Tamper-evident data for device fleets.

# pip install requests pynacl   (PyNaCl ships ARM wheels, installs on Raspberry Pi OS)
import json, base64, requests
from nacl.signing import VerifyKey

API = "https://dynamicfeed.ai"
r = requests.post(API+"/v1/batch", json={"calls":[{"tool":"air_quality","args":{"city":"Sydney"}}]}, timeout=20).json()
sig = r.pop("signature")                       # detach the signature block
msg = json.dumps(r, sort_keys=True, separators=(",",":")).encode()  # json-sorted-compact
jwks = requests.get(API+"/.well-known/keys", timeout=20).json()
pub  = base64.urlsafe_b64decode(jwks[sig["key_id"]] + "==")   # look key up by sig.key_id
VerifyKey(pub).verify(msg, base64.urlsafe_b64decode(sig["sig"] + "=="))  # raises if tampered
print("VALID", r["results"][0]["data"]["us_aqi"])    # act only after this passes
# full client (+ RFC 3161 timestamp of a local reading): clients/edge/raspberry-pi/

# keyless REST sensor, value + provenance/freshness as attributes
rest:
  - resource: https://dynamicfeed.ai/v1/batch
    method: POST
    headers: {"Content-Type": application/json}
    payload: '{"calls":[{"tool":"grid_carbon","args":{"region":"nsw"}}]}'
    scan_interval: 600
    sensor:
      - name: "Dynamic Feed Grid Carbon Intensity"
        value_template: "{{ value_json.results[0].data.carbon_intensity_g_per_kwh }}"
        unit_of_measurement: "gCO2/kWh"
        json_attributes_path: "$.results[0].data"
        json_attributes: ["provenance", "freshness", "method", "derived"]
# AU grid_carbon is DERIVED from live AEMO dispatch (not an official measurement);
# the tool says so in its own fields. Full config: integrations/home-assistant/

# 1) install the node into your Node-RED user dir, then restart (Node 18+, zero deps)
npm install /path/to/packages/node-red-dynamicfeed   # or, once published: node-red-contrib-dynamicfeed

# 2) in the editor: drop a "Dynamic Feed" node, set Tool + Args, wire to a debug node.
#    Per-message: leave Tool blank and set msg.tool + msg.payload (args) upstream.
# the node sets msg.payload to the full SIGNED envelope:
{ "calls": [ { "tool": "current_weather", "args": { "city": "Sydney" } } ] }
# → msg.payload = { count, results:[{tool,ok,data}], signature{alg,key_id,sig} }
# → msg.dynamicfeed = { tool, ok, data, signature }   (verify on the Pi-class host)

# pip install paho-mqtt requests pynacl
export MQTT_HOST=broker.example.com
export DF_TOOLS='current_weather:{"city":"Sydney"},air_quality:{"city":"Sydney"},grid_carbon'
export DF_INTERVAL_SEC=300
python bridge.py            # publishes RAW signed bytes to dynamicfeed/<tool> (one tool per batch)

# on any subscriber, re-canonicalize + verify the Ed25519 signature per message:
python verify_subscriber.py
# [verify] OK  dynamicfeed/air_quality: VALID (active key df-ed25519-6ca0de29113b)
# VALID = unaltered since we signed it; NOT a claim the value is correct.