# Aere.Cloud (.NET)

The official .NET client for the [Aere Cloud API](https://aere.network/cloud.html) on Aere Network (chain 2800).
**No dependencies** beyond the .NET base library (`System.Net.Http`, `System.Text.Json`, `System.Security.Cryptography`).
Targets .NET 8 (LTS) and runs on later versions. Same routes and semantics as the JS, Python, Go and Java clients 1.7.0,
including `VerifyAsync`, the Trust API, and `IdentityVerifyAsync` / `ComplianceCheckAsync`.

JSON routes return the server's JSON as a `JsonElement`, so you bind it to the types you already use. The two routes
that return files (the audit export and the check of a kept export) return typed results, with the SHA-256 computed
locally from the bytes received.

## Use

```csharp
using Aere.Cloud;

using var c = new AereCloudClient(Environment.GetEnvironmentVariable("AERE_KEY")!);
var head = await c.DataHeadAsync();                        // {"block":...,"chainId":2800,...}
ulong n = await c.BlockNumberAsync();

// the Trust API: any AERE Proof Protocol (AIP-23) envelope -> VALID / INVALID / PARTIAL, with the levels checked
var verdict = await c.VerifyAsync(JsonDocument.Parse(File.ReadAllText("envelope.json")).RootElement); // chain: 2800 or 28001, default = the one the envelope declares
// pass the parsed JsonElement (key order kept): the verdict hashes the statement in its own key order

// quantum-readiness scan of a domain's TLS edge: free, no key is sent unless you attest the report
var report = await c.ReadinessAsync("example.com");

// the audit log of a day as a file; Verified is true only if the sha256 of the bytes you received equals the digest
AuditExport day = await c.AuditExportAsync("2026-09-24");

// a kept export still matches the day we hold, or the tombstone a deleted day left behind
KeptCheck k = await c.AuditVerifyKeptAsync("2026-05-01", keptBytes);

// verify a webhook delivery (constant-time HMAC-SHA256 over the exact bytes received)
bool ok = AereCloudClient.VerifyWebhook(rawBody, request.Headers["x-aere-signature"], secret);
```

Non-2xx answers are thrown as `AereCloudException` with `Status`, `Body` and `Path` (`Status` 0 = no answer; the
message never carries your key). The client does not follow redirects: a 3xx is returned as an answer, so your API key
is never sent to a host you did not name.

## Tests

```
dotnet run --project Aere.Cloud.Tests -c Release     # offline: a recording HTTP handler, plus a real local server for the redirect test
bash control-negativ.sh                               # breaks ten guards in a copy of the source; each one's test must fail
```

Measured 2026-09-28 (WSL, .NET SDK 10.0.302): 9 tests green; the negative control 10 of 10 red, the untouched source green.