proof locally. The identity is
# blinded through the namespace VRF, and the proof reveals no other
# identity in the directory. No token is needed.
base = "https://mosskeys.com/api/acme"
label = "alice@example.com"

%{body: r} = Req.get!("#{base}/lookup", params: [label: label])
identity = Base.encode64(label)

case r["status"] do
  "present" ->
    # {:ok, value} unless the presence proof reconstructs `root` under
    # `vrf_public`. `value` equals r["value"]: the entry_hash of the
    # label's current head. Then GET /api/:slug/log/label/:label to read
    # the keys and confirm their entry_hash matches (with an inclusion proof).
    {:ok, _value} =
      MetamorphicLog.Coniks.verify_lookup(
        r["namespace"], r["vrf_public"], r["root"], identity, r["proof"]
      )

  "absent" ->
    # :ok unless the absence proof verifies: the directory binds no value.
    :ok =
      MetamorphicLog.Coniks.verify_absence(
        r["namespace"], r["vrf_public"], r["root"], identity, r["proof"]
      )
end

curl https://mosskeys.com/api/acme/directory-proof

{
  "directory_mode": "coniks",
  "namespace": "acme",
  "slug": "acme",
  "root": "<base64 64-byte SHA3-512 directory root>",
  "vrf_public": "<base64 VRF public key>",
  "entries": 128
}

curl "https://mosskeys.com/api/acme/log/proof/inclusion?index=0&size=42"

{
  "index": 0,
  "size": 42,
  "leaf_hash": "<base64>",
  "proof": ["<base64>", "<base64>", "…"]
}

curl "https://mosskeys.com/api/acme/log/proof/consistency?from=42&to=57"

{
  "from": 42,
  "to": 57,
  "proof": ["<base64>", "<base64>", "…"]
}

curl "https://mosskeys.com/api/acme/log/reconcile?since=42"

{
  "checkpoint": {
    "origin": "mosskeys.com/acme",
    "size": 57,
    "root": "<base64 32-byte Merkle root>",
    "note": "<C2SP signed checkpoint note>"
  },
  "consistency_proof": {
    "from": 42,
    "to": 57,
    "proof": ["<base64>", "<base64>", "…"]
  }
}

# Offline verification + one-shot reconcile, via the audited metamorphic_log
# NIF (Hex). No token is needed: every byte below is already public.
base = "https://mosskeys.com/api/acme"
vkeys = ["<namespace vkey>"] # pinned out of band; your root of trust

# --- 1. PIN (online, once) -------------------------------------------
# Fetch the current signed checkpoint, verify its signature, then store
# {note, size, root} locally alongside the pinned vkeys.
pinned = Req.get!("#{base}/checkpoint").body
:ok = MetamorphicLog.Checkpoint.verify(pinned["note"], vkeys)

# --- 2. OFFLINE (no network) -----------------------------------------
# Verify cached inclusion proofs against the PINNED signed root. Because
# the pinned note was signature-checked above, this needs no server.
:ok =
  MetamorphicLog.Checkpoint.verify_inclusion(
    pinned["note"], vkeys,
    cached_entry["index"], cached_entry["leaf_hash"], cached_proof["proof"]
  )

# --- 3. ON RECONNECT: one-shot reconcile -----------------------------
# A single request returns the new head + the consistency proof from our
# pinned size, collapsing what was two serial round trips into one.
bundle = Req.get!("#{base}/log/reconcile", params: [since: pinned["size"]]).body

# Verify BOTH notes' signatures AND append-only continuity from the pin to
# the served head in one call. The degenerate empty proof (pin already
# current) verifies trivially.
:ok =
  MetamorphicLog.Checkpoint.verify_consistency(
    pinned["note"],               # older, pinned checkpoint note
    bundle["checkpoint"]["note"], # newer, served checkpoint note
    vkeys,
    bundle["consistency_proof"]["proof"]
  )

# Continuity holds relative to your pin: RE-PIN to the new checkpoint and
# keep going. (The lower-level MetamorphicLog.Proof.verify_consistency/5
# checks the proof alone if you have already verified both notes.)
pinned = bundle["checkpoint"]

curl https://mosskeys.com/api/acme/log/tile/0/000 -o tile-0-000.bin

{ "error": "not found" }

# The one-liner: verify a label's key history read-only, no token, no
# account. It fetches the label head + inclusion proof + signed checkpoint
# and checks them through the SAME metamorphic-log verifier used everywhere
# else. Exit code 0 = verified; non-zero maps the failure (a rewritten head
# exits with the head_mismatch code).
mosskeys verify --namespace acme --label alice@example.com

# Pin the namespace's published verifier key(s) to also check the
# checkpoint co-signatures, and a previously saved checkpoint to prove
# append-only continuity. --json emits a machine-readable result.
mosskeys verify -n acme --label alice@example.com \
  --verifier-key "<namespace vkey>" \
  --pin ./pinned-checkpoint.note --json

// A full "fetch a key, then verify it against a signed checkpoint" flow.
// No token is needed: every byte below is already public.
//
// The verifier comes from the audited metamorphic-log WASM package. One call
// (checkpointVerifyInclusion) verifies the checkpoint SIGNATURE against the
// namespace's trusted key AND that the leaf is included under the signed
// root; it throws on any mismatch. That is the whole trust check.
import init, { checkpointVerifyInclusion } from "metamorphic-log";

const base = "https://mosskeys.com/api/acme";
// The namespace's published verifier key(s), in C2SP vkey form. You obtain
// these out of band (e.g. from the namespace page) and pin them; this is
// your root of trust, so never fetch them from the same response you verify.
const VKEYS = ["<namespace vkey>"];

await init();

// 1. Pin to the log's current signed tree head.
const checkpoint = await (await fetch(`${base}/checkpoint`)).json();

// 2. Fetch the leaf you care about (here, index 0).
const entry = await (await fetch(`${base}/log/entries/0`)).json();

// 3. Fetch an inclusion proof sized to the checkpoint.
const proof = await (
  await fetch(`${base}/log/proof/inclusion?index=${entry.index}&size=${checkpoint.size}`)
).json();

// 4. Verify. Throws unless the checkpoint is validly signed AND the leaf is
//    provably included under its root.
checkpointVerifyInclusion(
  checkpoint.note,     // the signed checkpoint note (C2SP)
  VKEYS,               // trusted verifier key(s) for this namespace
  BigInt(entry.index), // leaf index
  entry.leaf_hash,     // base64 leaf hash
  proof.proof,         // array of base64 sibling hashes
);

// Reached here without throwing: the key in `entry` is provably part of the
// log the checkpoint committed to. You never had to trust the server.

# The same check server-side or in any Elixir service, via the audited
# metamorphic_log NIF (Hex). Add {:metamorphic_log, "~> 0.1"} to your deps.
base = "https://mosskeys.com/api/acme"
vkeys = ["<namespace vkey>"] # pinned out of band; your root of trust

checkpoint = Req.get!("#{base}/checkpoint").body
entry = Req.get!("#{base}/log/entries/0").body

proof =
  Req.get!("#{base}/log/proof/inclusion",
    params: [index: entry["index"], size: checkpoint["size"]]
  ).body

# Verifies the checkpoint signature AND inclusion under the signed root.
:ok =
  MetamorphicLog.Checkpoint.verify_inclusion(
    checkpoint["note"],
    vkeys,
    entry["index"],
    entry["leaf_hash"],
    proof["proof"]
  )

# ONLINE — verify an agent identity's current key against the latest signed
# checkpoint. No token, no account. Exit 0 = verified; non-zero is scriptable.
mosskeys verify -n acme --label "agent:billing-bot@acme"

# OFFLINE (edge / air-gapped) — verify a checkpoint note you pinned earlier,
# plus its witness co-signatures, with no network at all.
mosskeys verify --checkpoint ./pinned-checkpoint.note --verifier-key "<vkey>"

# OFFLINE continuity (reconcile) — prove a newer pinned checkpoint is an
# append-only extension of an older one, from saved files, no network.
mosskeys verify --checkpoint ./newer.note --pin ./older.note \
  --consistency ./consistency.json --verifier-key "<vkey>"

# SUPPLY-CHAIN — prove an artifact/leaf digest is committed at a known index.
# --json emits a machine-readable result for a fleet controller to parse.
mosskeys verify -n acme --digest <sha-256 hex> --index 42 --json