# Photonictag resolver

Every tagged product has a GS1 Digital Link URL: https://tag.photonictag.com/01/{GTIN}/21/{serial}
Request it with "Accept: application/json" to get the signed record:
  {"record": {...schema.org Product...}, "signature": {"alg": "Ed25519", "kid": "...", "value": "..."},
   "keysUrl": "/.well-known/trustlayer/keys", "resolveCount": 3}

Verify: fetch brand keys from https://tag.photonictag.com/.well-known/trustlayer/keys, pick the key whose kid matches,
and check the Ed25519 signature over the record serialized as JSON with sorted keys and no whitespace.
Images may carry an invisible TrustMark watermark with a 61-bit ID; resolve it at https://tag.photonictag.com/id/{16 hex digits}.

MCP server (streamable HTTP): https://tag.photonictag.com/mcp
Tools: verify_product_link, verify_watermark_id, check_listing_claims. Only call a product genuine when verified=true.