Every event ends in a receipt anyone can check.

#!/usr/bin/env node
// Verify a me.ochk.io envelope with nothing but Node 18+.
//   node verify-envelope.mjs <envelope-id> [https://me.ochk.io]
import { createHash, createPublicKey, verify } from 'node:crypto';

const [id = 'oc-me-example-receipt', base = 'https://me.ochk.io'] = process.argv.slice(2);
const get = (path) => fetch(base + path).then((r) => r.json());

// 1. The envelope: its canonical bytes, and the signature over them.
const env = await get(`/api/envelope/${encodeURIComponent(id)}?format=wrapped`);
if (!env.ok || !env.signature) throw new Error(`no signed envelope at ${id}`);
const bytes = Buffer.from(env.canonical_b64, 'base64');

// 2. The key it names, from the published key set.
const jwks = await get('/.well-known/oc-envelope-jwks.json');
const jwk = jwks.keys.find((k) => k.kid === env.signature.kid);
if (!jwk) throw new Error(`key ${env.signature.kid} is not in the published set`);

// 3. Ed25519 over the canonical bytes themselves, not over a hash of them.
const ok = verify(
    null,
    bytes,
    createPublicKey({ key: jwk, format: 'jwk' }),
    Buffer.from(env.signature.sig_hex, 'hex')
);

// 4. The content address. A billable event's id is a routing id, so it is
//    reported, not compared; the other envelope kinds are named by it.
const sha256 = createHash('sha256').update(bytes).digest('hex');

// 5. The OpenTimestamps proof, when anchored, is over that digest:
//    save env.ots.proof_b64 and walk it with the `ots` client and your node.

// 6. Nostr carries a salted commitment, never the envelope (drop manifests
//    excepted). Recompute it; the kind-30087 event under env.nostr.d_tag holds it.
let nostr = 'not published';
if (env.nostr?.salt_hex) {
    const commitment = createHash('sha256')
        .update(Buffer.from('oc-me-commit/v1\0'))
        .update(Buffer.from(env.nostr.salt_hex, 'hex'))
        .update(bytes)
        .digest('hex');
    if (commitment !== env.nostr.commitment_hex) throw new Error('nostr commitment mismatch');
    nostr = env.nostr.d_tag;
} else if (env.nostr) nostr = env.nostr.d_tag;

console.log({
    id,
    ok,
    kid: env.signature.kid,
    sha256,
    ots: env.ots?.status ?? 'not anchored',
    nostr,
});
process.exit(ok ? 0 : 1);