// 1. Install the SDK · one package · namespaces per Module // npm install @h33/sdk import { H33 } from '@h33/sdk' // 2. Load an H33-Key Reference · h33k_... only · never a raw provider secret const h33 = new H33() const key = await h33.key.load('h33k_9fA2c7...b41d') // 3. Governed resolve · purpose-bound · permitted or denied · always evidenced const verdict = await key.resolveFor({ purpose: 'auth.biometric.verify' }) if (verdict.status === 'denied') { // First-class outcome · not an error // verdict.reason ∈ { VIRTUALIZED_KEY_UNKNOWN, VIRTUALIZED_KEY_PURPOSE_NOT_ALLOWED, VIRTUALIZED_KEY_REVOKED } console.log(verdict.reason, verdict.receipt) return } // 4. Materialize for exactly ONE runtime use · secret never leaves resolve boundary const result = await verdict.use(async (secret) => h33.auth.verify({ biometric: captureData, userId: 'user_abc123', secret, // resolved plaintext · scoped to this call only })) // 5. Evidence receipt is attached to every governed resolve · replayable via Governance Replay console.log(result.verified, verdict.receipt.id())

# 1. Install the SDK · one package · namespaces per Module # pip install h33 import h33 # 2. Load an H33-Key Reference · h33k_... only · never a raw provider secret key = h33.key.load("h33k_9fA2c7...b41d") # 3. Governed resolve · purpose-bound · permitted or denied · always evidenced verdict = key.resolve_for(purpose="auth.biometric.verify") if verdict.status == "denied": # First-class outcome · not an error # verdict.reason ∈ { VIRTUALIZED_KEY_UNKNOWN, VIRTUALIZED_KEY_PURPOSE_NOT_ALLOWED, VIRTUALIZED_KEY_REVOKED } print(verdict.reason, verdict.receipt) return # 4. Materialize for exactly ONE runtime use · secret never leaves resolve boundary with verdict.use() as secret: result = h33.auth.verify( biometric=capture_data, user_id="user_abc123", secret=secret, ) # 5. Evidence receipt is attached to every governed resolve · replayable print(result.verified, verdict.receipt.id())

# 1. Reference an H33-Key Reference · h33k_... only · never a raw secret in env or args export H33_KEY_REF="h33k_9fA2c7...b41d" # 2. Governed resolve · purpose-bound · verdict is permitted or denied (both first-class) curl -X POST https://api.h33.ai/v1/key/resolve \ -H "H33-Key-Ref: $H33_KEY_REF" \ -H "Content-Type: application/json" \ -d '{ "purpose": "auth.biometric.verify" }' # 3. Permitted response · returns a one-shot resolve handle + evidence receipt { "status": "permitted", "resolveHandle": "rh_1a3f...one-shot", "receipt": { "id": "rec_...", "signature": "ML-DSA-65" } } # Denied response · first-class outcome, not an error # { "status": "denied", "reason": "VIRTUALIZED_KEY_PURPOSE_NOT_ALLOWED", "receipt": {...} } # 4. Use the resolveHandle for exactly ONE call · plaintext never crosses this API boundary curl -X POST https://api.h33.ai/v1/auth/verify \ -H "H33-Resolve-Handle: rh_1a3f..." \ -d '{ "biometric": "base64_template", "userId": "user_abc123" }'

// 1. Install: go get github.com/h33/sdk // 2. Load an H33-Key Reference · h33k_... only · never a raw provider secret package main import ( "context" "github.com/h33/sdk" ) func main() { ctx := context.Background() h := h33.New() key, _ := h.Key().Load(ctx, "h33k_9fA2c7...b41d") // Governed resolve · purpose-bound · verdict is permitted or denied verdict, _ := key.ResolveFor(ctx, h33.Purpose("auth.biometric.verify")) if verdict.Denied() { // verdict.Reason ∈ { VirtualizedKeyUnknown, VirtualizedKeyPurposeNotAllowed, VirtualizedKeyRevoked } fmt.Println(verdict.Reason, verdict.Receipt) return } // Materialize for exactly ONE runtime use · secret scoped to this closure result, _ := verdict.Use(func(secret []byte) (any, error) { return h.Auth().Verify(ctx, h33.AuthRequest{UserID: "user_abc123", Biometric: template, Secret: secret}) }) fmt.Println(result, verdict.Receipt.ID()) }

// 1. Add to Cargo.toml: h33 = "1" // 2. Load an H33-Key Reference · h33k_... only · never a raw provider secret use h33::{Client, Purpose, Verdict}; #[tokio::main] async fn main() -> h33::Result<()> { let h = Client::new(); let key = h.key().load("h33k_9fA2c7...b41d").await?; // Governed resolve · purpose-bound · verdict is Permitted or Denied match key.resolve_for(Purpose("auth.biometric.verify")).await? { Verdict::Denied { reason, receipt } => { // reason ∈ { VirtualizedKeyUnknown, VirtualizedKeyPurposeNotAllowed, VirtualizedKeyRevoked } println!("denied: {:?} receipt={}", reason, receipt.id()); } Verdict::Permitted(handle) => { // Materialize for exactly ONE runtime use · secret scoped to closure let result = handle.use_with(|secret| h.auth().verify(user_id, face_embedding, secret)).await?; println!("verified={} receipt={}", result.verified, result.receipt.id()); } } Ok(()) }