One real run, captured and static

import { createHash, createPublicKey, verify } from "node:crypto";

function sortKeysDeep(v) {
  if (Array.isArray(v)) return v.map(sortKeysDeep);
  if (v && typeof v === "object") {
    return Object.keys(v).sort().reduce((acc, k) => ((acc[k] = sortKeysDeep(v[k])), acc), {});
  }
  return v;
}
const hashEvent = (c) => createHash("sha256").update(JSON.stringify(sortKeysDeep(c))).digest("hex");
const loadKey = (base64) => createPublicKey({ key: Buffer.from(base64, "base64"), format: "der", type: "spki" });

function verifyEvidenceChain(events, publicKeyBase64, keyDirectory = []) {
  const publicKey = loadKey(publicKeyBase64);
  const directory = new Map(keyDirectory.map((k) => [k.key_id, loadKey(k.public_key)]));
  let expectedSequence = events[0].sequence;
  let previousHash = events[0].previous_hash;
  for (const e of events) {
    if (e.sequence !== expectedSequence) return { ok: false, brokenAtSequence: e.sequence, reason: "sequence_gap" };
    if (e.previous_hash !== previousHash) return { ok: false, brokenAtSequence: e.sequence, reason: "previous_hash_mismatch" };
    const expected = hashEvent({
      organization_id: e.organization_id, sequence: e.sequence, type: e.type, subject_type: e.subject_type,
      subject_id: e.subject_id, payload: e.payload, previous_hash: e.previous_hash, created_at: e.created_at,
    });
    if (expected !== e.hash) return { ok: false, brokenAtSequence: e.sequence, reason: "hash_mismatch" };
    // No key_id at all -> this chain's one key, publicKey. A key_id present
    // but not in the directory fails closed -- never silently falls back.
    const signingKey = e.key_id ? directory.get(e.key_id) : publicKey;
    try {
      if (!signingKey || !verify(null, Buffer.from(e.hash, "hex"), signingKey, Buffer.from(e.signature, "base64")))
        return { ok: false, brokenAtSequence: e.sequence, reason: "signature_invalid" };
    } catch {
      return { ok: false, brokenAtSequence: e.sequence, reason: "signature_invalid" };
    }
    previousHash = e.hash;
    expectedSequence += 1;
  }
  return { ok: true, signed: true };
}

// Paste "events", "public_key", and "key_directory" from this page (or from
// GET /v1/evidence + GET /v1/evidence/public-key) below, then run this file.
// A passing result proves Waysafe signed this exact record and nothing in
// it was altered afterward -- it does NOT prove completeness (that nothing
// happened outside this chain); see the note below the snippets.
const events = [ /* evidence.events from this page */ ];
const publicKey = "..."; // evidence.public_key from this page
const keyDirectory = [ /* evidence.key_directory from this page */ ];
console.log(verifyEvidenceChain(events, publicKey, keyDirectory));

import { verifyEvidenceIndependently } from "@waysafe/sdk";

// events: from GET /v1/evidence (or "evidence.events" in proof.json)
// publicKey: from GET /v1/evidence/public-key's "public_key" (or "evidence.public_key" below)
// keyDirectory: that same response's "key_directory" (or "evidence.key_directory" below) --
// an event carrying a key_id is checked against the matching entry; an
// event with none falls back to publicKey.
const result = verifyEvidenceIndependently(events, publicKey, keyDirectory);
// { ok: true, signed: true } -- checked locally, no network call,
// no trust in the server that produced the data. Same algorithm as the
// self-contained node:crypto version above; this is the SDK's own copy of it.

[
  {
    "id": "ev_01m2rbew7fb75ds8vhvh80bwaw",
    "organization_id": "org_demo",
    "sequence": 436,
    "type": "passkey.registered",
    "subject_type": "principal",
    "subject_id": "prin_01m2rbeth8fj8aj10613h3f44n",
    "payload": {
      "credential_id": "96_4u4fbOvNGwqGETE-zxQ"
    },
    "previous_hash": "427b53557eb51797843695777056485d441fa87489b1db3c12390f1e37642840",
    "hash": "1079aeb64b183e80f8f4de2aae2fdcfc6f794bd488ce5715de5cafb10af6e2b0",
    "signature": "AMFa5PU9pO9ud+VwO6IdNo+9nWi0pj377c95rctkDhogUB3tWXFrTC72IkHyUmXUNDvOSWrRCFZfANti/DzeCQ==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:26.528Z"
  },
  {
    "id": "ev_01m2rbex48kg49n1tesy6cthj6",
    "organization_id": "org_demo",
    "sequence": 437,
    "type": "mandate.authenticated",
    "subject_type": "mandate_version",
    "subject_id": "mdv_01m2rbett9gnyx44a57em5a0m1",
    "payload": {
      "credential_id": "96_4u4fbOvNGwqGETE-zxQ"
    },
    "previous_hash": "1079aeb64b183e80f8f4de2aae2fdcfc6f794bd488ce5715de5cafb10af6e2b0",
    "hash": "a05e6b17b940b0917ed961445af26d361a4d83be87a3763e641c6cef1526d3de",
    "signature": "8s1fD073/4FVs+H496IrUTij6SiAEGVt6gTBflp8KxPAOrDxXogeDqPMaiUv8RNKoJ0W6Pv0PNDBrs5IMqqBCw==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:26.528Z"
  },
  {
    "id": "ev_01m2rbf5g0y0mv75stvwd2b2j5",
    "organization_id": "org_demo",
    "sequence": 438,
    "type": "passkey.registered",
    "subject_type": "principal",
    "subject_id": "prin_01m2rbf4m8s1dqctj2wyfyeq1k",
    "payload": {
      "credential_id": "EChmndtpjdqUjsEr58kGAQ"
    },
    "previous_hash": "a05e6b17b940b0917ed961445af26d361a4d83be87a3763e641c6cef1526d3de",
    "hash": "b766b95b18f8c8f58e0a907df6651e46b87ad924991ee43eda6e3fbb6ec9eea2",
    "signature": "3MJyXPN4K0/fbuKLIfDdDeJJaIJOleuo3E4d2FJJ1CCoRnGeEqFpeZjeOZZNu1xtgEgfXDz3s/BZxh/BfyA/Cg==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:36.348Z"
  },
  {
    "id": "ev_01m2rbf6529zabddemwjxs1mdf",
    "organization_id": "org_demo",
    "sequence": 439,
    "type": "mandate.authenticated",
    "subject_type": "mandate_version",
    "subject_id": "mdv_01m2rbf4vhp49btr177jagvyfa",
    "payload": {
      "credential_id": "EChmndtpjdqUjsEr58kGAQ"
    },
    "previous_hash": "b766b95b18f8c8f58e0a907df6651e46b87ad924991ee43eda6e3fbb6ec9eea2",
    "hash": "fbf43536f6f3f31e7c4c5b9538921c38709533dc0bc2375f1b76838b6ebcad27",
    "signature": "nWJWdnQ7jfYjjAM7OZsSQuJoma4zxl6VF5RINW5Mq3OPWxkCEMejzE1izSVUqD7eCX/7dVQh+sMkpONYHY5SDw==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:36.348Z"
  },
  {
    "id": "ev_01m2rbfc2zj3tm6wgg57521pc9",
    "organization_id": "org_demo",
    "sequence": 440,
    "type": "enforcement.stripe_issuing.decision",
    "subject_type": "authorization",
    "subject_id": "auth_01m2rbfbjv6s5wjw1117sc9h9m",
    "payload": {
      "amount": 450,
      "card_id": "ic_demo_mdt_01m2rbf4vhfkp3zfrpcjb9avmp",
      "currency": "USD",
      "decision": "ALLOW",
      "merchant": {
        "mcc": "5999",
        "network_mid": "goodbeans_card_9001"
      },
      "reason_codes": [
        "ALLOW_WITHIN_MANDATE"
      ],
      "instrument_id": "inst_01m2rbfaz437nggjjgfxv2f0g1",
      "stripe_authorization_id": "iauth_demo_goodbeans_card_9001"
    },
    "previous_hash": "fbf43536f6f3f31e7c4c5b9538921c38709533dc0bc2375f1b76838b6ebcad27",
    "hash": "3fde1fb790e8dc4abd46c8497ddd3cd892af95cac6bf91d0fbade9a9514a9ef4",
    "signature": "CIcBjdnbHHYINRawSdPxqWATW03Sp4xE5ZbOoqpmWLBOUVXD8NYJlvOZaYR64Tl8loeCOB/DgDC//v4Cotd3BA==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:42.244Z"
  },
  {
    "id": "ev_01m2rbfct8b7s51w4bepzk0wp5",
    "organization_id": "org_demo",
    "sequence": 441,
    "type": "enforcement.stripe_issuing.decision",
    "subject_type": "authorization",
    "subject_id": "auth_01m2rbfcf7wchhavgepmyt9126",
    "payload": {
      "amount": 899,
      "card_id": "ic_demo_mdt_01m2rbf4vhfkp3zfrpcjb9avmp",
      "currency": "USD",
      "decision": "DENY",
      "merchant": {
        "mcc": "5999",
        "network_mid": "unknown_subscription_5210"
      },
      "reason_codes": [
        "DENY_MERCHANT_NOT_ALLOWLISTED"
      ],
      "instrument_id": "inst_01m2rbfaz437nggjjgfxv2f0g1",
      "stripe_authorization_id": "iauth_demo_unknown_subscription_5210"
    },
    "previous_hash": "3fde1fb790e8dc4abd46c8497ddd3cd892af95cac6bf91d0fbade9a9514a9ef4",
    "hash": "5c8c3655b57050da3857f99901b9ca95ca344e6fbcdf9d189bc2377e703b09a0",
    "signature": "NiueaTh7NYywmw+ZalDA9x7+IFoAHZnm/v2upEE8RAcnYNhG4wJ0jDol4BtF6xlD2wY8vo1BcgmQn8LzP3B1Bg==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:42.244Z"
  },
  {
    "id": "ev_01m2rbfdhd78x0ebc41acqx2xq",
    "organization_id": "org_demo",
    "sequence": 442,
    "type": "enforcement.stripe_issuing.decision",
    "subject_type": "authorization",
    "subject_id": "auth_01m2rbfd75nbq8xxn7x72r5657",
    "payload": {
      "amount": 1500,
      "card_id": "ic_demo_mdt_01m2rbf4vhfkp3zfrpcjb9avmp",
      "currency": "USD",
      "decision": "DENY",
      "merchant": {
        "mcc": "5999",
        "network_mid": "goodbeans_card_9001"
      },
      "reason_codes": [
        "DENY_TRANSACTION_LIMIT_EXCEEDED"
      ],
      "instrument_id": "inst_01m2rbfaz437nggjjgfxv2f0g1",
      "stripe_authorization_id": "iauth_demo_goodbeans_card_9001"
    },
    "previous_hash": "5c8c3655b57050da3857f99901b9ca95ca344e6fbcdf9d189bc2377e703b09a0",
    "hash": "595203622fd0c43d2a07e1569d0a686384d40ae6104c9193deb6c5a36daa8296",
    "signature": "Yuca1M7IWVJUyxqb9caBpKtaFT9xMtKhq+ismRNWWfgEDQEGTiIiaquwBKUM2n3r1sSBrMg2/MTt1VhgI8ayCw==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:53:42.244Z"
  },
  {
    "id": "ev_01m2rbg24kt6pxa437e5gbj5g0",
    "organization_id": "org_demo",
    "sequence": 443,
    "type": "enforcement.x402.decision",
    "subject_type": "authorization",
    "subject_id": "auth_01m2rbg1jhtjdcex38kp6zzbx4",
    "payload": {
      "asset": "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
      "amount": 50,
      "pay_to": "0x600dc0ff600Dc0FF600dC0fF600dc0ff600dC0fF",
      "network": "polygon-amoy",
      "currency": "USD",
      "decision": "ALLOW",
      "merchant": {
        "name": "GoodBeans API -- 1 inference credit",
        "domain": "127.0.0.1",
        "onchain_address": "0x600dc0ff600dc0ff600dc0ff600dc0ff600dc0ff"
      },
      "reason_codes": [
        "ALLOW_WITHIN_MANDATE"
      ],
      "resource_url": "http://127.0.0.1:4402/pay/goodbeans",
      "instrument_id": "inst_01m2rbexd300e52483f86dxyqv"
    },
    "previous_hash": "595203622fd0c43d2a07e1569d0a686384d40ae6104c9193deb6c5a36daa8296",
    "hash": "5487da0d28ef4110d06db7e54e283c6d2a911f2a3a181ad2c7780d97d3cbbeed",
    "signature": "XHTZh7TOK4CUIZrlepGbGTDodtUEnUbQX5UgpkmY4ZENV/RKCi7eiWtCbzd5kdMkBxThtWnvuYubqTkUVZRxAw==",
    "key_id": "2a71ea6ee10e66a5",
    "created_at": "2026-09-17T18:54:04.923Z"
  }
]

MCowBQYDK2VwAyEAYlvrdOK8J275U6kFy+421nPqnWGpEQr0zBoOun3RJzk=

[
  {
    "key_id": "2a71ea6ee10e66a5",
    "public_key": "MCowBQYDK2VwAyEAYlvrdOK8J275U6kFy+421nPqnWGpEQr0zBoOun3RJzk=",
    "valid_from": null
  }
]