@aptos-labs/inference-verifier 0.0.0-stage → 0.1.0

package/dist/trusted_root.json

@@ -0,0 +1,126 @@
+{
+    "mediaType": "application/vnd.dev.sigstore.trustedroot+json;version=0.1",
+    "tlogs": [
+        {
+            "baseUrl": "https://rekor.sigstore.dev",
+            "hashAlgorithm": "SHA2_256",
+            "publicKey": {
+                "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE2G2Y+2tabdTV5BcGiBIx0a9fAFwrkBbmLSGtks4L3qX6yYY0zufBnhC8Ur/iy55GhWP/9A/bY2LhC30M9+RYtw==",
+                "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+                "validFor": {
+                    "start": "2021-01-12T11:53:27Z"
+                }
+            },
+            "logId": {
+                "keyId": "wNI9atQGlz+VWfO6LRygH4QUfY/8W4RFwiT5i5WRgB0="
+            }
+        },
+        {
+            "baseUrl": "https://log2025-1.rekor.sigstore.dev",
+            "hashAlgorithm": "SHA2_256",
+            "publicKey": {
+                "rawBytes": "MCowBQYDK2VwAyEAt8rlp1knGwjfbcXAYPYAkn0XiLz1x8O4t0YkEhie244=",
+                "keyDetails": "PKIX_ED25519",
+                "validFor": {
+                    "start": "2025-09-23T00:00:00Z"
+                }
+            },
+            "logId": {
+                "keyId": "zxGZFVvd0FEmjR8WrFwMdcAJ9vtaY/QXf44Y1wUeP6A="
+            }
+        }
+    ],
+    "certificateAuthorities": [
+        {
+            "subject": {
+                "organization": "sigstore.dev",
+                "commonName": "sigstore"
+            },
+            "uri": "https://fulcio.sigstore.dev",
+            "certChain": {
+                "certificates": [
+                    {
+                        "rawBytes": "MIIB+DCCAX6gAwIBAgITNVkDZoCiofPDsy7dfm6geLbuhzAKBggqhkjOPQQDAzAqMRUwEwYDVQQKEwxzaWdzdG9yZS5kZXYxETAPBgNVBAMTCHNpZ3N0b3JlMB4XDTIxMDMwNzAzMjAyOVoXDTMxMDIyMzAzMjAyOVowKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABLSyA7Ii5k+pNO8ZEWY0ylemWDowOkNa3kL+GZE5Z5GWehL9/A9bRNA3RbrsZ5i0JcastaRL7Sp5fp/jD5dxqc/UdTVnlvS16an+2Yfswe/QuLolRUCrcOE2+2iA5+tzd6NmMGQwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYBAf8CAQEwHQYDVR0OBBYEFMjFHQBBmiQpMlEk6w2uSu1KBtPsMB8GA1UdIwQYMBaAFMjFHQBBmiQpMlEk6w2uSu1KBtPsMAoGCCqGSM49BAMDA2gAMGUCMH8liWJfMui6vXXBhjDgY4MwslmN/TJxVe/83WrFomwmNf056y1X48F9c4m3a3ozXAIxAKjRay5/aj/jsKKGIkmQatjI8uupHr/+CxFvaJWmpYqNkLDGRU+9orzh5hI2RrcuaQ=="
+                    }
+                ]
+            },
+            "validFor": {
+                "start": "2021-03-07T03:20:29Z",
+                "end": "2022-12-31T23:59:59.999Z"
+            }
+        },
+        {
+            "subject": {
+                "organization": "sigstore.dev",
+                "commonName": "sigstore"
+            },
+            "uri": "https://fulcio.sigstore.dev",
+            "certChain": {
+                "certificates": [
+                    {
+                        "rawBytes": "MIICGjCCAaGgAwIBAgIUALnViVfnU0brJasmRkHrn/UnfaQwCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMjA0MTMyMDA2MTVaFw0zMTEwMDUxMzU2NThaMDcxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEeMBwGA1UEAxMVc2lnc3RvcmUtaW50ZXJtZWRpYXRlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE8RVS/ysH+NOvuDZyPIZtilgUF9NlarYpAd9HP1vBBH1U5CV77LSS7s0ZiH4nE7Hv7ptS6LvvR/STk798LVgMzLlJ4HeIfF3tHSaexLcYpSASr1kS0N/RgBJz/9jWCiXno3sweTAOBgNVHQ8BAf8EBAMCAQYwEwYDVR0lBAwwCgYIKwYBBQUHAwMwEgYDVR0TAQH/BAgwBgEB/wIBADAdBgNVHQ4EFgQU39Ppz1YkEZb5qNjpKFWixi4YZD8wHwYDVR0jBBgwFoAUWMAeX5FFpWapesyQoZMi0CrFxfowCgYIKoZIzj0EAwMDZwAwZAIwPCsQK4DYiZYDPIaDi5HFKnfxXx6ASSVmERfsynYBiX2X6SJRnZU84/9DZdnFvvxmAjBOt6QpBlc4J/0DxvkTCqpclvziL6BCCPnjdlIB3Pu3BxsPmygUY7Ii2zbdCdliiow="
+                    },
+                    {
+                        "rawBytes": "MIIB9zCCAXygAwIBAgIUALZNAPFdxHPwjeDloDwyYChAO/4wCgYIKoZIzj0EAwMwKjEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MREwDwYDVQQDEwhzaWdzdG9yZTAeFw0yMTEwMDcxMzU2NTlaFw0zMTEwMDUxMzU2NThaMCoxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjERMA8GA1UEAxMIc2lnc3RvcmUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAT7XeFT4rb3PQGwS4IajtLk3/OlnpgangaBclYpsYBr5i+4ynB07ceb3LP0OIOZdxexX69c5iVuyJRQ+Hz05yi+UF3uBWAlHpiS5sh0+H2GHE7SXrk1EC5m1Tr19L9gg92jYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRYwB5fkUWlZql6zJChkyLQKsXF+jAfBgNVHSMEGDAWgBRYwB5fkUWlZql6zJChkyLQKsXF+jAKBggqhkjOPQQDAwNpADBmAjEAj1nHeXZp+13NWBNa+EDsDP8G1WWg1tCMWP/WHPqpaVo0jhsweNFZgSs0eE7wYI4qAjEA2WB9ot98sIkoF3vZYdd3/VtWB5b9TNMea7Ix/stJ5TfcLLeABLE4BNJOsQ4vnBHJ"
+                    }
+                ]
+            },
+            "validFor": {
+                "start": "2022-04-13T20:06:15Z"
+            }
+        }
+    ],
+    "ctlogs": [
+        {
+            "baseUrl": "https://ctfe.sigstore.dev/test",
+            "hashAlgorithm": "SHA2_256",
+            "publicKey": {
+                "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbfwR+RJudXscgRBRpKX1XFDy3PyudDxz/SfnRi1fT8ekpfBd2O1uoz7jr3Z8nKzxA69EUQ+eFCFI3zeubPWU7w==",
+                "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+                "validFor": {
+                    "start": "2021-03-14T00:00:00Z",
+                    "end": "2022-10-31T23:59:59.999Z"
+                }
+            },
+            "logId": {
+                "keyId": "CGCS8ChS/2hF0dFrJ4ScRWcYrBY9wzjSbea8IgY2b3I="
+            }
+        },
+        {
+            "baseUrl": "https://ctfe.sigstore.dev/2022",
+            "hashAlgorithm": "SHA2_256",
+            "publicKey": {
+                "rawBytes": "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEiPSlFi0CmFTfEjCUqF9HuCEcYXNKAaYalIJmBZ8yyezPjTqhxrKBpMnaocVtLJBI1eM3uXnQzQGAJdJ4gs9Fyw==",
+                "keyDetails": "PKIX_ECDSA_P256_SHA_256",
+                "validFor": {
+                    "start": "2022-10-20T00:00:00Z"
+                }
+            },
+            "logId": {
+                "keyId": "3T0wasbHETJjGR4cmWc3AqJKXrjePK3/h4pygC8p7o4="
+            }
+        }
+    ],
+    "timestampAuthorities": [
+        {
+            "subject": {
+                "organization": "sigstore.dev",
+                "commonName": "sigstore-tsa-selfsigned"
+            },
+            "uri": "https://timestamp.sigstore.dev/api/v1/timestamp",
+            "certChain": {
+                "certificates": [
+                    {
+                        "rawBytes": "MIICEDCCAZagAwIBAgIUOhNULwyQYe68wUMvy4qOiyojiwwwCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMC4xFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEVMBMGA1UEAxMMc2lnc3RvcmUtdHNhMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE4ra2Z8hKNig2T9kFjCAToGG30jky+WQv3BzL+mKvh1SKNR/UwuwsfNCg4sryoYAd8E6isovVA3M4aoNdm9QDi50Z8nTEyvqgfDPtTIwXItfiW/AFf1V7uwkbkAoj0xxco2owaDAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFIn9eUOHz9BlRsMCRscsc1t9tOsDMB8GA1UdIwQYMBaAFJjsAe9/u1H/1JUeb4qImFMHic6/MBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMIMAoGCCqGSM49BAMDA2gAMGUCMDtpsV/6KaO0qyF/UMsX2aSUXKQFdoGTptQGc0ftq1csulHPGG6dsmyMNd3JB+G3EQIxAOajvBcjpJmKb4Nv+2Taoj8Uc5+b6ih6FXCCKraSqupe07zqswMcXJTe1cExvHvvlw=="
+                    },
+                    {
+                        "rawBytes": "MIIB9zCCAXygAwIBAgIUV7f0GLDOoEzIh8LXSW80OJiUp14wCgYIKoZIzj0EAwMwOTEVMBMGA1UEChMMc2lnc3RvcmUuZGV2MSAwHgYDVQQDExdzaWdzdG9yZS10c2Etc2VsZnNpZ25lZDAeFw0yNTA0MDgwNjU5NDNaFw0zNTA0MDYwNjU5NDNaMDkxFTATBgNVBAoTDHNpZ3N0b3JlLmRldjEgMB4GA1UEAxMXc2lnc3RvcmUtdHNhLXNlbGZzaWduZWQwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQUQNtfRT/ou3YATa6wB/kKTe70cfJwyRIBovMnt8RcJph/COE82uyS6FmppLLL1VBPGcPfpQPYJNXzWwi8icwhKQ6W/Qe2h3oebBb2FHpwNJDqo+TMaC/tdfkv/ElJB72jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSY7AHvf7tR/9SVHm+KiJhTB4nOvzAKBggqhkjOPQQDAwNpADBmAjEAwGEGrfGZR1cen1R8/DTVMI943LssZmJRtDp/i7SfGHmGRP6gRbuj9vOK3b67Z0QQAjEAuT2H673LQEaHTcyQSZrkp4mX7WwkmF+sVbkYY5mXN+RMH13KUEHHOqASaemYWK/E"
+                    }
+                ]
+            },
+            "validFor": {
+                "start": "2025-07-04T00:00:00Z"
+            }
+        }
+    ]
+}

package/dist/verify.d.ts

@@ -0,0 +1,21 @@
+import { type SigstoreRoots } from "./sigstore.js";
+export interface RouterEvidence {
+    tlsPublicKey: string;
+    hpkePublicKey: string;
+    mrtd: string;
+    rtmrs: [string, string, string, string];
+    hardware: string;
+    releaseDigest: string;
+    releaseTag: string;
+    codeMeasurement: {
+        type: string;
+        registers: string[];
+    };
+    tcbStatus: string;
+    collateralExpiresAt: number;
+}
+export interface VerifyOptions {
+    rootDer?: Buffer;
+    sigstore?: SigstoreRoots;
+}
+export declare function verifyRouterDocument(bytes: Uint8Array, nonce: Uint8Array, repo: string, nowSecs: number, options?: VerifyOptions): RouterEvidence;

package/dist/verify.js

@@ -0,0 +1,77 @@
+import { verifyDcap, launchInputsAreZero, reportDataMatches } from "./dcap.js";
+import { checkDocument, isValidRepo, SIGSTORE_CODE_V1, SIGSTORE_HARDWARE_V1, TDX_QUOTE_V1, } from "./document.js";
+import { fail } from "./error.js";
+import { appraiseTdx } from "./policy.js";
+import { INTEL_SGX_ROOT_CA_DER } from "./intel-root.js";
+import { verifyCode, verifyHardware } from "./sigstore.js";
+const HARDWARE_REPO = "tinfoilsh/hardware-measurements";
+const PROFILES = ["small_0d_v011"];
+export function verifyRouterDocument(bytes, nonce, repo, nowSecs, options = {}) {
+    if (!isValidRepo(repo))
+        fail("policy", "trusted repository must be owner/name");
+    const document = checkDocument(bytes, nonce);
+    if (document.cpuFormat !== TDX_QUOTE_V1)
+        fail("policy", "expected a TDX quote");
+    if (document.deviceCount !== 0)
+        fail("policy", "the router carries no device evidence");
+    const dcap = verifyDcap(document.quote, document.collateral, nowSecs, options.rootDer ?? INTEL_SGX_ROOT_CA_DER);
+    reportDataMatches(dcap.quote, document.reportData);
+    launchInputsAreZero(dcap.quote.td);
+    if (dcap.tcbStatus !== "UpToDate")
+        fail("tdx", `TCB status ${dcap.tcbStatus} is not UpToDate`);
+    appraiseTdx(dcap.quote.td, dcap.quote.version, dcap.quote.qeVendorId, dcap.evalDataNumber);
+    const code = verifyCodeBundle(document.collateral, repo, options.sigstore);
+    const quote = dcap.quote.td;
+    if (code.rtmr1 !== quote.rtmrs[1].toString("hex") || code.rtmr2 !== quote.rtmrs[2].toString("hex")) {
+        fail("provenance", "code measurements do not match the quote");
+    }
+    const hardware = matchHardware(document.collateral, quote.mrTd.toString("hex"), quote.rtmrs[0].toString("hex"), options.sigstore);
+    return {
+        tlsPublicKey: document.tlsPublicKey,
+        hpkePublicKey: document.hpkePublicKey,
+        mrtd: quote.mrTd.toString("hex"),
+        rtmrs: quote.rtmrs.map((value) => value.toString("hex")),
+        hardware,
+        releaseDigest: code.digest,
+        releaseTag: code.tag,
+        codeMeasurement: {
+            type: "https://tinfoil.sh/predicate/snp-tdx-multiplatform/v1",
+            registers: [code.snp, code.rtmr1, code.rtmr2],
+        },
+        tcbStatus: dcap.tcbStatus,
+        collateralExpiresAt: dcap.collateralExpiresAt,
+    };
+}
+function verifyCodeBundle(collateral, repo, roots) {
+    const entry = collateral.find((item) => item.role === "reference-values" && item.format === SIGSTORE_CODE_V1);
+    if (entry === undefined)
+        fail("provenance", "missing code provenance");
+    const claimed = string(entry.data.repo);
+    if (claimed !== repo)
+        fail("provenance", `collateral names ${claimed}, not ${repo}`);
+    const tag = string(entry.data.tag);
+    const digest = string(entry.data.digest);
+    return verifyCode(entry.data.sigstore_bundle, repo, tag.length === 0 ? undefined : tag, digest, roots);
+}
+function matchHardware(collateral, mrtd, rtmr0, roots) {
+    const entry = collateral.find((item) => item.role === "reference-values" && item.format === SIGSTORE_HARDWARE_V1);
+    if (entry === undefined)
+        fail("provenance", "missing hardware measurements");
+    if (entry.data.repo !== HARDWARE_REPO)
+        fail("provenance", "unexpected hardware catalog publisher");
+    const digest = string(entry.data.digest);
+    const measurements = verifyHardware(entry.data.sigstore_bundle, HARDWARE_REPO, digest, roots);
+    const match = measurements.find((item) => {
+        const profile = item.name.split("@")[0] ?? "";
+        return PROFILES.includes(profile) && item.mrtd === mrtd && item.rtmr0 === rtmr0;
+    });
+    if (match === undefined)
+        fail("policy", "firmware matches no accepted router profile");
+    return match.name;
+}
+function string(value) {
+    if (typeof value !== "string")
+        fail("provenance", "collateral field is not a string");
+    return value;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAC;AAE/E,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,QAAQ,GAAG,CAAC,eAAe,CAAC,CAAC;AAoBnC,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,KAAiB,EACjB,IAAY,EACZ,OAAe,EACf,UAAyB,EAAE;IAE3B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,IAAI,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,SAAS,KAAK,YAAY;QAAE,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;IAChF,IAAI,QAAQ,CAAC,WAAW,KAAK,CAAC;QAAE,IAAI,CAAC,QAAQ,EAAE,uCAAuC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAChH,iBAAiB,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;IACnD,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,SAAS,KAAK,UAAU;QAAE,IAAI,CAAC,KAAK,EAAE,cAAc,IAAI,CAAC,SAAS,kBAAkB,CAAC,CAAC;IAC/F,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,YAAY,EAAE,0CAA0C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnI,OAAO;QACL,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAqC;QAC5F,QAAQ;QACR,aAAa,EAAE,IAAI,CAAC,MAAM;QAC1B,UAAU,EAAE,IAAI,CAAC,GAAG;QACpB,eAAe,EAAE;YACf,IAAI,EAAE,uDAAuD;YAC7D,SAAS,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC;SAC9C;QACD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA0D,EAAE,IAAY,EAAE,KAAqB;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC;IAC9G,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,EAAE,oBAAoB,OAAO,SAAS,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AACzG,CAAC;AAED,SAAS,aAAa,CACpB,UAA0D,EAC1D,IAAY,EACZ,KAAa,EACb,KAAqB;IAErB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAoB,CAAC,CAAC;IAClH,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,aAAa;QAAE,IAAI,CAAC,YAAY,EAAE,uCAAuC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,EAAE,6CAA6C,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,42 @@
 {
   "name": "@aptos-labs/inference-verifier",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Offline attestation verifier for the Aptos inference router.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aptos-labs/aptos-inference-sdk-ts.git",
+    "directory": "packages/verifier"
+  },
+  "homepage": "https://github.com/aptos-labs/aptos-inference-sdk-ts/tree/main/packages/verifier#readme",
+  "bugs": {
+    "url": "https://github.com/aptos-labs/aptos-inference-sdk-ts/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "dependencies": {
+    "@peculiar/x509": "1.14.3"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3",
+    "vitest": "3.2.4"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
 }