@attested-intelligence/aga-mcp-server 3.0.1 → 3.3.0

package/dist/sep/verify.js

@@ -1,21 +1,27 @@
 /**
- * SEP §6 verifier — a faithful TypeScript port of the normative reference
- * aga-receipt-spec/verify/verify-sep.mjs. Same six steps, same semantics, same crypto
- * (node:crypto), so its verdicts match the reference byte-for-byte. See SPEC_PRECEDENCE.md.
+ * SEP §6 verifier — the ONE agile + hardened verifier (ALGORITHM_AGILITY_SPEC.md).
+ *
+ * The six-step construction and the H1–H11 hardening below are a faithful port of the normative
+ * reference aga-receipt-spec/verify/verify-sep.mjs and are PROFILE-INVARIANT. Only the signature
+ * primitive and the key well-formedness are dispatched per profile (./profiles): v1 Ed25519
+ * (node:crypto) and v2 ML-DSA-65+Ed25519 composite (AND-verify). The verdict is a trichotomy:
+ *   VERIFIED (exit 0) | FAILED (exit 1) | UNSUPPORTED_PROFILE (exit 3).
+ * UNSUPPORTED_PROFILE is returned — with NO soundness claim — when the bundle declares a registered
+ * profile this verifier does not implement (e.g. a v1-only build handed a v2 bundle). An UNKNOWN /
+ * unregistered algorithm is FAILED, never a false VERIFIED, never a partial verify.
  */
 import { canonicalize } from './canonical.js';
-import { sha256Hex, wellFormedKey, verifyHex, isHex } from './crypto.js';
+import { sha256Hex, isHex } from './crypto.js';
 import { nodeHash } from './merkle.js';
-import { SEP_ALGORITHM, SEP_RECEIPT_FIELDS } from './receipt.js';
+import { SEP_RECEIPT_FIELDS } from './receipt.js';
 import { SEP_CHECKPOINT_FIELDS } from './checkpoint.js';
+import { isRegisteredProfile, validPublicKeyForProfile, verifyForProfile, ALL_PROFILES, REGISTERED_PROFILES, } from './profiles.js';
 const leaf = (r) => sha256Hex(canonicalize(r));
 const strip = (o, f) => Object.fromEntries(Object.entries(o).filter(([k]) => k !== f));
 /**
- * Canonical SEP timestamp validation (cross-stack unified). A timestamp is VALID iff it
- * matches the EXACT fixed-width UTC form Date.prototype.toISOString() emits AND its calendar
- * fields are in range — computed with PURE INTEGER ARITHMETIC, no Date/parser, so every
- * verifier reaches a byte-identical verdict. Uses the literal [0-9] class (not \d, which
- * matches Unicode digits and would diverge from the other stacks).
+ * Canonical SEP timestamp validation (cross-stack unified). A timestamp is VALID iff it matches the
+ * EXACT fixed-width UTC form Date.prototype.toISOString() emits AND its calendar fields are in range —
+ * pure integer arithmetic, no Date/parser, so every verifier reaches a byte-identical verdict.
  */
 const TS_RE = /^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\.[0-9]{3}Z$/;
 const isLeap = (y) => y % 4 === 0 && (y % 100 !== 0 || y % 400 === 0);
@@ -36,10 +42,9 @@ const isValidTimestamp = (ts) => {
         && second >= 0 && second <= 59;
 };
 /**
- * Strict-schema floor: the object must carry EXACTLY the canonical fields — no extra,
- * unknown, or "__proto__"-injected keys (Object.keys counts a JSON-parsed "__proto__" as
- * an own key, so a 16th key fails the count). This is the cross-stack-robust rule: every
- * conformant verifier rejects the identical bundles.
+ * Strict-schema floor: the object must carry EXACTLY the canonical fields — no extra, unknown, or
+ * "__proto__"-injected keys (Object.keys counts a JSON-parsed "__proto__" as an own key, so a 16th
+ * key fails the count). Cross-stack-robust: every conformant verifier rejects the identical bundles.
  */
 const hasExactKeys = (o, fields) => {
     if (!o || typeof o !== 'object' || Array.isArray(o))
@@ -47,24 +52,41 @@ const hasExactKeys = (o, fields) => {
     const keys = Object.keys(o);
     return keys.length === fields.length && fields.every((f) => Object.prototype.hasOwnProperty.call(o, f));
 };
-export function verifySepBundle(bundle, expectedPublicKey) {
-    // Robust contract: a malformed/hostile bundle (e.g. a receipt with a deeply-nested value
-    // that overflows the depth-bounded canonicalize) yields FAILED, never a thrown exception.
-    const pinned = isHex(expectedPublicKey, 64);
+export function verifySepBundle(bundle, expectedPublicKey, opts) {
+    const supported = opts?.supportedProfiles ?? ALL_PROFILES;
+    const algorithm = typeof bundle?.algorithm === 'string' ? bundle.algorithm : '';
+    // Trichotomy: a REGISTERED profile this verifier does not implement -> UNSUPPORTED_PROFILE. No
+    // soundness claim is made (the verifier neither passes nor fails the bundle's content). An unknown /
+    // unregistered algorithm falls through to the structural floor below and FAILS.
+    if (isRegisteredProfile(algorithm) && !supported.includes(algorithm)) {
+        return {
+            verdict: 'UNSUPPORTED_PROFILE',
+            summary: `UNSUPPORTED_PROFILE — this verifier does not implement profile '${algorithm}' (v${REGISTERED_PROFILES[algorithm]}); no soundness claim is made`,
+            issuerVerified: false,
+            pinned: false,
+            steps: [{ name: 'profile_support', ok: false }],
+        };
+    }
+    // Robust contract: a malformed/hostile bundle yields FAILED, never a thrown exception.
+    let pinned = false;
     try {
         const steps = [];
         const add = (name, ok) => { steps.push({ name, ok }); return ok; };
         const receipts = Array.isArray(bundle?.receipts) ? bundle.receipts : [];
         const proofs = Array.isArray(bundle?.merkle_proofs) ? bundle.merkle_proofs : [];
         const pub = bundle?.public_key;
-        // §6.1 structural floor — incl. STRICT receipt schema (exactly the canonical fields;
-        // rejects extra/unknown keys and "__proto__" injection on every signed receipt).
-        add('structural', bundle?.algorithm === SEP_ALGORITHM && wellFormedKey(pub)
+        // A pin is honored only if it is well-formed for the bundle's (supported, registered) profile;
+        // a malformed pin is an integrity-only check (pinned=false), never a silent provenance pass.
+        pinned = isRegisteredProfile(algorithm) && supported.includes(algorithm)
+            && typeof expectedPublicKey === 'string' && validPublicKeyForProfile(algorithm, expectedPublicKey);
+        // §6.1 structural floor — supported registered profile + profile-valid key + STRICT receipt schema
+        // (exactly the canonical fields; rejects extra/unknown keys and "__proto__" injection).
+        add('structural', isRegisteredProfile(algorithm) && supported.includes(algorithm) && validPublicKeyForProfile(algorithm, pub)
             && receipts.length > 0 && proofs.length === receipts.length
             && receipts.every((r) => hasExactKeys(r, SEP_RECEIPT_FIELDS)));
-        // §6.2 receipt signatures (against the bundle key; provenance handled in §6.6)
-        add('receipt_signatures', receipts.length > 0 && receipts.every((r) => verifyHex(pub, canonicalize(strip(r, 'signature')), r.signature)));
-        // §6.3 chain + ordering
+        // §6.2 receipt signatures, verified under the bundle's profile primitive (provenance is §6.6)
+        add('receipt_signatures', receipts.length > 0 && receipts.every((r) => verifyForProfile(algorithm, pub, canonicalize(strip(r, 'signature')), r.signature)));
+        // §6.3 chain + ordering — canonical fixed-width timestamps, non-decreasing (lexicographic compare)
         const leaves = receipts.map(leaf);
         let chain = receipts.length > 0;
         let prevTs = null;
@@ -72,9 +94,6 @@ export function verifySepBundle(bundle, expectedPublicKey) {
             const expectPrev = i === 0 ? '' : leaves[i - 1];
             if ((receipts[i].previous_receipt_hash || '') !== expectPrev)
                 chain = false;
-            // Canonical timestamps: each must match the fixed-width UTC form and be calendar-valid
-            // (pure integer arithmetic, no Date parser). Because the form is fixed-width zero-padded
-            // UTC, non-decreasing ordering is a PLAIN STRING (lexicographic) compare; EQUAL allowed.
             const ts = receipts[i].timestamp;
             if (!isValidTimestamp(ts))
                 chain = false;
@@ -85,7 +104,10 @@ export function verifySepBundle(bundle, expectedPublicKey) {
             }
         }
         add('chain_and_ordering', chain);
-        // §6.4 merkle: recompute leaf from content, walk proof, single root, index bijection
+        // §6.4 merkle: recompute leaf from content, walk proof, single root, index bijection. directions is
+        // UNSIGNED — require a well-formed array of EXACTLY "left"/"right" tokens (same length as siblings),
+        // and each sibling a lowercase 64-hex (an uppercase sibling decodes to the same bytes and would VERIFY
+        // on a case-insensitive stack while Python FAILS — the cross-stack split this guard closes).
         let root = null;
         let merkle = proofs.length === receipts.length && proofs.length > 0;
         const seen = new Set();
@@ -96,18 +118,14 @@ export function verifySepBundle(bundle, expectedPublicKey) {
             if (recomputed === null || recomputed !== p.leaf_hash)
                 merkle = false;
             let cur = p.leaf_hash;
-            // directions is UNSIGNED, so it must be a well-formed array of EXACTLY "left"/"right" tokens
-            // (same length as siblings). Otherwise the merkle step FAILS — without this, JS/Go would treat a
-            // rewritten token (e.g. "right"->"RIGHT") as a "right" fallthrough and still walk to the correct
-            // root and VERIFY, while Python FAILS: a cross-stack disagreement. (Matches Python's strictness.)
             const sib = Array.isArray(p.siblings) ? p.siblings : [];
             const dir = Array.isArray(p.directions) ? p.directions : [];
-            if (dir.length !== sib.length || !dir.every((d) => d === 'left' || d === 'right'))
+            if (dir.length !== sib.length || !dir.every((d) => d === 'left' || d === 'right') || !sib.every((s) => isHex(s, 64)))
                 merkle = false;
             for (let j = 0; j < sib.length; j++)
                 cur = dir[j] === 'left' ? nodeHash(sib[j], cur) : nodeHash(cur, sib[j]);
             if (p.merkle_root !== cur)
-                merkle = false; // the proof's own claimed root must match what it walks to (L-7)
+                merkle = false; // the proof's own claimed root must match what it walks to
             if (root === null)
                 root = cur;
             else if (root !== cur)
@@ -115,40 +133,40 @@ export function verifySepBundle(bundle, expectedPublicKey) {
         }
         const bijection = seen.size === receipts.length && [...seen].every((n) => Number.isInteger(n) && n >= 0 && n < receipts.length);
         add('merkle_and_bijection', merkle && bijection);
-        // §6.5 mandatory signed checkpoint — STRICT schema (exactly the canonical fields) + the
-        // bound algorithm value, then signature + root/count/head binding.
+        // §6.5 mandatory signed checkpoint — STRICT schema (exactly the canonical fields) + the SAME profile
+        // as the bundle, then signature (profile primitive) + root/count/head binding.
         const cp = bundle?.checkpoint;
         let cpOk = false;
         if (hasExactKeys(cp, SEP_CHECKPOINT_FIELDS)) {
-            cpOk = cp.algorithm === SEP_ALGORITHM
-                && verifyHex(pub, canonicalize(strip(cp, 'signature')), cp.signature)
+            cpOk = cp.algorithm === algorithm
+                && verifyForProfile(algorithm, pub, canonicalize(strip(cp, 'signature')), cp.signature)
                 && root !== null && cp.merkle_root === root
                 && cp.leaf_count === receipts.length
                 && cp.head_leaf_hash === (leaves.length ? leaves[leaves.length - 1] : '');
         }
         add('signed_checkpoint', cpOk);
-        // §6.5b cross-field consistency: per-receipt identity + the UNSIGNED envelope must agree
-        // with the signed/recomputed values, so nothing outside the signed objects can mislead a
-        // consumer that reads the envelope (M-1/M-2/L-3).
+        // §6.5b cross-field consistency: per-receipt identity + the UNSIGNED envelope must agree with the
+        // signed/recomputed values, so nothing outside the signed objects can mislead an envelope reader.
         const cpGatewayId = (cp && typeof cp === 'object') ? cp.gateway_id : undefined;
         const cpGeneratedAt = (cp && typeof cp === 'object') ? cp.generated_at : undefined;
         add('envelope_consistency', receipts.length > 0
-            && receipts.every((r) => r.public_key === pub) // every receipt is signed under the bundle key (L-3)
-            && receipts.every((r) => r.gateway_id === bundle?.gateway_id) // receipts ↔ envelope gateway_id
-            && cpGatewayId === bundle?.gateway_id // checkpoint ↔ envelope gateway_id (M-2)
-            && bundle?.generated_at === cpGeneratedAt // envelope generated_at ↔ signed checkpoint (T6)
-            && root !== null && bundle?.merkle_root === root); // envelope merkle_root ↔ recomputed (M-1)
-        // §6.6 provenance (only when a key is pinned)
+            && receipts.every((r) => r.public_key === pub)
+            && receipts.every((r) => r.gateway_id === bundle?.gateway_id)
+            && cpGatewayId === bundle?.gateway_id
+            && bundle?.generated_at === cpGeneratedAt
+            && root !== null && bundle?.merkle_root === root);
+        // §6.6 provenance (only when a well-formed key is pinned)
         const issuerVerified = pinned && pub === expectedPublicKey;
         if (pinned)
             add('gateway_key_match', issuerVerified);
         const verdict = steps.every((s) => s.ok) ? 'VERIFIED' : 'FAILED';
         const failed = steps.filter((s) => !s.ok).map((s) => s.name);
+        const profileTag = `${algorithm} (v${REGISTERED_PROFILES[algorithm] ?? '?'})`;
         const summary = verdict === 'FAILED'
             ? `FAILED — bundle did not verify (failed: ${failed.join(', ') || 'unknown'})`
             : pinned
-                ? 'VERIFIED (provenance verified — issued by the pinned gateway key)'
-                : 'VERIFIED (integrity only — NOT provenance; pass the gateway key to prove who issued it)';
+                ? `VERIFIED (${profileTag}; provenance verified — issued by the pinned gateway key)`
+                : `VERIFIED (${profileTag}; integrity only — NOT provenance; pass the gateway key to prove who issued it)`;
         return { verdict, summary, issuerVerified, pinned, steps };
     }
     catch (e) {

package/dist/sep/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAYxD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,CAAS,EAA2B,EAAE,CAC/E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,KAAK,GAAG,oEAAoE,CAAC;AACnF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CACnD,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,CAAC,EAAW,EAAW,EAAE;IAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE;WAC3B,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;WAC3C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;WACvB,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;WAC3B,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,MAAyB,EAAW,EAAE;IACtE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,iBAA0B;IACrE,yFAAyF;IACzF,0FAA0F;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC;QACL,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAW,EAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAW,MAAM,EAAE,UAAU,CAAC;QAEvC,qFAAqF;QACrF,iFAAiF;QACjF,GAAG,CAAC,YAAY,EACd,MAAM,EAAE,SAAS,KAAK,aAAa,IAAI,aAAa,CAAC,GAAG,CAAC;eACtD,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;eACxD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAEjE,+EAA+E;QAC/E,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE1I,wBAAwB;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC5E,uFAAuF;YACvF,yFAAyF;YACzF,yFAAyF;YACzF,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;iBACpC,CAAC;gBAAC,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM;oBAAE,KAAK,GAAG,KAAK,CAAC;gBAAC,MAAM,GAAG,EAAE,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAEjC,qFAAqF;QACrF,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS;gBAAE,MAAM,GAAG,KAAK,CAAC;YACtE,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;YACtB,6FAA6F;YAC7F,iGAAiG;YACjG,iGAAiG;YACjG,kGAAkG;YAClG,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,CAAC;gBAAE,MAAM,GAAG,KAAK,CAAC;YAClG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC,CAAU,iEAAiE;YACrH,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,GAAG,GAAG,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChI,GAAG,CAAC,sBAAsB,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;QAEjD,wFAAwF;QACxF,mEAAmE;QACnE,MAAM,EAAE,GAAG,MAAM,EAAE,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC,SAAS,KAAK,aAAa;mBAChC,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;mBAClE,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,KAAK,IAAI;mBACxC,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM;mBACjC,EAAE,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE/B,yFAAyF;QACzF,yFAAyF;QACzF,kDAAkD;QAClD,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChH,GAAG,CAAC,sBAAsB,EACxB,QAAQ,CAAC,MAAM,GAAG,CAAC;eAChB,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAe,qDAAqD;eAC/G,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,CAAC,CAAC,iCAAiC;eAC5F,WAAW,KAAK,MAAM,EAAE,UAAU,CAAyB,yCAAyC;eACpG,MAAM,EAAE,YAAY,KAAK,aAAa,CAAqB,iDAAiD;eAC5G,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAY,0CAA0C;QAE1G,8CAA8C;QAC9C,MAAM,cAAc,GAAG,MAAM,IAAI,GAAG,KAAK,iBAAiB,CAAC;QAC3D,IAAI,MAAM;YAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ;YAClC,CAAC,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;YAC9E,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,mEAAmE;gBACrE,CAAC,CAAC,yFAAyF,CAAC;QAChG,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3L,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/sep/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,mBAAmB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,GACnG,MAAM,eAAe,CAAC;AAiBvB,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,MAAM,KAAK,GAAG,CAAC,CAA0B,EAAE,CAAS,EAA2B,EAAE,CAC/E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEjE;;;;GAIG;AACH,MAAM,KAAK,GAAG,oEAAoE,CAAC;AACnF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC;AACvF,MAAM,WAAW,GAAG,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE,CACnD,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,CAAC,EAAW,EAAW,EAAE;IAChD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,OAAO,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE;WAC3B,GAAG,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;WAC3C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;WACvB,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE;WAC3B,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,EAAE,CAAC;AACnC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,CAAU,EAAE,MAAyB,EAAW,EAAE;IACtE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAA4B,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1G,CAAC,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,MAAW,EAAE,iBAA0B,EAAE,IAAoB;IAC3F,MAAM,SAAS,GAAG,IAAI,EAAE,iBAAiB,IAAI,YAAY,CAAC;IAC1D,MAAM,SAAS,GAAW,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,SAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;IAEpG,+FAA+F;IAC/F,qGAAqG;IACrG,gFAAgF;IAChF,IAAI,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO;YACL,OAAO,EAAE,qBAAqB;YAC9B,OAAO,EAAE,mEAAmE,SAAS,OAAO,mBAAmB,CAAC,SAAS,CAAC,+BAA+B;YACzJ,cAAc,EAAE,KAAK;YACrB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAW,EAAW,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,QAAQ,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,MAAM,GAAU,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,GAAG,GAAW,MAAM,EAAE,UAAU,CAAC;QAEvC,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;eACnE,OAAO,iBAAiB,KAAK,QAAQ,IAAI,wBAAwB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAErG,mGAAmG;QACnG,wFAAwF;QACxF,GAAG,CAAC,YAAY,EACd,mBAAmB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,wBAAwB,CAAC,SAAS,EAAE,GAAG,CAAC;eACxG,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;eACxD,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAEjE,8FAA8F;QAC9F,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE5J,mGAAmG;QACnG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAChC,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,IAAI,EAAE,CAAC,KAAK,UAAU;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;iBACpC,CAAC;gBAAC,IAAI,MAAM,KAAK,IAAI,IAAI,EAAE,GAAG,MAAM;oBAAE,KAAK,GAAG,KAAK,CAAC;gBAAC,MAAM,GAAG,EAAE,CAAC;YAAC,CAAC;QAC1E,CAAC;QACD,GAAG,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAEjC,oGAAoG;QACpG,qGAAqG;QACrG,uGAAuG;QACvG,6FAA6F;QAC7F,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,CAAC,CAAC,SAAS;gBAAE,MAAM,GAAG,KAAK,CAAC;YACtE,IAAI,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC;YACtB,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,MAAM,GAAG,GAAa,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAAE,MAAM,GAAG,KAAK,CAAC;YACrI,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7G,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC,CAAU,2DAA2D;YAC/G,IAAI,IAAI,KAAK,IAAI;gBAAE,IAAI,GAAG,GAAG,CAAC;iBAAM,IAAI,IAAI,KAAK,GAAG;gBAAE,MAAM,GAAG,KAAK,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChI,GAAG,CAAC,sBAAsB,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC;QAEjD,qGAAqG;QACrG,+EAA+E;QAC/E,MAAM,EAAE,GAAG,MAAM,EAAE,UAAU,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,YAAY,CAAC,EAAE,EAAE,qBAAqB,CAAC,EAAE,CAAC;YAC5C,IAAI,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS;mBAC5B,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC;mBACpF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,KAAK,IAAI;mBACxC,EAAE,CAAC,UAAU,KAAK,QAAQ,CAAC,MAAM;mBACjC,EAAE,CAAC,cAAc,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAE/B,kGAAkG;QAClG,kGAAkG;QAClG,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,MAAM,aAAa,GAAG,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAE,EAA8B,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QAChH,GAAG,CAAC,sBAAsB,EACxB,QAAQ,CAAC,MAAM,GAAG,CAAC;eAChB,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC;eAC3C,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,EAAE,UAAU,CAAC;eAC1D,WAAW,KAAK,MAAM,EAAE,UAAU;eAClC,MAAM,EAAE,YAAY,KAAK,aAAa;eACtC,IAAI,KAAK,IAAI,IAAI,MAAM,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC;QAEpD,0DAA0D;QAC1D,MAAM,cAAc,GAAG,MAAM,IAAI,GAAG,KAAK,iBAAiB,CAAC;QAC3D,IAAI,MAAM;YAAE,GAAG,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,GAAG,SAAS,MAAM,mBAAmB,CAAC,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC;QAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,QAAQ;YAClC,CAAC,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG;YAC9E,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,aAAa,UAAU,2DAA2D;gBACpF,CAAC,CAAC,aAAa,UAAU,iFAAiF,CAAC;QAC/G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,kDAAkD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC3L,CAAC;AACH,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@attested-intelligence/aga-mcp-server",
-  "version": "3.0.1",
-  "description": "MCP server for cryptographic AI agent governance. Seal policy artifacts, enforce at runtime, prove with signed receipts and offline-verifiable evidence bundles.",
+  "version": "3.3.0",
+  "description": "MCP governance proxy and evidence engine for AI agent tool calls: evaluate each call against a sealed policy, permit or deny it at the proxy boundary, and prove every decision with signed, offline-verifiable evidence bundles.",
   "author": "Attested Intelligence Holdings LLC",
   "license": "MIT",
   "homepage": "https://attestedintelligence.com/technology",
@@ -15,6 +15,21 @@
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./verify": {
+      "types": "./dist/sep/verify.d.ts",
+      "default": "./dist/sep/verify.js"
+    },
+    "./sep": {
+      "types": "./dist/sep/index.d.ts",
+      "default": "./dist/sep/index.js"
+    },
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist/",
     "README.md",
@@ -39,28 +54,35 @@
     "test:proxy": "vitest run tests/proxy/",
     "test:conformance": "node fixtures/run-conformance.mjs",
     "conformance:cross-stack": "node fixtures/cross-stack/run-all-stacks.mjs",
+    "conformance:cross-stack-v2": "node fixtures/cross-stack/run-v2-stacks.mjs",
     "check:pack": "node scripts/check-pack.mjs",
     "check": "npm run build && npm run lint && npm run test && npm run test:conformance && npm run check:pack",
     "proxy": "tsx src/proxy/index.ts",
     "proxy:start": "tsx src/proxy/index.ts start",
     "demo": "tsx scripts/demo.ts",
     "benchmark": "tsx scripts/benchmark.ts",
-    "verify": "cd independent-verifier && npm test",
+    "verify": "cd independent-verifier && npm ci --no-audit --no-fund && npm test",
     "lint": "tsc --noEmit",
     "prepublishOnly": "npm run build && npm run test && npm run test:conformance && npm run check:pack"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.0",
-    "@noble/hashes": "^1.7.0",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "@noble/ed25519": "2.1.0",
+    "@noble/hashes": "1.6.1",
+    "@noble/post-quantum": "0.6.1",
     "commander": "^14.0.3",
     "zod": "^3.24.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^11.7.0"
   },
+  "overrides": {
+    "hono": ">=4.12.25"
+  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.12",
     "@types/node": "^22.10.0",
+    "canonicalize": "^2.1.0",
     "tsx": "^4.19.0",
     "typescript": "^5.7.0",
     "vitest": "^2.1.0"
@@ -77,8 +99,7 @@
     "agentic-ai",
     "attestation",
     "governance",
-    "cryptographic-enforcement",
-    "runtime-integrity",
+    "policy-proxy",
     "evidence-bundles",
     "ed25519",
     "policy-artifacts",