Prerequisites

• Node.js 18+
• Verifier API reachable (local API billing pilot or https://api.quantzk.com)
• QUANTZK_ATTEST_SECRET for issuance (not required for offline verify)

Path A — @quantzk/sdk (recommended)

Prefer the public verifier extract for offline verify + SDK workspace packages:

git clone https://github.com/ayitsomar/quantzk-verify.git
cd quantzk-verify
npm install --legacy-peer-deps

Issuance still needs the API (or the full monorepo protocol/ workspace with a running verifier-api).

import { QuantZK } from '@quantzk/sdk';
import { readFileSync } from 'fs';

const trustRoots = JSON.parse(
  readFileSync('conformance/qzr-1/trust-roots.json', 'utf8'),
);

const qzk = new QuantZK({
  baseUrl: process.env.QUANTZK_API_URL || 'http://localhost:3001',
  attestSecret: process.env.QUANTZK_ATTEST_SECRET,
  trustRoots,
});

const grant = await qzk.authorize({
  tenantId: 'cus_acme',
  tariffId: 'tariff_default',
  unitPriceMicros: 120,
  currency: 'USD',
});

const receipt = await qzk.record({
  eventId: 'evt_001',
  tenantId: 'cus_acme',
  units: 1842,
  unitPriceMicros: 120,
  authority: grant,
});

const result = await qzk.verify(receipt, { level: 'standard' });
console.log(result.headline);
// QUANTZK VERIFIED — QZR-1 STANDARD
console.log(result.levels);

What happened:

1. The API issued a signed charge grant (authorize) that predates execution.
2. The API attested the meter event + tariff against that grant and returned attestation, receipt, and billing fingerprint.
3. The SDK wrapped that into a portable QZR-1 .qzk object.
4. Offline verify evaluated Minimal / Standard / Strict predicates (Standard requires Phase-2 binding when the server issued billing_proof; a present but invalid grant fails Standard).

Hand the .qzk to a customer:

node packages/verify-cli/bin/quantzk-verify.js --trust-roots conformance/qzr-1/trust-roots.json \
  --level standard billing-receipt.qzk

Path B — two HTTP calls

See API billing pilot for raw POST /api/vdi/billing/attest + POST /api/vdi/billing/verify.

Path C — generic VDI (non-billing)

Offline verify from the public extract (not yet on the public npm registry as standalone packages):

git clone https://github.com/ayitsomar/quantzk-verify.git
cd quantzk-verify
npm install --legacy-peer-deps

import { verify } from '@quantzk/vdi-verifier';

const offline = await verify(attestation);
console.log(offline.valid);

Full issuer / attest stack remains in the monorepo: ayitsomar/zkCaptcha-backend → protocol/.

Levels (short)

Level	Use when
minimal	Historical attestation + fingerprint is enough
standard	You want a cryptographically bound billing receipt (Phase-2)
strict	Bound receipt plus fresh revocation / current trust

Details: QZR-1, SDK, Verify CLI.

Next Steps

• API billing pilot — HTTP runbook, failure modes, tests
• LiteLLM adapter — gateway usage → receipts
• Design partner kit — outbound partner checklist
• Trust Model — receipts, profiles, transparency
• Public source — ayitsomar/quantzk-verify