// A server that signs its exports, and a check that a file came from it unchanged.
//
//   quillo run signatures.qwe      then open http://localhost:8080/export

use "signatures.qwer"

// In a real app the private key comes from the environment: SIGNING_KEY=$(sig_keypair().private)
let KEYS = sig_keypair()
let PRIVATE = env("SIGNING_KEY") ?? KEYS.private
let PUBLIC = sig_public_key(PRIVATE)?

route GET /export {
    let body = json.stringify({ orders: [{ id: 1, total: 120.5 }], at: "2026-11-02" })
    { body, signature: sig_sign(body, PRIVATE)?, public_key: PUBLIC }
}

route GET /check {
    let body = "invoice 2026-114: 120.50 EUR"
    let signature = sig_sign(body, PRIVATE)?
    {
        genuine: sig_verify(body, signature, PUBLIC)?,
        tampered: sig_verify("invoice 2026-114: 920.50 EUR", signature, PUBLIC)?,
        other_key: sig_verify(body, signature, sig_keypair().public)?,
    }
}