# aere-cloud (Go)

The official Go client for the [Aere Cloud API](https://aere.network/cloud.html) on Aere Network (chain 2800).
**Zero dependencies** beyond the Go standard library. Same routes and semantics as the JS, Python and Java
clients 1.5.0.

JSON routes return the server's JSON as `json.RawMessage`, so you decode it into the types you already use. The two
routes that return files (the audit export and the check of a kept export) return typed results, with the SHA-256
computed locally from the bytes received.

## Use

```go
import aerecloud "git.aere.network/aere-network/aere-cloud-sdk/go"

c, err := aerecloud.New(os.Getenv("AERE_KEY"))
head, err := c.DataHead(ctx)                         // {"block":...,"chainId":2800,...}
n, err := c.BlockNumber(ctx)

// quantum-readiness scan of a domain's TLS edge: free, no key is sent unless you attest the report
report, err := c.Readiness(ctx, "example.com", false, false)

// the audit log of a day as a file; Verified is true only if the sha256 of the bytes you received equals the digest
day, err := c.AuditExport(ctx, "2026-09-24", "jsonl")

// a kept export still matches the day we hold, or the tombstone a deleted day left behind
k, err := c.AuditVerifyKept(ctx, "2026-05-01", keptBytes)

// Trust API (1.6.0): any AERE Proof Protocol (AIP-23) envelope -> VALID / INVALID / PARTIAL; chain 0 = the one the envelope declares.
// Pass the envelope's bytes as received (os.ReadFile): a Go map would sort the keys and change the statement's hash.
verdict, err := c.Verify(ctx, json.RawMessage(envelopeBytes), 2800)

// identity and compliance (1.7.0): the presentation, keys, lists and policy travel as their JSON bytes (numbers above 2^53 stay exact)
id, err := c.IdentityVerify(ctx, aerecloud.IdentityVerifyRequest{Presentation: presBytes, Audience: "https://your.app/verifier", Nonce: nonce,
	TrustedIssuers: []json.RawMessage{json.RawMessage(`"aere-id:..."`)}, StatusLists: []json.RawMessage{listBytes}})
ok, err := c.ComplianceCheck(ctx, aerecloud.ComplianceCheckRequest{Presentation: presBytes, Policy: policyBytes, Audience: "https://your.app/verifier", Nonce: nonce, Record: true})

// verify a webhook delivery (constant-time HMAC-SHA256 over the exact bytes received)
ok := aerecloud.VerifyWebhook(rawBody, r.Header.Get("x-aere-signature"), secret)
```

Non-2xx answers come back as `*aerecloud.Error` with `Status`, `Body` and `Path`. The client does not follow
redirects: a 3xx is returned as an answer, so your API key is never sent to a host you did not name.

## Tests

```
go test ./...                 # offline, against a local httptest server
node control-negativ.mjs      # breaks six guards in a copy of the package; each one's test must fail
```

Measured 2026-09-25: 7 tests green; the negative control 6 of 6 red, the untouched package green.