AffixIO Demo

Official integration demo for @affix-io/sdk-light: post-quantum eligibility validation, Merkle audit, and QR/barcode presentment across 16 database formats.

Demo API key included. Clone, install, run. No AffixIO account required to try the harness (uses the public demo key against api.affix-io.com).

---

What this repo does

This is a working reference for privacy-preserving validation with post-quantum cryptography (PQC):

Layer	Technology
Local prove	AffixIO Light HMAC (milliseconds, offline-capable)
Remote attest	ML-DSA-65 (NIST post-quantum signature)
Audit trail	Merkle tree anchoring on api.affix-io.com
Presentment	QR codes and barcodes (Code128, PDF417, DataMatrix)

The demo generates 150 synthetic patient records per format (CSV, JSON, Mongo export, Redis dump, dBase, LDIF, INI, fixed-width, SQL, XML with 600 rows, and more). Each record includes synthetic PII (names, NHS numbers, DOB, postcode, email, phone) so adapters exercise realistic source data. Proofs, QR/barcode sidecars, and everything under output/ must never contain that PII; the harness scans artifacts after every batch run.

Hub metrics you will see when running against the demo key:

• Proofs made = ML-DSA attest calls (/api/attest)
• Proofs validated = Merkle audit calls (/v1/merkle/audit, batch)
• Failed (24h) = intentional 4xx injection tests (controlled errors, not crashes)

Rate limit in this repo: 4 requests/second (matches demo key quota on the API).

---

Quick start

Requirements: Node.js 20+

git clone https://github.com/AffixIO/demo.git
cd demo
npm install
npm run generate    # build 16 database formats under data/
npm run batch       # full harness (~40s, 250+ scenarios)

Optional:

npm test            # unit/integration tests
npm run validate    # per-store attest report
BATCH_SEED=42 npm run batch   # reproducible run

Demo API key

A public demo key is wired in lib/config.mjs. You do not need to create keys to run the demo:

demo_8be462d6b2ce64216f23b3a544f98d6a0860fc635011b34c5b178ae78cfd05af

Replace with your own key for production:

export AFFIX_API_KEY='aio_your_key_here'
npm run batch

---

Project layout

demo/
├── data/                 # Generated databases (run npm run generate)
│   ├── modern/           # JSON, KV, Mongo, Redis, NDJSON
│   ├── legacy/           # CSV, TSV, pipe, DBF, XML, LDIF, INI, fixed-width
│   ├── sql/              # SQL script for in-memory engine
│   └── patients-large.xml
├── lib/
│   ├── batch-runner.mjs  # Huge batch orchestrator
│   ├── config.mjs        # Demo key + 4/sec rate limit
│   ├── record-picker.mjs # Random records per store
│   └── expected-api-failures.mjs
├── scripts/
│   ├── generate-databases.mjs
│   ├── run-batch-huge.mjs
│   └── validate-all.mjs
└── tests/                # node:test suites

---

What each command runs

npm run generate

Creates synthetic datasets for every adapter supported by SDK-Light data-check:

• Modern: JSON document, key-value, Mongo/NDJSON, Redis export, SQL script
• Legacy: CSV, TSV, semicolon, pipe, fixed-width, dBase DBF, XML, LDIF, INI
• Large XML: 600-row patients-large.xml

Writes data/manifest.json with sample IDs that pass policy checks.

npm run batch

The main demo. For each of 16 stores, picks 6 random records (half pass, half fail) and exercises:

1. Data check → proveFromCheck (offline)
2. QR / barcode → generateCodeFromCheck → readCode scan simulation
3. Tamper rejection (corrupted carrier or sidecar)
4. Alternate prove paths: checkAndProve, buildWitness, generateCodeFromProve
5. Remote verify (pass records only) → ML-DSA attest
6. Merkle batch + flush to AffixIO
7. Expected API failures (8 controlled 4xx calls for hub "Failed" metric)

Success criteria: FALSE POSITIVES: 0 (fail records must never scan as admitted).

npm run validate

One pass/fail cycle per store with live attest + Merkle for yes proofs.

npm test

Runs all tests/*.test.mjs including the huge batch (tests/batch-huge.test.mjs).

---

SDK features demonstrated

Feature	Demo coverage
openDataStore	All 16 manifest store kinds
proveFromCheck	Pass + fail policy alignment
checkAndProve	Single-call lookup + prove
proveFromCheckAndVerify	Online ML-DSA attest
generateCodeFromCheck	DB → prove → scannable code
readCode	Admit yes / reject no / reject tamper
flushOfflineQueue	Digest batch sync
buildMerkleBatch	Client-side Merkle inclusion
QR full / compact	Sidecar for compact carriers
Barcodes	Code128, PDF417, DataMatrix

---

Extending with agents (LLM)

This harness is designed to plug into agent workflows without sending PII to a model:

1. Tool: check_eligibility — pass a store kind, record ID, and required status; receive { pass, decision, proof_id }.
2. Tool: issue_pass — call generateCodeFromCheck and return a QR SVG path or carrier string for gate scanners.
3. Tool: verify_scan — wrap readCode for admission at a venue.

An LLM agent orchestrates natural language ("Is patient P-0042 in ED?") into structured DataCheckQuery objects. The proof and attest stay on your host; the agent only sees yes/no and opaque digests. Pair with AffixIO Hub for key usage and Merkle feed visibility.

Example agent prompt fragment:

Use the AffixIO demo tools. Never log raw patient fields. For eligibility questions, call check_eligibility against the JSON store. If pass, call issue_pass and return the QR file path.

---

Keywords (search and discovery)

Post-quantum cryptography, ML-DSA-65, FIPS 204, Merkle audit trail, eligibility validation, privacy-preserving verification, zero-knowledge light proofs, offline-first SDK, QR eligibility, barcode verification, healthcare policy check, KYC without PII, age assurance, agent tools, LLM integration, Node.js validation demo.

---

Links

• Website: affix-io.com
• SDK-Light npm: @affix-io/sdk-light
• API: api.affix-io.com
• Hub dashboard: hub.affix-io.com

---

License

Apache-2.0. See LICENSE.