Verify in Node.js

import { readFileSync } from "node:fs";
import { verifyDoctrineSignature } from "acf-mcp/lib/doctrine-signature";

const signed = JSON.parse(readFileSync("./tool-output.json", "utf8"));
const ok = verifyDoctrineSignature({
  contentHash: signed.doctrine_hash,
  signature: signed.doctrine_signature,
  publicKey: signed.doctrine_public_key,
});
console.log(ok ? "✓ signature valid" : "✗ signature INVALID");

import { createPublicKey, verify } from "node:crypto";
import { readFileSync } from "node:fs";

// 1. Load the public key embedded in the acf-mcp release.
//    (For Node.js apps consuming the npm package, this lives at
//    node_modules/acf-mcp/dist/archive/doctrine-v1.0.json under
//    .meta.doctrine_public_key — the SPKI base64 form.)
const PUBLIC_KEY_SPKI_B64 =
  "MCowBQYDK2VwAyEAojtKfh20SGGV63LMETjZBXRWo2tY0viAYziG/y3/L0s=";

const publicKey = createPublicKey({
  key: Buffer.from(PUBLIC_KEY_SPKI_B64, "base64"),
  format: "der",
  type: "spki",
});

// 2. Read the signed tool output (anything returned by an acf.* tool).
const signed = JSON.parse(readFileSync("./tool-output.json", "utf8"));

// 3. Recompute what was signed: the doctrine_hash field as raw UTF-8.
const message = Buffer.from(signed.doctrine_hash, "utf8");

// 4. Strip the "ed25519:" prefix and decode the signature from base64.
const sigB64 = signed.doctrine_signature.replace(/^ed25519:/, "");
const signature = Buffer.from(sigB64, "base64");

// 5. Verify.
const ok = verify(null, message, publicKey, signature);
console.log(ok ? "✓ signature valid" : "✗ signature INVALID");